The shared global header (injected on every dev page via the dl-static global-footer.js) hardcodes the topbar OWNER badge to 'Carol' (and links it to Orion's org page) for ALL Car\u2026

Make every Carol app compliant-by-construction and guard it with two independent, deterministic gates (design + architecture), all agent-centric (no standalone scripts). Triggered\u2026

The gateway page (/dev/apps/) loads carol_hero.png which is a 1280x720, 1.1MB PNG displayed at 32px (topbar) and 160px (hero). It is also served with Cache-Control no-store (CF BY\u2026

Add an allowlisted restart_app operation to Radagast sudo executor that safely relaunches a critical non-systemd uvicorn app (initiatives/planner/gateway/auth) with its canonical\u2026

app-watchdog.sh (restarts the critical shared apps: initiatives, planner, gateway, auth) is currently a loose deploy shell script — not a registered droid, not scheduled, no run-a\u2026

Make Orion Logbook fully public (the page is already open; stage an nginx rule to expose its read-only images). Add an Orion Logbook footer link to three canonical surfaces: Carol\u2026

DIAGNOSIS: The initiatives API (port 7167) crashed and stayed down because there is no auto-restart mechanism. The system service carol-initiatives.service is masked. carol-apps.s\u2026

ROOT CAUSE of the Carol Chat send-fail. registry.db users.phone is TEXT UNIQUE, but register_user_by_channel inserts phone='' (empty string) for every web user. The first web row\u2026

All 35 Carol apps render their own index.html with no consistent identity strip. User asks for: (a) every app to show its owner in the header, (b) every app to display reliably (a\u2026

Carol's Org page shows 28 (full registry); Apps gateway shows 20 (active AI only). Neither matches the canonical definition of 'Carol agent', causing drift. Decision (Ninad 2026-0\u2026