📖About

Found during CLI-190. The Inspector, the independent watchdog of Hermione, reads her run record from the retired planner book instead of the live run-audit store. That book last recorded her scheduler on 6 July, so every five minutes since then the Inspector has concluded the scheduler is down by two million seconds and the estate sweep has never run, while both are firing normally. The alarm never reached anyone because the filing it raises is missing the fields the filing gate now requires, so it silently bounces every time. Its recovery action meanwhile force-runs Hermione's scheduler and re-runs the estate sweep on that false reading. A watcher that is wrong and cannot be heard is worse than no watcher.

⚖️Decisions

• Elrond's bypass methodology checklist (a reminder, not a gate -- you've got this): 0. File it requested_mode='bypass' (planner-vs-bypass is a deliberate choice). bypass_start REFUSES a non-bypass initiative (CAROL-INI-1846), and the dispatcher only skips the bypass lane when the mode says bypass -- a 'planner' mistag lets Merlin's pipeline grab the placeholder step and block your finished work. 1. Filed as planned status -- let the bypass claim/activate it; never file active. 2. Open the bypass (bypass_start) with your droid id + the remediation answer (remediates_initiative_id=NNN, or remediates_nothing=True). 3. Work the blocks for your work-type: template -> design -> code -> test -> review. Do the real work; record decisions on the initiative as you make them. 4. Reality is recorded for you at close -- code (files changed), each decision, and the twin-review verdict become real activities tied to this initiative and show in the Activity Tracker like a planner run (CAROL-INI-1840). No dummy rows. 5. Keep the initiative status moving; it parks in 'reviewing' and is tagged uat-pending for you at close (CAROL-INI-1836), so the stuck-watchdog leaves it alone until UAT. 6. Close runs the gates (design/architecture compliance + caller-audit). If a gate flags something pre-existing or unrelated to your change, waive it with a clear written rationale -- audit, don't skip. 7. Bypass skips the planner's auto-orchestration, NOT the standards. Same template checklist, same review, same observability as a planner run. (elrond)
• [status-router] planned -> executing | event=bypass_executing | bypass transition (or-bx-01)
• The watcher was reading a book nothing writes to any more — Scheduled run-audit moved into its own store under CAROL-INI-1952. The Inspector kept opening the PLANNER book directly, which stopped receiving Hermione's runs on 6 July 2026 and froze there. Every five minutes since, it concluded her scheduler had been dead for 2,171,115 seconds and that the estate sweep had never run at all, while both were firing normally — measured live: her scheduler had last run 49 seconds before the fix, and the sweep 564 seconds before. It now reads through shared/process_liveness, which consults BOTH books and returns the newer, so a store moving underneath it cannot wrong-foot it again. (orion)
• A watcher that cannot be heard is worse than no watcher — The alarm the Inspector raises has been rejected by the filing gate on every attempt: the payload carried no budget and no roadmap reference (required since CAROL-INI-2803) and no success criteria (required since CAROL-INI-2199). The exception was caught and printed, and nothing else happened — so 25 days of a screaming watchdog produced not one record. The payload now matches the shape Hermione's own sweep files with successfully. (orion)
• The recovery was the expensive part — On each false reading the Inspector force-ran Hermione's scheduler AND re-ran the estate sweep — 288 extra scheduler firings a day on top of its own every-minute cadence, on a reading that was never true. With the store fixed both read healthy and neither is touched; a check drives the whole run and asserts nothing is restarted while the estate is well. (orion)
• A repair must not break the thing it repairs — The crontab line the Inspector would have REINSTATED had lost the run-audit wrapper. Restoring it would have cured an outage and simultaneously blinded every monitor that watches the scheduler — including the Inspector itself, which reads exactly those run rows. The line is now identical to the one that actually runs, and a check compares the two against the live crontab so they cannot drift apart again. (orion)
• FINDING now able to reach the pipeline: Hermione sees four broken processes and cannot file them — The Inspector's third watch — whether Hermione's filings LAND — has been reporting ten failed filings in the latest sweep, covering the Step Planner (failed), the Auditor (never ran), the Reconciler (failed) and Carol's Daily-Life Generator (stuck). That escalation was bouncing on the same gate. With the filing fixed it will reach the pipeline on the Inspector's own next run, which is the point of the watcher. (orion)
• [status-router] executing -> reviewing | event=bypass_reviewing | bypass transition (or-bx-01)
• [status-router] reviewing -> closed | event=operator_signoff | Auto-accepted (CAROL-INI-1859): Orion-initiated, >2 days in reviewing with no objection. (el-srac-01)

✅Success criteria

• The Inspector's verdict on Hermione matches reality, read from the live run record rather than a retired copy. (must_have)
• When the Inspector does find something genuinely wrong, the alarm lands as a filed initiative rather than bouncing unseen. (must_have)
• The Inspector no longer force-restarts Hermione's scheduler or re-runs the estate sweep on a false reading. (must_have)
• A recovery instruction the Inspector would reinstate matches how the work is actually triggered today, so a repair cannot silently break the run record. (must_have)