diff --git a/CLAUDE.md b/CLAUDE.md
index d568fc7f..e292f4a2 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -75,8 +75,8 @@ Quick orientation map — for what each piece is *for* and the decisions behind
 | `variables.tf` | `workspace_image`, `test_mode` — both supplied by the release workflow |
 | `script-agent-startup.sh` / `script-prepare-workspace.sh` | Scripts run on agent/workspace startup |
 | `script-container-entrypoint.sh` | The workspace container's `command`. Wipes `/tmp` and `exec`s Coder's generated `/workspace-init.sh` — the wipe must precede the agent, see the gotcha below |
-| `script-memory-watchdog.sh` | Userspace memory watchdog — see [DESIGN.md](DESIGN.md#design-tensions-and-decisions). It bounds the **standing population of restartable helpers** (per-role PSS budgets, ten-minute dwell, per-role circuit breaker) and records every per-process sweep. It does **not** try to prevent an acute OOM. `memory_watchdog_mode` selects `observe` / `enforce` (helpers — the default) / `enforce-all` (helpers + editor + the uncalibrated `treeHelper` role) |
-| `script-memory-watchdog-test.sh` | Fixture tests for the watchdog's arithmetic, process selection, budgets, dwell and circuit breaker. Run by hand (`./script-memory-watchdog-test.sh`) and by the `watchdog` job in `.github/workflows/test.yaml`. `kill` is shadowed by a function throughout — the fixture pids are real pids in whatever container runs the suite |
+| `script-memory-watchdog.sh` | Userspace memory watchdog — see [DESIGN.md](DESIGN.md#design-tensions-and-decisions). It bounds the **standing population of restartable helpers** against a fixed **2048 MiB envelope** for the VS Code tree (per-role shares of it, PSS, ten-minute dwell) and records every per-process sweep. It does **not** try to prevent an acute OOM. `memory_watchdog_mode` selects `observe` / `enforce` (the default; arms every role). `enforce-all` is retired and honoured as `enforce` |
+| `script-memory-watchdog-test.sh` | Fixture tests for the watchdog's envelope and shares, process selection, dwell, the oversize rule and the kill-rate report. Run by hand (`./script-memory-watchdog-test.sh`) and by the `watchdog` job in `.github/workflows/test.yaml`. `kill` is shadowed by a function throughout — the fixture pids are real pids in whatever container runs the suite |
 | `script-vscode-server-gc.sh` | Weekly GC of `~/.vscode-server` (interrupted downloads, superseded server versions/extensions, orphaned CLI binaries — see the script's own header for the exact signal per class, and the `coder_script.vscode_server_gc` comment in `scripts.tf` for why it's template-owned rather than dotfiles-owned) |
 
 **Image** (`images/homelab-workspace/Dockerfile`): three build stages — `base` (minimal bootstrap deps) → `system-base` (`unminimize` + full interactive toolset) → final stage (env vars into `/etc/environment`, fixed-UID/GID `coder` user, `USER coder`). All `apt`-touching `RUN` steps use BuildKit cache mounts — match that pattern when adding packages.
@@ -93,12 +93,16 @@ Things that look arbitrary in the code but are load-bearing (full reasoning in [
 - `script-memory-watchdog.sh` computes headroom as `memory.max − U`, where `U` sums only the *unreclaimable* fields of `memory.stat` (`anon`, `shmem`, `unevictable`, `slab_unreclaimable`, `kernel_stack`, `pagetables`, `sec_pagetables`, `percpu`, `sock`). Do not "simplify" it to `memory.current` or to `memory.stat`'s `kernel` roll-up: on the live pod those read 96% and 42% of the limit while true `U` is 28%. Nothing acts on this number any more — it is pod-level context for the per-process rows and the honest figure published in the workspace UI.
 - `calibration.csv`'s `du_bytes_per_s` column is a per-sample instantaneous rate (`(M_U - PREV_U) / SAMPLE_INTERVAL`, 10s by default), not a drift rate, and naively averaging it overstates drift roughly fourfold: ~19.8 kB/s (~68 MB/hour) naive mean on the live pod versus ~18.4 MB/hour computed from `u_mb` across two `event=census` rows 26.1h apart. The naive mean is dominated by a handful of 10s allocation/GC spikes (+102 to −58 MB/s) that an hourly comparison washes out. The column and its caveat are documented together at its declaration in the script; nothing currently reads this column programmatically, so the trap is for a human, not a bug.
 - **The watchdog is a drift policer, not an OOM preventer, and the difference is measured.** The graded L1–L4 shedding ladder that used to be here was removed, not tuned: the recorded kills are 70–220 MB/s spikes that go from idle to dead inside a minute, a live reproduction climbed the ladder correctly and logged `no-candidates` because the runaway was not in the tree it managed, and the entire editor tree it could shed is ~0.7 GiB — five seconds of that growth. Before re-adding anything reactive, establish that a poll loop can see the event at all. What the loop *is* good at is MB-per-minute growth in the standing population, which is what it now does.
-- **Budgets are per role, in PSS, and never below a role's measured *resting* size — not its fresh size.** Fresh tree: extension host 471 MB PSS, serverMain 160 MB, ptyHost 36 MB, file watcher 34 MB. Resting tree (reconnected, idle, 8 GiB pod): extension host **713 MB**, file watcher 88 MB, language server 54 MB, tree total 1093 MB. A uniform 512 MB budget would sit 40 MB above where the extension host *starts* and 200 MB below where it *lives*, which is the same class of defect as the earlier `RLIMIT_DATA` ceiling that landed below what an idle file watcher already held — "calibrated against fresh, deployed against resting" has now appeared twice in this design, so `RESTING_ROLE` holds the resting figures and nothing else. Each budget is `max(min(role budget, memory.max / 8), resting × 1.5)`, and the derivation records which budgets the floor lifted (`floored=1`), which is documented to mean the pod is too small to bound that role at its intended share. **That reading only holds while every declared budget already clears its own resting floor, and it did not: `extensionHost` was declared at 1024 MiB against a 1069 MiB floor, so `floored=1` was true at 4, 8, 16 and 64 GiB alike — a property of the constants reported as a property of the pod.** The declared number is now 1069 MiB, the one that was always in force; no effective budget changed at any pod size, and the flag now flips off at 16 GiB. The tests assert the *properties* — no budget at or below resting, and no declared budget below its own floor, at any pod size — rather than the arithmetic. Override one role with `WATCHDOG_BUDGET_<role>`; PSS (`smaps_rollup`) is the comparison, not RSS and not `VmData`.
+- **The VS Code tree gets a fixed 2048 MiB envelope; each role holds a named share of it that does not vary with pod size; a process is killed when its PSS has been above its share for ten continuous minutes *and* it has been observed inside that share since it started.** That last clause is the whole of the `oversize` rule, and it is what replaced the `resting × 1.5` floor. Shares: `serverMain` 512 (the largest, allocated by *consequence* — it holds the remote connection, so a wrong kill costs a disconnect rather than a reload), `extensionHost` 480, `tsserver` 320, `treeHelper` 320, `fileWatcher` 160, `languageServer` 128, `extensionHelper` 128 — 2048 exactly. `claudeHelper` 512 sits **outside** the envelope (not VS Code; sized against the measured 1.66 GB python MCP server). Override one role with `WATCHDOG_BUDGET_<role>`; PSS (`smaps_rollup`) is the comparison, not RSS and not `VmData`. The tests assert *properties* — the shares sum to the envelope and are identical at every `memory.max`, no share exceeds an eighth of the smallest supported pod, `serverMain` is strictly the largest, every role is armed under `enforce` — rather than one pod's arithmetic.
+- **Three mechanisms were removed under the envelope, and none of them may come back piecemeal.** (1) The `resting × 1.5` **floor**: it stopped a share landing below what a healthy process already holds — a real scar, this design shipped that twice — but a floor can push the sum past the envelope, which is the envelope defeated by arithmetic. Its protection now comes from the `oversize` rule: a process never seen inside its share is reported forever and never signalled, which is measured on the running process rather than read from a hand-maintained constant that goes stale, and cannot inflate a budget. `RESTING_ROLE`, `RESTING_FACTOR_*` and `FLOORED` are gone with it; the measurements survive as comments beside the share each one argues about. (2) The `memory.max / 8` **divisor**: it was always per-role and never a total (#865's body and the code comment both say so), and it is meaningless against a fixed envelope; its protection survives because the largest share, 512 MiB, is exactly an eighth of the smallest pod this template offers — asserted at every pod size rather than trusted. (3) The **circuit breaker's permanent disarm**: under a deliberate cap, repeated kills mean the process does not fit, not that the number is wrong, and a mechanism that switches itself off after three kills is inert by mid-morning while arriving to look exactly like the watchdog working. It now emits `event=kill-rate ... enforcing=yes` and disarms nothing; the kill *loop* it guarded against cannot form, because the replacement of a killed process arrives over budget and is `oversize`.
+- **The extension host does not fit today, and the answer is reporting rather than thrashing.** It arrived at 610 MB PSS at 11 seconds old and settled at 577 MB before doing any work, against a 480 MiB share; no apportionment of 2048 MiB can both keep `serverMain` the largest share and clear 610 MB, which is arithmetic rather than a preference. So the envelope presupposes a tree trimmed in the operator's *dotfiles* (capped launcher heaps, extensions moved client-side) — and because **a template can never depend on dotfiles having been applied** (the `vscode-server-gc` lesson), the untrimmed case is designed for and not merely reported: that one role degrades to a repeating `event=oversize` line while the other six go on being enforced. `tsserver` is the same shape from the other end: it runs with `--max-old-space-size=3072` (VS Code's shipped default, observed live on both instances), so without the dotfiles cap its 320 MiB share means "report a healthy tsserver on a large project", not "bound it".
+- **A kill needs ten minutes of continuous over-budget dwell.** That separates drift from load — a language server that balloons while indexing and hands the memory back must survive. The fit evidence behind the `oversize` rule is only taken at or past the 300 s age floor, so the classification cannot become a function of which sweep happened to catch a process seconds after `exec`.
+- **The envelope is enforced as an apportionment and *measured* as a total.** Comparison stays per process (a role-level total cannot say which sibling is the offender, and does not compose with a per-`pid:starttime` dwell clock), so N members of one role can hold N × their share. That hole is not fixed; it is published — `TREE_PSS` reaches the census as `tree_pss_mb`/`envelope_pct`, the `summary` file, and every sweep's `TOTAL` row. Acting on the total is deliberately not attempted: that is the graded ladder that was removed because a poll loop cannot see the events it was reacting to.
 - **A kill needs ten minutes of continuous over-budget dwell, and three kills of one role inside an hour disarm that role.** The dwell is what separates drift from load — a language server that balloons while indexing and hands the memory back must survive. The breaker is what stops the failure that would make this actively harmful: kill the extension host → VS Code restarts it → it reloads every extension → it exceeds again → kill, a loop that arrives looking exactly like the watchdog working. It disarms and reports rather than widening its own budget, because a mechanism that raises the limit it is enforcing has stopped enforcing.
-- **Inside the server tree, an unrecognised process is *governed*, not invisible — that default is inverted on purpose, and its risk is bought off by arming rather than by hope.** `role_of` returned `other` for three real helpers on the live tree, and `compute_policed` skips `other`, so they had no budget, no dwell clock and no warning: a `tamasfe.even-better-toml` `server.js` at **280 MB PSS** (already above the 256 MiB `languageServer` budget a matching pattern would have given it), tsserver's `typingsInstaller.js` at 61 MB, and the built-in `markdown-language-features` server at 54 MB. Widening the pattern list is the easy fix and the wrong one: the set of launch shapes is the union of every extension's own choices, so a pattern list is a permanent race against a vendor-controlled vocabulary that fails *silently*. So anything in the tree, on VS Code's own runtime, unprotected and unnamed becomes role `treeHelper`. Two things make that safe rather than merely bold: (1) `treeHelper` is in `UNKNOWN_ROLES`, armed **only** under `enforce-all`, because its 512 MiB budget is a reasoned guess and no member has been measured at rest — under `enforce` (the template default) a coverage gap arrives as `event=would-kill armed=no` in the container log instead of as silence; (2) a **direct child of a server root is excluded structurally** — core forks (`fileWatcher`, `extensionHost`, `ptyHost`) are exactly the direct children of `server-main.js`, and no extension helper is, so a VS Code upgrade that renames `--type=extensionHost` makes that process unmanaged and loud rather than managed on a 512 MiB budget it holds 685 MB against. Its sweep-log identity is `<extension>/<script>`, because a dozen extensions all ship a file called `server.js` and `server` answers nothing in a post-mortem.
+- **Inside the server tree, an unrecognised process is *governed*, not invisible — that default is inverted on purpose, and its risk is bought off by arming rather than by hope.** `role_of` returned `other` for three real helpers on the live tree, and `compute_policed` skips `other`, so they had no budget, no dwell clock and no warning: a `tamasfe.even-better-toml` `server.js` at **280 MB PSS** (already above the 256 MiB `languageServer` budget a matching pattern would have given it), tsserver's `typingsInstaller.js` at 61 MB, and the built-in `markdown-language-features` server at 54 MB. Widening the pattern list is the easy fix and the wrong one: the set of launch shapes is the union of every extension's own choices, so a pattern list is a permanent race against a vendor-controlled vocabulary that fails *silently*. So anything in the tree, on VS Code's own runtime, unprotected and unnamed becomes role `treeHelper`. Two things make that safe rather than merely bold: (1) `treeHelper` holds a 320 MiB share like every other role and is armed like every other role — what protects a member whose legitimate size is larger than the share is the `oversize` rule, not an arming exception, and a coverage gap still arrives in the container log rather than as silence; (2) a **direct child of a server root is excluded structurally** — core forks (`fileWatcher`, `extensionHost`, `ptyHost`) are exactly the direct children of `server-main.js`, and no extension helper is, so a VS Code upgrade that renames `--type=extensionHost` makes that process unmanaged and loud rather than managed on a share it holds several times over. Its sweep-log identity is `<extension>/<script>`, because a dozen extensions all ship a file called `server.js` and `server` answers nothing in a post-mortem.
 - **Per-process, never per-role-aggregate — and that hole is a resourced decision, not an oversight.** Each pid is compared against `BUDGET[$role]` alone, so N same-role processes can each sit just under budget indefinitely. Not fixed, for three reasons: the only multi-process role here is `tsserver` (two of them, 112 + 141 MB against 768 MiB *each*); a role-level total makes "which sibling dies" arbitrary when three each contributed a third; and it does not compose with a dwell clock keyed per `pid:starttime`, which is what separates load from drift. What *is* done is the cheap half — `role_pss_mb` in the hourly census — so the evasion becomes visible as data before anyone designs for it.
 - **Disarming a role finishes the kill it already started; it does not begin a new one.** A drill found the opposite by accident: the breaker tripped between a process's SIGTERM and its SIGKILL, the disarm branch short-circuited ahead of the escalation, and the process was left alive, over budget and half-signalled — recorded as neither killed nor spared, and undocumented either way. The escalation check now precedes the disarm check, `record_kill` is deliberately *not* called again (it is the same kill, already counted), and the line carries `after_disarm=yes`. Completing one escalation cannot start the loop the breaker exists to stop.
-- **`RESTING_ROLE` is a hand measurement with a review trigger, never a derived one.** A watchdog that re-derived its own floor from what it observed would raise the limit it is enforcing exactly when the thing it enforces against grew — the move the breaker already refuses, one level removed. The trigger is `role_peak_mb` in the census and `peak_pss` in the summary file: when a role's peak sits persistently above its constant while never dwelling over budget, a human re-measures. Checked at the time of writing: the live extension host read 685 MB at 27.6 h uptime, i.e. *below* the recorded 713 MB, so the reference is not stale and the drift is not monotonic — V8 hands memory back.
+- **No number the watchdog enforces is ever derived from what the watchdog observed.** A loop that re-derived a limit from its own measurements would raise the limit it is enforcing exactly when the thing it enforces against grew. The shares are constants; the observations are *published* for a human — `role_peak_mb` in the census, `peak_pss` in the summary, and `tree_pss_mb`/`envelope_pct` against the envelope — and a share that no longer matches the workload is a decision somebody makes, not one the loop makes for itself.
 - **The "nothing policed" warning is per episode of blindness, not per process lifetime.** It was a one-shot latch set at the warmup sweep whether or not it warned, testing a lifetime high-water mark — so a watchdog that policed something once in its first half hour could never warn again however blind it went. A pod lives for days and the interesting blind spot is the one that arrives on day two, when an upgrade changes a launch shape. The clock now restarts when blindness starts and re-arms when anything is policed again.
 - **`2>/dev/null` must precede the input redirect it is meant to silence, not follow it.** `read -r line <"$entry/stat" 2>/dev/null || continue` opens the file *before* stderr is redirected, so a process exiting between the `/proc` listing and the read makes bash print its own error to inherited stderr; `|| continue` still handles it, so the bug is pure noise — 160 of 161 lines of `boot.log` — that would hide a real error. `release_singleton` already carried a comment showing this was understood. Every per-process `/proc` read now orders it correctly; `memory.stat`/`memory.max` deliberately do not, because a missing cgroup file is a genuine error worth seeing.
 - **The watchdog decides what is a VS Code process by executable path — `argv[0]` under `~/.vscode-server/` — never by whether something "is node".** A provisioned workspace has two unrelated node installations: VS Code's bundled one under `~/.vscode-server/cli/servers/Stable-<commit>/server/`, and mise's on `PATH`, which is what repo tooling and the operator's agent sessions run on. (There is no `/usr/bin/node`, and nothing named `node` on `PATH` at all without dotfiles.) `comm` is `MainThread` for every node process in a real tree, never `node`, because V8 renames its main thread; nothing may key off it. `script-memory-watchdog-test.sh` asserts this three ways, each paired with the mutation that flips it.
@@ -109,7 +113,7 @@ Things that look arbitrary in the code but are load-bearing (full reasoning in [
 - **Action lines also go to `/proc/1/fd/1`, which is the container's stdout, because PID 1 here is the coder agent.** That is the only route out of this pod — the cluster's log agent tails container stdout and nothing else — and it needs no configuration anywhere: the lines land in Loki labelled by namespace, pod and container. **Only actions** take that route (kills, refusals, disarms, the budgets in force, one census line an hour); the sweep stays local, and a test asserts that it does, because dozens of rows a minute do not belong in a log pipeline. Lines are logfmt starting with `component=memory-watchdog` so `|= "component=memory-watchdog" | logfmt` works against a very chatty stream without adding a stream label, free text is quoted into `detail=` by `record_action` rather than at call sites, and the write is best-effort — one failure disables the path, logs why once, and nothing else changes.
 - **A test fixture that can write to `/proc/1/fd/1` writes into production telemetry.** This happened: the first run of the suite after the stdout path was added — before the harness set the seam — put fixture `event=kill role=extensionHost pss_mb=1907` lines into the live workspace's container log and thus into Loki, describing kills that never occurred in the exact format a post-mortem would trust. `load_watchdog` now sets `WATCHDOG_STDOUT_PATH` and the suite **exits** rather than continuing if the seam did not take. Any future test seam that fans out to a real sink deserves the same treatment.
 - Watchdog state keys — the dwell clock and the SIGTERM/SIGKILL escalation — are keyed on `pid:starttime`, never on pid alone. A recycled pid must not inherit another process's history and be killed for it.
-- `parameters.tf`'s `memory_watchdog_mode` also goes through the `local.validated_*` treatment: Coder constrains the value server-side, but it is the single switch deciding whether the watchdog may signal processes, so an unrecognised value falls back to the inert `observe` rather than being passed through.
+- `parameters.tf`'s `memory_watchdog_mode` also goes through the `local.validated_*` treatment: Coder constrains the value server-side, but it is the single switch deciding whether the watchdog may signal processes, so an unrecognised value falls back to the inert `observe` rather than being passed through. The retired `enforce-all` is the one exception — it is mapped to `enforce` in both the Terraform local and `normalise_mode`, because a workspace still carrying that stored value had asked for *more* enforcement and must not silently get none.
 - Adding a package/tool has three possible homes, and picking the wrong one is a real mistake, not a style choice — route by the rule in [DESIGN.md](DESIGN.md#where-the-workspace-environment-comes-from): universal + stable → image (`Dockerfile`); occasionally-needed + apt-only + too heavy to bake in → the template's `system_packages` parameter; personal, fast-moving, or not an apt package → the operator's dotfiles (a *different* repo — see below), never this one.
 - `deployment.tf` mounts `/tmp` on its own ephemeral Longhorn volume, not the node's root filesystem and not the NFS-backed home PVC - see [DESIGN.md](DESIGN.md#design-tensions-and-decisions) for why both of those are wrong for it. Its lifecycle is per-Pod, the same as the `system` volume, so it is *not* wiped by a container-only restart within a live Pod - `script-container-entrypoint.sh` wipes it explicitly on every container start instead. Anything relying on `/tmp` persisting across a container restart was already wrong before this (the same was true for free when it was the container's writable overlay).
 - **The `/tmp` wipe belongs in the container entrypoint and nowhere later - this is a fixed regression, not a style preference.** The workspace container's `command` is `script-container-entrypoint.sh`, which wipes `/tmp` and then `exec`s Coder's generated `/workspace-init.sh`. That bootstrap unpacks the agent CLI into a per-boot `mktemp` directory under `/tmp`, chdirs into it, appends it to the PATH of every session and script the agent runs, and only then runs the agent startup script - so wiping `/tmp` from `script-agent-startup.sh` deletes the CLI the agent installed seconds earlier and every `coder stat` metadata panel reports `coder: command not found`. Do not "fix" a future collision here with an exclusion list: the agent's `/tmp` paths are version-dependent and not consistently prefixed (v2.35.3 owns `coder.XXXXXX/`, `coder-agent.sock`, `coder-agent*.log`, `coder-script-data/`, `coder-screen/` *and* `boundary-audit.sock`), so an allowlist rots silently. `script-agent-startup.sh` asserts the CLI resolves and runs, which is what makes a recurrence loud.
diff --git a/DESIGN.md b/DESIGN.md
index f3f8be88..1ac01538 100644
--- a/DESIGN.md
+++ b/DESIGN.md
@@ -79,17 +79,25 @@ The rule that ties the layers together: a package or tool belongs in the *lowest
 
