claudetools/session-logs/2026-06/2026-06-21-howard-gururmm-features-audit-submodule-fix.md

User

• User: Howard Enos (howard)
• Machine: Howard-Home
• Role: tech

Session Summary

Worked through a batch of GuruRMM roadmap/bug items, ran a full codebase audit, and ended by root-causing and fixing a ClaudeTools sync bug that had been disrupting the whole session. Started by listing outstanding skill/roadmap work (excluding bitdefender/unifi/guru-scan), then implemented in sequence: SPEC-021 (logged-in-user domain & account-type detection) + the BUG-020 watchdog tray-teardown follow-up; the "Add Devices"/"Enroll an Agent" modal UX fix (top-X close, click-outside + Escape dismissal, refresh-on-close); BUG-018 (reliable agent deletion); and the "Open in MSP360" deep-link button (RMM_THOUGHTS Feature 3). Each landed full-stack on its own branch and was compile-validated (server cargo check, dashboard tsc -b && vite build run server-side in a throwaway git worktree, since this machine has no node_modules).

The enrollment modal fix was the only item taken all the way to production this session: built the feature branch's dashboard onto the beta web root via a git worktree, the user tested it on rmm-beta, then promoted beta to prod with promote-dashboard.sh --confirm. Established (and saved as a feedback memory) a standing rule that GuruRMM dashboard changes go to beta first, before main, unless told otherwise — and documented that the pipeline auto-builds beta from main, so getting a branch onto beta means a manual worktree build, not a merge.

Ran /rmm-audit (5 parallel Opus passes + a build-pipeline pass over SSH). It surfaced one real HIGH bug — assigning/unassigning any policy silently wiped a connected agent's Event Log Watch monitoring (the third instance of a clobber class already fixed at two other config-push sites) — which was fixed by reusing the single rule-shaper. The audit also flagged a MEDIUM info-disclosure (raw error strings in 500 bodies) that turned out to be already fixed in main (commit 58c1a96); it was a false positive because the audit agents read a stale working tree.

Lined up the four pending GuruRMM branches as Gitea PRs (#40-#43) with the migration merge-order (060 → 061 → 062) spelled out, DM'd Mike the lineup, and synced. Finally, diagnosed why the guru-rmm submodule kept reverting to a stale commit (2e469f1) and discarding work all session: sync.sh ran git submodule update --init unconditionally on every sync, re-checking-out the intentionally-lagging pinned gitlink in detached HEAD. Guarded it to only populate genuinely-missing submodules, verified guru-rmm now stays on main through a sync, and pushed the fix fleet-wide.

Key Decisions

• Dashboard changes go to beta before main (saved as memory rmm-dashboard-beta-before-main). Beta auto-builds from main, so a feature branch is previewed by building its dashboard/ in a git worktree and rsyncing dist/ to /var/www/gururmm/dashboard-beta; promotion to prod is the separate human-run promote-dashboard.sh --confirm.
• BUG-018 root cause corrected against the live DB, not the roadmap's guess: the two huge cascade children (metrics ~6.4 GB, agent_logs ~3.5 GB) were already indexed on agent_id; only five small FKs were unindexed (migration 061). The real operator fix is the new POST /api/agents/bulk-delete (one transaction), not the indexes.
• MSP360 deep-link placement unified: the backup-alert "Investigate" action already deep-links to ?tab=backup, so a single button on the backup-tab plan card covers both placements; no separate alert-row button (the alert doesn't carry the console id).
• Event Log Watch fix reused the existing shaper (watch_rules_for_agent retargeted from &AppState to &PgPool) rather than duplicating the rule-mapping JSON — one source of truth across all three push sites.
• Submodule fix guarded the clobber, did not bump the gitlink: CLAUDE.md intends the parent's pinned gitlink to lag main; the bug was sync.sh re-checking-out that pin over live work, so the fix is a populate-only guard, preserving the lag-by-design behavior.
• Used a SHA-push workaround (commit → cherry-pick onto origin/main → git push origin <sha>:refs/heads/<branch> → verify with ls-remote) to land branches reliably while the submodule kept detaching, before the root cause was found.

