Rate limiting: Specification
Caller-scoped token-bucket quotas with distinct 429 and 503 classes, Retry-After on throttle, burst versus sustained windows, and tenant-fair sharing that never discloses a neighbor's identity.
Service-to-service calls propagate remaining deadline budget, refuse work that cannot finish inside it, and distinguish client cancellation from deadline expiry in status, retries, and traces.