Function limit_requests 

pub(crate) async fn limit_requests(
    __arg0: Extension<RequestLimit>,
    req: Request,
    next: Next,
) -> Response

Each request holds a slot while in flight; excess gets 429. A websocket’s slot is released at the 101 upgrade: long-lived streams are deliberately unbounded here, since demo workloads (nasty-client holds hundreds of streams by design) dwarf the request budget of 25.