PASS WITH DEFERRALS — localdb P2 Studio milestone
Recorded 2026-09-27 12:59:38 EDT, rdmsm4x, codex@rdmsm4x/ldbp2x0927.
Execution began12:17 EDT after rename PASS. Canonical repo is
/Users/richh/dev/fleet/localdb; rdsysdb is the
compatibility symlink, not a rollback. One production reader
switched. Full reader rollout is not complete. TASK-20260927-51
remains open for owner continuation.
| Requested item | Verdict | Evidence and limits |
|---|---|---|
| Approval/decision/ticket | PASS | DEC-20260927-10 records Rich's11:46 EDT approval, bounded scope and rollback; TASK-20260927-51 tracks execution. No P3/public receiver or ticket authority flip. |
| Inbound signature checks | PASS | Dynamic SecCode Developer ID team+identifier validation; actual socket PID separated from signature parent PID; daemon-owned socket writes rejected; future phases closed. Wrong identity/team rejected. |
| Log rotation | PASS | Daemon and notifier record logs archive on append at1MiB, no deletion or periodic job. Launchd stdout/stderr diagnostics are outside this rotation scope. |
| Reader plan | PASS | docs/design/P2-CUTOVER.md inventories nine reader categories and ordered dispositions; detailed READERS.md in handoff. |
| Reader switches | PASS for roster; DEFERRED for remainder | Installed agent_msg.zsh v1.8.1 Studio row reads localdb. Real installed-script fixture8/0 proves planted localdb17 vs legacy7 and explicit failure. Production localdb→file→localdb rollback exercised12:52; final source localdb, five agent categories, coverage1/1 and invocation heartbeat. Other host rows remain on files. |
| Claude job approval | PASS | Bus20260927-123616-CFDBB407 and addendum20260927-124056-FC392287; signed-off replica GUI launchd canary. Seven Studio plists unchanged. |
| rdmpw3275m shadow replica | PASS installation/canary; DEFERRED sustained freshness under load | sleep0/disksleep0 verified. Existing authenticated SSH, no public receiver. nice10,64KiB/s,batches50; backoff load>20 or baseline+3, retry throttle300s. First failed canary exited75 and immediately archived/unloaded. Second matched287/287 and canary seq2493 in0.531s. At12:57:45 cache stale/count287/seq2495/reason load backoff, load14.88; not currently a healthy fresh replica. No reader uses it. |
| Tests/build/merge | PASS | Swift49/0, Python15/0, signed e2e43/0, installed reader8/0. Universal2 x86_64+arm64/minos26.7, notarization Accepted f30dbff3-25c4-4418-bb6e-674d91023374. Source and maintenance integrations merged/pushed fleet+backup; final documentation SHA recorded in integration.json. |
| Health/latency | PASS final checks; FAIL uninterrupted-service objective | Final12:57:44 health2.233ms,7/7 loaded, daemon58689/notifier58829 running; nightlyaudit runs0 since rename and is not counted as an executed success. Rapid restart during comparison caused about36s socket outage12:49:04–12:49:40, recovered without data rollback. |
What now reads localdb
~/.agent-coordination/agent_msg.zsh roster reads
/hosts/rdmsm4x/heartbeat through
~/.localdb/bin/reader_state.py; pin
~/.localdb/readers/roster.source=localdb. Raw measurement
timestamp drives age, publication does not freshen stale measurements.
roster.status.json records each invocation, not continuous
liveness. Status writes are outside publisher WatchPaths. Legacy source
writers remain active. Existing menu app and notifier are baseline
consumers, not additional switches.
TASK-20260927-54 was offered to ops, unaccepted at handoff: agent board display and informational preflight claim count. TASK-20260927-55 was offered to localdb, unaccepted: missing full ticket/stale-claim coverage before those readers switch. Botwake1800-second/three-miss behavior requires separate owner proof; do not substitute localdb900-second verdict. Fleetreg F2 remains TASK-20260927-50/seven-day gate. Nightlyaudit coverage remains blind110/215;6/6 finding checks do not repair it.
Verification and latency
Raw evidence is in logs/: swift-p2-final.log,
replica-tests.log, e2e-shadow-p2.log, roster-installed-e2e.log,
roster-live-localdb.json, roster-live-rollback.json,
roster-live-final.json, studio-final.json, replica-parity.json,
replica-positive-control.json, replica-final.txt. Signature probe is
signature/live-probe.log.
Baseline100/100 p501.267/p996.176ms. Early post-install p99 rose25.023–43.608ms; these samples are retained. Paired isolated old/new200 each p990.578/1.012ms; with notifier1.670/2.620ms. Live old200/200 p995.696ms vs restored new200/200 p994.684ms (new max6.988ms). No sustained binary regression reproduced; not a guarantee of exact latency equality. Restart outage is separately recorded in ISSUES.md. The historical experiment script is disabled to prevent accidental replay of its unsafe kickstart sequence.
Final installed SHA256: CLI
dd2bf8d7a723833eb1c1181f2597ce7a459d7d01d9d2943d921f82d66df66a21;
daemon
b0f4ba321069e3dc5ad99522b5d0f9922cace29bdc10203eecb188844ca0d6bc.
Both spctl install assessments accepted Notarized Developer ID. Bare
executables cannot be stapled. Reproducible signed copies are in handoff
release/.
One-step rollbacks
# Only the switched reader; exercised successfully in production.
python3 /Users/richh/.localdb/bin/reader_source.py roster file
# Shadow replica only: unload, archive plist, retain cache.
ssh -o BatchMode=yes [email protected] 'zsh ~/.localdb-replica/bin/rollback.zsh'
# Studio P2 binaries/adapters, retaining database; source pin is independent.
zsh /Users/richh/dev/_handoff/localdb-p2-20260927/rollback-studio.zshSnapshots before/ and before-restart/ contain consistent SQLite backups, installed files/config and seven plists; further pre-comparison snapshots retained. Studio rollback now bootout/wait/bootstrap restarts daemon+notifier to avoid the kickstart throttle failure. Reader helpers remain installed with file pins after rollback. No archive or source data was deleted.
Integration and continuation
localdb source0565bf8, verificationb580203, checkpoint1b20c12; maintenanceb09a5e8 (TASK-20260927-53 resolved). Final doc commit and remote verification are recorded in handoff integration.json. Studio bus installed atomically from committed maintenance source after snapshot; broad fleet reconcile was not run because inspection showed it distributes installed Studio bus to spokes. Controller and ops were notified. P2 is Studio-scoped.
Remaining work is the owning lanes' reader integration and sustained replica freshness after INC-20260927-01 load subsides. Do not mark the full P2 reader rollout complete. Required topology audit path was absent; actual host/SSH evidence used without topology changes. Apple Notes status is recorded in notes-status.txt; durable file copies exist even if Aqua publication is pending.