📖About

Measured 2026-08-02: the registry's main file is writable by the operator's own login, but while the registry is on write-ahead, SQLite also needs write access to the -shm and -wal side files - and those are created with the umask of whichever process happened to open the registry first. After the apps umbrella restarted today they were recreated owned by the apps login, group-readable only, so the OPERATOR could no longer write the registry at all: a plain BEGIN IMMEDIATE returns 'attempt to write a readonly database' even though the operator owns the database file. This is not the known journal-mode hazard, which is already owned by Hagrid's Registry Journal Custodian; it is a permissions accident that silently transfers write authority to whichever process restarted last. The side files must be group writable by the shared dev group by construction, whoever creates them, for as long as the registry is on write-ahead.

⚖️Decisions

• Elrond's bypass methodology checklist (a reminder, not a gate -- you've got this): 0. File it requested_mode='bypass' (planner-vs-bypass is a deliberate choice). bypass_start REFUSES a non-bypass initiative (CAROL-INI-1846), and the dispatcher only skips the bypass lane when the mode says bypass -- a 'planner' mistag lets Merlin's pipeline grab the placeholder step and block your finished work. 1. Filed as planned status -- let the bypass claim/activate it; never file active. 2. Open the bypass (bypass_start) with your droid id + the remediation answer (remediates_initiative_id=NNN, or remediates_nothing=True). 3. Work the blocks for your work-type: template -> design -> code -> test -> review. Do the real work; record decisions on the initiative as you make them. 4. Reality is recorded for you at close -- code (files changed), each decision, and the twin-review verdict become real activities tied to this initiative and show in the Activity Tracker like a planner run (CAROL-INI-1840). No dummy rows. 5. Keep the initiative status moving; it parks in 'reviewing' and is tagged uat-pending for you at close (CAROL-INI-1836), so the stuck-watchdog leaves it alone until UAT. 6. Close runs the gates (design/architecture compliance + caller-audit). If a gate flags something pre-existing or unrelated to your change, waive it with a clear written rationale -- audit, don't skip. 7. Bypass skips the planner's auto-orchestration, NOT the standards. Same template checklist, same review, same observability as a planner run. (elrond)
• [status-router] planned -> executing | event=bypass_executing | bypass transition (or-bx-01)
• Corrected diagnosis (measured, CLI-214): the side files do NOT take the creating process umask - SQLite explicitly fchmods a newly created zero-size -wal/-shm to copy the MAIN database file mode (proven on this VM, sqlite 3.45.1: main=664+umask=022 gives 664 side files; main=644 gives 644 whatever the umask). The accident chain is main-file mode drift: data/registry.db lost its group-write bit (restore artifact - the pre-ini3569 copy of 2026-08-01 is 0644), and the next side-file recreation copied that mode, locking the operator out. Fix therefore guards BOTH at the one door (rconnect): repair the main file and the side files to group-writable when this process owns them, report once per process when it cannot. The initiative objective (group-writable by construction whoever creates them) is unchanged. (orion)
• [HYGIENE GATE apps_registered] skip: work_type=G does not require app registration (orion.bypass)
• [HYGIENE GATE design_filed] skip: no design_id provided (orion.bypass)
• [HYGIENE GATE architecture_compliance] pass: references architecture design #146 (agent-centric modular architecture) (orion.bypass)
• [HYGIENE GATE policy_check] pass: considered: P.01.03.01.06 (orion.bypass)
• [HYGIENE GATE constitution_aligned] pass: soft-default pass; caller responsible for asserting via decision row (orion.bypass)
• [HYGIENE GATE cookbook_entry] fail: no cookbook_id provided — bypass should leave a recipe or explicitly waive (orion.bypass)
• [HYGIENE GATE logbook_entry] pass: logbook session 330: (orion.bypass)
• [delivery-check] 2 must-have criteria remain pending at bypass_end — delivery FAILED live re-performance; UAT must grade on live evidence, not checklist silence (CAROL-INI-3020): test test_ini3602.py: FAIL (no tests ran in 0.50s) (orion)
• [status-router] executing -> reviewing | event=bypass_reviewing | bypass transition (or-bx-01)
• [HYGIENE GATE apps_registered] skip: work_type=G does not require app registration (orion.bypass)
• [HYGIENE GATE design_filed] skip: no design_id provided (orion.bypass)
• [HYGIENE GATE architecture_compliance] pass: references architecture design #146 (agent-centric modular architecture) (orion.bypass)
• [HYGIENE GATE policy_check] pass: considered: P.01.03.01.06 (orion.bypass)
• [HYGIENE GATE constitution_aligned] pass: soft-default pass; caller responsible for asserting via decision row (orion.bypass)
• [HYGIENE GATE cookbook_entry] pass: cookbook 1149: Registry side-file permissions: main-file mode decides, guarded at rconnect (CAROL-INI-3602) (orion.bypass)
• [HYGIENE GATE logbook_entry] pass: logbook session 330: (orion.bypass)
• Post-close restart proof executed under the reviewing initiative (Radagast service_action restart carol-apps.service, ran rc=0): side files recreated by the restarted estate at 20:36 are 0664 carol-dev and the operator BEGIN IMMEDIATE passes - criteria 9412 and 9414 flipped to met on this evidence. The restart also loads the new accessor guard into every long-running umbrella process. (orion)
• [status-router] reviewing -> closed | event=operator_signoff | Auto-accepted (CAROL-INI-1859): Orion-initiated, >2 days in reviewing with no objection. (el-srac-01)

✅Success criteria

• The registry side files are group-writable by the shared dev group whoever creates them, so write authority never depends on which process restarted last (must_have)
• The operator's own login can take a write lock on the registry after any app restart, proven by taking one (must_have)
• A reader that finds the side files not group-writable REPORTS it, rather than failing later with a misleading readonly error (must_have)
• The fix survives an apps restart: restart the umbrella and the operator can still write (must_have)
• C1 By construction: a registry side file created through the guarded accessor (shared/registry_db.rconnect) ends group-writable regardless of the creating process umask - proven on a scratch WAL registry under umask 0o022 (must_have)
• C4 A registered regression check (regression/test_ini3602.py in tests.json) goes red whenever C1-C3 stop holding - the monitoring gap is closed BEFORE the fix per the report-before-fix rule (must_have)