Fixed-window limiter allows burst

You enforce a 1,000 req/min per-tenant limit using a fixed-window counter (reset at the top of each minute). A large tenant intermittently overruns and overwhelms a downstream that's provisioned for ~1,000 req/min: monitoring shows brief ~30-second windows where the downstream sees close to 2,000 req from that one tenant and saturates, even though the limiter reports the tenant never exceeded 1,000 per minute. The limiter logs confirm each one-minute window stayed at or under 1,000. How do you triage and fix the limiter so the downstream stops getting buried?