X_AUTH_LIMITER_NOT_SHARED

the app declared a fleet-wide credential throttle and the limiter keeps its counters per process

defineAuth({ rateLimit: { scope: 'shared' } }) against the built-in limiter, whose scope is 'process' — account lockout would be maxAttempts × replicas, and a lockout on one replica invisible to the others. Refused at defineAuth, never at a request

pass a shared AuthLimiter to defineAuth({ limiter }), or drop to scope: 'process'