📖About

Found while proving CAROL-INI-3873 (b) on a live turn, and PRE-EXISTING: the same probe refuses identically on the pre-change code, so this is not caused by the engine convergence. No tool call means no receipt; gate_reply refuses ANY reply without one, so the user gets 'I couldn't verify an action receipt' while the drafted answer was correct and sitting right there (live probe: she drafted 'Themis owns the Audit and Compliance service.' and the user would have received the refusal). Her lane resolves to claude/claude-fable-5, so this is not the 3860 text-only-lane case that was already cured for the engine's employee path — the same cure (contract carried in the prompt, parsed and run through the SAME executor) is the likely shape here. Refusal rows exist in her web store (latest 2026-08-10) and the org store (11 rows, latest 2026-08-14), so this is reaching real conversations. Establish first HOW OFTEN a real WhatsApp turn refuses — measure before fixing.

⚖️Decisions

• Elrond's bypass methodology checklist (a reminder, not a gate -- you've got this): 0. File it requested_mode='bypass' (planner-vs-bypass is a deliberate choice). bypass_start REFUSES a non-bypass initiative (CAROL-INI-1846), and the dispatcher only skips the bypass lane when the mode says bypass -- a 'planner' mistag lets Merlin's pipeline grab the placeholder step and block your finished work. 1. Filed as planned status -- let the bypass claim/activate it; never file active. 2. Open the bypass (bypass_start) with your droid id + the remediation answer (remediates_initiative_id=NNN, or remediates_nothing=True). 3. Work the blocks for your work-type: template -> design -> code -> test -> review. Do the real work; record decisions on the initiative as you make them. 4. Reality is recorded for you at close -- code (files changed), each decision, and the twin-review verdict become real activities tied to this initiative and show in the Activity Tracker like a planner run (CAROL-INI-1840). No dummy rows. 5. Keep the initiative status moving; it parks in 'reviewing' and is tagged uat-pending for you at close (CAROL-INI-1836), so the stuck-watchdog leaves it alone until UAT. 6. Close runs the gates (design/architecture compliance + caller-audit). If a gate flags something pre-existing or unrelated to your change, waive it with a clear written rationale -- audit, don't skip. 7. Bypass skips the planner's auto-orchestration, NOT the standards. Same template checklist, same review, same observability as a planner run. (elrond)
• [status-router] planned -> executing | event=bypass_executing | bypass transition (or-bx-01)
• FINDING (Ninad, 2026-08-16), NOTED NOT FILED at his instruction: the estate abstracts WHICH MODEL a lane uses but not WHAT THAT LANE CAN DO, so a lane switch changes capability silently. The adapter layer (CAROL-INI-3369) makes swapping a provider a config change with no caller edit — for model NAMES. Capabilities that genuinely differ between lanes carry no contract at all: forcing a tool call, tool use at all, JSON output mode, image input, context size. Carol is the proof: her lane could not force the commit call, she lost every receipt from 2026-07-30, and nothing anywhere noticed for seventeen days. The shape of the cure: every lane declares its capabilities, every feature declares what it requires, and a switch that breaks a requirement is REFUSED or visibly degraded rather than quietly dropping the feature. CAROL-INI-3882 builds exactly ONE such declaration (can_force_tool_call) for ONE boundary; the general contract is separate work, deliberately not filed yet. — Ninad asked whether agents are effectively stuck with a well-tested model. Answer: not stuck, but switching is UNVERIFIED, which is worse because it fails silently. Recorded here so the finding survives the session without pre-empting his decision to file. (orion)
• OPEN DECISION for the operator: the claude adapter carries a guard (CAROL-INI-3523) meant to refuse an action turn on a lane that cannot enforce a mandatory tool call. It reads tool_choice from a keyword argument, while every real caller nests it inside the tools envelope, so the condition can never be true — proven by signature: the adapter's call() takes tools as a NAMED parameter, so kwargs is empty for that key. Its own regression (test_ini3523) passes tool_choice as a kwarg, the one shape no caller uses, which is how it stayed green throughout. The adapter is root-owned protected core, so fixing it needs a core install via Radagast with operator approval. NOT taken in this bypass: the creed says avoid a core install when an unprotected chokepoint will do, and both real callers now consult the capability before forcing a call. test_ini3882 adds a codebase-wide check that turns red if any future caller forces a tool call without asking. The guard itself remains decorative until Ninad rules. — Reported to Ninad in session CLI-271; he has not yet ruled on spending a core install. Recorded so the hole is on the record rather than in a handover only. (orion)
• [delivery-check] 4 pending must-have criteria stamped met at bypass_end on live re-performance evidence (CAROL-INI-3020): test test_ini3882.py: PASS (13 passed in 0.97s) (orion)
• [status-router] executing -> reviewing | event=bypass_reviewing | bypass transition (or-bx-01)
• The initiative row's actual_cost_usd was left None by the close. NOT written by hand, because that field is demonstrably unreliable rather than merely empty: across the bypasses closed in the last day it is either None (3878, 3880, 3881, this one) or exactly 0.56 (3877, 3883, 3887, 3888, 3890) — an identical figure on five different initiatives of very different sizes is a constant, not a measurement. Writing a true number into a field whose other values are a placeholder would make this row incomparable in a new way. The real figure is recorded here instead, and the field's behaviour is raised as a finding. — Ninad's standing concern is that recorded cost equals charged cost. A close-time sync that lands a constant on some initiatives and nothing on others fails that on both counts, and it is not this initiative's scope to fix. Reported to him in session CLI-271. (orion)
• [status-router] reviewing -> closed | event=operator_signoff | Auto-accepted (CAROL-INI-1859): Orion-initiated, >2 days in reviewing with no objection. (el-srac-01)

✅Success criteria

• Measured: how many of Carol's recent real turns ended in the receipt refusal, from the record rather than from a guess (must_have)
• Her commit tool fires on her own lane, or the contract is carried and executed the way CAROL-INI-3860 does it for employee turns (must_have)
• A correct drafted answer is never replaced by the receipt refusal, and an unbacked success claim is still refused (must_have)
• A regression test proves both halves on a live-shaped turn (must_have)