@runuai/host 0.9.78 → 0.9.80

package/images/standard/container/uai-init

@@ -419,9 +419,25 @@ install_folder_deps() {
 
 reject_workspace_runtime_shadow || exit 78
 
-if [ -d "$WORKSPACE" ] && [ -f "$RUNTIME_PROJECTS" ] \
-   && [ ! -L "$RUNTIME_PROJECTS" ]; then
-  seen_runtime_projects="|"
+# ADR-122: dependency installs leave the task-start critical path. The loop
+# below runs in a DETACHED background process so uai-init (and with it
+# task-up) returns as soon as the cheap, provable work is done — the editor
+# and the agents start immediately, warm or cold. Progress is observable in
+# the workspace itself:
+#
+#   $WORKSPACE/.uai/init/deps-status   running | done | failed | authority-violation
+#   $WORKSPACE/.uai/init/deps.log      the full install transcript
+#
+# The runtime-authority posture narrows deliberately: the synchronous
+# workspace-shadow proofs above and below still exit 78 (task-up
+# quarantines), but a shadow that APPEARS MID-INSTALL can no longer stop the
+# task — agents are already running by then, and an agent could author the
+# same shadow a second later anyway. The runner still refuses to run any
+# further dependency command under a shadowed root and records
+# `authority-violation`; the shared asdf volume stays read-only-proven
+# regardless.
+run_workspace_installs() {
+  local seen_runtime_projects="|" project_slug folder git_marker
   while IFS= read -r project_slug || [ -n "$project_slug" ]; do
     if [[ ! "$project_slug" =~ ^[a-z0-9-]{1,64}$ ]]; then
       log "warning: unsafe runtime-project allowlist entry — skipping"
@@ -441,11 +457,67 @@ if [ -d "$WORKSPACE" ] && [ -f "$RUNTIME_PROJECTS" ] \
       log "warning: allowlisted project $project_slug is not a safe Git worktree — skipping"
       continue
     fi
-    reject_workspace_runtime_shadow || exit 78
+    if ! reject_workspace_runtime_shadow; then
+      printf 'authority-violation\n' > "$deps_status_file"
+      return 78
+    fi
     # Run in a subshell so a `cd` (or a failing command under the relaxed
     # error mode) in one folder never leaks into the next.
     ( install_folder_deps "$folder" )
   done < "$RUNTIME_PROJECTS"
+  return 0
+}
+
+if [ -d "$WORKSPACE" ] && [ -f "$RUNTIME_PROJECTS" ] \
+   && [ ! -L "$RUNTIME_PROJECTS" ]; then
+  deps_state_dir="$WORKSPACE/.uai/init"
+  deps_status_file="$deps_state_dir/deps-status"
+  deps_log_file="$deps_state_dir/deps.log"
+  deps_lock_dir="$deps_state_dir/deps.lock.d"
+  mkdir -p "$deps_state_dir"
+
+  # One runner at a time. uai-init is re-runnable (task-up retry, recovery),
+  # and each re-run SHOULD refresh dependencies — but never concurrently.
+  # mkdir is the portable atomic lock; a pid that no longer answers marks a
+  # crashed runner whose lock is stale and may be stolen.
+  deps_spawn=1
+  if mkdir "$deps_lock_dir" 2>/dev/null; then
+    # Hold the lock as ourselves until the runner's pid replaces it, so a
+    # concurrent uai-init never reads an empty pid file as a stale lock.
+    printf '%s\n' "$$" > "$deps_lock_dir/pid"
+  else
+    deps_holder=$(cat "$deps_lock_dir/pid" 2>/dev/null || true)
+    if [ -n "$deps_holder" ] && kill -0 "$deps_holder" 2>/dev/null; then
+      log "dependency install already running (pid $deps_holder) — leaving it be"
+      deps_spawn=0
+    else
+      rm -rf "$deps_lock_dir"
+      if mkdir "$deps_lock_dir" 2>/dev/null; then
+        printf '%s\n' "$$" > "$deps_lock_dir/pid"
+      else
+        log "warning: could not acquire the dependency install lock — skipping installs"
+        deps_spawn=0
+      fi
+    fi
+  fi
+  if [ "$deps_spawn" -eq 1 ]; then
+    printf 'running\n' > "$deps_status_file"
+    log "installing workspace dependencies in the background (status: $deps_status_file, log: $deps_log_file)"
+    (
+      trap 'rm -rf "$deps_lock_dir"' EXIT
+      deps_rc=0
+      run_workspace_installs || deps_rc=$?
+      if [ "$deps_rc" -eq 0 ]; then
+        printf 'done\n' > "$deps_status_file"
+        log "workspace dependency install complete"
+      elif [ "$deps_rc" -ne 78 ]; then
+        printf 'failed\n' > "$deps_status_file"
+        log "workspace dependency install failed (exit $deps_rc)"
+      fi
+    ) >>"$deps_log_file" 2>&1 </dev/null &
+    printf '%s\n' "$!" > "$deps_lock_dir/pid"
+    disown
+  fi
 elif [ ! -d "$WORKSPACE" ]; then
   log "workspace $WORKSPACE missing — scratchpad/no-project task, skipping installs"
 else

