Parent: MEMY-894. Evidence from the third salt freeze of 2026-08-08 (boot 2c9ed26b, died 12:30:45 UTC).

What happened

The whole guard ring went down before the machine did, in the order that matters least-first:

time (UTC)	event
12:22:00	blackbox loses 28 s of samples
12:27:04	blackbox loses 62 s
12:28:02	`corpus-loadgate` watchdog timeout (limit 1min), killed with SIGABRT
12:28:20	loadgate dumps core, `Failed with result "watchdog"`
12:28:23	blackbox loses 79 s
12:29:11	loadgate restart #1 — `start operation timed out` (45 s)
12:30:02	loadgate restart #2 — timed out
12:30:07	loadgate restart #3 — never completed
12:30:45	host dies

corpus-gpuguard followed the identical pattern. The flight recorder lost its three longest gaps of the entire boot in the final eight minutes — precisely the window it exists to record.

Why

All three guards run with no reclaim protection at all, inside the slice that caused the incident:

Slice=app.slice          # app.slice reached 44.2 GiB during the fatal window
MemoryMin=0
MemoryLow=0
IOSchedulingClass=2      # best-effort, priority 4, in a 99% io-pressure storm
OOMScoreAdjust=200       # identical to every other user process
Restart=always
TimeoutStartUSec=45s
WatchdogUSec=1min

MemoryHigh=128M is not the cause — loadgate peaked at 49.7 MiB, so it never bound. The 35.1 MiB swap peak came from global reclaim under swappiness=120. Raising MemoryHigh would change nothing; MemoryMin and io priority are the real levers.

Restart=always + a 45 s start timeout is actively harmful here: it forked a fresh Python interpreter into a machine at 99% io pressure three times in the last two minutes of its life.

Second gap: merged is not live

The io-pressure rung merged to main at 08:27 UTC. The crash was at 12:30 UTC. The running corpus-loadgate process had been up since 07:05 UTC and still held the pre-merge code in memory — Python does not reload modules from disk. Nothing ties "antifreeze code landed" to "guard restarted", so a shipped fix can sit inert for hours while the failure it prevents recurs.

Fix direction

Reclaim protection: non-zero MemoryMin on all three guards so global reclaim cannot take their working set.
io priority: the guards must read /proc and append a line while the disk is saturated.
Get them out of app.slice, or otherwise ensure the slice they sample cannot starve them.
Restart policy: back off instead of storming; a guard that cannot start under thrash should not retry every 5 s.
Watchdog: a starved recorder should degrade (log the gap, keep sampling) rather than SIGABRT itself out of existence at the moment of peak interest.
A mechanism that restarts the guards when their code changes.

OOMScoreAdjust cannot go negative without CAP_SYS_RESOURCE — do not propose that.

Acceptance criteria

[x] All three guard units carry reclaim + io protection; verified against the live unit properties via systemctl --user show, never against the file just written (this epic has been burned by that three times). MemoryMin (64M loadgate/gpuguard, 96M blackbox) + IOSchedulingPriority=0 landed, applied live, verified. Bound named in the build report: effective protection is capped by user@$UID.service's own root-owned ~250M memory.min, already oversubscribed by session.slice's 1G claim -- raising that ceiling is a separate, root-gated follow-up, not attempted here.
[x] Restart storm replaced with bounded backoff. RestartSteps=4 + RestartMaxDelaySec=5min (real exponential backoff) + StartLimitIntervalSec=0 (moved to [Unit], where it belongs) so backing off can never become permanently parking in failed.
[~] Watchdog behaviour reconsidered so a stalled recorder logs a gap instead of aborting. Unit layer only: WatchdogSignal=SIGTERM (was SIGABRT, no more coredump into the storm) + WatchdogSec raised (60->180s, 90->240s). The sampling/ladder loop itself noticing starvation and logging a gap lives in monitor.py/cli.py/sample.py -- out of this card's file scope (MEMY-1147/MEMY-1149 own those).
[~] Guards restart when their code lands; demonstrated end to end. refresh_path()/refresh_service() built, rendered, unit-tested, installed live (inactive, per install()'s existing "never enable/start" contract). ExecCondition gating and the restart command proven live via direct systemd-run probes with trace files; the full inotify-PathChanged-to-restart chain could not be exercised end to end in this session (a transient, pre-existing, unrelated host job-queue backlog blocked it; it has since cleared) -- and it has no live effect regardless, since the refresh units are not enabled on the real guards.
[x] Unit-generation tests updated in step with the change. 261 tests across test_loadgate.py/test_blackbox.py/test_gpuguard.py, all passing.

Branch agent/MEMY-1148-protect-the-antifreeze-guards-from-the-pressure, commit c25417c6. Committed, not merged -- awaiting launcher review via agent-worktree merge. Full build report (live systemctl transcript, cgroup ancestor-chain reading, stale defer-flag defect, and the loadgate-FREEZE-on-restart anomaly against already-merged MEMY-1147) in the spec-executor's final response to the launch, not yet a filed journal/reports/ document.