diff --git a/crates/bashkit/src/interpreter/mod.rs b/crates/bashkit/src/interpreter/mod.rs
index 10fce58d5..d63d2f37c 100644
--- a/crates/bashkit/src/interpreter/mod.rs
+++ b/crates/bashkit/src/interpreter/mod.rs
@@ -9379,7 +9379,7 @@ impl Interpreter {
             }
 
             // Handle input redirections first
-            let stdin = match self
+            let stdin_setup = match self
                 .process_input_redirections(
                     stdin,
                     &command.redirects,
@@ -9394,6 +9394,10 @@ impl Interpreter {
                 }
                 Err(e) => return Err(e),
             };
+            // Hold the stdin clone's live lease (if stdin is a budgeted
+            // clone minted above) for as long as `stdin` is retained below.
+            let _stdin_storage = stdin_setup.stdin_lease;
+            let stdin = stdin_setup.stdin;
 
             // `read -u FD` on a readable fd (`exec 3<f`, a coproc): its
             // next line is stdin.
@@ -12868,7 +12872,7 @@ impl Interpreter {
             // WTF: a coproc fd as a compound's stdin (`while read l; do
             // ...; done <&${C[0]}`) is read to end of input up front, not
             // line by line as the loop runs.
-            let stdin = match self
+            let stdin_setup = match self
                 .process_input_redirections(None, redirects, StdinDemand::All, HighFdStdin::Any)
                 .await
             {
@@ -12878,6 +12882,10 @@ impl Interpreter {
                 }
                 Err(e) => return Err(e),
             };
+            // Hold the stdin clone's live lease (if stdin is a budgeted
+            // clone minted above) for as long as `stdin` is retained below.
+            let _stdin_storage = stdin_setup.stdin_lease;
+            let stdin = stdin_setup.stdin;
             let prev_pipeline_stdin = if stdin.is_some() {
                 let prev = self.pipeline_stdin.take();
                 self.pipeline_stdin = stdin;
@@ -12974,8 +12982,11 @@ impl Interpreter {
                     .await
                 };
                 match read {
-                    Ok(content) => {
-                        if let Some(content) = content {
+                    Ok(setup) => {
+                        // Hold the stdin clone's live lease while the
+                        // substitution output derived from it is live.
+                        let _stdin_storage = setup.stdin_lease;
+                        if let Some(content) = setup.stdin {
                             // Account for the VFS-owned input while it and the
                             // decoded substitution text are simultaneously live.
                             let _content_lease =
diff --git a/crates/bashkit/src/interpreter/redirection.rs b/crates/bashkit/src/interpreter/redirection.rs
index 248276e4f..46b4ca424 100644
--- a/crates/bashkit/src/interpreter/redirection.rs
+++ b/crates/bashkit/src/interpreter/redirection.rs
@@ -56,6 +56,51 @@ fn redirect_target_may_split(redirect: &Redirect) -> bool {
     })
 }
 
+/// Stdin slot: the buffer plus the live-bytes lease when the buffer is a
+/// budgeted clone minted here. Assigning the slot drops any previous
+/// buffer and its clone lease together.
+type StdinSlot = Option<(
+    crate::StreamData,
+    Option<crate::limits::ExecutionBudgetLease>,
+)>;
+
+/// Assign the stdin slot, dropping any previous buffer and its clone lease
+/// together. Fresh reads pass `lease: None`; budgeted clones pass the lease
+/// from `charge_input_retention` so it lives as long as stdin does.
+fn set_stdin_slot(
+    slot: &mut StdinSlot,
+    value: Option<crate::StreamData>,
+    lease: Option<crate::limits::ExecutionBudgetLease>,
+) {
+    *slot = value.map(|data| (data, lease));
+}
+
+/// Result of input-redirection processing: the stdin buffer plus the
+/// live-bytes lease for it when stdin is a budgeted clone minted here.
+/// Callers hold `stdin_lease` for as long as they retain `stdin`.
+pub(crate) struct StdinSetup {
+    pub stdin: Option<crate::StreamData>,
+    pub stdin_lease: Option<crate::limits::ExecutionBudgetLease>,
+}
+
+/// Numbered-fd table with replace semantics: re-redirecting an fd drops the
+/// superseded buffer — and its live-bytes lease — instead of piling clones.