package/lib/browser-testing.ts

@@ -50,6 +50,7 @@ import {
 } from "./task-container-cli";
 import { MCP_CONFIG_LOCK_PATH } from "./mcp-config-lock";
 import {
+  MACHINE_RUNTIME_AUTHORITY_ENV,
   RUNTIME_AUTHORITY_ENV,
   runtimeAuthorityDockerExecArgs,
 } from "./runtime-authority";
@@ -994,8 +995,19 @@ export async function setupBrowserTesting(
   containerName: string,
   hasCodex: boolean,
   codexHomes: readonly string[] = hasCodex ? [DEFAULT_CODEX_HOME] : [],
-  environment?: Pick<TaskEnvironmentHandle, "exec" | "launchDetachedSession">,
+  environment?: Pick<TaskEnvironmentHandle, "exec" | "launchDetachedSession"> &
+    Partial<Pick<TaskEnvironmentHandle, "descriptor">>,
 ): Promise<BrowserSetup> {
+  // Machine sessions run under MACHINE_RUNTIME_AUTHORITY_ENV, so every setup
+  // exec here must too — the prewarm in particular. Warming npx under the
+  // CONTAINER authority (private NPM_CONFIG_CACHE) leaves the session-default
+  // npm cache cold, and Codex's 10s MCP startup deadline then kills the
+  // browser (and every npx-launched server) for the session's whole lifetime
+  // while Claude's 30s survives — live 2026-08-28, first codex machine task.
+  const authorityEnv =
+    environment?.descriptor?.locator.provider === "machine"
+      ? MACHINE_RUNTIME_AUTHORITY_ENV
+      : RUNTIME_AUTHORITY_ENV;
   let ready = false;
   let configured = false;
   let changed = false;
@@ -1029,7 +1041,7 @@ export async function setupBrowserTesting(
       if (environment) {
         await environment.launchDetachedSession({
           argv: ["sh", "-c", step],
-          env: RUNTIME_AUTHORITY_ENV,
+          env: authorityEnv,
           maxOutputBytes: 64 * 1024,
           launchTimeoutMs: 10_000,
         });
@@ -1067,14 +1079,14 @@ export async function setupBrowserTesting(
           await environment.exec({
             argv: ["/usr/bin/chown", "node:node", "/opt/pw-browsers"],
             user: "root",
-            env: RUNTIME_AUTHORITY_ENV,
+            env: authorityEnv,
             timeoutMs: 5_000,
             maxOutputBytes: 64 * 1024,
           });
           return environment.exec({
             argv: ["sh", "-lc", PREWARM_CMD],
             cwd: "/workspace",
-            env: RUNTIME_AUTHORITY_ENV,
+            env: authorityEnv,
             timeoutMs: INSTALL_TIMEOUT_MS,
             maxOutputBytes: 256 * 1024,
           });
@@ -1140,7 +1152,7 @@ export async function setupBrowserTesting(
       (10 + Math.max(45, 15 + selectedCodexHomes.length * 12) + 5 + 10) *
       1_000;
     const writeEnv = {
-      ...RUNTIME_AUTHORITY_ENV,
+      ...authorityEnv,
       UAI_BROWSER_DEF: JSON.stringify(SERVER_DEF),
       UAI_MCP_PATH: MCP_CONFIG_PATH,
       UAI_CLAUDE_SETTINGS_PATH: CLAUDE_SETTINGS_PATH,
@@ -1276,7 +1288,7 @@ export async function setupBrowserTesting(
     ].join("; ");
 
