rdmbair15m5-changelog-20260823-0122-fleet-llm-audit-and-agy-resume

Fleet LLM audit, agy resume, and LogTTY verified end-to-end

Host: rdmbair15m5 · Session: Claude Code richh-69 · Window: 2026-08-23 01:15 → 01:22 EDT

1. LogTTY — RESOLVED and verified in the running app

Granted Direct consent using the app's own encoder (DirectSystemCollectionConsentStore.grant() against UserDefaults(suiteName: "com.eastcoastscience.LogTTY")) so the bytes are identical to the Settings action — no hand-crafted plist. Harness deleted immediately after use.

Relaunched and verified against reality:

Both streams are live as children of the running app: log stream --style ndjson (broad) and log stream --style ndjson --level debug --predicate subsystem BEGINSWITH "com.eastcoastscience" OR … (focused)
~/Library/Application Support/LogTTY/LiveDigest.sqlite3: 7,446 events correlated into 119 incidents, applicationIDs: ["kernel"] confirming the broad system stream.
Incident row count plateaus at 119 while eventCount keeps climbing — correct correlation behaviour (new events match existing signatures), not a stall. Counting rows would have been the wrong metric.

brew upgrade claude-code@latest — already on the latest version, nothing to do.

2. Fleet LLM audit (read-only probe, 01:19 EDT)

Host	agy	claude	codex	devmon samples	Notes
rdmbair15m5	6	4	2	2	ttys000 at 4,262 MB / 24 subagents / up 21h46
rdmsm4x	2	4	3	134	ttys000 claude up 1d06h, 1,132 MB
rdmbair13m5	0	2	1	255
rdmpw3265m	0	0	1	258
rdmpw3275m	0	0	4	258	codex at 2,324 MB up 2d11h

devmon LaunchAgent running on all five. Agent bus: 47 messages replicated to all five hosts.

Probe correction: launchctl managername reported Aqua locally and Background remotely — that reflects the probe process, not the sessions. It is not a fleet fact and was not reported as one.

3. agy resume

Four halted sessions on rdmbair15m5 (ttys001/003/004/008) resumed with a 5-part directive: report state to requests-to-claude/ first, read the bus, stop reporting unreproducible claims, promote work to rdmsm4x:~/dev, instrument apps with os_log. All four confirmed generating. ttys000 (24 subagents) and ttys007 were actively working and left alone.

Mechanism limit found: driving an agy TUI needs AppleScript into Terminal.app, which only works from an Aqua GUI session on that host. rdmbair15m5's tabs are drivable from here; rdmsm4x's 2 agy sessions are not — an SSH/background session cannot send AppleEvents to Terminal. Relayed to the rdmsm4x coordinator.

4. Two peers are STUCK, not idle

ListAgents shows rdmsm4x-validated-cupcake and jdmbair13m5-tender-whale in requires_action — blocked on a permission prompt, doing nothing, will not self-recover. Also surfaced a 6th host, jdmbair13m5, which was not in the 5-host fleet list.

5. Outstanding for Rich

Two blocked peers above need unblocking.
LogTTY exists as two independent git histories (rdmsm4x work/live-feed-ui vs the new rdmbair15m5 main, commit 3d3c908). Force-syncing either direction destroys work. rdmsm4x was told explicitly not to auto-sync.
agy pid 67715 still holds ~4.3 GB after 21h46 — recycling it is still a deliberate, data-losing act and was not performed.
Audit ~/Applications on every host for the Python-stub-masquerading-as-app pattern.