@bridge4dev/runner 0.56.0 → 0.58.1

package/dist/protocol.d.ts

@@ -1,5 +1,6 @@
 import { z } from 'zod';
 import type { HostLoadFrame } from './host-load.js';
+import type { SessionLimitsFrame } from './session-limits.js';
 export declare const SessionDescriptorSchema: z.ZodObject<{
     id: z.ZodString;
     kind: z.ZodEnum<["TICKET", "CHAT"]>;
@@ -102,8 +103,8 @@ export declare const SessionDescriptorSchema: z.ZodObject<{
         budgetMinutes: z.ZodNullable<z.ZodNumber>;
     }, "strip", z.ZodTypeAny, {
         path: string;
-        trustMode: "STRICT" | "NORMAL" | "AUTO";
         id: string;
+        trustMode: "STRICT" | "NORMAL" | "AUTO";
         projectId: string;
         budgetUsd: number | null;
         budgetMinutes: number | null;
@@ -115,8 +116,8 @@ export declare const SessionDescriptorSchema: z.ZodObject<{
         agentAllowDestructiveGit?: boolean | undefined;
     }, {
         path: string;
-        trustMode: "STRICT" | "NORMAL" | "AUTO";
         id: string;
+        trustMode: "STRICT" | "NORMAL" | "AUTO";
         projectId: string;
         budgetUsd: number | null;
         budgetMinutes: number | null;
@@ -208,8 +209,8 @@ export declare const SessionDescriptorSchema: z.ZodObject<{
 }, "strip", z.ZodTypeAny, {
     mode: "ask" | "plan" | "auto" | "full";
     agent: "CLAUDE" | "CODEX";
-    id: string;
     status: "RUNNING" | "FAILED" | "STARTING" | "WAITING_INPUT" | "WAITING_PERMISSION" | "REVIEW" | "DONE" | "STOPPED";
+    id: string;
     kind: "TICKET" | "CHAT";
     model: string | null;
     effort: string | null;
@@ -222,8 +223,8 @@ export declare const SessionDescriptorSchema: z.ZodObject<{
     extraBudgetMinutes: number | null;
     workspace: {
         path: string;
-        trustMode: "STRICT" | "NORMAL" | "AUTO";
         id: string;
+        trustMode: "STRICT" | "NORMAL" | "AUTO";
         projectId: string;
         budgetUsd: number | null;
         budgetMinutes: number | null;
@@ -256,15 +257,15 @@ export declare const SessionDescriptorSchema: z.ZodObject<{
     } | undefined;
 }, {
     agent: "CLAUDE" | "CODEX";
-    id: string;
     status: "RUNNING" | "FAILED" | "STARTING" | "WAITING_INPUT" | "WAITING_PERMISSION" | "REVIEW" | "DONE" | "STOPPED";
+    id: string;
     kind: "TICKET" | "CHAT";
     prompt: string;
     providerSessionId: string | null;
     workspace: {
         path: string;
-        trustMode: "STRICT" | "NORMAL" | "AUTO";
         id: string;
+        trustMode: "STRICT" | "NORMAL" | "AUTO";
         projectId: string;
         budgetUsd: number | null;
         budgetMinutes: number | null;
@@ -520,8 +521,8 @@ export declare const GatewayFrameSchema: z.ZodDiscriminatedUnion<"type", [z.ZodO
             budgetMinutes: z.ZodNullable<z.ZodNumber>;
         }, "strip", z.ZodTypeAny, {
             path: string;
-            trustMode: "STRICT" | "NORMAL" | "AUTO";
             id: string;
+            trustMode: "STRICT" | "NORMAL" | "AUTO";
             projectId: string;
             budgetUsd: number | null;
             budgetMinutes: number | null;
@@ -533,8 +534,8 @@ export declare const GatewayFrameSchema: z.ZodDiscriminatedUnion<"type", [z.ZodO
             agentAllowDestructiveGit?: boolean | undefined;
         }, {
             path: string;
-            trustMode: "STRICT" | "NORMAL" | "AUTO";
             id: string;
+            trustMode: "STRICT" | "NORMAL" | "AUTO";
             projectId: string;
             budgetUsd: number | null;
             budgetMinutes: number | null;
@@ -626,8 +627,8 @@ export declare const GatewayFrameSchema: z.ZodDiscriminatedUnion<"type", [z.ZodO
     }, "strip", z.ZodTypeAny, {
         mode: "ask" | "plan" | "auto" | "full";
         agent: "CLAUDE" | "CODEX";
-        id: string;
