maxPendingFetches

Cap on launched-but-unfinished fetch Jobs (vs semaphore, which gates concurrent round-trips); bounds the queue so a huge changing cut can't pile up unbounded coroutines + HTTP/SSL → OOM. Over-cap tiles re-request a later frame.