Tyrell R2 aborted safely when the canary lid closed; exact Build 15/17 recovery was verified, immutable evidence and registry corrections were preserved, and R3 is blocked until the lid is open on AC.

Tyrell R2 environmental abort and fail-closed rollback

Scope and outcome

• Coordinator host: rdmpw3275m.
• Canary host: rdmbair15m5.
• Canonical documentation host: rdmsm4x.
• Ticket: ISSUE-20260914-15.
• R2 stage: /Users/richh/.tyrell/build25-canary-r2-20260915-4818529 on rdmbair15m5.
• R2 ended at 2026-09-15 23:56:26 EDT when the guard detected a closed clamshell. The abort is environmental and inconclusive, not a memory rejection.
• The prior R2 short gate remains valid evidence for that exact run. R2 did not reach six-hour, 24-hour, reboot, integration, fleet, or release acceptance.
• The exact accepted Build 15 daemon and Build 17 app were restored and independently verified healthy.
• R3 was not launched because the authoritative probe still reported AppleClamshellState = Yes despite AC power.

Exact state changes and files touched

• Updated ticket ISSUE-20260914-15 with rerunnable abort, rollback, and immutable-evidence receipts.
• Updated canonical /Users/richh/dev/PROJECTS.md on rdmsm4x by compare-and-swap:
  • Before SHA-256: 28913b8091ea84ce3a374ac0dcfd2c838f7fe1929b6e01d109502a627ad5f918.
  • After SHA-256: e9c610693af3f556fab029524da514e5915084fac7693a4037c3792e336e145b.
  • Exact before/after copies are retained under the evidence packet's registry/ directory.
• Created local frozen evidence:
  • /Users/richh/Documents/ChatGPT/rdmpw3275m/handoff/tyrell-build25-r2-environmental-abort-evidence-20260916-0014.
• Promoted the byte-identical canonical evidence copy:
  • /Users/richh/dev/_handoff/tyrell-build25-r2-environmental-abort-evidence-20260916-0014 on rdmsm4x.
• Updated check-in:
  • /Users/richh/.agent-coordination/checkins/codex-rdmpw3275m-tyrell-build25-canary-20260915.json.
  • SHA-256 after the 00:57 AGY-state correction: 496804031a1d66f4e739de25989a051c0da3ca680590d99356ae3de7a4da5811.
• Updated active heartbeat automation finish-tyrell-build-16 with the superseding R2 abort/R3 blocker state.
• Automation TOML SHA-256 after the 00:57 corrected exact-parent resume procedure: 062402003fec58b81180a4535a91b68220f03c7d66bd6bfcbc80304ecb952cee.
• Sent and synchronized fleet messages:
  • Canary observer source: 20260915-235747-224E0EC9.
  • Independent verification reply: 20260916-001346-E3A7B4C3.
  • Coordinator notification: 20260916-001346-ADE51BC0.

Commands and checks run

• Resolved the executing host with scutil --get ComputerName and ran the shared agentkit preflight with explicit AGENT_LLM=codex and AGENT_SESSION=01a078a7-f1fc-77f1-9114-949dab68f922.
• Synchronized the fleet bus and read/acknowledged the new high-priority canary-abort message.
• Pinned rdmbair15m5 to its expected ED25519 host-key fingerprint SHA256:HDXZpExLTrlJconcMTpEfnH+t9xRbzygqdpKMmyF5KU.
• Re-read state.json, latest.json, guard/recovery/app-rollback logs, processes, signatures, exact hashes, launchd recovery state, power state, clamshell state, and both status APIs.
• Parsed all copied JSON and all 95 samples.jsonl rows.
• Ran shasum -a 256 -c MANIFEST.sha256 on local and canonical copies; every listed file returned OK.
• Recomputed the deterministic recursive evidence hash independently on local and canonical copies.
• Checked current AGY parent PID 5069, provider log, exact conversation, and RTTy ticket/repository state. An actual provider RESOURCE_EXHAUSTED HTTP 429 began at 00:16:25 EDT and repeated with a stable reset boundary of approximately 03:23:26 EDT. The automatic retry series ended at 00:27:49 EDT; transcript step 1126 at 00:27:42 is the last turn evidence. The exact foreground interactive parent remains alive on ttys011, but it is idle rather than still retrying. No duplicate or manual pre-reset retry was launched.
• Preserved the final completed AGY tool result before quota: transcript step 1107 exited 1 at 00:16:07 EDT after four archive-policy controls passed, with the remaining failure archive policy wrapper contains a deployment/upload/launch action: /Users/richh/dev/apps/RTTy/script/archive_standard.sh. No RTTy completion is accepted.
• Corrected ISSUE-20260914-14, the active automation, and the check-in so the post-reset procedure resumes exactly once inside the existing idle parent if it remains alive, or resumes the exact conversation only after proving that parent exited. Sent coordinator pointer 20260916-005815-213C2D12.

