Scope:

• Add process‑wide limits (connections, concurrency, queue depth, CPU/memory/IO).
• Fast‑fail with 429/Retry‑After (+ jitter).
• Protect liveness/control lanes.
• Surface overload metrics and alerts.

Success criteria:

• Under synthetic overload, shared queues bounded.
• 429/Retry‑After (+ jitter) returned.
• Liveness/control RPCs responsive.
• Self‑recover ≤ 2 min after load normalizes.
• Alerts within ≤ 30s.