     const rootWorkerEnv = {
-      ...RUNTIME_AUTHORITY_ENV,
+      ...authorityEnv,
       NPM_CONFIG_CACHE: "/tmp/uai-root-npm-cache",
       npm_config_cache: "/tmp/uai-root-npm-cache",
       NPM_CONFIG_LOGS_DIR: "/tmp/uai-root-npm-cache/_logs",

package/lib/machine-provider-aws.ts

@@ -42,8 +42,14 @@ export interface AwsMachineConfig {
   /** Override the size ladder; the default picks the smallest Graviton
    * type satisfying both cpu and memory. */
   instanceType?: (spec: MachineSpec) => string;
+  /** Root EBS volume size. The AMI snapshot default (8 GiB Debian) starves
+   * real work — a monorepo install plus a browser left ~36 MB free live
+   * (2026-08-28). cloud-init's growpart expands the filesystem on boot. */
+  diskGiB?: number;
 }
 
+const DEFAULT_DISK_GIB = 50;
+
 type Runner = (args: string[]) => Promise<DockerResult>;
 
 const DEFAULT_TIMEOUT_MS = 60_000;
@@ -224,6 +230,41 @@ export function createAwsMachineProvider(
     return machineId.slice("uai-machine-".length);
   };
 
+  /** Root device name per AMI, resolved once per process. A failure throws:
+   * guessing the device would silently attach a blank second volume while
+   * the root stays at its 8 GiB snapshot size. */
+  const rootDeviceByImage = new Map<string, string>();
+  async function rootDeviceName(image: string): Promise<string> {
+    const cached = rootDeviceByImage.get(image);
+    if (cached) return cached;
+    const res = await runner([
+      "ec2",
+      "describe-images",
+      "--image-ids",
+      image,
+      "--query",
+      "Images[0].RootDeviceName",
+    ]);
+    if (res.status !== 0) {
+      throw new Error(
+        `could not resolve the root device of ${image}: ${
+          res.stderr.trim() || `exit ${res.status ?? "killed"}`
+        }`,
+      );
+    }
+    let device: unknown;
+    try {
+      device = JSON.parse(res.stdout);
+    } catch {
+      device = null;
+    }
+    if (typeof device !== "string" || !device.startsWith("/dev/")) {
+      throw new Error(`image ${image} reports no root device name`);
+    }
+    rootDeviceByImage.set(image, device);
+    return device;
+  }
+
   /** Resolve the logical machine id to its live instances via the tag. */
   async function resolveLive(
     machineId: string,
@@ -292,6 +333,12 @@ export function createAwsMachineProvider(
       // identical retry still cannot mint a second instance; a CHANGED
       // launch legitimately gets a fresh token, and the resume-aware
       // provision's describe-first step remains the guard against doubling
+      // The AMI snapshot's root volume (8 GiB on the Debian payload) starves
+      // real work; request a task-sized gp3 root instead. The mapping must
+      // name the AMI's actual root device — a wrong name would ADD a blank
+      // volume while the root stays small — so resolve it per image.
+      const diskGiB = config.diskGiB ?? DEFAULT_DISK_GIB;
+      const rootDevice = await rootDeviceName(spec.image);
       // a live machine.
       const launchFingerprint = createHash("sha256")
         .update(
@@ -302,6 +349,7 @@ export function createAwsMachineProvider(
             config.subnetId ?? null,
             config.securityGroupId ?? null,
             config.iamInstanceProfileArn ?? null,
+            diskGiB,
           ]),
         )
         .digest("hex")
@@ -321,6 +369,17 @@ export function createAwsMachineProvider(
         `${machineId}-${launchFingerprint}`.slice(0, 64),
         "--tag-specifications",
         `ResourceType=instance,Tags=[{Key=${AWS_MACHINE_TAG},Value=${spec.taskId}},{Key=Name,Value=${machineId}}]`,
+        "--block-device-mappings",
+        JSON.stringify([
+          {
+            DeviceName: rootDevice,
+            Ebs: {
+              VolumeSize: diskGiB,
+              VolumeType: "gp3",
+              DeleteOnTermination: true,
+            },
+          },
+        ]),
         ...(spec.authorizedPublicKey
           ? ["--user-data", awsUserData(spec.authorizedPublicKey)]
           : []),

