◈ Observify

Re-surveyed 2026-08-07 (snapshot 2026-08-08T02:05:00Z; previous pass 2026-07-28T13:00:20Z). All 13 current plist definitions and all seven service-only non-Apple/non-application registrations in gui/501 are inventoried (20 union labels, up from 18). Deliberately excludes 450 com.apple.* user services (unchanged count) and 14 application.* transient GUI registrations (9 on 2026-07-28 — more GUI apps are simply open right now), per spec. CHANGES SINCE 2026-07-28, two additions and no removals: (1) homebrew.mxcl.ollama is NEW — a real user LaunchAgent whose plist was created 2026-07-31 03:30 local, i.e. `brew services start ollama` was run three days after the last survey. It is RunAtLoad+KeepAlive and running now (pid 1163, ollama 0.32.0). S5 carries the package-management view of the same service. (2) com.microsoft.VSCode.ShipIt is NEW — a ServiceManagement-submitted registration made by Visual Studio Code (submitted by Code[68807]) for Squirrel, its in-app auto-updater. It has no plist in either allowed LaunchAgents directory, has run once, exited 0, and is idle. Every other label from 2026-07-28 is still present with the same kind, trigger, and owner. Every pid changed because the machine REBOOTED on 2026-08-03 05:00:53 local (kern.boottime); the pid churn is that reboot, not service instability. The one exception is observify.runtimecards.8787, whose runs counter reads 16 SINCE that boot — it is restarted by its own deploy cycle, and its last-exit column is still -15 (SIGTERM), so its `broken` flag is carried forward rather than cleared. ⚠ Submitted services expose no standalone defining plist or executable in the bounded registry. No sudo was used; no mutating launchctl verb was run.

Exhaustive union of 11 /Library/LaunchDaemons plists and 15 non-com.apple system-domain registrations (16 labels; 7 live). Deliberately excludes 422 com.apple.* system services and the 4 S1-owned /Library/LaunchAgents labels: com.paragon-software.extfs.notification-agent, org.xquartz.startx, us.zoom.updater.login.check, us.zoom.updater. ⚠ No audited sudo capture was on file; the unprivileged registry supplied complete counts for this run. ⚠ systemextensionsctl list failed unprivileged and the NordVPN helper plist was unreadable, so those gaps are named on the affected rows.

'Primary source is the human-staged /Users/wolf/Projects/mac-atlas/captures/btm.txt (1,313 lines; captured unprivileged from the conductor at 2026-07-25T05:53:34Z, no sudo). It contains 96 Type records: UID -2 has 21, UID 0 has 10, and UID 501 has 65. This inventory itemizes all 53 UID-501 non-developer records. It summarizes the 12 UID-501 developer placeholders and UID -2/UID 0 (21/10 records) because S2 owns the daemon layer. The detached worker''s own sfltool dumpbtm probe still fails authorization with zero output despite the staged capture; the capture is authoritative for this rebuild, while launchctl print gui/501 remains available for background-agent liveness. No Automation permission was requested.'

The bounded scan found no scheduled-work labels from the spec's cron-entry, periodic-script, or at-job parity probe, and no periodic subsystem paths or binary. The cron and at mechanisms are itemized separately because their backing plists exist. `/usr/lib/cron/tabs/` could not be read without escalation (`Permission denied`), so crontabs for accounts other than wolf are unverifiable in this run. The exact `crontab -l` and `atq` probes were also blocked by the execution sandbox with `operation not permitted`; therefore wolf's personal crontab and the at queue are explicit unknowns, not silently asserted empty. The bounded `dscl . -list /Users UniqueID` check failed with `eServerError`, so the single-user condition could not be verified.

