Clara as Coworker — Release Hub

The transfer works: Clara reliably dials Camellia's office line. The problem: nobody answers 6 of 14 transfers since Sept 8, and the email that follows often drops who called and why. Not caused by Western Slope or portfolio/org work — ruled out.

1. Caller identity keeps flickering off — PROVEN. AppFolio holds two numbers per resident: old on guest card, new on tenant record. Every 5-min sync tick, the guest-card writer retires the tenant writer's number instead of demoting it, then re-adds it — introduced by PR #7463 (9/9). One person affected, all 72 properties; 3 calls lost recognition; still running as of 16:41 UTC today. Reachable 7 of every 300 seconds. Fix: one function demotes instead of retires. Pending Fede's word.
2. A word-count filter swallows short, real asks. A rule meant to catch a closing "thank you" got reused to judge intent — short answers like "key pickup" read as "no reason," while a robocall's long script sails through. Damaged 3 of 6 emails.
3. Move-in status set "active" too early — WITHDRAWN. Jordan M.'s lease shows a 9/16 move-in date, the day he called; the key-pickup gate reads that field, so the funnel would have passed him — identity was the only blocker. Real gaps found instead: 5 approved Camellia applicants have no tenancy record (no unit, dates, or phone key-pickup); a 9/18 move-in can book keys by text but not phone; "under application review" isn't a system state. Willows harness in progress; pending Fede's word.
4. Robocalls get transferred and paged like real callers, the robot's menu prompt logged as the reason. Sized: 6 in six weeks vs. 180 real calls; one cost an office page. Phrase detection caught all 6, zero real callers flagged; repeat-caller and no-name signals are unusable (125, 56 false positives). Decision: not built today (Fede, 9/16).
5. The office itself isn't answering — 6 of 14 transfers since 9/8 reached nobody. That's an operations fact, not a software bug, but it's what makes every issue above visible.

• Transfer tool, dialed number, and feature switch — all correct at Camellia
• Email routing and delivery — right inbox every time, all 6 delivered, zero bounces
• Message-taking (non-transfer path) — got Jordan M.'s name, unit, and reason right a day before the bad email

Fede reviewed every change this session put live at Camellia beyond the autonomous switch itself. Outcome, Sept 7 evening (UTC):

Kept

• Camellia answers on its own; when Clara cannot answer, one note goes to the office inbox. Live since Sept 7 02:24 UTC.
• After hours, callers hear the office is closed and Clara takes the question; nobody is transferred into an empty office. Global, every property.
• Clara never names a time for a callback.
• Two cross-property leaks closed: a caller is only matched against this property's records, and Clara never reads another property's open question aloud.
• The office counts as closed on US federal holidays; emergencies still reach the emergency line on any day.
• A transfer nobody answered is reported to the office right away, not six minutes later (proven by tests; no live call yet).
• The office note quotes the caller's question and shows the number once; test notes no longer page the team.

Changed on Fede's word

• The "I'm on it, I've got your question with the team, you'll get a text" opening is deleted for every property, even when a question is open. Clara may still use natural context ("are you calling about your tour?") and answers if asked for an update. A teammate who took a thread over still keeps Clara quiet on it.
• Clara says "the property team", never "leasing" or "maintenance"; the desk label on the office note is gone; the topic classifier behind the desk label was deleted outright.
• Holidays widened from six to all eleven federal holidays.
• The hand-off mode card was removed from the property page (the setting itself stays, code-only).

Undone (reverted, not requested by Fede)

• Vendor callers asked which job (reverted).
• Vendor call update naming the job the caller confirmed (reverted).
• Date-as-name guard (reverted).
• Email intake changes (closed unmerged). Merge-guard tightening (closed unmerged). Tour-note backstop (closed unmerged).

Standing rule: Nothing merges to Camellia's live paths without Fede's word on that specific change. QA passes report; they do not fix.

