Constant DEFAULT_STORE_TIMEOUT 

pub const DEFAULT_STORE_TIMEOUT: Duration;

Default ceiling on one store.consume call — first attempt and any backend-internal retry, as a single budget.

The security review measured the alternative: redis’s ConnectionManager defaults both its connection and response timeouts to None, so during a real outage each attempt awaited an unbounded reconnect cycle — 9.46s, doubled to 18.92s by the retry. “Degrade to unlimited” silently meant “hang for nineteen seconds, then allow”, which is worse for the caller than the refusal it replaced and is itself a denial-of-service lever.

500ms is chosen to be far above a healthy Redis round-trip (sub- millisecond on a local network, single-digit milliseconds across an availability zone) and far below anything a human would call a hang. An elapsed budget is a transport-class failure — the store did not answer — so a transport reports it as CratestackError::Unavailable and applies StoreErrorPolicy::permits to it like any other.

It lives beside the policy so HTTP and MCP cannot drift apart on the default; each transport enforces it with its own timer. cratestack-axum’s RateLimitLayer::with_store_timeout tunes it on HTTP.