Rate Limiter

Accepted history and observed time are different state. A denied request adds no accepted timestamp, yet must still advance the client's observed clock. Otherwise a later request could travel backward relative to that denial and accidentally restore an earlier quota view.

// Active interval is (now-window,now], so equality at the left boundary expires.
bool active = accepted_time > now-window;

Keep clocks per client: a busy client's timestamp must not prohibit an unrelated client's smaller timestamp. Validate a complete history before filtering it in the prototype; deleting malformed entries first would hide invalid input. Returning a copy from history() protects internal quotas. The final design can retain a deque and expire from its front for amortized O(1) timestamp removal. No sleep or wall clock belongs in deterministic logical-time tests.

C++ contract conventions: numeric values use signed Int (long long); all inputs and intermediate arithmetic are within its representable range. Opt<T> means std::optional<T> and absence is std::nullopt; Vec<T> means std::vector<T>. Invalid documented arguments throw std::invalid_argument. Inputs passed by const reference remain caller owned. Returned containers and records own their contents. Calls use the declared C++ parameter types. Implicit conversions performed by the caller are outside the runtime validation contract. Unless a lesson states otherwise, string ordering is lexicographic over Unicode code points (Text) or UTF-8 identifiers (std::string).