Evidence: merged #7296 43f5574bd9, #7298 a9ba8eadd8, #7303 c7410790e4, #7305 c4a295b89e, #7306 5416e27b92, #7307 1f5e50df07; closed #7279 #7292 #7293 #7262 #7276

1. Answer what she knows from Camellia's notes. No holding lines, no "checking with the team," no promised times.
2. When she can't answer, say so once and route by common sense: on a call in office hours, offer to connect the caller to the team; after hours, "the office is closed, I'll leave the team a note with your number and your question"; on text or email, "I'll let the leasing team know" (plus the office phone and hours if it's urgent and they're on file); a prospect who hasn't toured gets "the leasing team can go over that at your tour, want me to book one?"
3. The team gets one plain note per person per day, in the missed-call shape: who, what they asked in their own words, how to reach them, and "call back" when the person asked for a call. No reminders, no alarms, no follow-up nagging.
4. A transfer nobody answered still sends that note, and the call stays open instead of being marked resolved. (This was the root cause of a safety complaint sitting unseen for 28 days.)
5. If the team doesn't act, that is visible, not hidden: the conversations screen shows how long each person has waited, and a weekly scorecard reports "told and nobody answered."

• One per-property switch decides coworker vs autonomous. Every property is coworker today; the switch is absent everywhere, so nothing behaves differently yet.
• Under autonomous: no tracked questions, no reminder ladder, no promise alarms, no holds, no holding-line template. Promises Clara would have made are rewritten into the deferral line instead.
• The deferral wording by channel and hours (your Sept 6 corrections applied: never "reach the office," never "when they call you back").
• "Say it once per thread" for the deferral, and the same rule for maintenance requests, with emergencies carved out.
• The old escalation email with the full conversation pasted in is deleted outright. One concise email shape remains for every property. Merged and live for every property as of Sept 6 evening: leads with the newest question instead of the oldest.
• Promise alarms: one composer instead of three, with an off switch. Double-sent team emails: fixed for two of the four cases found.
• Fair-housing check: verdict and reason stored on the message; under autonomous it alerts instead of blocking and does not block on a timeout. Coworker properties keep the blocking behaviour.
• A failed transfer no longer marks the call resolved at any property (correctness fix, live everywhere once deployed).
• Phone calls: the phone prompt gets a per-property hand-off policy slot. Camellia's phone prompt is frozen until a hand-triggered upload step. In review.
• Weekly live scorecard on real Camellia traffic, Mondays. Merged; first run next Monday.
• The rule that held some changes for Fede's merge press is removed. A session that has read the full change merges it.
• The staff reminder ladder behind a handed-off question now stops at a property in autonomous mode. The first notice still goes out everywhere; only the repeat chases stop.
• Phone hand-offs under autonomous: the closed-office sentence now matches the rule, the thread stops being marked as a human's once the team note is delivered, a tour deferral sends the team note, all notes go to one inbox (the escalation owner, office inbox as fallback), and the Willows renewal phone prompt is back in the automatic upload.

Replay of past Camellia conversations through the code Camellia runs now (Sept 7 midday), five runs each side, today's behaviour versus autonomous. Since this morning the grader also reads the note the office receives.

Counts: promises with nothing behind them 6 to 0; holding lines 8 to 0; replies the person received 12 to 15; notes to the office 8 and 8. The three rows that looked worse at midday were a grading mistake: the grader counted a correct 'I'll let the leasing team know' as an answer. With that fixed, and the note now naming the desk that owns the ask in its subject and first line, every row is clean on three runs. One real wording defect remains in the decision deck (a pet-fee question answered fully and still followed by the deferral line) and is being fixed with the deck as the measurement. A wider run over all 439 replayable text and email turns is running overnight. Phone calls, 89% of the history, cannot be replayed this way; they are checked with real robot calls instead.

