Function query_envelope 

pub async fn query_envelope(
    __arg0: State<Arc<Envelope>>,
    request: Request,
    next: Next,
) -> Response

Middleware over the query routes: the global concurrency cap and the caller’s per-plan query timeout.

Runs inside the auth layer (which has already attached KeyPlan), so the timeout is the authenticated key’s own plan value; a request with no plan attached — the router served without the auth wrapper, as in some tests — gets the cap but no timeout. The permit is held for the whole request. On timeout the answer is 504 request_timeout: the handler future is dropped, though blocking work it already spawned runs to completion in the background (a spawn_blocking task cannot be cancelled), so a timed-out request’s tail may briefly outlive its permit — the cap bounds admitted requests, not physics.