Problems Encountered

• Submodule kept reverting to 2e469f1 (detached HEAD), discarding uncommitted edits — caused multiple dangling-commit recoveries and one reverted sed edit. Worked around with SHA-pushes, then root-caused: sync.sh:339 git submodule update --init ran unconditionally. Fixed with a git -C "$ppath" rev-parse --git-dir populate-only guard. Verified guru-rmm now survives a sync on main @ ed8cad3.
• Audit ran against a stale checkout (working tree pinned at 2e469f1, 5 commits behind origin/main). One MEDIUM finding (500-body info-disclosure, 17 sites) was already fixed in main by 58c1a96; caught before shipping a redundant change, deleted the bogus branch, corrected the report. Re-verified all other findings against real main — only that one was stale. Same submodule root cause as above.
• Build-server SSH host key changed — 172.16.3.30 was rebuilt as a new physical box on 2026-06-11 (per wiki), so the ED25519 key legitimately changed. Refreshed known_hosts after confirming the rebuild, rather than blindly bypassing.
• No SSH key on Howard-Home for the build server — used the dedicated gururmm-physical key from the SOPS vault (extract to a temp keyfile, ssh -i, delete after).

Configuration Changes

ClaudeTools repo (committed + pushed):

• M .claude/scripts/sync.sh — populate-only guard on the submodule update (Phase 1a) so already-populated submodules are never re-checked-out to the lagging gitlink.
• A .claude/memory/rmm-dashboard-beta-before-main.md + index pointer in .claude/memory/MEMORY.md.
• M errorlog.md — three entries: two --friction (detached-HEAD submodule; stale audit base) and the root-cause fix context.

guru-rmm submodule (on feature branches, not yet merged):

• feat/spec-021-and-bug-020-tray-teardown: agent/src/metrics/mod.rs, agent/Cargo.toml, agent/src/watchdog/{mod,monitor,wts}.rs, server/migrations/060_logged_in_user_domain.sql, server/src/db/metrics.rs, server/src/ws/mod.rs, dashboard/src/{api/client.ts,pages/AgentDetail.tsx}, docs/specs/SPEC-021-*.md, docs/FEATURE_ROADMAP.md.
• fix/bug-018-agent-delete-indexes: server/migrations/061_index_agent_foreign_keys.sql, server/src/db/agents.rs, server/src/api/{agents,mod}.rs, dashboard/src/{api/client.ts,pages/Agents.tsx}, docs/FEATURE_ROADMAP.md.
• feat/msp360-deeplink: server/src/mspbackups/{client,sync}.rs, server/src/db/mspbackups.rs, server/src/api/mspbackups.rs, server/migrations/062_backup_provider_console_id.sql, dashboard/src/{api/client.ts,lib/provider-links.ts,components/BackupDetailTab.tsx}, docs/RMM_THOUGHTS.md.
• fix/eventlog-watch-policy-clobber: server/src/api/event_log_watches.rs, server/src/ws/mod.rs, server/src/api/policies.rs.
• fix/enrollment-modal-ux (MERGED to main as 4027c86): dashboard/src/components/{EnrollmentModal,EnrollAgentModal}.tsx, dashboard/src/pages/{SiteDetail,ClientDetail}.tsx.
• Untracked (NOT committed): projects/msp-tools/guru-rmm/reports/2026-06-21-rmm-audit.md.

Credentials & Secrets

No new credentials created. Used (all already vaulted):

• SSH to build server: gururmm-physical ed25519 key — vault infrastructure/gururmm-server-physical.sops.yaml field credentials.ssh-private-key (user guru@172.16.3.30, key-only auth; password auth disabled on the new box).
• Sudo on build server (for promote): Paper123!@#-rmm — vault infrastructure/gururmm-server.sops.yaml credentials.password.
• Postgres (schema query): vault infrastructure/gururmm-server.sops.yaml credentials.databases.postgresql-password (db gururmm, user gururmm, localhost:5432).
• Gitea API (PR creation): vault services/gitea-howard.sops.yaml credentials.password (user howard, internal http://172.16.3.20:3000).

Infrastructure & Servers

• GuruRMM server 172.16.3.30 (hostname gururmm) — physical Lenovo ThinkCentre M83, Ubuntu 26.04, replaced the Jupiter VM at this IP on 2026-06-11. Repo /home/guru/gururmm. Build pipeline /opt/gururmm/*.sh, webhook :9000. Postgres 18, MariaDB, GuruRMM API :3001, Coord API :8001.
• Dashboard web roots: beta /var/www/gururmm/dashboard-beta (https://rmm-beta.azcomputerguru.com), prod /var/www/gururmm/dashboard (https://rmm.azcomputerguru.com). API https://rmm-api.azcomputerguru.com.
• Channel model: webhook auto-builds beta from origin/main; prod is updated only by promote-dashboard.sh --confirm (backs up prod first; --rollback to undo).
• Gitea: git.azcomputerguru.com (internal 172.16.3.20:3000), repo azcomputerguru/gururmm.

