Part of #1035: **upload session concurrency cap**. A global cap over the population that holds object-storage staging buffers, enforced in `internal/storage` where the sessions are opened, with a bounded wait that ends in a `503 UNAVAILABLE` rather than an unbounded park. It changes no commit protocol, no path layout, and no session row shape. **References:** [plan](https://gitlab.com/gitlab-org/ops/artifact-registry/-/blob/main/docs/plans/2026-09-03-upload-session-concurrency-cap.md) (see "Step 2"). No spec owns this control: [docs/dev/storage.md](https://gitlab.com/gitlab-org/ops/artifact-registry/-/blob/main/docs/dev/storage.md) is the present-tense authority for `BlobStore` and `Session`. The plan's research is pinned at `655743520da9fd935d7884db34ad074e6046013c`, so re-derive any count, line, or file list before acting on it. **Type:** `chore` | **Depends on:** none | **MR title marker:** `(upload-session-concurrency-cap plan: 2/12)` **MR:** !2408. While it is open the gate exists on no branch but its own. Once it merges, `internal/storage/upload_admission.go` and `ErrUploadSessionsBusy` are on `main` and Steps 3, 4, 5, 6, 10, 11 and 12 can open against them. ## Scope The weighted admission gate with its wait-then-shed acquire, the exported shed sentinel, and its metrics. Nothing calls it, so the cap is inert. The gate wraps `golang.org/x/sync/semaphore`.Weighted rather than a counting channel, so a caller needing two sessions takes both units in one `Acquire(ctx, 2)` or takes none. The release closure is idempotent, a deliberate departure from the npm precedent rather than a copy of it: `Weighted.Release` panics with `semaphore: released more than held`, so the `sync.Once` turns a crash into a no-op. ## Files - `internal/storage/upload_admission.go` (Create): the gate type, a constructor panicking on a non-positive capacity or wait (Step 1 makes that a composition bug rather than reachable config), an `Acquire(ctx, n)` that bounds the wait with a `context.WithTimeout` of the configured budget and returns a `sync.Once`-guarded release closure, and the reservation value an already-admitted caller hands to `NewSession` so it is not charged twice. One arm decides what a failed `Acquire` returns, and it reads the **caller's** context rather than the derived one: if the caller's own context is done the gate returns that error and books **no** shed, and it returns `ErrUploadSessionsBusy` only when the budget expired with the caller's context still live. Disconnect is the dominant abort, so booking it as a shed would move every mid-acquire disconnect into the counter an operator alerts on. The sentinel is returned **unwrapped**, and its arm in `outcomeForError` has to sit **above** that function's `cancelled` arm, or a sentinel wrapped around `ctx.Err()` matches by `errors.Is` and books `outcome="cancelled"` however the shed arm below it is written. - `internal/storage/errors.go` (Modify): `ErrUploadSessionsBusy`. - `internal/storage/metrics.go` (Modify): the shed's `outcome` constant, plus four vectors named on the `upload_session_` prefix the existing session metrics share. A gauge for units in use. A gauge for the derived capacity, so the first has a denominator and an alert can be written on a ratio. A counter for sheds carrying an `admission_source` label over the six call sites, counting a budget expiry only and never an `Acquire` abandoned by its caller. And a histogram of hold durations observed at release, which is how a leaked slot and genuine saturation are told apart: a leaked slot never releases and so never enters the histogram, so in-use pinned at capacity with only short holds is a leak while in-use at capacity with long holds is saturation. `admission_source` takes its own name rather than joining the existing `source`, per the route-vocabulary rule in `internal/metrics/cardinality.go`; `source` is pinned exact-2 and no value spans the two sets. - `internal/metrics/cardinality.go` (Modify): pin `admission_source` at 6 with its closed set. `internal/metrics/audit.go` rejects an unpinned label value on first emission, so the shed counter cannot emit at all until this lands with it. - `internal/storage/metrics_test.go` (Modify): the four new vectors in `TestRegisterMetrics_ExposesAllVectors`' `want` list, which asserts the list length against `storageCollectors`, so four additions redden it until the list grows with them. ## Acceptance With every unit held, a further `Acquire` returns `ErrUploadSessionsBusy` and increments the shed counter, asserted as outcomes and counter deltas with no wall-clock floor anywhere. An `Acquire` whose caller context is already done returns **that context's error**, takes no unit and books **no** shed, asserted as the error plus a zero delta on the shed counter. One whose context dies while parked leaves the gate at its prior level. A gate of capacity N admits exactly N units again once every release has run. One release closure called twice frees exactly one unit and does **not** panic, which is the case that reddens when the `sync.Once` guard is deleted. The floor progress case: **4** concurrent two-unit operations against a gate of capacity 2, requiring **every** one of them to complete rather than asserting a derived number. The 4 is a literal because `rebuildMaxRendering` is unexported in a package that imports `internal/storage`, and because Step 11's clamp recomputes it to 1 at capacity 2, which would drive one operation and let the split-acquire regression ship green. Re-derive the literal if `rebuildMaxRendering` moves. A waiter parked on a full gate is **admitted** when a holder releases, synchronised on a channel rather than a clock, which is the one criterion an implementation that sheds immediately on a full gate fails while satisfying every other. And a waiter whose budget expires before any holder releases sheds, driven under `testing/synctest` so the expiry is an ordered event rather than a race. ## Tests `internal/storage/upload_admission_internal_test.go` (Create), in-package because the gate is unexported, named on the `_internal_test.go` convention this package already uses. The budget-expiry case runs inside `synctest.Test`; nothing in the tree imports `testing/synctest` yet, so this file is where it starts. Emission assertions live here rather than in `metrics_test.go`, whose own header says it verifies the vectors and not emission. ## Forecast ~175 source, ~510 test, ~685 total. Over the 500-LOC ceiling by ~185; the MR description carries the split.