Live Camellia, last 7 days, today's build: 3 of 7 text or email hand-offs left the person hanging; 15 of 28 promises had nothing behind them; 5 stale re-pages to the team. That is the baseline the weekly scorecard will track after the flip.

• No more "Fede presses merge." The rule that held admin-page and scheduled-job changes for a human press is removed. A session that has read the full diff merges them itself. Both held changes are being merged now.
• Deck picks: the recommended option on every card is taken as the pick. Any card can be overridden later.
• The ten waiting people: nobody answers them by hand. The open asks are deleted in the drain.
• Camellia gets leasing plus maintenance, as built.

Still open, low stakes, defaults applied unless Fede says otherwise: D9 drop the "on the way" and "arrived" tour pings (default: drop); D10 fold paperwork reminders into one daily digest (default: yes); D5 dedupe promise alarms (default: yes); D3 fair-housing timeout at coworker properties (default: leave blocking).

1. Code: done. All follow-ups are merged.
2. Live check at the Willows test property: first pass done Sept 6 evening (after-hours legs only, it was Sunday). Text and email: pass, right sentence, one team note each. Un-toured prospect: right behaviour, but no team note went out. Both phone legs: no transfer, message taken, one note each, but Clara improvised her wording, promised a callback, and left the thread marked as a human's. Also: text and phone notes went to two different inboxes, and one of the six phone prompts was excluded from the prompt upload. Nothing was tracked, held, or alarmed on any leg. All five fixes are merged, all dark. The phone problem turned out to be a standing 'office is closed' instruction at the top of every phone prompt that told Clara to say 'someone on the team will get back to you'; that sentence is replaced. The office-hours legs (offer to connect, transfer) and a re-run of the phone legs happen Monday morning at 9am Mountain.
3. Camellia's escalation contact — Done Sept 7
4. Drain — Done Sept 7
5. Your go — Done Sept 7
6. Phone script: deployed automatically on merge, Sept 7. Manual uploads are blocked at the keyboard, in the build, and at push.
7. First Monday scorecard after the flip is the check that it worked.

Quiet test at Camellia, Sept 7 night

• Text legs: 5 run, nothing reached the Camellia inbox, no reminders/alarms/holds created; passes on answerable question, say-once, un-toured prospect.
• Phone legs: FAILED and stopped after two calls. A returning-caller greeting promised a text before the caller spoke, and a caller recognised as a vendor was transferred to the real office line after hours (nobody answered; a robot voicemail was left). No team note went out on either call, and the closed-office sentence was never reached. Phone fixes, all merged Sept 7 early morning: a caller recognised as a vendor is no longer transferred when the office is closed (this was two contradictory standing orders in one script; the vendor rule won); the returning-caller greeting no longer promises a text and only speaks about a question from the property being called; vendor recognition, names and jobs are scoped to the property's own customer; a transfer that ends in voicemail sends the team note when the office is closed or nobody works that mailbox; and deleting a conversation now removes every row under it. None of these changed the phone wording. A bench run at the Willows then found three defects in the message-taking phone agent itself: it never says the office is closed, sometimes hangs up instead of taking the message, and files notes without a callback number. All of that is now merged too. A transfer that ends without a person always sends the team note, any hour, either mode. The message-taking phone agent now takes the message instead of hanging up, always captures a callback number (using the caller's own number if they decline), and no longer implies a follow-up. Measured on the live agents, five runs each: hang-ups went from every run to none; notes carrying the question and a number from one in five to five in five; the closed-office sentence from never to three in five on the note desk and five in five on the maintenance desk, so that sentence is still not fully reliable. Real robot calls at the Willows test property at 1:40am Denver: three calls, three notes with the question and a number, no transfer even on the vendor leg, no promise. A third round tightened the wording: the closed-office sentence now lives in one place in the phone script; the generic 'sure, I can get you someone' is banned and the closed-office sentence comes first; the vendor post-call email names the job the caller confirmed, never Clara's first guess, and a correction can only change the email and a note, never a date or a truck. Measured on the live agents: the closed-office sentence on the note desk is seventeen in twenty, notes carry the question and a number five in five, no hang-ups. One regression was caused and partly recovered: the first agent must hand a question to the desk that owns it before taking a message; measured again before touching it, it was already thirty-nine in forty. A cleanup shipped anyway, left a dangling pointer in the phone script, and took it to zero in twenty on the live agents for thirteen minutes at 3:48am Denver with no calls in the window; it was reverted and re-measured at four in five. Prompt tuning stopped there for the night. Next check: Monday 9am Mountain, office-hours legs at the Willows. The text bench and the live audio agent do not fully agree, so the remaining numbers are from the live agents.
• Text-side fixes: all merged and live. The team note now quotes the person's question and shows their number once (root cause: the note was composed after the turn, from a store that only exists during the turn). One function now answers 'is the office closed today, and why' on the property's own clock; it also caught that Labor Day itself was reading as open. Offices count as closed on the six major holidays only by default. A repair question from an unknown number now names the maintenance team. The quality grader no longer pages a teammate when the team note was staged and delivered after the turn.

