Enforce a hard quota before the pool fills

A shared pool serves many tenants. A quota that only warns is a chart, not a limit, and one tenant that runs far more than the rest can fill the pool before anyone acts on the warning.

Make the cap hard, not advisory

A soft cap tells everyone the pool is full while it is already full. A hard cap refuses the work that would exceed a tenant share, so the pool stays usable for the others.

Check before admitting, not after trimming

Check the cap at admission time. Trimming later means the work was already accepted and another tenant already paid for it.

def admit(tenant):
    return tenant.inflight + 1 <= tenant.cap

Count work in flight as well as queued

Work already running still holds the pool. A quota that counts only queued work lets a tenant run far past its share without ever tripping the cap.