diff --git a/scripts/setup/machine-setup/lib/system.sh b/scripts/setup/machine-setup/lib/system.sh
index dd2654ba..ffc261d8 100644
--- a/scripts/setup/machine-setup/lib/system.sh
+++ b/scripts/setup/machine-setup/lib/system.sh
@@ -173,6 +173,168 @@ swappiness_set() {
   sysctl -q -w "vm.swappiness=$1"
 }
 
+# -----------------------------------------------------------------------------
+# Emergency disk ballast
+# -----------------------------------------------------------------------------
+#
+# The same idea as swap, one layer down. Swap is the valve for memory pressure;
+# this is the valve for disk pressure.
+#
+# A junk file holding no data, sized at 10% of free disk. Its only job is to be
+# deleted when the filesystem is about to fill, buying enough headroom to log in
+# and clean up properly instead of meeting a wedged box — Docker, journald and
+# postgres all misbehave badly at 100% full, and some of them do not recover on
+# their own.
+#
+# A one-shot valve: once spent, it has to be recreated.
+#
+# ── Moved out of the user's home ──
+#
+# The original put the checker in $USER_HOME/.local/bin and ran it from a root
+# cron. A root cron executing a script inside a directory its owner can write is
+# a privilege escalation waiting to be noticed — moot on a box where that user
+# already has passwordless sudo, but wrong, and not something to carry forward.
+# Both the script and the file now live in root-owned system paths.
+
+BALLAST_FILE=/var/lib/machine-setup/ballast.bin
+BALLAST_CHECKER=/usr/local/sbin/emergency-disk-check
+BALLAST_CRON=/etc/cron.d/emergency-disk-check
+BALLAST_THRESHOLD=10
+
+ballast_exists() { [[ -f "$BALLAST_FILE" ]]; }
+
+ballast_size_human() { du -h "$BALLAST_FILE" 2>/dev/null | cut -f1; }
+
+# 10% of what is free right now, in MiB.
+ballast_size_mb() {
+  local free_kb
+  free_kb="$(df -Pk /var/lib | awk 'NR == 2 { print $4 }')"
+  echo $((free_kb / 1024 / 10))
+}
+
+ballast_create() {
+  local mb="$1"
+  mkdir -p "$(dirname "$BALLAST_FILE")"
+
+  # fallocate reserves real blocks. A sparse file made with truncate would
+  # reserve nothing and free nothing when deleted, which is the entire point.
+  if ! fallocate -l "${mb}M" "$BALLAST_FILE" 2>/dev/null; then
+    info "     fallocate is not usable here — writing with dd, which is slower"
+    dd if=/dev/zero of="$BALLAST_FILE" bs=1M count="$mb" status=none
+  fi
+  chmod 600 "$BALLAST_FILE"
+}
+
+ballast_install_checker() {
+  mkdir -p "$(dirname "$BALLAST_FILE")"
+  cat >"$BALLAST_CHECKER" <<CHECKER
+#!/usr/bin/env bash
+#
+# Emergency disk ballast checker. Installed by machine-setup.
+#
+# Deletes the pre-allocated ballast file when free space falls below the
+# threshold, buying headroom to log in and clean up. Run with --status to see
+# where things stand without changing anything.
+
+set -euo pipefail
+
+BALLAST="${BALLAST_FILE}"
+THRESHOLD=${BALLAST_THRESHOLD}
+TAG="emergency-disk"
+
+# Walk up to a directory that exists. The ballast's own directory is gone if
+# somebody cleaned up after the valve was spent, and df failing under
+# \`set -e\` would make cron mail an error every ten minutes.
+MOUNT_DIR="\$(dirname "\$BALLAST")"
+while [[ ! -d "\$MOUNT_DIR" && "\$MOUNT_DIR" != "/" ]]; do MOUNT_DIR="\$(dirname "\$MOUNT_DIR")"; done
+USE_PCT="\$(df -P "\$MOUNT_DIR" | awk 'NR == 2 { gsub(/%/, "", \$5); print \$5 }')"
+FREE_PCT=\$((100 - USE_PCT))
+
+if [[ "\${1:-}" == "--status" ]]; then
+  echo "Mount:     \$(df -P "\$MOUNT_DIR" | awk 'NR == 2 { print \$6 }')"
+  echo "Free:      \${FREE_PCT}% (threshold: \${THRESHOLD}%)"
+  if [[ -f "\$BALLAST" ]]; then
+    echo "Ballast:   present, \$(du -h "\$BALLAST" | cut -f1) — \$BALLAST"
+  else
+    echo "Ballast:   ABSENT (already spent) — \$BALLAST"
+  fi
+  exit 0
+fi
+
+((FREE_PCT < THRESHOLD)) || exit 0
+
+if [[ -f "\$BALLAST" ]]; then
+  FREED="\$(du -h "\$BALLAST" | cut -f1)"
+  rm -f "\$BALLAST"
+  logger -t "\$TAG" -p user.crit \\
+    "Free space \${FREE_PCT}% below \${THRESHOLD}% — deleted ballast, reclaimed \${FREED}. CLEAN UP NOW: this valve is spent."