package/lib/task-environment/index.ts

@@ -138,11 +138,13 @@ function machineBackend() {
     if (!region) {
       throw new Error("UAI_MACHINE_PROVIDER=aws requires UAI_AWS_REGION");
     }
+    const diskGiB = Number(process.env.UAI_MACHINE_DISK_GIB ?? "");
     return createAwsMachineProvider({
       region,
       subnetId: process.env.UAI_AWS_SUBNET_ID,
       securityGroupId: process.env.UAI_AWS_SECURITY_GROUP_ID,
       iamInstanceProfileArn: process.env.UAI_AWS_INSTANCE_PROFILE_ARN,
+      ...(Number.isInteger(diskGiB) && diskGiB > 0 ? { diskGiB } : {}),
     });
   }
   return createLocalMachineProvider();

package/lib/vnode-pressure.ts

@@ -0,0 +1,103 @@
+/**
+ * ADR-118 follow-up: the macOS vnode-table pressure sensor.
+ *
+ * Apple's Virtualization.framework virtiofs pins one host vnode per distinct
+ * guest-touched file for the life of the task VM (~12k per task after
+ * ADR-118 moved the pnpm store off virtiofs; ~130k+ before it). The table
+ * ceiling (`kern.maxvnodes`) is a boot-time default the host cannot raise
+ * without root, and AT the ceiling unrelated host software starts failing
+ * with ENFILE — the suspected 2026-08-24 kernel-panic precursor.
+ *
+ * Three surfaces ride this module:
+ *  - `readVnodePressure()` — the sensor (cached; null off-macOS).
+ *  - `vnodeAdmissionProblem()` — task-up guard: refuse to start ANOTHER
+ *    apple-container VM above the threshold instead of letting the kernel
+ *    hit the wall. Existing tasks keep running.
+ *  - `logVnodePressure()` — periodic observability, warn-level near the
+ *    ceiling so host logs explain refusals before they happen.
+ *
+ * Raising the ceiling needs root once: `sudo uai-host tune` (see cli.ts)
+ * installs a LaunchDaemon that reasserts the sysctls at every boot —
+ * sysctl writes alone are ephemeral.
+ */
+
+import { execFile } from "node:child_process";
+import { promisify } from "node:util";
+
+const exec = promisify(execFile);
+
+/** Refuse NEW apple task VMs above this fraction of the vnode ceiling. */
+const ADMISSION_THRESHOLD = 0.9;
+/** Warn-log above this fraction. */
+const WARN_THRESHOLD = 0.8;
+const CACHE_MS = 15_000;
+
+export interface VnodePressure {
+  current: number;
+  max: number;
+  ratio: number;
+}
+
+let cached: { at: number; value: VnodePressure | null } | null = null;
+
+export async function readVnodePressure(): Promise<VnodePressure | null> {
+  if (process.platform !== "darwin") return null;
+  if (cached && Date.now() - cached.at < CACHE_MS) return cached.value;
+  let value: VnodePressure | null = null;
+  try {
+    const { stdout } = await exec(
+      "/usr/sbin/sysctl",
+      ["-n", "kern.num_vnodes", "kern.maxvnodes"],
+      { timeout: 5_000 },
+    );
+    const parts = stdout.trim().split(/\s+/).map(Number);
+    const current = parts[0] ?? Number.NaN;
+    const max = parts[1] ?? Number.NaN;
+    if (Number.isFinite(current) && Number.isFinite(max) && max > 0) {
+      value = { current, max, ratio: current / max };
+    }
+  } catch {
+    // Sensor failure is never a task failure; admission simply has no data.
+  }
+  cached = { at: Date.now(), value };
+  return value;
+}
+
+/** Non-null = refuse to start another apple-container task VM right now. */
+export async function vnodeAdmissionProblem(): Promise<string | null> {
+  const pressure = await readVnodePressure();
+  if (!pressure || pressure.ratio < ADMISSION_THRESHOLD) return null;
+  return (
+    `the macOS vnode table is at ${Math.round(pressure.ratio * 100)}% ` +
+    `(${pressure.current}/${pressure.max}); starting another task VM risks ` +
+    "system-wide file-table exhaustion. Close a running task, or raise the " +
+    "ceiling once with: sudo uai-host tune"
+  );
+}
+
+let lastLoggedBand: "ok" | "warn" | "critical" = "ok";
+
+/** Log on band TRANSITIONS only, so a host sitting near the ceiling does not
+ * spam its own log every interval. */
+export async function logVnodePressure(): Promise<void> {
+  const pressure = await readVnodePressure();
+  if (!pressure) return;
+  const band =
+    pressure.ratio >= ADMISSION_THRESHOLD
+      ? "critical"
+      : pressure.ratio >= WARN_THRESHOLD
+        ? "warn"
+        : "ok";
+  if (band === lastLoggedBand) return;
+  lastLoggedBand = band;
+  const detail = `${pressure.current}/${pressure.max} (${Math.round(pressure.ratio * 100)}%)`;
+  if (band === "critical") {
+    console.warn(
+      `[vnode] table at ${detail} — new apple task VMs will be refused; run: sudo uai-host tune`,
+    );
+  } else if (band === "warn") {
+    console.warn(`[vnode] table filling: ${detail}`);
+  } else {
+    console.log(`[vnode] table pressure back to normal: ${detail}`);
+  }
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@runuai/host",
-  "version": "0.9.78",
+  "version": "0.9.80",
   "description": "Uai host — runs ephemeral AI tasks in containers on a machine you control.",
   "license": "MIT",
   "author": "Uai Tech <team@runuai.com>",

