rdmpw3275m-changelog-20260911-1821-tyrell-build19-canary-launched

Tyrell Build 19 was independently reviewed, signed, notarized, and launched only on the designated rdmbair15m5 canary under a corrected physical-footprint gate and exact Build 15 rollback protection.

Scope

• Coordinator and independent verification host: rdmpw3275m.
• Canonical source, signing, integration, and release owner: rdmsm4x.
• Designated canary: rdmbair15m5 only.
• Fleet expansion: not started and not authorized by the canary guard.
• Local agy execution: unchanged; no process was launched.

Source and issue state

• ISSUE-20260905-23 remains the existing Tyrell high-memory issue.
• Distinct release-gate defect ISSUE-20260911-15 records the incorrect use of aggregate RSS as the charged-memory pass/fail field.
• Exact Build 18 replay and clean-versus-dirty controls showed that high RSS can be dominated by reclaimable allocator and SQLite backing while physical footprint remains much lower. Build 18 remains rejected and was not retroactively accepted.
• SyncEngine.sync() loaded up to ten million records before an unchanged/no-missing early return. Commit e14041a moved that idle fast path ahead of full materialization while preserving outstanding-blob retry.
• Build 19 source commit ec036973cff969447292c1fb7ebef9916dfcb14c merged via PR 29 at a34089e.
• Physical-footprint gate commits f47d51a, da9e082, and 06cec6d merged via PR 30 at canonical/fleet/backup main commit b661740687f8a2d7aafcbd0a971bd210c06d1f8e.

Independent verification

• Fresh coordinator rerun: 11 pure memory-gate tests, 3 synthetic guard-flow tests, 3 dependency-packaging tests, and the real staged dependency preflight all passed.
• The corrected gate rejects missing/nonfinite measurements, sample gaps greater than 90 seconds, changed PID, same-PID process-start reuse, executable/path/hash drift, endpoint loss, stale permission data after warm-up, descriptor drift, charged-memory bounds, and growth limits.
• Delayed rollback rechecks the pinned dependency closure; exact 300 MiB, 400 MiB, and 0.20 MiB/min values are read from the reviewed policy.
• All six executable dependencies existed and matched their recorded SHA-256 values.
• Independent review accepted the final gate package for canary use only. This did not confer runtime or fleet acceptance.

Canary state

• Stage: /Users/richh/.tyrell/build19-canary-20260911-ec03697 on rdmbair15m5.
• Guard PID: 69716.
• Daemon PID: 69804.
• Process start: Fri Sep 11 18:18:18 2026.
• Guard start epoch: 1789165099.8843231.
• Earliest six-hour-after-warm-up gate: epoch 1789187299.8843231, approximately 2026-09-12 00:28:19 EDT.
• Required 24-hour boundary: epoch 1789251499.8843231, approximately 2026-09-12 18:18:19 EDT.
• Exact daemon SHA-256: 03e365cec1b8219b3d4cc12384b42313936b850748a97727366e6595f4ee390b at /Users/richh/Library/Application Support/Tyrell/releases/daemon-03e365cec1b8/tyrelld.
• Exact app executable SHA-256: cfb51c67602f9cf6047e4b6bf609ee1a5e24fe99d907269fcf0548d7c5c2c072; combined CDHash 933b995d29644a80e6e3b40721a98fb0f2984e07f9db70f978ed8064f16f6563; bundle build 19.
• Deployment wrapper exited 0.
• Authenticated app functional probe passed current fleet usage plus chat send/page/command; evidence SHA-256 3c4e5b3408b352513640d355e45a5700332e7cb0a0ac52ee0d8f6e1ed0d51ed7.
• Initial retained warm-up sample: physical footprint 358434256 bytes, peak 554419712 bytes, RSS 677792 KiB, CPU 27.8%, 43 lsof rows, 2 TCP descriptors, both status planes HTTP 200, and all 16 permission probes HTTP 200.
• A later direct check found the same daemon at about 55 MiB physical footprint with both status planes HTTP 200. Startup observations are retained but excluded from steady-state slope/bound calculations under the predeclared policy.

Rollback and undo

• Exact signed universal Build 15 daemon SHA-256 dbc440bd54b85a54dd6c4150b23b3e508bff7d8d8080687d81b9ba7ac2cbbcf0 and the prior Build 17 app are snapshotted in the canary stage.
• Any real guard breach automatically restores those exact predecessors and records a fail-closed state.
• Do not manually stop the guard or reinstall Build 18. A deliberate rollback must first verify the exact stage-owned guard command and avoid racing the guard.
• No other fleet host received Build 19.

Durable coordination

• Monitoring takeover acknowledgement: fleet-bus message 20260911-181951-D303D56F.
• Independent gate acceptance receipt: 20260911-181659-4D43EC36.
• Canonical tickets ISSUE-20260905-23, ISSUE-20260909-12, ISSUE-20260911-01, ISSUE-20260911-15, and TASK-20260911-01 were updated with bounded evidence.
• Heartbeat automation finish-tyrell-build-16 was renamed and updated to follow Build 19 through the six-hour and 24-hour boundaries while continuing the local agy receipt monitor.

Outstanding work

• Maintain exact same-PID, same-process-start, exact-artifact, endpoint, permission, physical-memory, RSS/category, CPU, descriptor/socket, and inventory evidence through the 24-hour gate.
• Require one complete inventory and an unchanged repeated inventory before acceptance.
• After a passing 24-hour state, independently reproduce the receipt, run a fresh app functional canary, and prove stable-path continuity across a coordinated reboot.
• Only after those gates may the exact accepted Build 19 artifacts be installed on rdmpw3275m under rollback protection and considered for a staged fleet rollout.
• Continue monitoring completed local agy parents for explicit canonical accept/reject/integration receipts; do not rerun them without a genuinely unfinished parent or a real provider quota-reset event.