rdmsm4x - code - rdtcc v2 fleet TCC evidence run and four scan fixes on branch - claude-mhtcc926 - FEAT-20260926-12 - RDmacTCCfix - 20260926-2235

Summary: I finished the evidence for rdtcc, the read-only fleet TCC check tool. The final scan reached 6/6 hosts with every host at 5/5 sources. Four defects found during the live runs are fixed. The watch LaunchAgent is live on rdmsm4x.

• When: 2026-09-26 21:27:37 → 22:35:24 EDT (resumed after the ~21:24 reboot; the build began 17:11)
• Host: rdmsm4x (runs); read-only ssh to all six fleet Macs
• Agent: claude@rdmsm4x/mhtcc926 (builder). Coordinator: rdmactccfix@rdmsm4x
• Worktree / branch: ~/dev/_worktrees/machealth-tcc-20260926, machealth/tcc-v2-20260926, HEAD fc81847 (not pushed)
• Proof: ~/dev/_handoff/machealth-tcc-20260926/EVIDENCE.md, RESULT.md, evidence/

Local state changed

• ~/Library/LaunchAgents/com.eastcoastscience.rdtcc.watch.plist: installed 21:36, reinstalled 22:21. Every 30 min it runs ~/Library/Application Support/RDmacTCCfix/bin/rdtcc watch --run-once.
• ~/Library/Application Support/RDmacTCCfix/: installed binary, heartbeat.json, watch-state.json, last-scan.json, watch.log.
• The bus got 6 tcc-drift messages to rdmactccfix@rdmsm4x, plus 1 tcc-builder-done report.
• rdmbair15m5: /tmp/rdtcc-evidence/rdtcc (a temp copy, used only for the A7 no-flag run).
• System Settings was opened once on the rdmsm4x console, at the Full Disk Access pane, as open evidence.
• Nothing written to any TCC store or clients.plist. No tccutil reset, and no legacy --repair.

Commits (explicit paths)

• b2c749f: open uses sudo -n launchctl asuser … sudo -u (plain asuser fails from ssh)
• ccc96c0: preflight kept its bare @P end sentinel (every host had read as "did not finish")
• 2bfb0ad: the watch message names incomplete-coverage hosts
• 1f311cd: the collector keeps the newest AUTHREQ lines (the old cap kept the oldest, so watch diffs flapped); adds sources_read.tccd_log_truncated (schema + INTERFACES, additive); ssh budget 180 → 600 s for Intel codesign checks
• 9435f38, fc81847: docs

Verification (counts, not "green")

• Tests: 27 executed, 1 skipped, 0 failed. Universal2 lipo ok on rdtcc, rdtcc-mcp and RDTCCCanary.
• Final scan at 22:28: 6/6 hosts, 5/5 sources each, exit 1, schema-valid. Preflight: 6/6, exit 0.
• A7 no-flag run on rdmsm4x and rdmbair15m5: clients.plist sha256 and TCC.db mtime+sha256 identical before and after.
• Positive control: found on both canary hosts; an absent control gives exit 2 scan_broken.

Undo

• Watch job: ~/Library/Application\ Support/RDmacTCCfix/bin/rdtcc watch --uninstall (moves the plist aside).
• Code: the branch is unmerged; drop it or revert the commits listed above.

Outstanding (owners)

• reset --apply: waits for claude@rdmsm4x's ruling on criterion 2 vs FLEET.md §7 (bus topic signing-tcc-home).
• The rdmsm4x canary was switched ON at the console at 21:28:36 (ISS-RDTCC-005). Restore it after the ruling.
• ISS-RDTCC-010: a live "changed": false heartbeat is still pending, because the fleet kept changing.
• Apple Notes copy: pending. This session is headless (launchctl managername = Background), and notes_changelog.zsh refuses to run from one.