Fede asked for this after saying we're building way too many small on/off switches. Short answer: it's a real pattern worth fixing, but the pile of switches is smaller than it feels — and none of the risky ones are even turned on anywhere yet.
Proposed — pending review · written 2026-09-29 · for Fede
On this page
Status: PRs in flight; tracker row 8 on /a/clara-platform-execution.
Fede said go on the cleanup. Wave 1 is the ten safest deletes: each switch is already on everywhere, or was never flipped, so no customer sees a change. Counts below use the code on main as of Oct 8; customer state is the Sep 30 reading.
| Bucket | Count | Meaning |
|---|---|---|
| (a) Fix-shaped, delete | 117 | 103 now, 14 after finishing the cutover. About 12 already gone. |
| (b) New capability, keep | 68 | 62 from the audit plus 6 added since. Fede turns each on. |
| (c) Unclear | 18 | Mostly parked schedules and two env values that disagree. |
| # | Switch | Read in | On / off today | Risk | PR plan |
|---|---|---|---|---|---|
| 1 | Four turn-integrity kill switches | turn-integrity-flags.ts, voice-review-gate.ts and 6 more | On everywhere | None; rollback becomes a revert | Make checks unconditional, about -250 |
| 2 | Ten AppFolio portfolio arms | pms-connection-health.ts, appfolio-sync handler and 12 more | On for all three accounts | None | Removal chain, 3 PRs, about -150 each |
| 3 | TOUR_SCHEDULE_INLINE_CDC | set-tour-schedule.ts, tour-schedule-stream-consumer.ts | Default on, unset | None | Delete env read, about -25 |
| 4 | CLARA_TRACE_CAPTURE_PROMPT | conversation-manager.ts, arms-registry.ts and 3 more | Default on, unset | None | Capture always, about -60 |
| 5 | APPFOLIO_FUTURE_ARRIVALS kill switch | future-arrivals.ts | Default on, unset | None | Remove early return, about -20 |
| 6 | SPINE_GSI_USE_SCAN / REPLICATOR_USE_SCAN | spine-gsi.ts | Unset (index path) | None; scan fallback gone | Delete branch, about -20 |
| 7 | TEMPORAL_USE_VERSIONING | renewal-worker.ts, executed-lease-fetch-workflow.ts | Unset (off) | None today | Hardcode off path, about -20 |
| 8 | Ticker self-heal (env + property) | ticker-self-heal-flag.ts, run-work-order-sync.ts and 3 more | On at 70 of 70 Western Slope homes; absent at JP&Co, Situs | Low; fixes missing tickers there | Always run, about -150 |
| 9 | PMS_SYNC_DISPATCH row | pms-connection-health.ts and 3 more | Per-connection since 09-10 | None | Keep one mode, about -100 |
| 10 | D8_PIPELINE_ARM row | kill-switch.ts, settings.ts and 6 more | Armed since 08-23 | None; rollback is a revert | Run unconditionally, about -200 |
Total: about 1,100 lines removed across 8 to 10 small PRs. Each says "fix/guard, no switch".
Wave 2 needs a replay first (a customer would see a change):
Where this disagrees with the Sep 30 audit
pmsMessagingSync.enabled row (staff texts and emails on the lead card, one robot read per home per minute, set by a script at onboarding, on at Willows only) and the company switch leasing.staffContextTimeline (card notes once per new lead, off everywhere). Not a wave-1 delete: turning them on at Western Slope is about 100,000 robot reads a day at 70 homes and Situs has a 429 history, so the end state is one per-company feed at a sane cadence with no row to press. Design page owed before anything is pressed; turn-on is Fede.<b>39 switches: 33 DELETE, 4 MERGE INTO, 2 KEEP AS SETTING.</b> Each change here is something a customer can see, so each needs its replay first. Audit and recommendations only; nothing has been changed.
