diff --git a/CLAUDE.md b/CLAUDE.md
index 6f199375..d568fc7f 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -75,7 +75,7 @@ Quick orientation map — for what each piece is *for* and the decisions behind
 | `variables.tf` | `workspace_image`, `test_mode` — both supplied by the release workflow |
 | `script-agent-startup.sh` / `script-prepare-workspace.sh` | Scripts run on agent/workspace startup |
 | `script-container-entrypoint.sh` | The workspace container's `command`. Wipes `/tmp` and `exec`s Coder's generated `/workspace-init.sh` — the wipe must precede the agent, see the gotcha below |
-| `script-memory-watchdog.sh` | Userspace memory watchdog — see [DESIGN.md](DESIGN.md#design-tensions-and-decisions). It bounds the **standing population of restartable helpers** (per-role PSS budgets, ten-minute dwell, per-role circuit breaker) and records every per-process sweep. It does **not** try to prevent an acute OOM. `memory_watchdog_mode` selects `observe` / `enforce` (helpers — the default) / `enforce-all` (helpers + editor) |
+| `script-memory-watchdog.sh` | Userspace memory watchdog — see [DESIGN.md](DESIGN.md#design-tensions-and-decisions). It bounds the **standing population of restartable helpers** (per-role PSS budgets, ten-minute dwell, per-role circuit breaker) and records every per-process sweep. It does **not** try to prevent an acute OOM. `memory_watchdog_mode` selects `observe` / `enforce` (helpers — the default) / `enforce-all` (helpers + editor + the uncalibrated `treeHelper` role) |
 | `script-memory-watchdog-test.sh` | Fixture tests for the watchdog's arithmetic, process selection, budgets, dwell and circuit breaker. Run by hand (`./script-memory-watchdog-test.sh`) and by the `watchdog` job in `.github/workflows/test.yaml`. `kill` is shadowed by a function throughout — the fixture pids are real pids in whatever container runs the suite |
 | `script-vscode-server-gc.sh` | Weekly GC of `~/.vscode-server` (interrupted downloads, superseded server versions/extensions, orphaned CLI binaries — see the script's own header for the exact signal per class, and the `coder_script.vscode_server_gc` comment in `scripts.tf` for why it's template-owned rather than dotfiles-owned) |
 
@@ -91,9 +91,16 @@ Things that look arbitrary in the code but are load-bearing (full reasoning in [
 - The Dockerfile writes shared env vars to `/etc/environment` rather than using `ENV`, because `PATH` needs to be extended by a script running after the image is built, not fixed at build time.
 - `parameters.tf`'s `local.validated_*` allowlist is the only thing stopping `system_packages`/`preferred_nodes` from injecting shell metacharacters into the init container — any new parameter whose value reaches a shell must go through the same validate-then-use step.
 - `script-memory-watchdog.sh` computes headroom as `memory.max − U`, where `U` sums only the *unreclaimable* fields of `memory.stat` (`anon`, `shmem`, `unevictable`, `slab_unreclaimable`, `kernel_stack`, `pagetables`, `sec_pagetables`, `percpu`, `sock`). Do not "simplify" it to `memory.current` or to `memory.stat`'s `kernel` roll-up: on the live pod those read 96% and 42% of the limit while true `U` is 28%. Nothing acts on this number any more — it is pod-level context for the per-process rows and the honest figure published in the workspace UI.
+- `calibration.csv`'s `du_bytes_per_s` column is a per-sample instantaneous rate (`(M_U - PREV_U) / SAMPLE_INTERVAL`, 10s by default), not a drift rate, and naively averaging it overstates drift roughly fourfold: ~19.8 kB/s (~68 MB/hour) naive mean on the live pod versus ~18.4 MB/hour computed from `u_mb` across two `event=census` rows 26.1h apart. The naive mean is dominated by a handful of 10s allocation/GC spikes (+102 to −58 MB/s) that an hourly comparison washes out. The column and its caveat are documented together at its declaration in the script; nothing currently reads this column programmatically, so the trap is for a human, not a bug.
 - **The watchdog is a drift policer, not an OOM preventer, and the difference is measured.** The graded L1–L4 shedding ladder that used to be here was removed, not tuned: the recorded kills are 70–220 MB/s spikes that go from idle to dead inside a minute, a live reproduction climbed the ladder correctly and logged `no-candidates` because the runaway was not in the tree it managed, and the entire editor tree it could shed is ~0.7 GiB — five seconds of that growth. Before re-adding anything reactive, establish that a poll loop can see the event at all. What the loop *is* good at is MB-per-minute growth in the standing population, which is what it now does.
-- **Budgets are per role, in PSS, and never below a role's measured *resting* size — not its fresh size.** Fresh tree: extension host 471 MB PSS, serverMain 160 MB, ptyHost 36 MB, file watcher 34 MB. Resting tree (reconnected, idle, 8 GiB pod): extension host **713 MB**, file watcher 88 MB, language server 54 MB, tree total 1093 MB. A uniform 512 MB budget would sit 40 MB above where the extension host *starts* and 200 MB below where it *lives*, which is the same class of defect as the earlier `RLIMIT_DATA` ceiling that landed below what an idle file watcher already held — "calibrated against fresh, deployed against resting" has now appeared twice in this design, so `RESTING_ROLE` holds the resting figures and nothing else. Each budget is `max(min(role budget, memory.max / 8), resting × 1.5)`; on the 8 GiB pod that makes the extension host 1069 MiB rather than the 1024 MiB share, and the derivation records which budgets the floor lifted (`floored=1`), because that means the pod is too small to bound the role at its intended share. The tests assert the *property* — no budget at or below resting, at any pod size — rather than the arithmetic. Override one role with `WATCHDOG_BUDGET_<role>`; PSS (`smaps_rollup`) is the comparison, not RSS and not `VmData`.
+- **Budgets are per role, in PSS, and never below a role's measured *resting* size — not its fresh size.** Fresh tree: extension host 471 MB PSS, serverMain 160 MB, ptyHost 36 MB, file watcher 34 MB. Resting tree (reconnected, idle, 8 GiB pod): extension host **713 MB**, file watcher 88 MB, language server 54 MB, tree total 1093 MB. A uniform 512 MB budget would sit 40 MB above where the extension host *starts* and 200 MB below where it *lives*, which is the same class of defect as the earlier `RLIMIT_DATA` ceiling that landed below what an idle file watcher already held — "calibrated against fresh, deployed against resting" has now appeared twice in this design, so `RESTING_ROLE` holds the resting figures and nothing else. Each budget is `max(min(role budget, memory.max / 8), resting × 1.5)`, and the derivation records which budgets the floor lifted (`floored=1`), which is documented to mean the pod is too small to bound that role at its intended share. **That reading only holds while every declared budget already clears its own resting floor, and it did not: `extensionHost` was declared at 1024 MiB against a 1069 MiB floor, so `floored=1` was true at 4, 8, 16 and 64 GiB alike — a property of the constants reported as a property of the pod.** The declared number is now 1069 MiB, the one that was always in force; no effective budget changed at any pod size, and the flag now flips off at 16 GiB. The tests assert the *properties* — no budget at or below resting, and no declared budget below its own floor, at any pod size — rather than the arithmetic. Override one role with `WATCHDOG_BUDGET_<role>`; PSS (`smaps_rollup`) is the comparison, not RSS and not `VmData`.
 - **A kill needs ten minutes of continuous over-budget dwell, and three kills of one role inside an hour disarm that role.** The dwell is what separates drift from load — a language server that balloons while indexing and hands the memory back must survive. The breaker is what stops the failure that would make this actively harmful: kill the extension host → VS Code restarts it → it reloads every extension → it exceeds again → kill, a loop that arrives looking exactly like the watchdog working. It disarms and reports rather than widening its own budget, because a mechanism that raises the limit it is enforcing has stopped enforcing.
+- **Inside the server tree, an unrecognised process is *governed*, not invisible — that default is inverted on purpose, and its risk is bought off by arming rather than by hope.** `role_of` returned `other` for three real helpers on the live tree, and `compute_policed` skips `other`, so they had no budget, no dwell clock and no warning: a `tamasfe.even-better-toml` `server.js` at **280 MB PSS** (already above the 256 MiB `languageServer` budget a matching pattern would have given it), tsserver's `typingsInstaller.js` at 61 MB, and the built-in `markdown-language-features` server at 54 MB. Widening the pattern list is the easy fix and the wrong one: the set of launch shapes is the union of every extension's own choices, so a pattern list is a permanent race against a vendor-controlled vocabulary that fails *silently*. So anything in the tree, on VS Code's own runtime, unprotected and unnamed becomes role `treeHelper`. Two things make that safe rather than merely bold: (1) `treeHelper` is in `UNKNOWN_ROLES`, armed **only** under `enforce-all`, because its 512 MiB budget is a reasoned guess and no member has been measured at rest — under `enforce` (the template default) a coverage gap arrives as `event=would-kill armed=no` in the container log instead of as silence; (2) a **direct child of a server root is excluded structurally** — core forks (`fileWatcher`, `extensionHost`, `ptyHost`) are exactly the direct children of `server-main.js`, and no extension helper is, so a VS Code upgrade that renames `--type=extensionHost` makes that process unmanaged and loud rather than managed on a 512 MiB budget it holds 685 MB against. Its sweep-log identity is `<extension>/<script>`, because a dozen extensions all ship a file called `server.js` and `server` answers nothing in a post-mortem.
+- **Per-process, never per-role-aggregate — and that hole is a resourced decision, not an oversight.** Each pid is compared against `BUDGET[$role]` alone, so N same-role processes can each sit just under budget indefinitely. Not fixed, for three reasons: the only multi-process role here is `tsserver` (two of them, 112 + 141 MB against 768 MiB *each*); a role-level total makes "which sibling dies" arbitrary when three each contributed a third; and it does not compose with a dwell clock keyed per `pid:starttime`, which is what separates load from drift. What *is* done is the cheap half — `role_pss_mb` in the hourly census — so the evasion becomes visible as data before anyone designs for it.
+- **Disarming a role finishes the kill it already started; it does not begin a new one.** A drill found the opposite by accident: the breaker tripped between a process's SIGTERM and its SIGKILL, the disarm branch short-circuited ahead of the escalation, and the process was left alive, over budget and half-signalled — recorded as neither killed nor spared, and undocumented either way. The escalation check now precedes the disarm check, `record_kill` is deliberately *not* called again (it is the same kill, already counted), and the line carries `after_disarm=yes`. Completing one escalation cannot start the loop the breaker exists to stop.
+- **`RESTING_ROLE` is a hand measurement with a review trigger, never a derived one.** A watchdog that re-derived its own floor from what it observed would raise the limit it is enforcing exactly when the thing it enforces against grew — the move the breaker already refuses, one level removed. The trigger is `role_peak_mb` in the census and `peak_pss` in the summary file: when a role's peak sits persistently above its constant while never dwelling over budget, a human re-measures. Checked at the time of writing: the live extension host read 685 MB at 27.6 h uptime, i.e. *below* the recorded 713 MB, so the reference is not stale and the drift is not monotonic — V8 hands memory back.
+- **The "nothing policed" warning is per episode of blindness, not per process lifetime.** It was a one-shot latch set at the warmup sweep whether or not it warned, testing a lifetime high-water mark — so a watchdog that policed something once in its first half hour could never warn again however blind it went. A pod lives for days and the interesting blind spot is the one that arrives on day two, when an upgrade changes a launch shape. The clock now restarts when blindness starts and re-arms when anything is policed again.
+- **`2>/dev/null` must precede the input redirect it is meant to silence, not follow it.** `read -r line <"$entry/stat" 2>/dev/null || continue` opens the file *before* stderr is redirected, so a process exiting between the `/proc` listing and the read makes bash print its own error to inherited stderr; `|| continue` still handles it, so the bug is pure noise — 160 of 161 lines of `boot.log` — that would hide a real error. `release_singleton` already carried a comment showing this was understood. Every per-process `/proc` read now orders it correctly; `memory.stat`/`memory.max` deliberately do not, because a missing cgroup file is a genuine error worth seeing.
 - **The watchdog decides what is a VS Code process by executable path — `argv[0]` under `~/.vscode-server/` — never by whether something "is node".** A provisioned workspace has two unrelated node installations: VS Code's bundled one under `~/.vscode-server/cli/servers/Stable-<commit>/server/`, and mise's on `PATH`, which is what repo tooling and the operator's agent sessions run on. (There is no `/usr/bin/node`, and nothing named `node` on `PATH` at all without dotfiles.) `comm` is `MainThread` for every node process in a real tree, never `node`, because V8 renames its main thread; nothing may key off it. `script-memory-watchdog-test.sh` asserts this three ways, each paired with the mutation that flips it.
 - **Helpers spawned by an agent session are the second policed population, and the walk that finds them stops at two boundaries: a shell, and a change of session id.** MCP servers live nowhere near `~/.vscode-server`, so the tree-scoped selection could not see them — the largest single offender ever measured was 1.66 GB of python. The session rule is measured, not assumed: on the live workspace a session root has `sid` = its login shell's session, while every Bash tool call has `pgid == sid == its own pid`, because Claude Code detaches each one. That is what keeps an in-flight build out of the policed set even when the tool call's shell has exec'd itself away, which the shell test alone would miss. If Claude Code ever stops detaching, the walk polices *nothing* rather than the wrong thing, and the visibility warning in `actions.log` says so.
 - **Identity guards are absolute; the two positional rules are not, and the distinction is deliberate.** `pid 1`, the coder agent, tmux, `claude` session roots, agent payloads and the watchdog's own kin may never be signalled by anything. The ptyHost subtree and "does not run VS Code's own binary" bound the *editor* selection only, so that an MCP server is policed the same whether its session was started with `coder ssh` or in a VS Code terminal — sparing one set because of which terminal it came from would make the mechanism miss half its cases silently. Everything the ptyHost rule genuinely protects (shells, multiplexers, sessions, tool calls) is still covered by identity guards and by the shell/session boundaries.
diff --git a/DESIGN.md b/DESIGN.md
index fb133a32..f3f8be88 100644
--- a/DESIGN.md
+++ b/DESIGN.md
@@ -79,7 +79,9 @@ The rule that ties the layers together: a package or tool belongs in the *lowest
 