+/// Aggregate input consumption stays cumulative.
+type OwnFdEntry = (i32, crate::StreamData, crate::limits::ExecutionBudgetLease);
+
+fn replace_own_fd(
+    own_fds: &mut Vec<OwnFdEntry>,
+    fd: i32,
+    data: crate::StreamData,
+    lease: crate::limits::ExecutionBudgetLease,
+) {
+    if let Some(slot) = own_fds.iter_mut().find(|(existing, _, _)| *existing == fd) {
+        *slot = (fd, data, lease);
+    } else {
+        own_fds.push((fd, data, lease));
+    }
+}
+
 /// `N<<EOF` / `N<<<word` with N >= 3: a readable fd for the command's body.
 fn high_fd_here(redirect: &Redirect) -> bool {
     matches!(
@@ -229,6 +274,19 @@ impl Interpreter {
         self.diag(format!("{path}: {reason}\n"))
     }
 
+    /// Charging helper for numbered input redirects (input-redirect budget fix). Every
+    /// retained buffer counts against the aggregate input budget and holds
+    /// a live-bytes lease while the redirect list is processed. Charges run
+    /// before the clone/allocation they cover; re-redirecting the same fd
+    /// replaces the superseded entry instead of piling clones.
+    fn charge_input_retention(
+        &self,
+        len: usize,
+    ) -> crate::error::Result<crate::limits::ExecutionBudgetLease> {
+        self.execution_budget.consume_input(len)?;
+        Ok(self.execution_budget.lease_bytes(len)?)
+    }
+
     /// Process input redirections (< file, <<< string). `demand` is how
     /// much the command reads, for stdin taken from a coproc's pipe.
     pub(super) async fn process_input_redirections(
@@ -237,10 +295,13 @@ impl Interpreter {
         redirects: &[Redirect],
         demand: StdinDemand,
         high_fd_stdin: HighFdStdin,
-    ) -> Result<Option<crate::StreamData>> {
-        let mut stdin = existing_stdin;
+    ) -> crate::error::Result<StdinSetup> {
+        // Stdin slot: a budgeted clone's live lease travels with the buffer
+        // so replacing stdin drops both together; the surviving lease is
+        // handed to the caller with stdin.
+        let mut stdin: StdinSlot = existing_stdin.map(|data| (data, None));
         // Readable fds this command's own redirects open (`4<<E <&4`).
-        let mut own_fds: Vec<(i32, crate::StreamData)> = Vec::new();
+        let mut own_fds: Vec<OwnFdEntry> = Vec::new();
 
         for redirect in redirects {
             // Fd N >= 1 for an input-side redirect (`3<f`, `4<<<w`, `5<>f`).
@@ -271,8 +332,11 @@ impl Interpreter {
                         }
                     };
                     match high_fd {
-                        Some(fd) => own_fds.push((fd, content)),
-                        None => stdin = Some(content),
+                        Some(fd) => {
+                            let lease = self.charge_input_retention(content.retained_len())?;
+                            replace_own_fd(&mut own_fds, fd, content, lease);
+                        }
+                        None => set_stdin_slot(&mut stdin, Some(content), None),
                     }
                 }
                 RedirectKind::Input => {
@@ -290,7 +354,7 @@ impl Interpreter {
                     if self.fd_alias(&path) == Some(0) {
                         // `< /dev/stdin` re-reads the current stdin: no-op.
