Tyrell Build 21 R1 failed the unchanged short physical-memory growth gate, automatically rolled back to the exact signed Build 15 daemon and Build 17 app, and was handed back to the canonical owner for a distinct Build 23-or-later fix.

Tyrell Build 21 R1 rejection, rollback, and successor dispatch

Scope and outcome

• Coordinator: codex@rdmpw3275m/01a078a7 on rdmpw3275m.
• Runtime host changed: designated canary rdmbair15m5 only.
• Canonical source host: rdmsm4x; existing task 01a08a70-7b42-7ed1-aa30-1e3408453d0a accepted Build 23-or-later remediation ownership under existing high-severity ISSUE-20260912-01 at 16:20:22 EDT, with no second writer.
• Build 21 R1 is rejected and must not be relaunched or expanded. Build 20 remains rejected as well.
• No fleet expansion, source integration, merge, release tag, or release claim occurred.

Gate failure

• Candidate source: be3e664f20afc0e7bb3de9c2fa057fee01b15674.
• Candidate daemon SHA-256: b9d85e48ff2e6d75ee58235537a61d0f204c9fb01cc726e054324b01b9a3d158.
• Candidate app executable SHA-256: dbc4bc187fba6089da185f566213d0ab8fdb44d929f59346d5d0135478c466a1.
• Unchanged policy: physical-footprint-v2, endpoint and least-squares growth each limited to +0.20 MiB/min.
• Exact independent window: 31 post-warmup samples over 1800.236744 seconds; physical footprint 17.423088 -> 38.532509 MiB.
• Endpoint growth: +0.703555 MiB/min. Least-squares growth: +0.912488 MiB/min. Both fail policy even though the absolute endpoint remains below 300 MiB.
• All 41 samples retained daemon PID 61143, start Mon Sep 14 15:33:50 2026, and exact hash-addressed executable path. Maximum sample gap 60.046281 seconds; libproc descriptors 26..28 with gate endpoint delta zero; TCP exactly two; zero status, permission, or HTTP 503 failures; AC power/open clamshell throughout.
• One inventory pass completed at 16:00:40 EDT. No unchanged repeat was claimed.
• Failure diagnostics: 38.6 MiB physical footprint, allocator fragmentation 22.4 MiB / 84 percent, and zero charged SQLite Page Cache. Build 21 improved over Build 20 R11 but remained outside policy; improvement was not accepted as success.

Automatic rollback and independent verification

• Guard entered rolled_back at 2026-09-14 16:14:02 EDT with reason physical footprint growth exceeds policy limit.
• Exact signed Build 15 daemon SHA-256 dbc440bd54b85a54dd6c4150b23b3e508bff7d8d8080687d81b9ba7ac2cbbcf0 restored at /Users/richh/Library/Application Support/Tyrell/releases/daemon-dbc440bd54b8/tyrelld.
• Fresh rollback daemon PID 130, process start Mon Sep 14 16:13:55 2026; launchd running, enabled, runs 1, never exited. Strict signature and designated requirement passed.
• Exact Build 17 app executable SHA-256 8693ebce3d474fed049597d11e3579bf1cd32f7a78acfd9544c78d77592da05e restored as /Applications/Tyrell.app, version 0.2.0 build 17. Main PID 377, bar PID 618; deep strict signature and Gatekeeper Notarized Developer ID acceptance passed.
• Both direct status endpoints returned HTTP 200 valid JSON.
• Live SQLite quick_check=ok, 153429 files, one additive last_seen_at column. The preflight backup was not restored over the healthy live database.
• Candidate guard process count zero; recovery LaunchAgent unloaded; recovery plist and active marker absent; ordinary launchd behavior re-enabled.