+else
+  logger -t "\$TAG" -p user.crit \\
+    "Free space \${FREE_PCT}% below \${THRESHOLD}% — ballast already spent, no headroom left to reclaim."
+fi
+CHECKER
+
+  chown root:root "$BALLAST_CHECKER"
+  chmod 755 "$BALLAST_CHECKER"
+
+  cat >"$BALLAST_CRON" <<CRON
+# Emergency disk ballast — deletes the ballast file if free space drops below ${BALLAST_THRESHOLD}%.
+# Installed by machine-setup. Check status: ${BALLAST_CHECKER} --status
+PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
+*/10 * * * * root ${BALLAST_CHECKER}
+CRON
+  chmod 644 "$BALLAST_CRON"
+}
+
+# -----------------------------------------------------------------------------
+# earlyoom
+# -----------------------------------------------------------------------------
+#
+# What happens when swap runs out too.
+#
+# The kernel's own OOM killer waits until allocation genuinely fails, and by then
+# the machine has usually spent minutes thrashing — unresponsive, ssh refusing to
+# connect, nothing to do but reset it. earlyoom watches free memory and kills the
+# largest consumer while there is still enough left to stay reachable.
+
+earlyoom_is_active() { systemctl is-active --quiet earlyoom 2>/dev/null; }
+
+earlyoom_install() {
+  pkg_is_installed earlyoom || pkg_install_now earlyoom
+  systemctl enable --now earlyoom >/dev/null 2>&1
+}
+
+# -----------------------------------------------------------------------------
+# Resource limits
+# -----------------------------------------------------------------------------
+#
+# inotify watches: how many files one user can have the kernel watching. The
+# stock limit is small enough that one file watcher walking
+# node_modules. Every watcher on the machine draws from the same pool.
+#
+# The failure is silent, which is what makes it worth setting in advance: nothing
+# errors, the watcher simply stops noticing changes. Hot reload goes quiet, a
+# build stops rebuilding, and the reason is never on screen.
+#
+# Mostly a development concern, but not exclusively — anything running `bun
+# --watch` or serving a file browser is a watcher too.
+
+INOTIFY_WATCHES=524288
+INOTIFY_INSTANCES=1024
+
+inotify_current_watches() { sysctl -n fs.inotify.max_user_watches 2>/dev/null || echo 0; }
+
+inotify_raise() {
+  cat >/etc/sysctl.d/99-machine-setup-inotify.conf <<EOF
+# Raised by machine-setup: the 8192 default is exhausted by file watchers, and
+# the failure is silent — the watcher stops noticing changes without an error.
+fs.inotify.max_user_watches=${INOTIFY_WATCHES}
+fs.inotify.max_user_instances=${INOTIFY_INSTANCES}
+EOF
+  sysctl -q -w "fs.inotify.max_user_watches=${INOTIFY_WATCHES}"
+  sysctl -q -w "fs.inotify.max_user_instances=${INOTIFY_INSTANCES}"
+}
+
 # -----------------------------------------------------------------------------
 # Timezone
 # -----------------------------------------------------------------------------
diff --git a/scripts/setup/machine-setup/machine-setup.sh b/scripts/setup/machine-setup/machine-setup.sh
index d2c548f9..6d982006 100755
--- a/scripts/setup/machine-setup/machine-setup.sh
+++ b/scripts/setup/machine-setup/machine-setup.sh
@@ -315,6 +315,123 @@ if ! skip; then
   step_ok
 fi
 
+# =============================================================================
+# 8. Emergency disk ballast
+# =============================================================================
+#
+# Always offered, whatever the role — the role only decides which way the
+# recommendation points.
+
+step "Emergency disk ballast"
+if ! skip; then
+  echo ""
+  info "Emergency disk ballast — a reserve you can burn when the disk fills up"
+  echo "     A junk file holding no data, sized at 10% of free disk. A root cron"
+  echo "     checks every 10 minutes and deletes it if free space drops below"
+  echo "     ${BALLAST_THRESHOLD}%, so you get room to log in and clean up instead of meeting a"
+  echo "     wedged machine — Docker, journald and postgres all misbehave badly"
+  echo "     at 100% full, and not all of them recover on their own."
+  echo "     It is a one-shot valve: once spent, run this again to recreate it."
