# Seat limiter — emergency seat semantics

audience: AI coding agents first. slug: `seat-limiter-emergency`
source request: owner 2026-08-15, verbatim: "when there is an emergency seat (can be selected by me in the overdeck UI, or by /od-emergency) the emergency seat will always be available. it can always start, regardless if queue being full, but when emergency seat is active, and one of the queues is free again, the emergency seat will take it. it will not launch another agent from the regular queue until there is another seat queued. what i mean by that - emergency can always launch - but it's not an extra seat to the pool. it will just take the next empty seat when available."
scope: the agent-session admission machinery (`_agent-session-admission`, the session-slots queue under /run/user/1000/agent-session-slots) — the seat limiter. This spec is the OWNER CONTRACT for the emergency seat; implementation is a future slice (registered, not started).

## Contract

1. **Emergency seat always starts immediately.** An emergency-designated session bypasses admission waiting entirely — full queue, exhausted slots, deep backlog: irrelevant. Zero wait, always.
2. **It is NOT an extra seat.** The pool size does not grow. While an emergency seat runs over-quota, the limiter runs a debt of 1: the NEXT regular seat that frees is consumed by the emergency seat's debt (the emergency session is folded into the pool), and NO new regular admission happens on that free. Regular admissions resume on the following free.
3. **Designation sources, exactly two:** the owner selecting a session as emergency in the Overdeck UI, and a session entering via `/od-emergency`. No agent may self-designate by any other path; the designation is journaled (who/when/which source).
4. **One at a time is the expected case;** if a second emergency starts while the first still holds debt, debts stack (each freed slot pays one debt before any regular admission). Debts are visible, never silent.
5. **Observability:** the sessions surface shows the emergency seat marked as such, and the limiter's state (pool size, seats held, outstanding emergency debt) is readable — the owner must be able to see WHY the regular queue isn't advancing while a debt is being paid.
6. **Failure honesty:** if the limiter cannot verify slot state, an emergency start STILL proceeds (rule 1 outranks bookkeeping); the discrepancy is journaled loudly. Regular admissions keep their existing fail-closed behavior.

## Non-goals

Not a WIP cap (owner-REJECTED, see live-status-registry plan L4) — this changes admission ORDER and emergency bypass only, never bounds total work. No cooldowns/timers (notifications doctrine). No change to what a seat IS — only to how one is granted.