Rate limits counted across the control planes with router.active_active

Each router's per-counter request and token counts, this minute's and the
last, ride the standby's two-second exchange with the leader. The leader
answers each standby with everyone else's sum, its own included, and puts
the standbys' sum in force on its own router; each limiter adds the
others' counts to its sliding window.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

docs/reference.md

@@ -2818,11 +2818,12 @@ written into the setup scripts and whose attempts are counted where.
 ActiveActive has standby control planes answer the client API
 themselves, routing to the leader's replicas, rather than passing
 every request to the leader. More machines carry the traffic, which
-is the point; what each router keeps in memory is then its own:
-rate limits are counted per control plane, so a key may make up to
-as many times its limit as there are control planes taking its
-requests; a budget is checked against the store every half minute;
-cached answers and prefix affinity are split between them. Off by
+is the point. Rate limits are the cluster's: each router's counts
+reach the others through the leader every two seconds, so a key
+spread over N control planes may pass its limit by what they allow
+in those two seconds. A budget is checked against the store every
+half minute; cached answers and prefix affinity are split between
+the routers. Off by
 default. Which machine a client reaches is the load balancer's or
 DNS's to say; the floating address stays on the leader.