Re-surveyed 2026-08-07 (snapshot 2026-08-08T02:10:00Z; previous pass 2026-07-28T13:28:54Z). Exhaustive package-management view: 34 casks, 71 brew leaves, and all 7 brew services are itemized (112 items, up from 109). The other 170 of 241 formulae are dependency-only and summarized in DOSSIER.md. CHANGES SINCE 2026-07-28. (1) THREE NEW LEAVES, no removals: epubcheck 5.3.0 (installed on request 2026-08-07 14:38 local, hours before this scan), mise 2026.7.15 (installed on request 2026-07-28 17:32 local, the same day as the last survey but after it ran), and ripgrep 15.1.0 (INSTALL_RECEIPT dated 2026-01-06, installed_on_request true — it was already on disk and only became a LEAF in this window, i.e. whatever formula depended on it stopped doing so; brew leaves is the authority for that transition and the receipt proves it is not a new install). (2) Casks are BYTE-FOR-BYTE the same set of 34 — nothing installed, nothing removed. (3) The 7 brew-service rows are the same 7 formulae, but OLLAMA FLIPPED none -> started: `brew services start ollama` was run 2026-07-31 03:30 local, creating ~/Library/LaunchAgents/homebrew.mxcl.ollama.plist, so started services went 2 -> 3 (ollama, postgresql@14, redis) and ollama gained the S1 launchd-agent overlap that postgresql@14 and redis already had. (4) STALENESS GREW WITHOUT A SINGLE UPGRADE: 53 itemized packages are now outdated versus 42 on 2026-07-28, and NOT ONE itemized package's installed version changed on disk in the interval — every delta is upstream moving, not Wolf updating. Twelve items became outdated (casks codex, font-meslo-lg-nerd-font; formulae mingw-w64, mise, nikto, node@24, poppler, rclone, ripgrep, subfinder, ttyd; service php). (5) ONE REPORTING CHANGE, NOT A MACHINE CHANGE: docker-desktop no longer appears in plain `brew outdated` because the cask now carries `auto_updates`; `brew outdated --cask --greedy` still names it (installed 4.41.2,191736 from 2025-05-16 vs 4.85.0,235549 available), so its outdated flag is deliberately KEPT — the app is stale even though the default report went quiet. Total formulae 238 -> 241, exactly the three new leaves; the dependency-only bucket is unchanged at 170, so no new transitive dependencies were pulled in. HOMEBREW_NO_AUTO_UPDATE=1 was set on every brew invocation, so no tap git-pull was triggered; no install/uninstall/upgrade/services verb was run; no sudo. Version and description evidence for the pre-existing rows retains the bounded local INSTALL_RECEIPT.json and Homebrew API metadata captured previously (Homebrew cache writes were denied on the prior pass and that limitation is unchanged); the current pass re-derived every installed version first-hand from `brew list --versions` and every staleness claim first-hand from `brew outdated`. No secrets were copied; credential-like settings were detected only in the readable active service configuration areas and are represented as contains_secrets: [redacted] with values withheld.