         status: "RUNNING" | "FAILED" | "STARTING" | "WAITING_INPUT" | "WAITING_PERMISSION" | "REVIEW" | "DONE" | "STOPPED";
+        id: string;
         kind: "TICKET" | "CHAT";
         model: string | null;
         effort: string | null;
@@ -640,8 +641,8 @@ export declare const GatewayFrameSchema: z.ZodDiscriminatedUnion<"type", [z.ZodO
         extraBudgetMinutes: number | null;
         workspace: {
             path: string;
-            trustMode: "STRICT" | "NORMAL" | "AUTO";
             id: string;
+            trustMode: "STRICT" | "NORMAL" | "AUTO";
             projectId: string;
             budgetUsd: number | null;
             budgetMinutes: number | null;
@@ -674,15 +675,15 @@ export declare const GatewayFrameSchema: z.ZodDiscriminatedUnion<"type", [z.ZodO
         } | undefined;
     }, {
         agent: "CLAUDE" | "CODEX";
-        id: string;
         status: "RUNNING" | "FAILED" | "STARTING" | "WAITING_INPUT" | "WAITING_PERMISSION" | "REVIEW" | "DONE" | "STOPPED";
+        id: string;
         kind: "TICKET" | "CHAT";
         prompt: string;
         providerSessionId: string | null;
         workspace: {
             path: string;
-            trustMode: "STRICT" | "NORMAL" | "AUTO";
             id: string;
+            trustMode: "STRICT" | "NORMAL" | "AUTO";
             projectId: string;
             budgetUsd: number | null;
             budgetMinutes: number | null;
@@ -721,8 +722,8 @@ export declare const GatewayFrameSchema: z.ZodDiscriminatedUnion<"type", [z.ZodO
     sessions: {
         mode: "ask" | "plan" | "auto" | "full";
         agent: "CLAUDE" | "CODEX";
-        id: string;
         status: "RUNNING" | "FAILED" | "STARTING" | "WAITING_INPUT" | "WAITING_PERMISSION" | "REVIEW" | "DONE" | "STOPPED";
+        id: string;
         kind: "TICKET" | "CHAT";
         model: string | null;
         effort: string | null;
@@ -735,8 +736,8 @@ export declare const GatewayFrameSchema: z.ZodDiscriminatedUnion<"type", [z.ZodO
         extraBudgetMinutes: number | null;
         workspace: {
             path: string;
-            trustMode: "STRICT" | "NORMAL" | "AUTO";
             id: string;
+            trustMode: "STRICT" | "NORMAL" | "AUTO";
             projectId: string;
             budgetUsd: number | null;
             budgetMinutes: number | null;
@@ -775,15 +776,15 @@ export declare const GatewayFrameSchema: z.ZodDiscriminatedUnion<"type", [z.ZodO
 }, {
     sessions: {
         agent: "CLAUDE" | "CODEX";
-        id: string;
         status: "RUNNING" | "FAILED" | "STARTING" | "WAITING_INPUT" | "WAITING_PERMISSION" | "REVIEW" | "DONE" | "STOPPED";
+        id: string;
         kind: "TICKET" | "CHAT";
         prompt: string;
         providerSessionId: string | null;
         workspace: {
             path: string;
-            trustMode: "STRICT" | "NORMAL" | "AUTO";
             id: string;
+            trustMode: "STRICT" | "NORMAL" | "AUTO";
             projectId: string;
             budgetUsd: number | null;
             budgetMinutes: number | null;
@@ -953,8 +954,8 @@ export declare const GatewayFrameSchema: z.ZodDiscriminatedUnion<"type", [z.ZodO
             budgetMinutes: z.ZodNullable<z.ZodNumber>;
         }, "strip", z.ZodTypeAny, {
             path: string;
-            trustMode: "STRICT" | "NORMAL" | "AUTO";
             id: string;
+            trustMode: "STRICT" | "NORMAL" | "AUTO";
             projectId: string;
             budgetUsd: number | null;
             budgetMinutes: number | null;
@@ -966,8 +967,8 @@ export declare const GatewayFrameSchema: z.ZodDiscriminatedUnion<"type", [z.ZodO
             agentAllowDestructiveGit?: boolean | undefined;
         }, {
             path: string;
