The Price of Exactness

You prototype a limiter that stores every accepted request timestamp in a per client sorted set, evicts entries older than the window, and admits when the remaining count is below the limit. It is exact in testing, but ops rejects it for a tier with 2 million active keys at 5000 requests per hour each. What is the objection?

It requires the clock on every client to be synchronized to within the window, since the stored timestamps come from the callers themselves

A sliding window log stores one entry per accepted request, so memory scales with limit times active keys, up to billions of timestamps here

A sliding window log cannot express a window as long as an hour, because eviction would have to sweep all 2 million keys on a fixed schedule

It still double counts at window boundaries, so a client can land 10000 calls in a two second span and gains no accuracy over a fixed window