@@ -41,7 +41,7 @@ Key abstractions:
 - `com.retailsvc.http.validate.DefaultValidator` — single class using `switch` pattern-match over `Schema` subtypes. Validation failures produce RFC 9457 `application/problem+json` 400 responses.
 - `com.retailsvc.http.internal.Router` — two indexes: exact path map and templated path list. Resolves `operationId` + extracted path variables for each request.
 - `TypeMapper` — per-media-type request parsing and response writing; registered via `Builder.bodyMapper(...)`, with `GsonTypeMapper` auto-registered when Gson is on the classpath.
-- `com.retailsvc.http.Request` — an immutable record-like carrier built from primitives (body bytes, path parameters, raw query string, a header lookup function), never the `HttpExchange`. `bytes()` returns the decoded body, `parsed()` the object produced by the `TypeMapper`. A handler that implements `StreamingRequestHandler` instead gets the body unread: `RequestPreparationFilter` routes first, validates parameters, peeks one byte, and binds `Request.streaming(...)`, whose `bodyStream()` decodes lazily (`internal/DecodingInputStream`) under the same size cap, or not at all when the handler's `decodeContent()` is false; `bytes()` / `parsed()` throw. `internal/StreamingLimit` optionally caps concurrent streaming requests server-wide (503 + `Retry-After`). `internal/RequestContentType` matches `Content-Type` against `requestBody.content` for both paths.
+- `com.retailsvc.http.Request` — an immutable record-like carrier built from primitives (body bytes, path parameters, raw query string, a header lookup function), never the `HttpExchange`. `bytes()` returns the decoded body, `parsed()` the object produced by the `TypeMapper`. A handler that implements `StreamingRequestHandler` instead gets the body unread: `RequestPreparationFilter` routes first, validates parameters, peeks one byte, and binds `Request.streaming(...)`, whose `bodyStream()` decodes lazily (`internal/DecodingInputStream`) under its own `long` size cap (`maxDecompressedStreamingRequestBytes`, defaulting to the buffered one), or not at all when the handler's `decodeContent()` is false; `bytes()` / `parsed()` throw. `internal/StreamingLimit` optionally caps concurrent streaming requests server-wide (503 + `Retry-After`). `internal/RequestContentType` matches `Content-Type` against `requestBody.content` for both paths.
 - `com.retailsvc.http.ContentCoding` — a pluggable HTTP content coding. gzip is built in (`internal/GzipCoding`); callers register others on the builder, held per direction in `internal/ContentCodings`. `RequestBodyReader` decodes requests under the size cap and `ResponseRenderer` codes responses. See the README's "Content encoding" section for the policy.
 
 ## Conventions
 
@@ -498,7 +498,8 @@ OpenApiServer.builder()
 
 Note this bounds the *inflated* size of a coded body, whatever the coding. It is not a request size
 limit — a body that arrives uncompressed is read in full, as it always has been. For a
-[streaming handler](#streaming-request-bodies), the cap is enforced as the handler reads.
+[streaming handler](#streaming-request-bodies), the cap is enforced as the handler reads, and
+[can be set separately](#raising-the-cap-for-streamed-bodies), past 2 GiB.
 
 **Responses.** A body is gzipped when the client sends `Accept-Encoding: gzip`, the media type is
 text-shaped (`text/*`, `application/json`, `application/xml`, `application/yaml`, and the `+json` /
@@ -1033,15 +1034,15 @@ What changes:
   handler returns, the response is sent and the exchange closed. A body the handler leaves unread
   is drained up to 64 KiB (the JDK's `sun.net.httpserver.drainAmount`); past that, the connection
   is closed rather than reused.
-- **A `Content-Encoding` is decoded as the handler reads**, still capped by
-  [`maxDecompressedRequestBytes`](#content-encoding), which can't go above 2 GiB — use a
-  [raw body](#raw-bodies) to take larger coded uploads. Going over the cap, or a body that fails to
-  decode, surfaces from `read` as a `BadRequestException` (413 or 400). The client dropping the
-  connection surfaces as the plain `IOException` it would be for an uncoded body. Let it propagate and the
-  `ExceptionHandler` renders it as usual. By then the handler may already have passed earlier bytes
-  on, so write to storage in a way you can abandon, such as a resumable upload you finalise only
-  after the last read. The handler sees no `Content-Encoding` and no `Content-Length` for a
-  decoded body.
