Brief-wait admission control for metadata-bearing serve work.

The handle caps concurrent operations and retains a bounded room of waiters: an operation acquires a slot immediately, waits briefly for one, or is refused. This bounds aggregate metadata residency by construction while absorbing a burst that merely brushes the cap, so near-capacity load degrades into short queueing delay rather than a refusal the client immediately retries. Refusal is reserved for genuine overload: a waiting room already at its bound (the deep-overflow band, refused instantly and cheaply) or a wait that outlives its budget.

Instant shedding is self-amplifying under a hammering client: each refusal is answered in microseconds, so the client comes straight back, and the refusal work itself competes for the cores the admitted work needs. Waiting in-process is a blocked green thread -- nearly free -- and every slot release goes to work that has already arrived. The wait budget equals the shed path's Retry-After: 1 hint, so a request is never refused faster than the client would have been told to come back.

Two fairness properties, one deliberate limit:

• A newcomer never jumps a non-empty waiting room: a freed slot is only taken directly when no one is waiting, so arrival order is respected between the room and the door.
• Within the room, wake-up order is not FIFO (STM retry semantics: all waiters race, first commit wins). With the room bounded at the capacity and slot turnover far faster than the budget, starvation is not a practical concern, and strict ticketing is complexity this surface has not earned.

Acquired slots are released across normal completion, failure, and asynchronous cancellation. The waits run masked: a blocked STM retry remains interruptible (a cancellation lands and aborts the transaction, taking nothing), while a committed acquire returns with exceptions still masked, so a slot can never be lost between acquisition and the protected run.