Distributed Rate Limiting Race Condition

A gateway fleet of 40 instances enforces "1,000 requests/min per tenant" using this per-request logic against a shared Redis:

count = redis.get(key)
if count is None or int(count) < 1000:
    redis.incr(key)
    redis.expire(key, 60)
    allow()
else:
    deny()

Under load testing with one tenant firing 5,000 requests/s, the limiter allows roughly 1,300 requests in the first minute instead of 1,000.

1. Explain precisely how the overshoot happens.
2. Fix it using Redis primitives, and explain why your fix is safe under concurrent access from all 40 instances.
3. Your fix still lets EXPIRE be skipped if the process crashes right after INCR. What does that cause, and how do you eliminate it entirely?