-            trustMode: "STRICT" | "NORMAL" | "AUTO";
             id: string;
+            trustMode: "STRICT" | "NORMAL" | "AUTO";
             projectId: string;
             budgetUsd: number | null;
             budgetMinutes: number | null;
@@ -1059,8 +1060,8 @@ export declare const GatewayFrameSchema: z.ZodDiscriminatedUnion<"type", [z.ZodO
     }, "strip", z.ZodTypeAny, {
         mode: "ask" | "plan" | "auto" | "full";
         agent: "CLAUDE" | "CODEX";
-        id: string;
         status: "RUNNING" | "FAILED" | "STARTING" | "WAITING_INPUT" | "WAITING_PERMISSION" | "REVIEW" | "DONE" | "STOPPED";
+        id: string;
         kind: "TICKET" | "CHAT";
         model: string | null;
         effort: string | null;
@@ -1073,8 +1074,8 @@ export declare const GatewayFrameSchema: z.ZodDiscriminatedUnion<"type", [z.ZodO
         extraBudgetMinutes: number | null;
         workspace: {
             path: string;
-            trustMode: "STRICT" | "NORMAL" | "AUTO";
             id: string;
+            trustMode: "STRICT" | "NORMAL" | "AUTO";
             projectId: string;
             budgetUsd: number | null;
             budgetMinutes: number | null;
@@ -1107,15 +1108,15 @@ export declare const GatewayFrameSchema: z.ZodDiscriminatedUnion<"type", [z.ZodO
         } | undefined;
     }, {
         agent: "CLAUDE" | "CODEX";
-        id: string;
         status: "RUNNING" | "FAILED" | "STARTING" | "WAITING_INPUT" | "WAITING_PERMISSION" | "REVIEW" | "DONE" | "STOPPED";
+        id: string;
         kind: "TICKET" | "CHAT";
         prompt: string;
         providerSessionId: string | null;
         workspace: {
             path: string;
-            trustMode: "STRICT" | "NORMAL" | "AUTO";
             id: string;
+            trustMode: "STRICT" | "NORMAL" | "AUTO";
             projectId: string;
             budgetUsd: number | null;
             budgetMinutes: number | null;
@@ -1154,8 +1155,8 @@ export declare const GatewayFrameSchema: z.ZodDiscriminatedUnion<"type", [z.ZodO
     session: {
         mode: "ask" | "plan" | "auto" | "full";
         agent: "CLAUDE" | "CODEX";
-        id: string;
         status: "RUNNING" | "FAILED" | "STARTING" | "WAITING_INPUT" | "WAITING_PERMISSION" | "REVIEW" | "DONE" | "STOPPED";
+        id: string;
         kind: "TICKET" | "CHAT";
         model: string | null;
         effort: string | null;
@@ -1168,8 +1169,8 @@ export declare const GatewayFrameSchema: z.ZodDiscriminatedUnion<"type", [z.ZodO
         extraBudgetMinutes: number | null;
         workspace: {
             path: string;
-            trustMode: "STRICT" | "NORMAL" | "AUTO";
             id: string;
+            trustMode: "STRICT" | "NORMAL" | "AUTO";
             projectId: string;
             budgetUsd: number | null;
             budgetMinutes: number | null;
@@ -1205,15 +1206,15 @@ export declare const GatewayFrameSchema: z.ZodDiscriminatedUnion<"type", [z.ZodO
 }, {
     session: {
         agent: "CLAUDE" | "CODEX";
-        id: string;
         status: "RUNNING" | "FAILED" | "STARTING" | "WAITING_INPUT" | "WAITING_PERMISSION" | "REVIEW" | "DONE" | "STOPPED";
+        id: string;
         kind: "TICKET" | "CHAT";
         prompt: string;
         providerSessionId: string | null;
         workspace: {
             path: string;
-            trustMode: "STRICT" | "NORMAL" | "AUTO";
             id: string;
+            trustMode: "STRICT" | "NORMAL" | "AUTO";
             projectId: string;
             budgetUsd: number | null;
             budgetMinutes: number | null;
@@ -1673,7 +1674,22 @@ export type RunnerFrame = {
  */
  | ({
     type: 'host_load';
-} & HostLoadFrame) | {
+} & HostLoadFrame)
+/**
+ * How this machine is dividing its memory between the sessions on it, right
+ * now (#398 S4).
