A count is not a claim

A Go service checks inFlight < 100 before spawning. Two goroutines observe 99 and both enter. The check described capacity; it did not transfer ownership.

Let total credit be $C$. At every observation, free credit plus credit held by admitted work equals $C$. Acquisition transfers one unit; release transfers it back. A semaphore implements this accounting. A bounded queue stores credits as empty positions. Backpressure means no credit is currently available, so the producer waits, refuses, or sheds work according to policy.

Cancellation has one direction—live toward canceled—and settlement returns a credit exactly once. A double release is as wrong as a leak because it invents capacity. Tests should permute completion, failure, and cancellation and check the conservation equation after every transition.

Where the model stops

Credits compose only when their units and scope match. Ten database connections cannot pay for ten megabytes. Weighted work may require multiple units, but a weight is useful only when it predicts the constrained resource. Refuse a semaphore where an ordinary immutable length check already occurs under one owner.

Lessons

• Capacity must be acquired, not merely observed.
• Admission and release conserve credits.
• Backpressure is exhaustion made explicit.
• Cancellation and failure return ownership exactly once.

Practice

1. Trace three credits through four contending workers.
2. Find the double-release path in a cancel-then-complete trace.
3. Transfer the model to memory pages, API rate tokens, or seats in a waiting room.

Capacity bounds how much may live. Part IV asks when a whole family of values may die together.

References

1. “The Go Memory Model.” — synchronization requirements for observing concurrent state.
2. “Edsger W. Dijkstra, “Cooperating Sequential Processes”.” — the semaphore lineage and disciplined process coordination.