A fixed-window limiter allows 100 requests per calendar minute. What is the worst-case number of requests a client can make within about 2 seconds?

The answer is "200". A client can send 100 requests in the last second of one window. Then it sends 100 more right after the next window starts. So 200 requests pass within about 2 seconds. That is why "100" is wrong: the limit is per calendar minute, not per any 60 seconds. Sliding-window or token bucket limiters smooth out this burst at the window boundary.