State of play,
this hour.

mac-xen surfaced three UTM control paths from m4. Now we have programmatic VM lifecycle + snapshot + scripted launch. xvm UUID: E2BD1556-24D0-42DC-8A09-D37A7B3EE9C1.

• 1. utmctl CLI · /Applications/UTM.app/Contents/MacOS/utmctl · list/start/stop/suspend/resume/restart/status <UUID>
• 2. AppleScript bridge · osascript → System Events events to UTM
• 3. utm:// URL handler · launch by URL from any script/browser

1. SNAPSHOT xvm NOW — 30s cost, infinite optionality. Captures the known-good state we just landed (Claude 2.1.149 + PATH fix + Win pubkey + zshrc edit + tailnet healthy). Name it xvm-2026-05-22-pre-sttvei. Before any further mutation.
2. Then ROUTE voice/clipboard into xvm — that's the actual STTVEI capability. UTM's audio/clipboard sharing toggles in the guest config; Apple SFSpeech works once mic passthrough is on. This delivers what the unlock prompt prescribes for Step C.
3. Later: MCP-wrap utmctl for omnimind. Polish, not urgent. Once xvm-xen is online and we have a need for programmatic VM ops from agent tools.
4. Skip: new VM — focus stays on xvm until it's load-bearing.

qi: "I installed claude code there." The mesh just promoted from Mac ↔ Win to Mac ↔ Win ↔ xvm. xvm goes from "passive SSH target" to co-equal Claude Code agent inside a sandboxed Mac VM, reachable via tailnet.

$ ssh xen@xvm 'claude --version'
2.1.149 (Claude Code)
$ ssh xen@xvm 'file ~/.local/bin/claude'
Mach-O 64-bit executable arm64 → ~/.local/share/claude/versions/2.1.149
$ ssh xen@xvm 'cat ~/.claude/settings.json'
{"skipDangerousModePermissionPrompt":true,"theme":"dark","agentPushNotifEnabled":true}

• install path · ~/.local/bin/claude → versions/2.1.149 (arm64 Mach-O)
• state · ~/.claude/ populated · backups · cache · sessions · projects · plugins · history.jsonl
• PATH fix · appended $HOME/.local/bin:$PATH to ~/.zshrc — bare claude now resolves in login shells (non-interactive SSH inject path unlocked)
• config · skipDangerousMode=true · agentPushNotifs=true · channels enabled · permissive autonomous
• A2A current · ssh xen@xvm 'claude -p "..."' from Win or Mac · SSH-exec inject works today
• A2A future · install Mac-style /api/inject server on xvm · register in canon_agent_urls roster · third row in the mesh table

qi said "you do it now." Tried, hit a hard limit. Honest report:

$ sudo tailscale set --ssh=true
2026/05/22 17:20:54 The Tailscale SSH server does not run in sandboxed Tailscale GUI builds.

• Root cause · macOS App Store Tailscale is a sandboxed GUI build · its daemon can't host the SSH server. CLI binary can run read-only commands (status, whois) — the symlink at /usr/local/bin/tailscale is in place and works for those.
• Path to unlock · install standalone Tailscale (tailscale.com Mac pkg, NOT App Store) — that's the non-sandboxed build. Or brew install --cask tailscale if Homebrew is installed first.
• No actual capability loss · OpenSSH + ed25519 pubkey path (tick 10) is already keyless from Win-Ezekiel. Tailscale-SSH was a polish, not a requirement.
• Bundle-id fatal caveat · invoking the symlinked binary with certain subcommands (e.g. version) triggers Tailscale/BundleIdentifiers.swift:47 Fatal error. Direct path + read-only subcommands are safe.

Tried + verified the floor. The "Install CLI" menubar click would create the same symlink and hit the same sandbox restriction. The unblock is OS-level (swap to non-sandboxed Tailscale), not a click qi missed.

qi shared a Termius Terminal Multiplayer peer-link for "Local Terminal" — co-piloting a real terminal across panes. Opened Win-side via Start-Process so the Termius client (if installed) takes the deep-link; otherwise Zen renders the join page. Relayed to mac-xen for parallel join. Link contains session pw — handled as session-only.

