@@ -174,9 +174,10 @@ export function sanitizeSmsReportFields(body) {
 // expiration TTL equal to the window so stale keys self-clean.
 const RATE_LIMIT_WINDOW_S = 60;
 const RATE_LIMIT_MAX_REQUESTS = 5;
-// A carrier hands each phone its own /64 out of a shared /48, so the /48 gets
-// a larger budget than one client, and the whole Worker gets one per minute so
-// a flood spread over many networks can't turn into a flood of GitHub commits.
+// A carrier hands each phone its own /64 out of a shared /48, so the /48 (an
+// IPv4 /24) gets a larger budget than one client, and the whole Worker gets one
+// per minute so a flood spread over many networks can't turn into a flood of
+// GitHub commits.
 const GROUP_RATE_LIMIT_MAX_REQUESTS = 20;
 const GLOBAL_RATE_LIMIT_MAX_REQUESTS = 30;
 
@@ -347,16 +348,36 @@ export async function readBoundedText(request, limit = MAX_BODY_BYTES) {
 }
 
 /**
- * Check the per-client, per-/48 and Worker-wide rate limits, in that order.
- * Returns { allowed: boolean, remaining: number, retryAfter: number } for the
- * first budget that refuses, or for the client budget when all allow.
+ * The network a client's group budget keys on: an IPv6 /48 (a carrier hands
+ * each phone a /64 out of a shared /48) or an IPv4 /24, so a handful of
+ * addresses in one block can't each spend a full client budget.
+ */
+export function limiterGroupKey(ip) {
+  const key = clientKey(ip, REPORTER_PREFIX_BITS);
+  const octets = key.match(/^(\d{1,3})\.(\d{1,3})\.(\d{1,3})\.\d{1,3}$/);
+  return octets ? `${octets[1]}.${octets[2]}.${octets[3]}.0/24` : key;
+}
+
+/**
+ * Check the Worker-wide, per-client and per-group rate limits. Returns
+ * { allowed: boolean, remaining: number, retryAfter: number } for the first
+ * budget that refuses, or for the client budget when all allow.
+ *
+ * The Worker-wide budget is the REPORT_GLOBAL_COUNTER Durable Object when it
+ * is bound. A rate-limiting binding counts separately in every Cloudflare
+ * location, so it can't hold one budget for the whole Worker; the single
+ * object can. Its budget is checked before the client is charged, so a report
+ * the Worker can't take doesn't spend the client's budget, and it is charged
+ * only after the client and group budgets allow, so one client hammering its
+ * own limit can't drain everyone else's.
  *
  * When the REPORT_LIMITER rate-limiting binding is bound it is authoritative:
  * the platform evaluates its counter atomically per key, so a burst of
  * concurrent requests cannot slip past the cap the way it can between the KV
  * counter's read and write (KV is eventually consistent and non-atomic).
  * The KV counter remains as a best-effort fallback for a deployment that has
- * not provisioned the limiter binding yet.
+ * not provisioned the limiter binding yet. Without the Durable Object the
+ * Worker-wide budget falls back the same way and is charged last.
  *
  * Missing bindings fail closed unless a local test explicitly sets
  * ALLOW_UNLIMITED_REPORTS=true. Production must never set that flag.
@@ -366,25 +387,90 @@ export async function checkRateLimit(ip, env) {
     return { allowed: false, remaining: 0, retryAfter: 0, identityError: true };
   }
   const client = clientKey(ip, LIMITER_PREFIX_BITS);
+  const group = limiterGroupKey(ip);
   const budgets = [
     { limiter: env?.REPORT_LIMITER, key: client, kvKey: `rl:${client}`, max: RATE_LIMIT_MAX_REQUESTS },
-    {
-      limiter: env?.REPORT_GROUP_LIMITER,
-      key: clientKey(ip, REPORTER_PREFIX_BITS),
-      kvKey: `rlg:${clientKey(ip, REPORTER_PREFIX_BITS)}`,
-      max: GROUP_RATE_LIMIT_MAX_REQUESTS,
-    },
-    { limiter: env?.REPORT_GLOBAL_LIMITER, key: "all", kvKey: "rlall", max: GLOBAL_RATE_LIMIT_MAX_REQUESTS },
+    { limiter: env?.REPORT_GROUP_LIMITER, key: group, kvKey: `rlg:${group}`, max: GROUP_RATE_LIMIT_MAX_REQUESTS },
   ];
+  const counter = env?.REPORT_GLOBAL_COUNTER;
+  if (counter) {
+    const open = await askGlobalCounter(counter, "peek");
+    if (!open.allowed) return open;
+  } else {
+    budgets.push({ limiter: env?.REPORT_GLOBAL_LIMITER, key: "all", kvKey: "rlall", max: GLOBAL_RATE_LIMIT_MAX_REQUESTS });
+  }
   let first;
   for (const budget of budgets) {
     const outcome = await consumeBudget(budget, env);
     if (!outcome.allowed) return outcome;
     first ??= outcome;
   }
+  if (counter) {
+    const taken = await askGlobalCounter(counter, "take");
+    if (!taken.allowed) return taken;
+  }
   return first;
 }
 
