Function scope_ttl_secs 

pub fn scope_ttl_secs(config: RateLimitConfig, window: Duration) -> u64

How long a scope’s admission record must live: at least as long as the buckets it admitted, and at least the caller’s requested floor.

This is the whole fix for cratestack#871’s second blocker. A scope that expires before its buckets do bounds nothing — the next generation admits max_distinct more while the previous ones are still alive, so the steady state was max_distinct × ceil(bucket_ttl / window) rather than max_distinct. Shared between both backends for the same reason bucket_ttl_secs is: a divergence here is a silently different bound per backend.