@@ -928,8 +928,8 @@ codebase-memory-mcp config set watcher_enabled false     # stop the watcher thre
 codebase-memory-mcp config set watch_non_git true        # also poll non-git project roots (default: false)
 codebase-memory-mcp config set index_max_files 250000    # optional per-index source-file limit
 codebase-memory-mcp config set index_max_source_mb 16384 # optional per-index source-size limit
-codebase-memory-mcp config set index_max_rss_mb 8192     # optional worker-tree current RSS limit
-codebase-memory-mcp config set index_max_duration_seconds 3600 # optional total worker duration
+codebase-memory-mcp config set index_max_rss_mb 8192     # optional worker-tree charged-memory limit
+codebase-memory-mcp config set index_max_duration_seconds 3600 # optional per-request duration
 codebase-memory-mcp config reset auto_index              # reset to default
 ```
 
 
@@ -93,8 +93,8 @@ Current keys:
 | `watch_non_git` | `false` | Also poll project roots that are **not git repositories**. By default the watcher only follows git projects, so a project indexed from a plain directory is never refreshed after its first index — reindex it manually with `index_repository`. Set `true` to poll such roots on the same adaptive cadence with a file-tree scan: the indexer's own discovery walk (same skip lists, `.gitignore` and `.cbmignore` rules) hashed over each file's path, size and mtime. Any change reindexes once; paths the indexer skips (including cbm's own `.codebase-memory/` output) never trigger. The first poll after the daemon starts reindexes each such project once, since nothing records which tree state the index holds. The scan walks the whole tree every poll, so it costs more than git polling on very large trees. Read once when the daemon starts, like `watcher_enabled`. |
 | `index_max_files` | `off` | Optional maximum number of accepted source files in one discovery run. |
 | `index_max_source_mb` | `off` | Optional maximum accepted source size in MiB in one discovery run. |
-| `index_max_rss_mb` | `off` | Optional maximum current RSS in MiB for the complete contained index-worker process tree (`64..1048576`). |
-| `index_max_duration_seconds` | `off` | Optional maximum total worker duration in seconds (`1..86400`). |
+| `index_max_rss_mb` | `off` | Optional maximum charged memory in MiB for the complete contained index-worker process tree (`64..1048576`). On macOS this is phys_footprint, not resident size. |
+| `index_max_duration_seconds` | `off` | Optional maximum wall-clock duration in seconds for the whole index request, including crash/hang recovery (`1..86400`). |
 
 For a watched project, `index_status` names the polling method in `watch.strategy`:
 `git` (HEAD and dirty-state polling), `tree` (a non-git root polled by the
 
@@ -27,24 +27,30 @@ ranges are rejected without changing the stored value.
 
 | Key | Default | Accepted value | Protects |
 |---|---:|---:|---|
-| `index_max_rss_mb` | `off` | `off` or `64..1048576` | Current RSS of the complete worker process tree |
-| `index_max_duration_seconds` | `off` | `off` or `1..86400` | Total worker wall-clock duration |
+| `index_max_rss_mb` | `off` | `off` or `64..1048576` | Charged memory of the complete worker process tree |
+| `index_max_duration_seconds` | `off` | `off` or `1..86400` | Wall-clock duration of the whole index request |
 
 ```bash
 codebase-memory-mcp config set index_max_rss_mb 8192
 codebase-memory-mcp config set index_max_duration_seconds 3600
 ```
 
-RSS is the current resident memory of the contained worker and every descendant,
-not the worker's allocation budget and not peak memory. This hard watchdog is
+RSS is the charged memory of the contained worker and every descendant, not
+the worker's allocation budget and not peak memory. On macOS that quantity is
+`phys_footprint` (the same number `cbm_mem_charged()` enforces), not
+`resident_size`, which still counts pages the allocator has already handed
+back. Linux and Windows use RSS / working set. This hard watchdog is
 separate from the internal `CBM_MEM_BUDGET_MB` soft budget. The supervisor
-samples RSS at most once every 250 milliseconds so the watchdog does not turn
-full process-table enumeration into a busy loop.
-
-Duration uses a monotonic clock from successful spawn. It is independent of the
-existing 15-minute quiet timeout: continuous log progress does not reset total
-duration, while the quiet timeout continues to identify a worker that stops
-making progress.
+samples the tree at most once every 250 milliseconds so the watchdog does not
+turn full process-table enumeration into a busy loop.
