Distributed semaphore

Design a distributed semaphore / quota system that caps concurrency of an expensive shared resource, e.g. "at most 100 concurrent connections to a fragile legacy mainframe", across hundreds of caller pods. Constraints: the global in-flight count must never meaningfully exceed 100, permits must be released even if a holder crashes, and acquire should block-with-timeout rather than reject. Explain how permits are counted, how concurrent acquirers coordinate, and how leaked permits are reclaimed.