+/** Peek at or take from the Worker-wide budget held by the one counter object. */
+async function askGlobalCounter(namespace, action) {
+  let answer;
+  try {
+    const stub = namespace.get(namespace.idFromName(GLOBAL_COUNTER_NAME));
+    const response = await stub.fetch(`https://global-counter/${action}`, { method: "POST" });
+    answer = await response.json();
+  } catch (error) {
+    console.error("Unable to reach the Worker-wide report counter", error);
+    return { allowed: false, remaining: 0, retryAfter: 0, stateError: true };
+  }
+  if (answer?.allowed === true) {
+    return { allowed: true, remaining: answer.remaining, retryAfter: 0 };
+  }
+  if (answer?.allowed === false && Number.isFinite(answer.retryAfter)) {
+    return { allowed: false, remaining: 0, retryAfter: Math.max(1, Math.ceil(answer.retryAfter)) };
+  }
+  console.error("Malformed answer from the Worker-wide report counter");
+  return { allowed: false, remaining: 0, retryAfter: 0, stateError: true };
+}
+
+const GLOBAL_COUNTER_NAME = "all";
+
+/**
+ * The Worker-wide report budget, one instance (named "all") for every
+ * Cloudflare location. Each request runs to completion without awaiting, so
+ * the check and the increment can't interleave. The count lives in memory:
+ * the object stays loaded while reports arrive, and one evicted after a quiet
+ * spell starts a fresh window, which an idle minute would have given anyway.
+ */
+export class ReportGlobalCounter {
+  constructor(_state, _env, now = () => Date.now()) {
+    this.now = now;
+    this.windowStart = 0;
+    this.count = 0;
+  }
+
+  async fetch(request) {
+    const action = new URL(request.url).pathname.slice(1);
+    if (action !== "peek" && action !== "take") {
+      return new Response("Not found", { status: 404 });
+    }
+    const now = this.now();
+    if (now - this.windowStart >= RATE_LIMIT_WINDOW_S * 1000) {
+      this.windowStart = now;
+      this.count = 0;
+    }
+    const allowed = this.count < GLOBAL_RATE_LIMIT_MAX_REQUESTS;
+    if (allowed && action === "take") this.count += 1;
+    const retryAfter = allowed
+      ? 0
+      : Math.max(1, Math.ceil((this.windowStart + RATE_LIMIT_WINDOW_S * 1000 - now) / 1000));
+    return new Response(
+      JSON.stringify({ allowed, remaining: GLOBAL_RATE_LIMIT_MAX_REQUESTS - this.count, retryAfter }),
+      { headers: { "Content-Type": "application/json" } },
+    );
+  }
+}
+
 /** Take one request from a budget: the atomic limiter binding when bound, else a KV counter. */
 async function consumeBudget({ limiter, key: limiterKey, kvKey: key, max }, env) {
   if (limiter) {
 