                     } else if is_dev_null(&path) {
-                        stdin = Some(crate::StreamData::new()); // EOF
+                        set_stdin_slot(&mut stdin, Some(crate::StreamData::new()), None); // EOF
                     } else if !self.shell_features.has_file_redirects() {
                         return Err(crate::error::Error::Execution(
                             self.diag(format!("{}: filesystem redirection disabled", target_path)),
@@ -300,7 +364,9 @@ impl Interpreter {
                             Ok(content) => {
                                 let content: crate::StreamData = content.into();
                                 if let Some(fd) = high_fd {
-                                    own_fds.push((fd, content.clone()));
+                                    let lease =
+                                        self.charge_input_retention(content.retained_len())?;
+                                    replace_own_fd(&mut own_fds, fd, content.clone(), lease);
                                 }
                                 // WTF: on a compound `3<file` also feeds
                                 // stdin; loops like `while read -u 3 ...;
@@ -314,7 +380,7 @@ impl Interpreter {
                                     (Some(_), HighFdStdin::Never) => false,
                                 };
                                 if feeds {
-                                    stdin = Some(content);
+                                    set_stdin_slot(&mut stdin, Some(content), None);
                                 }
                             }
                             Err(e) => {
@@ -330,8 +396,11 @@ impl Interpreter {
                     let content = self.expand_word(&redirect.target).await?;
                     let content: crate::StreamData = format!("{}\n", content).into();
                     match high_fd {
-                        Some(fd) => own_fds.push((fd, content)),
-                        None => stdin = Some(content),
+                        Some(fd) => {
+                            let lease = self.charge_input_retention(content.retained_len())?;
+                            replace_own_fd(&mut own_fds, fd, content, lease);
+                        }
+                        None => set_stdin_slot(&mut stdin, Some(content), None),
                     }
                 }
                 RedirectKind::HereDoc | RedirectKind::HereDocStrip => {
@@ -340,8 +409,11 @@ impl Interpreter {
                     let content: crate::StreamData =
                         self.expand_word(&redirect.target).await?.into();
                     match high_fd {
-                        Some(fd) => own_fds.push((fd, content)),
-                        None => stdin = Some(content),
+                        Some(fd) => {
+                            let lease = self.charge_input_retention(content.retained_len())?;
+                            replace_own_fd(&mut own_fds, fd, content, lease);
+                        }
+                        None => set_stdin_slot(&mut stdin, Some(content), None),
                     }
                 }
                 RedirectKind::DupInput => {
@@ -360,12 +432,16 @@ impl Interpreter {
                     let Ok(src) = target.parse::<i32>() else {
                         continue;
                     };
-                    // `<&4` after this command's own `4<<E`.
-                    if let Some((_, content)) = own_fds.iter().rev().find(|(fd, _)| *fd == src) {
+                    // `<&4` after this command's own `4<<E`: the clone below is
+                    // charged before allocation.
+                    if let Some((_, content, _)) =
+                        own_fds.iter().rev().find(|(fd, _, _)| *fd == src)
+                    {
+                        let lease = self.charge_input_retention(content.retained_len())?;
                         let content = content.clone();
                         match high_fd {
-                            Some(fd) => own_fds.push((fd, content)),
-                            None => stdin = Some(content),
+                            Some(fd) => replace_own_fd(&mut own_fds, fd, content, lease),
+                            None => set_stdin_slot(&mut stdin, Some(content), Some(lease)),
                         }
                         continue;
                     }
@@ -391,11 +467,15 @@ impl Interpreter {
                                     text.push('\n');
                                 }
                             }
-                            stdin = Some(text.into());
+                            set_stdin_slot(&mut stdin, Some(text.into()), None);
                         }
                         Some(coproc::InputFd::Pipe(end)) => {
                             let pipe = Arc::clone(&end.0);
-                            stdin = Some(Box::pin(coproc::read_coproc_input(pipe, demand)).await);
+                            set_stdin_slot(
+                                &mut stdin,
+                                Some(Box::pin(coproc::read_coproc_input(pipe, demand)).await),
+                                None,
+                            );
                         }
                         // `<&5` with fd 5 never opened (or closed): bash
                         // reports it and does not run the command.
@@ -416,7 +496,12 @@ impl Interpreter {
             }
         }
 
-        Ok(stdin)
+        let mut stdin_lease = None;
+        let stdin = stdin.map(|(data, lease)| {
+            stdin_lease = lease;
+            data
+        });
+        Ok(StdinSetup { stdin, stdin_lease })
     }
 
     /// Apply output redirections to command output
diff --git a/crates/bashkit/src/stream.rs b/crates/bashkit/src/stream.rs
index e22fb3799..c33a92fb3 100644
--- a/crates/bashkit/src/stream.rs
+++ b/crates/bashkit/src/stream.rs
@@ -58,6 +58,12 @@ impl StreamData {
     pub fn len(&self) -> usize {
         self.bytes.len()
     }
+
+    /// Live bytes retained by this buffer: the raw bytes plus the decoded
+    /// text kept alongside them.