Three deletions with the biggest customer effect: the dark-feature bench list (seven caller-audible voice features on for every caller), the flipped-addresses list (reroutes real calls and mail), and the tour time-window pair (every prospect gets windowed offers, off at all three customers today).
Counts use main as of Oct 9 (e171a3eee1). Customer state is the Sep 30 audit reading or code defaults; I did not read production, and "unknown" means the code does not say.
| # | Switch | Lives in | What it gates | State today | Recommendation | Risk |
|---|---|---|---|---|---|---|
| 1 | leasing.tourTimeRangesEnabled (company setting + registry key) | src/lib/domain/leasing/tour-time-ranges-switch.ts | Tour offers come as windows ("mornings 9-12") in text, email, voice and availability checks; off, plain single slots. | Off at JP&Co, Western Slope, Situs (Sep 30). Fede ruled it permanent 09-29. | DELETE Windows become the only offer. Run first: the tour-time-windows eval and its mutation controls (marked MANUAL, so it must actually be run) plus the availability-windows test. | Every prospect sees windowed offers; also removes the admin toggle and company field. |
| 2 | tourWindowMatchingEnabled (property setting + arm + TOUR_WINDOW_MATCHING env) | src/lib/domain/leasing/tour/tour-window-flag.ts | When a prospect says "Tuesday mornings", Clara narrows the days and times she offers and names the closest real time. | Off at all three customers (Sep 30); on at Willows test homes only. The old note "effectively on" is wrong. | DELETE Always on. Run first: the tour-window replay script and the availability-windows test, together with the row above. | Reply wording changes at every property ("No openings on X" becomes "Checking other times in the morning"). |
| 3 | tour.scheduleChokepoint (arm + env + property field) | src/lib/domain/leasing/tour/tour-chokepoint-flag.ts | Every tour date/time change goes through one versioned write, so reminders re-anchor on reschedule and decline; off, the old scattered writes run. | Off at every customer home (Sep 30: absent on all 124). | DELETE Always on. Run first: the chokepoint flag test plus a reschedule/decline replay checking exactly one reminder survives. | Tour rows gain a version number; stale reminders stop, but a bug here touches every booking. |
| 4 | tour.deciderMode (arm + TOUR_DECIDER_MODE env) | src/lib/domain/leasing/tour/tour-decider-flag.ts | Which code reads a prospect's reply to a tour proposal (confirm, decline, change): the old handler or the new decider. | Old handler at all three customers (Sep 30); new decider only at Willows. | DELETE New decider becomes the only path and the old handler goes. Fede rules on the cutover first (decision page exists). Run first: the decider gauntlet test and the tour-decider end-to-end replay. | True cutover: how every tour reply is understood changes. |
| 5 | tourRequestSmsEnabled (property setting) | src/lib/domain/leasing/tour/send-tour-outcome-sms.ts | Receipt text ("we asked for Tuesday 2pm, the team will confirm") when a call only REQUESTED a tour. | Off everywhere (Sep 30). | DELETE Do not just delete: replace it with a rule from the line type (request-only line sends the receipt; calendar-booking line does not). Run first: the tour-request-sms gate test and the post-call tour-request test, plus a replay showing no receipt at a calendar-booking property. | New text to callers; plain deletion would text about slots nobody holds at calendar properties. |
| 6 | SLOT_HOLD_PROPERTY_IDS (code list + config file) | src/lib/domain/leasing/tour/slot-hold-flag.ts | Claims a tour slot in the store before the calendar write, so two simultaneous bookings cannot both win. | Sandbox building only (Sep 30); off at all customers. | DELETE Always hold. Run first: the slot-hold replay script and the calendar-slot-hold ramp test. | A prospect can hear "that time just got taken" where a double booking used to slip through; adds a store write per booking. |
| 7 | lostTourSlotProspectMessage (property setting) | src/lib/temporal/activities/tour.ts | Apology text to the prospect when their booked time is gone, offering another. | Off everywhere (Sep 30). Ruled permanent 09-29. | DELETE Always send. Run first: the slot-lost prospect-notice test and the slot-lost hold test. | New send to prospects; must not fire for a company with Leasing off or a cancelled tour. |