 What a poll loop is good at is growth measured in MB per *minute*, and that drift is the real, daily problem: the operator was policing it by hand for months, repeatedly killing VS Code to save agent sessions, with a python MCP server holding 1.66 GB at one of the kills. So the watchdog now keeps the resting population of **restartable helpers** inside per-role budgets. The goal is runway rather than rescue: when a spike does arrive, it starts from as much free memory as the pod can offer. Every process it may signal has a supervisor — VS Code respawns its own forks and language servers, an agent session respawns its MCP servers — so a wrong kill costs a reload, not a session, and that asymmetry is what licenses being aggressive.
 
-That licence has a limit, and the limit is *calibration* rather than blast radius. Selection used to return `other` for any process in the server tree that no pattern named, and the policed set skipped `other` — so three genuine helpers, one of them holding 280 MB PSS, had no budget, no dwell clock and no warning attached to them. Widening the pattern list per extension is the easy answer and the wrong one: the launch shapes belong to the extensions, so the list is a permanent race that fails silently, one extension at a time. The default inside the tree is therefore inverted — unknown means governed — and the risk that creates is paid for explicitly rather than assumed away. An unnamed in-tree process gets the `treeHelper` role: measured, budgeted, dwell-tracked and reported in every mode, but signalled only under `enforce-all`, because its budget is a reasoned guess and no member of the role has been measured at rest, and this design has twice shipped a limit that sat below what a healthy process already held. Separately, a direct child of a server root is excluded from the role outright: VS Code's core forks are exactly those direct children, so a future release that renames `--type=extensionHost` produces a process that is unmanaged and conspicuous rather than one carrying a guessed 512 MiB budget against the 685 MB it actually holds.
+That licence has a limit, and the limit is *calibration* rather than blast radius. Selection used to return `other` for any process in the server tree that no pattern named, and the policed set skipped `other` — so three genuine helpers, one of them holding 280 MB PSS, had no budget, no dwell clock and no warning attached to them. Widening the pattern list per extension is the easy answer and the wrong one: the launch shapes belong to the extensions, so the list is a permanent race that fails silently, one extension at a time. The default inside the tree is therefore inverted — unknown means governed — and the risk that creates is paid for explicitly rather than assumed away. An unnamed in-tree process gets the `treeHelper` role: measured, budgeted, dwell-tracked and reported in every mode, and armed like every other role. It used to be armed only under `enforce-all`, because its budget was a reasoned guess and this design has twice shipped a limit that sat below what a healthy process already held; what pays for that risk now is the oversize rule below rather than an arming exception, which is a better instrument because it acts on the process actually running instead of on a class. Separately, a direct child of a server root is excluded from the role outright: VS Code's core forks are exactly those direct children, so a future release that renames `--type=extensionHost` produces a process that is unmanaged and conspicuous rather than one carrying a helper's share against the several times more it actually holds.
 
-**Budgets are per role and anchored on measurement, because a uniform number is wrong in both directions.** A *fresh* extension host is 471 MB PSS, so a single 512 MB budget would sit 40 MB above where it starts while being far too generous for a 34 MB file watcher. Fresh is also the wrong baseline: measured on a reconnected, idle 8 GiB workspace, the same extension host holds **713 MB** and the tree around it 1093 MB rather than the 727 MB originally cited. "Calibrated against fresh, deployed against resting" is precisely the error that produced a file-watcher ceiling below what an idle file watcher already held, so the reference for each role is now the largest figure measured at rest. Each role gets a budget clamped between a share of the pod's own `memory.max` and one-and-a-half times that reference, and the resting floor wins when they conflict — a budget below resting usage is not a conservative budget, it is a kill loop written down. On the 8 GiB pod the floor is what sets the extension host's budget at 1069 MiB rather than the 1024 MiB share, and the watchdog reports which budgets were lifted that way, because the floor winning is meant to say that the pod is too small to bound that role at the share it was intended to have. That reading is only true while every *declared* budget already clears its own resting floor, since only then can the pod share be the thing that pushed one below it — and for a while it was not true: the extension host's declared 1024 MiB sat below its own 1069 MiB floor, so the flag was set at 4, 8, 16 and 64 GiB alike and described the constants rather than the pod. The declared number is now the one that was always in force, which moved no effective budget at any pod size and gave the diagnostic back its meaning; the test suite asserts the invariant (no declared budget below its own floor) rather than the flag's value on one pod. The references themselves stay hand-measured on purpose: a watchdog that re-derived its floor from what it observed would raise the limit it is enforcing precisely when the thing it enforces against grew, which is the move the circuit breaker already refuses. The census publishes each role's peak instead, so a stale reference is something a human is told about rather than something the mechanism quietly accommodates. PSS is the quantity compared, not RSS and not `VmData`: `VmData` was only ever relevant because `RLIMIT_DATA` accounts it, and on a V8 process it runs an order of magnitude above what the pod actually pays.
+**The VS Code tree is given one 2048 MiB envelope, and every other number here is a share of it.** In one sentence: each role holds a named share that does not vary with pod size, and a process is killed when its PSS has been above its share for ten continuous minutes *and* it has been observed inside that share at some point since it started. The shares are `serverMain` 512 MiB, `extensionHost` 480, `tsserver` 320, `treeHelper` 320, `fileWatcher` 160, `languageServer` 128, `extensionHelper` 128 — 2048 exactly — with `claudeHelper` at 512 MiB deliberately outside the envelope, because an MCP server is not VS Code and its number is anchored on a measured *adversary* (the 1.66 GB python server this mechanism was built for) rather than on a share of anything. The largest share goes to `serverMain` by *consequence* rather than by size: it holds the remote connection, so a wrong kill costs a disconnect rather than a reload, and it should be the share least likely to be reached by accident. That the biggest share therefore goes to the role with the smallest measured appetite — 233 MB over 38 hours — is a real cost of roughly 280 MiB, paid on purpose. PSS is the quantity compared, not RSS and not `VmData`: `VmData` was only ever relevant because `RLIMIT_DATA` accounts it, and on a V8 process it runs an order of magnitude above what the pod actually pays.
 
-Two things then keep aggression from becoming harm. A process must be over budget **continuously for ten minutes** before anything happens to it, so a language server that balloons while indexing and hands the memory back is treated as load rather than drift. And a role that has to be killed three times inside an hour is not drifting — its budget is wrong for this workload — so the watchdog **disarms itself for that role**, logs why, and leaves the number to a human. It never widens its own budget: a mechanism that quietly raises the limit it enforces is a mechanism that has stopped enforcing. The kill loop, not the wrong kill, is the failure mode that would make this actively harmful, and it arrives looking exactly like the watchdog working.
+What this replaced was `max(min(role budget, memory.max / 8), resting × 1.5)` — three interacting terms, each patching the previous one's failure, and no term anywhere that bounded the total. Two of the three are gone rather than re-parameterised, and it is worth being explicit about what each was protecting against. The **`resting × 1.5` floor** existed so a budget could never land below what a process already held at rest, which is a real scar: this design twice shipped a limit below a running process's size, most memorably an `RLIMIT_DATA` ceiling below what an idle file watcher held. But a floor and an envelope are incompatible instruments — under a total, a process whose resting size does not fit means the process must be made smaller, whereas a floor says the budget must grow to meet it, and enough of those push the sum past the envelope. The **`memory.max / 8` divisor** scaled each role with the pod, so that a budget reasoned about for the 8 GiB workspace could not let one helper own a quarter of the 4 GiB one; it was never a bound on the total, and against a fixed envelope it means nothing. Its protection survives by construction instead of by arithmetic, because the largest single share is exactly an eighth of the smallest pod offered, and the test suite asserts that at every pod size rather than trusting the coincidence.
+
+**What replaced the floor is a rule about the process rather than about the role: nothing that has never fitted is ever signalled.** A process counts as having fitted only if it has been observed at or below its share while old enough to have finished starting up — without that age condition the classification would be decided by whether a sweep happened to catch it in the seconds after `exec`, when everything is small. A process that was inside its share and drifted out of it is killed, because restarting it demonstrably recovers the memory. A process that has been above its share for its whole observed life is recorded as `oversize` and left alone, because killing it accomplishes nothing: the replacement arrives over budget too, and that is a kill loop with a supervisor's restart in the middle of it. The report repeats once per dwell period, indefinitely — it cannot silence itself, it cannot widen a budget, and it re-arms by itself the moment a replacement is seen fitting. That is a better guard than the floor was, because it is measured on the process that is actually running rather than read from a hand-maintained constant that goes stale, and because it bounds nothing upward.
+
+**The extension host does not fit today, and that is designed for rather than reported.** It arrived at 610 MB PSS at eleven seconds old and settled at 577 MB before doing any work, against a 480 MiB share; no apportionment of 2048 MiB can both keep `serverMain` the largest share and clear 610 MB, which is arithmetic rather than a preference. So the envelope presupposes a tree that has been trimmed — capped launcher heaps and extensions moved to the client side, which happens in the operator's dotfiles — and this template can never depend on dotfiles having been applied, a coupling this repo pair has already been burned by. If the trim has not landed, that one role degrades to a repeating `event=oversize` line while the other six go on being enforced, and the line is exactly the evidence that it has not landed. `tsserver` is the same shape from the other end: it is launched with `--max-old-space-size=3072`, VS Code's shipped default, observed live on both instances in this pod, so without the same dotfiles cap its 320 MiB share means "report a healthy tsserver on a large project" rather than "bound it".
+
+**The envelope is enforced as an apportionment and measured as a total, and the difference matters.** Each share is compared against one process at a time, so a role with three members can hold three times its share without any single process being over budget. That hole is not fixed — a role-level total cannot say which sibling is the offender, and it does not compose with a dwell clock keyed per `pid:starttime` precisely so that load can be told from drift — but it is no longer invisible: the tree's total PSS is computed every sweep and published in the census as `tree_pss_mb` and `envelope_pct`, in the summary file, and in the `TOTAL` row of every sweep, so the envelope is a claim a reviewer can falsify from the log. Acting on the total is deliberately not attempted; that is the graded shedding ladder this design already removed, because a poll loop cannot see the events it was reacting to.
+
+**Two things then keep aggression from becoming harm, and one of them used to be a third.** A process must be over budget **continuously for ten minutes** before anything happens to it, so a language server that balloons while indexing and hands the memory back is treated as load rather than drift. Nothing that never fitted is signalled at all. What has *gone* is the circuit breaker: a role killed three times inside an hour used to disarm itself permanently. That inference was safe while budgets were per-role numbers reasoned about one at a time — repeated kills meant a wrong number — and it is not safe under a deliberate cap, where repeated kills can equally mean the process does not fit in the share the operator chose. A mechanism that switches itself off after three of those is inert by mid-morning, and it arrives looking exactly like the watchdog working: the failure the breaker was built to prevent, now caused by the breaker. The kill *loop* it guarded against is prevented structurally instead, because the replacement of a killed process arrives over budget and is `oversize`. What remains is a report — `event=kill-rate ... enforcing=yes` — which is a sizing signal for a human while enforcement continues. It still never widens its own budget: a mechanism that quietly raises the limit it enforces is a mechanism that has stopped enforcing.
 
 **What it may touch is decided structurally, and there are two populations rather than one.** Inside the VS Code tree, only a process whose own binary lives under `~/.vscode-server` counts as the editor's: a provisioned workspace carries two unrelated node installations — VS Code's bundled one and the operator's from mise — and a rule that asked "is this node" instead of "whose binary is this" would classify an agent session spawned by an extension as a sheddable helper. The second population is what an agent session spawned directly, chiefly MCP servers, which live nowhere near `~/.vscode-server` and which the tree-scoped selection could not see at all. That walk descends from each session root and stops at two boundaries: any shell or multiplexer, and any change of session id. The second is measured, not assumed — on the live workspace a session root has `sid` equal to its login shell's session while every Bash tool call has `pgid == sid == its own pid`, because Claude Code detaches each one — and it is what keeps an in-flight build out of the policed set even when the tool call's shell has exec'd itself away. Identity guards (`pid 1`, the agent, tmux, the session roots themselves, agent payloads, the watchdog's own kin) are absolute; the two *positional* rules — the pty host's subtree, and "does not run VS Code's binary" — bound the editor selection only, so that an MCP server is treated the same whether its session was started with `coder ssh` or in a VS Code terminal.
 
 **It records every sweep, and that is a deliverable rather than decoration.** Each per-process sweep is appended to a rotating local log with role, PSS, RSS, age, budget, how long the process has been over it, which guard claimed it, and a stable identity breadcrumb — the MCP server's module name rather than `python3` — with secrets in argv redacted at the point of writing. Processes it does *not* manage are recorded too, because on the evidence of every OOM in this investigation that is where the memory actually was. The previous version computed this table on every cycle and discarded it, which is why every post-mortem here has been unanswerable.
 
-**Its actions also leave the pod, at no cost.** The cluster's log agent tails container stdout and nothing else, so no file here can reach Loki — but PID 1 in this container is the coder agent, which makes `/proc/1/fd/1` the container's stdout. Writing action lines there needs no new infrastructure and no configuration anywhere, and they arrive already labelled by namespace, pod and container. Only actions go that way — kills, refusals, disarms, the budgets in force, and one census line an hour; the sweep is dozens of rows a minute and stays local, which is a limit worth defending rather than a temporary compromise. Every line is logfmt beginning with `component=memory-watchdog`, so a LogQL line filter and the `logfmt` parser both work on it without anyone adding a stream label to a chatty stream, and free text is quoted at the point of writing so a sentence cannot parse into five bogus fields. The write is best-effort in both directions: a fd that cannot be written disables the path, says so once locally, and changes nothing else, because a watchdog that died because logging failed would be a worse bug than any it prevents. Observe mode emits what it *would* have done, which is the evidence anyone needs before arming this on a live workspace.
+**Its actions also leave the pod, at no cost.** The cluster's log agent tails container stdout and nothing else, so no file here can reach Loki — but PID 1 in this container is the coder agent, which makes `/proc/1/fd/1` the container's stdout. Writing action lines there needs no new infrastructure and no configuration anywhere, and they arrive already labelled by namespace, pod and container. Only actions go that way — kills, refusals, oversize reports, kill-rate reports, the shares in force, and one census line an hour; the sweep is dozens of rows a minute and stays local, which is a limit worth defending rather than a temporary compromise. Every line is logfmt beginning with `component=memory-watchdog`, so a LogQL line filter and the `logfmt` parser both work on it without anyone adding a stream label to a chatty stream, and free text is quoted at the point of writing so a sentence cannot parse into five bogus fields. The write is best-effort in both directions: a fd that cannot be written disables the path, says so once locally, and changes nothing else, because a watchdog that died because logging failed would be a worse bug than any it prevents. Observe mode emits what it *would* have done, which is the evidence anyone needs before arming this on a live workspace.
 