 What a poll loop is good at is growth measured in MB per *minute*, and that drift is the real, daily problem: the operator was policing it by hand for months, repeatedly killing VS Code to save agent sessions, with a python MCP server holding 1.66 GB at one of the kills. So the watchdog now keeps the resting population of **restartable helpers** inside per-role budgets. The goal is runway rather than rescue: when a spike does arrive, it starts from as much free memory as the pod can offer. Every process it may signal has a supervisor — VS Code respawns its own forks and language servers, an agent session respawns its MCP servers — so a wrong kill costs a reload, not a session, and that asymmetry is what licenses being aggressive.
 
-**Budgets are per role and anchored on measurement, because a uniform number is wrong in both directions.** A *fresh* extension host is 471 MB PSS, so a single 512 MB budget would sit 40 MB above where it starts while being far too generous for a 34 MB file watcher. Fresh is also the wrong baseline: measured on a reconnected, idle 8 GiB workspace, the same extension host holds **713 MB** and the tree around it 1093 MB rather than the 727 MB originally cited. "Calibrated against fresh, deployed against resting" is precisely the error that produced a file-watcher ceiling below what an idle file watcher already held, so the reference for each role is now the largest figure measured at rest. Each role gets a budget clamped between a share of the pod's own `memory.max` and one-and-a-half times that reference, and the resting floor wins when they conflict — a budget below resting usage is not a conservative budget, it is a kill loop written down. On the 8 GiB pod the floor is what sets the extension host's budget at 1069 MiB rather than the 1024 MiB share, and the watchdog reports which budgets were lifted that way, because the floor winning means the pod is too small to bound that role at the share it was meant to have. PSS is the quantity compared, not RSS and not `VmData`: `VmData` was only ever relevant because `RLIMIT_DATA` accounts it, and on a V8 process it runs an order of magnitude above what the pod actually pays.
+That licence has a limit, and the limit is *calibration* rather than blast radius. Selection used to return `other` for any process in the server tree that no pattern named, and the policed set skipped `other` — so three genuine helpers, one of them holding 280 MB PSS, had no budget, no dwell clock and no warning attached to them. Widening the pattern list per extension is the easy answer and the wrong one: the launch shapes belong to the extensions, so the list is a permanent race that fails silently, one extension at a time. The default inside the tree is therefore inverted — unknown means governed — and the risk that creates is paid for explicitly rather than assumed away. An unnamed in-tree process gets the `treeHelper` role: measured, budgeted, dwell-tracked and reported in every mode, but signalled only under `enforce-all`, because its budget is a reasoned guess and no member of the role has been measured at rest, and this design has twice shipped a limit that sat below what a healthy process already held. Separately, a direct child of a server root is excluded from the role outright: VS Code's core forks are exactly those direct children, so a future release that renames `--type=extensionHost` produces a process that is unmanaged and conspicuous rather than one carrying a guessed 512 MiB budget against the 685 MB it actually holds.
+
+**Budgets are per role and anchored on measurement, because a uniform number is wrong in both directions.** A *fresh* extension host is 471 MB PSS, so a single 512 MB budget would sit 40 MB above where it starts while being far too generous for a 34 MB file watcher. Fresh is also the wrong baseline: measured on a reconnected, idle 8 GiB workspace, the same extension host holds **713 MB** and the tree around it 1093 MB rather than the 727 MB originally cited. "Calibrated against fresh, deployed against resting" is precisely the error that produced a file-watcher ceiling below what an idle file watcher already held, so the reference for each role is now the largest figure measured at rest. Each role gets a budget clamped between a share of the pod's own `memory.max` and one-and-a-half times that reference, and the resting floor wins when they conflict — a budget below resting usage is not a conservative budget, it is a kill loop written down. On the 8 GiB pod the floor is what sets the extension host's budget at 1069 MiB rather than the 1024 MiB share, and the watchdog reports which budgets were lifted that way, because the floor winning is meant to say that the pod is too small to bound that role at the share it was intended to have. That reading is only true while every *declared* budget already clears its own resting floor, since only then can the pod share be the thing that pushed one below it — and for a while it was not true: the extension host's declared 1024 MiB sat below its own 1069 MiB floor, so the flag was set at 4, 8, 16 and 64 GiB alike and described the constants rather than the pod. The declared number is now the one that was always in force, which moved no effective budget at any pod size and gave the diagnostic back its meaning; the test suite asserts the invariant (no declared budget below its own floor) rather than the flag's value on one pod. The references themselves stay hand-measured on purpose: a watchdog that re-derived its floor from what it observed would raise the limit it is enforcing precisely when the thing it enforces against grew, which is the move the circuit breaker already refuses. The census publishes each role's peak instead, so a stale reference is something a human is told about rather than something the mechanism quietly accommodates. PSS is the quantity compared, not RSS and not `VmData`: `VmData` was only ever relevant because `RLIMIT_DATA` accounts it, and on a V8 process it runs an order of magnitude above what the pod actually pays.
 
 Two things then keep aggression from becoming harm. A process must be over budget **continuously for ten minutes** before anything happens to it, so a language server that balloons while indexing and hands the memory back is treated as load rather than drift. And a role that has to be killed three times inside an hour is not drifting — its budget is wrong for this workload — so the watchdog **disarms itself for that role**, logs why, and leaves the number to a human. It never widens its own budget: a mechanism that quietly raises the limit it enforces is a mechanism that has stopped enforcing. The kill loop, not the wrong kill, is the failure mode that would make this actively harmful, and it arrives looking exactly like the watchdog working.
 
diff --git a/TESTING.md b/TESTING.md
index b3d261f4..4cb1fdbe 100644
--- a/TESTING.md
+++ b/TESTING.md
@@ -28,10 +28,45 @@ Because all three stages run for real in dry-run — just scoped away from produ
 Everything else here is declarative and is covered by the stages above. `script-memory-watchdog.sh` decides at runtime whether to kill a process, so it gets two things neither lint nor a template push can provide:
 
 - **Fixtures** — `./templates/kubernetes/homelab-workspace/script-memory-watchdog-test.sh`, also run by the `watchdog` job in `.github/workflows/test.yaml`. The suite is built around negative assertions paired with the mutation that must flip them: "it did not kill the agent session" proves nothing unless removing one rule makes it kill the agent session. Two of its own safety properties matter as much as its assertions: `kill` is shadowed by a function throughout, because the fixture pids name real processes in whatever container runs the suite; and every load of the watchdog redirects its stdout emission to a temporary file, with the suite exiting outright if that seam did not take — the real default is the container's own stdout, and a run without the seam has already put fixture kill lines into a live workspace's log stream.
-- **A live drill on the `test` workspace**, which has disposable storage and can be wrecked freely. Fixtures cannot answer whether a real process tree classifies correctly, whether a supervisor really does respawn what was killed, or whether the circuit breaker stops a loop rather than joining it. The drill that has been run: a stand-in session root with an over-budget helper that a supervisor respawns, a second helper inside its budget, and a detached tool call larger than both. In `enforce` mode with the dwell shortened, the watchdog killed the drifted helper three times, disarmed that role on the third with the loop message, and left the fourth incarnation, the tool call, and the session roots untouched.
+- **A live drill on a disposable `test_mode` workspace**, which has disposable storage and can be wrecked freely. Fixtures cannot answer whether a real process tree classifies correctly, whether a supervisor really does respawn what was killed, or whether the circuit breaker stops a loop rather than joining it. The drill that has been run: a stand-in session root (`exec -a claude bash`, to exercise the shebang branch of the claude-root guard rather than the trivial compiled-binary one) with an over-budget helper that a supervisor respawns, a second helper inside its budget, and a process detached into its own session with `setsid` — the same mechanism Claude Code uses to detach a Bash tool call — larger than both.
 
 Neither replaces the other, and the live one is where every defect that mattered in this component has been found.
 
