📖About

After the cap bit, Shield logged Carol DOWN 165 times for the rest of the day and auto-filed restart initiatives - a budget stop masqueraded as an outage. Fix at the one chokepoint (the endpoint): (1) evidence-of-life first - a successful non-probe serving call in the last 30 min answers the probe with NO model call; (2) truly idle: at most one paid probe per 30 min, cached verdict between; (3) the paid call declares a work ticket for the registry task whatsapp.availability_watch (track resolved from the task record at call time, never hardcoded); (4) a spend-gate refusal (budget parked or switch off) returns a distinct paused status which Shield records as paused - never down, no restart attempt, no auto-filed initiative.

⚖️Decisions

• Elrond's bypass methodology checklist (a reminder, not a gate -- you've got this): 0. File it requested_mode='bypass' (planner-vs-bypass is a deliberate choice). bypass_start REFUSES a non-bypass initiative (CAROL-INI-1846), and the dispatcher only skips the bypass lane when the mode says bypass -- a 'planner' mistag lets Merlin's pipeline grab the placeholder step and block your finished work. 1. Filed as planned status -- let the bypass claim/activate it; never file active. 2. Open the bypass (bypass_start) with your droid id + the remediation answer (remediates_initiative_id=NNN, or remediates_nothing=True). 3. Work the blocks for your work-type: template -> design -> code -> test -> review. Do the real work; record decisions on the initiative as you make them. 4. Reality is recorded for you at close -- code (files changed), each decision, and the twin-review verdict become real activities tied to this initiative and show in the Activity Tracker like a planner run (CAROL-INI-1840). No dummy rows. 5. Keep the initiative status moving; it parks in 'reviewing' and is tagged uat-pending for you at close (CAROL-INI-1836), so the stuck-watchdog leaves it alone until UAT. 6. Close runs the gates (design/architecture compliance + caller-audit). If a gate flags something pre-existing or unrelated to your change, waive it with a clear written rationale -- audit, don't skip. 7. Bypass skips the planner's auto-orchestration, NOT the standards. Same template checklist, same review, same observability as a planner run. (elrond)
• [status-router] planned -> executing | event=bypass_executing | bypass transition (or-bx-01)
• Fix lives at the endpoint chokepoint; Shield only learns the new paused state — Every prober benefits from evidence-gating and the paid cap without remembering to check - the same partial-copy reasoning that put the switch in the spend gate. The availability track is resolved from the task record at call time, never hardcoded, so re-tracking the task moves the billing with it. (orion)
• Known 30-minute transient accepted: pre-fix probe rows count as life-evidence once — Rows written before this change bill the serving track under the serving task and are indistinguishable from real serves; for up to 30 minutes after deploy the probe may answer from its own old evidence. Self-correcting: every new probe row carries the availability-watch task and is excluded from evidence forever after. (orion)
• [status-router] executing -> reviewing | event=bypass_reviewing | bypass transition (or-bx-01)
• [status-router] reviewing -> closed | event=operator_signoff | Auto-accepted (CAROL-INI-1859): Orion-initiated, >2 days in reviewing with no objection. (el-srac-01)

✅Success criteria

• A probe made while Carols lane served successfully within the last 30 minutes answers ok from that evidence with no model call and no new cost row (must_have)
• When the lane is idle the paid probe fires at most once per 30 minutes regardless of prober cadence; between probes the cached verdict is served (must_have)
• A paid probes ledger row names the availability-watch task and its track, never Carols Serving Engine; the track is resolved from the task record at call time (must_have)
• A spend-gate refusal returns a distinct paused status; Shield records paused - never down - attempts no restart and files no initiative for it (must_have)
• A regression test proves all four behaviours with the model call replaced (must_have)