Admission keyed by FIX SenderCompID

The ingestion edge had an obvious identity available before the FIX parser ran: the peer address on the TCP connection. That was the wrong key for admission control. Multiple counterparties can arrive through the same NAT, proxy, or cross-connect, and the rate limiter would treat them as one caller. A single noisy session could spend the shared Redis window while quieter sessions from the same path were still within their own expected rate.

The platform contract now keys Allow by the authenticated FIX SenderCompID. The ingestion worker owns that extraction: it binds the session to a counterparty identifier during logon, normalizes the value used in limiter calls, and rejects traffic that has not established the session identity. The distributed rate limiter keeps the same sliding-window implementation and treats the key as opaque; its job is still to trim expired hits, count the live range, and admit or reject the candidate request.

That split matters because it keeps ownership aligned with the data each service actually sees. The worker understands FIX session state and can decide which SenderCompID is valid for a connection. The limiter understands distributed counters and can enforce the same window across worker replicas. The combined behavior is per-counterparty admission at the ingestion edge without giving each worker a private quota or moving FIX-specific parsing into the limiter.