Highly available rate-limit aggregator

Design a highly-available singleton service: a global rate-limit/quota aggregator that must have exactly one active instance computing the authoritative cross-region usage total (so quotas aren't double-counted), but must fail over to a standby within seconds if the active dies. It also can't be a bottleneck, thousands of services report usage to it. How do you elect the one active instance, fail over fast, and not lose counts during the switch?