package/src/cli.ts

@@ -22,7 +22,7 @@ import "./load-env";
 
 import { spawn, spawnSync } from "node:child_process";
 import { createHash, randomBytes } from "node:crypto";
-import { existsSync, mkdirSync, readFileSync } from "node:fs";
+import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
 import { homedir, hostname } from "node:os";
 import { dirname, join, resolve } from "node:path";
 
@@ -137,6 +137,8 @@ async function main(): Promise<void> {
       return cmdLogs(follow);
     case "runtime":
       return cmdRuntime(rest);
+    case "tune":
+      return cmdTune();
     case "update":
       return cmdUpdate(rest);
     case "rollback":
@@ -498,6 +500,139 @@ async function boundedResponseJson(
 
 // --- runtime ---------------------------------------------------------------
 
+// --- tune (ADR-118 follow-up: vnode/file-table ceilings) ---------------------
+
+const TUNE_DAEMON_LABEL = "com.runuai.tune";
+const TUNE_DAEMON_PLIST = `/Library/LaunchDaemons/${TUNE_DAEMON_LABEL}.plist`;
+/** Floors, not targets — an operator-raised ceiling is never lowered. Each
+ * apple-container task VM pins host vnodes for its life (~12k after ADR-118,
+ * far more during dependency churn), and the boot defaults sit low enough
+ * that two heavy tasks have filled the table live (2026-08-25). ~2M vnodes
+ * is roughly half a GB of kernel memory IF fully populated. */
+const TUNE_MAXVNODES_FLOOR = 2_097_152;
+const TUNE_MAXFILES_FLOOR = 2_097_152;
+const TUNE_MAXFILESPERPROC_FLOOR = 1_048_576;
+
+function readSysctlNumber(name: string): number | null {
+  const res = spawnSync("/usr/sbin/sysctl", ["-n", name], {
+    encoding: "utf8",
+  });
+  const value = Number((res.stdout ?? "").trim());
+  return res.status === 0 && Number.isFinite(value) ? value : null;
+}
+
+function tunePlistContent(settings: Array<[string, number]>): string {
+  const args = ["/usr/sbin/sysctl", ...settings.map(([k, v]) => `${k}=${v}`)]
+    .map((a) => `    <string>${a}</string>`)
+    .join("\n");
+  return `<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+<dict>
+  <key>Label</key>
+  <string>${TUNE_DAEMON_LABEL}</string>
+  <key>ProgramArguments</key>
+  <array>
+${args}
+  </array>
+  <key>RunAtLoad</key>
+  <true/>
+</dict>
+</plist>
+`;
+}
+
+async function cmdTune(): Promise<void> {
+  if (process.platform !== "darwin") {
+    console.error(red("tune is macOS-only (apple-container task VMs)"));
+    process.exitCode = 1;
+    return;
+  }
+  const current = {
+    maxvnodes: readSysctlNumber("kern.maxvnodes"),
+    maxfiles: readSysctlNumber("kern.maxfiles"),
+    maxfilesperproc: readSysctlNumber("kern.maxfilesperproc"),
+  };
+  if (
+    current.maxvnodes === null ||
+    current.maxfiles === null ||
+    current.maxfilesperproc === null
+  ) {
+    console.error(red("could not read the current kernel limits via sysctl"));
+    process.exitCode = 1;
+    return;
+  }
+  // Order matters at apply time: maxfilesperproc must stay <= maxfiles.
+  const settings: Array<[string, number]> = [
+    ["kern.maxfiles", Math.max(current.maxfiles, TUNE_MAXFILES_FLOOR)],
+    [
+      "kern.maxfilesperproc",