+    pub(crate) fn retained_len(&self) -> usize {
+        self.bytes.len().saturating_add(self.text.len())
+    }
     pub fn is_empty(&self) -> bool {
         self.bytes.is_empty()
     }
diff --git a/crates/bashkit/tests/integration/input_redirect_budget_tests.rs b/crates/bashkit/tests/integration/input_redirect_budget_tests.rs
new file mode 100644
index 000000000..15f7a3182
--- /dev/null
+++ b/crates/bashkit/tests/integration/input_redirect_budget_tests.rs
@@ -0,0 +1,472 @@
+//! Repeated numbered input redirects must charge the input budget:
+//!
+//! Each `N<file` / `N<&M` redirect materializes a retained `StreamData` clone
+//! in the redirect list. Without a budget charge, `3</big 4</big ...`
+//! duplicates the buffer once per fd with no aggregate or live-bytes
+//! accounting, and superseded entries for the same fd pile up instead of
+//! replacing each other.
+
+use bashkit::{Bash, Error, ExecutionBudgetExceeded, ExecutionLimits, LimitExceeded};
+use std::path::Path;
+
+#[tokio::test]
+/// Repeated numbered input redirects exceed the aggregate input budget.
+async fn numbered_input_redirects_charge_aggregate_input_budget() {
+    let payload = vec![b'x'; 32];
+    let mut bash = Bash::builder()
+        .limits(ExecutionLimits::new().max_aggregate_input_bytes(100))
+        .build();
+    bash.fs()
+        .write_file(Path::new("/big"), &payload)
+        .await
+        .unwrap();
+
+    let result = bash.exec(": 3</big 4</big").await;
+    assert!(
+        matches!(
+            result,
+            Err(Error::ResourceLimit(LimitExceeded::ExecutionBudget(
+                ExecutionBudgetExceeded::InputBytes { .. }
+            )))
+        ),
+        "expected aggregate input budget exhaustion, got {result:?}"
+    );
+}
+
+#[tokio::test]
+/// A superseded numbered input fd keeps latest-wins behavior.
+async fn superseded_numbered_input_fd_is_replaced() {
+    let mut bash = Bash::builder().build();
+    bash.fs()
+        .write_file(Path::new("/a"), b"first")
+        .await
+        .unwrap();
+    bash.fs()
+        .write_file(Path::new("/b"), b"second")
+        .await
+        .unwrap();
+
+    let result = bash.exec("cat 3</a 3</b <&3").await.unwrap();
+    assert_eq!(result.stdout.text().unwrap(), "second");
+}
+
+#[tokio::test]
+/// Retained numbered-fd buffers hold live-bytes leases while processed.
+async fn numbered_input_redirects_hold_live_bytes_budget() {
+    let payload = vec![b'x'; 32];
+    let mut bash = Bash::builder()
+        .limits(ExecutionLimits::new().max_live_intermediate_bytes(100))
+        .build();
+    bash.fs()
+        .write_file(Path::new("/big"), &payload)
+        .await
+        .unwrap();
+
+    let result = bash.exec(": 3</big 4</big").await;
+    assert!(
+        matches!(
+            result,
+            Err(Error::ResourceLimit(LimitExceeded::ExecutionBudget(
+                ExecutionBudgetExceeded::LiveBytes { .. }
+            )))
+        ),
+        "expected live-bytes budget exhaustion, got {result:?}"
+    );
+}
+
+#[tokio::test]
+/// Original attack shape: ':' with 1024 same-fd /dev/zero redirects trips
+/// the aggregate budget on the first retained buffer instead of piling MiBs.
+async fn original_shape_1024_dev_zero_trips_fast() {
+    let mut bash = Bash::builder()
+        .limits(ExecutionLimits::new().max_aggregate_input_bytes(65_536))
+        .build();
+    let script = format!(":{}", " 3</dev/zero".repeat(1024));
+    let result = bash.exec(&script).await;
+    assert!(
+        matches!(
+            result,
+            Err(Error::ResourceLimit(LimitExceeded::ExecutionBudget(
+                ExecutionBudgetExceeded::InputBytes { .. }
+            )))
+        ),
+        "expected aggregate input budget exhaustion, got {result:?}"
+    );
+}
+
+#[tokio::test]
+/// Both backing buffers count: a 32B ASCII payload retains 64B, so a cap of
+/// 63 trips on a single redirect while 64 succeeds.