+- **A `Content-Encoding` is decoded as the handler reads**, capped by
+  [`maxDecompressedRequestBytes`](#content-encoding) unless a
+  [streaming cap](#raising-the-cap-for-streamed-bodies) is set. Going over the cap, or a body that
+  fails to decode, surfaces from `read` as a `BadRequestException` (413 or 400). The client
+  dropping the connection surfaces as the plain `IOException` it would be for an uncoded body.
+  Let it propagate and the `ExceptionHandler` renders it as usual. By then the handler may
+  already have passed earlier bytes on, so write to storage in a way you can abandon, such as a
+  resumable upload you finalise only after the last read. The handler sees no `Content-Encoding`
+  and no `Content-Length` for a decoded body.
 - **An uncoded body has no size limit.** Bound it yourself if you need to, for example by counting
   as you read, and bound how many run at once with
   [`maxConcurrentStreamingRequests`](#limiting-concurrent-streaming-requests).
@@ -1053,6 +1054,21 @@ Tests can build a streaming request directly with `Request.streaming(InputStream
 buffered requests, `bodyStream()` returns a fresh stream over `bytes()`, so a helper that reads a
 stream works for both.
 
+### Raising the cap for streamed bodies
+
+`maxDecompressedRequestBytes` bounds buffered bodies too, which are held in a `byte[]`, so it
+can't go above 2 GiB. A streamed body is never held in memory, so it can have a cap of its own,
+any positive `long`:
+
+```java
+OpenApiServer.builder()
+    .maxDecompressedRequestBytes(32 * 1024 * 1024)                  // buffered: 32 MiB
+    .maxDecompressedStreamingRequestBytes(50L * 1024 * 1024 * 1024) // streamed: 50 GiB
+```
+
+Left unset, streamed bodies share `maxDecompressedRequestBytes`. It covers decoded bodies only;
+uncoded and [raw](#raw-bodies) bodies have no cap either way.
+
 ### Raw bodies
 
 To store or forward a body exactly as the client sent it, wrap the handler in
@@ -1063,8 +1079,8 @@ To store or forward a body exactly as the client sent it, wrap the handler in
 ```
 
 The handler then reads the coded bytes. `Content-Encoding` and `Content-Length` are visible as
-sent. `maxDecompressedRequestBytes` doesn't apply, and a coding the server doesn't know is passed
-on instead of being answered 415.
+sent. Neither decompression cap applies, and a coding the server doesn't know is passed on
+instead of being answered 415.
 
 ### Limiting concurrent streaming requests
 
 
@@ -4,7 +4,7 @@
 
 **Goal:** Let a handler opt into reading the request body as it arrives, via a `StreamingRequestHandler` marker type, so memory per request no longer grows with the body — while routing, parameter validation, security, interceptors and error rendering keep working.
 
-**Architecture:** `RequestPreparationFilter` routes before reading the body. For an operation whose handler is a `StreamingRequestHandler`, it opens the body through a new `RequestBodyReader.stream(...)` instead of `read(...)`, validates parameters, peeks one byte to apply the `required` / `Content-Type` checks, and binds a `Request` built with `Request.streaming(...)`. Coded bodies are decoded lazily by an internal `DecodingInputStream` that enforces `maxDecompressedRequestBytes` as the handler reads. `ExtrasRouter` takes the same split for extra routes. Buffered operations keep their exact behaviour and order.
+**Architecture:** `RequestPreparationFilter` routes before reading the body. For an operation whose handler is a `StreamingRequestHandler`, it opens the body through a new `RequestBodyReader.stream(...)` instead of `read(...)`, validates parameters, peeks one byte to apply the `required` / `Content-Type` checks, and binds a `Request` built with `Request.streaming(...)`. Coded bodies are decoded lazily by an internal `DecodingInputStream` that enforces the decompression cap as the handler reads (`maxDecompressedStreamingRequestBytes`, defaulting to `maxDecompressedRequestBytes`; Task 15). `ExtrasRouter` takes the same split for extra routes. Buffered operations keep their exact behaviour and order.