+
+Duration is per request: the clock starts at the first worker spawn and is
+not reset when crash/hang recovery starts a later attempt. Continuous log
+progress does not reset it. It is independent of the existing 15-minute quiet
+timeout, which still identifies a worker that stops making progress. A
+duration limit shorter than that quiet timeout kills a hung worker before hang
+quarantine can name the in-flight file, so the next attempt may hang on the
+same file.
 
 Equality is allowed. The first RSS or elapsed-duration observation above its
 limit starts the existing graceful-to-force process-tree shutdown. CBM reports
 
@@ -7603,8 +7603,9 @@ static const config_key_def_t CONFIG_KEYS[] = {
     {CBM_CONFIG_UI_PORT, "9749", "Port for the graph UI listener when enabled"},
     {CBM_INDEX_CONFIG_MAX_FILES, "off", "Max accepted source files per index, or off"},
     {CBM_INDEX_CONFIG_MAX_SOURCE_MB, "off", "Max accepted source MiB per index, or off"},
-    {CBM_INDEX_CONFIG_MAX_RSS_MB, "off", "Max worker process-tree RSS MiB, or off"},
-    {CBM_INDEX_CONFIG_MAX_DURATION_SECONDS, "off", "Max worker duration in seconds, or off"},
+    {CBM_INDEX_CONFIG_MAX_RSS_MB, "off", "Max worker process-tree charged memory MiB, or off"},
+    {CBM_INDEX_CONFIG_MAX_DURATION_SECONDS, "off",
+     "Max wall-clock seconds for the whole index request, or off"},
 };
 
 /* #1558: ui_enabled and ui_port were reachable ONLY by hand-editing
 
@@ -159,6 +159,7 @@ struct cbm_daemon_application_job {
      * job outlives the request and session that started it. */
     bool async_owned;
     bool worker_started;
+    uint64_t request_started_ms;
     cbm_daemon_application_job_t *next;
 };
 
@@ -361,6 +362,7 @@ static void application_worker_diagnostic(const char *line, void *context) {
 static int application_worker_start_default(void *context, const char *args_json,
                                             size_t memory_budget_bytes, const char *marker_file,
                                             const char *quarantine_file,
+                                            uint64_t duration_origin_ms,
                                             cbm_daemon_application_worker_t *worker_out) {
     (void)context;
     cbm_index_resource_policy_t resource_policy;
@@ -382,7 +384,7 @@ static int application_worker_start_default(void *context, const char *args_json
     yyjson_doc_free(args_doc);
     int result = cbm_index_worker_start_with_policy_log(
         args_json, memory_budget_bytes, &resource_policy, false, marker_file, quarantine_file,
-        application_worker_diagnostic, worker, &worker->handle);
+        application_worker_diagnostic, worker, duration_origin_ms, &worker->handle);
     if (result != 0) {
         application_worker_destroy_default(NULL, worker);
         *worker_out = NULL;
@@ -1377,10 +1379,13 @@ static application_attempt_status_t application_job_run_attempt(cbm_daemon_appli
     }
 
     cbm_daemon_application_worker_t worker = NULL;
+    if (job->request_started_ms == 0) {
+        job->request_started_ms = cbm_index_worker_now_ms();
+    }
     application_tmp_lock();
-    int start_result =
-        application->worker_ops.start(application->worker_ops.context, job->args_json,
-                                      memory_budget_bytes, marker_path, quarantine_path, &worker);
+    int start_result = application->worker_ops.start(
+        application->worker_ops.context, job->args_json, memory_budget_bytes, marker_path,
+        quarantine_path, job->request_started_ms, &worker);
     application_tmp_unlock();
     if (start_result != 0 || !worker) {
         return application_job_cancel_requested(job) ? APPLICATION_ATTEMPT_CANCELLED
 
@@ -31,7 +31,7 @@ typedef void *cbm_daemon_application_update_worker_t;
 typedef struct {
     void *context;
     int (*start)(void *context, const char *args_json, size_t memory_budget_bytes,
-                 const char *marker_file, const char *quarantine_file,
+                 const char *marker_file, const char *quarantine_file, uint64_t duration_origin_ms,
                  cbm_daemon_application_worker_t *worker_out);
     cbm_index_worker_poll_t (*poll)(void *context, cbm_daemon_application_worker_t worker,
                                     const cbm_index_worker_result_t **result_out);
 
@@ -513,6 +513,12 @@ static cbm_proc_tree_rss_status_t cbm_subprocess_tree_rss_platform(cbm_subproces
     bool root_failed = false;
     for (DWORD index = 0; index < processes->NumberOfProcessIdsInList; index++) {
         DWORD pid = (DWORD)processes->ProcessIdList[index];
+        /* GetProcessMemoryInfo documents PROCESS_QUERY_INFORMATION |
+         * PROCESS_VM_READ. PROCESS_QUERY_LIMITED_INFORMATION is a lesser
+         * alternative on newer Windows; the Job Object membership list
+         * already closes most of the pid-reuse window between listing and
+         * opening. A member we cannot open is a probe failure when it is
+         * the root. */
         HANDLE member = OpenProcess(PROCESS_QUERY_INFORMATION | PROCESS_VM_READ, FALSE, pid);
         if (!member) {
             root_failed = root_failed || pid == process->process_id;
@@ -592,7 +598,11 @@ static cbm_proc_tree_rss_status_t cbm_subprocess_tree_rss_platform(cbm_subproces
             root_failed = root_failed || pids[index] == process->pid;
             continue;
         }
-        cbm_rss_add_saturated(&total, usage.ri_resident_size);
+        /* phys_footprint is what the OS charges, matching cbm_mem_charged().