 The trade is unchanged in shape: this is a userspace daemon in a pod with no supervisor, doing crudely what the kernel would do properly if it were allowed to, and it is built to be deleted in one step if that ever changes. It measures deliberately against every stock reading, including Coder's own — page cache and reclaimable slab make this pod look near death while it is idle — so the honest number is published beside the misleading one in the workspace UI rather than replacing it, next to the largest helper as a share of its budget. What remains unaddressed is the acute spike, and honestly so: that is the kernel's job, and with `singleProcessOOMKill` now set at the kubelet it does it properly — the runaway dies and the container survives. Runway is the second line of defence, not the first, and it is the line that matters if the first is ever lost: that kubelet setting is hand-applied node state rather than code, and if a rebuild or the Talos migration drops it the blast radius silently returns to all-or-nothing with nothing to say why.
 
diff --git a/TESTING.md b/TESTING.md
index 4cb1fdbe..8ef75958 100644
--- a/TESTING.md
+++ b/TESTING.md
@@ -28,13 +28,13 @@ Because all three stages run for real in dry-run — just scoped away from produ
 Everything else here is declarative and is covered by the stages above. `script-memory-watchdog.sh` decides at runtime whether to kill a process, so it gets two things neither lint nor a template push can provide:
 
 - **Fixtures** — `./templates/kubernetes/homelab-workspace/script-memory-watchdog-test.sh`, also run by the `watchdog` job in `.github/workflows/test.yaml`. The suite is built around negative assertions paired with the mutation that must flip them: "it did not kill the agent session" proves nothing unless removing one rule makes it kill the agent session. Two of its own safety properties matter as much as its assertions: `kill` is shadowed by a function throughout, because the fixture pids name real processes in whatever container runs the suite; and every load of the watchdog redirects its stdout emission to a temporary file, with the suite exiting outright if that seam did not take — the real default is the container's own stdout, and a run without the seam has already put fixture kill lines into a live workspace's log stream.
-- **A live drill on a disposable `test_mode` workspace**, which has disposable storage and can be wrecked freely. Fixtures cannot answer whether a real process tree classifies correctly, whether a supervisor really does respawn what was killed, or whether the circuit breaker stops a loop rather than joining it. The drill that has been run: a stand-in session root (`exec -a claude bash`, to exercise the shebang branch of the claude-root guard rather than the trivial compiled-binary one) with an over-budget helper that a supervisor respawns, a second helper inside its budget, and a process detached into its own session with `setsid` — the same mechanism Claude Code uses to detach a Bash tool call — larger than both.
+- **A live drill on a disposable `test_mode` workspace**, which has disposable storage and can be wrecked freely. Fixtures cannot answer whether a real process tree classifies correctly, whether a supervisor really does respawn what was killed, or whether the respawned process comes back inside its share (a drift the watchdog should keep policing) or above it (an `oversize` it should report and leave alone). The drill that has been run: a stand-in session root (`exec -a claude bash`, to exercise the shebang branch of the claude-root guard rather than the trivial compiled-binary one) with an over-budget helper that a supervisor respawns, a second helper inside its budget, and a process detached into its own session with `setsid` — the same mechanism Claude Code uses to detach a Bash tool call — larger than both.
 
 Neither replaces the other, and the live one is where every defect that mattered in this component has been found.
 
 ### What the most recent drill actually observed
 
-Run 2026-08-21 on a disposable `watchdog-drill` workspace, `enforce` mode, with every threshold compressed and wall-clock arithmetic left real (`WATCHDOG_NOW` was never set): dwell 600→20s, age floor 300→45s, kill grace 30→8s, breaker window 3600→180s, sweep cadence ~60→~3s, `WATCHDOG_BUDGET_claudeHelper` pinned 512→100 MiB. The code paths and the arithmetic are the production ones; production *timings* were never waited out, which is what compressing them costs. The synthetic workload was compiled C — no `python3` or `node` exists on `PATH` in a fresh workspace without dotfiles applied, itself worth knowing.
+Run 2026-08-21 on a disposable `watchdog-drill` workspace, `enforce` mode, **against the pre-envelope construction** — per-role budgets clamped by `memory.max / 8` and a resting floor, with a circuit breaker that disarmed a role permanently. Everything below is what was observed then and is left as the record. Two things in it no longer exist: `event=disarmed` (the breaker now reports `event=kill-rate ... enforcing=yes` and disarms nothing), and the compressed `breaker window` is now only the window that report is rated over. The kills themselves would still happen — the hog was respawned inside its pinned budget each time and drifted out of it, which is the drift case, not the `oversize` one. It was run with every threshold compressed and wall-clock arithmetic left real (`WATCHDOG_NOW` was never set): dwell 600→20s, age floor 300→45s, kill grace 30→8s, breaker window 3600→180s, sweep cadence ~60→~3s, `WATCHDOG_BUDGET_claudeHelper` pinned 512→100 MiB. The code paths and the arithmetic are the production ones; production *timings* were never waited out, which is what compressing them costs. The synthetic workload was compiled C — no `python3` or `node` exists on `PATH` in a fresh workspace without dotfiles applied, itself worth knowing.
 
 The daemon's own `actions.log` for the drill, re-fetched from Loki afterward and matched byte-for-byte against the pod's local copy:
 
