rdmsm4x-changelog-20260916-1145-stormguard-resource-storm-forensics

Read-only forensic root cause analysis on ISSUE-20260909-11 (rdmsm4x resource storm busy 99%, load1 143), correlation with ISSUE-20260905-08 and 09-05 kernel panic, recurrence analysis, and proposed prevention for Rich's approval.

• Scope: rdmsm4x host system forensics & ticket store
• Ticket Handled: ISSUE-20260909-11 (claimed, forensic comment posted, claim released)
• Forensic Findings:
  • Immediate Trigger: Boot storm. rdmsm4x rebooted at 12:13 EDT on 2026-09-09 (last reboot). The stormguard alert fired at 12:16:03 EDT (~180 seconds after boot).
  • Active Processes:
    • Startup/User Applications: 1Password (222.6%), OrbStack (191.9%), ReplicantDB (104.7%), CleanMyMac5.HealthMonitor (103.0%), ChatGPT (86.6%), WindowServer (62.4%).
    • System daemons: biomesyncd (95.8%), fseventsd (95.5%), mds/mds_stores (114–130%), corespotlightd (71.7%), and chronic runaway contactsd (156–246%).
  • Correlation with ISSUE-20260905-08: Belongs to the same underlying indexing and daemon contention family, exacerbated by concurrent post-reboot startup.
  • Cost / Kernel Panic Link: Runnable queue saturation prevents thread scheduling. On 2026-09-05 13:35 EDT, a storm (CPU 208%, load1 74, mediaanalysisd 1631%, contactsd 347%) triggered a watchdog timeout kernel panic 15 minutes later at 13:51 EDT.
  • Recurrence: Post-boot load spikes recurred on every reboot (09-09 16:09, 09-10 13:04, 09-11 14:59, 09-13 21:21, 09-14 14:56). Daily daemon spikes continue in devmon (e.g. 1Password at 311% CPU today at 11:09 EDT; OrbStack Helper at 4.6–4.9 GB RSS).
  • Proposed Prevention:
    1. Mandatory boot grace period (uptime < 15m) in load monitoring guards.
    2. Reset AddressBook sync cache to stop contactsd spin loops.
    3. Prune core.fsmonitor across passive dev repos.
  • Ticket Survivorship: Recommend ISSUE-20260905-08 survives as the canonical umbrella; ISSUE-20260909-11 should be closed/resolved into it.
• Guardrails Preserved: Zero guards, scripts, LaunchAgents, index settings, or processes modified.