middleware runs twice per navigation and my rate limiter 429s real users Middleware

Both. Exclude prefetches now, then move the limiter.

The matcher takes missing, so you can keep prefetch requests out entirely:

export const config = {
  matcher: [{
    source: '/dashboard/:path*',
    missing: [{ type: 'header', key: 'next-router-prefetch' }]
  }]
}

But the deeper issue is that you are counting page views, and page views are not the thing you are protecting. Nobody abuses your app by looking at the dashboard. Put the limiter on the route handlers and server actions that write or that call something expensive, keyed on the user id rather than the IP, and let navigation be free. Your office customers behind one NAT will thank you too.

Middleware runs far more often than people picture. Prefetches, RSC payload requests, and anything else your matcher happens to catch. I have seen a matcher of /:path* with a lazy negative lookahead pull in every image request on the page, at which point your "10 per minute" is 10 per screenful.

Log req.url for a day before you trust any assumption about how often it fires.

Also look at what this is costing you. On most hosts middleware invocations are billed separately from function invocations, and a chatty matcher on a dashboard with 40 links in the viewport is a genuinely surprising line item. I cut mine 60% with matcher changes alone and the app behaved identically.

Just put prefetch={false} on every Link in the sidebar. One prop, done, and you stop paying for prefetches you mostly do not use.

"The framework is making requests on the user's behalf and your infrastructure cannot tell them apart from the user" is going to be the theme of the next few years, honestly.