+ *
+ * Machine-scoped with a `sessions` array rather than one frame per session:
+ * half of what has to be shown is about the MACHINE — what is free, what is
+ * held by things that are not DevBridge, how many guarantees fit — and a
+ * machine with no live sessions still has to be able to say it.
+ *
+ * Sent only when it moved, on the same tick that recomputes it. Fields mirror
+ * `@devbridge/shared` — see `session-limits.ts`.
+ */
+ | ({
+    type: 'session_limits';
+} & SessionLimitsFrame) | {
     type: 'pong';
 };
 //# sourceMappingURL=protocol.d.ts.map

package/dist/recipe-schema.d.ts

@@ -134,17 +134,17 @@ export declare const ProjectRecipeSchema: z.ZodObject<{
             env?: Record<string, string> | undefined;
             timeoutSec?: number | undefined;
         } | undefined;
-        verify?: {
+        test?: {
             run: string;
             env?: Record<string, string> | undefined;
             timeoutSec?: number | undefined;
         } | undefined;
-        build?: {
+        verify?: {
             run: string;
             env?: Record<string, string> | undefined;
             timeoutSec?: number | undefined;
         } | undefined;
-        test?: {
+        build?: {
             run: string;
             env?: Record<string, string> | undefined;
             timeoutSec?: number | undefined;
@@ -160,17 +160,17 @@ export declare const ProjectRecipeSchema: z.ZodObject<{
             env?: Record<string, string> | undefined;
             timeoutSec?: number | undefined;
         } | undefined;
-        verify?: {
+        test?: {
             run: string;
             env?: Record<string, string> | undefined;
             timeoutSec?: number | undefined;
         } | undefined;
-        build?: {
+        verify?: {
             run: string;
             env?: Record<string, string> | undefined;
             timeoutSec?: number | undefined;
         } | undefined;
-        test?: {
+        build?: {
             run: string;
             env?: Record<string, string> | undefined;
             timeoutSec?: number | undefined;
@@ -219,17 +219,17 @@ export declare const ProjectRecipeSchema: z.ZodObject<{
             env?: Record<string, string> | undefined;
             timeoutSec?: number | undefined;
         } | undefined;
-        verify?: {
+        test?: {
             run: string;
             env?: Record<string, string> | undefined;
             timeoutSec?: number | undefined;
         } | undefined;
-        build?: {
+        verify?: {
             run: string;
             env?: Record<string, string> | undefined;
             timeoutSec?: number | undefined;
         } | undefined;
-        test?: {
+        build?: {
             run: string;
             env?: Record<string, string> | undefined;
             timeoutSec?: number | undefined;
@@ -268,17 +268,17 @@ export declare const ProjectRecipeSchema: z.ZodObject<{
             env?: Record<string, string> | undefined;
             timeoutSec?: number | undefined;
         } | undefined;
-        verify?: {
+        test?: {
             run: string;
             env?: Record<string, string> | undefined;
             timeoutSec?: number | undefined;
         } | undefined;
-        build?: {
+        verify?: {
             run: string;
             env?: Record<string, string> | undefined;
             timeoutSec?: number | undefined;
         } | undefined;
-        test?: {
+        build?: {
             run: string;
             env?: Record<string, string> | undefined;
             timeoutSec?: number | undefined;

package/dist/self-update.js

@@ -5,6 +5,7 @@ import path from 'node:path';
 import { promisify } from 'node:util';
 import { findClaudeCli, USE_BUNDLED_CLAUDE } from './agent-binary.js';
 import { systemdUserEnv } from './environment.js';
+import { cageAuthority, CageAuthorityError } from './cage-authority.js';
 import { log } from './log.js';
 import { stateDir } from './paths.js';
 import { RUNNER_VERSION } from './version.js';
@@ -386,8 +387,28 @@ function systemctlEnv() {
     return env;
 }
 export async function selfUpdate(options) {
+    /**
+     * The default executor installs software on somebody's machine and reloads
+     * their systemd, so it asks the same door the cages ask (#403).
+     *
+     * The check is on the DEFAULT and not on the injected one: a test hands its
+     * own executor and is testing the sequence of commands, which is exactly what
+     * it should be able to do. What must not happen is a call with no executor
+     * from a process that has no business updating anything — `npm install -g`
+     * from a vitest worker would be the incident of 10.09.2026 with a much longer
+     * tail.
+     */
     const exec = options.exec ??