 
 **Additions (Tasks 9–12), review fixes (Task 13):** Content-Type matching with media-type ranges and a missing-header default, `Request.headers()`, raw (undecoded) streaming bodies, and a server-wide cap on concurrent streaming requests. See the spec's "Additions" section.
 
@@ -186,3 +186,13 @@ Two independent reviews (Opus, Fable) returned SHIP WITH FIXES.
 - [x] **Step 3:** SonarLint sweep (`sonar_analyze_file`) over the changed main and test files; fix new findings. The `java:S9391` hit in `OpenApiServer.validateHandlerWiring` predates this change.
 - [x] **Step 4:** Note `StreamingRequestHandler` in `CLAUDE.md`'s architecture section.
 - [x] **Step 5:** Commit on `feat/streaming-request-bodies`: `feat: Support streaming request bodies` (signed).
+
+## Task 15: Streaming decompression cap
+
+Spec: "Streaming decompression cap". Lifts the 2 GiB ceiling on decoded streams without touching the buffered path.
+
+- [x] **Step 1:** `RequestBodyReader`: three-argument constructor `(maxDecompressedBytes, maxStreamedDecompressedBytes, decoders)`, both validated positive; the two-argument constructor delegates with the same cap. `stream` passes the streamed cap to `DecodingInputStream`; `read` is unchanged.
+- [x] **Step 2:** `Builder.maxDecompressedStreamingRequestBytes(long)` — any positive `long`; unset falls back to `maxDecompressedRequestBytes` at `build()`. Javadoc on both setters.
+- [x] **Step 3:** Tests. Unit: streamed body held to its own cap, buffered body keeps its cap when the streamed one is higher, constructor rejects a non-positive streamed cap; builder accepts `Integer.MAX_VALUE + 1` and `Long.MAX_VALUE`, rejects 0 and -1. IT: a gzip body past the buffered cap streams when the streaming cap is higher; one past the streaming cap is 413.
+- [x] **Step 4:** README "Raising the cap for streamed bodies", cross-links from "Content encoding", the streaming bullets and "Raw bodies"; spec section and constraint; this task.
+- [x] **Step 5:** `pre-commit run`, `mvn verify`, SonarLint on changed files; commit `feat: Separate decompression cap for streamed bodies` (signed) and push to PR #131.
@@ -64,7 +64,8 @@ Buffered operations keep their exact order (body read, then 404/405, then valida
 
 A coded body is decoded lazily by `DecodingInputStream`, which opens the decoder once the first
 byte arrives (so an empty coded body reads as empty, as when buffered) and counts decoded bytes
-against `maxDecompressedRequestBytes`. Exceeding the cap throws `BadRequestException(413)` from
+against the streaming cap (`maxDecompressedStreamingRequestBytes`, defaulting to
+`maxDecompressedRequestBytes`; see "Streaming decompression cap"). Exceeding the cap throws `BadRequestException(413)` from
 `read`; a decoder failure throws `BadRequestException(400)`. Both propagate out of the handler to
 the `ExceptionHandler`. The header view hides `Content-Encoding` and `Content-Length` for a decoded
 body, since the decoded length is unknown up front. Identity bodies are passed through uncapped,
@@ -135,6 +136,23 @@ binding and the extras router.
   `maxConnections` would also shed health probes and cheap API calls under an upload burst, which
   is the opposite of what shedding is for.
 
+### Streaming decompression cap
+
+`maxDecompressedRequestBytes` bounds both paths, but the buffered one decodes into a `byte[]`, so
+the builder rejects values above `Integer.MAX_VALUE`. That needlessly held decoded streams to
+2 GiB, since `DecodingInputStream` counts in a `long` and holds nothing.
+
+- `Builder.maxDecompressedStreamingRequestBytes(long)` sets the cap for bodies decoded as a
+  streaming handler reads them; any positive `long`, else `IllegalArgumentException`.
+- Unset, it defaults to `maxDecompressedRequestBytes`, so existing servers behave as before.
