0.4.1 fixes duplicate macOS accounting of guest memory while preserving partial physical reclamation and charging reused pages again. Compression-driven reclamation now yields when the guest needs memory, while real host-pressure safeguards remain active.
The real application-build matrix peaked at 21.12 GiB with 24 GiB configured, 11.96 GiB at 12 GiB, and 7.96 GiB at 8 GiB. The 24 GiB build succeeded; the smaller guests exhausted memory cleanly, then each ran a fresh container and a small uncached build without a VM restart. These are measured workload results: configured RAM limits guest memory, and host-process overhead can exceed it. Footprint includes compressed memory and is not a count of distinct resident physical pages.
Other fixes cover published-container removal deadlocks, socket-map rollback and buffer cleanup, guest idle wakeups, resizing pressure targets, build-worker OOM priority, descriptor capacity, preserving installer wrappers, startup without Docker CLI, and inherited cleanup locks. Shared-file invalidation now recovers after event loss and queue overflow. Twenty-second leases bound ordinary name and attribute caching when notifications are delayed.
Validation:
- Source 62c92de: hosted CI, 321 workspace tests, 15 signed hypervisor tests, extra regression scripts and all twelve hardware gates pass on M1 and M5.
- Complete share, guest-disk and amd64 benchmarks on both Macs precede packaging. Records use 297f622; production sources and guest inputs are unchanged through the release commit.
- Fresh archive smokes pass on both Macs: doctor, start, arm64 and amd64 containers, published TCP/UDP, guest IPv6 route and stop.
- Actual M1 Homebrew reinstall, brew test and fresh installed-prefix smoke pass, including signatures, stapled ticket, Gatekeeper and both container architectures. The M5 published-archive installer and daily VM checks pass, preserving the original 24 GiB configuration, data and launcher wrapper.
- Developer ID signed, hardened runtime, Apple notarization Accepted, submission 5d09e36e-8905-4ca1-9332-7d3277a0744d; stapled ticket and Gatekeeper checks pass.
Measured tradeoffs and remaining limits:
- Controlled M1 twenty-second versus long cache leases increased ripgrep medians from 229 to 357 ms (+55.9%) and copy from 6,007.5 to 7,353.5 ms (+22.4%, with overlap between arms). Workload-specific variance is recorded separately; small differences are not claimed as speedups. Correct memory accounting also costs initialization time and kernel metadata.
- macOS notification delivery can still be delayed for over twenty seconds. Earlier failed qualifications and independent traces remain recorded. Latest watch samples passed (M5 821/2/2 ms; M1 315/1/2 ms), but this is not a deterministic delivery guarantee. Existing mappings and same-size/same-mtime edits still require invalidation.
- A full working-day sleep/wake and VPN-change soak has not been performed. Optional PostgreSQL client and global IPv6 checks were unavailable on M1.
Archive SHA-256: 2f14375ef2ea1e065de856de39cb00c84489ff208e350333d31d5717861e3a9b.
The earlier 19c0786 prerelease, formerly tagged v0.4.1, is preserved as v0.4.1-rc.1 with its original archive. This release replaces it with the newly qualified runtime and separately notarized archive.
Benchmarks · Memory investigation · Event-delivery investigation · Repeatability