Tyrell Build 21 R1 replaced the accepted Build 15/17 runtime only on designated canary rdmbair15m5 under an identity-pinned fail-closed guard; early health passed, while all runtime acceptance and fleet-release gates remain open.

Tyrell Build 21 R1 canary-host launch

Scope and outcome

• Host changed: rdmbair15m5 only.
• Exact Build 21 source: be3e664f20afc0e7bb3de9c2fa057fee01b15674; independent source review accepted and full suite passed 553 XCTest cases with one skip plus 664 Swift Testing cases with zero failures.
• Exact signed/notarized daemon SHA-256: b9d85e48ff2e6d75ee58235537a61d0f204c9fb01cc726e054324b01b9a3d158.
• Exact signed/notarized app executable SHA-256: dbc4bc187fba6089da185f566213d0ab8fdb44d929f59346d5d0135478c466a1.
• Build 20 remains rejected and prohibited from relaunch; existing bug ISSUE-20260912-01 owns the remediation.

Exact host changes

• Active stage: /Users/richh/.tyrell/build21-canary-r1-20260914-be3e664.
• Installed Build 21 app at /Applications/Tyrell.app and launched it exactly once.
• Installed daemon into hash-addressed release path /Users/richh/Library/Application Support/Tyrell/releases/daemon-b9d85e48ff2e/tyrelld and updated the managed stable link.
• Launch time: 2026-09-14 15:33:52 EDT. Initial daemon PID 61143, process start Mon Sep 14 15:33:50 2026.
• Guard PID 60887, caffeinate PID 60971; both PreventSystemSleep and PreventUserIdleSystemSleep are active and bound to the exact guard lifetime.
• Candidate automatic loading is disabled while unaccepted. Persistent recovery label com.eastcoastscience.tyrell-canary-recovery is loaded; its marker pins the exact daemon, guard, policy, boot session and heartbeat.
• TyrellBar was restarted from the installed bundle. Nonce-bound functional app probe and host receipt both passed.

Verification evidence

• Guard SHA-256: 323e385286f79914cbf2858704f12c08fe8e5b528eb3ba7976f7b6a86cb7d69f.
• Policy SHA-256: 2674761f053232c0a2518163931ff487d8c54affe1da19336b3c241e1518bc94.
• Read-only guard verifier passed AC power, open clamshell, guard/caffeinate parentage, both sleep assertions, loaded recovery sentinel, disabled candidate autostart, exact boot identity, and heartbeat age within 180 seconds.
• First five one-minute samples: 240.048137-second span, 60.036472-second maximum gap, one PID/start/path, descriptor rows 26..27, exactly two TCP descriptors, and all status and permissions probes HTTP 200 valid JSON. Physical footprint 259589440 -> 18203944 bytes, maximum 259589440 bytes. This is early-soak health, not acceptance.
• Live database quick_check=ok; both direct status endpoints returned HTTP 200 valid JSON.
• App probe SHA-256: a97e6f36635940c842c6cec4b9a417928e8e4f6dfc585cb0c6a71bf078cc3ffd.
• App receipt SHA-256: fab07fc13fc8277a2afc680562c91b9fd2a7c15759d7239c7b84745be2aa0ef6.
• Canonical frozen launch evidence: /Users/richh/dev/_handoff/tyrell-build21-memory-20260914/canary-r1-launch-20260914-1533; MANIFEST.sha256 file hash 3c97bdf7b2b0829d86babd776f9d113b3207466a3d2c447d6a3e55210d373b3b, recursive summary hash d3490d0d1722ae9ec98bb0e8db75fdd29da1ad5282a284a9b98278adcb3644bb.

Backups and recovery

• Fresh preflight database backup: /Users/richh/Library/Application Support/Tyrell/backups/20260914-1525-build21-r1-preflight-be3e664/tyrell.db, SHA-256 c2c5cfc0f32311d8c2c255d2fe32b60e122cd0c6840c0862a2c7ca06a808e5d6, SQLite quick_check=ok, 153412 rows, one additive last_seen_at column. Do not overwrite a healthy live database with it.
• Exact rollback daemon: signed Build 15 SHA-256 dbc440bd54b85a54dd6c4150b23b3e508bff7d8d8080687d81b9ba7ac2cbbcf0.
• Exact rollback app: Build 17 executable SHA-256 8693ebce3d474fed049597d11e3579bf1cd32f7a78acfd9544c78d77592da05e, retained at /Applications/.tyrell-rollbacks/20260914-153342-2c5ca2a674fe/Tyrell.app.
• Bounded rollback command from an authorized operator: /opt/homebrew/bin/python3.14 /Users/richh/.tyrell/build21-canary-r1-20260914-be3e664/canary_guard.py rollback. The active guard automatically serializes the same exact rollback on failure.

Outstanding actions

• State is SOAKING_NOT_ACCEPTED; no fleet expansion occurred.
• Short memory gate is no earlier than about 16:13:52 EDT; six-hour gate about 21:43:52 EDT; fixed 24-hour gate no earlier than 2026-09-15 15:33:52 EDT.
• Repeated-inventory, CPU, fresh-app, controlled-reboot, integration, and fleet-release gates remain open. Do not intentionally reboot before memory/app/CPU prerequisites pass.
• Apple Notes publication for this host must be performed from an Aqua desktop session using /Users/richh/scripts/notes_changelog.zsh; remote SSH cannot create the host-local Notes entry.