Re-surveyed 2026-08-07 and RE-DERIVED 2026-08-08T02:24:33Z under the CORRECTED ephemeral_class image needle (spec fix ratified by the conductor the same night; the wave-A scan raised the gap and correctly refused to patch it itself). Docker daemon REACHABLE: `docker info; echo $?` returned 0, so this is a full enumeration, not a degrade. `docker context ls` shows 'desktop-linux *' described as Docker Desktop — Docker Desktop is still the backend serving every command, and colima is still installed-but-idle. 25 items: 1 container, 2 images, 0 volumes, 17 networks, 5 runtime-presence rows. IMAGES — THE CLASSIFICATION CHANGE: `docker images` returns 30 rows. 28 of them are locally-built task-gate build artifacts and are now SUMMARIZED, not itemized, per the widened ephemeral_class needle: 19 fbtask-<slug>-env / -tests gate pairs; 2 *-scratch-tests ad-hoc builds; 7 <task>__<hash>-main compose service images. They are built and reaped continuously by terminus3 (_build/gate-task.sh lines 264-266 build `fbtask-${slug}-env` / `fbtask-${slug}-tests`, plus the per-task gate-oracle.sh and the compose vendor runs); the oldest present was built 2026-07-31 11:14:16 -0400 EDT and the newest 2026-08-07 22:21:16 -0400 EDT — minutes before this re-derivation, which is the whole reason the class exists. PROOF THE OLD NEEDLE WAS DEAD: it matched the literal prefix `terminus-review-`, a workflow name that no longer exists on this machine, so it excluded ZERO images while all 28 of that same class were itemized as churn rows that went stale within minutes. Only 2 images are itemized now: alpine:<none>, python:3.13-slim — both pulled Docker Official base images, both unreferenced by any container and so both flagged dangling-risk. The aggregate disk cost of the whole image population (the actionable fact for the summarized class) is in `docker system df` below. CONTAINERS: one, lucid_cray, and it is RUNNING — a terminus3 functional-gate verifier held open with `sh -c sleep infinity`, bind-mounting /Users/wolf/Projects/terminus3/_build/work/auger-screw/scratch/functional-gate.14gAf9/{solved,logs-PASS-primary-1}, on the `none` network, publishing no ports. It is an ephemeral sandbox but it is ITEMIZED with live_now: true and flags [transient], which is now the spec's stated rule (ephemeral_class, RUNNING EPHEMERAL CONTAINERS clause) rather than an improvisation: the liveness probe is a bare `docker ps` with no ephemeral filter and the gate's `missed` check is deliberately NOT transient-exempt, so something actually running must appear in the atlas. The previous survey's container thirsty_easley is GONE — reaped, exactly the turnover the class predicts. VOLUMES: still zero. Nothing on this machine persists container state right now. NETWORKS: 17 — the 3 built-ins plus 14 compose-project networks, 10 of them new since 2026-07-28 (9 `ball-valve-parametric__<hash>_default` created 2026-08-03 and 1 `tdisplay-enclosure__k3supgq_default` 2026-08-06), one per terminus3 vendor-run attempt. 14 of the 17 have zero attached containers and are flagged unused-network; only `none` has an attachment (lucid_cray). DISK, re-read at re-derivation time: Images 30 0 7.755GB 4.112GB (53%) | Containers 1 1 491.5kB 0B (0%) | Local Volumes 0 0 0B 0B | Build Cache 177 0 8.956GB 1.522GB. Disk went DOWN versus 2026-07-28 (10 images / 8.731GB / 5.851GB reclaimable, 13.18GB of build cache with 9.694GB reclaimable) despite five times the images, because terminus3 runs `docker builder prune -f` per task. ⚠ THIS SNAPSHOT IS THE MOST PERISHABLE IN THE ATLAS: an image was built one minute before this re-derivation ran. That churn no longer moves the itemized set — which is what the corrected needle bought. Container env was read for KEYS only ([PATH]); no value was read or copied. No mutating docker or colima verb was run — every kill string is documentation. No sudo.

All 50 bundles emitted by the spec parity command are inventoried: 47 in /Applications, one in ~/Applications, and two in /Applications/Utilities. /System/Applications is summarized only (47 bundles). ⚠ The prescribed defaults, mdls, and spctl reads returned errors for almost every named bundle, so version, Spotlight last-used metadata, and spctl acceptance are not inferred; stat, codesign, lipo, and bounded LaunchAgents listing remain evidenced. ⚠ S3 reports BTM authorization failure because the human capture is missing.

[sensitive content omitted]

The six Shortcut definitions are itemized from the required named-column read of Shortcuts.sqlite because the live `shortcuts list` command returned `Error: Couldn’t communicate with a helper application`; the SQLite count is 6 and the ZSHORTCUT/ZTRIGGER schema is present. The Automations tab has 0 ZTRIGGER rows. ~/Library/Workflows is absent and its bounded workflow find returned no paths; ~/Library/Services exists and is empty; /Library/ Services is absent; ~/Library/Scripts is absent; Folder Actions has an opaque 236-byte blob but `folderActionsEnabled = 0`; the System Events liveness query was denied with error -10827; both the exact spec presence loops and a bounded expanded-$HOME recheck found no third-party app/config hits. No liveness registry is applicable to definition-only items on this surface.

[sensitive content omitted]

[sensitive content omitted]