diff --git a/common/lib/console_output.sh b/common/lib/console_output.sh
index 415a86f..ff11c02 100644
--- a/common/lib/console_output.sh
+++ b/common/lib/console_output.sh
@@ -3,6 +3,7 @@
 # A Library of contextual console output-related operations.
 # Intended for use by other scripts, not to be executed directly.
 
+# shellcheck source=common/lib/defaults.sh
 source $(dirname $(realpath "${BASH_SOURCE[0]}"))/defaults.sh
 
 # helper, not intended for use outside this file
@@ -10,10 +11,11 @@ _rel_path() {
     if [[ -z "$1" ]]; then
         echo "<stdin>"
     else
-        local abs_path=$(realpath "$1")
-        local rel_path=$(realpath --relative-to=. $abs_path)
-        local abs_path_len=${#abs_path}
-        local rel_path_len=${#rel_path}
+        local abs_path rel_path abs_path_len rel_path_len
+        abs_path=$(realpath "$1")
+        rel_path=$(realpath --relative-to=. $abs_path)
+        abs_path_len=${#abs_path}
+        rel_path_len=${#rel_path}
         if ((abs_path_len <= rel_path_len)); then
             echo "$abs_path"
         else
@@ -24,9 +26,10 @@ _rel_path() {
 
 # helper, not intended for use outside this file
 _ctx() {
+    local shortest_source_path grandparent_func
     # Caller's caller details
-    local shortest_source_path=$(_rel_path "${BASH_SOURCE[3]}")
-    local grandparent_func="${FUNCNAME[2]}"
+    shortest_source_path=$(_rel_path "${BASH_SOURCE[3]}")
+    grandparent_func="${FUNCNAME[2]}"
     [[ -n "$grandparent_func" ]] || \
         grandparent_func="main"
     echo "$shortest_source_path:${BASH_LINENO[2]} in ${FUNCNAME[3]}()"
@@ -34,9 +37,10 @@ _ctx() {
 
 # helper, not intended for use outside this file.
 _fmt_ctx() {
-    local stars="************************************************"
-    local prefix="${1:-no prefix given}"
-    local message="${2:-no message given}"
+    local stars prefix message
+    stars="************************************************"
+    prefix="${1:-no prefix given}"
+    message="${2:-no message given}"
     echo "$stars"
     echo "$prefix  ($(_ctx))"
     echo "$stars"
@@ -57,8 +61,9 @@ die() {
 }
 
 dbg() {
+    local shortest_source_path
     if ((A_DEBUG)); then
-        local shortest_source_path=$(_rel_path "${BASH_SOURCE[1]}")
+        shortest_source_path=$(_rel_path "${BASH_SOURCE[1]}")
         (
         echo
         echo "$DEBUG_MSG_PREFIX ${1:-No debugging message given} ($shortest_source_path:${BASH_LINENO[0]} in ${FUNCNAME[1]}())"
@@ -73,8 +78,10 @@ msg() {
 # Mimic set +x for a single command, along with calling location and line.
 showrun() {
     local -a context
+    # Tried using readarray, it broke tests for some reason, too lazy to investigate.
+    # shellcheck disable=SC2207
     context=($(caller 0))
-    echo "+ $@  # ${context[2]}:${context[0]} in ${context[1]}()" > /dev/stderr
+    echo "+ $*  # ${context[2]}:${context[0]} in ${context[1]}()" > /dev/stderr
     "$@"
 }
 
@@ -109,7 +116,7 @@ show_env_vars() {
         warn "The \$SECRET_ENV_RE var. unset/empty: Not filtering sensitive names!"
     fi
 
-    for env_var_name in $(awk 'BEGIN{for(v in ENVIRON) print v}' | grep -Eiv "$filter_rx" | sort -u); do
+    for env_var_name in $(awk 'BEGIN{for(v in ENVIRON) print v}' | grep -Eiv "$filter_rx" | sort); do
 
         line="${env_var_name}=${!env_var_name}"
         msg "    $line"
diff --git a/mac_pw_pool/InstanceSSH.sh b/mac_pw_pool/InstanceSSH.sh
index 1f9dad8..8688795 100755
--- a/mac_pw_pool/InstanceSSH.sh
+++ b/mac_pw_pool/InstanceSSH.sh
@@ -11,7 +11,9 @@ set -eo pipefail
 # shellcheck source-path=SCRIPTDIR
 source $(dirname ${BASH_SOURCE[0]})/pw_lib.sh
 
-SSH="ssh $SSH_ARGS"  # N/B: library default nulls stdin
+# Enable access to VNC if it's running
+# ref: https://repost.aws/knowledge-center/ec2-mac-instance-gui-access
+SSH="ssh $SSH_ARGS -L 5900:localhost:5900"  # N/B: library default nulls stdin
 
 [[ -n "$1" ]] || \
     die "Must provide EC2 instance ID as first argument"
@@ -24,4 +26,5 @@ if [[ -z "$pub_dns" ]] || [[ "$pub_dns" == "null" ]]; then
     die "Instance '$1' does not exist, or have a public DNS address allocated (yet)."
 fi
 
+echo "+ $SSH ec2-user@$pub_dns \"$*\"" >> /dev/stderr
 $SSH ec2-user@$pub_dns "$@"
diff --git a/mac_pw_pool/service_pool.sh b/mac_pw_pool/service_pool.sh
index f4ea8dc..44c6bb4 100644
--- a/mac_pw_pool/service_pool.sh
+++ b/mac_pw_pool/service_pool.sh
@@ -60,14 +60,14 @@ while [[ -r $PWCFG ]]; do
     if [[ $(date -u "+%Y%m%d%H") -ge $expires ]]; then
         msg "$(date -u -Iseconds) Instance expired."
         # Block pickup of new jobs
-        pkill -u $PWUSER -f "cirrus worker run"
+        sudo pkill -u $PWUSER -f "cirrus worker run"
         # Try not to clobber a running Task, unless it's fake.
         if pgrep -u $PWUSER -q "cirrus-ci-agent"; then
             msg "$(date -u -Iseconds) Shutdown paused 2h for apparent in-flight CI task."
             # Cirrus-CI has hard-coded 2-hour max task lifetime
             sleep $(60 * 60 * 2)
             msg "$(date -u -Iseconds) Killing hung or nefarious CI agent older than 2h."
-            pkill -u $PWUSER "cirrus-ci-agent"
+            sudo pkill -u $PWUSER "cirrus-ci-agent"
         fi
         msg "$(date -u -Iseconds) Executing shutdown."
         sudo shutdown -h +1m "Automatic instance recycle after >$PWLIFE hours."