+### What the most recent drill actually observed
+
+Run 2026-08-21 on a disposable `watchdog-drill` workspace, `enforce` mode, with every threshold compressed and wall-clock arithmetic left real (`WATCHDOG_NOW` was never set): dwell 600→20s, age floor 300→45s, kill grace 30→8s, breaker window 3600→180s, sweep cadence ~60→~3s, `WATCHDOG_BUDGET_claudeHelper` pinned 512→100 MiB. The code paths and the arithmetic are the production ones; production *timings* were never waited out, which is what compressing them costs. The synthetic workload was compiled C — no `python3` or `node` exists on `PATH` in a fresh workspace without dotfiles applied, itself worth knowing.
+
+The daemon's own `actions.log` for the drill, re-fetched from Loki afterward and matched byte-for-byte against the pod's local copy:
+
+```text
+event=kill sig=TERM pid=<p1> role=claudeHelper id=hog pss_mb=150 budget_mb=100 over_s=22 age_s=68
+event=kill sig=KILL pid=<p1> role=claudeHelper id=hog pss_mb=150 budget_mb=100 over_s=31 detail="still over budget 8s after SIGTERM"
+event=kill sig=TERM pid=<p2> role=claudeHelper id=hog pss_mb=150 budget_mb=100 over_s=43 age_s=46
+event=kill sig=KILL pid=<p2> role=claudeHelper id=hog pss_mb=150 budget_mb=100 over_s=52 detail="still over budget 8s after SIGTERM"
+event=disarmed role=claudeHelper reason=kill-loop kills=3 window_s=180 budget_mb=100 detail="a role that has to be killed this often does not have a drift problem, it has a wrong budget; raise WATCHDOG_BUDGET_claudeHelper or accept the size, but this watchdog will not keep restarting it"
+```
+
+The two kills are gated by two different rules, not the same one twice: the first fired at `over_s=22` against a 20s dwell — one sweep late, proportional to the ~3s cadence, i.e. dwell-bound. The second's dwell was satisfied around `over_s≈20`, but the kill waited for `age_s` to clear its 45s floor, so `over_s` kept climbing to 43 before it fired — age-bound. A third respawn (not shown above) supplied the kill that tripped the breaker.
+
+`sweep.log` also confirms a dip resets the dwell clock rather than just capping it, in consecutive rows for the same pid:
+
+```text
+... over 153981 155052 55 102400 15 ...   <- over_s climbing toward the dwell threshold
+...  ok   20861  22020 58 102400  0 ...   <- PSS dropped under budget; over_s reset to 0
+```
+
+Equally load-bearing is what `actions.log` does **not** contain: the `setsid`-detached process standing in for a Claude Code Bash tool call — the single largest process in the drill — appears zero times, and neither does the in-budget helper. Both were alive and untouched when the drill ended.
+
+Not exercised by this drill, and not claimed to be: production timings (everything above ran on compressed ones); the VS Code tree half of selection (`extensionHost`/`tsserver`/`fileWatcher`/`ptyHost`) — no VS Code server ran in this disposable pod; `observe` mode's `would-kill`; the global 8-kill-across-roles breaker; and `event=refused`, whose guard is structurally unreachable in normal operation because selection filters protected pids before `signal_pid` is ever called.
+
+### Checking a claim like this against the record
+
+An `event=kill`/`event=disarmed` line, unlike the sweep log, does leave the pod (see [DESIGN.md](DESIGN.md#design-tensions-and-decisions)), so a claim like the one above is checkable: `{namespace="coder"} |= "component=memory-watchdog" |~ "event=(kill|would-kill|refused|disarmed)"` against Loki finds exactly the six lines quoted above, timestamped and labelled with the `watchdog-drill` pod.
+
+The same query, run over the full retained history, is also what falsifies a different claim: PR [#865](https://github.com/ppat/coder/pull/865) (merged 2026-08-18), which introduced this drill practice, described one run in its body as killing "a drifted 739 MB helper... three times" with the role disarming "on the third kill," and stated "the daemon's own lines from the test workspace are in Loki." Neither `event=kill` nor `event=disarmed` nor the string `739` appears anywhere in the retained record for any workspace at any time before this run. The only kill/disarm lines anywhere near that PR's merge time are on the operator's live workspace at 2026-08-18T01:01–01:08, and the daemon logged its own correction for them at the time: `event=note reason=fixture-leak`, naming fixture pids 41/61 at 1907/1583 MB — the same incident this repo's docs already describe as the fixture suite's stdout seam leaking into production before it was guarded. No `event=kill` or `event=disarmed` line from a workspace named `test` exists in the record at all. `event=budget role=extensionHost budget_mb=1069 pod_share_mb=512 floored=1` — the figures the PR body also cites as drill evidence — is not distinguishing evidence either: every disposable `test_mode` workspace since has printed exactly that line at startup, regardless of whether anything was ever killed, because `floored=1` was a constant at that pod size — the bug PR #881 fixes.
+
+None of this proves the described drill did not happen — a drill run through the fixture harness's required `WATCHDOG_STDOUT_PATH` seam would, correctly, leave nothing in Loki to find, which is indistinguishable in the record from a drill that never ran. What the record supports is narrower than what was claimed: the specific figures and the "verified end to end... in Loki" line cannot be checked, and the only Loki-verifiable kill/disarm evidence tied to that PR's timeframe is the fixture leak, which was not a drill result. The verified account above is offered in its place.
+
 ## After merge
 
 Merging to `main` is what flips the pipeline into live mode — there's no separate promotion step afterward. The dry-run pass on the PR is the actual release gate.
diff --git a/templates/kubernetes/homelab-workspace/script-memory-watchdog-test.sh b/templates/kubernetes/homelab-workspace/script-memory-watchdog-test.sh
index 7acfdaed..12bd9ac8 100755
--- a/templates/kubernetes/homelab-workspace/script-memory-watchdog-test.sh
+++ b/templates/kubernetes/homelab-workspace/script-memory-watchdog-test.sh
@@ -224,11 +224,15 @@ write_uptime() {
 #   |               +- 40  server-main.js            <- the root
 #   |                   +- 41  extensionHost
 #   |                   |   +- 44  tsserver.js
+#   |                   |   |   +- 57  typingsInstaller.js  <- treeHelper
 #   |                   |   +- 45  yaml languageserver.js
 #   |                   |   +- 46  terraform-ls      (native, not node)
 #   |                   |   +- 47  claude-code cli.js  (mise's node, not VS Code's)
 #   |                   |   +- 48  an extension task   (mise's node, not VS Code's)
+#   |                   |   +- 55  markdown serverWorkerMain  <- treeHelper
+#   |                   |   +- 56  even-better-toml server.js <- treeHelper
 #   |                   +- 42  fileWatcher
+#   |                   +- 49  an unrecognised core fork  <- NOT policed
 #   |                   +- 43  ptyHost               <- positional protection
 #   |                       +- 50  bash
 #   |                           +- 51  tmux: server
@@ -295,6 +299,37 @@ build_tree() {
     "${ext}/anthropic.claude-code-2.1.232/resources/claude-code/cli.js" --ide
   add_proc "$dir" 48 41 "$nc" 600000000 "$mnode" \
     "${ext}/hverlin.mise-vscode-1.6.0/dist/taskRunner.js" --cwd /home/coder/code
+  # The three processes role_of used to return `other` for, transcribed from
+  # `ps -eo pid,ppid,sid,comm,args` on the live workspace along with their
+  # measured PSS. All three run VS Code's own node, all three hang off the
+  # extension host or off another helper rather than off the server root, and
+  # none of the role patterns reaches any of them:
+  #
+  #   - a user-installed extension's language server, whose script is called
+  #     `server.js` like roughly every other extension's. 280 MB PSS measured,
+  #     i.e. already above the 256 MiB languageServer budget it would have been
+  #     given had a pattern matched it. Written here at the 287 MB figure the
+  #     investigation recorded.
+  #   - a built-in extension's server, under the *server's* extensions
+  #     directory rather than the user one, and named by neither convention.
+  #   - tsserver's typings installer, a grandchild: helpers spawn helpers.
+  add_proc "$dir" 55 41 "$nc" 56000000 "${sdir}/node" \
+    "${sdir}/extensions/markdown-language-features/dist/serverWorkerMain" \
+    --node-ipc --clientProcessId=41
+  add_proc "$dir" 56 41 "$nc" 287000000 "${sdir}/node" \
+    "${ext}/tamasfe.even-better-toml-0.21.2/dist/server.js" --node-ipc --clientProcessId=41
+  add_proc "$dir" 57 44 "$nc" 63000000 "${sdir}/node" \
+    "${sdir}/extensions/node_modules/typescript/lib/typingsInstaller.js" \
+    --globalTypingsCacheLocation /home/coder/.cache/typescript/6.0 --enableTelemetry
+  # A core fork whose --type= flag this script does not recognise - the shape a
+  # VS Code upgrade produces if it renames or adds one. It is a *direct child of
+  # the server root*, which is what every core fork is and what no extension
+  # helper is, and that is the whole reason the treeHelper fallback declines it:
+  # a renamed extensionHost must become unmanaged and loud, never managed on a
+  # guessed 512 MiB budget.
+  add_proc "$dir" 49 40 "$nc" 200000000 "${sdir}/node" \
+    "${sdir}/out/bootstrap-fork" --type=sharedProcess
+
   add_proc "$dir" 42 40 "$nc" 40000000 "${sdir}/node" \
     "${sdir}/out/bootstrap-fork" --type=fileWatcher
   add_proc "$dir" 43 40 "$nc" 100000000 "${sdir}/node" \
@@ -493,7 +528,7 @@ test_selection() {
   assert_eq MainThread "${P_COMM[40]}" "the fixture encodes the real comm value"
   assert_eq 40 "$SERVER_PID" "server root found with comm=MainThread, not comm=node"
   assert_eq "40" "${SERVER_ROOTS[*]}" "and the decoys are not roots"
-  assert_eq 14 "${#SERVER_TREE[@]}" "server tree spans every descendant, ptyHost included"
+  assert_eq 18 "${#SERVER_TREE[@]}" "server tree spans every descendant, ptyHost included"
 
   local d
   for d in 3 4; do
@@ -693,9 +728,16 @@ test_operator_runtime_is_never_a_helper() {
   # Code's binary". The agent session survives on its name, which is identity and
   # absolute; the extension task loses its only positional protection and is left
   # standing on one thing alone - that role_of keys on argv[0].
-  # shellcheck disable=SC2317,SC2329  # invoked indirectly, via the sourced watchdog
-  is_vscode_binary() { return 0; }
+  #
+  # The mutation clears the two pids out of NOT_EDITOR rather than overriding
+  # is_vscode_binary, and the difference is the point. role_of now consults that
+  # same predicate for its treeHelper fallback, so stubbing it `return 0`
+  # falsifies the position rule and the role rule at once and proves neither -
+  # the suite caught exactly that when the fallback was added. A mutation has to
+  # remove one rule, or it is not evidence about which rule was carrying the
+  # weight.
   compute_protected
+  unset 'NOT_EDITOR[47]' 'NOT_EDITOR[48]'
   compute_policed
   assert_protected 47 yes "without the position rule the agent session still has its name"
   assert_policed 47 no "and is still not policed"
@@ -727,7 +769,7 @@ test_comm_is_not_a_criterion() {
     load_watchdog "${WORK}/cg" "$pdir"
     scan_fixture
     assert_eq 40 "$SERVER_PID" "comm=${comm}: the server root is still pid 40"
-    assert_eq 14 "${#SERVER_TREE[@]}" "comm=${comm}: the tree is still complete"
+    assert_eq 18 "${#SERVER_TREE[@]}" "comm=${comm}: the tree is still complete"
     assert_policed 53 no "comm=${comm}: the hog in a terminal is still not policed"
   done
 }
@@ -746,7 +788,7 @@ test_two_servers() {
   scan_fixture
 
   assert_eq "40 70" "${SERVER_ROOTS[*]}" "both server roots are discovered"
-  assert_eq 18 "${#SERVER_TREE[@]}" "the managed tree is the union of both subtrees"
+  assert_eq 22 "${#SERVER_TREE[@]}" "the managed tree is the union of both subtrees"
   assert_policed 73 fileWatcher "the second server's file watcher is policed"
   assert_policed 72 no "and the shell under its ptyHost is not"
   if [[ -n ${NOT_EDITOR[71]:-} ]]; then
@@ -841,6 +883,184 @@ test_guards_are_precise() {
   fi
 }
 
