fix: harden rate limiting, bound waits and optimize 10.2.0

[KSemenenko]

Closes rate-limit bypasses in HTTP, SignalR and grain filters, isolates policy quotas, and preserves permit ownership through cancellation, failed configuration and concurrent disposal. Updates dependencies/tools and releases version 10.2.0.

Acquisition now carries a scalar server wait budget. Native queue and configuration waits expire locally even when Orleans has CancelRequestOnTimeout=false. A generated bounded proxy supplies the budget without a global outgoing filter, keeping release and unrelated calls on Orleans' direct dispatch path. The immediate path creates no client deadline timer and uses native distributed cancellation only for callers with cancellable tokens. Expired configuration waits preserve quota; late concurrency acquisitions release their permits. HTTP abort and SignalR disconnect propagation remain covered.

Known time-based leases no longer accumulate in a server dictionary or send redundant release RPCs. Empty lease metadata is shared, holders cache bounded references, and concurrency disposal reuses the owner reference. Existing RPC identities remain available; old metadata defaults to explicit release. All updated holders require the bounded capability, so update silos before clients. Custom grains used with built-in holders must implement that capability.

The branch also fixes failed-delete state loss, token restoration overflow/backwards clocks, cooperative storage cancellation and failed-write retries. Metrics avoid partition identifiers. RPC manifests are enforced, package APIs validate against 10.1.0, and workflow permissions/quoting are hardened.

Validation: 187/187 tests pass normally and under Coverlet, with no skips (38 new timeout/performance-contract regressions beyond the previous 149). Line coverage is 93.78%, and the 85% overall gate is unchanged. Timeout providers have 100% coverage. The generator-required non-generic proxy forwarding overload has a documented coverage exception; all registered bounded RPCs exercise the generic path. Sixteen timeout storms complete in 800.9–810.0 ms against a one-second RPC timeout, leaving empty queues and usable concurrency capacity. Build/analyzers have zero warnings/errors; ordinary and benchmark formatting, all three packages, API compatibility, actionlint and direct/transitive NuGet vulnerability audit pass.

Performance validation includes reproducible benchmarks with verified gateway/placement, real caller tokens and workload warm-up. Local timing was affected by unrelated browser workloads; all raw results, including regressions, are retained. A manually dispatched CI job compares baseline 705b47d and this revision in ABBA order on one separate runner, publishing all samples and a paired summary. The first isolated run found an 8.4% hot-key regression for the CancellationToken.None overload and motivated removing the global filter. The final proxy revision was measured by the same isolated comparison: https://github.com/managedcode/Orleans.RateLimiting/actions/runs/34157954597. All six repetitions per case are included in the medians below. Hot-key throughput still regresses by 7.1% for the token overload with CancellationToken.None and 5.2% with a cancellable token; p99 improves in every measured case. The performance regression is reduced but not fully eliminated.

Migration and limits: corrected IP/policy keys start new counters. Budgets begin at server method entry; routing time remains part of the Orleans response timeout. Lost replies/client crashes do not gain distributed lease expiry, and persistence remains best-effort. See docs/SecurityReview-10.2.0.md, docs/CancellationAndObservability.md and docs/PerformanceAndTimeouts.md. PR merged at commit 6e7b500. Release v10.2.0 and all three NuGet packages are published. GHSA-mfr4-hpp8-752w is closed with patched version 10.2.0 recorded. There are no open repository issues.

Final isolated performance results:

Medians of all six repetitions per case (two processes per revision).
Throughput includes successful acquisition and disposal; p99 is the median of per-repetition p99 values.
Raw JSON retains each repetition, allocations, GC counts, timestamps and verified topology.

Scenario	Token overload	Cancellable token	Baseline ops/s	Updated ops/s	Change	p99 ms baseline → updated	B/op baseline → updated
hot-key-16	False	False	25,476	25,983	+2.0%	1.223 → 1.216	10,420 → 8,584
hot-key-16	True	False	27,344	25,399	-7.1%	1.221 → 1.191	10,993 → 9,522
hot-key-16	True	True	24,901	23,610	-5.2%	1.280 → 1.253	12,406 → 10,573
partitioned-16	False	False	60,527	63,932	+5.6%	0.733 → 0.596	6,271 → 5,146
partitioned-16	True	False	55,620	64,371	+15.7%	0.880 → 0.565	9,123 → 5,145
partitioned-16	True	True	55,574	63,345	+14.0%	0.837 → 0.691	9,124 → 5,278
sequential	False	False	13,244	14,318	+8.1%	0.108 → 0.102	6,176 → 5,052
sequential	True	False	11,769	14,295	+21.5%	0.121 → 0.104	9,022 → 5,059
sequential	True	True	12,163	14,284	+17.4%	0.116 → 0.101	9,020 → 5,181