RTTy: keychain fix, HS-8, HS-9, Direct 0.3.849/524 fleet deploy — rdmsm4x, 2026-09-26 (ET)

Agent: rtty@rdmsm4x/rtty-grokbot (grok executor), implementers: headless claude (Opus 5.5).

Merges (main, pushed origin/fleet/backup; rdmbair15m5 clone ff each time)

• 12:19 ET 5b42cc9 — ISSUE-20260925-01 keychain root fix (6841d56 + 5b42cc9). Resolved.
• 12:57 ET 8848a10 — HS-8 TASK-20260926-15 per-Mac app checks no longer published to iCloud. Resolved.
• 13:27 ET 46fdc22 — HS-9 TASK-20260926-16 login-item consent asked once, never silent. Resolved.
• 13:44 ET aa236c4 — release: 0.3.849 Build 524 Direct fleet identity (VERSION/BUILD_NUMBER only; xcconfigs + Trusted*.json left for the App Store archive pipeline).

Gates

HS-8, HS-9 and aa236c4 each gated in a private pinned tree (make_release_tree.zsh, 7 libs pinned, libDependenciesDirty=false): full XCTest suites 0 failures (final: RTTyTests 1375/8 skipped, LatencyCore 435, PrivilegedCapture 71), feature inventory PASS 69 rows / 248 cited tests, build_and_run --stage rc=0 universal2 + strict codesign, Developer ID. Keychain fix was staged on hub (off-pin libs) before steering; superseded by the pinned 524 build.

Deploy 0.3.849/524 aa236c4 (Developer ID, UN-NOTARIZED; nothing sent to Apple)

zip ~/dev/_handoff/rtty-keychain-20260926/deploy/RTTy-0.3.849-524-aa236c4-direct.zip sha256 1183b05f…, exe 03f06024…; installer deploy_rtty_direct.zsh v1.8; receipts deploy/receipts/*-aa236c4.txt.

• jdmbair13m5 13:44 PASS, relaunched. rdmbair15m5 13:44 PASS, not running → not relaunched. rdmpw3275m 13:44 PASS, relaunched. rdmsm4x 13:45 PASS, relaunched.
• Old 0.3.848-523-5b42cc9 archived to ~/Archive/RTTy-builds/0.3.848-523-5b42cc9/ on each host.
• Skipped: rdmpw3265m (offline), rdmbair13m5 (refuses key) — both still 523 and will show an iCloud decode error for 524 settings records (accepted HS-8 trade-off).