+# --------------------------------------------------------------------------- #
+# 2f. the tree helpers nothing used to name
+#
+# role_of returned `other` for three real processes on the live workspace, and
+# compute_policed skips `other`, so they had no budget, no dwell clock, no
+# signal and - the part that made it a design defect rather than a gap - no
+# warning. The largest was a language server holding 280 MB PSS, already above
+# the 256 MiB budget it would have been given had any pattern matched it.
+#
+# The fix inverts the default inside the tree: unknown means governed, not
+# invisible. The risk that buys is a guessed budget applied to a process whose
+# legitimate resting size is bigger than the guess, which is the failure this
+# design has already shipped twice, so the guess is disarmed by default and the
+# one shape that would be catastrophic - a core fork whose --type= flag stopped
+# being recognised - is excluded structurally rather than hopefully.
+# --------------------------------------------------------------------------- #
+
+# role_of exactly as it was before the treeHelper fallback existed. Used as the
+# mutation that must flip the coverage assertions red: with this in place the
+# three processes below go back to being unpoliced and unreported, which is the
+# bug, stated as a test.
+mutate_role_of_to_other_fallback() {
+  # shellcheck disable=SC2317,SC2329  # invoked indirectly, via the sourced watchdog
+  role_of() {
+    local cmd=" ${P_CMD[$1]:-} "
+    local argv0=${P_ARGV0[$1]:-}
+    case "$cmd" in
+    *" --type=ptyHost "* | *"--type=ptyHost"*) ROLE=ptyHost ;;
+    *" --type=extensionHost "*) ROLE=extensionHost ;;
+    *" --type=fileWatcher "*) ROLE=fileWatcher ;;
+    *"tsserver.js "* | *"/typescript/lib/tsserver"*) ROLE=tsserver ;;
+    *yaml-language-server* | *jsonServerMain* | *-language-server* | *languageserver*) ROLE=languageServer ;;
+    *"out/server-main.js "*) ROLE=serverMain ;;
+    *)
+      if [[ $argv0 == *"/.vscode-server/extensions/"* ]]; then
+        ROLE=extensionHelper
+      else
+        ROLE=other
+      fi
+      ;;
+    esac
+    return 0
+  }
+}
+
+test_tree_helpers() {
+  printf 'in-tree helpers that no pattern names\n'
+  write_cgroup "${WORK}/cg" 8589934592 0.00
+  local pdir="${WORK}/proc2f"
+  build_tree "$pdir"
+  load_watchdog "${WORK}/cg" "$pdir"
+  scan_fixture
+
+  # None of the role patterns reaches these, and the point is that none of them
+  # ever could: the launch shape is each extension's own choice.
+  role_of 55
+  assert_eq treeHelper "$ROLE" "a built-in extension's server is a tree helper"
+  role_of 56
+  assert_eq treeHelper "$ROLE" "so is a user extension's server.js"
+  role_of 57
+  assert_eq treeHelper "$ROLE" "so is a helper's own helper, two levels down"
+
+  assert_policed 55 treeHelper "and it is policed rather than skipped"
+  assert_policed 56 treeHelper "including the one already over a language server's budget"
+  assert_policed 57 treeHelper "including the grandchild"
+
+  # The breadcrumb. Three unrelated extensions all ship a `server.js`, so the
+  # script name alone re-hides exactly what this role exists to reveal.
+  assert_eq "tamasfe.even-better-toml-0.21.2/server" "$(identity_of 56 treeHelper)" \
+    "a tree helper is named for its extension, not just its script"
+  assert_eq "markdown-language-features/serverWorkerMain" "$(identity_of 55 treeHelper)" \
+    "including a built-in extension under the server's own extensions directory"
+  assert_eq "typescript/typingsInstaller" "$(identity_of 57 treeHelper)" \
+    "and node_modules is skipped for the name that means something"
+
+  # Never armed by the mode the template actually runs. The budget is a guess and
+  # the design's own history is a guessed limit that landed below what a healthy
+  # process already held, so a coverage gap surfaces as a log line first.
+  # shellcheck disable=SC2034  # MODE is a global of the sourced watchdog
+  MODE=observe
+  assert_armed treeHelper no "observe arms nothing, tree helpers included"
+  # shellcheck disable=SC2034
+  MODE=enforce
+  assert_armed treeHelper no "enforce reports tree helpers and does not signal them"
+  assert_armed extensionHelper yes "while a role with a measured resting size is armed"
+  # shellcheck disable=SC2034
+  MODE=enforce-all
+  assert_armed treeHelper yes "enforce-all arms them, which is where the operator opts in"
+  # shellcheck disable=SC2034
+  MODE=observe
+
+  # A core fork whose --type= flag stopped being recognised. This is the shape
+  # that makes inverting the default dangerous rather than merely uncertain: the
+  # extension host holds 685 MB at rest, and handing it a 512 MiB helper budget
+  # is a standing kill order on the largest, most user-visible process here.
+  role_of 49
+  assert_eq other "$ROLE" "an unrecognised core fork is NOT given a guessed helper budget"
+  assert_policed 49 no "it is left unmanaged, where the sweep log still records it"
+
+  # Falsification 1 - the guard that declines it is the only thing declining it.
+  # shellcheck disable=SC2317,SC2329  # invoked indirectly, via the sourced watchdog
+  is_server_fork() { return 1; }
+  compute_policed
+  assert_policed 49 treeHelper \
+    "without the direct-child-of-the-root rule that core fork would be budgeted as a helper"
+  # Re-source rather than hand-restore: a mutation left in place would silently
+  # weaken every assertion after it, which is how this suite has been green
+  # while testing nothing before.
+  load_watchdog "${WORK}/cg" "$pdir"
+  scan_fixture
+  assert_policed 49 no "and with the real rule back it is unmanaged again"
+
+  # Falsification 2 - the whole coverage claim, against the classifier that was
+  # here before. If this does not flip, nothing above is evidence of anything.
+  mutate_role_of_to_other_fallback
+  compute_policed
+  assert_policed 56 no "with the previous classifier the 280 MB language server is invisible"
+  assert_policed 55 no "and so is the built-in server"
+  assert_policed 57 no "and so is the typings installer"
+
+  # Falsification 3 - argv[0], not tree position, is what separates a tree helper
+  # from the operator's own runtime. Two synthetic processes identical in every
+  # way except the binary they execute.
+  load_watchdog "${WORK}/cg" "$pdir"
+  scan_fixture
+  local sdir="/home/coder/.vscode-server/cli/servers/Stable-abc123/server"
+  local mnode="/home/coder/.local/share/mise/installs/node/22.14.0/bin/node"
+  local args="/home/coder/.vscode-server/extensions/some.ext-1.0.0/dist/server.js --node-ipc"
+  # shellcheck disable=SC2034  # globals of the sourced watchdog
+  P_PPID[9002]=41 P_ARGV0[9002]="$mnode" P_CMD[9002]="${mnode} ${args}"
+  # shellcheck disable=SC2034
+  P_PPID[9003]=41 P_ARGV0[9003]="${sdir}/node" P_CMD[9003]="${sdir}/node ${args}"
+  role_of 9002
+  assert_eq other "$ROLE" "the operator's node in the tree is not a tree helper"
+  role_of 9003
+  assert_eq treeHelper "$ROLE" "VS Code's own node, same arguments, is"
+  unset 'P_PPID[9002]' 'P_ARGV0[9002]' 'P_CMD[9002]'
+  unset 'P_PPID[9003]' 'P_ARGV0[9003]' 'P_CMD[9003]'
+}
+
+# What the two modes actually do to a drifted tree helper, end to end, because
+# "not armed" is a claim about behaviour and not about a string.
+test_tree_helper_arming_is_end_to_end() {
+  printf 'a drifted tree helper: reported under enforce, killed under enforce-all\n'
+  write_cgroup "${WORK}/cg" 8589934592 0.00
+  local pdir="${WORK}/proc2g"
+  build_tree "$pdir"
+
+  rm -rf "${WORK}/state"
+  load_watchdog "${WORK}/cg" "$pdir" enforce
+  set_pss "$pdir" 56 700000000
+  sweep_at 1000
+  sweep_at $((1000 + DWELL_SECONDS))
+  # Targeted rather than "SIGNALS is empty": the fixture's MCP server is over
+  # budget in an armed role in this same sweep, and an assertion that the whole
+  # run signalled nothing would be asserting that enforce mode is broken.
+  assert_absent "$SIGNALS" ":56" "enforce signals nothing, however far a tree helper has drifted"
+  assert_contains "$(cat "${WORK}/state/actions.log")" \
+    "event=would-kill armed=no pid=56 role=treeHelper" \
+    "but says exactly what it would have done, with the identity to act on"
+  # And the per-process record carries it as a budgeted role rather than as one
+  # of the `unmanaged` rows it used to be lost among. 524288 kB is the 512 MiB
+  # budget in the sweep log's units.
+  local latest
+  latest="$(cat "${WORK}/state/sweep.latest")"
+  assert_contains "$latest" "treeHelper" "the sweep log records the role"
+  assert_contains "$latest" "524288" "with the budget it is being held to"
+
+  rm -rf "${WORK}/state"
+  load_watchdog "${WORK}/cg" "$pdir" enforce-all
+  set_pss "$pdir" 56 700000000
+  sweep_at 2000
+  sweep_at $((2000 + DWELL_SECONDS))
+  assert_contains "$SIGNALS" "TERM:56" "enforce-all is where a tree helper is actually shed"
+  assert_absent "$SIGNALS" ":49" "and the unrecognised core fork is still never touched"
+  assert_absent "$SIGNALS" ":41" "nor the extension host, by a helper's budget or any other"
+}
+
 # --------------------------------------------------------------------------- #
 # 3. the budgets
 #
@@ -878,6 +1098,41 @@ test_budgets() {
   assert_eq "" "${FLOORED[fileWatcher]:-}" "and is not floored - 88 MB resting is well under it"
   assert_eq 536870912 "${BUDGET[claudeHelper]}" "8 GiB: an MCP server gets 512 MiB"
 
