diff --git a/scripts/onboard/steps/20-base.sh b/scripts/onboard/steps/20-base.sh
index 72e9b41..3824912 100644
--- a/scripts/onboard/steps/20-base.sh
+++ b/scripts/onboard/steps/20-base.sh
@@ -25,10 +25,8 @@ if ! declare -f log >/dev/null 2>&1; then
 fi
 
 # ── parse node.yaml ───────────────────────────────────────────────────────────
-SSH_USER=$(yaml_get  "$NODE_YAML" "ssh_user")
+SSH_USER=$(yaml_get    "$NODE_YAML" "ssh_user")
 TS_HOSTNAME=$(yaml_get "$NODE_YAML" "tailscale.hostname")
-_raw_mb=$(yaml_get   "$NODE_YAML" "hardware.swap.mb" 2>/dev/null || true)
-SWAP_MB="${_raw_mb:-2048}"
 
 [[ -z "$SSH_USER"    ]] && die "ssh_user not set in $NODE_YAML"
 [[ -z "$TS_HOSTNAME" ]] && die "tailscale.hostname not set in $NODE_YAML"
@@ -47,55 +45,52 @@ rprobe() {
 # ═══════════════════════════════════════════════════════════════════════════════
 # Stage 1 — swap→zram
 # ═══════════════════════════════════════════════════════════════════════════════
-step "[$STEP_NAME] 1/3 swap→zram (target: zram ${SWAP_MB} MB, algo=zstd)"
+step "[$STEP_NAME] 1/3 swap→zram (PERCENT=50, algo=zstd)"
 
-# Guard: is dphys-swapfile still active?
-if rprobe 'systemctl is-active dphys-swapfile' >/dev/null 2>&1; then
-    log "dphys-swapfile active — disabling"
-    rrun sudo dphys-swapfile swapoff
-    rrun sudo systemctl disable --now dphys-swapfile
-    if rprobe '[ -f /var/swap ]' 2>/dev/null; then
-        rrun sudo rm -f /var/swap
-        log "Removed /var/swap"
-    fi
+# Guard by EFFECT: zram device present in swapon AND dphys-swapfile not active
+# → desired end-state already reached, skip the whole stage.
+_zram_active=0
+_dphys_active=0
+rprobe 'sudo swapon --show 2>/dev/null | grep -q /dev/zram' && _zram_active=1 || true
+rprobe 'systemctl is-active dphys-swapfile' >/dev/null 2>&1  && _dphys_active=1 || true
+
+if [[ "$_zram_active" -eq 1 && "$_dphys_active" -eq 0 ]]; then
+    log "zram already active, dphys-swapfile not active — skip"
 else
-    log "dphys-swapfile not active — skip disable"
-fi
-
-# Guard: is zram-tools installed?
-if ! rprobe 'command -v zramswap' >/dev/null 2>&1; then
-    log "zram-tools not found — installing"
-    rrun sudo apt-get install -y zram-tools
-else
-    log "zram-tools already installed"
-fi
-
-# Guard: is zram already active with the correct SIZE?
-_zram_ok=0
-if rprobe 'swapon --show --noheadings 2>/dev/null | grep -q zram' 2>/dev/null; then
-    _cfg_size=$(rprobe \
-        "grep -E '^[[:space:]]*SIZE=' /etc/default/zramswap 2>/dev/null \
-         | cut -d= -f2 | tr -d '\"[:space:]'" 2>/dev/null || echo "")
-    if [[ "$_cfg_size" == "$SWAP_MB" ]]; then
-        _zram_ok=1
-        log "zram active, SIZE=${SWAP_MB} MB — skip configure"
+    # Substage: disable dphys-swapfile if still active
+    if [[ "$_dphys_active" -eq 1 ]]; then
+        log "dphys-swapfile active — disabling"
+        rrun sudo dphys-swapfile swapoff
+        rrun sudo systemctl disable --now dphys-swapfile
+        if rprobe '[ -f /var/swap ]' 2>/dev/null; then
+            rrun sudo rm -f /var/swap
+            log "Removed /var/swap"
+        fi
     else
-        log "zram active but SIZE='${_cfg_size:-unset}' ≠ ${SWAP_MB} — reconfigure"
+        log "dphys-swapfile not active — skip disable"
     fi
-fi
 
-if [[ "$_zram_ok" -eq 0 ]]; then
-    log "Writing /etc/default/zramswap (ALGO=zstd, SIZE=${SWAP_MB})"
-    rrun sudo bash -c "printf 'ALGO=zstd\nSIZE=${SWAP_MB}\n' | tee /etc/default/zramswap > /dev/null"
+    # Substage: install zram-tools if package not present
+    # Use dpkg -l rather than command -v: zramswap binary may not be on PATH over SSH
+    if ! rprobe 'dpkg -l zram-tools 2>/dev/null | grep -q "^ii"' 2>/dev/null; then
+        log "zram-tools not installed — installing"
+        rrun sudo apt-get install -y zram-tools
+    else
+        log "zram-tools already installed"
+    fi
+
+    # Write config and (re)start zramswap
+    log "Writing /etc/default/zramswap (ALGO=zstd, PERCENT=50)"
+    rrun bash -c "printf '%s\n' 'ALGO=zstd' 'PERCENT=50' | sudo tee /etc/default/zramswap > /dev/null"
     rrun sudo systemctl enable zramswap
     rrun sudo systemctl restart zramswap
 fi
 
 # Verify (skipped in dry-run — mutations may not have run)
 if [ "${DRY_RUN:-0}" != 1 ]; then
-    if rprobe 'swapon --show --noheadings 2>/dev/null | grep -q zram'; then
+    if rprobe 'sudo swapon --show 2>/dev/null | grep -q /dev/zram'; then
         log "Verify OK: zram swap active"
-        rprobe 'swapon --show; echo "---"; zramctl' || true
+        rprobe 'sudo swapon --show' || true
     else
         die "zram swap not active after setup — check: systemctl status zramswap on ${TS_HOSTNAME}"
     fi