+      Math.max(current.maxfilesperproc, TUNE_MAXFILESPERPROC_FLOOR),
+    ],
+    ["kern.maxvnodes", Math.max(current.maxvnodes, TUNE_MAXVNODES_FLOOR)],
+  ];
+  const desiredPlist = tunePlistContent(settings);
+  const plistCurrent = existsSync(TUNE_DAEMON_PLIST)
+    ? readFileSync(TUNE_DAEMON_PLIST, "utf8")
+    : null;
+  const changes = settings.filter(
+    ([key, value]) => value !== current[key.slice("kern.".length) as keyof typeof current],
+  );
+  if (changes.length === 0 && plistCurrent === desiredPlist) {
+    const summary = settings.map(([k, v]) => `${k}=${v}`).join(" ");
+    console.log(`already tuned (${summary}); boot persistence in place`);
+    return;
+  }
+
+  if (typeof process.getuid !== "function" || process.getuid() !== 0) {
+    console.log(`${bold("uai-host tune")} will (needs sudo):`);
+    for (const [key, value] of changes) {
+      console.log(
+        `  raise ${key}: ${current[key.slice("kern.".length) as keyof typeof current]} -> ${value}`,
+      );
+    }
+    console.log(
+      `  install ${TUNE_DAEMON_PLIST} so the limits survive reboots`,
+    );
+    console.log(`\nrun: ${cyan("sudo uai-host tune")}`);
+    process.exitCode = 1;
+    return;
+  }
+
+  for (const [key, value] of settings) {
+    const res = spawnSync("/usr/sbin/sysctl", [`${key}=${value}`], {
+      encoding: "utf8",
+    });
+    if (res.status !== 0) {
+      console.error(
+        red(`sysctl ${key}=${value} failed: ${(res.stderr ?? "").trim()}`),
+      );
+      process.exitCode = 1;
+      return;
+    }
+  }
+  writeFileSync(TUNE_DAEMON_PLIST, desiredPlist, { mode: 0o644 });
+  spawnSync("/usr/sbin/chown", ["root:wheel", TUNE_DAEMON_PLIST]);
+  // Re-bootstrap so launchd owns the daemon under its current definition.
+  spawnSync("/bin/launchctl", ["bootout", `system/${TUNE_DAEMON_LABEL}`]);
+  const bootstrap = spawnSync(
+    "/bin/launchctl",
+    ["bootstrap", "system", TUNE_DAEMON_PLIST],
+    { encoding: "utf8" },
+  );
+  if (bootstrap.status !== 0) {
+    console.error(
+      red(
+        `limits applied, but launchctl bootstrap failed (${(bootstrap.stderr ?? "").trim()}) — they will not survive a reboot`,
+      ),
+    );
+    process.exitCode = 1;
+    return;
+  }
+  const summary = settings.map(([k, v]) => `${k}=${v}`).join(" ");
+  console.log(`tuned: ${summary} (persisted via ${TUNE_DAEMON_PLIST})`);
+}
+
 async function cmdRuntime(rest: string[]): Promise<void> {
   if (rest[0] === "begin-install") {
     return cmdBeginRuntimeInstall(rest.slice(1));
@@ -1882,6 +2017,8 @@ function printHelp(): void {
   status               connection, service info, active tasks (same as the UI)
   logs [--follow]      tail the service log
   runtime recheck      probe Docker again and refresh cloud capabilities
+  tune                 (macOS, sudo) raise kernel vnode/file-table ceilings for
+                       apple-container task VMs and persist them across boots
   setup --cloud <wss-url> --enroll <token>
                        claim this machine via an enrollment token from the web
                        app (mints + writes the host credential); on an