Commands & Outputs

• Beta preview build (per branch, no main merge): git worktree add --detach <wt> origin/<branch> → cd <wt>/dashboard && npm install && npm run build → rsync -a --delete dist/ /var/www/gururmm/dashboard-beta/. Do NOT touch /opt/gururmm/last-built-commit-dashboard.
• Promote beta→prod: sudo /opt/gururmm/promote-dashboard.sh --confirm (prod backup written to /var/www/gururmm/.dashboard-backups/dashboard-20260621-191008). Undo: ... --rollback.
• Unindexed-FK / schema queries run via PGPASSWORD=... psql -U gururmm -d gururmm -h localhost.
• PR creation: POST http://172.16.3.20:3000/api/v1/repos/azcomputerguru/gururmm/pulls (basic auth howard:<pw>, JSON built with jq -nc --arg).
• Submodule-clobber fix verified: guru-rmm main @ ed8cad3 before AND after a full sync.sh run (previously reverted to detached 2e469f1).

Pending / Incomplete Tasks

• Four GuruRMM PRs await Mike's review/merge — merge migrations in order:
  • #40 SPEC-021 + BUG-020 (migration 060) — FIRST. SPEC-021 also needs a Pluto signed-MSI agent build + fleet rollout.
  • #41 BUG-018 (migration 061) — after 060.
  • #42 MSP360 deep-link (migration 062) — last.
  • #43 Event Log Watch HIGH fix — no migration, merge anytime.
• After each PR with a dashboard portion merges to main, it auto-builds to beta; promote to prod when validated.
• Remaining audit findings (all re-verified valid against real main): LOW DoS cap_field batch (DiscoveryResult / WatchdogEvent / NetworkState / Auth hostname in ws/mod.rs), SSE status-stream revocation bypass + JWT-in-URL (agents.rs:758-762), two console.log stubs (AgentDetail.tsx:670, Logs.tsx:198), ContextTree.tsx missing isError, and the roadmap reconciliation (5 shipped-but-unchecked items to flip [ ]→[x] + 3 partials to annotate).
• The audit report reports/2026-06-21-rmm-audit.md is untracked in the guru-rmm submodule working tree — not yet committed to the gururmm repo.

Reference Information

• PRs: azcomputerguru/gururmm#40 (..43)
• Branch tips: SPEC-021/BUG-020 7083e39; BUG-018 604c42f; MSP360 776b587; eventlog fix 432b434; enrollment (merged) 4027c86.
• guru-rmm origin/main = ed8cad3; the already-shipped info-disclosure fix = 58c1a96; the stale gitlink the submodule was pinned at = 2e469f1.
• Discord DMs to Mike: prod-promote confirmation (msg 1518332316114489505), PR lineup (msg 1518361486509215955).
• Memory added: .claude/memory/rmm-dashboard-beta-before-main.md.

---

Update: 17:39 PT — concurrent-session fallout + BUG-018 rework to Mike's spec

Summary

Discovered a concurrent Claude session (GURU-5070/claude-main, Mike's machine) was working the same guru-rmm tree — branch refs/HEAD kept moving under me. Mike then sent coord decisions: BUG-018 is mine to do as a fast 202 + background purge (it's row volume, not indexes); BUG-019 he approved + merges himself; pfSense Option A + Tier-1 2a/2b are his/settled. Acted on the guru-rmm fallout only (the rest is GURU-5070's). Created a 6-item TaskList and worked it to done, isolating all work in git worktrees + push-by-SHA to dodge the shared-tree races.

Reworked BUG-018 (PR #41) to the 202+bg design, renumbered SPEC-021's migration 060→063 to clear a collision with BUG-019's 060, opened PR #44 for the earlier audit-cleanup branch, and flagged a Gitea-SSH/build-pipeline refusal. Mike replied: BUG-019 built clean (v0.6.67 beta, marker 8b5e0dc), Gitea SSH was only transiently down (build completed before the refusal), and he pushed a gururmm-build skill + docs/BUILD.md + build memories (picked up by this sync). Remaining PRs + the stateful-alert-lifecycle shape-spec are handed to another session.

