A request with an empty RemoteAddr falls through to the raw-value
fallback and keys on the empty string, so every such request shares
one bucket. That is the fail-closed direction and stays as it is. A
test now pins it, and the comment at the fallback tells it apart from
the Unix-socket case.
Model: opus-5-5
sneak