@@ -46,7 +46,7 @@ event=kill sig=KILL pid=<p2> role=claudeHelper id=hog pss_mb=150 budget_mb=100 o
 event=disarmed role=claudeHelper reason=kill-loop kills=3 window_s=180 budget_mb=100 detail="a role that has to be killed this often does not have a drift problem, it has a wrong budget; raise WATCHDOG_BUDGET_claudeHelper or accept the size, but this watchdog will not keep restarting it"
 ```
 
-The two kills are gated by two different rules, not the same one twice: the first fired at `over_s=22` against a 20s dwell — one sweep late, proportional to the ~3s cadence, i.e. dwell-bound. The second's dwell was satisfied around `over_s≈20`, but the kill waited for `age_s` to clear its 45s floor, so `over_s` kept climbing to 43 before it fired — age-bound. A third respawn (not shown above) supplied the kill that tripped the breaker.
+The two kills are gated by two different rules, not the same one twice: the first fired at `over_s=22` against a 20s dwell — one sweep late, proportional to the ~3s cadence, i.e. dwell-bound. The second's dwell was satisfied around `over_s≈20`, but the kill waited for `age_s` to clear its 45s floor, so `over_s` kept climbing to 43 before it fired — age-bound. A third respawn (not shown above) supplied the kill that tripped the breaker; under the current construction that same kill produces an `event=kill-rate` line and enforcement continues.
 
 `sweep.log` also confirms a dip resets the dwell clock rather than just capping it, in consecutive rows for the same pid:
 
@@ -61,7 +61,7 @@ Not exercised by this drill, and not claimed to be: production timings (everythi
 
 ### Checking a claim like this against the record
 
-An `event=kill`/`event=disarmed` line, unlike the sweep log, does leave the pod (see [DESIGN.md](DESIGN.md#design-tensions-and-decisions)), so a claim like the one above is checkable: `{namespace="coder"} |= "component=memory-watchdog" |~ "event=(kill|would-kill|refused|disarmed)"` against Loki finds exactly the six lines quoted above, timestamped and labelled with the `watchdog-drill` pod.
+An `event=kill`/`event=oversize` line, unlike the sweep log, does leave the pod (see [DESIGN.md](DESIGN.md#design-tensions-and-decisions)), so a claim like the one above is checkable: `{namespace="coder"} |= "component=memory-watchdog" |~ "event=(kill|would-kill|oversize|refused|kill-rate)"` against Loki finds exactly the six lines quoted above, timestamped and labelled with the `watchdog-drill` pod.
 
 The same query, run over the full retained history, is also what falsifies a different claim: PR [#865](https://github.com/ppat/coder/pull/865) (merged 2026-08-18), which introduced this drill practice, described one run in its body as killing "a drifted 739 MB helper... three times" with the role disarming "on the third kill," and stated "the daemon's own lines from the test workspace are in Loki." Neither `event=kill` nor `event=disarmed` nor the string `739` appears anywhere in the retained record for any workspace at any time before this run. The only kill/disarm lines anywhere near that PR's merge time are on the operator's live workspace at 2026-08-18T01:01–01:08, and the daemon logged its own correction for them at the time: `event=note reason=fixture-leak`, naming fixture pids 41/61 at 1907/1583 MB — the same incident this repo's docs already describe as the fixture suite's stdout seam leaking into production before it was guarded. No `event=kill` or `event=disarmed` line from a workspace named `test` exists in the record at all. `event=budget role=extensionHost budget_mb=1069 pod_share_mb=512 floored=1` — the figures the PR body also cites as drill evidence — is not distinguishing evidence either: every disposable `test_mode` workspace since has printed exactly that line at startup, regardless of whether anything was ever killed, because `floored=1` was a constant at that pod size — the bug PR #881 fixes.
 
diff --git a/templates/kubernetes/homelab-workspace/env.tf b/templates/kubernetes/homelab-workspace/env.tf
index d722adf7..1cacb101 100644
--- a/templates/kubernetes/homelab-workspace/env.tf
+++ b/templates/kubernetes/homelab-workspace/env.tf
@@ -5,15 +5,16 @@ resource "coder_env" "welcome_message" {
 }
 
 # The switch that arms the memory watchdog. "observe" measures and records what
-# it would have done; "enforce" kills helpers that have been over budget for ten
-# minutes; "enforce-all" adds the two editor roles whose restart the operator can
-# see.
+# it would have done; "enforce" kills any process that has been over its share of
+# the 2048 MiB VS Code envelope for ten minutes and had previously been seen
+# inside it.
 #
 # Set from a mutable workspace parameter rather than hardcoded here, because it
 # is the one control that decides whether the watchdog may signal anything, and
 # because turning it off has to be a parameter change rather than a code change
-# on a bad day. The budgets themselves are derived from the pod's own memory.max,
-# so this value does not have to be reconsidered per pod size.
+# on a bad day. The shares are constants that add up to the envelope and do not
+# vary with pod size, so this value does not have to be reconsidered per pod
+# size either.
 resource "coder_env" "memory_watchdog_mode" {
   agent_id = coder_agent.main.id
   name     = "WATCHDOG_MODE"
diff --git a/templates/kubernetes/homelab-workspace/parameters.tf b/templates/kubernetes/homelab-workspace/parameters.tf
index 58729621..1f0c07eb 100644
--- a/templates/kubernetes/homelab-workspace/parameters.tf
+++ b/templates/kubernetes/homelab-workspace/parameters.tf
@@ -33,24 +33,19 @@ data "coder_parameter" "memory_watchdog_mode" {
 
   default      = "enforce"
   display_name = "Memory Watchdog"
-  description  = "What the memory watchdog may do about a helper process that has been over its budget for ten minutes"
+  description  = "What the memory watchdog may do about a process that has been over its share of the 2048 MiB VS Code envelope for ten minutes"
   icon         = "/icon/memory.svg"
   mutable      = true
 
   option {
     name        = "Observe only"
     value       = "observe"
-    description = "Measure, record every sweep, and log the kill it would have made. Sends no signals"
+    description = "Measure, record every sweep, and log the action it would have taken. Sends no signals"
   }
   option {
-    name        = "Enforce (helpers)"
+    name        = "Enforce"
     value       = "enforce"
-    description = "Also kill drifted helpers: language servers, the file watcher, native extension helpers, and MCP servers an agent session spawned. Each restarts invisibly"
-  }
-  option {
-    name        = "Enforce (helpers and editor)"
-    value       = "enforce-all"
-    description = "Also kill the VS Code extension host and server. These restart visibly, so they are armed separately"
+    description = "Also kill drifted processes, in every role. A process that has never fitted its share is reported rather than killed, so nothing is restarted on a loop"
   }
 }
 
@@ -62,9 +57,19 @@ locals {
   # So it goes through the same validate-then-use step as the list parameters
   # below, and anything unrecognised falls back to the inert mode rather than to
   # whatever was supplied.
-  validated_watchdog_mode = contains(
-    ["observe", "enforce", "enforce-all"], data.coder_parameter.memory_watchdog_mode.value
-  ) ? data.coder_parameter.memory_watchdog_mode.value : "observe"
+  #
+  # "enforce-all" is the retired third mode: under a fixed envelope every role is
+  # armed, so there is no superset left for it to name. A workspace still
+  # carrying the stored value is mapped to "enforce" rather than dropped to
+  # "observe", because it had asked for more enforcement and must not silently
+  # get none.
+  validated_watchdog_mode = (
+    data.coder_parameter.memory_watchdog_mode.value == "enforce-all" ? "enforce" : (
+      contains(
+        ["observe", "enforce"], data.coder_parameter.memory_watchdog_mode.value
+      ) ? data.coder_parameter.memory_watchdog_mode.value : "observe"
+    )
+  )
 
   validated_preferred_nodes = (data.coder_parameter.preferred_nodes.value != "") ? [
     for str in jsondecode(data.coder_parameter.preferred_nodes.value) :
diff --git a/templates/kubernetes/homelab-workspace/script-memory-watchdog-test.sh b/templates/kubernetes/homelab-workspace/script-memory-watchdog-test.sh
index 12bd9ac8..84c53a68 100755
--- a/templates/kubernetes/homelab-workspace/script-memory-watchdog-test.sh
+++ b/templates/kubernetes/homelab-workspace/script-memory-watchdog-test.sh
@@ -210,6 +210,14 @@ write_uptime() {
 # workspace with a VS Code server attached, and extended with the second
 # population this watchdog now polices: the helpers an agent session spawns.
 #
+# The PSS figures are the maxima the watchdog's own sweep log recorded for each
+# role over ~38 hours on that workspace, not sizes invented to make a test pass.
+# One of them matters more than the rest: the extension host is written at the
+# 738 MB it actually reached, which is *above* its 480 MiB share of the envelope,
+# because that is the real situation this design has to survive. In the fixture
+# as in the pod it is therefore classified oversize and never signalled - which
+# is also what keeps every kill assertion below about exactly one process.
+#
 # The `comm` values are load-bearing. Every node process in a real server tree
 # reports MainThread, because V8 renames its main thread with prctl(PR_SET_NAME).
 # An earlier version of this fixture wrote `node`, and that one wrong string hid
@@ -278,16 +286,16 @@ build_tree() {
   add_proc "$dir" 34 32 sh 3000000 sh "${sdir}/bin/code-server" \
     --connection-token=remotessh --start-server --enable-remote-auto-shutdown
 
-  add_proc "$dir" 40 34 "$nc" 300000000 "${sdir}/node" "$srv" \
+  add_proc "$dir" 40 34 "$nc" 233000000 "${sdir}/node" "$srv" \
     --connection-token=remotessh --start-server --enable-remote-auto-shutdown
-  add_proc "$dir" 41 40 "$nc" 500000000 "${sdir}/node" \
+  add_proc "$dir" 41 40 "$nc" 738000000 "${sdir}/node" \
     --dns-result-order=ipv4first "${sdir}/out/bootstrap-fork" \
     --type=extensionHost --transformURIs --useHostProxy=false
-  add_proc "$dir" 44 41 "$nc" 400000000 "${sdir}/node" \
+  add_proc "$dir" 44 41 "$nc" 208000000 "${sdir}/node" \
     "${ext}/ms-vscode.typescript/lib/tsserver.js" --useInferredProjectPerProjectRoot
-  add_proc "$dir" 45 41 "$nc" 120000000 "${sdir}/node" \
+  add_proc "$dir" 45 41 "$nc" 31000000 "${sdir}/node" \
     "${ext}/redhat.vscode-yaml-1.24.0/dist/languageserver.js" --node-ipc --clientProcessId=41
-  add_proc "$dir" 46 41 terraform-ls 300000000 \
+  add_proc "$dir" 46 41 terraform-ls 24000000 \
     "${ext}/hashicorp.terraform-2.40.0-linux-x64/bin/terraform-ls" serve
   # Two processes the extension host spawned that run the *operator's* node, not
   # VS Code's. There is no /usr/bin/node and nothing named node on PATH in this
@@ -330,7 +338,7 @@ build_tree() {
   add_proc "$dir" 49 40 "$nc" 200000000 "${sdir}/node" \
     "${sdir}/out/bootstrap-fork" --type=sharedProcess
 
-  add_proc "$dir" 42 40 "$nc" 40000000 "${sdir}/node" \
+  add_proc "$dir" 42 40 "$nc" 107000000 "${sdir}/node" \
     "${sdir}/out/bootstrap-fork" --type=fileWatcher
   add_proc "$dir" 43 40 "$nc" 100000000 "${sdir}/node" \
     "${sdir}/out/bootstrap-fork" "$ptyhost_arg" --logsPath "${vsc}/data/logs/20260816T162519"
@@ -419,11 +427,11 @@ load_watchdog() {
   fi
   mkdir -p "${WORK}/state"
   SIGNALS=""
-  # Budgets are derived from memory.max on the first cycle rather than being
-  # constants, so a harness that skipped this would be testing a watchdog with no
-  # budgets at all - which is not a state the real thing is ever in, and which
-  # silently passes any assertion about not killing anything.
-  read_cgroup_memory && derive_budgets "$M_MAX"
+  # Budgets are installed on the first cycle rather than at source time, so a
+  # harness that skipped this would be testing a watchdog with no budgets at all
+  # - which is not a state the real thing is ever in, and which silently passes
+  # any assertion about not killing anything.
+  read_cgroup_memory && derive_budgets
   read_cgroup_pressure
 }
 
@@ -498,16 +506,16 @@ test_measurement() {
   set_pss "$pdir" 41 123456789
   read_usage 41
   assert_eq 123456512 "${P_PSS[41]}" "PSS is read from smaps_rollup"
-  assert_eq 499998720 "${P_RSS[41]}" "and RSS separately from statm"
+  assert_eq 737996800 "${P_RSS[41]}" "and RSS separately from statm"
   assert_eq 0 "$PSS_UNAVAILABLE" "with PSS available, nothing is flagged"
 
   # And the fallback, which must be visible rather than silent: RSS is the larger
   # number, so substituting it quietly would make every budget look tighter.
   rm -f "${pdir}/41/smaps_rollup"
   read_usage 41
-  assert_eq 499998720 "${P_PSS[41]}" "without smaps_rollup, RSS stands in"
+  assert_eq 737996800 "${P_PSS[41]}" "without smaps_rollup, RSS stands in"
   assert_eq 1 "$PSS_UNAVAILABLE" "and the substitution is recorded, not hidden"
-  set_pss "$pdir" 41 500000000
+  set_pss "$pdir" 41 738000000
 }
 
 # --------------------------------------------------------------------------- #
@@ -958,19 +966,21 @@ test_tree_helpers() {
   assert_eq "typescript/typingsInstaller" "$(identity_of 57 treeHelper)" \
     "and node_modules is skipped for the name that means something"
 
-  # Never armed by the mode the template actually runs. The budget is a guess and
-  # the design's own history is a guessed limit that landed below what a healthy
-  # process already held, so a coverage gap surfaces as a log line first.
+  # This role used to be armed only under enforce-all, because its budget was a
+  # guess and this design has twice shipped a limit below what a healthy process
+  # already held. It now holds a named share of the envelope like every other
+  # role and is armed like every other role; what protects a tree helper whose
+  # legitimate size is larger than its share is the oversize rule, not an arming
+  # exception. See section 3b.
   # shellcheck disable=SC2034  # MODE is a global of the sourced watchdog
   MODE=observe
   assert_armed treeHelper no "observe arms nothing, tree helpers included"
   # shellcheck disable=SC2034
   MODE=enforce
-  assert_armed treeHelper no "enforce reports tree helpers and does not signal them"
-  assert_armed extensionHelper yes "while a role with a measured resting size is armed"
-  # shellcheck disable=SC2034
-  MODE=enforce-all
-  assert_armed treeHelper yes "enforce-all arms them, which is where the operator opts in"
+  assert_armed treeHelper yes "enforce arms tree helpers like everything else"
+  assert_armed extensionHelper yes "and native extension helpers"
+  assert_armed extensionHost yes "and the extension host"
+  assert_armed serverMain yes "and the process holding the remote connection"
   # shellcheck disable=SC2034
   MODE=observe
 
@@ -1023,187 +1033,360 @@ test_tree_helpers() {
   unset 'P_PPID[9003]' 'P_ARGV0[9003]' 'P_CMD[9003]'
 }
 
-# What the two modes actually do to a drifted tree helper, end to end, because
-# "not armed" is a claim about behaviour and not about a string.
+# What enforce actually does to a drifted tree helper, end to end, because
+# "armed" is a claim about behaviour and not about a string. This is the class of
+# process the whole inverted default exists for: a helper no pattern names,
+# holding 280 MB on the live tree, which used to be invisible and then for a
+# while was visible but unenforceable.
 test_tree_helper_arming_is_end_to_end() {
-  printf 'a drifted tree helper: reported under enforce, killed under enforce-all\n'
+  printf 'a drifted tree helper is killed under enforce\n'
   write_cgroup "${WORK}/cg" 8589934592 0.00
   local pdir="${WORK}/proc2g"
   build_tree "$pdir"
 
   rm -rf "${WORK}/state"
   load_watchdog "${WORK}/cg" "$pdir" enforce
-  set_pss "$pdir" 56 700000000
+  # 287 MB is what this process was measured at, and it is inside the 320 MiB
+  # share - so the fixture starts it fitting, and then drifts it out.
   sweep_at 1000
-  sweep_at $((1000 + DWELL_SECONDS))
-  # Targeted rather than "SIGNALS is empty": the fixture's MCP server is over
-  # budget in an armed role in this same sweep, and an assertion that the whole
-  # run signalled nothing would be asserting that enforce mode is broken.
-  assert_absent "$SIGNALS" ":56" "enforce signals nothing, however far a tree helper has drifted"
-  assert_contains "$(cat "${WORK}/state/actions.log")" \
-    "event=would-kill armed=no pid=56 role=treeHelper" \
-    "but says exactly what it would have done, with the identity to act on"
+  set_pss "$pdir" 56 700000000
+  sweep_at 1060
+  sweep_at $((1060 + DWELL_SECONDS))
+  assert_contains "$SIGNALS" "TERM:56" "a tree helper that drifted out of its share is shed"
+  assert_absent "$SIGNALS" ":49" "and the unrecognised core fork is still never touched"
+  assert_absent "$SIGNALS" ":41" \
+    "nor the extension host, which never fitted and is therefore reported instead"
+
   # And the per-process record carries it as a budgeted role rather than as one
-  # of the `unmanaged` rows it used to be lost among. 524288 kB is the 512 MiB
-  # budget in the sweep log's units.
+  # of the `unmanaged` rows it used to be lost among. 327680 kB is the 320 MiB
+  # share in the sweep log's units.
   local latest
   latest="$(cat "${WORK}/state/sweep.latest")"
   assert_contains "$latest" "treeHelper" "the sweep log records the role"
-  assert_contains "$latest" "524288" "with the budget it is being held to"
+  assert_contains "$latest" "327680" "with the share it is being held to"
 
+  # Observe mode still only reports, for this role as for every other.
+  SIGNALS=""
   rm -rf "${WORK}/state"
-  load_watchdog "${WORK}/cg" "$pdir" enforce-all
-  set_pss "$pdir" 56 700000000
+  load_watchdog "${WORK}/cg" "$pdir" observe
+  set_pss "$pdir" 56 287000000
   sweep_at 2000
-  sweep_at $((2000 + DWELL_SECONDS))
-  assert_contains "$SIGNALS" "TERM:56" "enforce-all is where a tree helper is actually shed"
-  assert_absent "$SIGNALS" ":49" "and the unrecognised core fork is still never touched"
-  assert_absent "$SIGNALS" ":41" "nor the extension host, by a helper's budget or any other"
+  set_pss "$pdir" 56 700000000
+  sweep_at 2060
+  sweep_at $((2060 + DWELL_SECONDS))
+  assert_absent "$SIGNALS" ":56" "observe mode signals no tree helper"
+  assert_contains "$(cat "${WORK}/state/actions.log")" \
+    "event=would-kill armed=no pid=56 role=treeHelper" \
+    "but says exactly what it would have done, with the identity to act on"
+  set_pss "$pdir" 56 287000000
 }
 
 # --------------------------------------------------------------------------- #
-# 3. the budgets
+# 3. the envelope and its shares
 #
-# The failure this section exists to prevent has happened twice in this design,
-# both times the same way: a limit derived from the pod that sat below what the
-# process already held at rest. In observe mode that is a log line; in enforce
-# mode it is a process that dies on its next allocation, restarts, and dies
-# again. So the properties asserted here are about the *relationship* between a
-# budget and the measured resting size of the role, not about the arithmetic.
+# The construction under test is one sentence: the VS Code tree gets a fixed
+# 2048 MiB envelope, each role holds a named share of it that does not vary with
+# pod size, and everything with a budget is armed under enforce.
+#
+# So the assertions here are *properties*, not one pod's arithmetic. The three
+# terms this replaced - a per-role constant, a memory.max/8 share and a
+# resting x 1.5 floor - could each be checked on the 8 GiB pod and pass while the
+# total was unbounded, which is how a design with no bound on the sum passed a
+# budget suite twice.
 # --------------------------------------------------------------------------- #
 
+POD_SIZES="2147483648 4294967296 8589934592 17179869184 68719476736"
+
 budgets_at() {
   BUDGET=()
-  derive_budgets "$1"
+  derive_budgets
 }
 
-test_budgets() {
-  printf 'budgets\n'
+test_envelope() {
+  printf 'the envelope\n'
   write_cgroup "${WORK}/cg" 8589934592 0.00
   load_watchdog "${WORK}/cg" "${WORK}/proc2"
 
-  # 8 GiB: the pod the roles were measured on. The operator's 512 MiB instinct
-  # applies unchanged to the helpers. The extension host does not get it, and
