rdmsm4x-changelog-20260924-2239-remote-control-cleanup-complete-rc-reset-v101

[2026-09-24 22:39:34 EDT · rdmsm4x] · session 158c9525 (notes-republish-pending-changelog) · work window 22:05–22:39 EDT · under Rich's relayed "resume all work", quota advice hold: everything inline, no workers

Summary: Finished the Remote Control 403 incident from 2026-09-03 across all six Macs (every idle stale record cleared, jdmbair13m5 done for the first time, claude_rc_reset.zsh v1.0.1 fixes a hang), resolved INC-20260903-03, and filed the RFC plus four postmortems Rich asked for on 2026-09-03. One defect of my own to report: an OAuth access token was printed into this session's transcript by a traced debug run.

Scope

• Hosts changed: rdmsm4x (2 transcripts cleared, script v1.0.1, one watcher), jdmbair13m5 (script installed, 5 transcripts cleared, 3 watchers), rdmbair13m5 / rdmbair15m5 / rdmpw3265m / rdmpw3275m (script v1.0.1 only; 0 stale).
• Not touched, per dev-c2's request tonight: TCC/FDA, xcode-select, herdr and ECSToolHost LaunchAgents, other agents' herdr panes.

Remote Control (INC-20260903-03) — final numbers

• claude_rc_reset.zsh v1.0.1 (sha256 5149573c4211bad7…): the check banner's claude --version is now timeout 5 claude --version. On both Airs the binary hangs for minutes (timeout 15 claude --version → rc 124; known as HERDR-20260905-06 / the run-new-binary-once trap), and the script sat in it forever with zero output. Installed by ssh host 'cat > path' < file with a remote shasum compared in the same command on all five spokes; snapshots in ~/dev/fleet/tooling/host-scripts/<host>/, commit f2b855f.
• INC-20260903-03 resolved with the numbers above.

Tickets filed (paused since 2026-09-03, filed under "resume all work")

• RFC-20260924-01 "Scripts ship on untested assumptions: catalog of realized mistakes to date and a mechanical test-where-it-runs gate" — catalog of every instance to date (all IDs verified to exist), five failure classes, the model-tier question answered (flat across tiers), five proposed gates A–E for Rich to accept or reject.
• Children (type POSTMORTEM, filed by the CLI under the INC prefix): INC-20260924-01 preflight v1.1 misplaced block; INC-20260924-02 publish_site rc 127 and the rc-reset watchers (zsh no word-split); INC-20260924-03 tests that cannot fail; INC-20260924-04 scripts never executed in their target environment.

Defect: OAuth access token printed into the transcript (mine)

• At 22:25 EDT I ran the check on rdmbair13m5 under zsh -x to find the hang. The trace echoed the TOKEN= assignment, so the Claude Code OAuth access token (not the refresh token) is now in this session's transcript ~/.claude/projects/-Users-richh-dev/158c9525-….jsonl (mode 600, local to rdmsm4x) and was briefly in /tmp/rc-x.err on rdmbair13m5, which I deleted at 22:26 (confirmed absent).
• Exposure bound: the token's expiresAt is 2026-09-25 02:32:53 EDT; Claude Code refreshes it with the refresh token, which was not printed. Nothing left the two machines.
• Never trace a script that handles a credential; the fix was to sample the running process's children instead, which named the hung command without printing any variable. Recorded in the RFC catalog as tonight's instance.

Notes publish

• This file is queued for the hourly com.rdm.claude-notes-autopublish job. dev-94 measured at 22:37 that the job is hanging on AppleEvents while dev-c2 primes Full Disk Access with deliberate TCC prompts (bus 20260924-220411-1B79F5F3); it drains on its own afterwards. Not published as of writing.

Backups / undo

• Cleared transcripts: ~/.claude/backups/rc-reset-20260924-2206*/ on rdmsm4x and rc-reset-20260924-222354/ on jdmbair13m5; undo = copy back or delete the appended last line.
• Script: previous v1.0.0 is in fleet git history (parent of f2b855f).