Full pass at the Willows, Sept 7 morning

Thirteen legs on the exact code Camellia runs. Labor Day made the office closed all day, so the transfer legs ran under a one-day override. Nine passed: answerable text answered from file with no hand-off; unanswerable text got the plain line and one note; the same question again got no repeat and no second note; a repair question from an unknown number named the maintenance team; three open-office calls got "let me connect you with someone on the team" and a real transfer attempt, with the missed-call note landing about six minutes later; three closed-office calls got the closed-office sentence word for word, no transfer, one note each with the question and a number. No tracked questions, reminders, promise alarms, holds, or threads left marked as a human's.

Two real failures: a prospect who hasn't toured got the right words but no note reached the team (second time found; being fixed at the cause), and an emailed question was dropped silently: the test mailbox filed it as junk, and the inbound sorter treated a resident's parking question as a system notification and skipped it. Whether that sorter drops real Camellia emails is being checked now.

Since then: when a vendor has more than one open job Clara asks which one instead of guessing (merged); the missed-call note after a failed transfer is sent as soon as the outcome is known (merged, with one regression caught and fixed within twenty minutes); the callback question sometimes still adds a reason, tracked.

Split at Aug 4, the day the "escalated threads get no automatic reply" rule shipped. Inbound volume was flat to up, so this is not fewer messages making worse ratios.

The worst week was Aug 24, which was also the week with the most machinery running: 11 tracked questions, 8 hand-offs, 9 holding lines (6 of them repeats to the same two people), and still 17% of people never answered. One prospect got the holding line five times in 24 hours. Before Aug 4, every unanswered thread was a "thanks, got it." After, most were live asks: a lease-term correction, a move-in date, a post-tour "I loved the place!", a direct question.

The decline actually starts a week earlier, Jul 27, when we stopped Clara from claiming hand-offs she hadn't made. She stopped over-claiming and started under-delivering in the same move: the claim was removed, nothing replaced it.