-  # does not even get the pod share: measured at rest on a reconnected, idle
-  # 8 GiB workspace it holds 713 MB, so the resting floor lifts it above the
-  # 1024 MiB share. That is the correction this table exists to survive - the
-  # first version of these numbers was calibrated against a *fresh* tree, where
-  # the same process is 471 MB.
-  budgets_at 8589934592
-  assert_eq 1121452032 "${BUDGET[extensionHost]}" \
-    "8 GiB: the extension host is lifted above the pod share by its resting size"
-  assert_eq 1 "${FLOORED[extensionHost]}" "and that lift is recorded, not silent"
-  assert_eq 536870912 "${BUDGET[serverMain]}" "8 GiB: serverMain gets 512 MiB"
-  assert_eq 268435456 "${BUDGET[fileWatcher]}" "8 GiB: the file watcher gets 256 MiB"
-  assert_eq "" "${FLOORED[fileWatcher]:-}" "and is not floored - 88 MB resting is well under it"
-  assert_eq 536870912 "${BUDGET[claudeHelper]}" "8 GiB: an MCP server gets 512 MiB"
-
-  # FLOORED is documented as a diagnostic - "this pod is too small to bound this
-  # role at the share it was meant to have" - and that reading only holds while
-  # every declared budget already clears its own resting floor, because then the
-  # pod share is the only thing that can push one below it. It did not hold:
-  # extensionHost's declared 1024 MiB sat below its own 1069 MiB floor, so the
-  # flag was true at 4, 8, 16 and 64 GiB alike and reported a property of the
-  # constants while claiming to report a property of the pod.
-  #
-  # This asserts the invariant rather than the flag, because the invariant is
-  # what makes the flag mean anything. A future budget lowered below its role's
-  # resting floor - the exact edit this design has made wrongly twice - fails
-  # here rather than quietly turning a diagnostic into a constant.
-  local r floor
-  for r in "${!BUDGET_ROLE[@]}"; do
-    floor=$(((${RESTING_ROLE[$r]:-0} * RESTING_FACTOR_NUM) / RESTING_FACTOR_DEN))
-    # shellcheck disable=SC2004
-    # The $ is NOT unnecessary: BUDGET_ROLE is associative, so inside (( )) the
-    # subscript is a string, and dropping it looks up the literal key "r" and
-    # silently reads 0 - which would make this assertion pass for every role.
-    if ((BUDGET_ROLE[$r] >= floor)); then
-      ok "the declared ${r} budget already clears its own resting floor"
-    else
-      bad "the declared ${r} budget (${BUDGET_ROLE[$r]}) is below its resting floor (${floor}): FLOORED stops being a pod-size diagnostic"
-    fi
+  # The apportionment, named. These are the numbers a reviewer is arguing with,
+  # so they are asserted individually rather than only as a sum: a change to one
+  # of them should have to be made here as well as in the script.
+  budgets_at
+  assert_eq 536870912 "${BUDGET[serverMain]}" "serverMain holds 512 MiB"
+  assert_eq 503316480 "${BUDGET[extensionHost]}" "the extension host holds 480 MiB"
+  assert_eq 335544320 "${BUDGET[tsserver]}" "tsserver holds 320 MiB"
+  assert_eq 335544320 "${BUDGET[treeHelper]}" "a tree helper holds 320 MiB"
+  assert_eq 167772160 "${BUDGET[fileWatcher]}" "the file watcher holds 160 MiB"
+  assert_eq 134217728 "${BUDGET[languageServer]}" "a language server holds 128 MiB"
+  assert_eq 134217728 "${BUDGET[extensionHelper]}" "an extension helper holds 128 MiB"
+  assert_eq 536870912 "${BUDGET[claudeHelper]}" "an MCP server holds 512 MiB, outside the envelope"
+
+  # Property 1: the shares add up to the envelope, at every pod size. This is the
+  # assertion the old construction could not have had - min(x, memory.max/8) and
+  # a resting floor have no sum to check. Mutation: change any single share, or
+  # reintroduce a term that scales one with the pod, and this goes red at some
+  # pod size.
+  local m total role
+  for m in $POD_SIZES; do
+    write_cgroup "${WORK}/cg" "$m" 0.00
+    read_cgroup_memory
+    budgets_at
+    total=$(envelope_in_force)
+    assert_eq "$ENVELOPE" "$total" "memory.max=${m}: the shares in force add up to the envelope"
   done
 
-  # And so the flag now varies with the pod, which is the whole claim.
-  budgets_at 17179869184
-  assert_eq "" "${FLOORED[extensionHost]:-}" \
-    "16 GiB: the extension host is not floored - the pod can afford its share"
-  # ...while moving no budget at all. This change repaired a diagnostic; if it
-  # had also changed what gets killed, that would be a separate decision.
-  assert_eq 1121452032 "${BUDGET[extensionHost]}" \
-    "16 GiB: and its budget is the same number it has always been in force"
-
-  # 4 GiB: the pod share is 512 MiB, far below what the extension host holds at
-  # rest. The floor overrides it rather than issuing a standing kill order.
-  budgets_at 4294967296
-  assert_eq 1121452032 "${BUDGET[extensionHost]}" \
-    "4 GiB: the resting floor overrides the pod share for the extension host"
-  assert_eq 268435456 "${BUDGET[fileWatcher]}" "4 GiB: the file watcher is unaffected"
-
-  # The property that matters more than any of the numbers: no budget may sit
-  # below the size the role was measured at while idle, at any pod size, ever.
-  local m r
-  for m in 2147483648 4294967296 8589934592; do
-    budgets_at $m
-    for r in "${!RESTING_ROLE[@]}"; do
+  # Property 2: and they are the *same* shares at every pod size. Summing to the
+  # envelope is not enough on its own - two roles could trade with each other as
+  # the pod changed and still sum correctly.
+  local -A at8=()
+  write_cgroup "${WORK}/cg" 8589934592 0.00
+  read_cgroup_memory
+  budgets_at
+  for role in "${!BUDGET[@]}"; do at8[$role]=${BUDGET[$role]}; done
+  for m in $POD_SIZES; do
+    write_cgroup "${WORK}/cg" "$m" 0.00
+    read_cgroup_memory
+    budgets_at
+    for role in "${!BUDGET[@]}"; do
       # shellcheck disable=SC2004
-      # The $ is NOT unnecessary here: these are associative arrays, whose
-      # subscripts are strings inside (( )), so dropping it looks up the literal
-      # key "r" and silently reads 0. That defect shipped once already.
-      if ((BUDGET[$r] > RESTING_ROLE[$r])); then
-        ok "memory.max=${m}: ${r} is budgeted above its resting size"
+      # The $ is NOT unnecessary: these are associative arrays, so inside (( ))
+      # the subscript is a string. Dropping it looks up the literal key "role"
+      # and silently reads 0, which would make this pass for every role.
+      if ((BUDGET[$role] == at8[$role])); then
+        ok "memory.max=${m}: the ${role} share is the same number it is on any other pod"
       else
-        bad "memory.max=${m}: ${r} budget ${BUDGET[$r]} is at or below resting ${RESTING_ROLE[$r]}"
+        bad "memory.max=${m}: the ${role} share moved with the pod (${BUDGET[$role]} vs ${at8[$role]})"
       fi
     done
   done
+  write_cgroup "${WORK}/cg" 8589934592 0.00
+  read_cgroup_memory
+  budgets_at
+
+  # Property 3: what the removed memory.max/8 divisor was protecting against - a
+  # budget reasoned about for the large pod letting one role own a quarter of the
+  # small one - still holds, now by construction rather than by arithmetic. The
+  # smallest pod this template offers is 4 GiB.
+  local smallest=4294967296
+  for role in "${!BUDGET[@]}"; do
+    # shellcheck disable=SC2004
+    # The $ is NOT unnecessary: BUDGET is associative, so inside (( )) the
+    # subscript is a string, and dropping it looks up the literal key "role" and
+    # silently reads 0 - which would make this assertion pass for every role.
+    if ((BUDGET[$role] <= smallest / 8)); then
+      ok "the ${role} share is within an eighth of the smallest supported pod"
+    else
+      bad "the ${role} share (${BUDGET[$role]}) exceeds an eighth of a 4 GiB pod - the divisor's protection is gone"
+    fi
+  done
 
-  local max role budget resting
-  for max in 2147483648 4294967296 8589934592 17179869184; do
-    budgets_at "$max"
-    for role in "${!BUDGET[@]}"; do
-      budget=${BUDGET[$role]}
-      resting=${RESTING_ROLE[$role]:-0}
-      if ((resting == 0)) || ((budget > resting)); then
-        ok "memory.max=${max}: the ${role} budget is above its measured resting size"
-      else
-        bad "memory.max=${max}: the ${role} budget (${budget}) is at or below resting (${resting}) - a kill loop"
-      fi
-      if ((budget < max)); then
-        ok "memory.max=${max}: the ${role} budget is inside the pod"
-      else
-        bad "memory.max=${max}: the ${role} budget (${budget}) is the whole pod - inert"
-      fi
-    done
+  # Property 4: the connection-holding process has the largest single share. It
+  # is the operator's rule and it is allocated by consequence rather than by
+  # size, so nothing in the numbers themselves would catch a later edit that
+  # broke it.
+  local biggest="" role
+  for role in ${ENVELOPE_ROLES}; do
+    # shellcheck disable=SC2004
+    if [[ -z $biggest ]] || ((BUDGET[$role] > BUDGET[$biggest])); then biggest=$role; fi
+  done
+  assert_eq serverMain "$biggest" "the process holding the remote connection has the largest share"
+  for role in ${ENVELOPE_ROLES}; do
+    [[ $role == serverMain ]] && continue
+    # shellcheck disable=SC2004
+    if ((BUDGET[$role] < BUDGET[serverMain])); then
+      ok "and ${role} is strictly smaller, so the largest share is unambiguous"
+    else
+      bad "${role} ties or beats serverMain - there is no single largest share"
+    fi
   done
 
-  # An explicit budget must win, or a number cannot be tried on a live workspace
-  # without editing the script under test.
-  BUDGET=()
-  WATCHDOG_BUDGET_extensionHost=268435456 derive_budgets 8589934592
-  assert_eq 268435456 "${BUDGET[extensionHost]}" "an explicit budget overrides the derivation"
-  assert_eq 536870912 "${BUDGET[serverMain]}" "while the rest is still derived"
-  budgets_at 8589934592
-
-  # Arming is by role and by mode, because the blast radius differs: nothing in
-  # the helper set is visible to the operator when it restarts, and both members
-  # of the editor set are.
-  # MODE is a global of the sourced watchdog, set here to ask each mode what it
-  # would arm.
+  # Property 5: BUDGET_ORDER names every declared role and nothing else. It is
+  # what the budget report iterates, and a literal list at a reporting call site
+  # is exactly where a fully-enforced share goes unreported.
+  local listed=" ${BUDGET_ORDER// / } "
+  for role in "${!BUDGET_ROLE[@]}"; do
+    assert_contains "$listed" " ${role} " "BUDGET_ORDER names ${role}"
+  done
+  for role in ${BUDGET_ORDER}; do
+    if [[ -n ${BUDGET_ROLE[$role]:-} ]]; then
+      ok "BUDGET_ORDER's ${role} is a declared role"
+    else
+      bad "BUDGET_ORDER names ${role}, which has no budget"
+    fi
+  done
+  assert_eq "${#BUDGET_ROLE[@]}" "$(printf '%s\n' ${BUDGET_ORDER} | wc -l)" \
+    "and names each of them exactly once"
+
+  # Property 6: every role inside the envelope is armed under enforce, and none
+  # is armed under observe. A share that cannot be signalled is a share that is
+  # not enforced, which would make the envelope a description of the tree rather
+  # than a bound on it.
+  #
+  # Mutation: restore the old `enforce) [[ $HELPER_ROLES == *" $role "* ]]`
+  # clause and the extensionHost, serverMain and treeHelper assertions go red.
   # shellcheck disable=SC2034
   MODE=observe
-  assert_armed claudeHelper no "observe mode arms nothing"
+  for role in "${!BUDGET_ROLE[@]}"; do
+    assert_armed "$role" no "observe arms nothing, ${role} included"
+  done
   # shellcheck disable=SC2034
   MODE=enforce
-  assert_armed claudeHelper yes "enforce arms MCP servers"
-  assert_armed fileWatcher yes "enforce arms the file watcher"
-  assert_armed extensionHost no "enforce leaves the extension host alone"
-  # shellcheck disable=SC2034
-  MODE=enforce-all
-  assert_armed extensionHost yes "enforce-all arms the extension host"
-  assert_armed serverMain yes "enforce-all arms serverMain"
+  for role in "${!BUDGET_ROLE[@]}"; do
+    assert_armed "$role" yes "enforce arms ${role}"
+  done
+  # A role with no declared budget is armed by nothing, in any mode: arming keys
+  # on having a share, so a future role added without one cannot be signalled on
+  # a budget of zero.
+  assert_armed somethingNew no "a role with no share is armed by nothing"
   # shellcheck disable=SC2034
   MODE=observe
+
+  # An explicit budget must win, or a number cannot be tried on a live workspace
+  # without editing the script under test.
+  BUDGET=()
+  WATCHDOG_BUDGET_extensionHost=268435456 derive_budgets
+  assert_eq 268435456 "${BUDGET[extensionHost]}" "an explicit budget overrides the declared share"
+  assert_eq 536870912 "${BUDGET[serverMain]}" "while the rest is unchanged"
+  # And an override that breaks the total says so, rather than leaving a sum
+  # nobody can reconstruct from the log.
+  local overridden
+  overridden=$(envelope_in_force)
+  if ((overridden != ENVELOPE)); then
+    ok "an override that changes the total is visible as a total"
+  else
+    bad "an override moved a share without moving the sum - envelope_in_force is not summing the shares in force"
+  fi
+  budgets_at
+
+  # The budget report is what a reviewer reads the apportionment out of, so it
+  # has to carry the envelope and not only the per-role number.
+  rm -rf "${WORK}/state"
+  load_watchdog "${WORK}/cg" "${WORK}/proc2" enforce
+  read_uptime
+  # cycle_once only reports the budgets on the cycle that installs them, and
+  # load_watchdog has already installed them.
+  BUDGET=()
+  cycle_once 1000 >/dev/null 2>&1
+  local actions
+  actions="$(cat "${WORK}/state/actions.log" 2>/dev/null)"
+  assert_contains "$actions" "event=budget role=serverMain budget_mb=512" \
+    "the report names each share in MiB"
+  assert_contains "$actions" "envelope=yes" "and says which roles are inside the envelope"
+  assert_contains "$actions" "event=budget role=claudeHelper budget_mb=512 envelope=no" \
+    "and that the MCP server budget is not one of them"
+  assert_contains "$actions" "shares_sum_mb=2048 " "and publishes the total the shares add up to"
+  assert_absent "$actions" "event=warning reason=envelope-mismatch" \
+    "with no mismatch to report when the shares are the declared ones"
+}
+
+# --------------------------------------------------------------------------- #
+# 3b. drift is killed; what never fitted is reported
+#
+# This is the mechanism that replaced the resting x 1.5 floor, and it has to be
+# tested as the pair it is: the same role, the same budget, the same final size,
+# and opposite outcomes decided only by whether the process was ever seen inside
+# its share.
+#
+# What the floor protected against was a share that lands below what a healthy
+# process already holds, which under enforcement is a kill loop with a
+# supervisor's restart in the middle of it. A floor cannot survive an envelope -
+# enough floors push the sum past the total - so the protection moved to the
+# process: nothing that has never fitted is signalled.
+# --------------------------------------------------------------------------- #
+
+test_oversize_is_reported_not_killed() {
+  printf 'a process that never fitted is reported, not killed\n'
+  write_cgroup "${WORK}/cg" 8589934592 0.00
+  local pdir="${WORK}/proc3b"
+  build_tree "$pdir"
+  rm -rf "${WORK}/state"
+  load_watchdog "${WORK}/cg" "$pdir" enforce
+
+  # The extension host as the live pod actually has it: 738 MB against a 480 MiB
+  # share, over from the first sweep and for its whole observed life.
+  local t=1000
+  sweep_at $t
+  t=$((t + DWELL_SECONDS + 60))
+  sweep_at $t
+  assert_absent "$SIGNALS" ":41" "an extension host that has never fitted is not killed"
+  assert_contains "$(cat "${WORK}/state/actions.log")" "event=oversize pid=41 role=extensionHost" \
+    "it is reported instead, with the identity to act on"
+  assert_contains "$(cat "${WORK}/state/sweep.latest")" "oversize" \
+    "and the sweep row says which of the two cases this is"
+  # It keeps saying so. A mechanism that reports a structural problem once and
+  # then goes quiet is indistinguishable from one that fixed it.
+  : >"${WORK}/state/actions.log"
+  t=$((t + DWELL_SECONDS + 60))
+  sweep_at $t
+  assert_contains "$(cat "${WORK}/state/actions.log")" "event=oversize pid=41" \
+    "and goes on saying so once per dwell period, indefinitely"
+
+  # The pair. Same process, same role, same 738 MB, same budget - but this one is
+  # seen inside its share first, so it drifted rather than never fitted.
+  #
+  # Mutation: delete the `[[ -z ${FIT_SEEN[$key]:-} ]]` branch in sweep_once and
+  # the first half of this test goes red (41 is killed); delete the FIT_SEEN
+  # assignment and the second half goes red (41 is never killed).
+  SIGNALS=""
+  rm -rf "${WORK}/state"
+  load_watchdog "${WORK}/cg" "$pdir" enforce
+  set_pss "$pdir" 41 400000000 # inside the 480 MiB share
+  t=5000
+  sweep_at $t
+  assert_eq 1 "${FIT_SEEN[41:100]:-0}" "a process seen inside its share is recorded as having fitted"
+  set_pss "$pdir" 41 738000000
+  t=$((t + 60))
+  sweep_at $t
+  t=$((t + DWELL_SECONDS))
+  sweep_at $t
+  assert_contains "$SIGNALS" "TERM:41" "and when it later drifts out of it, it is killed"
+  set_pss "$pdir" 41 738000000
+
+  # The fit evidence is only taken from a process old enough to have finished
+  # starting up. Without that, the classification would depend on whether a sweep
+  # happened to catch the process in the seconds after exec, when everything is
+  # small - a race, decided by sweep timing rather than by the process.
+  #
+  # Mutation: drop `age >= MIN_AGE` from the FIT_SEEN assignment and this goes
+  # red, because the young small observation would arm the kill.
+  SIGNALS=""
+  rm -rf "${WORK}/state"
+  load_watchdog "${WORK}/cg" "$pdir" enforce
+  set_age "$pdir" 41 30
+  set_pss "$pdir" 41 100000000
+  t=8000
+  sweep_at $t
+  assert_eq 0 "${FIT_SEEN[41:$((( UPTIME_S - 30 ) * 100))]:-0}" \
+    "a small reading from a process that has just started proves nothing"
+  set_age "$pdir" 41 50000
+  set_pss "$pdir" 41 738000000
+  t=$((t + DWELL_SECONDS + 600))
+  sweep_at $t
+  t=$((t + DWELL_SECONDS + 600))
+  sweep_at $t
+  assert_absent "$SIGNALS" ":41" "so it is still oversize once it is old and large"
+  set_pss "$pdir" 41 738000000
+
+  # And the whole rule is inert in observe mode, like everything else - but it
+  # reports the *right* one of the two cases, which is the evidence anyone needs
+  # before arming this on a live workspace.
+  SIGNALS=""
+  rm -rf "${WORK}/state"
+  load_watchdog "${WORK}/cg" "$pdir" observe
+  t=20000
+  set_pss "$pdir" 61 200000000
+  sweep_at $t
+  set_pss "$pdir" 61 1660000000
+  t=$((t + 60))
+  sweep_at $t
+  t=$((t + DWELL_SECONDS + 60))
+  sweep_at $t
+  assert_eq "" "$SIGNALS" "observe mode signals nothing either way"
+  local obs
+  obs="$(cat "${WORK}/state/actions.log")"
+  assert_contains "$obs" "event=oversize pid=41" \
+    "and calls the extension host oversize rather than would-kill"
+  assert_contains "$obs" "event=would-kill armed=no pid=61" \
+    "while a helper that did fit and then drifted is still reported as a kill it would have made"
 }
 
 # --------------------------------------------------------------------------- #
@@ -1223,9 +1406,15 @@ test_dwell() {
   rm -rf "${WORK}/state"
   load_watchdog "${WORK}/cg" "$pdir" enforce
 
-  # The python MCP server at the size it was actually observed at: 1.66 GB
-  # against a 512 MiB budget.
-  local t=1000
+  # The python MCP server, first at a size a healthy one was actually measured
+  # at and then at the 1.66 GB the offending one reached. It has to be seen
+  # fitting before it can be said to have drifted - a process that was never
+  # inside its share is the other case entirely, and section 3b owns it.
+  local t=900
+  set_pss "$pdir" 61 200000000
+  sweep_at $t
+  set_pss "$pdir" 61 1660000000
+  t=1000
   sweep_at $t
   assert_eq "" "$SIGNALS" "the first sweep over budget signals nothing"
   assert_eq "$t" "${OVER_SINCE[61:100]}" "but it starts the dwell clock"
@@ -1254,11 +1443,11 @@ test_dwell() {
   rm -rf "${WORK}/state"
   load_watchdog "${WORK}/cg" "$pdir" enforce
   t=2000
-  set_pss "$pdir" 44 900000000 # tsserver indexing, over its 768 MiB budget
+  set_pss "$pdir" 44 900000000 # tsserver indexing, well over its 320 MiB share
   sweep_at $t
   t=$((t + 300))
   sweep_at $t
-  set_pss "$pdir" 44 400000000 # indexing finished, memory handed back
+  set_pss "$pdir" 44 208000000 # indexing finished, memory handed back
   t=$((t + 60))
