📖About

Option 1 hygiene (distinct from 1908 which is Radagast verifier reads). (a) Make the on-disk initiatives DB owned/writable ONLY by Elronds writer daemon so stray writers (tests/ghost emitter) cannot clobber it; (b) reconcile to ONE real file (no stale duplicate) + clean daemon restart; (c) route the actual writers/hooks (Initiative Creator [done], Initiative Closer, close-event hooks) through the relay so they never touch the file path. Read-only droids keep reading the now-protected real file.

⚖️Decisions

• Elrond's bypass methodology checklist (a reminder, not a gate -- you've got this): 0. File it requested_mode='bypass' (planner-vs-bypass is a deliberate choice). bypass_start REFUSES a non-bypass initiative (CAROL-INI-1846), and the dispatcher only skips the bypass lane when the mode says bypass -- a 'planner' mistag lets Merlin's pipeline grab the placeholder step and block your finished work. 1. Filed as planned status -- let the bypass claim/activate it; never file active. 2. Open the bypass (bypass_start) with your droid id + the remediation answer (remediates_initiative_id=NNN, or remediates_nothing=True). 3. Work the blocks for your work-type: template -> design -> code -> test -> review. Do the real work; record decisions on the initiative as you make them. 4. Reality is recorded for you at close -- code (files changed), each decision, and the twin-review verdict become real activities tied to this initiative and show in the Activity Tracker like a planner run (CAROL-INI-1840). No dummy rows. 5. Keep the initiative status moving; it parks in 'reviewing' and is tagged uat-pending for you at close (CAROL-INI-1836), so the stuck-watchdog leaves it alone until UAT. 6. Close runs the gates (design/architecture compliance + caller-audit). If a gate flags something pre-existing or unrelated to your change, waive it with a clear written rationale -- audit, don't skip. 7. Bypass skips the planner's auto-orchestration, NOT the standards. Same template checklist, same review, same observability as a planner run. (elrond)
• [status-router] planned -> executing | event=bypass_executing | bypass transition (or-bx-01)
• UAT note (caller-audit close gate) — Caller-audit UAT note: entry point `albus.troubleshooter` (agents/agt_001/al_diagnose_01.py) was modified, but callers ['merlin.task_reviewer', 'merlin.task_runner', 'merlin.step_reviewer', 'merlin.step_questioner', 'merlin.planner_orchestrator', 'elrond.handover_watchdog', 'elrond.audit', 'elrond.initiative_reviewer', 'forge.executor', 'shared.albus_trigger', 'shared.albus_coach', 'shared.step_review'] are not in callers_audited; entry point `elrond.initiative_reviewer` (agents/agt_011/droids/ir_s1.py) was modified, but callers ['elrond.bypass_reviewer', 'elrond.watcher', 'merlin.pipeline'] are not in callers_audited. Add the missing callers to the initiative's callers_audited field before sign-off, or record a decision prefixed 'Caller audit waived by Orion:' to waive. (Orion (bypass close gate))
• UAT note (compliance close gate) — Compliance UAT note: [build-cookbook] design: no loading state — a data-driven app must show a loading indicator (design #178 §3); [build-cookbook] design: no empty state — handle the no-data case (design #178 §3); [carol-costs] design: missing canonical topbar — include the shared component /static/dl/carol-topbar.js or the CAROL_LOGO_v4 block (design #178 §4); [carol-costs] design: dark-theme baseline palette not used — design #178 §1; [initiatives] architecture: data artifact in app dir: bypass_book.db (file) — the store lives in the central data folder and must be referenced by its central path; no .db may sit in an app dir (L1.5, design #275); [migration-cookbook] design: no loading state — a data-driven app must show a loading indicator (design #178 §3); [migration-cookbook] design: no empty state — handle the no-data case (design #178 §3). Bring the app to standard (Design System #178 / architecture #146/#173/#156) before sign-off, or record a decision prefixed 'Compliance waived by' to waive. (Orion (bypass close gate))
• [status-router] executing -> reviewing | event=bypass_reviewing | bypass transition (or-bx-01)
• Closed to reviewing under the new CAROL-INI-2039 change-scoped gates — Gates scoped to the 81 relay-cutover files (369 foreign dirty files excluded via baseline). Caller-audit + compliance findings recorded as non-blocking UAT notes; initiative parked in reviewing+uat-pending awaiting Ninad sign-off rather than blocked. (Orion (or-bx-01))
• Re-handled under corrected scoped-reviewer model (CAROL-INI-2039) — Reviewer passed this initiative against its OWN success criteria -> stays in reviewing (Recent Executions) awaiting UAT. Out-of-scope quality findings filed as new initiatives: 2040 (caller-audit) + 2042 (compliance). Not blocked. (Orion (or-bx-01))
• Orion remediated: INI-999900288 bypass closed — CAROL-INI-696 close-marker: the Orion bypass INI-999900288 filed against this parent reached terminal state (closed). This row's literal prefix Orion remediated: is the canonical signal the cookbook-155 dispatcher gate looks for. (shared.bypass.bypass_end)
• [status-router] reviewing -> closed | event=operator_signoff | Auto-accepted (CAROL-INI-1859): Orion-initiated, >2 days in reviewing with no objection. (el-srac-01)
• Orion remediated: INI-999900618 bypass closed — CAROL-INI-696 close-marker: the Orion bypass INI-999900618 filed against this parent reached terminal state (closed). This row's literal prefix Orion remediated: is the canonical signal the cookbook-155 dispatcher gate looks for. (shared.bypass.bypass_end)

✅Success criteria

• The initiatives data file is writable ONLY by the writer daemon user; a stray direct write by caroladmin/another user fails (clobbering is impossible). (must_have)
• One real data file (no stale stub): a fresh direct read of the file returns the real schema (has state + roadmap_refs) and the full initiative set. (must_have)
• Initiative Creator, Closer, and close-event hooks write/read via the relay (no direct file access); filing succeeds and close bookkeeping (scoring/cascade/rollup) runs without no-such-table/column errors. (must_have)