Unauthenticated sync reads are limited to 600 per minute per caller address (routes/mod.rs:391), and repo.getRecord counts against it. An indexer reading the whole server from one address can't finish a restart in reasonable time at 10x.
Measured on loopback at 73ddde8: 600 reads, then 429 with Retry-After: 60. A vibescrobble index restart costs 2–3 counted reads per account:
| accounts | reads | time at 600/min |
|---|---|---|
| 272 (today) | 816 | 1.4 min |
| 2,700 (10x) | 5,400–8,100 | 9–13.5 min |
| 5,000 (cap) | 10,000–15,000 | 17–25 min |
On the vibescrobble side the same budget left 32% of a 10x board empty after the index gave up (https://tangled.org/permadeath.com/vibescrobble.com/issues/65). Relays doing a full getRepo resync from one address face the same wall.
Options: a configured allowance for known indexer or relay addresses, as its own key with a documented range; a higher budget for cheap reads (getRecord, getLatestCommit) than for getRepo; or a token-bucket burst sized for one full pass over the roster.
Addressed in #1243. The per-address budget is now
[capacity] sync_reads_per_minute(default 600, range 60 to 60,000), so an operator can size it for one full pass over the roster. A newsync_reads_in_flight_per_address(default 8 of the 32 the server runs at once, range 1 to 32) stops one fast address from holding every read while relays wait. The defaults are unchanged, so the 13-minute pass at 10x stays until a deployment raises the budget.