The envelope is where the mathematics agrees to fly.
Mass and centre of gravity are limited together, as a polygon on a chart, and each edge of that polygon is a different physical failure waiting outside it. The top edge is structure — spar bending, landing gear. The forward edge is control authority: enough tail power to flare, to hold the nose up at low speed. The aft edge is stability, and it is the edge this article keeps returning to, because it is the one that kills the most politely.
The centre of gravity is nothing mystical: total moment divided by total mass, a weighted average of everything on board. Each seat, tank and locker has a fixed arm from the datum; you multiply, sum and divide. The tool below does it live for two aircraft, and the point of the exercise is watching the dot move — because everything you load moves it.
Aft CG is a stability loan.
Moving the CG aft is genuinely pleasant at first: the tail carries less download, trim drag falls, the stick lightens, cruise gets a knot faster. You are borrowing against static stability — the tendency of the nose to drop and speed to recover after a disturbance. Keep moving aft and the loan comes due: the aircraft hunts in pitch, stalls with less warning, and the spin flattens as the mass moves toward the tail, right up to the point where recovery inputs no longer have the leverage to work.
That is why the aft limit is not a comfort boundary but a certification one, demonstrated by a test pilot with a recovery parachute. The margin between "delightfully light in pitch" and "unrecoverable" is the width of a few centimetres of CG travel — which is exactly the quantity the tool prints.
Load it, then look at the dot.
Slide the glider's front pilot from 90 kg down to 55 and watch the dot leave the envelope backwards — the placard was never about politeness. Then add tail ballast and watch the minimum cockpit load climb: mass four metres behind the datum is concentrated aft CG, which is why fin-tank placards raise the minimum seat load. The light pilot's cure sits at the other end — seat ballast, or the rear pilot, who genuinely brings the requirement down. In the trainer, note the dashed line: the flight travels it as fuel burns, and both ends must be inside.
The glider case: why there is a minimum pilot.
A glider pilot sits far ahead of the wing — the arm is large and negative. A heavy pilot drags the CG forward; a light pilot is an aft CG. Solve the aft-limit inequality for pilot mass and a number falls out: for the schematic two-seater in the tool, 65.6 kg. That is the placard on the cockpit wall, derived rather than decreed — and the tool re-derives it live as you move the rear pilot and ballast.
This is also why tail and fin ballast systems exist, and why "just add a cushion" is not a loading strategy: the cushion moves comfort, not moment. Seat ballast weights bolted at a known arm move the mathematics — which is the only thing the wing responds to.
Fuel burns, CG walks.
An aeroplane is not loaded once — it reloads itself continuously as the tanks empty. Depending on where the fuel sits relative to the CG, burning it walks the dot forward or aft, and the certification rule is blunt: the aircraft must be inside the envelope at takeoff mass and at zero-fuel mass, because the flight will travel the whole line between them without asking permission. The tool draws that line; a plan whose zero-fuel end pokes outside the polygon is illegal before the engine starts.
In your cockpit.
Do the arithmetic before every non-routine loading — new rear passenger, full water, winter clothing, the tow-out kit in the baggage compartment — and do it on the instrument, where the arms are stored and the adding is honest. Thirty seconds on a loading page settles what no amount of stick feel diagnoses reliably in flight, and it settles it while the mistake is still standing on the grass.
Why the aft-CG stall is the one that bites — the wing's view of the same story — is the angle of attack article.