@@ -13,6 +13,8 @@ import worker, {
   sanitizeSmsUrlIndicators,
   checkRateLimit,
   clientKey,
+  limiterGroupKey,
+  ReportGlobalCounter,
   getClientIp,
   checkDedup,
   deriveReporterBucket,
@@ -289,14 +291,136 @@ test("one IPv6 /48 has a budget of its own across its /64s", async () => {
 
 test("the Worker has one per-minute budget across every network", async () => {
   const env = { RATE_LIMIT: createMockKV() };
+  // One client per /24, so no group budget refuses first.
   for (let i = 1; i <= 30; i++) {
-    assert.equal((await checkRateLimit(`198.51.100.${i}`, env)).allowed, true, `client ${i}`);
+    assert.equal((await checkRateLimit(`198.51.${i}.1`, env)).allowed, true, `client ${i}`);
   }
   const refused = await checkRateLimit("203.0.113.200", env);
   assert.equal(refused.allowed, false);
   assert.ok(refused.retryAfter > 0);
 });
 
+test("IPv4 clients share a group budget by /24", async () => {
+  assert.equal(limiterGroupKey("192.0.2.77"), "192.0.2.0/24");
+  assert.equal(limiterGroupKey("::ffff:192.0.2.77"), "192.0.2.0/24");
+  assert.equal(limiterGroupKey("2001:db8:7:1::1"), clientKey("2001:db8:7:1::1", 48));
+
+  const env = { RATE_LIMIT: createMockKV() };
+  for (let i = 1; i <= 20; i++) {
+    assert.equal((await checkRateLimit(`192.0.2.${i}`, env)).allowed, true, `address ${i}`);
+  }
+  const refused = await checkRateLimit("192.0.2.200", env);
+  assert.equal(refused.allowed, false);
+  assert.ok(refused.retryAfter > 0);
+  assert.equal((await checkRateLimit("192.0.3.1", env)).allowed, true);
+});
+
+/** A Durable Object namespace that hands every location the same counter. */
+function counterNamespace(counter = new ReportGlobalCounter()) {
+  const names = [];
+  return {
+    names,
+    counter,
+    idFromName(name) {
+      names.push(name);
+      return { name };
+    },
+    get() {
+      return { fetch: (url, init) => counter.fetch(new Request(url, init)) };
+    },
+  };
+}
+
+test("the Worker-wide counter takes 30 a minute, and a peek takes nothing", async () => {
+  let now = 1_000_000;
+  const counter = new ReportGlobalCounter(null, null, () => now);
+  const ask = async (action) => (await counter.fetch(new Request(`https://global-counter/${action}`))).json();
+  for (let i = 1; i <= 30; i++) {
+    assert.equal((await ask("peek")).allowed, true, `peek ${i}`);
+    assert.equal((await ask("take")).allowed, true, `take ${i}`);
+  }
+  const full = await ask("take");
+  assert.equal(full.allowed, false);
+  assert.equal(full.retryAfter, 60);
+  assert.equal((await ask("peek")).allowed, false);
+  now += 59_500;
+  assert.equal((await ask("take")).retryAfter, 1);
+  now += 500;
+  assert.equal((await ask("take")).allowed, true);
+  assert.equal((await counter.fetch(new Request("https://global-counter/reset"))).status, 404);
+});
+
+test("every location asks the one Worker-wide counter", async () => {
+  const namespace = counterNamespace();
+  const env = { RATE_LIMIT: createMockKV(), REPORT_GLOBAL_COUNTER: namespace };
+  for (let i = 1; i <= 30; i++) {
+    assert.equal((await checkRateLimit(`198.51.${i}.1`, env)).allowed, true, `client ${i}`);
+  }
+  assert.equal((await checkRateLimit("203.0.113.200", env)).allowed, false);
+  assert.deepEqual(new Set(namespace.names), new Set(["all"]));
+  // The KV fallback for the Worker-wide budget isn't used while the counter is bound.
+  assert.equal(env.RATE_LIMIT._store.has("rlall"), false);
+});
+
+test("a full Worker-wide budget refuses before the client is charged", async () => {
+  const namespace = counterNamespace();
+  for (let i = 0; i < 30; i++) await namespace.counter.fetch(new Request("https://global-counter/take"));
+  const charged = [];
+  const limiter = { async limit({ key }) { charged.push(key); return { success: true }; } };
+  const response = await worker.fetch(
+    new Request("https://reports.example", {
+      method: "POST",
+      headers: { "content-type": "application/json", "cf-connecting-ip": "203.0.113.60" },
+      body: JSON.stringify({ number: "+12122340101", type: "spam" }),
+    }),
+    {
+      RATE_LIMIT: createMockKV(),
+      REPORT_LIMITER: limiter,
+      REPORT_GROUP_LIMITER: limiter,
+      REPORT_GLOBAL_COUNTER: namespace,
+      GITHUB_TOKEN: "test-token",
+      REPORTER_BUCKET_SECRET: "s".repeat(32),
+    },
+  );
+  assert.equal(response.status, 429);
+  assert.ok(Number(response.headers.get("retry-after")) > 0);
+  assert.deepEqual(charged, []);
+});
+
+test("a report the client's own limit refuses doesn't spend the Worker-wide budget", async () => {
+  const namespace = counterNamespace();
+  const env = {
+    RATE_LIMIT: createMockKV(),
+    REPORT_LIMITER: { async limit() { return { success: false }; } },
+    REPORT_GLOBAL_COUNTER: namespace,
+  };
+  for (let i = 0; i < 50; i++) {
+    assert.equal((await checkRateLimit("203.0.113.70", env)).allowed, false);
+  }
+  const peek = await (await namespace.counter.fetch(new Request("https://global-counter/peek"))).json();
+  assert.equal(peek.remaining, 30);
+});
+
+test("an unreachable Worker-wide counter fails closed as a state error", async () => {
+  const errors = [];
+  const originalError = console.error;
+  console.error = (...args) => errors.push(args.join(" "));
+  try {
+    const rl = await checkRateLimit("203.0.113.80", {
+      RATE_LIMIT: createMockKV(),
+      REPORT_GLOBAL_COUNTER: {
+        idFromName: (name) => ({ name }),
+        get: () => ({ fetch: async () => { throw new Error("object unavailable"); } }),
+      },
+    });
+    assert.equal(rl.allowed, false);
+    assert.equal(rl.stateError, true);
+  } finally {
+    console.error = originalError;
+  }
+  assert.equal(errors.length > 0, true);
+});
+
 test("POST returns 429 when the /48 or the Worker-wide limiter refuses", async () => {
   for (const refusing of ["REPORT_GROUP_LIMITER", "REPORT_GLOBAL_LIMITER"]) {
     const keys = { REPORT_LIMITER: [], REPORT_GROUP_LIMITER: [], REPORT_GLOBAL_LIMITER: [] };
 
