- Coordinate concurrent store and middleware attempts behind start barriers - Prove Host rotation and inline policy changes share anonymous budgets
- MemoryStore mirrors Laravel tooManyAttempts-before-hit first-hit-wins - FixedWindowLimiter + throttle factory; success and 429 rate-limit headers - Trusted-proxy ClientIP; remove noOpLimit; keep Limiter interface seam