package/src/index.ts

@@ -70,10 +70,12 @@ import {
   containerRuntimeTeardownProblem,
   ensureContainerRuntimeForTask,
   initializeContainerRuntime,
+  pinnedContainerRuntimeProvider,
   reprobeContainerRuntimeMachineIdentity,
   suspendContainerRuntime,
   waitForContainerRuntimeOperational,
 } from "../lib/container-runtime";
+import { vnodeAdmissionProblem } from "../lib/vnode-pressure";
 import {
   provisionTaskEnvironment,
   reconstructPersistedTaskEnvironment,
@@ -264,6 +266,21 @@ export const hostCommands: HostCommands = {
     if (readyAdmissionFailure) return readyAdmissionFailure;
     const readyRuntimeFailure = runtimeUnavailable();
     if (readyRuntimeFailure) return readyRuntimeFailure;
+    // ADR-118 follow-up: each apple-container task is its own VM, and each
+    // VM pins host vnodes for its life. Refuse to start ANOTHER one when the
+    // table is nearly full — a clear, retryable refusal now beats ENFILE
+    // storms (and the suspected panic path) for the whole machine later.
+    if (pinnedContainerRuntimeProvider() === "apple-container") {
+      const vnodeProblem = await vnodeAdmissionProblem();
+      if (vnodeProblem) {
+        return {
+          ok: false,
+          code: HostErrorCode.HostUnavailable,
+          message: vnodeProblem,
+          retryable: true,
+        };
+      }
+    }
     const orchestrator = getOrchestrator();
     return orchestrator.runTaskLifecycle(input.task.id, async () => {
       // A direct duplicate teardown may still be draining operations that

package/src/main.ts

@@ -110,6 +110,7 @@ import {
   publishActivationPhase,
 } from "../lib/container-runtime";
 import { reconstructPersistedTaskEnvironment } from "../lib/task-environment";
+import { logVnodePressure } from "../lib/vnode-pressure";
 import { resolveAppleTunnelRoute } from "./apple-tunnel-route";
 import {
   configureBundledContainerRuntime,
@@ -516,6 +517,11 @@ void connect();
 // Local browser UI (ADR-028) — same single process, alongside the WSS client.
 // Best-effort: a UI bind failure must not take the host service down.
 void startLocalUi();
+// ADR-118 follow-up: vnode-pressure observability (macOS/apple-container
+// hosts). Logs only on band transitions; the sensor caches its sysctl read.
+const vnodePressureTimer = setInterval(() => void logVnodePressure(), 60_000);
+vnodePressureTimer.unref?.();
+void logVnodePressure();
 
 async function startLocalUi(): Promise<void> {
   try {