Users report that our rate limiter lets far more traffic through than it should: once a client has been idle for a while, it can keep making requests indefinitely without being limited. The existing tests pass. Find the bug and fix it.