Stop 1 of 5 · Pump station at the trailhead

A bucket does not need a clock ticking for every key. When a request arrives, work out how much time has passed since the last update, add that much refill, and clamp at capacity. This costs two numbers of state, cannot drift, and avoids a million timers. A periodic full reset would bring back the boundary problem.

tokens = min(capacity, tokens + (now - last) * rate)
last = now