   sweep_at $t
   assert_eq "" "${OVER_SINCE[44:100]:-}" "coming back under budget clears the dwell clock"
@@ -1283,60 +1472,79 @@ test_dwell() {
 }
 
 # --------------------------------------------------------------------------- #
-# 4b. the kill loop, and the circuit breaker that stops it
+# 4b. the kill rate is reported, and disarms nothing
+#
+# There used to be a circuit breaker here: LOOP_KILLS kills of one role inside
+# LOOP_WINDOW disarmed that role permanently. It was protecting against the kill
+# loop - kill the extension host, VS Code restarts it, it reloads every
+# extension, it exceeds again, kill - which is the failure that arrives looking
+# exactly like the watchdog working.
+#
+# Under a deliberate envelope that inference no longer holds: repeated kills can
+# mean the process does not fit in the share it was given, which is a decision
+# rather than a defect, and a mechanism that switches itself off after three of
+# them is inert by mid-morning. The loop itself is prevented by the oversize rule
+# instead (section 3b), which is why removing the breaker does not put it back.
 #
-# This is the failure mode that makes drift policing actively harmful, and it
-# arrives looking exactly like the watchdog working: kill the extension host, VS
-# Code restarts it, it reloads every extension, it exceeds again, kill. What
-# distinguishes a drifting role from a wrongly-budgeted one is only how often the
-# same role has to be killed, so that is what the breaker measures.
+# So this section asserts the *negative*: however many times a role is killed,
+# enforcement continues, and the rate is reported.
 # --------------------------------------------------------------------------- #
 
-test_kill_loop_breaker() {
-  printf 'the kill loop breaker\n'
+test_kill_rate_is_reported_and_nothing_disarms() {
+  printf 'the kill rate is reported and disarms nothing\n'
   write_cgroup "${WORK}/cg" 8589934592 0.00
   local pdir="${WORK}/proc4b"
   build_tree "$pdir"
   rm -rf "${WORK}/state"
   load_watchdog "${WORK}/cg" "$pdir" enforce
 
-  local t=1000 i
-  for ((i = 1; i <= LOOP_KILLS; i++)); do
-    # A fresh incarnation of the same role, as a supervisor restart would give.
+  # Each incarnation is seen inside its share first and then drifts out of it, so
+  # every one of them is a genuine drift kill rather than an oversize report.
+  # That is what makes this a test of the rate rather than of the oversize rule.
+  local t=1000 i n=$((LOOP_KILLS + 2))
+  for ((i = 1; i <= n; i++)); do
     printf '%s (python3) S 60 1 1 0 -1 4194560 0 0 0 0 0 0 0 0 20 0 1 0 %s\n' \
       61 $((i * 1000)) >"${pdir}/61/stat"
-    set_pss "$pdir" 61 1660000000
+    set_pss "$pdir" 61 200000000 # inside the 512 MiB share
+    sweep_at $t
+    set_pss "$pdir" 61 1660000000 # the 1.66 GB it was actually measured at
+    t=$((t + 60))
     sweep_at $t
     t=$((t + DWELL_SECONDS))
     sweep_at $t
     t=$((t + 60))
   done
-  assert_eq "$LOOP_KILLS" "${KILLS[claudeHelper]:-0}" "the role was killed once per incarnation"
-  if [[ -n ${DISARMED[claudeHelper]:-} ]]; then
-    ok "and after ${LOOP_KILLS} kills inside the window the role is disarmed"
-  else
-    bad "the role kept being killed - there is no circuit breaker"
-  fi
-  assert_contains "$(cat "${WORK}/state/actions.log")" "event=disarmed role=claudeHelper" \
-    "the breaker says so in the log rather than going quiet"
-
-  # And it stays disarmed: the next incarnation is watched, reported, and left
-  # alone.
+  assert_eq "$n" "${KILLS[claudeHelper]:-0}" \
+    "the role is killed once per incarnation, past the old breaker threshold and beyond"
+
+  local actions
+  actions="$(cat "${WORK}/state/actions.log")"
+  assert_contains "$actions" "event=kill-rate role=claudeHelper" \
+    "the rate is reported once it crosses the threshold"
+  assert_contains "$actions" "enforcing=yes" "and the report says enforcement continues"
+  assert_absent "$actions" "event=disarmed" "nothing is disarmed"
+  assert_absent "$(cat "${WORK}/state/sweep.latest")" "disarmed" \
+    "and no process is recorded as deliberately spared for that reason"
+
+  # The falsification for the whole section: the last kill must be a real signal,
+  # not a leftover from before the threshold. Mutation: restore
+  # `DISARMED[$role]=1` in record_kill and this goes red.
   SIGNALS=""
   printf '%s (python3) S 60 1 1 0 -1 4194560 0 0 0 0 0 0 0 0 20 0 1 0 99000\n' 61 \
     >"${pdir}/61/stat"
+  set_pss "$pdir" 61 200000000
+  sweep_at $t
   set_pss "$pdir" 61 1660000000
+  t=$((t + 60))
   sweep_at $t
-  t=$((t + DWELL_SECONDS + 60))
+  t=$((t + DWELL_SECONDS))
   sweep_at $t
-  assert_eq "" "$SIGNALS" "a disarmed role is not killed again"
-  assert_contains "$(cat "${WORK}/state/sweep.latest")" "disarmed" \
-    "and the sweep records that it is over budget and deliberately spared"
-
-  # Falsification: with a window short enough that the kills fall outside it, the
-  # same three kills must NOT disarm anything - otherwise the assertion above is
-  # about the count and not about the rate, and any long-lived workspace would
-  # eventually disarm itself.
+  assert_contains "$SIGNALS" "TERM:61" \
+    "a role well past the old breaker threshold is still enforced"
+
+  # The report is a rate and not a count: kills spread beyond the window must not
+  # produce it, or any long-lived workspace would eventually report one for
+  # nothing.
   rm -rf "${WORK}/state"
   load_watchdog "${WORK}/cg" "$pdir" enforce
   # shellcheck disable=SC2034  # a global of the sourced watchdog
@@ -1346,51 +1554,52 @@ test_kill_loop_breaker() {
     record_kill claudeHelper $t
     t=$((t + 600))
   done
-  if [[ -n ${DISARMED[claudeHelper]:-} ]]; then
-    bad "kills spread over hours still disarm the role - the breaker counts, it does not measure a rate"
-  else
-    ok "kills spread beyond the window do not disarm the role"
-  fi
+  assert_absent "$(cat "${WORK}/state/actions.log" 2>/dev/null)" "event=kill-rate role=claudeHelper" \
+    "kills spread beyond the window are not reported as a rate"
 
-  # The global breaker: a budget wrong in a way that spreads across roles.
+  # And the same idea across roles.
   rm -rf "${WORK}/state"
   load_watchdog "${WORK}/cg" "$pdir" enforce
   t=20000
   for ((i = 1; i <= GLOBAL_LOOP_KILLS; i++)); do
     record_kill "role${i}" $t
   done
-  if [[ -n ${DISARMED[claudeHelper]:-} ]]; then
-    ok "enough kills across unrelated roles disarms everything"
-  else
-    bad "no global circuit breaker"
-  fi
+  assert_contains "$(cat "${WORK}/state/actions.log" 2>/dev/null)" "event=kill-rate role=all" \
+    "enough kills across unrelated roles is reported too"
 }
 
 # --------------------------------------------------------------------------- #
-# 4c. what the breaker does to a kill that is already in flight
+# 4c. a kill already in flight is finished
+#
+# A drill on a disposable workspace found this by accident under the old
+# breaker: it tripped between a process's SIGTERM and its SIGKILL, the disarm
+# branch short-circuited ahead of the escalation, and the process was left alive,
+# still over budget, signalled, abandoned, and recorded as neither killed nor
+# spared. Nothing in the code or the docs said which of those was intended, so it
+# was not a defect anyone could have reviewed.
 #
-# A drill on a disposable workspace found this by accident: the breaker tripped
-# between a process's SIGTERM and its SIGKILL, and the disarm branch
-# short-circuited ahead of the escalation, so the process was still alive and
-# still over budget when the drill ended - signalled, abandoned, and recorded as
-# neither killed nor spared. Nothing in the code or the docs said which of those
-# was intended, so it was not a defect anyone could have reviewed.
+# The breaker is gone but the ladder still has a branch that can short-circuit an
+# escalation - the oversize rule - and the lesson is the same one: "do not decide
+# to kill this" is not "abandon a kill already decided". Leaving a process
+# half-signalled is the worst of both outcomes. So the escalation branch is
+# tested first, and this asserts it, by taking the fit evidence away between the
+# SIGTERM and the SIGKILL.
 #
-# It is decided here: disarming means "stop deciding to kill this role", not
-# "abandon a kill already decided". Finishing one escalation cannot start the
-# loop the breaker exists to stop. Both halves are asserted, because either one
-# alone is satisfiable by a watchdog that got the decision backwards.
+# Mutation: move the `[[ -z ${FIT_SEEN[$key]:-} ]]` branch above the
+# `[[ -n ${KILLED_AT[$key]:-} ]]` branch and this goes red.
 # --------------------------------------------------------------------------- #
 
-test_disarm_completes_an_escalation_in_flight() {
-  printf 'a disarmed role finishes the kill it started and starts no new one\n'
+test_an_escalation_in_flight_is_finished() {
+  printf 'a kill already in flight is finished, not abandoned\n'
   write_cgroup "${WORK}/cg" 8589934592 0.00
   local pdir="${WORK}/proc4c"
   build_tree "$pdir"
   rm -rf "${WORK}/state"
   load_watchdog "${WORK}/cg" "$pdir" enforce
 
-  # 61 drifts and is asked politely.
+  # 61 fits, drifts, and is asked politely.
+  set_pss "$pdir" 61 200000000
+  sweep_at 900
   set_pss "$pdir" 61 1660000000
   sweep_at 1000
   sweep_at $((1000 + DWELL_SECONDS))
@@ -1398,29 +1607,30 @@ test_disarm_completes_an_escalation_in_flight() {
   assert_absent "$SIGNALS" "KILL:61" "and not yet a SIGKILL"
   local kills_before=${KILLS[claudeHelper]:-0}
 
-  # The breaker now trips - on this role, from other incarnations - while that
-  # SIGTERM is outstanding.
-  # shellcheck disable=SC2034  # a global of the sourced watchdog
-  DISARMED[claudeHelper]=1
+  # The fit evidence disappears while that SIGTERM is outstanding - which is what
+  # a pid:starttime key change, or a pruning bug, would look like from inside the
+  # ladder.
+  unset 'FIT_SEEN[61:100]'
   SIGNALS=""
   sweep_at $((1000 + DWELL_SECONDS + KILL_GRACE))
   assert_contains "$SIGNALS" "KILL:61" \
     "the escalation completes rather than leaving the process half-signalled"
-  assert_contains "$(cat "${WORK}/state/actions.log")" "after_disarm=yes" \
-    "and the log distinguishes it from an ordinary escalation"
   assert_eq "$kills_before" "${KILLS[claudeHelper]:-0}" \
-    "it is the same kill, so the breaker does not count it twice"
+    "it is the same kill, so the rate does not count it twice"
 
-  # The other half: the disarmed role starts nothing new. 62 is a different
-  # process of the same role that has never been signalled.
+  # The other half: a process that never fitted starts nothing, however far it
+  # has drifted. 62 is a different process of the same role.
   SIGNALS=""
+  rm -rf "${WORK}/state"
+  load_watchdog "${WORK}/cg" "$pdir" enforce
   set_pss "$pdir" 62 900000000
   sweep_at 5000
   sweep_at $((5000 + DWELL_SECONDS))
   assert_absent "$SIGNALS" ":62" \
-    "a disarmed role begins no new kill, however far another of its processes has drifted"
-  assert_contains "$(cat "${WORK}/state/sweep.latest")" "disarmed" \
+    "a process that never fitted begins no kill at all"
+  assert_contains "$(cat "${WORK}/state/sweep.latest")" "oversize" \
     "and says it is deliberately sparing it"
+  set_pss "$pdir" 62 200000000
 }
 
 # --------------------------------------------------------------------------- #
@@ -1435,7 +1645,11 @@ test_observe_mode() {
   rm -rf "${WORK}/state"
   load_watchdog "${WORK}/cg" "$pdir" observe
 
-  local t=1000
+  local t=900
+  set_pss "$pdir" 61 200000000
+  sweep_at $t
+  set_pss "$pdir" 61 1660000000
+  t=1000
   sweep_at $t
   t=$((t + DWELL_SECONDS))
   sweep_at $t
@@ -1449,29 +1663,31 @@ test_observe_mode() {
   assert_contains "$(cat "${WORK}/state/sweep.latest")" "would-kill" \
     "the sweep row says would-kill rather than killed"
 
-  # Enforce mode arms helpers but not the editor, so the extension host is
-  # reported and spared in exactly the same way.
-  SIGNALS=""
-  rm -rf "${WORK}/state"
-  load_watchdog "${WORK}/cg" "$pdir" enforce
-  set_pss "$pdir" 41 2000000000
-  t=5000
-  sweep_at $t
-  t=$((t + DWELL_SECONDS))
-  sweep_at $t
-  assert_absent "$SIGNALS" "TERM:41" "enforce mode does not kill the extension host"
-  assert_contains "$(cat "${WORK}/state/actions.log")" "pid=41" \
-    "but it does report it as over budget"
-
+  # enforce-all is the retired third mode. It must not fall through to observe:
+  # a workspace still carrying the stored value asked for more enforcement, not
+  # for none, so it is honoured as enforce. This is asserted by behaviour rather
+  # than by reading MODE, because the fallback that matters is the one in main().
   SIGNALS=""
   rm -rf "${WORK}/state"
   load_watchdog "${WORK}/cg" "$pdir" enforce-all
+  MODE=enforce-all
+  normalise_mode
+  assert_eq enforce "$MODE" "the retired enforce-all mode is honoured as enforce"
+  MODE=somethingElse
+  normalise_mode
+  assert_eq observe "$MODE" "and an unrecognised mode still falls back to the inert one"
+  # shellcheck disable=SC2034
+  MODE=enforce
+  set_pss "$pdir" 61 200000000
   t=8000
   sweep_at $t
+  set_pss "$pdir" 61 1660000000
+  t=$((t + 60))
+  sweep_at $t
   t=$((t + DWELL_SECONDS))
   sweep_at $t
-  assert_contains "$SIGNALS" "TERM:41" "enforce-all does kill it"
-  set_pss "$pdir" 41 500000000
+  assert_contains "$SIGNALS" "TERM:61" "and it enforces"
+  set_pss "$pdir" 61 1660000000
 }
 
 # --------------------------------------------------------------------------- #
@@ -1531,7 +1747,9 @@ test_sweep_log() {
   local summary
   summary="$(cat "${WORK}/state/summary")"
   assert_contains "$summary" "claudeHelper=512M" "the summary prints real budgets"
-  assert_contains "$summary" "extensionHost=1069M" "including the ones the resting floor lifted"
+  assert_contains "$summary" "extensionHost=480M" "including its share of the envelope"
+  assert_contains "$summary" "envelope=2048M" "and the envelope those shares add up to"
+  assert_contains "$summary" "tree_pss=" "beside what the tree is actually holding against it"
   assert_contains "$summary" "policed=" "and the size of the policed set"
 
   # The visibility check: a watchdog that manages nothing looks exactly like a
@@ -1605,10 +1823,16 @@ test_stdout_emission() {
   # asserting on half the output.
   # shellcheck disable=SC2034  # globals of the sourced watchdog
   SWEEP_EVERY=1
-  # Emptied so the first cycle derives its budgets exactly as the daemon does at
+  # Emptied so the first cycle installs its budgets exactly as the daemon does at
   # startup, and emits them.
   BUDGET=()
   local t=1000
+  # Seen inside its share first, so what follows is a drift kill rather than the
+  # oversize report a process that never fitted would get.
+  set_pss "$pdir" 61 200000000
+  cycle_once $t
+  set_pss "$pdir" 61 1660000000
+  t=$((t + 60))
   cycle_once $t
   # shellcheck disable=SC2034  # a global of the sourced watchdog
   CYCLE=1
@@ -1619,7 +1843,9 @@ test_stdout_emission() {
   out="$(cat "$STDOUT_FILE")"
   assert_contains "$out" "event=kill sig=TERM" "a kill is emitted to stdout"
   assert_contains "$out" "event=budget role=" "so are the budgets in force"
-  assert_contains "$out" "floored=1" "including which of them the resting floor lifted"
+  assert_contains "$out" "envelope_pct=" "including each share as a fraction of the envelope"
+  assert_contains "$out" "event=oversize pid=41 role=extensionHost" \
+    "and the structurally-over-budget extension host, which is the case a post-mortem cannot otherwise tell from a drift"
   assert_contains "$out" "event=census" "and a census line"
   assert_contains "$out" "id=homelab_mcp.server" "with the identity breadcrumb, not just a pid"
   assert_contains "$out" "top_role=" "and the census carries the standing population's largest member"
@@ -1653,6 +1879,10 @@ test_stdout_emission() {
   rm -rf "${WORK}/state"
   load_watchdog "${WORK}/cg" "$pdir" observe
   t=5000
+  set_pss "$pdir" 61 200000000
+  sweep_at $t
+  set_pss "$pdir" 61 1660000000
+  t=$((t + 60))
   sweep_at $t
   t=$((t + DWELL_SECONDS))
   sweep_at $t
@@ -1788,10 +2018,11 @@ main() {
   test_guards_are_precise
   test_tree_helpers
   test_tree_helper_arming_is_end_to_end
-  test_budgets
+  test_envelope
+  test_oversize_is_reported_not_killed
   test_dwell
-  test_kill_loop_breaker
-  test_disarm_completes_an_escalation_in_flight
+  test_kill_rate_is_reported_and_nothing_disarms
+  test_an_escalation_in_flight_is_finished
   test_observe_mode
   test_sweep_log
   test_stdout_emission
diff --git a/templates/kubernetes/homelab-workspace/script-memory-watchdog.sh b/templates/kubernetes/homelab-workspace/script-memory-watchdog.sh
index 209fbe54..3a6608ae 100644
--- a/templates/kubernetes/homelab-workspace/script-memory-watchdog.sh
+++ b/templates/kubernetes/homelab-workspace/script-memory-watchdog.sh
@@ -3,6 +3,12 @@
 # Memory watchdog for the workspace pod: it bounds the *standing population* of
 # restartable helper processes.
 #
+# In one sentence: the VS Code tree is given a fixed 2048 MiB envelope, each role
+# holds a named share of it that does not vary with pod size, and a process is
+# killed when its PSS has been above its role's share for ten continuous minutes
+# *and* it has been observed inside that share at some point since it started.
+# The long form is in the "the envelope" section below.
+#
 # What it is for, and what it deliberately is not for.
 #
 # It is not an OOM preventer. The earlier version of this script was, and the
@@ -41,21 +47,17 @@
 #
 # Modes (the memory_watchdog_mode template parameter; the script itself falls
 # back to observe when the value is anything else):
-#   observe     - measure, publish, and log the kill it *would* have made.
-#                 Signals nothing.
-#   enforce     - additionally kill drifted *helpers*: language servers, the
-#                 file watcher, native extension helpers, and helpers spawned by
-#                 an agent session (MCP servers). This is the template default,
-#                 because every one of them restarts without the operator
-#                 noticing.
-#   enforce-all - additionally kill the extension host and the server main
-#                 process, and the treeHelper role. The first two are
-#                 user-visible when they restart; treeHelper is here for a
-#                 different reason - it is the role for a process in the server
-#                 tree that no rule can name, so its budget is a reasoned guess
-#                 rather than a measurement. All three are roles a wrong budget
-#                 would put in a kill loop, so they are armed separately and on
-#                 purpose.
+#   observe - measure, publish, and log the action it *would* have taken.
+#             Signals nothing.
+#   enforce - additionally kill drifted processes, in *every* role. This is the
+#             template default.
+#
+# There used to be a third mode, enforce-all, which armed the editor roles that
+# enforce left alone. Under a fixed envelope there is nothing left for it to add:
+# a role outside the enforced set is a role whose share of the envelope is not
+# actually enforced, which makes the envelope a description rather than a bound.
+# The value is still accepted, as a synonym for enforce, so that a workspace
+# carrying it does not silently fall back to observing.
 #
 # Test seams, exercised by script-memory-watchdog-test.sh:
 #   WATCHDOG_CGROUP_DIR  WATCHDOG_PROC_DIR  WATCHDOG_STATE_DIR
@@ -107,135 +109,169 @@ MIN_AGE="${WATCHDOG_MIN_AGE:-300}"
 # process that is shutting down politely is never hurried.
 KILL_GRACE="${WATCHDOG_KILL_GRACE:-30}"
 
-# The circuit breaker. This is the counterweight to being aggressive, and it
-# exists because the failure mode of drift policing is not a wrong kill - it is a
-# kill *loop*: kill the extension host, VS Code restarts it, it reloads every
-# extension, it exceeds again, kill. That loop arrives looking exactly like the
-# watchdog working, and it is the thing that gets a watchdog switched off.
+# The kill-rate report. This was a circuit breaker: a role killed LOOP_KILLS
+# times inside LOOP_WINDOW disarmed itself permanently. It no longer disarms
+# anything, and the reason is the envelope below.
+#
+# The breaker assumed that repeated kills meant a *wrong budget*, which was true
