Coordinate retry attempts with backend permits

docs/internal/capacity.md

@@ -67,6 +67,11 @@ limited call acquires an active permit, invokes the next client, and defers
 permit release so ordinary returns and panic unwinding both restore capacity.
 Preparation and validation never hold an active permit.
 
+The manager's `Acquire` operation owns that active-permit acquisition and
+returns an idempotent release function. The existing wrapper delegates to it;
+the internal generation coordinator uses the same operation around individual
+attempts. There is one queue and one active limit per limited backend pool.
+
 When all active permits are occupied, calls join a mutex-protected FIFO waiter
 list. Releasing a permit transfers it directly to the oldest remaining waiter
 before making it generally available. Pools do not order work relative to