Fleet changelogs · dev.ecs0.net
rdmsm4x-changelog-20260914-1518-tyrell-build21-notarized-candidate

rdmsm4x-changelog-20260914-1518-tyrell-build21-notarized-candidate

Tyrell Build 21 — notarized candidate, not installed

Build 21 removes a reproducible full-inventory allocation on pending upload retries. It is not a proven cure for R11 and has not passed runtime or fleet acceptance. No installed app, daemon, database, or canary was changed by this lane.

Source and ownership

Proven change and limits

The baseline test required a full read on every pending retry. Strengthening it to require successful retry without another full read failed on baseline 75e8ab6, then passed after this patch. SQLite now selects only requested missing hashes, one non-secret/non-aggregate representative per hash, preserving the first eligible path and eligible-record count. Batches of 400 avoid bind limits. Tests cover host isolation, duplicate paths, exclusions, absent hashes, and 805 requested hashes across three batches. Initial and six-hour full reconciliation remain unchanged. No schema migration, shared-library change, or memory-policy change was made.

Frozen R11 MANIFEST SHA-256 0eeae8ca9627eabfaa14c9f1f4141fd96b1db2d1e444bd1e24406eeed89c1dcd and README SHA-256 d9570bbec553f042a82153f4a98156c4a282f59da2b94099758d2b822b874c64 match the handoff; every listed file verifies. Independent recomputation confirms approximately +1.512 MiB/min endpoint and +1.888 MiB/min regression growth. The sample time span is 1800.305197 seconds; the README uses elapsed span 1800.306823 seconds, a 1.6 ms difference that does not alter rejection.

There are no allocation stacks or sync-cycle logs in the frozen packet. A retrospective log query returned only its header, not evidence that sync was idle. R11's 21-minute jump therefore remains unattributed. Independent review also found no obvious unbounded retention in the observation loop. Keep the existing physical-footprint-v2 policy unchanged; Build 20 remains rejected.

Validation

swift test on Apple Swift 6.4 at the exact artifact source returned 0:

The existing Providers PNG prerequisite was regenerated using the current app's own visual-fixture renderer in Aqua (capture-provider-fixture.zsh, exit 0). The slow existing provider-reactivity test was sampled and was parsing telemetry, not hung. The pre-existing concurrency warning at MCPMain.swift:279 remains; this candidate is not warning-free. The first packaging preflight exited 2 because memory-policy tests generated an untracked Python cache; that owned cache was moved to this evidence root and the unchanged wrapper reran from a clean tree.

Artifact identity

Build/sign/notarization ran in the authorized rdmsm4x Aqua session. build-release-aqua.exit and artifact-verification.exit are both 0. The final app archive was extracted separately, signature/staple/Gatekeeper checked again, executable compared byte-for-byte, and version verified by execution. Scripts, logs, submission receipts and artifact-receipt.json are retained beside this file.

Next boundary and rollback

Return the existing bug to the coordinator for preflight; do not install automatically. No acceptance clocks have started for Build 21. Use a new stage, nonce and designated-canary receipt for rdmbair15m5, with the current reboot-safe recovery guard. Preserve all short, six-hour, 24-hour, CPU, descriptor/socket, API, functional-app, reboot, signature and exact-hash gates. The six-hour window needs inventory activity near its fixed endpoint. Capture phase-attributed sync/inventory logs; if allocation-stack capture changes overhead, keep it in a separate diagnostic run.

The frozen rollback material remains at /Users/richh/dev/_handoff/tyrell-build20-memory-20260912/canary-r11-short-gate-failure-rollback-20260914-1419/stage/prior/: daemon, Tyrell.app and daemon.plist. Both signatures and hashes reverified:

These are verified rollback copies, not a fresh claim about a running host. Coordinator must recheck the live baseline and take a consistent database backup before any install. This patch adds no schema change. Undo the source proposal by closing the unmerged PR; keep its branch and artifacts as evidence.

Topology audit reached all six hosts but returned 1: rdmpw3265m account-lane mismatch, plus jdmbair13m5 account classification and durable-root discrepancies. Nothing was repaired or reconfigured. These are coordinator pre-install findings, not authorization to alter accounts. No action is required from Rich for this source handoff.

Build21 frozen delivery receipt

Complete frozen packet: /Users/richh/dev/_handoff/tyrell-build21-memory-20260914/frozen-handoff.