A process-wide serve admission handle. The constructor is hidden so only the checked acquire/wait/release operations can mutate its capacity and waiting room.

Allocate a bounded handle with the given positive capacity, a waiting room of the same size, and the serveAdmissionWaitMicros budget.

The room equals the capacity so a burst of twice the cap is absorbed as brief queueing while anything deeper still gets the instant, cheap refusal -- bounding both waiting memory and worst-case latency. Configuration parsing enforces the positive-capacity precondition; the unchecked integer stays at this internal composition boundary so every request pays only an STM transaction, not another validation step.

Run an action within the admission bound. Nothing means the request was refused -- the waiting room was full, or no slot freed within the wait budget -- and the caller should shed it.

A request that had to wait records ecluse.serve.admission.queued on admission, so the queue's work is visible beside the in-flight gauge and the shed decisions.

Inlined so the literal AdmissionObservers folds into the shared core's saturated call at each request site, leaving no per-request record allocation on the admitted hot path.

How long an operation finding the cap busy waits for a slot before it is refused: the shared admissionWaitMicros budget, equal to the shed path's Retry-After: 1 hint.

Allocate a bounded handle with an explicit waiting-room bound and wait budget (microseconds), so a test can exercise the queueing behaviour without real-second sleeps. Production goes through newServeAdmission, which fixes both from the capacity; a room of zero reproduces pure acquire-or-refuse admission.