Rate limiting: Specification
Caller-scoped token-bucket quotas with distinct 429 and 503 classes, Retry-After on throttle, burst versus sustained windows, and tenant-fair sharing that never discloses a neighbor's identity.
Under load, services expose bounded queues, explicit admission decisions, retry hints, and load-shedding states so callers degrade predictably instead of timing out against unbounded buffers.