The shared brief-wait admission core: a weighted door/wait/shed machine both serve admission (Ecluse.Core.Server.Admission) and byte-weighted publish admission (Ecluse.Core.Server.Admission.Bytes) are built from. The unit-slot version is this core at weight one with the room equal to the capacity.

A handle caps the aggregate weight concurrently held and retains a __bounded room of waiters__: an acquisition takes its weight immediately, waits briefly for room, or is refused. This bounds aggregate residency by construction while absorbing a burst that merely brushes the capacity, so near-capacity load degrades into short queueing delay rather than a refusal the client immediately retries. Refusal is reserved for genuine overload: a waiting room already at its bound (the deep-overflow band, refused instantly and cheaply) or a wait that outlives its budget.

Instant shedding is self-amplifying under a hammering client: each refusal is answered in microseconds, so the client comes straight back, and the refusal work itself competes for the cores the admitted work needs. Waiting in-process is a blocked green thread -- nearly free -- and every release goes to work that has already arrived. The wait budget (admissionWaitMicros) equals the shed path's Retry-After: 1 hint, so a request is never refused faster than the client would have been told to come back.

Two fairness properties, one deliberate limit:

• A newcomer never jumps a non-empty waiting room: capacity is taken directly only when no one is waiting, so arrival order is respected between the room and the door.
• Within the room, wake-up order is not FIFO (STM retry semantics: all waiters race, first commit wins). With the room bounded and turnover far faster than the budget, starvation is not a practical concern, and strict ticketing is complexity this surface has not earned.

Held weight is released across normal completion, failure, and asynchronous cancellation. The waits run masked: a blocked STM retry remains interruptible (a cancellation lands and aborts the transaction, taking nothing), while a committed acquire returns with exceptions still masked, so weight can never be lost between acquisition and the protected run. Release publishes the in-flight gauge decrement before returning capacity to the door, so a newly admitted request cannot make the observable gauge transiently exceed the configured bound; capacity is still returned if that observer throws.

The two instances differ only in their construction policy (the serve handle errors on a non-positive capacity, the byte handle clamps to one byte and clamps each call's weight to the capacity) and in the observer callbacks they supply; the door discipline lives here so a fix to the slot-leak-prone reasoning is made once for both.