-        ((file, args, opts) => execFileAsync(file, args, { timeout: opts.timeout, env: opts.env, maxBuffer: 4_000_000 }));
+        ((file, args, opts) => {
+            if (cageAuthority() === 'none') {
+                throw new CageAuthorityError(`this process may not run «${file}»: updating this machine's runner is the daemon's job`);
+            }
+            return execFileAsync(file, args, {
+                timeout: opts.timeout,
+                env: opts.env,
+                maxBuffer: 4_000_000,
+            });
+        });
     const fromVersion = RUNNER_VERSION;
     const fail = (detail, extra = {}) => ({
         ok: false,

package/dist/service-unit.d.ts

@@ -57,7 +57,7 @@ export declare function buildUnit(execStart?: string, nodeBinary?: string): stri
  * which is the only way to fix the servers that already have the bad numbers
  * baked in — and it never overwrites a unit the operator edited by hand.
  */
-export declare const LIMITS_VERSION = 5;
+export declare const LIMITS_VERSION = 6;
 /**
  * Where the agent sessions live once they have a cage of their own.
  *
@@ -239,6 +239,19 @@ export declare function managedUsageFloorBytes(facts: MemoryFacts): number;
  *  - cap 85 % of total: on an idle dedicated box `MemAvailable` is nearly the whole
  *    machine, and a ceiling of «everything» is the bug this function exists to fix.
  */
+/**
+ * What the machine keeps for itself, whatever the agents are doing.
+ *
+ * Enough for sshd, journald, the kernel and some page cache to keep working
+ * while our cgroups sit at their ceiling. Proportional on a big machine,
+ * absolute on a small one, because 15 % of 4 GB is not enough to stay reachable.
+ *
+ * Hoisted out of {@link memoryPolicy} for #398 S3: the live allocator has to
+ * subtract exactly the same reserve when it decides how much of the machine is
+ * free right now, and a second copy of this number would drift from this one on
+ * the first machine where it mattered.
+ */
+export declare function machineReserveBytes(totalBytes: number): number;
 export declare function memoryPolicy(facts: MemoryFacts, minCeilingBytes?: number): MemoryPolicy;
 /** `SwapTotal` of this machine, or null where `/proc/meminfo` will not say. */
 export declare function readSwapTotalBytes(): number | null;
@@ -418,7 +431,24 @@ export declare function buildLimitsOverride(cpuCount?: number, facts?: MemoryFac
  *                can measure one (the drift check treats a file with no
  *                `MemoryMax` as outdated).
  */
-export declare function buildSessionsSliceOverride(facts?: MemoryFacts | null, sessionsUsageBytes?: number | null): string;
+export declare function buildSessionsSliceOverride(facts?: MemoryFacts | null, sessionsUsageBytes?: number | null, maxSessions?: number): string;
+/**
+ * Where the collective brake sits under the collective ceiling.
+ *
+ * Nine tenths: close enough that the sessions get almost the whole pot before
+ * anything is throttled, far enough that the kernel has a tenth of the pot in
+ * which to slow everyone down and reclaim, instead of arriving at the hard
+ * ceiling and choosing a victim.
+ */
+export declare const SLICE_BRAKE_OF_CEILING = 0.9;
+/**
+ * Seats assumed when nobody has said otherwise.
+ *
+ * Three, which is what `DevServer.maxSessions` defaults to in the database. The
+ * runner's own config may say fewer; the slice's protection is sized for the
+ * seats the machine sells, not for the sessions that happen to be running.
+ */
+export declare const DEFAULT_MAX_SESSIONS = 3;
 /**
  * The CPU share of everything the agents run, against the daemon's own.
  *
@@ -453,7 +483,9 @@ export declare function limitsOverrideIsOutdated(readFile?: (p: string) => strin
  * arrive at the same number — otherwise a write whose floor was binding would be
  * seen as drifted on the very next call and rewritten forever.
  */
-export declare function writeLimitsOverride(force?: boolean, home?: string, facts?: MemoryFacts | null, sessionsUsageBytes?: number | null): boolean;
+export declare function writeLimitsOverride(force?: boolean, home?: string, facts?: MemoryFacts | null, sessionsUsageBytes?: number | null, 
+/** Seats this machine sells — sizes the slice's collective `MemoryLow` (#398 S3). */
+maxSessions?: number): boolean;
 /**
  * Does the installed unit point at something that no longer exists?
  *

package/dist/service-unit.js

@@ -129,7 +129,7 @@ export function buildUnit(execStart, nodeBinary = process.execPath) {
  * which is the only way to fix the servers that already have the bad numbers
  * baked in — and it never overwrites a unit the operator edited by hand.
