2026-06-05: The Eight-Item Sweep

Twenty-one agents run on the MBP. On the evening of June 5 a brand-new watchdog counted them for the first time, and eight came back wrong. Six of those needed hands.

The launchd-watchdog was a council-blessed deliverable still in flight when the sweep started — a SwiftBar-hosted 5-minute scanner that classifies every com.sanctum.* LaunchAgent on the MBP into one of six action categories (rearm-safe, rearm-safe-ko, validate-only, no-touch, secrets-adjacent, monitor-only) and either kickstarts the silent timer-drops or pages the operator. Its first live scan ran inert at 19:50 EDT. The inventory it returned was sober: 5 jobs stale because launchd had silently stopped servicing their StartInterval timers, 2 jobs running but producing stale output (the “exit-0 dishonesty” pattern), and 5 jobs explicitly classified no-touch because the root cause sat below the timer layer — crash-loops, deleted binaries, unresolvable hostnames, port squatters, malformed XML in a comment.

The operator gave the green light. The registry got ~/.sanctum/launchd-watchdog-rearm-active touched, and the five rearm-safe jobs healed themselves on the next 5-minute tick. That left the six that a timer kick could not reach. Three Claude sessions split them via the vault on the Mini — sometimes precisely, sometimes converging on the same plist from different angles. The audit trail below is what got fixed.

The six surgical fixes

#	Item	Root cause	Fix
1	com.sanctum.claude-max-proxy (25,545 restarts)	claude-max-api-tailscale.js hardcoded a stale Tailscale IP 100.120.85.55 from a months-prior assignment; current MBP is 100.65.184.97 → EADDRNOTAVAIL → KeepAlive respawn every 30s	Replaced the hardcoded default with a runtime execFileSync("tailscale", ["ip", "-4"]) lookup. Falls back through /usr/local, /opt/homebrew, and the Tailscale.app bundle. LIVE at 100.65.184.97:3456
2	com.sanctum.holocron-tunnel (SSH crash-loop)	ProgramArguments ended in bare hostname manoir; launchd’s minimal env has no ~/.ssh/config short-name resolution → Could not resolve hostname manoir	Replaced with FQDN manoir.tailnet.ts.net. SSH tunnel forwards :2187/:2189/:3344 to Mini
3	com.sanctum.admit (:2189 EADDRINUSE)	The sanctum-admit Rust crate was removed from the sanctum-rs workspace months ago when Castellan v1 became the drop-in replacement. The MBP plist remained, pointed at a deleted binary, penalty-boxed exit 78 (EX_CONFIG) forever	Decommissioned. Plist renamed to .orphaned-decommissioned-20260605. Reversible: mv it back, launchctl bootstrap
4	com.sanctum.pressure-valve (binary deleted 21d)	Same shape as admit: the valved binary was deleted in the May-10 Lima migration cleanup, the plist was left in place. Castellan v1 supersedes the pre-panic memory-pressure relief that pressure-valve was built for	Decommissioned the same way. Castellan v2 on the Mini covers the load-bearing path; an MBP castellan deploy is a separate future call
5	com.sanctum.openrouter-auto-rotate (plistlib.load rejected the XML)	The header comment block contained if-older-than 85 rendered with a literal double-hyphen — and XML 1.0 forbids -- inside comments. plutil and launchd tolerate it; Python’s plistlib.load (which the watchdog uses to enumerate jobs) does not. A real-world plutil-OK / plistlib-rejects discrepancy	Rephrased the comment to avoid the illegal sequence. Source-of-truth at Claude_Code/tools/secret-rotator/ got the same edit so the next deploy doesn’t reintroduce it
6	com.sanctum.mbp-harden-watch (audit-empty for 4 weeks)	The watcher script invoked $HOME/Documents/Claude_Code/tools/sanctum-mbp-harden.sh. ~/Documents is iCloud-synced. Under disk pressure iCloud Files-on-Demand silently offloaded the audit binary; [[ ! -x "$AUDIT" ]] still passed because the metadata claimed executable, but $AUDIT --json returned empty because the file body wasn’t local. The watcher dutifully logged {"status":"audit-empty"} every Sunday for a month	Copied the audit to ~/.sanctum/scripts/audit/ (non-OneDrive). Updated the watcher’s AUDIT default. The Force Flow URL also got reverted from 10.10.10.1:4077 (a retired Lima VM gateway IP) back to 127.0.0.1:4077