+         * ri_resident_size still counts pages mimalloc already marked
+         * MADV_FREE_REUSABLE, so a Mac worker can look like 17 GB RSS while
+         * the kernel holds it to 5.5 GB. */
+        cbm_rss_add_saturated(&total, usage.ri_phys_footprint);
         measured++;
     }
     cbm_free(CBM_MEM_CLASS_OTHER, pids);
 
@@ -155,10 +155,12 @@ int cbm_subprocess_spawn(const cbm_proc_opts_t *opts, cbm_subprocess_t **out);
  * tree when cancel_grace_ms elapses. Callers must keep polling to make progress. */
 cbm_proc_poll_t cbm_subprocess_poll(cbm_subprocess_t *process, cbm_proc_result_t *out);
 
-/* Read the current resident-set size of the complete contained process tree.
- * OK returns an overflow-safe byte total, EMPTY means the owned tree currently
- * has no observable members, and ERROR means no trustworthy measurement could
- * be obtained. Individual processes that exit during enumeration are ignored. */
+/* Read the current charged memory of the complete contained process tree.
+ * On macOS this is phys_footprint (what the OS holds against the process);
+ * elsewhere it is RSS. OK returns an overflow-safe byte total, EMPTY means
+ * the owned tree currently has no observable members, and ERROR means no
+ * trustworthy measurement could be obtained. Individual processes that exit
+ * during enumeration are ignored. */
 cbm_proc_tree_rss_status_t cbm_subprocess_tree_rss_bytes(cbm_subprocess_t *process,
                                                          uint64_t *rss_bytes);
 bool cbm_subprocess_root_running(const cbm_subprocess_t *process);
 
@@ -881,7 +881,8 @@ static int worker_start_internal(const char *args_json, size_t memory_budget_byt
                                  const cbm_index_resource_policy_t *resource_policy,
                                  bool single_thread, const char *marker_file,
                                  const char *quarantine_file, cbm_proc_log_cb log_callback,
-                                 void *log_context, cbm_index_worker_handle_t **handle_out) {
+                                 void *log_context, uint64_t duration_origin_ms,
+                                 cbm_index_worker_handle_t **handle_out) {
     if (handle_out) {
         *handle_out = NULL;
     }
@@ -985,45 +986,54 @@ static int worker_start_internal(const char *args_json, size_t memory_budget_byt
         return -1;
     }
     if (handle->resource_policy.max_duration_ms.enabled) {
-        handle->started_ms = worker_resource_now_ms();
+        /* Duration is per request, not per spawn: a crash/hang recovery must
+         * not reset the clock. Callers pass the request origin; 0 means now. */
+        uint64_t origin = duration_origin_ms != 0 ? duration_origin_ms : worker_resource_now_ms();
+        handle->started_ms = origin;
     }
     *handle_out = handle;
     return 0;
 }
 
+uint64_t cbm_index_worker_now_ms(void) {
+    return worker_resource_now_ms();
+}
+
 int cbm_index_worker_start_with_log(const char *args_json, size_t memory_budget_bytes,
                                     bool single_thread, const char *marker_file,
                                     const char *quarantine_file, cbm_proc_log_cb log_callback,
                                     void *log_context, cbm_index_worker_handle_t **handle_out) {
     return worker_start_internal(args_json, memory_budget_bytes, NULL, single_thread, marker_file,
-                                 quarantine_file, log_callback, log_context, handle_out);
+                                 quarantine_file, log_callback, log_context, 0, handle_out);
 }
 
 int cbm_index_worker_start(const char *args_json, size_t memory_budget_bytes, bool single_thread,
                            const char *marker_file, const char *quarantine_file,
                            cbm_index_worker_handle_t **handle_out) {
     return worker_start_internal(args_json, memory_budget_bytes, NULL, single_thread, marker_file,
-                                 quarantine_file, NULL, NULL, handle_out);
+                                 quarantine_file, NULL, NULL, 0, handle_out);
 }
 
 int cbm_index_worker_start_with_policy(const char *args_json, size_t memory_budget_bytes,