| 8 | tourBookingBlockedTeamEmail (property setting) | src/lib/domain/leasing/tour/notify-team-of-tour-booking-blocked.ts | Email to the leasing team when Clara cannot book a tour (calendar down, hours unreadable). | Off everywhere (Sep 30). Ruled permanent 09-29. | DELETE Always send, at most once a day per cause. Run first: the tour-booking-refusal test and the company-live-gate test. | New send to staff at every property. |
| 9 | lostTourSlotTeamEmail (property setting) | src/lib/domain/leasing/tour/notify-team-of-lost-tour-slot.ts | Email to the leasing team when a booked tour's invite vanishes or the time is taken. | Off everywhere (Sep 30). Ruled permanent 09-29. | DELETE Always send, one per lost slot. Run first: the slot-lost hold test and the internal-only notice test. | New send to staff at every property. |
| 10 | renewalLapseDigestEnabled (property setting) | src/lib/domain/leasing/renewal-auto-start.ts | Daily email to the renewal contact listing leases that have lapsed. | Off at all three customers and Willows (Sep 30). Ruled permanent 09-29. | DELETE Always send (nothing goes where no contact exists). Run first: the lapse-digest test and the renewal replay for the lapse digest. | New recurring email into each property manager's inbox. |
| 11 | leasing.preferenceCapture (arm + PREFERENCE_CAPTURE env + property field) | src/lib/domain/leasing/preference-capture-flag.ts | Whether the leasing prompt carries the preference-ask rule and first-touch emails mention stated preferences. | Off at all three customers (Sep 30); on at Willows. The old note "effectively on" is wrong. | DELETE Always on. Run first: the preference-capture gate test and the preference-vs-fact eval, plus the guest-card regression. | Clara's asks and first-email wording change; low harm. |
| 12 | voice.callback (arm + VOICE_CALLBACK env + property field) | src/lib/domain/escalation/voice-callback-flag.ts | Clara phones a caller back after staff reply on an escalated voice matter; off, text only. | Off at all three customers (Sep 30); on at one Willows home. | DELETE Always on (quiet hours and once-per-matter limits stay). Run first: the voice-callback orchestration test and a real test-line callback. | New outbound phone call to real callers at every property. |
| 13 | leasing.staffContextTimeline (company field + registry key) | src/lib/domain/leasing/staff-context-timeline-switch.ts | Imports AppFolio guest-card notes and activities and shows them as staff-only rows on each thread. | Off at all three customers (Sep 30). | DELETE Blocked on the per-company feed design the Oct 8 note already owes. End state: no row to press. Run first: guest-card timeline sync test and thread staff-rows test. | Staff see card notes on every thread; the import runs on every new guest-card lead. |
| 14 | pmsMessagingSync.enabled (property row) | lambda/appfolio-sync/handler.ts | Whether the sync pulls AppFolio guest-card message threads onto the conversation (one robot read per home per minute). | On at Willows only; set by hand by a script. Others unknown (Sep 30 audit has no row). | DELETE Blocked on the same design: one per-company feed at a sane cadence, no row. Run first: sync handler test, onboarding-import message-stage test, and a read-count estimate per customer. | About 100,000 robot reads a day at 70 Western Slope homes; Situs has a 429 history. |
| 15 | guestCardWriteFromCalls (property setting) | src/lib/platform/settings-resolver.ts | Clara creates and notes the caller's AppFolio guest card after a call. | Western Slope 70 of 70 on; off at JP&Co and Situs (Sep 30). | DELETE On everywhere, org row merged in (see MERGE row). Run first: the guest-card regression skill over captured cards at all three customers, plus the guest-card create-intent test. | AppFolio cards cannot be deleted, so a wrong write is permanent; Situs has a 429 history. |