+async fn both_backing_buffers_admitted() {
+    for (cap, ok) in [(71_u64, false), (72, true)] {
+        let mut bash = Bash::builder()
+            .limits(ExecutionLimits::new().max_aggregate_input_bytes(cap))
+            .build();
+        bash.fs()
+            .write_file(Path::new("/big"), &[b'x'; 32])
+            .await
+            .unwrap();
+        let result = bash.exec(": 3</big").await;
+        assert_eq!(result.is_ok(), ok, "aggregate cap {cap}");
+    }
+    for (cap, ok) in [(63_u64, false), (64, true)] {
+        let mut bash = Bash::builder()
+            .limits(ExecutionLimits::new().max_live_intermediate_bytes(cap))
+            .build();
+        bash.fs()
+            .write_file(Path::new("/big"), &[b'x'; 32])
+            .await
+            .unwrap();
+        let result = bash.exec(": 3</big").await;
+        assert_eq!(result.is_ok(), ok, "live cap {cap}");
+    }
+}
+
+#[tokio::test]
+/// Replacing a superseded same-fd entry releases its live lease: eight
+/// same-fd repeats never hold more than two 64B buffers transiently (one
+/// retained plus one incoming during replacement), so a 128B live cap
+/// suffices where append-only leases would grow without bound.
+async fn superseded_entry_releases_live_lease() {
+    let mut bash = Bash::builder()
+        .limits(ExecutionLimits::new().max_live_intermediate_bytes(128_u64))
+        .build();
+    bash.fs()
+        .write_file(Path::new("/a"), &[b'y'; 32])
+        .await
+        .unwrap();
+    let script = format!(":{}", " 3</a".repeat(8));
+    let result = bash.exec(&script).await;
+    assert!(
+        result.is_ok(),
+        "expected lease release on replace, got {result:?}"
+    );
+}
+
+#[tokio::test]
+/// Aggregate consumption is cumulative across replaces: the second same-fd
+/// repeat exceeds a 100B aggregate cap even though live stays at 64B.
+async fn cumulative_aggregate_survives_replace() {
+    let mut bash = Bash::builder()
+        .limits(ExecutionLimits::new().max_aggregate_input_bytes(100))
+        .build();
+    bash.fs()
+        .write_file(Path::new("/a"), &[b'y'; 32])
+        .await
+        .unwrap();
+    let result = bash.exec(": 3</a 3</a").await;
+    assert!(
+        matches!(
+            result,
+            Err(Error::ResourceLimit(LimitExceeded::ExecutionBudget(
+                ExecutionBudgetExceeded::InputBytes { .. }
+            )))
+        ),
+        "expected cumulative aggregate exhaustion, got {result:?}"
+    );
+}
+
+#[tokio::test]
+/// The DupInput target duplication itself is charged: with a 16B payload
+/// (32B retained), a 47B aggregate cap admits the 15B script plus the source
+/// fd (47B total) but the `4<&3` clone (79B) trips `InputBytes`. Controls
+/// prove the script text and source fd fit on their own.
+async fn dup_target_duplication_charges() {
+    // Control 1: source fd alone fits (7B script + 32B retained = 39B).
+    let mut bash = Bash::builder()
+        .limits(ExecutionLimits::new().max_aggregate_input_bytes(39))
+        .build();
+    bash.fs()
+        .write_file(Path::new("/big"), b"sixteen-bytesxx")
+        .await
+        .unwrap();
+    assert!(bash.exec(": 3</big").await.is_ok());
+    // Control 2: source plus dup fits under a 79B cap.
+    let mut bash = Bash::builder()
+        .limits(ExecutionLimits::new().max_aggregate_input_bytes(79))
+        .build();
+    bash.fs()
+        .write_file(Path::new("/big"), b"sixteen-bytesxx")
+        .await
+        .unwrap();
+    assert!(bash.exec(": 3</big 4<&3").await.is_ok());
+    // The duplication itself trips: script (15B) + source (32B) fits 47B,
+    // the target clone (+32B = 79B) does not.
