We should bound the amount of time that a request can spend in the proxy. I suggest that any request that cannot sent to its destination within a second or two should error with a 503.

I propose that this is implemented wherever the proxy buffers requests, as a new layer (or, set of layers):

• ExpiryEnqueue: A Service<Request> that
  • attempts to extract a deadline from each request
  • If the deadline exists, create a future that fires at the deadline
  • move the request into an Arc<Mutex<Option<Request>>>
  • downgrade the request to a weak ref and call it into an inner Service<Weak<Mutex<Option<Request>>>>
  • create a new response future that selects over the deadline future and the response future, and holds the strong reference to the request:
    • if the deadline fires, attempt to take the request
      • if the request was taken, fail the response future with an Error
    • otherwise, poll the response future
• ExpiryDequeue: A Service<Weak<Mutex<Option<Request>>>> that
  • attempts to upgrade and take each request
    • if the request could be taken, its issued into the inner Service<Request>
    • otherwise, an error is returned (but this error will never be processed!)

The error handler will have to map these errors to 503s.