DL-500

Every layer passes the PutAgentConfig door; only the default carries profiles/ and only the tenant locks.yml; layer caps (default 48 MiB / 2560 files, overlay 4 MiB / 512) keep every four-layer effective bundle within one 64 MiB / 4096-file cap.

Status: Active (Matt, 2026-10-13)

Record: ../../agent-config-overlays.md#decisions