Part of #1035: **upload session concurrency cap**. A global cap over the population that holds object-storage staging buffers, enforced in `internal/storage` where the sessions are opened, with a bounded wait that ends in a `503 UNAVAILABLE` rather than an unbounded park. It changes no commit protocol, no path layout, and no session row shape. **References:** [plan](https://gitlab.com/gitlab-org/ops/artifact-registry/-/blob/main/docs/plans/2026-09-03-upload-session-concurrency-cap.md) (see "Step 12"). No spec owns this control: [docs/dev/storage.md](https://gitlab.com/gitlab-org/ops/artifact-registry/-/blob/main/docs/dev/storage.md) is the present-tense authority for `BlobStore` and `Session`. The plan's research is pinned at `655743520da9fd935d7884db34ad074e6046013c`, so re-derive any count, line, or file list before acting on it. **Type:** `feat` | **Depends on:** Steps 2, 11 | **MR title marker:** `(upload-session-concurrency-cap plan: 12/12)` **Why a method rather than a carve-out.** `handleDelete` resumes only to call `Cancel`, and the ruling that teardown must not be refusable is right, but not because no writer is involved: the resume opens a `driver.Writer`, and `Cancel` reaches `cancelStaging`, which opens a second whenever `writerClosed || writer == nil`. What makes an ungated teardown *safe* is checkable instead: neither driver allocates the staging buffer at open. GCS grows it on write, and the S3 writer is constructed with `new(bytes.Buffer)`, which holds no backing array until something is written. So a teardown writer that is never written holds none of the memory this cap bounds. A dedicated `CancelSession` is ungated by construction, which removes the opt-out option, its doc-comment obligation, the problem that a gate inside `ResumeSession` cannot tell `DELETE` from `PATCH`, and the need for `resumeSession` to carry a per-caller flag. The cost is an interface addition on `storage.BlobStore`, `PgBlobStore`, `internal/storage/stub`, OCI's narrowed `blobStore` seam and that seam's fakes. The two must land together: gating `ResumeSession` before `DELETE` moves off it would let a teardown be refused. **Why the acquire sits in `resumeRecover`.** Step 11's reason for acquiring ahead of the row work (a shed after the INSERT strands a row for the ADR-011 purger) does not transfer, because the resume path reads, on `D2b` deletes, and inserts nothing. What decides the placement here is what a slot counts: the acquire goes immediately before the fourth `driver.Writer` open, so only a resume that actually gets a staging buffer holds a slot, and the gauge keeps meaning "sessions that can hold a buffer" rather than "resume attempts". The two finalize-only modes then cost nothing, and a memory cap can no longer refuse the commit of a fully staged blob to protect memory that request would never allocate. The accepted cost is one wasted Postgres round-trip per shed. **Rebase form.** This step opens on Step 11, whose MR the project squash-merges, so rebase with `git rebase --onto <main-pin> <Step 11 tip>` rather than plain `git rebase origin/main`, which would replay Step 11's already-landed commits. ## Scope Give session teardown its own ungated store method, move `handleDelete` onto it, and only then gate the resume path, at `resumeRecover` rather than at `ResumeSession`'s entry. ## Files - `internal/storage/blobstore.go`, `internal/storage/pg_blobstore.go` (Modify): `CancelSession`, and the resume acquire in `resumeRecover` immediately before the fourth `driver.Writer` open, plus its release func, paired with a release-unless-owned `defer` that fires on every path not returning a writable session, including the tail-call into `recoverFinalized`. - `internal/storage/stub/session.go` (Modify): the stub's `CancelSession`, and its `ResumeSession` signature. - `internal/format/oci/upload.go` (Modify): `handleDelete` calls `CancelSession`; `handlePatch` and `handlePut` defer the release. Also the narrowed `blobStore` seam's `ResumeSession` and `CancelSession` declarations, which this file holds. - `internal/storage/testsuites/session_lifecycle.go`, `internal/storage/testsuites/session_faults.go`, `internal/storage/testsuites/session_expiry.go`, `internal/storage/testsuites/chunked_upload.go` (Modify): **29** `.ResumeSession(` call sites at the plan's pin (8, 18, 2 and 1 across the four files). The count is of method calls rather than name matches; bare `ResumeSession(` returned 33, the extra four being `runResumeSession` and `testCtxCanceledResumeSession`. Re-derive at the head SHA. - Every test fake declaring `ResumeSession` (Modify): **10** declarations across 10 files at the plan's pin, from `grep -rn ") ResumeSession(" internal/ --include='*_test.go'`. They embed `storage.BlobStore`, so one left at the old signature shadows the embedded method and its type stops satisfying the interface silently. - `internal/metrics/cardinality.go` (Modify): `op` from 7 to 8, with `CancelSession` added to its closed set, which is rejected on first emission until this lands. `CancelSession` **does** carry the `observeBlobStoreCall` defer, like every other `BlobStore` method: the alternative leaves it the one method with no timing and falsifies `docs/dev/storage.md`'s "Per-`BlobStore`-method timing and count" for the row this step already edits. - `docs/dev/storage.md` (Modify): `CancelSession` and why teardown is ungated. ## Acceptance A `PATCH` or `PUT` resume against a genuinely full gate sheds, which is the paired positive the design needs and which would stay green if the gate were wired to skip every resume. A `DELETE` against the same full gate still cancels and answers `204`, for a `docker` repository and for an `oci` one. The slot returns on every arm past the acquire that does not hand back a writable session. Moving the acquire into `resumeRecover` shortens that table rather than lengthening it, and the shortening is the point: `ResumeSession`'s own arms now sit **before** the acquire and hold no slot at all. Past the acquire the arms are six across two functions. In `resumeRecover`: the offset-divergence error, and the open-staging-writer failure at that `driver.Writer` site. In `recoverFinalized`, which `resumeRecover` tail-calls once the writer open reports no resumable staging state: both `Exists` probe failures, staging and destination; the delete-orphan-`upload_sessions` failure; and the `ErrSessionUnrecoverable` return for `D2b` that the delete precedes. Plus the two finalize-only modes, `D1b` and `D2a`, which return a `Session` with **no** writer and so release before returning it: those two are the cases that prove the release is keyed on holding a buffer rather than on returning a session. `ResumeSession`'s `activeSessionRow` failure, its hash-state unmarshal failure and its `ctx.Err()` check are deliberately **not** on the list, because all three precede the acquire. ## Tests `internal/storage/pg_blobstore_integration_test.go` (Modify), `internal/format/oci/upload_test.go` (Modify). ## Forecast ~200 source, ~330 test, ~530 total. Over the 500-LOC ceiling by ~30.