+    let mut bash = Bash::builder()
+        .limits(ExecutionLimits::new().max_aggregate_input_bytes(47))
+        .build();
+    bash.fs()
+        .write_file(Path::new("/big"), b"sixteen-bytesxx")
+        .await
+        .unwrap();
+    let result = bash.exec(": 3</big 4<&3").await;
+    assert!(
+        matches!(
+            result,
+            Err(Error::ResourceLimit(LimitExceeded::ExecutionBudget(
+                ExecutionBudgetExceeded::InputBytes { .. }
+            )))
+        ),
+        "target duplication should trip InputBytes, got {result:?}"
+    );
+}
+
+#[tokio::test]
+/// ReadWrite numbered retention is charged: 10B script + 32B retained trips
+/// a 31B aggregate cap with `InputBytes`.
+async fn readwrite_numbered_retention_charges() {
+    let mut bash = Bash::builder()
+        .limits(ExecutionLimits::new().max_aggregate_input_bytes(31))
+        .build();
+    bash.fs()
+        .write_file(Path::new("/big"), b"sixteen-bytesxx")
+        .await
+        .unwrap();
+    let result = bash.exec(": 3<>/big").await;
+    assert!(
+        matches!(
+            result,
+            Err(Error::ResourceLimit(LimitExceeded::ExecutionBudget(
+                ExecutionBudgetExceeded::InputBytes { .. }
+            )))
+        ),
+        "ReadWrite retention should trip InputBytes, got {result:?}"
+    );
+}
+
+#[tokio::test]
+/// The session stays usable after a budget error: unrelated commands run.
+async fn session_recovers_after_budget_error() {
+    let mut bash = Bash::builder()
+        .limits(ExecutionLimits::new().max_aggregate_input_bytes(100))
+        .build();
+    bash.fs()
+        .write_file(Path::new("/big"), &[b'x'; 32])
+        .await
+        .unwrap();
+    let tripped = bash.exec(": 3</big 4</big").await;
+    assert!(
+        tripped.is_err(),
+        "expected the redirect to trip, got {tripped:?}"
+    );
+    let result = bash.exec("echo recovered").await.unwrap();
+    assert_eq!(result.exit_code, 0);
+    assert!(
+        result.stdout.text().unwrap().contains("recovered"),
+        "unexpected stdout: {:?}",
+        result.stdout.text()
+    );
+}
+
+#[tokio::test]
+/// Finite bash parity: numbered-fd duplication chains resolve latest-wins.
+async fn numbered_fd_duplication_chain() {
+    let mut bash = Bash::builder().build();
+    bash.fs()
+        .write_file(Path::new("/a"), b"alpha")
+        .await
+        .unwrap();
+    let result = bash.exec("cat 3</a 4<&3 <&4").await.unwrap();
+    assert_eq!(result.stdout.text().unwrap(), "alpha");
+}
+
+#[tokio::test]
+/// A 1MiB numbered-heredoc body stays bounded: the script-text charge covers
+/// it once, it is not retained per-exec, and it must not double-trip a cap
+/// above the script size. Guards against double-charge regressions.
+async fn large_numbered_heredoc_stays_bounded() {
+    let body = "z".repeat(1024 * 1024);
+    let script = format!(": 3<<EOF\n{body}\nEOF");
+    let mut bash = Bash::builder()
+        .limits(ExecutionLimits::new().max_aggregate_input_bytes(1_572_864))
+        .build();
+    let result = bash.exec(&script).await.unwrap();
+    assert_eq!(result.exit_code, 0);
+}
+
+#[tokio::test]
+/// Stdin-clone live overlap: `cat 3</a <&3 4</b` simultaneously owns three
+/// 64B buffers (fd-3 entry, stdin clone, fd-4 entry), so a 192B live cap
+/// succeeds while 191B trips `LiveBytes` on the third admission.
