DL-479
Agent-initiated spawn (SpawnAsAccount) is capped per owner on placed agents plus in-flight spawns, default 16, set by --max-agents-per-owner / $COMPASS_MAX_AGENTS_PER_OWNER (minimum 1, no unlimited mode); an in-flight spawn is a durable, tenant-owned reservation row counted under a per-owner Postgres advisory lock, so the cap holds across server replicas and restarts; one gate reserves before CreateAgent, refuses a spawn of an agent already in flight aborted before it checks placement, and returns a placed agent’s retry without a row; a slot whose container may still exist (a timed-out or failed Provision, a failed rollback Remove, a dropped Runner) stays charged and renewed until the Provision succeeds or a Remove on the spawn’s own enrollment succeeds, and only a Provision never sent releases at once, with the lease only as the crash backstop; a Remove success proves removal only where each backend keeps a failed teardown visible to Exists (OQ-9 (b), open; partial on microVM); a refusal at the cap is in-band resource_exhausted telling the agent to stop and ask its owner or manager; the admin operator door is exempt but counted, and compass agent despawn is the human way to free a slot
Status: Active (proposed, pending Matt, 2026-10-11)