+  # FLOORED is documented as a diagnostic - "this pod is too small to bound this
+  # role at the share it was meant to have" - and that reading only holds while
+  # every declared budget already clears its own resting floor, because then the
+  # pod share is the only thing that can push one below it. It did not hold:
+  # extensionHost's declared 1024 MiB sat below its own 1069 MiB floor, so the
+  # flag was true at 4, 8, 16 and 64 GiB alike and reported a property of the
+  # constants while claiming to report a property of the pod.
+  #
+  # This asserts the invariant rather than the flag, because the invariant is
+  # what makes the flag mean anything. A future budget lowered below its role's
+  # resting floor - the exact edit this design has made wrongly twice - fails
+  # here rather than quietly turning a diagnostic into a constant.
+  local r floor
+  for r in "${!BUDGET_ROLE[@]}"; do
+    floor=$(((${RESTING_ROLE[$r]:-0} * RESTING_FACTOR_NUM) / RESTING_FACTOR_DEN))
+    # shellcheck disable=SC2004
+    # The $ is NOT unnecessary: BUDGET_ROLE is associative, so inside (( )) the
+    # subscript is a string, and dropping it looks up the literal key "r" and
+    # silently reads 0 - which would make this assertion pass for every role.
+    if ((BUDGET_ROLE[$r] >= floor)); then
+      ok "the declared ${r} budget already clears its own resting floor"
+    else
+      bad "the declared ${r} budget (${BUDGET_ROLE[$r]}) is below its resting floor (${floor}): FLOORED stops being a pod-size diagnostic"
+    fi
+  done
+
+  # And so the flag now varies with the pod, which is the whole claim.
+  budgets_at 17179869184
+  assert_eq "" "${FLOORED[extensionHost]:-}" \
+    "16 GiB: the extension host is not floored - the pod can afford its share"
+  # ...while moving no budget at all. This change repaired a diagnostic; if it
+  # had also changed what gets killed, that would be a separate decision.
+  assert_eq 1121452032 "${BUDGET[extensionHost]}" \
+    "16 GiB: and its budget is the same number it has always been in force"
+
   # 4 GiB: the pod share is 512 MiB, far below what the extension host holds at
   # rest. The floor overrides it rather than issuing a standing kill order.
   budgets_at 4294967296
@@ -1111,6 +1366,63 @@ test_kill_loop_breaker() {
   fi
 }
 
+# --------------------------------------------------------------------------- #
+# 4c. what the breaker does to a kill that is already in flight
+#
+# A drill on a disposable workspace found this by accident: the breaker tripped
+# between a process's SIGTERM and its SIGKILL, and the disarm branch
+# short-circuited ahead of the escalation, so the process was still alive and
+# still over budget when the drill ended - signalled, abandoned, and recorded as
+# neither killed nor spared. Nothing in the code or the docs said which of those
+# was intended, so it was not a defect anyone could have reviewed.
+#
+# It is decided here: disarming means "stop deciding to kill this role", not
+# "abandon a kill already decided". Finishing one escalation cannot start the
+# loop the breaker exists to stop. Both halves are asserted, because either one
+# alone is satisfiable by a watchdog that got the decision backwards.
+# --------------------------------------------------------------------------- #
+
+test_disarm_completes_an_escalation_in_flight() {
+  printf 'a disarmed role finishes the kill it started and starts no new one\n'
+  write_cgroup "${WORK}/cg" 8589934592 0.00
+  local pdir="${WORK}/proc4c"
+  build_tree "$pdir"
+  rm -rf "${WORK}/state"
+  load_watchdog "${WORK}/cg" "$pdir" enforce
+
+  # 61 drifts and is asked politely.
+  set_pss "$pdir" 61 1660000000
+  sweep_at 1000
+  sweep_at $((1000 + DWELL_SECONDS))
+  assert_contains "$SIGNALS" "TERM:61" "the drifted helper gets a SIGTERM"
+  assert_absent "$SIGNALS" "KILL:61" "and not yet a SIGKILL"
+  local kills_before=${KILLS[claudeHelper]:-0}
+
+  # The breaker now trips - on this role, from other incarnations - while that
+  # SIGTERM is outstanding.
+  # shellcheck disable=SC2034  # a global of the sourced watchdog
+  DISARMED[claudeHelper]=1
+  SIGNALS=""
+  sweep_at $((1000 + DWELL_SECONDS + KILL_GRACE))
+  assert_contains "$SIGNALS" "KILL:61" \
+    "the escalation completes rather than leaving the process half-signalled"
+  assert_contains "$(cat "${WORK}/state/actions.log")" "after_disarm=yes" \
+    "and the log distinguishes it from an ordinary escalation"
+  assert_eq "$kills_before" "${KILLS[claudeHelper]:-0}" \
+    "it is the same kill, so the breaker does not count it twice"
+
+  # The other half: the disarmed role starts nothing new. 62 is a different
+  # process of the same role that has never been signalled.
+  SIGNALS=""
+  set_pss "$pdir" 62 900000000
+  sweep_at 5000
+  sweep_at $((5000 + DWELL_SECONDS))
+  assert_absent "$SIGNALS" ":62" \
+    "a disarmed role begins no new kill, however far another of its processes has drifted"
+  assert_contains "$(cat "${WORK}/state/sweep.latest")" "disarmed" \
+    "and says it is deliberately sparing it"
+}
+
 # --------------------------------------------------------------------------- #
 # 5. observe mode really is inert, and says what it would have done
 # --------------------------------------------------------------------------- #
@@ -1230,11 +1542,45 @@ test_sweep_log() {
   write_uptime "$empty"
   add_proc "$empty" 1 0 coder 14208 ./coder agent
   load_watchdog "${WORK}/cg" "$empty" observe
-  SWEEPS=$VISIBILITY_WARMUP
-  sweep_at 1000
-  check_visibility
+  local i
+  for ((i = 0; i <= VISIBILITY_WARMUP; i++)); do
+    sweep_at $((1000 + i))
+    check_visibility
+  done
   assert_contains "$(cat "${WORK}/state/actions.log")" "event=warning reason=nothing-policed" \
     "an empty policed set is reported rather than passing for health"
+
+  # And it is a warning per *episode of blindness*, not per process lifetime.
+  # The latch used to be set at the warmup sweep whether or not it warned, and
+  # the condition it tested was a lifetime high-water mark, so a watchdog that
+  # policed something once in its first half hour could never warn again however
+  # blind it went later. A pod lives for days and the interesting blind spot is
+  # the one that arrives on day two, when an upgrade changes a launch shape.
+  #
+  # Falsification: each half of this is asserted against the fixture that must
+  # flip it. A watchdog that warns while it is policing something is crying wolf;
+  # one that cannot warn twice is the bug being fixed.
+  rm -rf "${WORK}/state"
+  local pdir="${WORK}/proc6c"
+  build_tree "$pdir"
+  load_watchdog "${WORK}/cg" "$pdir" observe
+  for ((i = 0; i <= VISIBILITY_WARMUP; i++)); do
+    sweep_at $((2000 + i))
+    check_visibility
+  done
+  assert_absent "$(cat "${WORK}/state/actions.log")" "reason=nothing-policed" \
+    "a watchdog that is policing something does not warn about blindness"
+
+  # Now selection goes blind, with the same process table it was managing a
+  # moment ago - which is what a launch-shape change looks like from in here.
+  # shellcheck disable=SC2317,SC2329  # invoked indirectly, via the sourced watchdog
+  compute_policed() { POLICED=(); }
+  for ((i = 0; i <= VISIBILITY_WARMUP; i++)); do
+    sweep_at $((3000 + i))
+    check_visibility
+  done
+  assert_contains "$(cat "${WORK}/state/actions.log")" "reason=nothing-policed" \
+    "a blind spot that appears later in the pod's life is still reported"
 }
 
 # --------------------------------------------------------------------------- #
@@ -1440,9 +1786,12 @@ main() {
   test_comm_is_not_a_criterion
   test_two_servers
   test_guards_are_precise
+  test_tree_helpers
+  test_tree_helper_arming_is_end_to_end
   test_budgets
   test_dwell
   test_kill_loop_breaker
+  test_disarm_completes_an_escalation_in_flight
   test_observe_mode
   test_sweep_log
   test_stdout_emission
diff --git a/templates/kubernetes/homelab-workspace/script-memory-watchdog.sh b/templates/kubernetes/homelab-workspace/script-memory-watchdog.sh
index 5b8d6995..209fbe54 100644
--- a/templates/kubernetes/homelab-workspace/script-memory-watchdog.sh
+++ b/templates/kubernetes/homelab-workspace/script-memory-watchdog.sh
@@ -49,9 +49,13 @@
 #                 because every one of them restarts without the operator
 #                 noticing.
 #   enforce-all - additionally kill the extension host and the server main
-#                 process. These are user-visible when they restart, and they
-#                 are the two roles a wrong budget would put in a kill loop, so
-#                 they are armed separately and on purpose.
+#                 process, and the treeHelper role. The first two are
+#                 user-visible when they restart; treeHelper is here for a
+#                 different reason - it is the role for a process in the server
+#                 tree that no rule can name, so its budget is a reasoned guess
+#                 rather than a measurement. All three are roles a wrong budget
+#                 would put in a kill loop, so they are armed separately and on
+#                 purpose.
 #
 # Test seams, exercised by script-memory-watchdog-test.sh:
 #   WATCHDOG_CGROUP_DIR  WATCHDOG_PROC_DIR  WATCHDOG_STATE_DIR
@@ -154,13 +158,33 @@ GLOBAL_LOOP_KILLS="${WATCHDOG_GLOBAL_LOOP_KILLS:-8}"
 #
 # It is not a budget; it is the floor below which a budget is a kill order
 # rather than a limit.
+# A declared budget is never allowed to sit below the role's own resting floor.
+# That is not a style rule, it is what makes the FLOORED report mean anything:
+# see the note above derive_budgets. extensionHost's declared 1024 MiB used to
+# violate it, so that role reported floored=1 at every pod size including a
+# hypothetical 64 GiB one, and the flag documented as "this pod is too small"
+# was in fact a constant. The number below is the one that was already in force.
 declare -gA BUDGET_ROLE=(
-  [extensionHost]=1073741824  # 1024 MiB, against 471 MB resting
+  [extensionHost]=1121452032  # 1069 MiB = 713 MB resting x 1.5. Not the round
+  #                              1024 MiB it reads like: the resting floor took
+  #                              it here unconditionally, so this records the
+  #                              budget the watchdog actually applies rather
+  #                              than an intent it never had.
   [serverMain]=536870912      #  512 MiB, against 160 MB resting
   [tsserver]=805306368        #  768 MiB - legitimately large on a big project
   [languageServer]=268435456  #  256 MiB - yaml/json/terraform LS rest near 100
   [fileWatcher]=268435456     #  256 MiB, against 34 MB resting
   [extensionHelper]=536870912 #  512 MiB - terraform-ls, gopls and the like
+  [treeHelper]=536870912      #  512 MiB - see the treeHelper note in role_of.
+  #                              Measured on the live tree, the three processes
+  #                              this role exists for hold 280 MB (an
+  #                              even-better-toml server), 61 MB (tsserver's
+  #                              typingsInstaller) and 54 MB (the built-in
+  #                              markdown server). 512 MiB clears the largest of
+  #                              them with room, and there is deliberately no
+  #                              RESTING_ROLE entry: no member of this role has
+  #                              been measured at rest, which is exactly why it
+  #                              is armed only where an operator asked for it.
   [claudeHelper]=536870912    #  512 MiB - MCP servers. The operator's number,
   #                              applied exactly where his instinct is right: a
   #                              helper that holds 1.66 GB is not doing its job
@@ -175,6 +199,17 @@ declare -gA RESTING_ROLE=(
 # A budget is never allowed below the role's measured resting size times this,
 # whatever the pod arithmetic says. This is the guard against the class of error
 # that has already bitten this design twice.
+# These are hand measurements with a review trigger and no automatic upkeep, and
+# that is deliberate. Deriving them from observation would mean the watchdog
+# raising the limit it is enforcing whenever the thing it is enforcing against
+# grew - the same move the circuit breaker refuses to make, one level removed.
+# The trigger instead is the `role_peak_mb` field of the hourly census and the
+# `peak_pss` line of the summary file: when a role's peak sits persistently above
+# its figure here while never dwelling over budget, the figure is stale and a
+# human re-measures it. Checked while writing this: the live extension host read
+# 685 MB PSS at 27.6 hours of uptime, i.e. below the 713 MB recorded below, so
+# the reference is not stale today and the growth is not monotonic - V8 does hand
+# memory back.
 RESTING_FACTOR_NUM="${WATCHDOG_RESTING_NUM:-3}"
 RESTING_FACTOR_DEN="${WATCHDOG_RESTING_DEN:-2}"
 # No single helper may be budgeted more than this share of the pod. The workspace
@@ -182,11 +217,22 @@ RESTING_FACTOR_DEN="${WATCHDOG_RESTING_DEN:-2}"
 # pod lets one helper own a quarter of the smaller one.
 POD_SHARE_DEN="${WATCHDOG_POD_SHARE_DEN:-8}"
 
