The surface
Meridian is the public REST API behind three product teams. It serves roughly forty million requests a month, with each team owning endpoints inside one shared contract: versioning, pagination, error shapes and rate limits are platform decisions, not per-team ones.
The problem
Latency crept up one endpoint at a time. A feature would add an eager load, a serialiser would add a relationship, and the p95 moved without anybody deciding it should. The recurring incident was always the same: a heavy query shipping during a peak window.
What changed
The API now declares a query budget per endpoint: a maximum number of queries and a maximum estimated row count. The budget is checked in CI against seeded data, so a regression fails the pull request rather than the pager.
Outcome
p95 fell from 840ms to 190ms over two quarters, and the timeout incident class stopped recurring.