The composition root's memory plan: one solver that partitions the effective heap ceiling between named tenants whose sum is bounded by the ceiling, so the budgets compose instead of each claiming an independent share of the same bytes.

With an effective ceiling H (Ecluse.Rts, what the RTS actually runs with), the tenants are, in allocation order:

1. The runtime reserve: GC copying headroom, stacks, buffers, and the RTS itself, taken off the top; everything else partitions the remainder (the application heap).
2. Fixed buffers: the mirror enqueue hand-off buffer, charged whenever any mount mirrors (whatever the backend).
3. The cache aggregate: ONE byte budget for all three metadata stores, split into their named sub-budgets at planCacheConfig (the split sums to the aggregate, so the cache can never triple its tenant).
4. The material aggregate: response materialisation working space. The admission capacity is max 1 (min A_cpu A_mem) -- the CPU-derived capacity (Ecluse.Composition.Sizing) jointly bounded by what the material share can actually hold, one envelope (packumentOriginFanout concurrent origins, each wire+parsed at expandWireBytes) per admitted operation.
5. The publish aggregate: the total bytes concurrently buffered publish bodies may hold (the byte-admission the publish pipeline acquires before reading a body), present only when a publication target is configured.
6. The queue tenant: the in-memory mirror queue's depth, charged only when the memory backend was selected (the selection precedes this plan; an SQS deployment spends no heap on queued jobs).
7. The mirror-artifact tenant: the transient publish envelope one back-fill job holds, charged whenever any mount mirrors (the same predicate as the fixed buffer). The worker buffers a fetched tarball whole and base64-encodes it into a strict publish document, so the tarball bytes, the base64 Text, and the serialised document coexist before GC at roughly mirrorArtifactEnvelopeMultiplier times the tarball; the worker's per-artifact byte cap (matMaxBytes) is this share divided back down by that multiplier, so the envelope the cap admits is what the tenant charges (issue #846).

The combined invariant -- reserve + cache + material + publish + queue + fixed buffers + mirror-artifact within the ceiling -- is enforced by construction for computed shares. Explicit overrides are re-checked by attribution, described under degradation below: a pin refuses the boot only when it is what a fitting plan cannot shed around, never on mere presence.

Graceful degradation, never a refusal

A pod too small for the tenants' normal floors sheds in a documented priority order, each step a loud boot warning naming what was given up and why: first the mirror-artifact cap shrinks, ultimately to zero (the background back-fill leg gives way before the serve hot path, so a starved pod protects its cache and admission and mirrors nothing it cannot buffer safely); then the cache aggregate shrinks below its floor, ultimately to zero (the proxy serves uncached); then admission shrinks toward one in-flight operation (and, where the nursery is the real pressure, the capability count sheds with it, automating the smaller-cores recommendation); then the publish aggregate shrinks to one maximum request; then the queue depth to its floor. One operation on one capability with no cache is the irreducible minimum and __always boots__ -- if even that exceeds the ceiling, the plan says so in its loudest warning and boots anyway (the cgroup backstop is then the guard).

Only an explicit operator override refuses the boot, and only when it is the cause. The plan re-derives the override-free minimum (every pin substituted out, every computed tenant at its floor) and refuses just when that minimum fits the ceiling while the pinned plan does not, naming the pins whose individual removal would fit (all of them when only their combination overshoots). A pin at or below the value the shed ladder would compute anyway pushes the plan past nothing and never refuses; a pod too small even without the pins boots with the loud warning like any other. An override is an operator claim, and a claim that alone breaks the ceiling is a misconfiguration to fix, not to shrink around.

With no ceiling datapoint at all, every bound falls back to the shipped values that predate the plan. An explicit config value always wins its own bound, and every decision returns a provenance line for the boot log.