maxPendingItems

Bounds both live submissions and physical queue slots.

A queued cancellation releases live admission immediately, but its physical queue slot remains reserved until the batching pipeline observes and discards the placeholder. A cancellation storm may therefore reject a new submission even when fewer than maxPendingItems live callers remain; this keeps the internal Reactor queue bounded.