+async fn stdin_clone_live_overlap() {
+    for (cap, ok) in [(192_u64, true), (191, false)] {
+        let mut bash = Bash::builder()
+            .limits(ExecutionLimits::new().max_live_intermediate_bytes(cap))
+            .build();
+        bash.fs()
+            .write_file(Path::new("/a"), &[b'A'; 32])
+            .await
+            .unwrap();
+        bash.fs()
+            .write_file(Path::new("/b"), &[b'B'; 32])
+            .await
+            .unwrap();
+        let result = bash.exec("cat 3</a <&3 4</b").await;
+        if ok {
+            let out = result.unwrap();
+            assert_eq!(out.exit_code, 0);
+            assert_eq!(out.stdout.text().unwrap(), "A".repeat(32));
+        } else {
+            assert!(
+                matches!(
+                    result,
+                    Err(Error::ResourceLimit(LimitExceeded::ExecutionBudget(
+                        ExecutionBudgetExceeded::LiveBytes { .. }
+                    )))
+                ),
+                "live cap {cap} should trip LiveBytes, got {result:?}"
+            );
+        }
+    }
+}
+
+#[tokio::test]
+/// After a live-budget trip on a stdin-clone overlap, the session recovers
+/// for commands within the remaining budget.
+async fn stdin_clone_trip_recovers() {
+    let mut bash = Bash::builder()
+        .limits(ExecutionLimits::new().max_live_intermediate_bytes(191_u64))
+        .build();
+    bash.fs()
+        .write_file(Path::new("/a"), &[b'A'; 32])
+        .await
+        .unwrap();
+    bash.fs()
+        .write_file(Path::new("/b"), &[b'B'; 32])
+        .await
+        .unwrap();
+    let tripped = bash.exec("cat 3</a <&3 4</b").await;
+    assert!(
+        tripped.is_err(),
+        "expected the overlap to trip, got {tripped:?}"
+    );
+    let result = bash.exec("echo recovered").await.unwrap();
+    assert_eq!(result.exit_code, 0);
+    assert!(result.stdout.text().unwrap().contains("recovered"));
+}
+
+/// Original shape under default limits in an owned bounded child: `:` plus
+/// 1024 same-fd `/dev/zero` redirects is denied quickly by the aggregate
+/// input budget (each 1MiB read retains ~2MiB against the 100MB default cap,
+/// tripping after ~50 redirects) instead of piling ~2GiB of retained clones.
+/// The harness asserts the exact denial: clean exit code 1 naming `aggregate
+/// input bytes` (production retention admission, far above the ~7KiB script
+/// text), which distinguishes budget denial from OOM/signal death (no exit
+/// code) and from pre-fix success (exit 0). The 1536MiB RLIMIT_AS
+/// additionally caps any regression to append-only retention. The child is
+/// always reaped, killed first on wall-clock expiry. Unix-only: needs bash +
+/// ulimit for enforcement.
+#[cfg(unix)]
+#[tokio::test]
+async fn original_shape_bounded_child_default_limits() {
+    let script = format!(":{}", " 3</dev/zero".repeat(1024));
+    // Controlled sink for instrumented-coverage artifacts: under coverage
+    // jobs the spawned CLI inherits LLVM_PROFILE_FILE and flushes a
+    // multi-MiB profraw at exit, which must not share the producer tight
+    // file cap (SIGXFSZ) nor pollute the workspace. Coverage stays enabled;
+    // only the sink location is controlled, and the artifact size gets an
+    // explicit bounded receipt below.
+    let sink_dir = std::env::temp_dir().join(format!("bashkit-ir-child-{}", std::process::id()));
+    std::fs::create_dir_all(&sink_dir).expect("artifact sink dir");
+    let profile = sink_dir.join("child.profraw");
+    let outcome = tokio::task::spawn_blocking(move || {
+        let exe = std::env::current_exe().expect("test executable path");
+        let cli = exe
+            .ancestors()
+            .flat_map(|dir| [dir.join(format!("bashkit{}", std::env::consts::EXE_SUFFIX))])
+            .find(|path| path.is_file())
+            .expect("build the CLI first: cargo build -p bashkit-cli");
+        // rlimits apply to the launched CLI only. -f is an explicit 128MiB
+        // artifact allowance for one short instrumented run (profraws are
+        // O(MB)); the producer itself writes no files (VFS in-memory,
+        // stdout/stderr piped), so anything near the cap is a regression.
