Document conversion queues: backpressure, fairness, and retry limits

A worker concurrency limit protects active CPU and memory, but it does not limit queued objects, expired credentials, or waiting users. Set explicit limits for accepted jobs, queued bytes, job age, and per tenant demand. Decide which requests can wait and which should be rejected with a retryable response. Admission should account for the source being available long enough to process. A queue full of jobs whose source links have already expired is not useful capacity; it is deferred failure that requires additional cleanup and retries.

There are at least three controls to tune independently. Admission decides whether a new job enters the system. Scheduling decides which accepted job runs next. Execution limits bound the resources consumed while it runs. Combining all three into one worker-count setting makes overload harder to diagnose.

Retry traffic must consume the same controlled capacity. A failing document that immediately requeues itself can monopolize processing even when new submissions are limited. Apply bounded attempts and delay, and identify permanent input errors early. During an incident, report the oldest waiting job and the reason workers are unavailable. A queue length of twenty means little without knowing whether those jobs are small previews, enormous presentations, or repeated failures that cannot complete.