The bucket key embedded the raw client address in ETS and in the
denial log line despite the comment claiming otherwise, and check/1
logged on every denied submit — the cheap path — so one looping client
could write unbounded WARN volume. Hash the address into the key
(truncated sha256 digest, like the sibling throttles' identifiers) and
gate the log to one line per bucket per window via a RateLimiter notify
bucket, mirroring LoginThrottle.

@@ -120,2 +125,2 @@
-    |> User.registration_changeset(attrs, validate_email: false, validate_callsign: false)
-    |> Repo.insert()
+  def register_user(attrs, client_ip \\ nil) do
+    if client_ip != nil and RegistrationThrottle.check(client_ip) == :throttled do

@@ -0,0 +15,4 @@
+  alias Aprsme.RateLimiter
+
+  @window to_timeout(hour: 1)
+  @ip_limit 5

@@ -0,0 +29,4 @@
+  def check(client_ip) do
+    case RateLimiter.hit(ip_key(normalize_ip(client_ip)), @window, @ip_limit) do
+      {:allow, _count} -> :ok
+      {:deny, _retry_after_ms} -> :throttled

@@ -0,0 +39,4 @@
+        # trusted-proxy regression collapsing all clients onto one ingress IP
+        # looks exactly like a quiet hour otherwise). Bucket key only — the
+        # IP itself is metadata the logger already carries as remote_ip.
+        Logger.warning("registration throttled bucket=#{key}")

@@ -0,0 +81,4 @@
+        end)
+
+      refute logs =~ ip_text
+      assert Regex.match?(~r/bucket=register:ip:[A-Za-z0-9_-]{16}\b/, logs)

@@ -0,0 +55,4 @@
+    test "a denied loop logs one line per window, not one per submit", %{ip: ip} do
+      logs =
+        capture_log(fn ->
+          assert :throttled = spend_budget(ip)