Load Shedding and Adaptive Concurrency Limits: Degrade Instead of Collapsing

A practical guide to the mechanism that decides whether your service degrades in an orderly way or collapses entirely when the spike arrives: why throughput falls off a cliff exactly when you need it most (goodput versus throughput and congestive collapse), Little’s Law applied to the concurrency limit your service already has even though you never wrote it down, why RPS rate limiting protects you from nothing when per-request cost is variable, the anatomy of a cheap rejection (503 with Retry-After before touching the database, and the per-request log line that sinks you precisely during overload), adaptive limits with AIMD implemented step by step — including the rule of not growing when you are not using the limit, which is what separates a limiter from an ornament — the Netflix and Envoy gradient controller with the minRTT formula and the periodic recalibration trap that fires a burst of 503s every thirty seconds, the queue you cannot see (kernel backlog, somaxconn and the worker pool) tamed with CoDel and adaptive LIFO so you stop serving requests the client already abandoned, criticality-based shedding with reserved budgets so checkout stays alive while analytics goes dark, the correct middleware order, why failing the readiness probe under load turns an overload into a full outage through cascading pod removal, what the client receiving a 503 should do (full-jitter backoff, propagated deadline budget and retries downgraded in criticality, plus a retry budget so you do not amplify), observability with the four metrics that matter, PromQL and Prometheus alerts, and how to validate all of it with k6 in an open model hunting for the saturation point. With production-ready code in Python, TypeScript, YAML and PromQL, eight recurring mistakes, a production checklist, FAQ and glossary.