Key decisions

• BUG-018 → Mike's 202 + background purge: mark status='deleting' synchronously (fast UPDATE, also the existence check), spawn a background tokio task for the cascade purge, return 202; fleet listings/stats exclude 'deleting' so the row leaves the UI immediately. Kept the bulk endpoint + FK indexes (mig 061 — speeds the bg purge).
• Migration order finalized: 060 BUG-019, 061 BUG-018, 062 MSP360, 063 SPEC-021 (renumbered SPEC-021 since Mike merges BUG-019's 060).
• Always isolate submodule work in a git worktree when concurrent sessions may share the tree; commit + push by explicit SHA, never trust the shared branch ref. (Logged as friction.)
• Stateful-alert-lifecycle shape-spec paused mid-Phase-2 (awaiting priority + out-of-scope) — now handed to another session per Howard.

Problems encountered

• Concurrent session moved HEAD/branch refs + mixed both sessions' uncommitted changes into the shared tree; resolved by committing in a worktree off origin/main and push-by-SHA, leaving the other session's files untouched.
• Build-host git fetch over Gitea SSH (git@172.16.3.20:2222) refused 3x during validation; validated instead via internal HTTP (http://...@172.16.3.20:3000). Mike confirmed it was transient.

Configuration changes (this update)

• guru-rmm fix/bug-018-agent-delete-indexes (de9b089): server/src/api/agents.rs (202 + mark-deleting + bg purge, bulk too), server/src/db/agents.rs (mark_agents_deleting, 'deleting' filter on list/stats queries), dashboard/src/api/client.ts + pages/Agents.tsx (202 flow, deleted->accepted).
• guru-rmm feat/spec-021-and-bug-020-tray-teardown (9171f84): renamed migration 060_logged_in_user_domain.sql -> 063_; updated the SPEC-021 note + roadmap reference.
• Coord: claimed + released lock gururmm/bug-018-agent-delete; messaged GURU-5070 (3 msgs).

Pending (handed to another session per Howard)

• PRs awaiting Mike's merge: #40 (SPEC-021/BUG-020, mig 063), #41 (BUG-018 202+bg, mig 061), #42 (MSP360, mig 062), #43 (eventlog HIGH), #44 (audit cleanup). Merge migrations in order 060→063.
• Stateful-alert-lifecycle shape-spec (paused at Phase 2).

Reference (this update)

• Branch tips: BUG-018 de9b089, SPEC-021 9171f84. BUG-019 built v0.6.67, marker 8b5e0dc.
• New from Mike (via sync): gururmm-build skill, guru-rmm docs/BUILD.md, memory feedback_gururmm_build_verification; fabb3421 app DELETED (use Exchange Operator b43e7342 for client mail, 1873b1b0 for /mailbox).
• Coord msgs to GURU-5070: 7a4747b8 (claim), 0c2ae45e (done + SSH flag). Discord DM 1518411100927033464 (build-outage flag).

---

Update: 20:35 PT — Roadmap verification, BUG-021 correction, BUG-022 fix (watchdog dead code)

Session Summary

Continued the roadmap verification pass after compaction. Did a deep functional verification of the live GuruRMM system (270 agents / 178 online, metrics flowing ~2531 rows/15 min, alerts with 0 legacy null dedup_keys, per-agent API endpoints all 200 on a real agent). The one unverified spot was watchdog_events/watchdog_alerts = 0 all-time. Traced both paths end-to-end against origin/main: the watchdog's REST escalation path (watchdog-alert, fires after 3 failed restarts) is sound — 0 alerts = healthy fleet. But watchdog_events = 0 because the agent never produces a WatchdogEvent: the WS variant was defined + fully server-handled (insert_watchdog_event + a watchdog_events table) yet had no producer, and architecturally couldn't (the watchdog is a separate companion process with no WS connection). Dead/orphaned path → filed BUG-022 (LOW).