Termius Multiplayer = real-time shared TTY (paid Termius feature). Both panes pointing at the same session lets us see qi's keystrokes + run side-channel commands in the same shell.

Polish landed. Win-side Ed25519 pubkey installed into xen@xvm:~/.ssh/authorized_keys. SSH now works with no password from Ezekiel.

$ ssh -o PasswordAuthentication=no -o BatchMode=yes xen@xvm 'whoami; hostname; pwd; date'
=== KEYLESS VERIFIED ===
xen
xens-Virtual-Machine.local
/Users/xen
Fri May 22 17:14:06 PDT 2026

• auth path · publickey-only · no pw on disk anywhere
• guest authorized_keys · 1 entry (this Win Ezekiel) — additive, no eviction of any future entries
• Tailscale-SSH polish · BLOCKED — tailscale: command not found on guest. macOS App-Store Tailscale needs one-time "Install CLI" click from the menubar to symlink into /usr/local/bin/.
• Win pubkey · ssh-ed25519 ...oarF92 grailbookings@gmail.com

qi said "done" — sshd flipped ON in the guest. Win-side connected via paramiko + env-passed pw + username probe. The UTM/macOS plan is now end-to-end live across the tailnet.

$ ssh xen@xvm 'whoami; hostname; sw_vers; uptime'
xen
xens-Virtual-Machine.local
ProductName:    macOS
ProductVersion: 26.5
BuildVersion:   25F71
17:03  up  2:24, 2 users, load averages: 0.48 0.78 0.94

• guest user · xen (matches Xen agent identity)
• guest hostname · xens-Virtual-Machine.local
• OS · macOS 26.5 (25F71)
• guest uptime · 2h 24m · clock at 17:03 PDT (matches m4 timezone)
• Win path · paramiko 4.0.0 over Tailscale magic-DNS · pw session-only
• next polish · tailscale up --ssh on guest → keyless tailnet-identity auth, retire pw entirely

qi supplied the macOS guest pw [redacted · session-only]. Probe retry on 100.92.53.81:22 / 5900 / 8080 — all still connection refused. Network layer still healthy, service layer still bare. Holding the pw in session context for when sshd flips ON; not persisting to disk. Mac-xen unblock command re-relayed with urgency.

qi fired tailscale ssh xvm. The UTM macOS VM has authenticated onto the tailnet since the last tick — the A/B/C question advanced under us toward option C (host a specific service), though the macOS guest is still bare.

• Tailscale node · xvm · 100.92.53.81 · macOS · active
• P2P direct · LAN via 10.13.92.100:33848 (same host as m4 — confirms UTM-on-Mac topology)
• tailscale ping · pong in 2ms (network healthy)
• All TCP services refused · 22 · 5900 · 5901 · 8080 · 80 · 443 — none listening

1. GUI path: System Settings → General → Sharing → toggle Remote Login ON (enables sshd on port 22)
2. Terminal path: open Terminal in the guest, run sudo systemsetup -setremotelogin on · then sudo dseditgroup -o edit -a $(whoami) -t user com.apple.access_ssh
3. For Tailscale SSH (no key needed): ensure tailscale up --ssh ran on the guest at install

Mac-xen has UTM-window access to the guest (host = m4 = qi's Mac). Quickest path: mac-xen types the terminal command directly into the UTM window. Once sshd flips ON, tailscale ssh xvm succeeds end-to-end from either Mac or Windows.