-# Which roles each mode may signal. The split is by blast radius, not by size:
-# nothing in the helper set is visible to the operator when it restarts, and both
-# members of the editor set are.
+# Which roles each mode may signal. The first split is by blast radius, not by
+# size: nothing in the helper set is visible to the operator when it restarts,
+# and both members of the editor set are.
 HELPER_ROLES=" tsserver languageServer fileWatcher extensionHelper claudeHelper "
 EDITOR_ROLES=" extensionHost serverMain "
+# The third set is on a different axis entirely, and the axis is *calibration*
+# rather than blast radius: a treeHelper is a process this watchdog is sure it
+# should be watching and has no measured resting size for. Its budget is a
+# reasoned guess, and a guessed budget applied to a process whose legitimate
+# resting size is larger than the guess is a kill loop - which is the specific
+# failure this design has already shipped twice. So the unknown set is measured,
+# budgeted, dwell-tracked and reported in every mode, and signalled only under
+# enforce-all, where the operator has already said he accepts restarts he can
+# see. Until then a coverage gap arrives as `event=would-kill armed=no` in the
+# container log instead of as silence.
+UNKNOWN_ROLES=" treeHelper "
 
 # Filled by derive_budgets().
 declare -gA BUDGET=() FLOORED=()
@@ -235,6 +281,11 @@ declare -gA CHILDREN=() SERVER_TREE=() PROTECTED=() NOT_EDITOR=() PROTECT_REASON
 declare -gA POLICED=() CLAUDE_ROOTS=()
 declare -ga PIDS=() SERVER_ROOTS=()
 declare -gA OVER_SINCE=() KILLED_AT=() KILL_TIMES=() DISARMED=() KILLS=()
+# Per-role aggregates, recomputed each sweep (SUM) and kept for the life of the
+# watchdog (PEAK). Neither drives any decision - see the note on aggregation in
+# sweep_once - and PEAK is the review trigger for RESTING_ROLE, which is a hand
+# measurement with no other way to tell that it has gone stale.
+declare -gA ROLE_SUM_PSS=() ROLE_PEAK_PSS=()
 SERVER_PID=""
 ROLE=other
 GUARD=""
@@ -249,12 +300,12 @@ UPTIME=0
 H_MAX_SEEN=0
 H_MIN_SEEN=0
 M_MAX=0
-POLICED_MAX_SEEN=0
 KILLS_TOTAL=0
 KILL_TIMES_ALL=""
 LAST_KILL_AT=0
 PSS_UNAVAILABLE=0
 VISIBILITY_WARNED=0
+BLIND_SINCE=-1
 STDOUT_OK=1
 LAST_CENSUS_AT=0
 STARTED_AT=${WATCHDOG_NOW:-$EPOCHSECONDS}
@@ -290,6 +341,15 @@ derive_budgets() {
     # to have, and the role keeps its budget because the alternative is a kill
     # loop. On the 8 GiB workspace the extension host reaches this, which is why
     # it is reported rather than silently applied.
+    #
+    # That reading only holds while every *declared* budget is already at or
+    # above its own resting floor, because then the only thing that can push
+    # `want` below the floor is the pod share. It did not hold before: the
+    # extension host's declared 1024 MiB was below its own 1069 MiB floor, so
+    # floored=1 was true at 4, 8, 16 and 64 GiB alike and said nothing about the
+    # pod at all. The declared number is now the one in force, and
+    # script-memory-watchdog-test.sh asserts the invariant directly rather than
+    # asserting the flag's value on one pod size.
     if ((want < floor)); then
       want=$floor
       FLOORED[$role]=1
@@ -305,7 +365,10 @@ role_is_armed() {
   [[ -n ${DISARMED[$role]:-} ]] && return 1
   case "$MODE" in
   enforce) [[ $HELPER_ROLES == *" $role "* ]] ;;
-  enforce-all) [[ $HELPER_ROLES == *" $role "* || $EDITOR_ROLES == *" $role "* ]] ;;
+  enforce-all)
+    [[ $HELPER_ROLES == *" $role "* || $EDITOR_ROLES == *" $role "* ||
+      $UNKNOWN_ROLES == *" $role "* ]]
+    ;;
   *) return 1 ;;
   esac
 }
@@ -375,7 +438,7 @@ read_cgroup_memory() {
   M_MAX=$raw
 
   M_CURRENT=0
-  read -r M_CURRENT <"${CGROUP_DIR}/memory.current" 2>/dev/null
+  read -r M_CURRENT 2>/dev/null <"${CGROUP_DIR}/memory.current"
 
   M_H=$((M_MAX - M_U))
 
@@ -395,13 +458,13 @@ read_cgroup_pressure() {
     [[ $field == *.* ]] || field="${field}.00"
     [[ ${field%%.*} =~ ^[0-9]+$ && ${field##*.} =~ ^[0-9]+$ ]] || continue
     M_PSI_CENTI=$((10#${field%%.*} * 100 + 10#${field##*.}))
-  done <"${CGROUP_DIR}/memory.pressure" 2>/dev/null
+  done 2>/dev/null <"${CGROUP_DIR}/memory.pressure"
   return 0
 }
 
 read_uptime() {
   local raw=""
-  read -r raw _ <"${PROC_DIR}/uptime" 2>/dev/null
+  read -r raw _ 2>/dev/null <"${PROC_DIR}/uptime"
   UPTIME=${raw%%.*}
   [[ $UPTIME =~ ^[0-9]+$ ]] || UPTIME=0
   return 0
@@ -432,7 +495,7 @@ read_process_table() {
 
   for entry in "${PROC_DIR}"/[0-9]*; do
     pid=${entry##*/}
-    read -r line <"$entry/stat" 2>/dev/null || continue
+    read -r line 2>/dev/null <"$entry/stat" || continue
 
     # /proc/<pid>/stat is "pid (comm) state ppid ...", and comm may contain
     # spaces and parentheses, so split on the *last* ") " rather than tokenise.
@@ -451,7 +514,7 @@ read_process_table() {
     [[ $sid =~ ^[0-9]+$ ]] || sid=0
 
     argv=()
-    mapfile -d '' -t argv <"$entry/cmdline" 2>/dev/null
+    mapfile -d '' -t argv 2>/dev/null <"$entry/cmdline"
     PIDS+=("$pid")
     P_COMM[$pid]=$comm
     P_CMD[$pid]="${argv[*]}"
@@ -483,7 +546,7 @@ read_process_table() {
 read_usage() {
   local pid res key val got
   for pid in "$@"; do
-    read -r _ res _ <"${PROC_DIR}/${pid}/statm" 2>/dev/null || continue
+    read -r _ res _ 2>/dev/null <"${PROC_DIR}/${pid}/statm" || continue
     P_RSS[$pid]=$((res * PAGE_SIZE))
     got=""
     if [[ -r "${PROC_DIR}/${pid}/smaps_rollup" ]]; then
@@ -492,7 +555,7 @@ read_usage() {
           got=$val
           break
         fi
-      done <"${PROC_DIR}/${pid}/smaps_rollup"
+      done 2>/dev/null <"${PROC_DIR}/${pid}/smaps_rollup"
     fi
     if [[ $got =~ ^[0-9]+$ ]]; then
       P_PSS[$pid]=$((got * 1024))
@@ -544,7 +607,7 @@ find_server_roots() {
   for pid in "${PIDS[@]}"; do
     [[ ${P_CMD[$pid]} == *"/.vscode-server/"*"out/server-main.js"* ]] || continue
     argv=()
-    mapfile -d '' -t argv <"${PROC_DIR}/${pid}/cmdline" 2>/dev/null
+    mapfile -d '' -t argv 2>/dev/null <"${PROC_DIR}/${pid}/cmdline"
     ((${#argv[@]} > 1)) || continue
     exe=${argv[0]##*/}
     [[ ${argv[0]} == *"/.vscode-server/"* || $exe == node || $exe == node[0-9]* ]] || continue
@@ -626,6 +689,29 @@ is_vscode_binary() {
   [[ ${P_ARGV0[$1]:-} == *"/.vscode-server/"* ]]
 }
 