Mid-session, Howard noted Mike likely fixed the earlier build issues. Re-checked the LIVE build marker and found I had been reporting a stale snapshot: the Windows build went green at 2026-06-22 02:19 (v0.6.67, last-built-commit-windows == origin/main 1dce66d). BUG-021 was already fixed on main via 1dce66d (pinned getrandom 0.3.1 + zeroize 1.8.1 below edition2024 — exactly the dep-pin I had diagnosed + flagged; the fix even reused the BUG-021 label). Also on main since the snapshot: BUG-018 (202+bg, cea87d4) and the Event Log Watch management UI (0fa65f5). Corrected the BUG-021 roadmap entry to Fixed (97045ec).

Then fixed BUG-022. For a LOW dead-code defect, chose option (a) — remove the orphaned path — over building a new feature (granular watchdog reporting is a product call for Mike). Removed the WatchdogEvent variant + payload + enum from agent/src/transport/mod.rs, the variant + payload struct + match arm + insert_watchdog_event call from server/src/ws/mod.rs, and the watchdog_events::* re-export from server/src/db/mod.rs; gutted db/watchdog_events.rs to a doc-only stub (keeps the table↔module invariant; left the empty table to avoid a migration-number collision with the open PR train). Compile-verified on the build server: cargo check clean on server (48.9s) + agent (15.7s), no new warnings. Pushed fix/bug-022-watchdog-event-deadcode (4eb5054), opened PR #45 (code) and PR #46 (docs: BUG-021/BUG-022 fixed + an RMM thought for the REST-based granular-watchdog follow-up). Did not merge — merging the code PR triggers a fleet build+deploy, left to Howard/Mike.

Key Decisions

• BUG-022 fix = remove dead code, not implement granular events. Proportionate for LOW; the feature alternative needs Mike's go (GuruRMM project) and a design (REST producer, since the watchdog has no WS connection). Captured the feature idea in RMM_THOUGHTS instead of discarding it.
• Left the empty watchdog_events table in place (no DROP migration) to avoid colliding with the in-flight PR migration numbers (061/062/063 on open PRs #40-42); flagged for a future consolidated cleanup migration.
• Kept the code fix branch code-only and put the doc status flip on the existing docs branch (disjoint files → no merge conflict between PR #45 and #46).
• Did not merge either PR — merging code to main = fleet deploy (hard-to-reverse, outward-facing).

Problems Encountered

• Stale build-status reporting (friction, logged): reported BUG-021 as still-failing from a build-log snapshot; it had already gone green by report time. Same "acted on a point-in-time read" class as the earlier stale-audit-base slip. Fix recorded: re-check the LIVE last-built-commit marker vs origin/main (and the latest build SUCCESS line, not just the last FAILED line) before asserting build status. errorlog.md ref=stale-audit-base-friction.
• Submodule reset to stale 2e469f1 again: the initial watchdog grep ran against old code. Re-ran authoritatively with git grep origin/main and did all edits in worktrees off origin/main
  • push-by-SHA (the established concurrency-safe pattern).
• cargo: command not found on non-interactive SSH: the build server's cargo is under ~/.cargo/bin; sourcing ~/.cargo/env fixed it (cargo 1.96 on .30).

Configuration Changes (this update)

• guru-rmm fix/bug-022-watchdog-event-deadcode (4eb5054): removed dead WatchdogEvent path across agent/src/transport/mod.rs, server/src/ws/mod.rs, server/src/db/mod.rs, server/src/db/watchdog_events.rs (doc-only stub).
• guru-rmm docs/bug-021-windows-build (487431f): BUG-021→Fixed + BUG-022 entry→Fixed in docs/FEATURE_ROADMAP.md; granular-watchdog-visibility thought appended to docs/RMM_THOUGHTS.md.
• errorlog.md: one --friction entry (stale build-status reporting).

Pending / Incomplete (this update)

• PR #45 (code) + PR #46 (docs) await merge by Howard/Mike. Merge #45 before #46. Merging #45 = fleet build+deploy.
• Empty watchdog_events table still present — drop in a future consolidated cleanup migration.
• Granular watchdog visibility (REST watchdog-event producer) — RMM_THOUGHTS, Raw, needs Mike's go.

Reference (this update)

• BUG-021 fix on main: 1dce66d (getrandom 0.3.1 + zeroize 1.8.1 pin). BUG-018 on main: cea87d4. Event Log Watch UI: 0fa65f5. Windows build green: v0.6.67, marker 1dce66d, 2026-06-22 02:19.
• Branch tips: fix 4eb5054, docs 487431f. PRs: #45 (code), #46 (docs).
• Verified live: 270 agents/178 online; REST watchdog-alert path sound; watchdog_events=0 = dead WS path (no producer).

