Decision — who is allowed to decide what happens to a tour?
Shipped — Option B · merged 2026-10-22 (PR #21991: old reply handler, mode switch, property field and arm row deleted; 2,156 of 2,156 real replies identical before the delete) · decided 2026-10-22 · proposed 2026-08-15 · Follows the Aug 15 RCA. Raised by Fede: "this seems like the wrong architecture."
Shipped 2026-10-22 — one decider, no switch (PR #21991)
Option B is decided and built. The old yes/no/cancel handler is deleted in the last pull request of the chain, which merges after the harness and gauntlet; from then every company runs one tour decider, with no setting or switch to choose another. Before deleting it we replayed every real text and email reply since Aug 16 through both deciders, carried over the three fixes that had only landed in the old one, and confirmed the decider matches it everywhere except one deliberate extra: after a confirm it also tells Clara the booked time.
| Measured on every real reply since Aug 16 | Result |
|---|
| Text and email replies replayed (JP&Co, Situs, Western Slope, Fairhaven, test property) | 2,156 |
| Different result from the old handler, unexplained | 0 |
| Different only in the label naming which decider wrote the tour history (label now removed) | 28 cancels |
| Confirms by either decider in production since Aug 16 (where the booked-time extra applies) | 0 |
| Replay agrees with what production recorded | 2,151 |
| Explained by a rule added after the reply arrived | 3 |
| Disagrees (reviewed, no reliable answer: classifier ambiguity) | 2 |
| With the old handler deleted (final PR's code): same result as before, reply for reply | 2,156 of 2,156 |
| Real-classifier gauntlet, graded scenarios producing the expected action | 19 of 19 |
Not covered: voice replies (4,260) never reach either decider. Camellia replies from Aug 16–24 have no reliable record of which decider was live. Harness: PR #21829; gauntlet: PR #21847.
The problem in three sentences (Aug 15)
When a customer texts "I need to cancel my tour," three different pieces of software are each allowed to act on it: an old yes/no/cancel handler from the original phone-confirmation flow (runs first, speaks an old dialect), the modern tour pipeline (speaks the modern dialect), and Clara herself via her booking tools. All writes already funnel through one chokepoint (ADR-0106) — the database side is sound. What's triplicated is the deciding and the narrating: two dialects of "here's what I already did," and machinery that only understands one of them. That dialect gap is exactly how Ciara's correct cancellation acknowledgment got guard-blocked on Aug 15, five days after the gap was written down as a known follow-up.
Already in flight (no decision needed)
- Tourniquet: one-field fix (legacy handler emits the modern action vocabulary) + an exhaustive contract test suite over deciders × actions × channels — PR in progress. Makes the three-decider world honest and tested, whatever is decided below.
The decision — pick one
| Option | What changes | Risk | Effort |
|---|
| A | Stop at the tourniquet. Keep three deciders; the contract suite is the permanent guarantee. | Nothing beyond the in-flight PR. | Sediment stays; every future feature must remember three interpreters exist. The next "five days later" is a matter of time. | 0 |
| B ★ | Retire the old handler. The modern tour pipeline absorbs the yes/no/cancel duty (it already interprets propose/confirm/reschedule); the legacy handler is deleted. Two actors remain — pipeline before Clara's turn, Clara's tools during it — both emitting the same completed-action events. | One pre-agent interpreter, one dialect. The contract suite (built this week) becomes its regression net; the Ciara and Aug-10 replay fixtures prove parity before cutover. | The legacy handler's quirks (proposed-tour vs any-active-tour lookup, its intent classifier) must be reproduced or consciously dropped — the parity replay covers this. | Days. Shadow the pipeline's verdict against the legacy handler's on real traffic before flipping. |
| C | Full event-sourced turn context. Every actor (pipeline, tools, dispatcher rungs, Temporal timers) writes typed events to one ledger; Clara's turn context is rendered only from the ledger. | The most principled shape; guards/grounding read one stream. | Big refactor across the router, conversation-manager, and Temporal; weeks of migration risk for a benefit B mostly captures. | Weeks. |
Recommendation: B. A is a bet that discipline outlasts sediment (Aug 15 is the counter-evidence). C is the right end-state but B captures most of its value at a tenth of the risk, and nothing in B forecloses C later. Sequence: contract suite lands (in flight) → pipeline learns yes/no/cancel behind a shadow comparison → parity proven on ≥30 days of replayed real traffic (the RCA's own gate) → legacy handler deleted.
Process rule that rides along (yes/no)
The Aug 10 session named the third decider and deferred it in prose; the prose evaporated. Rule: a "flagged as follow-up" in any PR body or session note must become a Trello card before the PR merges — the merge checklist asks for the card link.