+# True when the process was forked directly by a remote-server entrypoint, i.e.
+# it is one of VS Code's own core forks rather than something an extension
+# started. Measured on the live tree: server-main.js's direct children are
+# exactly fileWatcher, extensionHost and ptyHost, while every language server,
+# typings installer and extension binary hangs off the extension host or off
+# another helper.
+#
+# It exists for one purpose, and it is a Munger-style "what would make this
+# actively harmful" guard rather than a classification aid. The treeHelper
+# fallback below governs anything in the tree it cannot name; if VS Code ever
+# renames `--type=extensionHost`, that fallback would hand the largest and most
+# user-visible process in the pod a 512 MiB helper budget and, under
+# enforce-all, a standing kill order. A core fork that stops being recognised
+# must become *unmanaged and loud*, never *managed on a guessed budget*.
+is_server_fork() {
+  local ppid=${P_PPID[$1]:-0} r
+  ((${#SERVER_ROOTS[@]})) || return 1
+  for r in "${SERVER_ROOTS[@]}"; do
+    [[ $ppid == "$r" ]] && return 0
+  done
+  return 1
+}
+
 # True for the root process of an agent session. Structural: the program being
 # executed is named claude, by comm (a compiled launcher) or by argv[0]'s
 # basename (a shebang script, where comm is the interpreter). Never a substring
@@ -840,6 +926,32 @@ role_of() {
     # extensions/ but runs VS Code's own node - keeps its role above.
     if [[ $argv0 == *"/.vscode-server/extensions/"* ]]; then
       ROLE=extensionHelper
+    elif is_vscode_binary "$1" && ! is_server_fork "$1"; then
+      # The default is inverted here, and this is the substantive change in this
+      # version: inside the server tree, running VS Code's own runtime, not one
+      # of the core forks, and not recognised - "I do not know what this is" is
+      # not the same statement as "this is not my business", and conflating them
+      # is what made three real helpers invisible.
+      #
+      # Measured on the live tree, `other` was returned for a
+      # tamasfe.even-better-toml server.js holding 280 MB PSS - already above the
+      # 256 MiB languageServer budget it would have been given had a pattern
+      # matched it - plus tsserver's typingsInstaller.js at 61 MB and the
+      # built-in markdown-language-features server at 54 MB. None of the
+      # patterns above reach them, and none of them ever could reliably: the set
+      # of launch shapes is the union of every extension's own choices, so a
+      # pattern list is a permanent race against a vendor-controlled vocabulary,
+      # and each new extension is silently ungoverned until somebody notices by
+      # hand. That is the failure this watchdog exists to end.
+      #
+      # The alternative to inverting is to keep adding a regex per extension.
+      # It is easier and it rots; worse, it fails *silently*, which is the one
+      # property this mechanism cannot afford. Inverting fails the other way -
+      # loudly, in a role whose budget is admittedly a guess - so the guess is
+      # made safe by arming rather than by hoping: treeHelper is in
+      # UNKNOWN_ROLES, so enforce (the template default) reports it and never
+      # signals it. See the note there.
+      ROLE=treeHelper
     else
       ROLE=other
     fi
@@ -943,19 +1055,39 @@ compute_policed() {
 # somewhere: VS Code puts --connection-token= on its own argv, and an MCP server
 # can be launched with an API key in an argument.
 identity_of() {
-  local pid=$1 role=$2 tok seg fallback
+  local pid=$1 role=$2 tok seg fallback rest ext
   # For a helper, the interpreter is never the interesting part of the name: a
   # dozen unrelated MCP servers are all `node` or `python3`, and what
   # distinguishes them is the first argument that is not the interpreter and not
   # a flag. For everything else argv[0] is the name, because that is the thing
   # the role was decided from.
-  if [[ $role == "claudeHelper" || $role == "extensionHelper" ]]; then
+  if [[ $role == "claudeHelper" || $role == "extensionHelper" || $role == "treeHelper" ]]; then
     for tok in ${P_CMD[$pid]:-}; do
       seg=${tok##*/}
       [[ -z $seg ]] && continue
       case "$seg" in
       -* | node | node[0-9]* | python | python[0-9] | python[0-9].[0-9]* | uv | uvx | npx | bun | deno) continue ;;
       esac
+      # A tree helper is named for the extension it came from as well as for its
+      # script, because the script name alone re-hides precisely what this role
+      # exists to reveal: on the live tree the toml server is `dist/server.js`,
+      # and so is roughly every other extension's language server. `server` as a
+      # breadcrumb answers nothing in a post-mortem.
+      if [[ $role == "treeHelper" && $tok == *"/extensions/"* ]]; then
+        rest=${tok##*"/extensions/"}
+        ext=${rest%%/*}
+        # Built-in extensions ship their servers under extensions/node_modules/,
+        # where the name worth having is one segment further in (typescript,
+        # not node_modules).
+        if [[ $ext == "node_modules" ]]; then
+          rest=${rest#node_modules/}
+          ext=${rest%%/*}
+        fi
+        if [[ -n $ext && $ext != "$seg" ]]; then
+          printf '%s/%s' "$ext" "${seg%.js}"
+          return 0
+        fi
+      fi
       printf '%s' "${seg%.js}"
       return 0
     done
@@ -1059,6 +1191,15 @@ publish_top() {
   return 0
 }
 
+# du_bytes_per_s is (M_U - PREV_U) / dt, dt being one SAMPLE_INTERVAL (10s by
+# default) - an instantaneous rate, not a drift rate, and naively averaging the
+# column conflates the two. On the live pod that naive mean reads ~19.8 kB/s
+# (~68 MB/hour); the same quantity taken from the hourly census's u_mb over a
+# 26.1h window reads ~18.4 MB/hour, a 3.7x difference. The naive mean is
+# dominated by a handful of 10s allocation/GC spikes (+102 MB/s to -58 MB/s)
+# that wash out over an hour but dominate a per-row average. Read this column
+# as "what changed in the last sample", not as "the drift rate" - for the
+# latter, difference u_mb across two event=census rows far apart in time.
 CSV_HEADER="ts,mem_max,mem_current,u,h,anon,shmem,unevictable,slab_unreclaimable,slab_reclaimable,kernel_stack,pagetables,sec_pagetables,percpu,sock,file,psi_full_avg10_centi,refault_file_per_s,pgscan_direct_per_s,pressure,du_bytes_per_s"
 
 append_calibration() {
@@ -1066,7 +1207,7 @@ append_calibration() {
   if [[ -s $csv ]]; then
     # A file written by an earlier version has different columns, and appending
     # to it would produce one CSV that is silently two schemas. Rotate it.
-    read -r first <"$csv" 2>/dev/null
+    read -r first 2>/dev/null <"$csv"
     if [[ $first != "$CSV_HEADER" ]]; then
       mv -f "$csv" "${csv}.1" 2>/dev/null
     fi
@@ -1095,7 +1236,7 @@ SWEEP_HEADER=$'#ts\tsweep\tpid\tstart\trole\tstate\tpss_kb\trss_kb\tage_s\tbudge
 append_sweep() {
   local dst="${STATE_DIR}/sweep.log" first=""
   if [[ -s $dst ]]; then
-    read -r first <"$dst" 2>/dev/null
+    read -r first 2>/dev/null <"$dst"
     [[ $first != "$SWEEP_HEADER" ]] && mv -f "$dst" "${dst}.1" 2>/dev/null
   fi
   [[ -s $dst ]] || printf '%s\n' "$SWEEP_HEADER" >"$dst"
@@ -1189,6 +1330,30 @@ prune_state() {
   return 0
 }
 
+# On aggregation, and why a budget is compared per process rather than per role.
+#
+# Every budget below is checked against one pid's PSS, and nothing sums a role.
+# A workspace running N same-role processes can therefore sit at N x
+# (just-under-budget) indefinitely and trip nothing, which is a real hole and is
+# recorded here rather than fixed, because fixing it costs more than it is worth
+# on the evidence available:
+#
+#  - The evidence says the case is not occurring. The only role that runs more
+#    than one process on this workspace is tsserver - two of them, measured at
+#    112 and 141 MB PSS against a 768 MiB budget each. The sum is a third of one
+#    budget.
+#  - A per-role total changes what a kill *means*. If three siblings each hold a
+#    third of the total, none of them is the offender, and killing the largest is
+#    an arbitrary choice dressed as a decision.
+#  - It does not compose with the dwell clock, which is keyed per pid:starttime
+#    precisely so that load can be told from drift. A role-level clock cannot
+#    distinguish "one process drifting" from "processes being created", and the
+#    second is a supervisor's business, not this loop's.
+#
+# What is done instead is the cheap half: ROLE_SUM_PSS is computed every sweep
+# and reported in the census, so the evasion is visible as data the moment it
+# starts happening, and a future decision to act on it would begin from a
+# measurement rather than from this argument.
 sweep_once() {
   local now=$1
   local pid role budget pss key over_since over_s state guard id cmd age
@@ -1203,6 +1368,8 @@ sweep_once() {
   read_usage "${PIDS[@]}"
   prune_state
 
+  ROLE_SUM_PSS=()
+
   TOP_ROLE=""
   TOP_ID=""
   TOP_PSS=0
@@ -1217,6 +1384,10 @@ sweep_once() {
     key="${pid}:${P_START[$pid]:-0}"
     ((policed_n += 1))
     total_pss=$((total_pss + pss))
+    # Per-role totals and peaks. Deliberately reported and not acted on: see
+    # the aggregation note above sweep_once.
+    ROLE_SUM_PSS[$role]=$((${ROLE_SUM_PSS[$role]:-0} + pss))
+    ((pss > ${ROLE_PEAK_PSS[$role]:-0})) && ROLE_PEAK_PSS[$role]=$pss
 