+        // Pipes are kernel-bounded, not FSIZE-capped: the poll loop
+        // plus kill-on-deadline keeps collection finite either way.
+        let launcher =
+            "ulimit -v 1572864; ulimit -t 120; ulimit -s 8192; ulimit -f 2048; exec \"$@\"";
+        let mut child = std::process::Command::new("bash")
+            .args([
+                "-c",
+                launcher,
+                "ir-child",
+                &cli.to_string_lossy(),
+                "-c",
+                &script,
+            ])
+            .stdin(std::process::Stdio::null())
+            .stdout(std::process::Stdio::piped())
+            .stderr(std::process::Stdio::piped())
+            .env("LLVM_PROFILE_FILE", &profile)
+            .spawn()
+            .expect("spawn bounded child");
+        let start = std::time::Instant::now();
+        let deadline = std::time::Duration::from_secs(100);
+        // wait_with_output runs only on an already-exited child, so
+        // collection is limited to kernel pipe buffers; the deadline branch
+        // kills first, then reaps. Either path returns promptly, and the
+        // artifact sink is cleaned below.
+        let (status, output, elapsed, overran) = loop {
+            if let Some(status) = child.try_wait().expect("poll child") {
+                let output = child.wait_with_output().expect("reap child");
+                break (status, output, start.elapsed(), false);
+            }
+            if start.elapsed() > deadline {
+                child.kill().expect("kill overrun child");
+                let _ = child.wait();
+                break (
+                    {
+                        use std::os::unix::process::ExitStatusExt;
+                        std::process::ExitStatus::from_raw(9)
+                    },
+                    std::process::Output {
+                        status: {
+                            use std::os::unix::process::ExitStatusExt;
+                            std::process::ExitStatus::from_raw(9)
+                        },
+                        stdout: Vec::new(),
+                        stderr: b"wall-clock overrun".to_vec(),
+                    },
+                    start.elapsed(),
+                    true,
+                );
+            }
+            std::thread::sleep(std::time::Duration::from_millis(50));
+        };
+        // Artifact receipt (when coverage writes one) plus finite cleanup.
+        const ARTIFACT_BOUND: u64 = 128 * 1024 * 1024;
+        if let Ok(meta) = std::fs::metadata(&profile) {
+            assert!(
+                meta.len() < ARTIFACT_BOUND,
+                "coverage artifact receipt: {} bytes exceeds {}",
+                meta.len(),
+                ARTIFACT_BOUND
+            );
+        }
+        let _ = std::fs::remove_dir_all(sink_dir);
+        (status, output, elapsed, overran)
+    })
+    .await
+    .expect("child harness join");
+    let (status, output, elapsed, overran) = outcome;
+    assert!(
+        !overran,
+        "bounded child overran the wall clock; killed and reaped"
+    );
+    let stderr = String::from_utf8_lossy(&output.stderr);
+    assert_eq!(
+        status.code(),
+        Some(1),
+        // Signal death here means OOM kill, an artifact-cap trip (SIGXFSZ),
+        // or a crash, never success; producer diagnostics included.
+        "producer must fail cleanly, got {status:?} with stderr {stderr:?}",
+    );
+    assert!(
+        stderr.contains("aggregate input bytes"),
+        "denial must name the aggregate input budget phase, got: {stderr:?}"
+    );
+    assert!(output.stdout.len() < 4096, "producer output capped");
+    assert!(
+        elapsed < std::time::Duration::from_secs(60),
+        "producer took {elapsed:?}"
+    );
+}
diff --git a/crates/bashkit/tests/integration/main.rs b/crates/bashkit/tests/integration/main.rs
index 3223e404a..3c00cca68 100644
--- a/crates/bashkit/tests/integration/main.rs
+++ b/crates/bashkit/tests/integration/main.rs
@@ -52,6 +52,7 @@ pub mod curl_data_compat_tests;
 pub mod custom_builtins_tests;
 pub mod custom_fs_tests;
 pub mod function_metadata_security_tests;
+pub mod input_redirect_budget_tests;
 pub mod interactive_builtins_tests;
 pub mod memory_growth_security_tests;
 pub mod tar_files_from_budget_tests;