Evidence and files changed

• Complete local evidence: /Users/richh/Documents/ChatGPT/rdmpw3275m/handoff/tyrell-build21-r1-short-gate-failure-rollback-20260914-1614.
• Complete canonical evidence: /Users/richh/dev/_handoff/tyrell-build21-memory-20260914/canary-r1-short-gate-failure-rollback-20260914-1614.
• Evidence contains 97 files, 30 directories, zero symlinks, and 310678659 bytes. MANIFEST.sha256 file hash: 63eb85c096bee9ac1d12cd87f2a353e14b5c68331ac15ef762805e6bf8b63aaa; recursive summary hash: 243a928a34f320c46379e9dfcfae070b1e65e88e59ab18eff2be97931d0e9220. Every manifest entry verified locally and canonically; rsync dry-run was empty.
• Appended material comments to canonical ticket files for ISSUE-20260912-01, TASK-20260911-01, and ISSUE-20260914-10.
• Broadcast high-priority fleet prohibition/rollback notice 20260914-162059-D9DA238F.
• Updated /Users/richh/.agent-coordination/checkins/codex-rdmpw3275m-tyrelld-build18-recovery-20260910.json from active-soak state to Build 21 rejection/exact rollback/Build 23 remediation ownership.
• Canonical owner updated only the Tyrell row in /Users/richh/dev/PROJECTS.md: before SHA-256 f4df23e9ba9b3f5fdf07d1b67862d5a5b16e372c11d17d71a29690940d93cce5, after bff493174abf3e737949ab3306d702e6471a815ac543c0b8ef03da4661b153bd. Backup: /Users/richh/dev/_handoff/tyrell-build23-memory-20260914/PROJECTS.md.before-rejection; receipt SHA-256 f5ef425d39d0d82bfe8ab95c1d8da724f756e56ad67c0b32e8a9c8d9b8edffcf.

Commands and verification

• Ran the pinned power/interlock check and inspected active state, sample, inventory, recovery, footprint, vmmap, traceback, and rollback outputs.
• Independently recomputed the short window directly from immutable samples.jsonl; result retained in INDEPENDENT-SHORT-GATE.json.
• Used rsync -a to preserve the complete canary stage, generated and verified MANIFEST.sha256, copied it to the canonical handoff, verified all entries again on rdmsm4x, and confirmed an empty local-to-canonical rsync dry-run.
• Independently checked the stable daemon link/hash/process/launchd state/signature, app hash/processes/deep signature/Gatekeeper status, both APIs, live database integrity/schema/count, unchanged backup hash, and absence of guard/recovery residue.
• Extended the existing bug and task records rather than creating a duplicate allocator bug.
• Resumed the existing canonical source task with a bounded Build 23-or-later objective; receipt message 20260914-162041-47D92010 confirms the same clean isolated worktree/branch at 9c5812a, an eight-hour lease through 2026-09-15 00:20:22 EDT, no Build 22 edits, no main change, and no install.

Backup and recovery

• Fresh preflight backup remains /Users/richh/Library/Application Support/Tyrell/backups/20260914-1525-build21-r1-preflight-be3e664/tyrell.db, SHA-256 c2c5cfc0f32311d8c2c255d2fe32b60e122cd0c6840c0862a2c7ca06a808e5d6, 153412 files at backup, quick_check=ok.
• Accepted runtime is exact Build 15 daemon plus Build 17 app. No undo of the safety rollback is authorized; do not reinstall Build 20 or Build 21.
• The complete failed candidate and its receipts remain recoverable in the immutable evidence directories, but are evidence only, not launch inputs.

Outstanding actions

• Canonical owner must identify the remaining persistent allocation path, create a distinct Build 23-or-later fix with a regression that fails on be3e664 and passes on the fix, obtain independent review and full tests, then sign/notarize/freeze artifacts without installing them.
• A future candidate must repeat every canary clock and gate from zero; no gate is inherited from Build 21.
• Separate app-only Build 22 remains READY_QUEUED_NOT_INSTALLED; its daemon must never deploy, and its app stays held until a successor daemon is accepted.
• ISSUE-20260914-10 remains open for controlled reboot proof during a future accepted candidate soak.
• Local AGY remains unchanged: no genuinely unfinished parent and no real quota/reset event exist, so no duplicate AGY process was launched.