X_RATE_LIMIT_BUCKET_UNBOUND

the installed limiter does not hold a bucket a route declares

a limiter passed through PipelineDeps.limiter was built by the app from a config that never saw the routes, so every route-declared limit silently reverted to default — measured before the fix: 21 of 21 requests allowed against a route declaring 5, with ratelimit-limit: 120 on the wire. Refused rather than rebound, because a RateLimiter is opaque and "binding" it would mean discarding the caller's limiter and its store. An absent bucket table is refused exactly as a wrong one is: what cannot be shown to hold is not assumed to hold

pass the store and let the pipeline build the limiter — httpServer({ routes, rateLimitStore }) — so the bucket table is the one the routes registered