+- `RequestBodyReader` gains a three-argument constructor `(maxDecompressedBytes,
+  maxStreamedDecompressedBytes, decoders)`; the two-argument one passes the same cap twice.
+  `read` keeps the first, `stream` uses the second.
+- Uncoded and raw bodies stay uncapped. Additive only: no existing signature or default changes.
+
+A single setting that the buffered path silently clamps was rejected: one value would mean
+different things on the two paths.
+
 ## Constraints
 
 - The stream must be read inside `handle()`, on the request thread. After the handler returns,
@@ -148,8 +166,9 @@ binding and the extras router.
   `Retry-After`.
 - `Expect: 100-continue` is answered by the JDK server before any filter runs, so a shed client
   may still send its body; the server drains up to 64 KiB of it, then closes the connection.
-- The decoded-size cap can't exceed 2 GiB (`maxDecompressedRequestBytes` is bounded by the
-  buffered path's `byte[]`); raw bodies have no cap.
+- `maxDecompressedRequestBytes` can't exceed 2 GiB (bounded by the buffered path's `byte[]`).
+  Streamed bodies take their own `long` cap, so this no longer limits them; raw bodies have no
+  cap.
 - `DecodingInputStream` turns only the coding's failures into a 400. A connection failure is
   tagged as it leaves the raw stream and rethrown unchanged, so a client disconnect is an
   `IOException`, as for an uncoded body.
 
@@ -256,6 +256,7 @@ public static final class Builder {
     private final Map<String, SchemeValidator> securityValidators = new LinkedHashMap<>();
     private boolean externalAuth = false;
     private long maxDecompressedRequestBytes = RequestBodyReader.DEFAULT_MAX_DECOMPRESSED_BYTES;
+    private Long maxDecompressedStreamingRequestBytes;
     private long minCompressibleResponseBytes = ResponseRenderer.DEFAULT_MIN_COMPRESSIBLE_BYTES;
     private final List<ContentCoding> requestCodings = new ArrayList<>();
     private final List<ContentCoding> responseCodings = new ArrayList<>();
@@ -408,7 +409,9 @@ public Builder https(Path certificateChainPem, Path privateKeyPem) {
      * Ceiling on the inflated size of a gzip request body, 10 MiB by default. A compressed payload
      * can expand by orders of magnitude, so this bounds what a single request may allocate;
      * exceeding it fails the request with 413. Bodies that arrive uncompressed are not affected.
-     * The cap holds for a {@link StreamingRequestHandler} too, enforced as the handler reads.
+     * The cap holds for a {@link StreamingRequestHandler} too, enforced as the handler reads,
+     * unless {@link #maxDecompressedStreamingRequestBytes(long)} sets one of its own. The body is
+     * held in a {@code byte[]}, so this can't exceed {@link Integer#MAX_VALUE}.
      */
     public Builder maxDecompressedRequestBytes(long maxDecompressedRequestBytes) {
       if (maxDecompressedRequestBytes <= 0 || maxDecompressedRequestBytes > Integer.MAX_VALUE) {
@@ -422,6 +425,23 @@ public Builder maxDecompressedRequestBytes(long maxDecompressedRequestBytes) {
       return this;
     }
 
+    /**
+     * Ceiling on the decoded size of a coded request body read by a {@link
+     * StreamingRequestHandler}, enforced as the handler reads; exceeding it fails the read with
+     * 413. Defaults to {@link #maxDecompressedRequestBytes(long)}. The body is never held in
+     * memory, so any positive {@code long} is accepted, past the 2 GiB that bounds a buffered body.
+     * Bodies that arrive uncompressed, and raw bodies, are not affected.