     id="$(identity_of "$pid" "$role")"
     if ((budget > 0)) && ((pss * 100 / budget > TOP_PCT)); then
@@ -1237,7 +1408,34 @@ sweep_once() {
       state=over
       if ((over_s >= DWELL_SECONDS)) && ((age >= MIN_AGE)); then
         state=over-dwell
-        if [[ -n ${DISARMED[$role]:-} ]]; then
+        if [[ -n ${KILLED_AT[$key]:-} ]]; then
+          # Already asked politely. Escalate once the grace has elapsed.
+          #
+          # This is tested *before* the disarm check, and that ordering is the
+          # decision rather than an accident of layout. A drill caught the other
+          # ordering: the breaker tripped between a process's SIGTERM and its
+          # SIGKILL, the disarm branch short-circuited, and the process was still
+          # alive and still over budget at the end of the run - signalled,
+          # abandoned, and recorded as neither killed nor spared.
+          #
+          # Disarming means "stop deciding to kill this role", not "abandon a
+          # kill already decided". Completing an escalation cannot start the
+          # loop the breaker exists to stop, because it finishes one action
+          # rather than beginning another - record_kill is deliberately not
+          # called again here, since this is the same kill it already counted.
+          # Leaving a process half-signalled is the worst of both outcomes: a
+          # helper that caught SIGTERM and began shutting down is not something
+          # to walk away from, and one that ignored it goes on holding the
+          # memory with the watchdog having decided not to look again.
+          if ((now - KILLED_AT[$key] >= KILL_GRACE)); then
+            if signal_pid KILL "$pid" "$role" "drift ${role}"; then
+              state=killed-9
+              record_action "event=kill sig=KILL pid=${pid} role=${role} id=${id} pss_mb=$((pss / MIB)) budget_mb=$((budget / MIB)) over_s=${over_s} after_disarm=$([[ -n ${DISARMED[$role]:-} ]] && printf yes || printf no) detail=@still over budget ${KILL_GRACE}s after SIGTERM@"
+            fi
+          else
+            state=terminating
+          fi
+        elif [[ -n ${DISARMED[$role]:-} ]]; then
           state=disarmed
         elif ! role_is_armed "$role"; then
           # Observe mode, or a role this mode does not arm. Report the kill that
@@ -1247,16 +1445,6 @@ sweep_once() {
           state=would-kill
           record_action "event=would-kill armed=no pid=${pid} role=${role} id=${id} pss_mb=$((pss / MIB)) budget_mb=$((budget / MIB)) over_s=${over_s} age_s=${age}"
           OVER_SINCE[$key]=$now
-        elif [[ -n ${KILLED_AT[$key]:-} ]]; then
-          # Already asked politely. Escalate once the grace has elapsed.
-          if ((now - KILLED_AT[$key] >= KILL_GRACE)); then
-            if signal_pid KILL "$pid" "$role" "drift ${role}"; then
-              state=killed-9
-              record_action "event=kill sig=KILL pid=${pid} role=${role} id=${id} pss_mb=$((pss / MIB)) budget_mb=$((budget / MIB)) over_s=${over_s} detail=@still over budget ${KILL_GRACE}s after SIGTERM@"
-            fi
-          else
-            state=terminating
-          fi
         else
           if signal_pid TERM "$pid" "$role" "drift ${role}"; then
             KILLED_AT[$key]=$now
@@ -1290,8 +1478,6 @@ sweep_once() {
     rows+=("${now}"$'\t'"${SWEEPS}"$'\t'"${pid}"$'\t'"${P_START[$pid]:-0}"$'\t'"unmanaged"$'\t'"seen"$'\t'"$((pss / 1024))"$'\t'"$((${P_RSS[$pid]:-0} / 1024))"$'\t'"${P_AGE[$pid]:-0}"$'\t'"0"$'\t'"0"$'\t'"${guard}"$'\t'"${P_COMM[$pid]:-unknown}"$'\t'"${cmd:0:160}")
   done
 
-  ((policed_n > POLICED_MAX_SEEN)) && POLICED_MAX_SEEN=$policed_n
-
   rows+=("${now}"$'\t'"${SWEEPS}"$'\t'"0"$'\t'"0"$'\t'"TOTAL"$'\t'"${PRESSURE}"$'\t'"$((total_pss / 1024))"$'\t'"0"$'\t'"0"$'\t'"0"$'\t'"0"$'\t'"-"$'\t'"policed=${policed_n},over=${over_n},killed=${killed_n},procs=${#PIDS[@]},tree=${#SERVER_TREE[@]},sessions=${#CLAUDE_ROOTS[@]}"$'\t'"h=${M_H},u=${M_U},psi=${M_PSI_CENTI},mode=${MODE}")
   append_sweep "${rows[@]}"
   printf '%s\n' "$SWEEP_HEADER" "${rows[@]}" >"${STATE_DIR}/sweep.latest.tmp" &&
@@ -1309,15 +1495,29 @@ sweep_once() {
 # with a workspace where VS Code is closed and no session is running - but it is
 # worth one line in the log, because the alternative reading is that selection is
 # broken, and that reading has been correct before.
+#
+# The latch is per *episode*, not per process lifetime. It used to be neither: a
+# one-shot flag was set at the warmup sweep whether or not it warned, and the
+# condition it tested was a lifetime high-water mark, so a watchdog that policed
+# something once in its first half hour could never warn again however blind it
+# went afterwards. A pod lives for days; the interesting blind spot is the one
+# that appears on day two, when an upgrade changes a launch shape and selection
+# quietly stops matching. So the clock restarts whenever the blindness does, and
+# re-arms as soon as anything is policed again - one line per episode, not one
+# line per pod.
 VISIBILITY_WARMUP="${WATCHDOG_VISIBILITY_WARMUP:-30}" # sweeps
 
 check_visibility() {
+  if ((${POLICED_N:-0} > 0)); then
+    BLIND_SINCE=-1
+    VISIBILITY_WARNED=0
+    return 0
+  fi
+  ((BLIND_SINCE >= 0)) || BLIND_SINCE=$SWEEPS
   ((VISIBILITY_WARNED)) && return 0
-  ((SWEEPS >= VISIBILITY_WARMUP)) || return 0
+  ((SWEEPS - BLIND_SINCE >= VISIBILITY_WARMUP)) || return 0
   VISIBILITY_WARNED=1
-  if ((POLICED_MAX_SEEN == 0)); then
-    record_action "event=warning reason=nothing-policed sweeps=${SWEEPS} detail=@either nothing this watchdog manages has run, or selection is finding nothing; sweep.latest shows what was there@"
-  fi
+  record_action "event=warning reason=nothing-policed sweeps=${SWEEPS} blind_since_sweep=${BLIND_SINCE} detail=@either nothing this watchdog manages has run, or selection is finding nothing; sweep.latest shows what was there@"
   return 0
 }
 
@@ -1327,15 +1527,27 @@ check_visibility() {
 # the pod is gone; and it is the trend series for the standing population - the
 # thing this watchdog exists to bound - at 24 lines a day rather than 40,000.
 emit_census() {
-  local now=$1 role disarmed=""
+  local now=$1 role disarmed="" sums="" peaks=""
   for role in "${!DISARMED[@]}"; do disarmed+="${role} "; done
+  # The per-role total is what makes the un-fixed aggregation hole observable
+  # (see the note above sweep_once), and the per-role peak is the review trigger
+  # for RESTING_ROLE. Neither is acted on: a watchdog that re-derived its own
+  # floor from what it observed would raise the limit it is enforcing every time
+  # the thing it is enforcing against grew, which is the one move this design
+  # forbids outright.
+  for role in "${!ROLE_SUM_PSS[@]}"; do
+    sums+="${role}=$((${ROLE_SUM_PSS[$role]} / MIB)) "
+  done
+  for role in "${!ROLE_PEAK_PSS[@]}"; do
+    peaks+="${role}=$((${ROLE_PEAK_PSS[$role]} / MIB)) "
+  done
   LAST_CENSUS_AT=$now
   record_action "event=census sweeps=${SWEEPS} uptime_s=$((now - STARTED_AT))" \
     "policed=${POLICED_N:-0} over_budget=${OVER_N:-0} sessions=${#CLAUDE_ROOTS[@]}" \
     "tree=${#SERVER_TREE[@]} kills_total=${KILLS_TOTAL} disarmed=@${disarmed% }@" \
     "h_mb=$((M_H / MIB)) u_mb=$((M_U / MIB)) pressure=${PRESSURE} psi_full10=${M_PSI_CENTI}" \
     "top_role=${TOP_ROLE:-none} top_id=${TOP_ID:-none} top_pss_mb=$((${TOP_PSS:-0} / MIB))" \
-    "top_budget_pct=${TOP_PCT:-0}"
+    "top_budget_pct=${TOP_PCT:-0} role_pss_mb=@${sums% }@ role_peak_mb=@${peaks% }@"
   return 0
 }
 
@@ -1363,6 +1575,13 @@ publish_summary() {
     # Per day rather than per hour: the operator's question is "not every
     # fifteen minutes", and an hourly rate over a short uptime reads as a huge
     # number for one event.
+    line=""
+    for role in "${!ROLE_PEAK_PSS[@]}"; do line+="${role}=$((${ROLE_PEAK_PSS[$role]} / MIB))M "; done
+    # The largest each role has been since this watchdog started. It is the only
+    # standing evidence that RESTING_ROLE - a hand measurement taken once - has
+    # drifted away from what the workload actually does, and it is reported for a
+    # human to act on rather than fed back into the budgets.
+    printf 'peak_pss %s\n' "${line:-none}"
     printf 'kill_rate_per_day=%d.%02d\n' \
       "$((KILLS_TOTAL * 86400 / up))" "$((KILLS_TOTAL * 86400 * 100 / up % 100))"
     printf 'dwell_s=%d min_age_s=%d loop_window_s=%d loop_kills=%d pss=%s\n' \
@@ -1395,10 +1614,10 @@ acquire_singleton() {
   local -a argv=()
 
   if [[ -s $pidfile ]]; then
-    read -r other <"$pidfile" 2>/dev/null
+    read -r other 2>/dev/null <"$pidfile"
     if [[ $other =~ ^[0-9]+$ ]] && ((other != $$)) &&
       [[ -r ${PROC_DIR}/${other}/cmdline ]]; then
-      mapfile -d '' -t argv <"${PROC_DIR}/${other}/cmdline" 2>/dev/null
+      mapfile -d '' -t argv 2>/dev/null <"${PROC_DIR}/${other}/cmdline"
       for a in "${argv[@]}"; do
         [[ $a == "$self" ]] && return 1
       done
@@ -1409,7 +1628,7 @@ acquire_singleton() {
   # Two watchdogs started at the same instant would both get this far. Settle it
   # by reading back who actually owns the file rather than by trusting the write.
   /usr/bin/sleep 1
-  read -r other <"$pidfile" 2>/dev/null
+  read -r other 2>/dev/null <"$pidfile"
   [[ $other == "$$" ]]
 }
 
@@ -1419,7 +1638,7 @@ release_singleton() {
   # fails is reported by the shell before `2>/dev/null` on the same command has
   # taken effect, so the test is done here rather than swallowed there.
   [[ -r $pidfile ]] || return 0
-  read -r owner <"$pidfile" 2>/dev/null
+  read -r owner 2>/dev/null <"$pidfile"
   # Never remove a pidfile another instance owns - that would hand the lock to a
   # third one while the second is still running.
   [[ $owner == "$$" ]] && rm -f "$pidfile"
@@ -1442,7 +1661,7 @@ cycle_once() {
   if ((${#BUDGET[@]} == 0)); then
     derive_budgets "$M_MAX"
     local role
-    for role in extensionHost serverMain tsserver languageServer fileWatcher extensionHelper claudeHelper; do
+    for role in extensionHost serverMain tsserver languageServer fileWatcher extensionHelper treeHelper claudeHelper; do
       record_action "event=budget role=${role} budget_mb=$((${BUDGET[$role]} / MIB)) pod_share_mb=$((M_MAX / POD_SHARE_DEN / MIB)) resting_mb=$((${RESTING_ROLE[$role]:-0} / MIB)) floored=${FLOORED[$role]:-0} armed=$(role_is_armed "$role" && printf yes || printf no)"
     done
     record_action "event=budgets_derived memory_max_mb=$((M_MAX / MIB)) dwell_s=${DWELL_SECONDS} min_age_s=${MIN_AGE} loop_window_s=${LOOP_WINDOW} loop_kills=${LOOP_KILLS} armed=@$(
@@ -1495,7 +1714,7 @@ count_lines() {
     printf '0'
     return 0
   }
-  n=$(/usr/bin/wc -l <"$1" 2>/dev/null)
+  n=$(/usr/bin/wc -l 2>/dev/null <"$1")
   printf '%s' "${n:-0}"
 }