• 5 real people at Camellia are waiting with no answer right now, for 6 to 22 days: an applicant whose lease says 12 months instead of 6, an incoming resident asking about a promised parking spot, a prospect who finished an application and asked "what now," a prospect who loved the tour, and a prospect who asked for a human.
• 144 emails from Clara to the Camellia inbox in 30 days, 5 replies back, all from one person, on one day, about one issue. Zero answers ever through the reply lane that closes a tracked question.
• The owner address for Camellia hand-offs is hello@propflowai.co, our inbox, and the copy line is the same address. So every hand-off mailed us twice and the property never.
• Duplicate alarms. Two "Clara made a promise nobody is following up on" emails 0.7 seconds apart, about a promise that had already been kept three weeks earlier, from an older alert path that has no per-property switch at all.
• The one real hand-off in the Slack hold queue (a co-signer question) was addressed to our own inbox, nagged once, and swept away when the hold switch was turned off. Nobody at Camellia saw it. The answer was in Camellia's notes the whole time, wired only into the after-approval tool.
• Promises with nothing behind them: 19 in 30 days, ten of them renewal calls ending "I'll text you the details" with no text ever sent, four blocked silently by a switch that is off at Camellia.
• 35 of 73 "resolved" tracked questions were closed with no staff answer. Camellia has 912 conversations and only 14 tracked hand-off records: most hand-offs never became anything anyone could track.
• Fair housing: 2 hard blocks in 60 days, both false, both the same prospect's pet-fee reply (he mentioned a bulldog). The check is an always-on model call with no off switch that fails closed, so a timeout also blocks the send, and its reason is never stored on the message. Before Aug 30 it silently rewrote replies and left no record, so earlier false triggers are unmeasurable.
• The missed-call email, the one thing that works the way we want, is not turned on at Camellia.

RC1. The signal goes nowhere a human answers. Six delivery channels to humans, four kinds of tracked record, fifteen "doors" that page someone, and not one of them lands on a person at Camellia who replies. Slack is write-only in our code: there is no way to answer a Slack post. Replies to a hand-off email, a promise email or a missed-call note go to a dead end. Only one path can turn a human's answer into policy, and no real customer has ever used it. The loop was designed around a responsive PM and we pointed it at ourselves.

RC2. Every safety layer became the place the next real ask dies. Hold-for-review caught bad emails and also the one good one. The fair-housing check fails closed, so a slow model call blocks a pet-fee reply. The reminder ladder stops after three tries and nothing follows. "No canned acknowledgement on human-owned threads" removed the noise and installed the silence. Each layer was built for the previous incident and none owns the outcome "a person is waiting."

RC3. Point solutions instead of one owner. 26 mechanisms since March, 20 of them since Aug 4, 15 in the last four weeks. 96 code modules. The hand-off handler alone rewritten 45 times in four months. Four separate test rigs for the same loop built 11 days apart. 51 doc pages plus 187 auto-generated "parked on you" pages. Nobody, human or code, holds the whole picture, so every fix is local and every incident reads as new.

RC4. The rollout loop was too fast to learn from. Most changes shipped to Camellia from the same session that found the bug, often the same day, and were proven safe on a test bench that does not have Camellia's silent team. Four times a problem was declared fixed and reopened within days. Three mechanisms were built and turned off within a week. Docs and code disagree in both directions.

RC5. Wrong first customer for the full vision. The coworker loop only compounds when the human answers and the answer becomes policy. Camellia's team does not answer, and we have already learned most of their policies. At Camellia the loop has no fuel.

Five pull requests merged, production untouched. (1) An extractor that pulls every Camellia record into a read-only corpus outside the repo: 912 conversations, 10,572 messages, every tour, work order, promise, hold, grade and trace since April. (2) A registry of all 30 hand-off gates, 16 marked removable, with a replay-only switch that refuses to run on any production runtime. (3) A scorecard that counts today's failures from the corpus with no model calls. (4) A reproduction lane that replays the real conversations through the real code. (5) A before/after report: today's gates versus autonomous, five runs each.

The scorecard today: 8 people left hanging after a hand-off; 4 people told "we'll get back to you" more than once (10 extra sends); 6 of 10 tracked questions closed with no staff answer; 19 of 39 promises with nothing behind them; 4 duplicate team emails; 3 pages about dates already gone. Four of those numbers match the hand audit exactly.

What the before/after shows, exactly counted: with the removable gates off, promises recorded with nothing behind them went from 4 to 0, sends stopped by a safety check from 1 to 0, team emails from 6 to 5, and the person received the same number of replies (14 and 14). Nothing got worse.