+     */
+    public Builder maxDecompressedStreamingRequestBytes(long maxDecompressedStreamingRequestBytes) {
+      if (maxDecompressedStreamingRequestBytes <= 0) {
+        throw new IllegalArgumentException(
+            "maxDecompressedStreamingRequestBytes must be positive, got "
+                + maxDecompressedStreamingRequestBytes);
+      }
+      this.maxDecompressedStreamingRequestBytes = maxDecompressedStreamingRequestBytes;
+      return this;
+    }
+
     /**
      * Smallest response body worth compressing, 1 KiB by default. Below this, the coding costs more
      * than it saves. Set it to 0 to compress every compressible body, or high enough to exceed any
@@ -552,7 +572,12 @@ public OpenApiServer build() throws IOException {
               extras,
               externalAuth,
               List.copyOf(afterHooks),
-              new RequestBodyReader(maxDecompressedRequestBytes, codings.decoders()),
+              new RequestBodyReader(
+                  maxDecompressedRequestBytes,
+                  maxDecompressedStreamingRequestBytes != null
+                      ? maxDecompressedStreamingRequestBytes
+                      : maxDecompressedRequestBytes,
+                  codings.decoders()),
               new ResponseRenderer(resolved, minCompressibleResponseBytes, codings.encoders()),
               streamingLimit);
       int resolvedPort = resolvePort();
 
@@ -34,15 +34,34 @@ public final class RequestBodyReader {
   private static final String CONTENT_LENGTH = "Content-Length";
 
   private final long maxDecompressedBytes;
+  private final long maxStreamedDecompressedBytes;
   private final int readLimit;
   private final Map<String, ContentCoding> decoders;
 
+  /** A reader holding buffered and streamed bodies to the same cap. */
   public RequestBodyReader(long maxDecompressedBytes, Map<String, ContentCoding> decoders) {
+    this(maxDecompressedBytes, maxDecompressedBytes, decoders);
+  }
+
+  /**
+   * A reader with separate caps: {@code maxDecompressedBytes} for a body read in full, {@code
+   * maxStreamedDecompressedBytes} for one decoded as a streaming handler reads it. Only the first
+   * is bounded by what fits in a {@code byte[]}.
+   */
+  public RequestBodyReader(
+      long maxDecompressedBytes,
+      long maxStreamedDecompressedBytes,
+      Map<String, ContentCoding> decoders) {
     if (maxDecompressedBytes <= 0) {
       throw new IllegalArgumentException(
           "maxDecompressedBytes must be positive, got " + maxDecompressedBytes);
     }
+    if (maxStreamedDecompressedBytes <= 0) {
+      throw new IllegalArgumentException(
+          "maxStreamedDecompressedBytes must be positive, got " + maxStreamedDecompressedBytes);
+    }
     this.maxDecompressedBytes = maxDecompressedBytes;
+    this.maxStreamedDecompressedBytes = maxStreamedDecompressedBytes;
     this.readLimit = (int) Math.min(maxDecompressedBytes, Integer.MAX_VALUE - 1L) + 1;
     this.decoders = Map.copyOf(decoders);
   }
@@ -95,7 +114,7 @@ public Streamed stream(HttpExchange exchange, boolean decode) {
       case Identity _ -> new Streamed(raw, copy(headers));
       case Coded(ContentCoding coding) ->
           new Streamed(
-              new DecodingInputStream(coding, raw, maxDecompressedBytes),
+              new DecodingInputStream(coding, raw, maxStreamedDecompressedBytes),
               decodedHeaders(headers, null));
       case Unsupported _ ->
           throw new BadRequestException(
 
@@ -65,6 +65,20 @@ void rejectsNonPositiveMaxDecompressedRequestBytes() {
         .hasMessageContaining("-1");
   }
 
+  @Test
+  void streamingDecompressionCapAcceptsAnyPositiveLong() {
+    OpenApiServer.Builder b = OpenApiServer.builder();
+
+    assertThat(b.maxDecompressedStreamingRequestBytes(Integer.MAX_VALUE + 1L)).isSameAs(b);
+    assertThat(b.maxDecompressedStreamingRequestBytes(Long.MAX_VALUE)).isSameAs(b);
+    assertThatThrownBy(() -> b.maxDecompressedStreamingRequestBytes(0))
+        .isInstanceOf(IllegalArgumentException.class)
+        .hasMessageContaining("0");
+    assertThatThrownBy(() -> b.maxDecompressedStreamingRequestBytes(-1))
+        .isInstanceOf(IllegalArgumentException.class)
+        .hasMessageContaining("-1");
+  }
+
   @Test
   void rejectsInvalidMaxConcurrentStreamingRequests() {
     OpenApiServer.Builder b = OpenApiServer.builder();