+# while budgets were per-role numbers reasoned about one at a time. Under a total
+# envelope it is no longer a safe inference: repeated kills can equally mean the
+# process does not fit in the share the operator decided to give it, and that is
+# a decision rather than a defect. A mechanism that switches itself off after
+# three of those is inert by mid-morning - and it arrives looking exactly like
+# the watchdog working, which is precisely the failure the breaker was built to
+# prevent, now caused by the breaker.
 #
-# So a role that has to be killed LOOP_KILLS times inside LOOP_WINDOW is not a
-# drifting role, it is a role whose budget is wrong for this workload. The
-# watchdog disarms itself for that role, says so, and leaves the number to a
-# human. It never widens its own budget: a mechanism that quietly raises the
-# limit it is enforcing is a mechanism that stops enforcing anything.
+# The kill *loop* it protected against is prevented structurally instead, by the
+# oversize rule in sweep_once: a process that has never been observed inside its
+# budget is never signalled, so the loop "kill it -> the replacement is over
+# budget too -> kill it" cannot form. That rule is per process and evidence-based
+# rather than per role and count-based, it re-arms by itself the moment a
+# replacement does fit, and it can never widen a budget.
+#
+# So these two numbers now only decide when a kill *rate* is worth a line in the
+# container log. Nothing is disarmed and nothing changes behaviour: the line is a
+# sizing signal for a human, and the watchdog goes on enforcing.
 LOOP_WINDOW="${WATCHDOG_LOOP_WINDOW:-3600}"
 LOOP_KILLS="${WATCHDOG_LOOP_KILLS:-3}"
-# And the same idea across all roles at once, in case a budget is wrong in a way
-# that spreads: too many kills in one window disarms everything.
+# The same idea across all roles at once.
 GLOBAL_LOOP_KILLS="${WATCHDOG_GLOBAL_LOOP_KILLS:-8}"
 
-# Budgets, in bytes of PSS, by role.
+# --------------------------------------------------------------------------- #
+# the envelope
+# --------------------------------------------------------------------------- #
+#
+# One sentence: the VS Code tree is given a fixed 2048 MiB envelope, each role
+# holds a named share of it that does not vary with pod size, and a process is
+# killed when its PSS has been above its role's share for ten continuous minutes
+# *and* it has been observed inside that share at some point since it started.
 #
-# Why PSS and not VmData. RLIMIT_DATA accounts VmData, which is why the previous
-# design measured it; that mechanism is gone, and for deciding "is this process
-# holding too much memory" VmData is the wrong quantity by roughly an order of
-# magnitude on a V8 process (measured: file watcher 66 MB resident against 622 MB
-# of data). PSS is what the pod actually pays: it counts shared pages once,
-# divided among the processes sharing them, which matters here because a dozen
-# node processes share one binary's file-backed pages. RSS would charge each of
-# them the full share and make every helper look bigger than it is.
+# Everything below is that sentence written out. What it replaced was three
+# interacting terms - a hand-picked per-role number, a memory.max/8 pod share,
+# and a resting x 1.5 floor - each patching the previous one's failure, with no
+# term anywhere that bounded the total.
 #
-# Why not one uniform number. The operator's instinct - "none of these should
-# ever exceed 512 MB, maybe 256" - is right about the helpers and wrong about the
-# extension host, and the difference is measured, not argued: on a *fresh* tree
-# the extension host is already 471 MB PSS, serverMain 160 MB, ptyHost 36 MB and
-# the file watcher 34 MB. A uniform 512 MB budget puts the extension host 40 MB
-# from its resting size before it has done any work, and 256 MB is below its
-# floor outright - which is the same defect as the ceiling this file used to
-# derive that sat below what an idle file watcher already held. So each role gets
-# the operator's number where it is right, and a number anchored on its own
-# measured resting size where it is not.
+# Why the floor is gone, and it is *gone* rather than relaxed. It existed so a
+# budget could never land below what a process already held at rest, which is a
+# real scar: this design twice shipped a limit below a running process's size,
+# most memorably an RLIMIT_DATA ceiling below what an idle file watcher held. But
+# a floor and an envelope are incompatible instruments. Under a total, a process
+# whose resting size does not fit means the process must be made smaller; a floor
+# says the budget must grow to meet it, and enough of those push the sum past the
+# envelope, which is the envelope defeated by arithmetic. What the floor was
+# protecting against is now protected against by the oversize rule (see
+# sweep_once): a process too big for its share is *reported and left alone*
+# rather than killed on a loop. That is a better guard than the floor was,
+# because it is measured on the process actually running rather than read from a
+# hand-maintained constant that goes stale, and because it cannot inflate a
+# budget.
 #
-# The reference column is that measurement, and it is the *resting* one rather
-# than the fresh one, which is the correction that produced these numbers. A
-# freshly started extension host is 471 MB PSS; the same extension host on a
-# reconnected, idle 8 GiB workspace is 713 MB, and the tree around it 1093 MB
-# rather than the 727 MB this design was first calibrated against. "Calibrated
-# against fresh, deployed against resting" is the same error that produced a
-# file-watcher ceiling below what an idle file watcher already held, so the
-# references below are the largest resting figure measured for each role, and
-# a role with no measurement gets none rather than a guess.
+# Why memory.max/8 is gone. It scaled each role with the pod, on the reasoning
+# that a budget reasoned about for an 8 GiB pod would let one helper own a
+# quarter of a 4 GiB one. It was never a bound on the total, and it is meaningless
+# against a fixed envelope: 2048 MiB is 2048 MiB on every pod size. Its protection
+# survives by construction rather than by arithmetic - the largest single share
+# below is 512 MiB, which is exactly memory.max/8 at the smallest pod this
+# template offers, and script-memory-watchdog-test.sh asserts that property at
+# every pod size rather than trusting this sentence.
 #
-# It is not a budget; it is the floor below which a budget is a kill order
-# rather than a limit.
-# A declared budget is never allowed to sit below the role's own resting floor.
-# That is not a style rule, it is what makes the FLOORED report mean anything:
-# see the note above derive_budgets. extensionHost's declared 1024 MiB used to
-# violate it, so that role reported floored=1 at every pod size including a
-# hypothetical 64 GiB one, and the flag documented as "this pod is too small"
-# was in fact a constant. The number below is the one that was already in force.
+# Why PSS and not VmData or RSS. RLIMIT_DATA accounts VmData, which is why the
+# long-removed ceiling measured it; for "is this process holding too much memory"
+# it is wrong by roughly an order of magnitude on a V8 process (measured: file
+# watcher 66 MB resident against 622 MB of data). PSS is what the pod actually
+# pays - shared pages counted once and divided among the sharers - which matters
+# when a dozen node processes share one binary's file-backed pages. RSS would
+# charge each of them the full share.
+ENVELOPE="${WATCHDOG_ENVELOPE:-2147483648}" # 2048 MiB
+
+# The roles inside the envelope. claudeHelper is deliberately not one of them: it
+# is not VS Code, it is not spawned by the editor, and it was sized against a
+# measured adversary rather than against a share of anything.
+ENVELOPE_ROLES=" serverMain extensionHost tsserver treeHelper fileWatcher languageServer extensionHelper "
+
+# The apportionment. Every figure below is a decision about how to divide a fixed
+# 2048 MiB, not an estimate of how large a role "should" be, and the two are not
+# the same kind of number: raising one of these lowers another.
+#
+# The measurements each share is argued against were taken over ~38 hours on the
+# live 8 GiB workspace - one operator, one Terraform/YAML/shell repository, and
+# only *eight distinct processes* behind the whole table. A role sampled 1700
+# times is one process observed 1700 times, not 1700 observations, so none of
+# these is a distribution and none should be read as one. What makes conservative
+# rounding unnecessary here is the oversize rule: under it, a share that turns
+# out to be too small for a legitimate process produces a repeating log line and
+# no kill, so being wrong costs evidence rather than a restart loop.
 declare -gA BUDGET_ROLE=(
-  [extensionHost]=1121452032  # 1069 MiB = 713 MB resting x 1.5. Not the round
-  #                              1024 MiB it reads like: the resting floor took
-  #                              it here unconditionally, so this records the
-  #                              budget the watchdog actually applies rather
-  #                              than an intent it never had.
-  [serverMain]=536870912      #  512 MiB, against 160 MB resting
-  [tsserver]=805306368        #  768 MiB - legitimately large on a big project
-  [languageServer]=268435456  #  256 MiB - yaml/json/terraform LS rest near 100
-  [fileWatcher]=268435456     #  256 MiB, against 34 MB resting
-  [extensionHelper]=536870912 #  512 MiB - terraform-ls, gopls and the like
-  [treeHelper]=536870912      #  512 MiB - see the treeHelper note in role_of.
-  #                              Measured on the live tree, the three processes
-  #                              this role exists for hold 280 MB (an
-  #                              even-better-toml server), 61 MB (tsserver's
-  #                              typingsInstaller) and 54 MB (the built-in
-  #                              markdown server). 512 MiB clears the largest of
-  #                              them with room, and there is deliberately no
-  #                              RESTING_ROLE entry: no member of this role has
-  #                              been measured at rest, which is exactly why it
-  #                              is armed only where an operator asked for it.
-  [claudeHelper]=536870912    #  512 MiB - MCP servers. The operator's number,
-  #                              applied exactly where his instinct is right: a
-  #                              helper that holds 1.66 GB is not doing its job
-  #                              better than one that holds 300 MB.
-)
-declare -gA RESTING_ROLE=(
-  [extensionHost]=747634688 # 713 MB resting (471 MB fresh)
-  [serverMain]=167772160    # 160 MB resting (90 MB on a second measurement)
-  [fileWatcher]=92274688    #  88 MB resting (34 MB fresh)
-  [languageServer]=56623104 #  54 MB resting
+  # The largest single share, and it is allocated by *consequence* rather than by
+  # size: serverMain holds the remote connection, so a wrong kill costs the
+  # operator a disconnect rather than a reload, and it should be the share least
+  # likely to be reached by accident. Observed maximum over the window: 233 MB.
+  # That the biggest share goes to the role with the smallest appetite is a real
+  # cost, roughly 280 MiB, and it is paid on purpose.
+  [serverMain]=536870912 # 512 MiB
+  # The residual, and deliberately the second-largest, because this is the only
+  # role that measurably drifts: its hourly *minimum* climbed 528 -> 686 MiB over
+  # 29 hours and it peaked at 738 MiB.
+  #
+  # It does not fit today, and that is stated rather than papered over: the live
+  # extension host arrived at 610 MB PSS at 11 seconds old and settled at 577 MB
+  # before doing any work, so with today's extension set it is over this share
+  # from birth, is classified oversize, and is reported rather than killed. No
+  # apportionment of 2048 MiB can both keep serverMain the largest share and put
+  # this one above 610 MB - that is arithmetic, not a preference - so the
+  # envelope presupposes a tree that has been trimmed. The trimming happens in
+  # the operator's dotfiles (capped launcher heaps, extensions moved to the
+  # client side) and this template cannot depend on it having been applied. If it
+  # has not, this role degrades to reporting and the other six go on being
+  # enforced; the repeating event=oversize line is exactly the evidence that the
+  # trim has not landed.
+  [extensionHost]=503316480 # 480 MiB
+  # 1.5x the 208 MB maximum observed, on a repository containing no TypeScript at
+  # all - so that figure is a floor of evidence rather than a ceiling. The number
+  # worth quoting is the other one: tsserver is launched with
+  # --max-old-space-size=3072, VS Code's shipped default, observed live on both
+  # instances in this pod. Any share of a 2048 MiB envelope is a fraction of the
+  # heap its own launcher sanctions, which is why the concurrent dotfiles change
+  # caps that ceiling too. Without the cap this share means "report a healthy
+  # tsserver on a large project", not "bound it".
+  [tsserver]=335544320 # 320 MiB
+  # Above the 284 MB maximum observed for the largest member of the role - a
+  # tamasfe.even-better-toml server - with 13% of headroom. The role's other two
+  # measured members hold 61 MB (tsserver's typingsInstaller) and 54 MB (the
+  # built-in markdown server). 256 MiB was considered and rejected: it is below a
+  # member measured on this very workspace, so it would have shipped a role that
+  # was oversize on day one.
+  [treeHelper]=335544320 # 320 MiB
+  # 1.5x the 107 MB maximum observed, which was flat to the megabyte for 28
+  # straight hours. The headroom is for repositories with more files than this
+  # one, since this is the one role whose size is a direct function of what is
+  # being watched.
+  [fileWatcher]=167772160 # 160 MiB
+  # 4x the 31 MB maximum observed (yaml/json/terraform servers). The class
+  # contains much larger members on other ecosystems, and this share does not fit
+  # them; that is the envelope being honest about what 2048 MiB divides into
+  # rather than a claim that a rust-analyzer is 128 MiB.
+  [languageServer]=134217728 # 128 MiB
+  # 5x the 24 MB maximum observed (terraform-ls), with the same caveat: gopls and
+  # rust-analyzer are in this class and are much larger.
+  [extensionHelper]=134217728 # 128 MiB
+  # Outside the envelope. The only budget here anchored on a measured *offender*
+  # rather than on a measured healthy size: the python MCP server holding 1.66 GB
+  # that this whole mechanism was built for. The largest healthy MCP server
+  # measured on this workspace is 142 MB, so this is ~3.6x the honest case and
+  # ~3.2x smaller than the adversary. It sits outside the envelope because an MCP
+  # server is not VS Code and tightening it would buy the editor nothing.
+  [claudeHelper]=536870912 # 512 MiB
 )
-# A budget is never allowed below the role's measured resting size times this,
-# whatever the pod arithmetic says. This is the guard against the class of error
-# that has already bitten this design twice.
-# These are hand measurements with a review trigger and no automatic upkeep, and
-# that is deliberate. Deriving them from observation would mean the watchdog
-# raising the limit it is enforcing whenever the thing it is enforcing against
-# grew - the same move the circuit breaker refuses to make, one level removed.
-# The trigger instead is the `role_peak_mb` field of the hourly census and the
-# `peak_pss` line of the summary file: when a role's peak sits persistently above
-# its figure here while never dwelling over budget, the figure is stale and a
-# human re-measures it. Checked while writing this: the live extension host read
-# 685 MB PSS at 27.6 hours of uptime, i.e. below the 713 MB recorded below, so
-# the reference is not stale today and the growth is not monotonic - V8 does hand
-# memory back.
-RESTING_FACTOR_NUM="${WATCHDOG_RESTING_NUM:-3}"
-RESTING_FACTOR_DEN="${WATCHDOG_RESTING_DEN:-2}"
-# No single helper may be budgeted more than this share of the pod. The workspace
-# is offered at 4 and 8 GiB; without it, a budget reasoned about for the larger
-# pod lets one helper own a quarter of the smaller one.
-POD_SHARE_DEN="${WATCHDOG_POD_SHARE_DEN:-8}"
-
-# Which roles each mode may signal. The first split is by blast radius, not by
-# size: nothing in the helper set is visible to the operator when it restarts,
-# and both members of the editor set are.
-HELPER_ROLES=" tsserver languageServer fileWatcher extensionHelper claudeHelper "
-EDITOR_ROLES=" extensionHost serverMain "
-# The third set is on a different axis entirely, and the axis is *calibration*
-# rather than blast radius: a treeHelper is a process this watchdog is sure it
-# should be watching and has no measured resting size for. Its budget is a
-# reasoned guess, and a guessed budget applied to a process whose legitimate
-# resting size is larger than the guess is a kill loop - which is the specific
-# failure this design has already shipped twice. So the unknown set is measured,
-# budgeted, dwell-tracked and reported in every mode, and signalled only under
-# enforce-all, where the operator has already said he accepts restarts he can
-# see. Until then a coverage gap arrives as `event=would-kill armed=no` in the
-# container log instead of as silence.
-UNKNOWN_ROLES=" treeHelper "
+
+# The order every budget is reported in. A literal role list at the reporting
+# call site is a place for a fully-enforced budget to go unreported, so the order
+# is declared once here and the test suite asserts it names every declared role
+# and nothing else.
+BUDGET_ORDER="serverMain extensionHost tsserver treeHelper fileWatcher languageServer extensionHelper claudeHelper"
 
 # Filled by derive_budgets().
-declare -gA BUDGET=() FLOORED=()
+declare -gA BUDGET=()
 
 # Only processes at or above this are written to the sweep log, plus every
 # process the watchdog is policing regardless of size. The floor keeps a sweep
@@ -280,12 +316,20 @@ declare -gA P_COMM=() P_CMD=() P_ARGV0=() P_PPID=() P_RSS=() P_PSS=() P_START=()
 declare -gA CHILDREN=() SERVER_TREE=() PROTECTED=() NOT_EDITOR=() PROTECT_REASON=() WATCHDOG_KIN=()
 declare -gA POLICED=() CLAUDE_ROOTS=()
 declare -ga PIDS=() SERVER_ROOTS=()
-declare -gA OVER_SINCE=() KILLED_AT=() KILL_TIMES=() DISARMED=() KILLS=()
+declare -gA OVER_SINCE=() KILLED_AT=() KILL_TIMES=() KILLS=()
+# FIT_SEEN[pid:starttime] is set the first time a process is observed at or
+# below its budget while old enough to have finished starting up. It is the
+# whole of the oversize rule: no entry means this process has never fitted, and
+# nothing that has never fitted is signalled. Keyed on pid:starttime like every
+# other piece of carried state, so a recycled pid cannot inherit the evidence.
+declare -gA FIT_SEEN=()
 # Per-role aggregates, recomputed each sweep (SUM) and kept for the life of the
 # watchdog (PEAK). Neither drives any decision - see the note on aggregation in
-# sweep_once - and PEAK is the review trigger for RESTING_ROLE, which is a hand
-# measurement with no other way to tell that it has gone stale.
+# sweep_once - and PEAK is how a share that no longer matches the workload
+# becomes visible to a human without the loop reacting to it.
 declare -gA ROLE_SUM_PSS=() ROLE_PEAK_PSS=()
+TREE_PSS=0
+OVERSIZE_N=0
 SERVER_PID=""
 ROLE=other
 GUARD=""
@@ -311,64 +355,71 @@ LAST_CENSUS_AT=0
 STARTED_AT=${WATCHDOG_NOW:-$EPOCHSECONDS}
 
 # --------------------------------------------------------------------------- #
-# derivation - one pure function of memory.max; no state, no I/O
+# derivation - now a copy, and that is the point
 # --------------------------------------------------------------------------- #
 
-# Sets BUDGET from memory.max. An explicit WATCHDOG_BUDGET_<role> wins outright,
-# which is how a budget is pinned for an experiment without editing the script.
+# Sets BUDGET. There is nothing to derive: a share of a fixed envelope is a
+# constant, so this copies the declared table and honours an explicit
+# WATCHDOG_BUDGET_<role>, which is how a number is tried on a live workspace
+# without editing the script.
