The watchdog can pull the emergency lever, and the lever has a cooldown it didn't write

Server A hosts production. Server B, a $29 box in another region, hosts the watchdog.

Every ten minutes a cron entry in the watchdog container POSTs /servers/{A}/execute-command with command_slug: check-memory and wait: false. A 202 comes back with a command_log_id; the script collects the result into SQLite. When memory climbs past the line for three reads and the proxy stops answering, the script escalates to kexec-reboot: the one high-risk command, confirmation token required.

What it cannot do is loop. Each command in the catalog carries cooldown_seconds and rate_limit_per_hour; a second reboot inside the cooldown gets a 429 with retry_after, whatever the script has decided. The limit lives on the server's side, not in the watchdog's code.