Tyrell Build 21 R1 failed its unchanged short physical-memory growth gate on rdmbair15m5 and automatically restored the exact signed Build 15 daemon and Build 17 app with healthy APIs, database, signatures, and cleanup.

Tyrell Build 21 R1 canary rejection and rollback

Host and runtime change

• Host: rdmbair15m5, designated canary only.
• Build 21 R1 candidate source be3e664f20afc0e7bb3de9c2fa057fee01b15674, daemon SHA-256 b9d85e48ff2e6d75ee58235537a61d0f204c9fb01cc726e054324b01b9a3d158, app executable SHA-256 dbc4bc187fba6089da185f566213d0ab8fdb44d929f59346d5d0135478c466a1.
• At 16:13:53 EDT, the unchanged short gate measured physical footprint 17.423088 -> 38.532509 MiB across 31 post-warmup samples / 1800.236744 seconds. Endpoint growth +0.703555 and regression growth +0.912488 MiB/min both exceeded +0.20.
• The pinned guard rejected the candidate and completed exact rollback at 16:14:02 EDT. Build 21 must not be relaunched.

Failure integrity

• All 41 samples retained PID 61143, one process start/path, maximum gap 60.046281 seconds, libproc descriptor range 26..28, TCP exactly two, zero endpoint/permission/503 failures, and AC/open power envelope.
• One inventory pass completed; no unchanged repeat was claimed.
• Failure diagnostics: physical footprint 38.6 MiB, allocator fragmentation 22.4 MiB / 84 percent, SQLite Page Cache charged zero.

Restored accepted runtime

• Daemon: exact signed Build 15 SHA-256 dbc440bd54b85a54dd6c4150b23b3e508bff7d8d8080687d81b9ba7ac2cbbcf0; stable target /Users/richh/Library/Application Support/Tyrell/releases/daemon-dbc440bd54b8/tyrelld; PID 130, start Mon Sep 14 16:13:55 2026; launchd enabled/running, runs 1, never exited; strict signature passed.
• App: exact Build 17 executable SHA-256 8693ebce3d474fed049597d11e3579bf1cd32f7a78acfd9544c78d77592da05e; /Applications/Tyrell.app version 0.2.0 build 17; main PID 377, bar PID 618; deep strict signature and Gatekeeper Notarized Developer ID acceptance passed.
• Both status endpoints returned HTTP 200 valid JSON.
• Live database quick_check=ok, 153429 files, one additive last_seen_at column.
• Candidate guard count zero; recovery LaunchAgent unloaded; recovery plist and active marker absent; normal daemon LaunchAgent re-enabled.

Evidence, backup, and recovery

• Canonical evidence: /Users/richh/dev/_handoff/tyrell-build21-memory-20260914/canary-r1-short-gate-failure-rollback-20260914-1614.
• MANIFEST.sha256 file hash: 63eb85c096bee9ac1d12cd87f2a353e14b5c68331ac15ef762805e6bf8b63aaa; recursive summary: 243a928a34f320c46379e9dfcfae070b1e65e88e59ab18eff2be97931d0e9220; 97 files, 30 directories, zero symlinks, 310678659 bytes.
• Preflight database backup remains /Users/richh/Library/Application Support/Tyrell/backups/20260914-1525-build21-r1-preflight-be3e664/tyrell.db, SHA-256 c2c5cfc0f32311d8c2c255d2fe32b60e122cd0c6840c0862a2c7ca06a808e5d6; it was not restored over the healthy live database.
• No undo of the safety rollback is authorized. Build 20 and Build 21 are prohibited from relaunch; keep the accepted Build 15/17 runtime until a new candidate passes a completely fresh sequence.

Outstanding actions

• Canonical Build 23-or-later allocator remediation is in progress under ISSUE-20260912-01; no install is authorized.
• App-only Build 22 remains queued and uninstalled; Build 22 daemon must never deploy.
• Controlled reboot proof remains open for a future candidate only after memory/app/CPU prerequisites pass.
• Publish this changelog to Apple Notes from an Aqua desktop session using /Users/richh/scripts/notes_changelog.zsh; SSH cannot send the required AppleEvents.