 #
-# The two clamps pull in opposite directions and the order matters. The pod share
-# is applied first because it expresses what the pod can afford; the resting
-# floor is applied second because it expresses what the process demonstrably
-# needs, and when those disagree the process wins. A budget below resting usage
-# is not a conservative budget, it is a kill loop written down.
+# It deliberately takes no arguments. It used to take memory.max, and taking it
+# again would invite a term that scales a share with the pod - which is exactly
+# what the envelope replaced.
 derive_budgets() {
-  local max=$1 role want share floor var
-  share=$((max / POD_SHARE_DEN))
+  local role var
   BUDGET=()
-  FLOORED=()
   for role in "${!BUDGET_ROLE[@]}"; do
     var="WATCHDOG_BUDGET_${role}"
     if [[ -n ${!var:-} ]]; then
       BUDGET[$role]=${!var}
       continue
     fi
-    want=${BUDGET_ROLE[$role]}
-    ((want > share)) && want=$share
-    floor=$(((${RESTING_ROLE[$role]:-0} * RESTING_FACTOR_NUM) / RESTING_FACTOR_DEN))
-    # The floor winning is not an error, but it is worth saying out loud: it
-    # means this pod is too small to bound this role at the share it was meant
-    # to have, and the role keeps its budget because the alternative is a kill
-    # loop. On the 8 GiB workspace the extension host reaches this, which is why
-    # it is reported rather than silently applied.
-    #
-    # That reading only holds while every *declared* budget is already at or
-    # above its own resting floor, because then the only thing that can push
-    # `want` below the floor is the pod share. It did not hold before: the
-    # extension host's declared 1024 MiB was below its own 1069 MiB floor, so
-    # floored=1 was true at 4, 8, 16 and 64 GiB alike and said nothing about the
-    # pod at all. The declared number is now the one in force, and
-    # script-memory-watchdog-test.sh asserts the invariant directly rather than
-    # asserting the flag's value on one pod size.
-    if ((want < floor)); then
-      want=$floor
-      FLOORED[$role]=1
-    fi
-    BUDGET[$role]=$want
+    BUDGET[$role]=${BUDGET_ROLE[$role]}
   done
   return 0
 }
 
+# The sum of the shares actually in force for the roles inside the envelope. This
+# is what makes an override visible as a change to the total rather than as a
+# change to one line, and it is what the census reports against.
+envelope_in_force() {
+  local role total=0
+  for role in ${ENVELOPE_ROLES}; do
+    total=$((total + ${BUDGET[$role]:-0}))
+  done
+  printf '%s' "$total"
+}
+
+# enforce-all is the retired third mode. It asked for a superset of enforce that
+# no longer exists, so it is honoured as enforce rather than dropped to observe:
+# a workspace that had asked for more enforcement must not silently get none.
+# Anything unrecognised still falls back to the inert mode - this is the last
+# line of defence for a value that has already been through Terraform's
+# allowlist, and it is a function rather than a case inside main() so that the
+# test suite can reach it.
+normalise_mode() {
+  case "$MODE" in
+  observe | enforce) ;;
+  enforce-all) MODE=enforce ;;
+  *) MODE=observe ;;
+  esac
+  return 0
+}
+
 # True when the mode may signal this role at all.
+#
+# There is no per-role arming any more. Every role with a budget is armed under
+# enforce, because a role inside the envelope that cannot be signalled is a share
+# that is not enforced, and an envelope with unenforced shares is a description
+# of the tree rather than a bound on it. What separates a role that should be
+# killed from one that should only be reported is not the role - it is whether
+# the individual process ever fitted, which sweep_once decides per process.
 role_is_armed() {
   local role=$1
-  [[ -n ${DISARMED[$role]:-} ]] && return 1
+  [[ -n ${BUDGET[$role]:-} ]] || return 1
   case "$MODE" in
-  enforce) [[ $HELPER_ROLES == *" $role "* ]] ;;
-  enforce-all)
-    [[ $HELPER_ROLES == *" $role "* || $EDITOR_ROLES == *" $role "* ||
-      $UNKNOWN_ROLES == *" $role "* ]]
-    ;;
+  enforce) return 0 ;;
   *) return 1 ;;
   esac
 }
@@ -947,10 +998,10 @@ role_of() {
       # The alternative to inverting is to keep adding a regex per extension.
       # It is easier and it rots; worse, it fails *silently*, which is the one
       # property this mechanism cannot afford. Inverting fails the other way -
-      # loudly, in a role whose budget is admittedly a guess - so the guess is
-      # made safe by arming rather than by hoping: treeHelper is in
-      # UNKNOWN_ROLES, so enforce (the template default) reports it and never
-      # signals it. See the note there.
+      # loudly. The risk it buys - a share applied to a process whose legitimate
+      # size is larger than the share - used to be paid for by arming this role
+      # separately; it is now paid for by the oversize rule, which spares any
+      # process that has never fitted, in every role alike.
       ROLE=treeHelper
     else
       ROLE=other
@@ -1268,8 +1319,15 @@ signal_pid() {
   return 0
 }
 
-# The circuit breaker. Called after a kill; decides whether this role has stopped
-# being a drifting role and started being a loop.
+# Called after a kill. It counts, and it reports a rate; it disarms nothing.
+#
+# What it used to do - permanently disarm a role after LOOP_KILLS kills in
+# LOOP_WINDOW - is described at LOOP_WINDOW above and was removed with the
+# envelope, not lost. The loop it guarded against is now impossible by
+# construction (see the oversize rule in sweep_once), and under a deliberate cap
+# repeated kills are a fact about the workload rather than proof of a wrong
+# number. What is left is worth saying out loud, because a role being recycled
+# every twenty minutes is a sizing decision somebody should look at.
 record_kill() {
   local role=$1 now=$2
   local t keep="" n=0 all="" na=0
@@ -1297,13 +1355,10 @@ record_kill() {
   KILL_TIMES_ALL=$all
 
   if ((n >= LOOP_KILLS)); then
-    DISARMED[$role]=1
-    record_action "event=disarmed role=${role} reason=kill-loop kills=${n} window_s=${LOOP_WINDOW} budget_mb=$((${BUDGET[$role]:-0} / MIB)) detail=@a role that has to be killed this often does not have a drift problem, it has a wrong budget; raise WATCHDOG_BUDGET_${role} or accept the size, but this watchdog will not keep restarting it@"
+    record_action "event=kill-rate role=${role} kills=${n} window_s=${LOOP_WINDOW} budget_mb=$((${BUDGET[$role]:-0} / MIB)) enforcing=yes detail=@this role is being recycled often enough to be worth a look; enforcement continues - raise WATCHDOG_BUDGET_${role}, change the envelope, or make the process smaller@"
   fi
   if ((na >= GLOBAL_LOOP_KILLS)); then
-    local r
-    for r in "${!BUDGET[@]}"; do DISARMED[$r]=1; done
-    record_action "event=disarmed role=all reason=global-kill-loop kills=${na} window_s=${LOOP_WINDOW} detail=@too many kills across roles for the budgets to be right; enforcement is off until the watchdog restarts@"
+    record_action "event=kill-rate role=all kills=${na} window_s=${LOOP_WINDOW} enforcing=yes detail=@kills across several roles in one window; the apportionment may not fit this workload@"
   fi
   return 0
 }
@@ -1327,6 +1382,9 @@ prune_state() {
   for key in "${!KILLED_AT[@]}"; do
     [[ -n ${live[$key]:-} ]] || unset 'KILLED_AT[$key]'
   done
+  for key in "${!FIT_SEEN[@]}"; do
+    [[ -n ${live[$key]:-} ]] || unset 'FIT_SEEN[$key]'
+  done
   return 0
 }
 
@@ -1350,15 +1408,25 @@ prune_state() {
 #    distinguish "one process drifting" from "processes being created", and the
 #    second is a supervisor's business, not this loop's.
 #
-# What is done instead is the cheap half: ROLE_SUM_PSS is computed every sweep
-# and reported in the census, so the evasion is visible as data the moment it
-# starts happening, and a future decision to act on it would begin from a
-# measurement rather than from this argument.
+# The envelope makes this hole more visible rather than less, and it is worth
+# saying exactly what it does and does not claim. 2048 MiB is enforced as an
+# *apportionment*: seven shares that add up to it, each compared against one
+# process at a time. It is not enforced as a sum, so a role with three members
+# can hold three times its share without any single process being over budget.
+#
+# So the sum is measured instead. TREE_PSS is computed every sweep, published in
+# the census as tree_pss_mb/envelope_pct and in the summary, and written into the
+# TOTAL row of every sweep. An envelope whose total was never computed would be a
+# number nobody could check; one that is computed and published is a claim a
+# reviewer can falsify from the log. Acting on it - shedding by total rather than
+# by process - is deliberately not attempted: that is the graded ladder this file
+# used to contain, which was removed because a poll loop cannot see the events it
+# was reacting to.
 sweep_once() {
   local now=$1
   local pid role budget pss key over_since over_s state guard id cmd age
   local -a rows=()
-  local policed_n=0 over_n=0 killed_n=0 total_pss=0
+  local policed_n=0 over_n=0 killed_n=0 total_pss=0 oversize_n=0
 
   read_uptime
   read_process_table
@@ -1369,6 +1437,7 @@ sweep_once() {
   prune_state
 
   ROLE_SUM_PSS=()
+  TREE_PSS=0
 
   TOP_ROLE=""
   TOP_ID=""
@@ -1388,6 +1457,21 @@ sweep_once() {
     # the aggregation note above sweep_once.
     ROLE_SUM_PSS[$role]=$((${ROLE_SUM_PSS[$role]:-0} + pss))
     ((pss > ${ROLE_PEAK_PSS[$role]:-0})) && ROLE_PEAK_PSS[$role]=$pss
+    # What the envelope is a claim about. Enforcement is per process (see the
+    # aggregation note above) so this total is measured and published rather than
+    # acted on - but an envelope whose total was never computed would be a number
+    # nobody could check.
+    [[ ${ENVELOPE_ROLES} == *" ${role} "* ]] && TREE_PSS=$((TREE_PSS + pss))
+
+    # The oversize rule, stated once: a process counts as having fitted only if
+    # it was seen at or below its budget while old enough to have finished
+    # starting up. Without the age test the flag would be set by whichever sweep
+    # happened to catch a process a second after exec, when everything is small -
+    # which would make the classification a function of sweep timing rather than
+    # of the process.
+    if ((budget > 0 && age >= MIN_AGE && pss <= budget)); then
+      FIT_SEEN[$key]=1
+    fi
 
     id="$(identity_of "$pid" "$role")"
     if ((budget > 0)) && ((pss * 100 / budget > TOP_PCT)); then
@@ -1430,13 +1514,28 @@ sweep_once() {
           if ((now - KILLED_AT[$key] >= KILL_GRACE)); then
             if signal_pid KILL "$pid" "$role" "drift ${role}"; then
               state=killed-9
-              record_action "event=kill sig=KILL pid=${pid} role=${role} id=${id} pss_mb=$((pss / MIB)) budget_mb=$((budget / MIB)) over_s=${over_s} after_disarm=$([[ -n ${DISARMED[$role]:-} ]] && printf yes || printf no) detail=@still over budget ${KILL_GRACE}s after SIGTERM@"
+              record_action "event=kill sig=KILL pid=${pid} role=${role} id=${id} pss_mb=$((pss / MIB)) budget_mb=$((budget / MIB)) over_s=${over_s} detail=@still over budget ${KILL_GRACE}s after SIGTERM@"
             fi
           else
             state=terminating
           fi
-        elif [[ -n ${DISARMED[$role]:-} ]]; then
-          state=disarmed
+        elif [[ -z ${FIT_SEEN[$key]:-} ]]; then
+          # Structurally over budget rather than drifted into it: this process
+          # has never been observed inside its share since it started, so killing
+          # it accomplishes nothing - the replacement arrives over budget too, and
+          # that is a kill loop with a supervisor's restart in the middle of it.
+          #
+          # It is reported instead, on the same once-per-dwell cadence as
+          # would-kill, and it is reported forever: the loop cannot silence
+          # itself, cannot widen the budget, and re-arms the moment a replacement
+          # is seen fitting. The known gap is a process that is born far too big
+          # and then grows further; the watchdog will record it and never signal
+          # it. That is accepted, because a process born at ten times its share is
+          # not the drift this loop polices, and the sweep log names it either way.
+          state=oversize
+          ((oversize_n += 1))
+          record_action "event=oversize pid=${pid} role=${role} id=${id} pss_mb=$((pss / MIB)) budget_mb=$((budget / MIB)) over_s=${over_s} age_s=${age} detail=@never observed inside its share since it started; killing it would not make the replacement smaller@"
+          OVER_SINCE[$key]=$now
         elif ! role_is_armed "$role"; then
           # Observe mode, or a role this mode does not arm. Report the kill that
           # would have happened, then restart the dwell clock so the same process
@@ -1478,13 +1577,14 @@ sweep_once() {
     rows+=("${now}"$'\t'"${SWEEPS}"$'\t'"${pid}"$'\t'"${P_START[$pid]:-0}"$'\t'"unmanaged"$'\t'"seen"$'\t'"$((pss / 1024))"$'\t'"$((${P_RSS[$pid]:-0} / 1024))"$'\t'"${P_AGE[$pid]:-0}"$'\t'"0"$'\t'"0"$'\t'"${guard}"$'\t'"${P_COMM[$pid]:-unknown}"$'\t'"${cmd:0:160}")
   done
 
-  rows+=("${now}"$'\t'"${SWEEPS}"$'\t'"0"$'\t'"0"$'\t'"TOTAL"$'\t'"${PRESSURE}"$'\t'"$((total_pss / 1024))"$'\t'"0"$'\t'"0"$'\t'"0"$'\t'"0"$'\t'"-"$'\t'"policed=${policed_n},over=${over_n},killed=${killed_n},procs=${#PIDS[@]},tree=${#SERVER_TREE[@]},sessions=${#CLAUDE_ROOTS[@]}"$'\t'"h=${M_H},u=${M_U},psi=${M_PSI_CENTI},mode=${MODE}")
+  rows+=("${now}"$'\t'"${SWEEPS}"$'\t'"0"$'\t'"0"$'\t'"TOTAL"$'\t'"${PRESSURE}"$'\t'"$((total_pss / 1024))"$'\t'"0"$'\t'"0"$'\t'"0"$'\t'"0"$'\t'"-"$'\t'"policed=${policed_n},over=${over_n},oversize=${oversize_n},killed=${killed_n},procs=${#PIDS[@]},tree=${#SERVER_TREE[@]},sessions=${#CLAUDE_ROOTS[@]},tree_mb=$((TREE_PSS / MIB)),envelope_mb=$((ENVELOPE / MIB))"$'\t'"h=${M_H},u=${M_U},psi=${M_PSI_CENTI},mode=${MODE}")
   append_sweep "${rows[@]}"
   printf '%s\n' "$SWEEP_HEADER" "${rows[@]}" >"${STATE_DIR}/sweep.latest.tmp" &&
     mv -f "${STATE_DIR}/sweep.latest.tmp" "${STATE_DIR}/sweep.latest"
 
   POLICED_N=$policed_n
   OVER_N=$over_n
+  OVERSIZE_N=$oversize_n
   publish_top
   return 0
 }
@@ -1527,14 +1627,13 @@ check_visibility() {
 # the pod is gone; and it is the trend series for the standing population - the
 # thing this watchdog exists to bound - at 24 lines a day rather than 40,000.
 emit_census() {
-  local now=$1 role disarmed="" sums="" peaks=""
-  for role in "${!DISARMED[@]}"; do disarmed+="${role} "; done
+  local now=$1 role sums="" peaks=""
   # The per-role total is what makes the un-fixed aggregation hole observable
-  # (see the note above sweep_once), and the per-role peak is the review trigger
-  # for RESTING_ROLE. Neither is acted on: a watchdog that re-derived its own
-  # floor from what it observed would raise the limit it is enforcing every time
-  # the thing it is enforcing against grew, which is the one move this design
-  # forbids outright.
+  # (see the note above sweep_once), and the per-role peak is how a share that no
+  # longer matches the workload becomes visible. Neither is acted on: a watchdog
+  # that re-derived a limit from what it observed would raise the limit it is
+  # enforcing every time the thing it enforces against grew, which is the one
+  # move this design forbids outright.
   for role in "${!ROLE_SUM_PSS[@]}"; do
     sums+="${role}=$((${ROLE_SUM_PSS[$role]} / MIB)) "
   done
@@ -1544,7 +1643,8 @@ emit_census() {
   LAST_CENSUS_AT=$now
   record_action "event=census sweeps=${SWEEPS} uptime_s=$((now - STARTED_AT))" \
     "policed=${POLICED_N:-0} over_budget=${OVER_N:-0} sessions=${#CLAUDE_ROOTS[@]}" \
-    "tree=${#SERVER_TREE[@]} kills_total=${KILLS_TOTAL} disarmed=@${disarmed% }@" \
+    "tree=${#SERVER_TREE[@]} kills_total=${KILLS_TOTAL} oversize=${OVERSIZE_N:-0}" \
+    "envelope_mb=$((ENVELOPE / MIB)) tree_pss_mb=$((${TREE_PSS:-0} / MIB)) envelope_pct=$((${TREE_PSS:-0} * 100 / ENVELOPE))" \
     "h_mb=$((M_H / MIB)) u_mb=$((M_U / MIB)) pressure=${PRESSURE} psi_full10=${M_PSI_CENTI}" \
     "top_role=${TOP_ROLE:-none} top_id=${TOP_ID:-none} top_pss_mb=$((${TOP_PSS:-0} / MIB))" \
     "top_budget_pct=${TOP_PCT:-0} role_pss_mb=@${sums% }@ role_peak_mb=@${peaks% }@"
@@ -1563,11 +1663,12 @@ publish_summary() {
     printf 'policed=%d over_budget=%d sessions=%d tree=%d\n' \
       "${POLICED_N:-0}" "${OVER_N:-0}" "${#CLAUDE_ROOTS[@]}" "${#SERVER_TREE[@]}"
     for role in "${!BUDGET[@]}"; do
-      line+="${role}=$((${BUDGET[$role]} / MIB))M"
-      [[ -n ${DISARMED[$role]:-} ]] && line+="(disarmed)"
-      line+=" "
+      line+="${role}=$((${BUDGET[$role]} / MIB))M "
     done
     printf 'budgets %s\n' "$line"
+    printf 'envelope=%dM tree_pss=%dM tree_pct=%d oversize=%d\n' \
+      "$((ENVELOPE / MIB))" "$((${TREE_PSS:-0} / MIB))" \
+      "$((${TREE_PSS:-0} * 100 / ENVELOPE))" "${OVERSIZE_N:-0}"
     line=""
     for role in "${!KILLS[@]}"; do line+="${role}:${KILLS[$role]} "; done
     printf 'kills total=%d by_role=%s last=%s\n' \
@@ -1577,10 +1678,9 @@ publish_summary() {
     # number for one event.
     line=""
     for role in "${!ROLE_PEAK_PSS[@]}"; do line+="${role}=$((${ROLE_PEAK_PSS[$role]} / MIB))M "; done
-    # The largest each role has been since this watchdog started. It is the only
-    # standing evidence that RESTING_ROLE - a hand measurement taken once - has
-    # drifted away from what the workload actually does, and it is reported for a
-    # human to act on rather than fed back into the budgets.
+    # The largest each role has been since this watchdog started. It is the
+    # standing evidence that a share no longer matches the workload, and it is
+    # reported for a human to act on rather than fed back into the budgets.
     printf 'peak_pss %s\n' "${line:-none}"
     printf 'kill_rate_per_day=%d.%02d\n' \
       "$((KILLS_TOTAL * 86400 / up))" "$((KILLS_TOTAL * 86400 * 100 / up % 100))"
@@ -1659,14 +1759,20 @@ cycle_once() {
   ((rc == 0)) || return 1
 
   if ((${#BUDGET[@]} == 0)); then
-    derive_budgets "$M_MAX"
-    local role
-    for role in extensionHost serverMain tsserver languageServer fileWatcher extensionHelper treeHelper claudeHelper; do
-      record_action "event=budget role=${role} budget_mb=$((${BUDGET[$role]} / MIB)) pod_share_mb=$((M_MAX / POD_SHARE_DEN / MIB)) resting_mb=$((${RESTING_ROLE[$role]:-0} / MIB)) floored=${FLOORED[$role]:-0} armed=$(role_is_armed "$role" && printf yes || printf no)"
+    derive_budgets
+    local role in_force
+    in_force=$(envelope_in_force)
+    for role in ${BUDGET_ORDER}; do
+      record_action "event=budget role=${role} budget_mb=$((${BUDGET[$role]} / MIB)) envelope=$([[ ${ENVELOPE_ROLES} == *" ${role} "* ]] && printf yes || printf no) envelope_pct=$((${BUDGET[$role]} * 100 / ENVELOPE)) armed=$(role_is_armed "$role" && printf yes || printf no)"
     done
-    record_action "event=budgets_derived memory_max_mb=$((M_MAX / MIB)) dwell_s=${DWELL_SECONDS} min_age_s=${MIN_AGE} loop_window_s=${LOOP_WINDOW} loop_kills=${LOOP_KILLS} armed=@$(
-      for role in "${!BUDGET[@]}"; do role_is_armed "$role" && printf '%s ' "$role"; done
+    record_action "event=budgets_derived memory_max_mb=$((M_MAX / MIB)) envelope_mb=$((ENVELOPE / MIB)) shares_sum_mb=$((in_force / MIB)) dwell_s=${DWELL_SECONDS} min_age_s=${MIN_AGE} loop_window_s=${LOOP_WINDOW} loop_kills=${LOOP_KILLS} armed=@$(
+      for role in ${BUDGET_ORDER}; do role_is_armed "$role" && printf '%s ' "$role"; done
     )@"
+    # The shares are constants that must add up to the envelope. An override, or
+    # an edit that changes one number without changing another, breaks that - and
+    # it must say so rather than leaving a total nobody can reconstruct from the
+    # log.
+    ((in_force == ENVELOPE)) || record_action "event=warning reason=envelope-mismatch shares_sum_mb=$((in_force / MIB)) envelope_mb=$((ENVELOPE / MIB)) detail=@the shares in force do not add up to the envelope; a budget override or an edit has changed the total@"
   fi
 
   read_cgroup_pressure
@@ -1724,12 +1830,7 @@ main() {
   CSV_LINES=$(count_lines "${STATE_DIR}/calibration.csv")
   SWEEP_LINES=$(count_lines "${STATE_DIR}/sweep.log")
 
-  case "$MODE" in
-  observe | enforce | enforce-all) ;;
-  *)
-    MODE=observe
-    ;;
-  esac
+  normalise_mode
 
   if ! acquire_singleton; then
     printf 'memory-watchdog: another instance is already running\n' >&2