Runtime & concurrency
Reveal answer and reasoning
Pass cancellation to the acquisition operation and construct a lease only after that wait succeeds. Do not release on the canceled path, because it never owned a permit. Keep the atomic single-release responsibility in the lease, while an outer owner controls when new acquisitions stop and when the underlying gate can finally be disposed. A lease should not destroy a synchronization resource still shared by other operations.
Test cancellation while another holder remains active, normal transfer to a waiting owner, repeated disposal, concurrent disposal in a bounded desktop fixture, and shutdown with no orphaned authorized waiters. Propagate failures rather than silently over-releasing to make a test finish. The wrong design disposes the semaphore from the first lease or calls Release from every finally block regardless of acquisition.
Idempotent cleanup narrows misuse, but it does not supply operation idempotency, reentrancy, fairness, or recovery from an incorrectly destroyed shared resource.
What a strong answer covers
- Cancellation before acquisition creates no release owner.
- Leases release; an outer owner destroys the shared resource.
- Test transfer and shutdown with bounded owned operations.
Common pitfall
Disposing a shared semaphore from an individual lease or releasing after canceled acquisition.
Follow-up questions
- How would new admission stop during shutdown?
- What should happen if protected work throws?
Self-review
Choose what to revisit. These marks are your own assessment and are separate from lesson completion.