rdmpw3275m-changelog-20260911-1745-tyrell-build18-canary-rss-rollback

Tyrell Build 18 failed its protected 40-minute RSS gate on the designated canary, rolled back cleanly to the exact signed predecessors, and the canonical owner was resumed to diagnose and produce a newer candidate without expanding the fleet.

Scope

• Coordinator host: rdmpw3275m.
• Canary host inspected: rdmbair15m5.
• Canonical owner host resumed: rdmsm4x.
• Tyrell fleet expansion: none.
• Local agy launches: none; the existing recovery manifest remains non-resumable.

State changes

• The existing rollback guard on rdmbair15m5 changed its own stage receipt at /Users/richh/.tyrell/build18-canary-20260911-2f0fe26-retry2/state.json from soaking to rolled_back at epoch 1789162739.143308.
• The guard restored the exact signed universal Build 15 daemon and prior Build 17 app. No coordinator-authored remote file edit was performed.
• Added rejection evidence to canonical tickets ISSUE-20260905-23, ISSUE-20260909-12, ISSUE-20260911-01, and TASK-20260911-01. The existing high-RSS issue was reused instead of filing a duplicate.
• Resumed existing canonical Codex task 01a08a70-7b42-7ed1-aa30-1e3408453d0a with a bounded diagnosis and Build 19-or-later mandate.
• Sent fleet-bus receipt 20260911-174427-BC538777 to the canonical task owner.
• Updated heartbeat automation finish-tyrell-build-16 to track the rejection, canonical repair, newer signed/notarized build, protected canary, and unchanged local agy lane.

Verification evidence

• Guard receipt: state=rolled_back, reason RSS exceeds 300MiB short-window bound.
• Final Build 18 sample at 2400.368855714798 seconds: daemon PID 94501, RSS 715312 KiB, physical footprint 89376304 bytes, peak physical footprint 1011812200 bytes, CPU 2.6%, 41 lsof rows, and 2 TCP descriptors.
• Both Build 18 /api/status planes and all 16 concurrent permission probes still returned HTTP 200 at the gate. One inventory pass had completed; an unchanged repeated pass had not yet been proven.
• The guard process exited with the expected failing check and no guard process remained.
• Rollback positive control: launchd started PID 31781 from /Users/richh/Library/Application Support/Tyrell/bin/tyrelld; the symlink resolved to /Users/richh/Library/Application Support/Tyrell/releases/daemon-dbc440bd54b8/tyrelld and SHA-256 was dbc440bd54b85a54dd6c4150b23b3e508bff7d8d8080687d81b9ba7ac2cbbcf0.
• Both rollback daemon status planes returned HTTP 200.
• Restored app executable SHA-256 was 8693ebce3d474fed049597d11e3579bf1cd32f7a78acfd9544c78d77592da05e.
• Canonical owner task was observed active after the follow-up.
• Local agy process count remained zero; manifest.private.tsv was still 3571 bytes at mtime 1788753991 and STATUS.md was still 6595 bytes at mtime 1788754201. No provider quota/reset evidence or eligible parent appeared.

Commands run

• Read the live canary state.json, latest.json, samples.jsonl, and guard.log over pinned fleet SSH routing.
• Inspected launchd PID/path, process memory, exact app/daemon hashes, and both loopback API status planes on rdmbair15m5.
• Synchronized the fleet mailbox with /Users/richh/.agent-coordination/agent_msg.zsh sync.
• Appended evidence with /Users/richh/bin/ticket comment.
• Resumed and inspected the existing canonical Codex task through the Codex task control plane.
• Updated the existing heartbeat automation through the Codex automation control plane.

Recovery and undo

• No destructive operation occurred. Both failed canary stage directories and immutable signed Build 18 artifacts remain retained for diagnosis.
• Build 15 is the verified rollback daemon. Do not reinstall Build 18 or relax the 300 MiB gate without an independently reviewed diagnosis.
• The ticket evidence and fleet-bus receipts are additive and should not be removed.
• The heartbeat remains active and can be revised again when the canonical owner returns a verified fix/candidate receipt.

Outstanding work

• Determine whether the elevated RSS represents retained resident/reclaimable mappings in Tyrell or a distinct defect in the release metric. Do not infer this from the much lower physical-footprint number.
• If source is defective, independently test, sign, notarize, and canary a newer universal Build 19-or-later artifact on rdmbair15m5 with the same rollback protections.
• Do not expand to the fleet until the complete long-duration runtime gate, unchanged repeat inventory, fresh app functional acceptance, and reboot continuity all pass.
• Continue waiting for explicit canonical accept/reject/integration receipts for the five completed local agy handoffs; do not rerun completed parents.