[MaximumTrainer]

Closes #99
Closes #100
Closes #101
Closes #102

Works through the four open issues on the board. Each is a separate commit.

#99 — Rate limiters are global rather than per-caller

Every policy was a single limiter shared by all callers, so one client exhausting a budget locked out every other. On session-start — anonymous by design and the entry point of every journey — 100 requests a minute denied service to all applicants.

• Each policy now partitions: session-start by client address, analytics-ingest by the applicant session in the token, the operator policies by principal. Keys are prefixed by kind so an address cannot collide with a session id.
• X-Forwarded-For is honoured only from a configured proxy. The ASP.NET loopback defaults are cleared: nothing is trusted until named in ForwardedHeaders:KnownProxies / KnownNetworks.
• A global ceiling runs alongside the per-caller policies so a distributed flood still has a bound.
• The runbook claimed limits were already per-IP. It now describes the real partitioning, the proxy configuration, and that counters are per-instance rather than cluster-wide.
• The general policy was declared, partitioned and configurable — and attached to nothing, leaving every controller endpoint bar three unlimited while appearing covered. It is now the fallback wherever no specific policy is named. Not via RequireRateLimiting on the controller group: that overrode the action-level attributes, so session-start silently ran under the general budget instead of its own. A test pins the precedence.
• Health checks stay outside it — throttling what a load balancer polls turns a traffic spike into an instance being pulled from service.

#100 — RabbitMqSessionEventTransport has no test coverage

The adapter that carries session events between replicas had no test of any kind. SessionEventEmitterTests covered the emitter and the port through an in-process fake; the only implementation that runs in a real deployment was unverified.

• Unit tests for the wire format, the poison-message path and the lifecycle guard. The poison path moved out of the consumer lambda into DeliverAsync so it can be tested without a broker.
• Broker-backed tests for the deployment-shaped case (publish through one transport, receive on another) and that a malformed body on the wire does not stop the consumer.
• Recovery was assumed from client defaults. It is now stated explicitly and proven — the recovery test drops the connection from the broker side, which is the only way to get one: the client treats an application-initiated close as deliberate and does not recover from it. Verified the test is not vacuous by flipping AutomaticRecoveryEnabled off and watching it fail.
• Broker tests skip with a clear reason when nothing is listening, so dotnet test stays dependency-free. CI declares a rabbitmq:3-management service container and sets REQUIRE_BROKER_TESTS=1, which turns a missing broker into a failure rather than a silent skip.

#101 — Applicant session tokens cannot be refreshed or revoked

• Renewal. Step submission returns a replacement token. Activity extends the credential, so no separate refresh endpoint is added.
• Revocation. The ownership requirement now carries read/write intent. Writes against a Completed or Abandoned session are refused for an applicant token; reads still serve the completion screen. Analytics ingest applies the same rule. Operators are unaffected. Abandon stays a read so its documented idempotency holds.
• Frontend. Stores each renewal, drops the token when the journey completes, and distinguishes a spent credential (401 expired, 403 terminal) from a server fault — showing "your session has expired, start again" instead of a generic error banner.

#102 — The persisted analytics event trail has no operator UI

SessionDetail now renders the trail beside the submissions it already showed: events in occurrence order, each with type, step, absolute timestamp, source, payload summary, and the gap since the previous event.

• Server and client events are distinguished by label as well as styling.
• A gap is never rendered negative — a browser-timestamped client event can land fractionally before the server event it followed.
• Both empty states are named rather than left blank: a trail with no client events is normal, and an empty trail may be a session whose events aged past retention.
• Read through operatorFetch and the admin session cookie; the applicant page still never requests it, and the existing assertion in App.routing.test.tsx still holds.

Verification

Backend, no broker	343 passed, 3 skipped
Backend, broker up, REQUIRE_BROKER_TESTS=1	346 passed, 0 skipped
Frontend vitest	175 passed (was 150)
Frontend lint + build	clean
Release build of OpenOnboarding.slnx	0 errors

Baseline before this work was 300 backend / 150 frontend.

Noted, not fixed

UploadDocuments and GetDocument on WorkflowController have [Authorize(Policy = "ApplicantOrOperator")] but no resource-based ownership check — unlike every other session endpoint. An applicant token for session A appears able to upload documents against session B, and GetDocument takes a fileId with no session scoping at all. Out of scope for these four issues; flagging it for a separate one.

🤖 Generated with Claude Code