Headroom is reserved, not borrowed. The 20% HIGH reserve is deducted from the shared pool when the policy is published, so saturation cannot consume it. Borrowing schemes fail exactly when they are needed.
Shedding is by tier and is deterministic: BULK pauses, LOW sheds, MEDIUM queues briefly, HIGH is served. A tenant can be told in advance what congestion will feel like.
The fourth column is the important one. Congestion and coordination failure are different events, and a design that conflates them behaves unpredictably during an incident.
Numbers
MEDIUM queue is bounded at 200 ms and 500 requests per pod, then 429. An unbounded queue converts a rate-limit problem into a latency problem.
LOW tier sheds first and receives retry_after derived from the tenant's own window, typically under 2 s.
The HIGH reserve is 20% of the shared pool, tunable per deployment; at 100k/s that is 20k/s held back.
Scope note
FR12 is marked optional-for-V2 in the brief. It is included in V1 here because the degraded-coordination column has to be answered anyway, and once tiers exist for that, using them for congestion is nearly free.
Weighted fair queuing across tenants within a tier is deferred to V2; V1 is first-come within a tier.
Cells describe admission behaviour only. What the tenant sees on the wire is in view 11's reason codes.