What it does not show, and why it matters more. The person-facing failures barely moved: Clara still hands off or promises a callback instead of answering or deferring to the tour in about 60% of turns, gates on or off. Two findings behind that. First, on the bench a live model answers with the bench's knowledge, so the same conversation reproduces a failure one run in five and then four runs in five; rates are samples, only the exact counts are evidence. Second, the gates were never the main cause of what the person experienced. The main cause is how Clara is told to behave: hand it to the team, promise a follow-up. Removing gates stops the noise to the team; changing what the person hears is a prompt change with its own evals, and it is the next lane after the removals.

Fair housing, measured: the judge withheld and then released the identical words on the same input. That is an alert's behavior, not a gate's. It is the only gate the replay switch cannot reach today, and the next pull request splits it.

Also caught overnight: a dated renewal test guard expired and turned main red for every pull request; the renewals session confirmed the old cohort had drained and retired the guards. It had warned for fourteen days with no reader.

What now exists, merged to production, off everywhere:

• One setting per property: hand-off mode. Coworker (today, every property) or autonomous. Only a dry-run-by-default script can set it — a build check fails if any product code tries to write it.
• The fair-housing check now records its verdict, its reason, and how long it took, on every message. Under autonomous it reports instead of blocks; under coworker it is unchanged, including blocking on a timeout.

Fede's picks needed: Hand-off decision deck — fifteen real Camellia conversations, three options each for what Clara should say, one pick per card and each pick becomes an eval case.

In review, stacked and dark: the promise-alarm email gets an off switch under autonomous; tracked questions and the reminder ladder get a real off switch under autonomous (existing questions left alone); a property set to autonomous can never also be holding every email for approval.

The prompt change — Clara answers what is in the property's notes, defers the rest to the tour or callback once, never promises a follow-up, and the canned "I'll check with the team" line no longer overwrites her reply — is in its eighth review round. Every round's finding was real and none reached production.

The before/after, both halves together (Sept 5, evening)

Five runs of each arm on the real Camellia conversations, on production code with both the prompt change and the gate removals merged. Read as: how often the thing that should happen for the person writing in failed to happen.

One row went the other way and is not a regression: the check that "no gate altered an outbound" went from 7% to 47% because under autonomous the promise check deliberately rewrites a promise into the deferral. Changing that sentence is the point. The expectation is being corrected to count only alert-only gates. The prompt half measured alone had improved these numbers; the gate half measured alone had made them worse; only the combined tree answers the question.

What has to be true before Camellia is switched

• Two changes still in review, both dark: at an autonomous property Clara's hand-offs no longer mark a thread as human-owned, and the silence gate checks the property setting first, so the 27 Camellia threads currently marked that way stop silencing her. And a drain script that closes questions still open at flip time and reports them; the setter script refuses to switch a property while open questions exist unless the drain has run.
• The drain dry-run today shows what a flip would clear: 4 open questions, 7 to 17 days old, and 27 threads marked human-owned.
• Camellia's phone prompt must be uploaded by hand with the new policy slot (a separate workflow that asks for a typed confirmation); until then phone calls keep today's behaviour.
• A live check on the Willows test property first, per the rollout playbook: a text, an email, and a call through the real path, after deploy.
• Fede's explicit go.

1. Gold mine first (in progress). Every Camellia record pulled into a read-only corpus, a scorecard of today's bad behaviors (silence after hand-off, repeated holding lines, questions closed without an answer, promises with nothing behind them, duplicate team emails, stale re-pages, fair-housing false blocks) computed from data with no model calls, calibrated against Fede's 75 hand-tapped grades. One command prints today's numbers; the same command on a candidate build prints the diff. No behavior changes until this exists.
2. Then Autonomous mode at Camellia (D1), shipped off, replayed against the corpus, compared on the scorecard, then turned on with Fede's go.
3. Then the five waiting people get a human answer, by hand, this week.
4. Then the coworker loop at a client who answers (D4).