@@ -31,10 +31,9 @@ namespace_id = "5001"
 limit = 5
 period = 60
 
-# A carrier gives each phone a /64 out of a shared /48, so the /48 gets a
-# larger budget of its own, and the whole Worker gets one budget per minute so
-# a flood spread across networks can't become a flood of GitHub commits. The
-# code falls back to KV counters when these bindings are missing.
+# A carrier gives each phone a /64 out of a shared /48, so the /48 (an IPv4
+# /24) gets a larger budget of its own. The code falls back to KV counters
+# when the limiter bindings are missing.
 [[ratelimits]]
 name = "REPORT_GROUP_LIMITER"
 namespace_id = "5002"
@@ -43,10 +42,16 @@ namespace_id = "5002"
 limit = 20
 period = 60
 
-[[ratelimits]]
-name = "REPORT_GLOBAL_LIMITER"
-namespace_id = "5003"
-
-[ratelimits.simple]
-limit = 30
-period = 60
+# The whole Worker gets one budget per minute so a flood spread across
+# networks can't become a flood of GitHub commits. A rate-limiting binding
+# counts separately in each Cloudflare location, so this budget is one
+# Durable Object (the instance named "all") that every location asks. It
+# keeps its count in memory and stores nothing; SQLite-backed so it runs on
+# the Workers Free plan.
+[[durable_objects.bindings]]
+name = "REPORT_GLOBAL_COUNTER"
+class_name = "ReportGlobalCounter"
+
+[[migrations]]
+tag = "v1"
+new_sqlite_classes = ["ReportGlobalCounter"]