Tyrell Build 20 R9 rolled back safely after a second lsof harness timeout; exact Build 15/17 recovery was verified, the guard was replaced with per-PID libproc measurements, and exact Build 20 R10 was launched on this designated canary only.

Host scope

• Host: rdmbair15m5.
• R9 was automatically returned to exact signed Build 15 daemon plus exact signed Build 17 app.
• R10 installed the same exact signed/notarized Build 20 candidate already approved for canarying; no other host changed.
• The live additive database was retained. The pinned pre-migration backup was verified but not restored.

Files and runtime state

• Preserved R9 source stage: /Users/richh/.tyrell/build20-canary-r9-20260914-96a5fc0.
• Active R10 stage: /Users/richh/.tyrell/build20-canary-r10-20260914-96a5fc0.
• Exact daemon stable path: /Users/richh/Library/Application Support/Tyrell/bin/tyrelld.
• Exact app: /Applications/Tyrell.app.
• Retained Build 17 app rollback: /Applications/.tyrell-rollbacks/20260914-112458-2c5ca2a674fe/Tyrell.app.
• Canonical R9 preservation: /Users/richh/dev/_handoff/tyrell-build20-memory-20260912/canary-r9-rollback-20260914-1057/build20-canary-r9-20260914-96a5fc0 on rdmsm4x.
• Canonical receipt: /Users/richh/dev/_handoff/tyrell-build20-memory-20260912/canary-r9-lsof-r10-libproc-launch-20260914-1125/README.md on rdmsm4x.

Verification

• R9 retained 20 healthy, continuous, same-PID/start/path AC/open samples through 1,140.890368 seconds before lsof -b -w -nP timed out; both APIs and memory evidence were healthy, so this is an inconclusive harness failure.
• Complete R9 source/canonical manifest matched SHA-256 3156eb60423fc8c8a91f7fb3d3e54b82d6957931572f6fede942cd9599adcfd6 across 53 files, 30 directories, zero symlinks, and 275,051,968 bytes.
• Exact Build 15 daemon SHA-256 dbc440bd54b85a54dd6c4150b23b3e508bff7d8d8080687d81b9ba7ac2cbbcf0, Build 17 app SHA-256 8693ebce3d474fed049597d11e3579bf1cd32f7a78acfd9544c78d77592da05e, both status APIs, database integrity, and guard/assertion removal passed after rollback.
• Guard v1.5 SHA-256 76fd2739188affe2190d997338bc0a6c3349c1b0649861372b25a7bc53dfd1be; libproc probe SHA-256 c960d7b16d55c616269c1c3f8b98dab1642906cafade0a26aa08311af3cff9cc.
• Thirty full native-probe measurements passed during active Time Machine copying, with maximum 0.061-second duration, stable descriptor/TCP identity, and no lsof call.
• Native layout, injected no-lsof, descriptor-churn retry, missing-dependency negative, exact dependency, syntax, app dry-run, and complete disposable rollback tests passed.
• R10 exact Build 20 daemon/app SHA-256 71bf6122e453315205f3f0dfaf3f1a3a6cf2d99dfe901cda88e7ac79a8112c77 / 423871cede8ae6313c486929f544dbee8d1085540b2d37896de6f2c2d4de90fd.
• R10 daemon PID/start 4857 / Mon Sep 14 11:25:27 2026; guard/caffeinate 4570/4692; app/bar 4112/4145.
• Guard parentage, both sleep assertions, AC/open state, launchd runs 1 and never exited, APIs, database, and two initial libproc-v1 samples passed.

Recovery and outstanding gates

• Automatic rollback remains fail-closed and retains the complete exact Build 15/17 payload.
• Never restore the pinned database over the additive live database.
• R10 is soaking, not accepted. Warmup 11:35:29, short 12:05:29, six-hour 17:35:29, and fixed 24-hour 2026-09-15 11:25:29 EDT remain pending with inventory, CPU, app, and reboot evidence.
• No fleet expansion is authorized.