| 16 | guestCardWriteFromTexts (property setting) | src/lib/domain/pms/guest-card-text-note.ts | Each text Clara sends a carded prospect is also noted on the AppFolio card. | Off on all Western Slope homes, JP&Co, Situs (Sep 30). | DELETE Always note. Run first: the text-note test and the guest-card regression. | Staff see a note per text; more AppFolio writes. |
| 17 | vendor.transferFirst (arm + property field) | src/app/api/voice/personalization/route.ts | Greeting for recognized vendors calling in office hours: announces the connect to the office, then transfers. | On at one of two JP&Co homes; off at Western Slope, Situs (Sep 30). | DELETE Always on. Run first: the voice-agents context wiring test and a live listen-test through the real call path (text sims cannot judge feel). | Vendors hear a different greeting in office hours; both greetings still end in a transfer. |
| 18 | DARK_FEATURE_BENCH_IDS (code list) | src/lib/platform/security/test-property-ids.ts | Seven caller-audible dark voice features: language prior on ring, post-call guest-card contact capture, bedroom-range directive, hangup backstop, lead-outcome sweep, missed-call note, prospect lookup by phone. | On for the Yale sandbox home only (Sep 30). | DELETE Delete the condition, but one PR per feature, each with its own replay (call-integrity directive test, hangup-backstop test, and so on). | Turns seven behaviors on for every caller at every customer. |
| 19 | record_transferred_legs (registry key) | src/lib/domain/maintenance/bridge-recording.ts | Whether the far end of a transferred call (staff or call center) is recorded. | On at one Willows home; absent at all three customers (Sep 30). Unset means OFF. | DELETE Always record, covered by Fede's 09-19 "every call recorded" ruling. Run first: the bridge-recording test and one real transferred call. | Turns recording on for every transferred leg; the voice URL re-push at Twilio is a Fede-gated write. |
| 20 | external_forward.via_bridge (registry key) | src/lib/domain/voice/external-forward-bridge.ts | Forwards to an outsourced call center go through Clara's hunt line, keeping the tenant's caller ID. | Absent at all three customers (Sep 30). Unset means OFF. | DELETE Always on (it fixes the center's "press 1 for text" texting Clara). Run first: the external-forward transfer and fallback tests and a real call to the center after forwarding is on. | Calls route differently; skipped where a ring-list ticket exists on the same line, so reconcile those first. |
| 21 | call_routing.v2 (registry key) | src/lib/domain/escalation/call-routing-v2.ts | The V2 call-routing engine for emergency ring list, maintenance intake and bucket decisions. | Off at all three customers; on at Willows and Fairhaven test homes (Sep 30). | DELETE Fede rules whether V2 stands; either way the key goes. Run first: the V2 routing and emergency tests, then a real call per customer line. | Rewrite of live phone routing at every customer. |
| 22 | unmappedLineFleet staging refusal (code branch) | src/app/api/voice/personalization/route.ts | A call to a number that maps to no home: staging drops it, production adopts the caller's own home. | Staging refuses, production fails open (Sep 30). | DELETE Refuse everywhere. Run first: the unmapped-line fallback test and a real call to an unmapped test number to hear what the caller gets. | Production callers to an unmapped number get a refusal; what they hear after it is unverified. |
| 23 | flipped addresses (code list + config file) | src/lib/domain/portfolio/address-flip.ts | Whether an inbound call, mailbox delivery or outbound text finds its org and home from the address record or the old code map. | Two test lines only; off at every customer line (Sep 30 audit has no row). | DELETE Head-based routing everywhere, one line at a time with Camellia last. Run first: address-flip and dialed-number tests, then a real call and one real mail per line. | Reroutes real calls and mail; outbound texts are refused if the head is unreadable. |
| 24 | flipped dispatch orgs (code list + config file) | src/lib/domain/vendors/dispatch-flip.ts | Which vendor picker chooses the vendor on a work order: the new one or the old auto-assign. | Sandbox company only (Sep 30 audit has no row). | DELETE New picker everywhere. Run first: the dispatch-flip read-out parity replay per customer, the config file's own rule. | Changes WHICH VENDOR IS CALLED at Camellia, Western Slope and Situs. |
