Scope:

• Applies to Log Service, Page Materializer, Page Servers, CMS (optionally CRS).
• (connections, concurrency, queue depth, CPU, memory, IOPS, bandwidth) with token buckets and Retry-After + jitter; circuit breakers with cooldown/stability windows; shed best-effort first; keep queues bounded; feature flags and safe defaults; full observability (admitted/rejected, queue depths, p95/p99, drop_reason).

Success:

• Under service overloads, control/consensus/serve lanes remain within targets; queues bounded; no head-of-line blocking; no crash loops; no retry storms; recovery ≤ 2 minutes; canaries remain green or red intervals within bounds.