rdmbair15m5 changelog — Tyrell Build 20 R11 short-gate rejection

Tyrell Build 20 R11 failed the real physical-footprint growth gate on this canary and the v1.6 fail-closed guard/sentinel automatically restored the exact accepted Build 15 daemon and Build 17 app.

Scope and runtime changes

• Host: rdmbair15m5 only; no fleet expansion.
• Rejected candidate: source 96a5fc012ff754d072aee04a47452fd84e69b2e0, daemon SHA-256 71bf6122e453315205f3f0dfaf3f1a3a6cf2d99dfe901cda88e7ac79a8112c77, app executable SHA-256 423871cede8ae6313c486929f544dbee8d1085540b2d37896de6f2c2d4de90fd.
• The candidate stayed one PID 55457 from start Mon Sep 14 13:39:51 2026 for all 41 samples, but the 31-sample post-warmup window grew 58.454315 to 103.813690 MiB over 1800.306823 seconds: endpoint +1.511723 MiB/min, regression +1.887622 MiB/min, policy maximum +0.20 MiB/min.
• Allocator capture showed 84.9 MiB / 95% fragmentation while SQLite Page Cache charged 0 B.
• The guard recorded rolled_back for physical footprint growth exceeds policy limit at about 14:20 EDT.
• Current accepted daemon is exact signed Build 15 SHA-256 dbc440bd54b85a54dd6c4150b23b3e508bff7d8d8080687d81b9ba7ac2cbbcf0, PID 94015, normal enabled LaunchAgent, one run, no exit.
• Current accepted app is exact Build 17 executable SHA-256 8693ebce3d474fed049597d11e3579bf1cd32f7a78acfd9544c78d77592da05e, one app and one TyrellBar.
• Both direct status endpoints returned HTTP 200 valid JSON; live SQLite quick_check returned ok, the additive column remained exactly once, and the database held 153533 rows.
• Recovery controls were cleaned: zero guard/caffeinate processes, recovery LaunchAgent unloaded, recovery plist absent, active-canary marker absent. No database restore occurred.

Files and evidence

• Preserved stage on this host: /Users/richh/.tyrell/build20-canary-r11-20260914-96a5fc0
• Canonical evidence: rdmsm4x:/Users/richh/dev/_handoff/tyrell-build20-memory-20260912/canary-r11-short-gate-failure-rollback-20260914-1419
• Frozen stage manifest SHA-256: 3070f10a51f6d5217c1744f370ac572d11d3bf30b77fba55715af55598932a50
• Incident README SHA-256: d9570bbec553f042a82153f4a98156c4a282f59da2b94099758d2b822b874c64
• Relevant tickets: ISSUE-20260912-01, ISSUE-20260914-10, TASK-20260911-01.

Verification commands

The remote coordinator ran bounded reads equivalent to:

jq . /Users/richh/.tyrell/build20-canary-r11-20260914-96a5fc0/state.json
launchctl print gui/$(id -u)/com.eastcoastscience.tyrelld
launchctl print-disabled gui/$(id -u)
<staged libproc_probe.py> <daemon PID>
codesign --verify --strict <stable daemon>
codesign --verify --deep --strict /Applications/Tyrell.app
curl --fail --silent --show-error http://127.0.0.1:43117/api/status
curl --fail --silent --show-error http://127.0.0.1:43118/api/status
sqlite3 <live Tyrell database> 'PRAGMA quick_check;'
pgrep -fl <Tyrell, TyrellBar, guard, and caffeinate identities>
pmset -g assertions

Complete stage transfer was verified with recursive rsync -naci checks and SHA-256 manifests before ticket or project-index updates.

Backup and undo

• Retained pre-migration database backup: /Users/richh/Library/Application Support/Tyrell/backups/20260912-0110-build20-preflight-96a5fc0/tyrell.db, SHA-256 db29432be4fc962a18436f15f29d1677b10bc7c541d7f78eab6c00f7ecce3c8f.
• Do not relaunch Build 20 as an undo action. The fail-closed rollback is the accepted state.
• Do not restore the older database over the healthy additive live database. The backup is retained only for recovery with an explicit corruption diagnosis.
• A future Build 21-or-later candidate requires a new exact artifact and a fresh full canary sequence; it must not reuse R11 acceptance time.

Outstanding owner actions

• Canonical source owner must correct allocator retention, independently review/test, and produce a separately signed/notarized Build 21 or later.
• Keep this host on exact Build 15 daemon plus Build 17 app until a future candidate passes every release gate.
• ISSUE-20260914-10 remains open pending a controlled reboot while a future candidate is actively guarded.