| 25 | handoffMode (property enum, leasing rung) | src/lib/domain/escalation/handoff-mode.ts | When Clara cannot answer: hold the thread for a human (coworker) or say so in a sentence and move on (autonomous). | Platform-wide 7 autonomous, 3 coworker, 224 unset; per customer unknown. Unset follows client stage (Sep 30). | DELETE Toward one coworker core, per Fede's 10-08 "one mode for every customer" ruling. Run first: the handoff-mode and stage tests plus a replay of held threads. | Changes whether staff get held threads or Clara answers alone. |
| 26 | PROPFLOW_ROSTER_GATE + ROSTER_REFUSE_PROPERTY_IDS (env + config list) | src/lib/platform/auth/require-in-roster.ts | Cross-company isolation: a user or home outside the org gets a 404. | Web prod = refuse; worker env unknown (Sep 30). List holds 2 test homes. | DELETE Always refuse. Run first: the in-roster armed and ramp tests, and confirm the renewal worker env first. | No change on web; any worker with it unset would start refusing. |
| 27 | WARM_CACHE_GATED_PROPERTY_IDS (code list) + paused availability refresh schedule | src/lib/domain/leasing/tour/availability-cache-gate.ts | Wider tour-day horizon on the voice prompt, real day-times answers, and the background availability refresher. | Willows only, marked TEMPORARY since 8/24; the refresh schedule has never run in production (Sep 30). | DELETE On everywhere, schedule unpaused in the same step. Run first: the availability cache gate and warm-cache tests, plus a read-load estimate for Situs. | Later tour days offered to every caller; adds AppFolio and calendar read load. |
| 28 | SPAM_FILTER_ENABLED (env) | agents/clara/lib/email/process-inbound-email.ts | Inbound email spam pre-filter and AI spam triage (lead-site and AppFolio relays exempt). | Web prod = false (filter off), mail Lambda unset (on): they disagree (Sep 30). | DELETE Always on. Run first: the spam detection tests and the Western Slope Zillow corpus replay, proving no lead is dropped. | Spam on the web ingest path starts being dropped; a false positive loses a lead. |
| 29 | ONBOARDING_IMPORT_ARM (config row per account) | src/lib/data/dynamo/onboarding-import-arm.ts | Whether connecting an AppFolio account runs the 5-stage import that creates units and leases, or only property skeletons. | Western Slope armed; no row for JP&Co or Situs (Sep 30). Unset means OFF. | DELETE Import runs at connect for every account. Run first: the onboarding-import runner test and a written Situs re-import plan; the sync pause row is then the brake. | Situs would start importing (185 of 448 units loaded) with a 429 history. |
| 30 | pmsSideEffectMode (company setting) | src/lib/domain/pms/side-effects/dispatcher.ts | Whether the new dispatcher actually writes the AppFolio assignment and outcome note after a reply, or only logs what it would write. | Shadow at JP&Co, Western Slope, Situs; apply at Willows (Sep 30). Unset means SHADOW. | DELETE Apply is the only path. Run first: compare a day of shadow logs to the inline write-back, and the dispatcher test. | Staff see new AppFolio notes; check no double write of the same note. |
| 31 | Paused recovery schedules: tour-cohort-walker, pm-action-reminder-backstop, onsite-pricing-daily, voice-injection-cache-refresh-daily, connection-health-sweep (code default) | src/lib/temporal/tour-client.ts | Hourly or daily sweeps that restart dropped tour reminders and reminder cadences, refresh scraped prices and voice context, and check connection health. | Unknown: live pause state is not in code (Sep 30 contract says four should be running). | DELETE Remove the paused-by-default option so they are simply scheduled. Run first: read the live schedule list (Fede or Gera), the tour-cohort-walker test, and a dry run listing what the walker would restart. | If paused today, unpausing may re-send reminders or texts for restarted tours. |