  */
-export const LIMITS_VERSION = 5;
+export const LIMITS_VERSION = 6;
 const LIMITS_MARKER = '# devbridge-limits-version:';
 /** `zz-` so it sorts last: an operator's own drop-in should still win. */
 const LIMITS_FILE = 'zz-devbridge-limits.conf';
@@ -277,6 +277,21 @@ const CEILING_FLOOR_BYTES = 2 * GIB;
  *  - cap 85 % of total: on an idle dedicated box `MemAvailable` is nearly the whole
  *    machine, and a ceiling of «everything» is the bug this function exists to fix.
  */
+/**
+ * What the machine keeps for itself, whatever the agents are doing.
+ *
+ * Enough for sshd, journald, the kernel and some page cache to keep working
+ * while our cgroups sit at their ceiling. Proportional on a big machine,
+ * absolute on a small one, because 15 % of 4 GB is not enough to stay reachable.
+ *
+ * Hoisted out of {@link memoryPolicy} for #398 S3: the live allocator has to
+ * subtract exactly the same reserve when it decides how much of the machine is
+ * free right now, and a second copy of this number would drift from this one on
+ * the first machine where it mattered.
+ */
+export function machineReserveBytes(totalBytes) {
+    return Math.max(1.5 * GIB, totalBytes * 0.15);
+}
 export function memoryPolicy(facts, minCeilingBytes = managedUsageFloorBytes(facts)) {
     const { totalBytes, availableBytes, ownUsageBytes, sessionsUsageBytes, uptimeSec } = facts;
     const swapMaxBytes = Math.floor(Math.max(0, facts.swapTotalBytes ?? 0) * SESSIONS_SWAP_SHARE);
@@ -307,7 +322,7 @@ export function memoryPolicy(facts, minCeilingBytes = managedUsageFloorBytes(fac
     // Enough for sshd, journald, the kernel and some page cache to keep working
     // while the cgroup sits at its ceiling. Proportional on a big machine, absolute
     // on a small one, because 15 % of 4 GB is not enough to stay reachable.
-    const reserve = Math.max(1.5 * GIB, totalBytes * 0.15);
+    const reserve = machineReserveBytes(totalBytes);
     // Both cgroups are added back, and for the same reason ours always was: what
     // they hold is already OUT of `MemAvailable`, so leaving the sessions out
     // makes a loaded machine look starved and walks the ceiling down under the
@@ -682,7 +697,7 @@ const MANAGED_HEADER = [
  *                can measure one (the drift check treats a file with no
  *                `MemoryMax` as outdated).
  */
-export function buildSessionsSliceOverride(facts = readMemoryFacts(), sessionsUsageBytes = readSessionsSliceUsageOrNull()) {
+export function buildSessionsSliceOverride(facts = readMemoryFacts(), sessionsUsageBytes = readSessionsSliceUsageOrNull(), maxSessions = DEFAULT_MAX_SESSIONS) {
     const memory = facts ? memoryPolicy(facts) : null;
     return ([
         ...MANAGED_HEADER,
@@ -691,6 +706,41 @@ export function buildSessionsSliceOverride(facts = readMemoryFacts(), sessionsUs
             ? [
                 `# ${memory.measured ? 'measured headroom' : 'still booting — conservative fraction of total'}`,
                 `MemoryMax=${asMiB(memory.maxBytes)}`,
+                /**
+                 * The COLLECTIVE brake, and the thing that makes #398 S3 safe.
+                 *
+                 * Since S3 each session's own brake is deliberately oversold — every
+                 * session may grow into everything that is free — so the sum of the
+                 * brakes is larger than this slice. That is only safe while THIS
+                 * line exists: as the sessions together approach the ceiling the
+                 * kernel slows all of them and reclaims first from whoever is above
+                 * their `MemoryLow`, and the hard ceiling above, where the OOM
+                 * killer picks a victim across the whole slice, is never reached.
+                 *
+                 * Measured on this host before it existed: the slice read
+                 * `MemoryHigh=infinity`, overflowing it ended in a kill rather than
+                 * throttling, and the one killed was the neighbour sitting under its
+                 * own limit (`memory.events` of the victim: `high 0, max 0, oom 0,
+                 * oom_kill 1`). The allocator reads this property back and falls
+                 * back to a non-oversold formula when it is not in force.
