Spec one API limit enforced across 40 servers

Your public API runs on 12 stateless Go servers behind a load balancer, and autoscaling takes it to 40 at peak. The pricing page promises each API key "600 requests in any 60 seconds" on the paid plan and 60 on the free one. Today each server keeps its own counter, so a key really gets 12 to 40 times its limit. A coding agent will build a shared limiter on Redis.

Write the spec you would hand the agent.

What you know:

• Go 1.22, go-redis v9 and Redis 7
• peak traffic is about 20,000 requests a second across all keys
• each request already carries the key's id and plan once auth has run
• a Redis call from the servers normally takes under 2 ms

Then, in a few sentences: what would "add Redis rate limiting" let the agent quietly choose wrong?