| 32 | appfolio-sync vendors (schedule, DISABLED) | lambda/appfolio-sync/schedules.json | Hourly sync of the AppFolio vendor directory into PropFlow. | Disabled on main (Sep 30 and now). Audit rows for work_orders and renewals are stale: both are ENABLED on main. | DELETE Delete the job, per the 09-11 ruling that the vendor list is an onboarding-time catalog. Run first: the sync-schedules drift test. | None today (already off); reversing the ruling needs Gera and Fede. |
| 33 | appfolio-sync vendor_contact (schedule, DISABLED) | lambda/appfolio-sync/schedules.json | Four-times-daily robot sweep refreshing stale vendor phone, email and owner. | Disabled; manual button only (Sep 30 and now). | DELETE Delete the job and keep the manual button, matching Gera's "for now manual only". Open question for Gera: does he want the sweep back? Run first: the sync-schedules drift test. | Stale vendor phones stay stale; enabling instead adds robot load on AppFolio. |
| 34 | GUEST_CARD_WRITE_FROM_CALLS (company config row) | src/lib/domain/pms/guest-card-write-switch.ts | The company half of the same guest-card write switch (about ten callers). | Western Slope enabled 09-18; JP&Co and Situs absent; test orgs have rows (Sep 30). | MERGE INTO guestCardWriteFromCalls on the property (row above). Run first: the guest-card regression; this one has no test of its own. | Two switches for one thing; AppFolio writes are permanent. |
| 35 | autoDraftLeaseOnApprovalEnabled (property setting) | src/lib/domain/leasing/new-lease/auto-draft-flag.ts | On approval in AppFolio, Clara drafts the lease there and emails the office. | Off at all three customers; on at one Willows home (Sep 30). | MERGE INTO newLease.pipeline: one new-lease mode. Run first: the auto-draft tests and the on-application-approved test. | Two switches for one thing; nothing goes to the applicant. |
| 36 | rentRollDataApiEnabled (property setting) | src/lib/domain/properties/rent-roll-data-api-flag.ts | Skips the emailed rent-roll attachments for a home because the PMS Data API is the source. | On at one of two JP&Co homes; off at Western Slope, Situs (Sep 30). | MERGE INTO The PMS connection record (the data source is a fact about the connection, not a switch). Run first: its flag test and a parse of one emailed rent roll. | Plain deletion would stop parsing emailed rent rolls everywhere. |
| 37 | OPERATING_MODE_ARM (config row + allowlist) | src/lib/domain/properties/operating-mode.ts | Whether Clara's autonomous pipeline works a real home's inbound lead emails; off, the email is received but not worked. | Enabled, allowlist is one bench home (Sep 30). Unset means OFF. | MERGE INTO The module mode / claraLive gatekeeper (prospects module). Not fix-shaped: deleting it turns Clara on at every real home. Run first: the operating-mode and SES lead pipeline tests. | Deleting breaks the "dark until Fede turns it on" rule. |
| 38 | newLease.autonomousSending (property setting) | src/app/api/new-lease-package-reviews/[id]/decision/route.ts | Whether approving a new-lease review sends the lease for e-signature and the congrats text, or saves a draft and holds the text. | Off at all three customers (Sep 30). | KEEP AS SETTING New customer-facing action (a binding send). Default off per property; page visibility not checked, so confirm it shows on the property page. | Turn-on is Fede's call per property. |
| 39 | human_handoff.text_on_ring (registry key) | src/lib/domain/escalation/text-on-ring.ts | The "missed call" text to the staff person being rung. | Absent at all three customers (Sep 30). Unset means OFF. | KEEP AS SETTING New staff text; Fede ruled it unreliable until the callback it promises is built. Default off; page visibility not checked. | Deleting turns on a text that promises a callback that does not work. |
Already deleted, so the Sep 30 audit rows are stale: escalated tour booking, same-thread memory ack, stated-name-wins, missed-transfer outreach, auto-link co-applicants, guest-card first-email engine, email and SMS shadow modes, the work-order cancel env, reader shadow mode, handyman quiet hours env, the old Temporal live/shadow allowlists, the renewal ladder allowlist, and the four org-level send fields (the real kill switches are global). Also corrected: the work-order and renewal sync schedules are ENABLED on main, not parked.
