I'm parked on you

Pick an option on each card and press Done; your answer goes straight back to the session. The raiser's pick is marked. "I'm not sure" and "Take it to the engineering bridge" are real answers.

1

In plain terms. Every safety check we merged today is sitting switched off, because this machine can no longer pick up changes to its own agent settings — who should own fixing that? A plan for it was written on 2026-09-17 and has been waiting for an owner ever since; in that time the gap has grown from 19 unmerged local changes to 103, and the one file in the way is the review service's own code, which is running live right now.
The full question, as raised

guard-bash rule 32 (gera-propflow/dotclaude#231) merged at 733269d after four Codex rounds, with both-ways evidence and an 8,117-command replay (245 denied, 3.0%). It is NOT installed: ~/.claude/hooks/guard-prod-script.py does not exist and the live guard-bash.sh has 0 references to rule 32 (control: rule 31 has 5). update-dotclaude.py exits 1 and applies nothing — ~/.claude is 103 local-only / 7 upstream-only commits, conflicting in services/review-webhook/listener.js (local dirty diff 552+/344-, executed live by com.propflow.review-webhook). EVERY dotclaude guard merged today is in the same state. ~/.claude/jobs/runtime-update/reconciliation-plan-20260917.md already rules the approach: owner-controlled cutover, a concrete 6-step sequence, no git reset --hard / clean / blind stash / Agent Smith script against ~/.claude, and line 84 says 'the driver has been asked to record a distinct reconciliation owner and obtain that owner's acceptance'. That owner was never recorded. Decider f179119c5: both passes chose 'a human with authority reconciles, then the updater runs'; it also rejects a second competing puller (plan line 78) and shows the narrow-apply option is already what the updater does — the block is that no conflict-free merge exists.

Why, and what was tried
The session raising this recommends: The review service's owner reconciles it
The single blocking file is the review-webhook listener, and the 2026-09-17 plan says its replacement and restart need the active review service owner — so that person is the gate whichever route is chosen. I am deliberately not naming them: I should not guess who owns a live service. Option 3 is my second choice and is viable — the plan's six steps are concrete, and it explicitly forbids the dangerous shortcuts (no git reset --hard, no clean, no blind stash, not the Agent Smith script) — but it still needs that same owner's decisions on ten uncommitted source edits, so it does not remove the dependency. Option 4 is the one I would argue against: it leaves every session believing a guard protects it when none does, which is the same reads-as-present-but-absent failure this whole task has been chasing, and it silently voids the ruling that commissioned rule 32. NOTE: the decider escalated this although both its passes agreed, on a keyword match for the word 'commit' (as in a git commit). The escalation is right in substance, since assigning an owner is a commitment to a person, but the trigger was incidental.
Model receiptFABLE was asked, and escalated. Receipt f179119c5 — NEEDS HUMAN.
Both passes agreed on 'A human with authority reconciles the conflicting commit, then the updater runs', and it is being escalated anyway: this question turns on money or a commitment to a person (matched 'commit'), which is not a model's to settle however confident it sounds.

Paid for on 2026-08-07: the unit-607 renewal rate came back RESOLVED from both passes at high confidence and was wrong — Fable found the standup ruling about the move-in SPECIAL and missed the correction posted 2h21m later saying she had actually asked about the RATE.

The reasoning, which is still worth reading before…

25803c87 (adopted from 1f65635c) is parked on this.

2

In plain terms. Every night a health check reads our whole customer database - 3.8 million rows, nine and a half minutes - and it is the only thing that would notice a deleted company reappearing or a person linked to the wrong company. Running that sweep weekly instead of nightly saves real money, but means a problem like that could sit unnoticed for up to a week instead of a day: do you want it weekly?
The full question, as raised

Move the org-invariant full-table sweep from nightly to weekly? It reads all 3.8M rows for 9.5 minutes daily (~10.9 RCU/s of a 285 average that must reach under 150). It is the only check answering org_default resurrection plus the per-Person org map, and no cheaper index can answer it (verified: 20 of 20 GSIs, none keyed on organizationId, every other index projects ALL). Built and test-proven; nothing opened as a PR yet.

Why, and what was tried
The session raising this recommends: Yes - move the full sweep to weekly, cheap checks stay nightly
What you are signing is a risk appetite, which is why it is yours. IN FAVOUR: stops reading 3.8 million rows nightly, the five cheap checks still run and still alert every night, and on a skipped day the report says the sweep was NOT checked rather than showing a clean zero nobody measured. AGAINST: a deleted company reappearing, or a broken person-to-company link, could go unnoticed up to a week. THE ALTERNATIVES ARE WORSE and we priced them: a dedicated index needs an AWS quota increase or deleting one of our 20 live indexes, plus a backfill and a cost on every future write, for a once-a-day check; and a cheaper partial check cannot work, because what we look for is a row CHANGING INTO the bad state, exactly what a new-rows-only check misses. NOT IN OUR FAVOUR: this alone does NOT reach the read target - the quiet floor is already 149.8 against 150, so any day the sweep runs will likely still measure over. The rest must come from the safety check you are deciding separately plus the one-off scripts our own sessions run. ALSO: the session that built it flagged that both daylight-saving changes fall on its chosen sweep day, which could silently make it 14 days twice a year; I am having that designed out so it self-heals after any missed run rather than asking you to sign a promise that breaks twice a year. Nothing is a pull request yet, deliberately - a finished PR with a clean review merges itself here, so I am asking BEFORE loading that gate.
Tried first, unsuccessfully: Decider receipt fcdff99e2 (fable-decide, RESOLVED via Fable, held under reversal, medium/high) settled the ENGINEERING: weekly sweep, daily keeps the bounded invariants, reusing the unavailable status so a skipped day never reads as a confirmed zero. It ruled out the high-water-mark bound (org_default is a resurrection check, so a row mutated into it is the primary case such a bound misses) and the sparse GSI (20 of 20 GSIs, the AWS default quota). I am NOT overriding that ruling - I agree with it and the code is built to it. I am raising the part the ruling itself named as the founder act: the cadence change is a risk-appetite decision. blocked refused --fable-receipt because that receipt says RESOLVED not NEEDS HUMAN; this is the separate human half, not a re-ask of settled engineering.

25803c87 (adopted from 1f65635c) is parked on this.

Answered and withdrawn (1)
Pick an option above, then press Done.
PropFlow Docs