Caps exist only on event/heatmap paths; the pageview path stores title/referrer/path verbatim — a 2MB title 500'd against the DynamoDB item limit and the pageview was LOST (live-verified). No body-size cap before request.json() enables memory-amplification DoS. Fix: reject bodies >16KB pre-parse; slice pageview fields.
From the production-readiness audit (docs/research/production-readiness.md, eacf996). Verified with live probes where stated.