=== SPEC OVERVIEW & GOALS === A token-bucket rate limiter fronting the public REST API. Goals: enforce per-key quotas, fair burst handling, <2ms added latency p99. Non-Goals: billing, per-endpoint pricing. === REQUIREMENTS === MUST enforce limits per API key with a sliding window; SHOULD return 429 with Retry-After; MAY support per-route overrides. === PROPOSED ARCHITECTURE === Edge middleware -> Redis token buckets -> async usage log. Key decision: counters live in Redis (shared, atomic INCR with Lua) so horizontal API replicas stay consistent. === ALTERNATIVES CONSIDERED === Local in-memory (fast, but inconsistent across replicas) vs centralized Redis (1 hop, consistent) vs sidecar proxy (Envoy ratelimit). Chose Redis for consistency at low op-cost. (...all 13 sections in full: data model + API contracts, Mermaid sequence diagram, risks at 10x scale, security/PII, phased rollout + rollback, observability/SLOs, decision log, reviewer checklist.)