X_AUTH_LIMITER_POLICY_MISMATCH

a custom credential limiter enforces different numbers than the app declared

defineAuth({ limiter }) where the limiter's own policy disagrees with the declared rateLimit on maxAttempts, windowMs or lockoutMs. Auth.rateLimit is what an operator reads as "what this deployment enforces", and an injected limiter could leave nothing behind it. The cause names both numbers and says which half is likely wrong; maxKeys is deliberately not compared, since it bounds one process' table and a shared limiter has no opinion on it

construct the limiter with the declared number — the declaration is what Auth.rateLimit reports, so it is the half that stays. If the limiter's number is the one this deployment means, change the declaration instead; meta carries { field, declared, enforced }