+  echo ""
+  if is_server; then
+    echo "     recommended for ${MACHINE_ROLE} — a full disk on an unattended box is the bad case"
+  else
+    echo "     less useful on ${MACHINE_ROLE} — you are sitting at this machine and will notice"
+  fi
+
+  if ballast_exists; then
+    echo "     already present: $(ballast_size_human) at ${BALLAST_FILE}"
+    SUMMARY+=("Disk ballast: already present ($(ballast_size_human))")
+  else
+    BALLAST_MB="$(ballast_size_mb)"
+    echo "     to create:    ${BALLAST_MB}M at ${BALLAST_FILE}"
+    if confirm "Create it?"; then
+      ballast_create "$BALLAST_MB"
+      ballast_install_checker
+      ok "ballast $(ballast_size_human), checker at ${BALLAST_CHECKER}"
+      SUMMARY+=("Disk ballast: $(ballast_size_human), checked every 10 min")
+    else
+      warn "skipped by request"
+      SUMMARY+=("Disk ballast: SKIPPED by request")
+    fi
+  fi
+  step_ok
+fi
+
+# =============================================================================
+# 9. earlyoom
+# =============================================================================
+
+step "earlyoom"
+if ! skip; then
+  echo ""
+  info "earlyoom — keeps the machine reachable when it runs out of memory"
+  echo "     The kernel's own OOM killer waits until an allocation actually"
+  echo "     fails, and by then the machine has usually spent minutes thrashing:"
+  echo "     unresponsive, ssh refusing to connect, nothing to do but reset it."
+  echo "     earlyoom watches free memory and kills the biggest consumer while"
+  echo "     there is still enough left to stay logged in."
+  echo ""
+  echo "     This is what happens after swap runs out, so the two go together."
+
+  if earlyoom_is_active; then
+    echo "     already installed and running"
+    SUMMARY+=("earlyoom: already running")
+  elif confirm "Install it?"; then
+    earlyoom_install
+    if earlyoom_is_active; then
+      ok "earlyoom running"
+      SUMMARY+=("earlyoom: installed and running")
+    else
+      warn "earlyoom installed but not running — check: systemctl status earlyoom"
+      SUMMARY+=("earlyoom: installed, not running")
+    fi
+  else
+    warn "skipped by request"
+    SUMMARY+=("earlyoom: SKIPPED by request")
+  fi
+  step_ok
+fi
+
+# =============================================================================
+# 10. inotify watch limit
+# =============================================================================
+
+step "inotify watch limit"
+if ! skip; then
+  CURRENT_WATCHES="$(inotify_current_watches)"
+
+  echo ""
+  info "inotify watch limit — how many files can be watched for changes at once"
+  echo "     A single file watcher walking a project with node_modules in it can"
+  echo "     exhaust the stock limit on its own, and every watcher on the machine"
+  echo "     draws from the same pool. The failure is silent: nothing errors, the"
+  echo "     watcher just stops noticing changes. Hot reload goes quiet, a build"
+  echo "     stops rebuilding, and the reason is never on screen."
+  echo ""
+  echo "     current:      ${CURRENT_WATCHES}"
+  echo "     to set:       ${INOTIFY_WATCHES}"
+  if is_role dev; then
+    echo "     recommended on dev — editors, bun --watch and vite are all watchers"
+  else
+    echo "     less pressing on ${MACHINE_ROLE}, but anything running bun --watch or"
+    echo "     serving a file browser is a watcher too"
+  fi
+
+  if ((CURRENT_WATCHES >= INOTIFY_WATCHES)); then
+    echo "     already at or above that, nothing to do"
+    SUMMARY+=("inotify watches: already ${CURRENT_WATCHES}")
+  elif confirm "Raise it?"; then
+    inotify_raise
+    ok "inotify watches raised to $(inotify_current_watches)"
+    SUMMARY+=("inotify watches: raised to ${INOTIFY_WATCHES}")
+  else
+    warn "skipped by request"
+    SUMMARY+=("inotify watches: SKIPPED by request — left at ${CURRENT_WATCHES}")
+  fi
+  step_ok
+fi
+
 # =============================================================================
 # NOT PORTED YET
 # =============================================================================
@@ -324,7 +441,7 @@ fi
 #   auto-suspend · boot-hang fix · user creation ·
 #   ssh keys · ssh hardening · dns · static ip · fail2ban · unattended-upgrades ·
 #   git config · docker · zsh + prompt · tailscale · neovim · js runtimes ·
-#   dev tools · ufw · zshrc · disk ballast
+#   dev tools · ufw · zshrc
 #
 # Each arrives as its own commit. Delete this block when the list is empty.