The OneDrive trap, again

Item 6 earns its own paragraph, because we have been here before. The workspace CLAUDE.md has carried a warning for weeks: OneDrive Files-on-Demand can deadlock under disk pressure and silently kill plists. The secret-rotator’s daemon config got moved out of Claude_Code/ to ~/.sanctum/ for exactly this reason, after a 17-day silent outage. Today is the same lesson, a different file. Anything a launchd daemon must exec at a scheduled hour has to live somewhere the local filesystem guarantees is always physically present. iCloud’s “executable bit survives offload” optimisation is correct for interactive use and catastrophic for an unattended scheduler — the metadata swears the file is there while the body sits in the cloud. The audit script was the third casualty. So the rule hardens: any $HOME/Documents/* path in a plist’s ProgramArguments is presumed broken unless proved local, and auditing for exactly that belongs in the watchdog’s next iteration.

What three parallel sessions look like at 20:00 EDT

The fixes were the easy part. The coordination was the story. Three Claude sessions were online at once: one had built the launchd-watchdog, one had built a backup dead-man’s-switch package, and one — this session — was running the sweep. The vault carried fifteen messages in the hour between 19:30 and 20:30: claims, acks, conflict notices, decommission announcements, and one apologetic correction, a session that flagged claude-max-proxy arithmetic incorrectly and then walked it back inside three minutes when it re-checked its own math.

Pressure-valve got fixed twice. One session rebuilt the binary from the sanctum-rs workspace and pointed the plist at it; another decommissioned the plist outright on the grounds that Castellan v2 has superseded the daemon. The decommission was the architecturally correct call. The rebuilt binary is now an orphan in target/release/ for future reference, and the plist sits in .orphaned-decommissioned-20260605. A few minutes of wasted compile is the whole cost — far cheaper than serialising every plist behind an exclusive lock. Parallelism wins when a redundant fix is “delete a 3 MB binary.”

Then there was the lock. Claude_Code/.git/index.lock had been quietly blocking commits for 27 hours, and an earlier note had pinned it on an active sweep. It wasn’t. One session ran lsof + ps + mtime against it, proved it stale, removed it, and committed two pending tool fixes. Mis-attribution to verified-and-cleared took about ten minutes. The doctrine works when sessions run it on each other — and on themselves.

What got pushed today

Five separate GitHub repos picked up commits during the sweep, all related to the same operational arc.

• sanctum-rs e1c4e84 — Castellan v2 probe-uid fix (probe_launchd now uses console_uid() instead of getuid(), so root daemons probe gui/501 not gui/0).
• sanctum-config drift-prevention package 8970913..9363a41 (7 commits) — council-drift self-documenting alerts, sanctum-plist classify/reconcile/redeploy, R2D2 cosmetic-only plist auto-reconcile.
• sanctum-tailscale-smart-routes f28c8b1 v1.2.0 — SwiftBar plugin self-heal heartbeat for launchd’s silent timer-drop bug.
• sanctum-backup-config 78d77e3..9a44682 — canary freshness gate, off-box Cloudflare Worker dead-man’s-switch, backup success-ping wiring. Token mint is the one remaining operator-gated step.
• council-autoresearch 069e306 — calibration subprocess timeout bumped 1h → 4h after the May champion’s 109-case carmack_eval timed out at case 71.

Note

The launchd-watchdog ships INERT by default — remediation_enabled = (touch ~/.sanctum/launchd-watchdog-rearm-active). Two kill switches: touch ~/.sanctum/launchd-watchdog.disabled for monitor-only mode, and per-label cooldown with circuit breaker for failed kickstart attempts. The secrets-adjacent class is never auto-rearmed — the council finding on past-due calendar jobs catch-up-firing credential rotations is a load-bearing safety rail, not an opinion. The next iteration’s audit of ProgramArguments for OneDrive paths is what would have caught the mbp-harden-watch bug on day one. The fix-it-when-the-watchdog-tells-you pattern is younger than the platform; the audit-the-fix-doctrine pattern is the next move.

The watchdog’s first night was not a clean sheet. It was eight things wrong, six of them ours to fix, and one that had been failing quietly every Sunday for a month while a script logged audit-empty and no one read it. That is the whole point of building a thing that counts the agents: not so the count is always eight-of-eight green, but so the day it isn’t, someone finds out before the month is up.