Everything I could decide myself is decided. What's left needs
you. Each one carries the recommendation of the session that raised it — if you
agree, pick it and press Done. A model's opinion, where there is one, appears on the card
as a receipt line; cards with no receipt were never put to a model. "I'm not sure" is a real answer and becomes work for me.
You don't need to open the session — pressing Done sends your answer back and it picks up.
1org_ws_mirror_test (the 'sanctioned mirror' org the Western Slope guest-card-replay harness writes to in propflow-prod, seeded by scripts/email-stress/guest-card-replay/mirror-roster.ts) holds a Person row (pers_78fd46c1...) with a real-shaped, unregistered phone (+12533419897, not in config/phone-registry.json), a real yahoo.com email, real name 'Michael Pate', and AppFolio guest-card content (westernslopepm guest_card ids), sourced 'backfill'/'appfolio_sync' — none of it rewritten to the ADR-0097/0110 +1000-NPA / @example.test convention that every OTHER mirror pipeline (the stage anon-backfill) uses. A real Tour + Outlook calendar sync exist for this person on the mirror property (ws-mirror-appfolio-399, isTest=true, capabilityStage.leasing='live'), and claraEngagedAt shows Clara already processed this inquiry. The org has a connected mailbox (clara@PROPFLOWTECHNOLOGIESINC.onmicrosoft.com) capable of emailing this real address. The triggering Sentry alert (JAVASCRIPT-NEXTJS-1AS, fatal, count=1) only fired because the mirror property has no outbound SMS line configured — that gap is what stopped an SMS tour reminder from going out to this real phone number; it was not a deliberate safeguard.
In plain terms. A tour-reminder alert led to a real person's real name, phone number, and email turning up inside one of our test sandboxes, unscrubbed — should we pull that real contact info out and lock down the test pipeline that put it there, or is this expected and safe to leave as-is?
The session raising this recommends: Scrub it now The org's name and isTest flag imply anonymized/synthetic data, but this record is real backfilled PII with an active leasing capability and a live mailbox attachment — the only thing that stopped an outbound send to a real stranger was a missing phone number, which is an accident, not a control. Tried first, unsuccessfully: Traced the alert from the Sentry issue to the Tour row to the Person/IdentityClaim rows in propflow-prod, confirmed the phone isn't a registered tester line, checked ADR-0097's anonymization pipeline (targets propflow-stage only, remaps phones to +1000-NPA and emails to @example.test) and confirmed org_ws_mirror_test's guest-card-replay seeding pipeline is a separate, unrelated mechanism that does not apply that scrub. Checked for an existing open decision on this — none; a resolved 21-day-old one (b87272322) covered a different, already-closed stage PII finding.