+                 */
+                `MemoryHigh=${asMiB(Math.floor(memory.maxBytes * SLICE_BRAKE_OF_CEILING))}`,
+                /**
+                 * …and the protection the guarantees are built on.
+                 *
+                 * `memory.low` of a child is bounded by its ancestors' protection:
+                 * without this line a session's own `MemoryLow` protects nothing at
+                 * all. Deliberately a CONSTANT (seats × one guarantee), not the sum
+                 * of the guarantees of the sessions that happen to be live: the sum
+                 * changes on every start and finish, the slice is never rewritten
+                 * live (a blocker QA found on 07.09 — a rewritten slice kills the
+                 * sessions under it), so a number that depended on the live roster
+                 * would be true for the hour after this file is written and a lie
+                 * for the rest of it. What separates one session from another lives
+                 * on their own scopes; this line only gives them the right to be
+                 * protected at all.
+                 */
+                `MemoryLow=${asMiB(Math.min(Math.max(1, maxSessions) * SESSION_GUARANTEE_BYTES, memory.maxBytes))}`,
             ]
             : unmeasuredSliceCeiling(sessionsUsageBytes)),
         // The line the cage is built on. See `session-cage.ts` and the note above.
@@ -701,6 +751,31 @@ export function buildSessionsSliceOverride(facts = readMemoryFacts(), sessionsUs
         'CPUAccounting=yes',
     ].join('\n') + '\n');
 }
+/**
+ * Where the collective brake sits under the collective ceiling.
+ *
+ * Nine tenths: close enough that the sessions get almost the whole pot before
+ * anything is throttled, far enough that the kernel has a tenth of the pot in
+ * which to slow everyone down and reclaim, instead of arriving at the hard
+ * ceiling and choosing a victim.
+ */
+export const SLICE_BRAKE_OF_CEILING = 0.9;
+/**
+ * The guarantee one session gets, in the one place the slice needs to know it.
+ *
+ * Copied rather than imported from `session-allocator.ts`: that module imports
+ * `session-cage.ts`, which imports this one, and the cycle would be real. The
+ * two are compared by a test (`service-unit.test.ts`) so they cannot drift.
+ */
+const SESSION_GUARANTEE_BYTES = 2048 * MIB;
+/**
+ * Seats assumed when nobody has said otherwise.
+ *
+ * Three, which is what `DevServer.maxSessions` defaults to in the database. The
+ * runner's own config may say fewer; the slice's protection is sized for the
+ * seats the machine sells, not for the sessions that happen to be running.
+ */
+export const DEFAULT_MAX_SESSIONS = 3;
 /**
  * The `[Slice]` lines for a machine whose memory the policy could not measure.
  * See {@link buildSessionsSliceOverride} for why each of the three answers is
@@ -853,7 +928,9 @@ function swapShareHasDrifted(contents, facts) {
  * arrive at the same number — otherwise a write whose floor was binding would be
  * seen as drifted on the very next call and rewritten forever.
  */
-export function writeLimitsOverride(force = false, home = systemdUserHome(), facts = readMemoryFacts(), sessionsUsageBytes = readSessionsSliceUsageOrNull()) {
+export function writeLimitsOverride(force = false, home = systemdUserHome(), facts = readMemoryFacts(), sessionsUsageBytes = readSessionsSliceUsageOrNull(), 
+/** Seats this machine sells — sizes the slice's collective `MemoryLow` (#398 S3). */
+maxSessions = DEFAULT_MAX_SESSIONS) {
     // Unknown usage can be a busy service whose systemd query timed out. Do not
     // replace an existing drop-in with a guessed percentage, or remove a limit
     // by rewriting the file without its MemoryMax line. Defer the whole policy.
@@ -866,7 +943,7 @@ export function writeLimitsOverride(force = false, home = systemdUserHome(), fac
     // them is a machine whose sessions are capped but whose daemon is not
     // prioritised — the regression described on `buildDevbridgeSliceOverride`.
     write(limitsOverridePath(home), buildLimitsOverride(undefined, facts));
-    write(sessionsSliceOverridePath(home), buildSessionsSliceOverride(facts, sessionsUsageBytes));
+    write(sessionsSliceOverridePath(home), buildSessionsSliceOverride(facts, sessionsUsageBytes, maxSessions));
     write(devbridgeSliceOverridePath(home), buildDevbridgeSliceOverride());
     return true;
 }