Wave 1's tail (removing them changes nothing a customer sees): call_recording (recordings are always kept; the key only sets a label), APPFOLIO_ENABLED, PMS_OUTAGE_ALARM, human_handoff.acceptMode (default already in force), email NTV firm routing, pmNotificationMode (nobody uses it), the all-true renewal arms row, collections halt, pmsWritesAllowedWhileTest (a test-property safety rail), and the test-only Temporal schedules.
The first five to delete, lowest risk first, each with the replay that must be clean:
Flipped addresses and flipped dispatch orgs go last: they change which line or vendor a real customer reaches. Nothing here has been changed or deleted.
Since late August, our rule has been: every behavior change ships turned off, as a switch someone can flip per company, and only Fede turns it on. That rule was meant to stop us from breaking a real client by accident. Instead it's quietly piling up small switches — each one harmless alone, but together they make it harder to tell which settings are real choices clients should control, and which ones are just leftover plumbing from how we shipped something.
We looked at every setting the app can store for a company or property. There are 99 of them. Most are exactly what they should be — real choices, like office hours or tour rules. A small group exist only so we could ship a change dark and flip it on later.
Two more rollout switches were already added and then deleted within a few days once the feature behind them was proven — a sign the pattern usually does clean up after itself, just slowly and by hand.
We checked live production data for every company. Not one of these 8 switches is turned on at a single real customer today. We looked at 5 real companies (ConAm, JP&Co, PropFlow Staff, Situs Group, Western Slope); only 3 of those actually have live properties.
| Switch | What it controls, in plain words | On anywhere? |
|---|---|---|
| New call-routing engine | Which system decides where a call goes | Off everywhere |
| Show caller's number on transfers | Whether a transferred call shows the caller's own number instead of Clara's | Off everywhere |
| Record transferred calls | Whether we keep recording after a call is handed to a person | Off everywhere |
| New vendor-dispatch flow | A new way of assigning maintenance vendors | Off everywhere |
| Street & landmark facts for Clara | Lets Clara mention nearby streets and landmarks to a prospect | Off everywhere |
| Offer specific tour times | Lets Clara offer tour time windows instead of just "does X time work" | Off everywhere |
| Clara texts the application link herself | Clara sends the apply-now link by text instead of a person doing it | Off everywhere |
| Text staff while their phone is ringing | Sends staff a text at the same moment their phone rings for a transfer | Off everywhere |
Measured by reading each company's live settings directly, read-only, 2026-09-29. Three more settings were unclear enough that we didn't force them into either bucket (a staff reminder email setting, one company's opt-in copy of client notices, and one setting for how a transfer counts as "answered") — details in the appendix.
Three ways to handle this going forward.
| Option | How it works | Trade-off |
|---|---|---|
| A — Recommended ship proven, not dark | A behavior change ships to everyone once it passes a quality check on Clara's real setup, including a planted mistake that the check must catch, plus a side-by-side replay of 20+ real past conversations showing it's actually better. If something's wrong after it ships, we undo it with GitHub's one-click revert, live again in minutes. | We can't rely on "the unit tests passed" as proof anymore — every change needs real proof it works before it goes out. That's slower per change, but nothing sits half-shipped waiting on a flip. |
| B — Switches with an expiration date | Keep shipping dark behind a switch, but every switch gets removed automatically once it's on for every company, or once 30 days pass with nobody using it. | Still creates a new switch for every change; just promises to clean them up. Depends on the cleanup actually running. |
| C — Keep today's rule | Every behavior change keeps shipping dark, per-company, until Fede turns it on. | This is the rule that caused the problem asked about in this report. |
If Fede picks A:
Fede, 2026-09-30: flags are for new experimental features we validate dark; anything that is a fix, a regression repair, a guard or an improvement to live behavior ships permanent, no switch. This re-audit counts every on/off switch in production (not just the settings registry the first pass covered) and gives each one a verdict. Inventory taken read-only against the code at commit 4f67ac92 and the production table on 2026-09-30.
