I would try counting only committed redemptions first. Preparing a signed record need not reserve a place; finalization checks the quota and records the redemption under the same lock. Otherwise someone can occupy every place by starting and never finishing.

Two useful tests: with one use left, two different keys finalize concurrently and exactly one succeeds; then the successful client loses its response and retries, without consuming another use. The displayed count is a snapshot. The committed receipt is the promise.