The rule, in five lines (Fede's words, Sept 6)

1. Clara handles everything she can from the property's notes.
2. Anything a human should decide: on a call in office hours she offers to connect them and transfers; after hours, or on text and email, she takes a message — "I'll let the team know."
3. Every time she takes a message or a transfer goes unanswered, the office gets one short email: who, what they asked in their words, their number, why she handed off, "call them back." One per person per day.
4. Nothing else: no promises, no reminders, no ledgers, no holds, no "checking with the team." If the office does not call back, that is on them, and it is visible.
5. A prospect's goal is the tour; anything she cannot answer for a prospect points at the tour and offers to book it.

What we found today

The decision deck

Fifteen real Camellia cases, each with what the person said, what Clara did, three options, and what the office would receive. Fede's picks become eval cases. Hand-off decision deck.

• Built and proven with a test that fails on the old code and passes on the new one — using a scrubbed copy of the real row shape, plus a two-run proof that a phone number added later lands on the same person with no duplicate created.
• Checked that this doesn't turn into unwanted outreach. Verified these applicants get no automatic message from Clara either before or after their contact details show up — this change is only about PropFlow being able to see the applicant, not about texting or emailing them.
• Merged and live: the pull request — merged and running in production at Camellia.
• No per-property switch needed. This changes what shows up inside PropFlow, not anything an applicant hears or sees, so there's nothing to turn on at a property once it ships.

• Every hand-off now leaves a paper trail. Handing a question to the team creates a tracked record. If the person asks something new while still waiting, that opens a fresh record instead of getting silently lumped in with the old one. And "resolved" now has to mean a real answer actually reached the person, or a human explicitly closed it out — a routine cleanup pass can no longer stamp something resolved just by touching the row.
• One honest status line, not silence. If the person asks the same question again while it's still parked, Clara now says, once, something like "still checking with the team on your question about <the specific thing they asked>. I'll let you know as soon as I hear back." And if Clara told someone she'd follow up, the system now actually keeps that promise true instead of quietly softening her words later to something like "I don't have that on file" — which is what was happening before.
• Reminders that don't just fizzle out. Today, after three unanswered reminders to the team, the record just sits there forever with nobody told. Now, after the third reminder, the question gets posted to the team's internal alert channel so a real person sees it. If the person writes back in the meantime, the reminder clock resets and starts over. Also fixed: the message Clara used to get back after a hand-off could claim "this is tracked with reminders" even when no reminder was actually running — it now only says that when it's true.
• A tour request doesn't get stuck behind an unrelated open question. If someone has a question parked with the team but then asks to book a tour, Clara now books it and confirms it back to them directly, using the real, saved tour details — instead of the tour request getting swallowed by the hold. This one needs both the main switch above and a second, tour-specific switch turned on together.
• The internal "what happened on this turn" screen tells the truth. When a safety check edits one line of Clara's reply and still sends it, the screen used to say "nothing went out this turn" — which was false; something did go out, just edited. It now says "Edited, then sent."

All five are proven by an 18-scenario test lane built for exactly this ("the person is never muted, only the question waits") — each scenario traces back to something Fede said or a real incident (this prospect, plus three other stuck Camellia threads, two escalations that went right, and the Aug 3 case where Clara talked over a human). With the switch off, every scenario that was passing before still passes byte-for-byte identically — this build changes nothing for anyone until it's turned on.

• Turn the main switch on for Camellia. Nothing above is on for any customer today, anywhere.
• Point Camellia's hand-offs at Camellia's real escalation address, with the PropFlow team's own address (hello@) copied — today hand-offs still go to a PropFlow address, not a real named person at Camellia.

Everything above is a night of individual fires. This is the step back: does the whole system still match what Fede actually asked for when he started this, and if not, what's the smallest change that gets it back on track — tonight, not a rebuild.

