rdmsm4x-changelog-20260825-1832-replicantdb-deployed-to-fleet

Summary: replicantDB reached first light and was deployed. It now runs on rdmsm4x against a live 675-file index (674 classified) and is installed on 5 of 6 fleet hosts as a signed universal2 app. Both P0 defects are closed, one proven fixed on real data.

Session part 3 of 3 (2026-08-25 15:00–18:32 EDT). Parts 1–2: …20260824-2245…, …20260825-0155….

Scope

rdmsm4x — project work, app installed to /Applications and launched.
rdmbair13m5, rdmbair15m5, rdmpw3265m, rdmpw3275m — /Applications/replicantDB.app plus ~/bin/replicantdb-cli and ~/bin/replicantdb-mcp installed.
jdmbair13m5 — NOT deployed, unreachable over the tailnet at deploy time.

What changed

Deployed a universal2 (x86_64 arm64) build signed TeamIdentifier=ZU2882L4HT. build.sh now defaults to the universal build.
First index cycle ran: ~/Desktop, read-only, CLI-only. 675 files, 392 snippets, 674 purposes assigned in ~1 second. Store at ~/Library/Application Support/replicantDB/replicantdb.sqlite, integrity_check = ok.
Gates landed (see docs/PLAN.md §4b): G1 badge-clobber P0, G2 walker guards ported from Tyrell with attribution, G4 no auto-scan at launch, G5 Finder tagging default-off.
Icon レプリカント installed, recovered from the chat transcript via ~/scripts/extract_chat_images.py.
Docs published to dev.dataroo.net/replicantDB/ (+ /plan.html) and ~/Desktop/.

Verification evidence

swift test 244 passing / 0 failures; swift build clean; tree clean; 55 commits.
codesign --verify --deep --strict OK on every deployed host; lipo -archs = x86_64 arm64.
CLI executed on an Intel host (not merely inspected) — the check that caught the arm64-only build before it shipped an unlaunchable app to two machines.
P0 proof on real data: a seeded USER_OVERRIDE survived a full re-scan and a classification pass with taxonomy and confidence intact; 669 rows carry last_seen_at > indexed_at with first-seen history preserved.

Outstanding owner actions (Rich)

Full Disk Access click (gates widening to ~/Library, not cycle 1).
CloudKit container iCloud.com.eastcoastscience.replicantDB — Apple ID [email protected], team-permanent. Steps in docs/CLOUDKIT-PLAN.md §7.
D-26 choice: git history still carries client names, so the repo is not publishable even though the working tree and binaries are clean.
Daemon registration decision (D-4). None registered anywhere — deliberate.
jdmbair13m5 reachability for the remaining deploy.

Not done

Nothing pushed to any remote. No daemon registered. No index run on any host but rdmsm4x. G6 (override export / squash protocol) remains and must precede Rich's first real correction.