Most teams add rate limiting once and never revisit it. They pick a fixed window counter because it’s simple, deploy it with local counters, and move on. Then a misbehaving client gets through at 5x the configured threshold and the post-mortem reveals…