---

Update: 10:35 PT (2026-06-22) — Tracker reconciliation + GuruRMM wiki full recompile

Session Summary

Closed out the session by making the living docs and wiki truthful for everything that landed. First reconciled the trackers against main: flipped BUG-018 from "Investigated/Open" to Fixed (cea87d4 — DELETE returns 202 + background purge) and marked the Event Log Watch management UI [x] complete in UI_GAPS.md (0fa65f5), bumping its Last-Updated. These went on the existing docs branch (PR #46) so they stay file-disjoint from the BUG-022 code PR (#45).

Then ran the recommended wiki update (decoupled from /save, so the prior save didn't do it): /wiki-compile project:guru-rmm --full. The guru-rmm article turned out to be a tombstone redirect — the canonical article is gururmm (no hyphen). Switched target and did a full recompile of wiki/projects/gururmm.md (651 -> 775 lines) by delegating gather+synthesis to a Sonnet agent: it read live artifacts from origin/main (migrations, routes, roadmap, BUILD.md, recent commits) + the delta session logs (2026-06-12 -> 22) + the existing article, and produced an updated article folding in BUG-018/020/021/022, Event Log Watch UI, SPEC-021, MSP360 deep-link, enrollment-modal UX, the two-wave (stable + legacy-1.77) Windows build, the BUG-021 dep-pin gotcha, and the watchdog section corrected to REST-watchdog-alert-only per BUG-022. Reviewed the staged diff, caught + removed a stale carryover (the article still listed the watchdog-alerts UI resolve/delete routes as "missing" — they exist + the UI is complete), applied it, refreshed the wiki/index.md GuruRMM row (v0.6.67, ~270 enrolled) + header date, committed to main (b977f5e), and released the per-article coord lock.

Key Decisions

• Tracker edits for BUG-018 + Event Log Watch UI went on the docs branch (PR #46), not a new branch — same file (FEATURE_ROADMAP.md/UI_GAPS.md), keeps it bundled with the other verification-pass doc updates and disjoint from the code PR.
• Wiki recompile delegated to a Sonnet agent (per the skill + the high-volume multi-source read) — it wrote to .claude/wiki_staging/ and I reviewed/applied, keeping the 97 KB synthesis out of main ctx.
• Compiled the canonical slug gururmm, NOT guru-rmm (the tombstone redirect caught the hyphen trap).

Problems Encountered

• /save recommends the wrong wiki slug for GuruRMM: Phase 3 derives project:guru-rmm from the submodule directory name, but the canonical wiki article is gururmm (the guru-rmm.md is a tombstone redirect). Caught immediately by reading the stub. Logged as a friction so the /save slug derivation can map guru-rmm -> gururmm.
• Stale carryover in the recompiled article: the Sonnet draft kept an old "watchdog-alerts UI routes missing on server" gap that is actually shipped/complete. Caught it in the Phase-5.2 staged review and removed it before applying — full recompiles inherit stale claims, so the diff review is load-bearing.

Configuration Changes (this update)

• guru-rmm docs/bug-021-windows-build (855b46b): FEATURE_ROADMAP.md BUG-018 -> Fixed; UI_GAPS.md Event Log Watch UI [ ] -> [x] + Last-Updated bump.
• ClaudeTools main (b977f5e): wiki/projects/gururmm.md full recompile (651 -> 775 lines); wiki/index.md GuruRMM row + header refreshed.
• errorlog.md: one --friction entry (/save wiki-slug derivation guru-rmm vs canonical gururmm).

Pending / Incomplete (session close)

• PR #45 (BUG-022 code) + PR #46 (BUG-018/021/022 + Event Log Watch roadmap/UI_GAPS + RMM thought) await Howard/Mike merge. Merge #45 before #46; merging #45 = fleet build+deploy.
• Empty watchdog_events table retained — drop in a future consolidated cleanup migration.
• Granular watchdog visibility (REST watchdog-event producer) — RMM_THOUGHTS, Raw, needs Mike's go.

Reference (this update)

• Wiki: wiki/projects/gururmm.md (canonical; guru-rmm.md = tombstone redirect). Commit b977f5e.
• Docs branch tip: 855b46b. Coord lock 9d9dc3ef (claimed + released).