Verification evidence

• R2 terminal state: rolled_back; reason: canary clamshell closed; daemon_healthy=true; app rollback exit 0.
• Last R2 sample: PID 85673; elapsed 5,643.9322419166565 seconds; physical footprint 82,773,216 bytes; RSS 143,344 KiB diagnostic; 26 descriptor rows; two TCP descriptors; valid API planes.
• Stable daemon: PID 56164; SHA-256 dbc440bd54b85a54dd6c4150b23b3e508bff7d8d8080687d81b9ba7ac2cbbcf0; CDHash 4344fbe498540b7f8e5a6f46edd7588ec9ed8495.
• Stable app: Build 17; executable SHA-256 8693ebce3d474fed049597d11e3579bf1cd32f7a78acfd9544c78d77592da05e.
• Recovery launch agent absent: launchctl print exit 113.
• Interlock: disarmed; normal service enablement restored.
• Both ports 43117 and 43118 returned valid status JSON with host=rdmbair15m5.
• Current physical blocker rechecked at 00:54:50 EDT: AC power present; AppleClamshellState = Yes.
• Evidence manifest SHA-256: 064dceb00c31a40ef534dd085180738310074c4e0695a63ddfe1e3e4882a4e3e.
• Evidence recursive SHA-256: 0096ec9c7a2c90cffa1b03c5696c0e12edba799d5d3f6e66544c38646533cace.
• Evidence inventory: 20 files, two nested directories, zero symlinks, 412,234 bytes.

Backups, rollback, and undo

• The guard already completed the authoritative runtime rollback; do not manually undo it.
• Exact accepted recovery remains Build 15 daemon plus Build 17 app.
• The prior online database backup remains /Users/richh/Library/Application Support/Tyrell/backups/20260914-2144-build24-r1-preflight-3834d45/tyrell.db, SHA-256 f042ddb7f32ea2fb3b1c48813daae27cc6c343cc7cc3bd934fd0ecbeacc354a6; do not overwrite the additive live database with it outside established fail-closed policy.
• R2 must remain immutable and must not be relaunched.
• If the canonical registry change must be undone, use the retained PROJECTS.before.md only if the live file still matches the recorded after hash; otherwise merge intentionally.
• The automation remains active and can be paused or deleted through the Codex automation control if monitoring is intentionally stopped.

Outstanding owner action and next step

• Physical action required: open the lid of rdmbair15m5 and keep the Mac on AC power for the full canary.
• After a fresh fingerprint-pinned probe verifies both AC and AppleClamshellState = No, create a distinct R3 stage from the exact accepted R2 packet, re-run every preflight, and restart every acceptance clock from the new daemon launch.
• Current Tyrell main remains prohibited as a build base under high-severity ISSUE-20260915-18 because it lacks the Build 21–24 daemon lineage.
• AGY PID 5069 remains the sole local parent and is under evidenced quota exhaustion. Do not manually retry before approximately 03:23:26 EDT. The provider turn stopped retrying at 00:27:49 while the interactive process remained alive. At or after the boundary, prove the exact PID, ttys011, conversation, transcript tail, and absence of a second parent; then send one continuation message inside that existing idle parent. If it exits first, prove no duplicate exists and resume exact conversation 79bad69b-cf45-4f90-b76e-157012ec740b once.