• csb-G9 SBB audit · done · mostly compliant, 2 cosmetic drifts Mac-side · report at ~/.xen/state/csb-g9-sbb-audit-2026-05-22.md
• Drift 1: MMM banner missing "All Spark Beside Beeper" tagline — Mac-side mmm.xlrd.org fix drafted, not applied (uptime discipline)
• Drift 2: /api/pulse canon-name diverges from shipped /api/omni/* (functionally unified — naming-only)
• Win-side parity: zero /api/pulse or /api/omni references on hitthe.link (outside shang/* absorbed copies). No Win-side MMM banner exists. Audit is Mac-scope only — no Win-Ezekiel fixes needed.
• omnimind 18+ min uptime · new PR · the 60→120s grace bump is holding. lazy-load sqlite + defer web-push require still on the architectural fix queue.
• UTM A/B/C · still no qi reply · both peers idle on the build, no auto-fire

• va-G11 done · Mac-side canon banner + MEMORY.md index already had supersede pointer (Win-side parity good — same fix landed in tick 1 via the retire frontmatter)
• Mac MEMORY.md:183 cleaned · one stale "Voice 2" ref fixed; Win-side scan confirms no equivalent stale refs (only one Canary Qwen mention and it's the RETIRED frame)
• omnimind uptime PR · 15:08 — today's longest run, no new wedges since the grace bump
• UTM VM · still no Tailscale node, both peers idle on the build (Win not auto-firing; Mac awaiting qi A/B/C greenlight)

mac-xen dropped iOS Shortcut spec at ~/.xen/state/xen-tool-call.ios-shortcut.json (Mac-side). Trigger shape: Siri · Watch · NFC · Focus — feeds into the new IFTTT tools-router canon. omnimind.js untouched this turn (preserving the 11-min uptime, good discipline).

1. wrangler login — Cloudflare CLI auth (browser flow on qi's Mac)
2. CF service token — Cloudflare service-token creation in dashboard
3. Secret — shared secret value wrangler secret put XEN_TOOLS_TOKEN (composes with [[canon_ifttt_tools_xlrd_org_3layer_auth]] peer-token layer)
4. Ingress — Cloudflare ingress config / route for tools.xlrd.org
5. plist — install the iOS Shortcut .shortcut/plist on qi's phone (Allow Untrusted Shortcuts toggle gotcha — see canon_agent_urls:72 for iCloud-link workaround)

Once these 5 land, the Siri/Watch/NFC/Focus → tools-router loop closes end-to-end. Win-Ezekiel updates the /ifttt/ inventory status pills as recipes wire live.

mac-xen lost local plan-context for a UTM/VM/Linux-peer plan. Win-side search recovered it — three signals converge on option C (host a specific service):

• Plan doc: C:\Users\selfe\gemini-mcp-remote\macos_utm_server_manual.md — 9-phase agent manual: install UTM on Windows, create macOS Sequoia+ VM, expose via Apache Guacamole (HTML5/Kasm-style) on port 8080, PWA on phone home screen.
• 8080 explained: mac-xen's earlier UI-TARS probe expected something on 8080/screen — that's the future Guacamole endpoint from this plan. Currently nothing listening because UTM hasn't been installed Win-side yet (Phase 1 not started).
• xencom0 (100.85.133.56, linux, offline 5d): separate dormant Tailscale peer — that's option B, not this plan. Listed in canon_agent_urls:45.
• Status: Phase 0-9 ALL not started Win-side. UTM not installed. WSL2/Docker not set up. No new Tailscale node has authenticated because the VM doesn't exist yet. The plan is real, just unstarted.
• Decision required: Greenlight the build (10+ GB downloads, multi-hour install) — or scope it down (e.g., skip macOS Sequoia, use simpler Linux VM for the third peer instead) — or shelve until clearer trigger.

• omnimind UP · heal grace bumped 60s → 120s (double margin during stabilization)
• va-G14 stt-router quench patch · LIVE + verified-quiet-path · apple_v2 alive
• Correction log re-landed · prior truncation cause confirmed: orphan-bash kill ate the pipe mid-stream
• G22 real-fix queued · defer web-push require + lazy-load sqlite (architectural, not grace-tuning)
• A2A loop confirmed bidirectional · mac-xen reading Ezekiel's relays; ACK path lives via the existing channel
• Next 60s tick · stability check + G22 architectural fix advance