                                        const cbm_index_resource_policy_t *resource_policy,
                                        bool single_thread, const char *marker_file,
-                                       const char *quarantine_file,
+                                       const char *quarantine_file, uint64_t duration_origin_ms,
                                        cbm_index_worker_handle_t **handle_out) {
     return worker_start_internal(args_json, memory_budget_bytes, resource_policy, single_thread,
-                                 marker_file, quarantine_file, NULL, NULL, handle_out);
+                                 marker_file, quarantine_file, NULL, NULL, duration_origin_ms,
+                                 handle_out);
 }
 
 int cbm_index_worker_start_with_policy_log(const char *args_json, size_t memory_budget_bytes,
                                            const cbm_index_resource_policy_t *resource_policy,
                                            bool single_thread, const char *marker_file,
                                            const char *quarantine_file,
                                            cbm_proc_log_cb log_callback, void *log_context,
+                                           uint64_t duration_origin_ms,
                                            cbm_index_worker_handle_t **handle_out) {
     return worker_start_internal(args_json, memory_budget_bytes, resource_policy, single_thread,
                                  marker_file, quarantine_file, log_callback, log_context,
-                                 handle_out);
+                                 duration_origin_ms, handle_out);
 }
 
 cbm_index_worker_poll_t cbm_index_worker_poll(cbm_index_worker_handle_t *handle,
@@ -1167,14 +1177,15 @@ static int worker_spawn_internal(const char *args_json,
                                  bool single_thread, const char *marker_file,
                                  const char *quarantine_file, cbm_proc_log_cb log_callback,
                                  void *log_context, const atomic_int *cancel_requested,
-                                 cbm_index_worker_result_t *result) {
+                                 uint64_t duration_origin_ms, cbm_index_worker_result_t *result) {
     if (!result) {
         return -1;
     }
     worker_result_init(result);
     cbm_index_worker_handle_t *handle = NULL;
     if (worker_start_internal(args_json, 0, resource_policy, single_thread, marker_file,
-                              quarantine_file, log_callback, log_context, &handle) != 0) {
+                              quarantine_file, log_callback, log_context, duration_origin_ms,
+                              &handle) != 0) {
         return -1;
     }
     const cbm_index_worker_result_t *cached = NULL;
@@ -1206,16 +1217,17 @@ int cbm_index_spawn_worker_with_log_cancel(const char *args_json, bool single_th
                                            const atomic_int *cancel_requested,
                                            cbm_index_worker_result_t *result) {
     return worker_spawn_internal(args_json, NULL, single_thread, marker_file, quarantine_file,
-                                 log_callback, log_context, cancel_requested, result);
+                                 log_callback, log_context, cancel_requested, 0, result);
 }
 
 int cbm_index_spawn_worker_with_policy_log_cancel(
     const char *args_json, const cbm_index_resource_policy_t *resource_policy, bool single_thread,
     const char *marker_file, const char *quarantine_file, cbm_proc_log_cb log_callback,
-    void *log_context, const atomic_int *cancel_requested, cbm_index_worker_result_t *result) {
+    void *log_context, const atomic_int *cancel_requested, uint64_t duration_origin_ms,
+    cbm_index_worker_result_t *result) {
     return worker_spawn_internal(args_json, resource_policy, single_thread, marker_file,
                                  quarantine_file, log_callback, log_context, cancel_requested,
-                                 result);
+                                 duration_origin_ms, result);
 }
 
 int cbm_index_spawn_worker_with_log(const char *args_json, bool single_thread,