01 · Before and afterThe pattern
// before: total checked on save A and save B separately, both outside the lock -> racy
if (expandedLength(field, currentVars) > MAX_LEN) throw new BadRequest(...)
// after: a structural bound that no concurrent edit can break
const MAX_REFS_PER_FIELD = 3; // 3 refs x 8,192-char values => bounded output
if (countRefs(field) > MAX_REFS_PER_FIELD) throw new BadRequest(...)02 · Run it on your appThe check
If your app expands user-supplied templates, is the largest possible output bounded by the input rules alone, without a check that a concurrent edit can get around?
If the honest answer is no or not sure, this is worth a look before it reaches production.