The founding rule, in Fede's own words from Aug 13: "escalate as little as possible; when we escalate, we create a policy and learn, and the next time we don't." Everything since has been read against that one sentence, plus five rulings he made along the way: never build a review queue for a person to sit and approve things (Aug 14) — engineering is the backstop, not a human clicking approve; escalate the question, not the person (Aug 20); no quiet off-switches for a real bug (Aug 23); keep this scoped to "Clara as a coworker, and keeping her word" (Aug 27); and if Clara says she'll do something, just have her do it herself, no separate tracking system needed (Aug 29). On Aug 31 he added: the goal is to reduce noise.

Roughly 18,000 lines of code, and 13 separate places in the system that can now page a human. Some of it is exactly what Fede asked for: the question-and-answer loop with a human, teaching Clara a new rule from the answer, the three-times reminder chase, holds that only cover the one topic in question, and a bake-in period Fede asked to add temporarily while trust builds. Some of it is more than he asked for, added along the way: a system that grades whether Clara kept every spoken promise (four separate pieces of which Fede has since ordered removed), a rule that a hold never expires, a hold that fires on any fair-housing-flagged staff answer, an experiment letting Clara auto-reply as a coworker (already reverted once), and text messages sent directly to callers. The fourth planned stage of this build — letting Clara actually carry out an instruction, not just answer or escalate it — was never started; Fede paused it himself on Aug 20.

Counting every bug found and fixed across the whole build, by the part of the system it lives in: the escalation-email-and-approval-gate system, 20; the keeping-your-word (promise) checker, 20; the missed-call follow-up lane, 20; the coworker-email feature, 9; the fair-housing staff-answer hold, 8; the tour-booking deadlock, 7; who a hold is even addressed to, 7; the reminder-nagging logic, 6; holds on a thread a human already took over, 5; creating a new tracked question, 4; the same person getting counted as two people, 4; and the "did they just say goodbye" detector, 3. On top of that, roughly 30 more fixes are recorded only by a one-line title, with no detail behind them to grade.

Three parts of the system — the keeping-your-word checker, the missed-call lane, and the escalation-email-and-approval-gate — each have as many or more bugs behind them as everything else put together. That is where a rebuild-versus-repair call matters most.

Not abstractions — real staff and real prospects who felt this go wrong: two staff members' own work email auto-replying to their teammates (Aug 20); a prospect left silent for 13 days on a real question; an accepted applicant left silent for 14 days with the wrong lease dates on file; a resident given the wrong door code (Aug 29); a prospect told a made-up rule that tours were closed until a date that isn't real (Aug 30); a text sent to a prospect that nobody approved (Aug 30); Fede himself getting five broken emails from Clara in one morning (Aug 31); a false "broken promise" alarm about a tour that actually went fine, still open days later; a resident's billing call mishandled (Sep 1); a hundred and six internal emails in a single week that a human was supposed to read; a tour request stuck in a dead end (Sep 3, now fixed); a promised work order that never got created (Sep 3, fix written and held); a fair-housing question mishandled and now being reviewed by hand; a safety switch found flipped on at a real property with no record of who did it or when; and a fix from earlier that morning that was never actually turned on.

Settled tonight (2026-08-31):

• Old alert emails stay on until the Camellia switch-on, then turn off in that same step — no gap where alerts reach nobody. (Camellia's team notifications now point at the real Camellia mailbox as part of the switch-on.)
• If nobody responds to a Camellia review request: it keeps holding, with reminders at 1 and 3 hours, and never auto-sends while this trial period lasts. Fede, verbatim: "never send on its own while it bakes." This matches what's already built.
• Camellia is allowed to have this "wait for a person" step, as a temporary, Camellia-only exception — it comes off once Fede trusts Clara here. The standing rule against approval queues still holds everywhere else.
• How many times Clara reminds someone about an unanswered question: up to 3 times, business days only, max once a day — same cadence as today's lease-renewal reminders. Fede, verbatim: "reminder 3 times like we do today with leases. business days only. once per day max." After the third reminder, it's marked stuck and surfaced loudly — never an endless nag.