Bound the whole resource lifecycle—not just the visible request
A concurrency limit only protects the resources inside it. If an application buffers request bodies before admission, those bytes can grow outside an otherwise well-behaved worker queue. Admit or reject work before materializing its body, bound waiting work, enforce body limits a…