Note: a 198th switch, the onboarding import arm, was found after the audit closed (Situs Group, 2026-09-30) and is added to the make-permanent table below.
testMode=true for everyone; six Vercel variables are read by nothing.| Switch | Kind | What it gates | Since | Live state | Why this verdict |
|---|---|---|---|---|---|
arms:tour.scheduleChokepoint | arms-registry | The C′ tour-scheduling chokepoint path. Inverted global: the literal `off` KILLS it everywhere; anything else leaves the per-property flag (boolean true, fail-closed) in charge. | 2026-07-21 #4274 A | property flag tourScheduleChokepointEnabled: {'JP&Co': 'absent on all 2 properties', 'WesternSlope': 'absent on all 70 properties', 'Situs': 'absent on all 52 properties', 'TEST Willows/sandbox': 'abs | Inverted env arms on leasing improvements; effectively on everywhere already. Env arms are banned by the constitution. |
arms:leasing.preferenceCapture | arms-registry | Clara's six-bucket ask taxonomy (RULE 7.2) rendering in the leasing prompt, and whether the first-touch email surfaces stated preferences. The `preferences` write on `update_prospect` itself is UNGATED as of 2026-09-21 ( | 2026-08-31 #6703 f | property flag preferenceCaptureEnabled: {'JP&Co': 'absent on all 2 properties', 'WesternSlope': 'absent on all 70 properties', 'Situs': 'absent on all 52 properties', 'TEST Willows/sandbox': '2 of 2 p | Inverted env arms on leasing improvements; effectively on everywhere already. Env arms are banned by the constitution. |
arms:tour.windowMatching | arms-registry | Change 3 of the Fabienne redesign — a prospect's stated tour window (which days, which part of those days) narrows the days AND times we offer, an impossible window names the closest real bookable time instead of recitin | 2026-08-31 #6713 T | property flag tourWindowMatchingEnabled: {'JP&Co': 'absent on all 2 properties', 'WesternSlope': 'absent on all 70 properties', 'Situs': 'absent on all 52 properties', 'TEST Willows/sandbox': 'absent | Inverted env arms on leasing improvements; effectively on everywhere already. Env arms are banned by the constitution. |
arms:voice.callback | arms-registry | Clara placing an outbound voice callback (vs. staying SMS-only relay). Inverted global: the literal `off` KILLS it everywhere; anything else leaves the per-property flag (boolean true, fail-closed) in charge. | 2026-08-19 #5904 W | property flag voiceCallbackEnabled: {'JP&Co': 'absent on all 2 properties', 'WesternSlope': 'absent on all 70 properties', 'Situs': 'absent on all 52 properties', 'TEST Willows/sandbox': '1 of 2 prope | Inverted env arms on leasing improvements; effectively on everywhere already. Env arms are banned by the constitution. |
arms:tour.deciderMode | arms-registry | Which tour-decision code path a property runs: the legacy handler (handle-tour-confirmation.ts, default) or the v2 pipeline decider (tour-decider.ts, when Property.tourDeciderMode === 'v2'). Global kill switch `TOUR_DECI | 2026-08-16 #5801 f | env TOUR_DECIDER_MODE: Vercel: unset on Vercel prod; ECS/Lambda: not set (no lambda reads it) | Inverted env arms on leasing improvements; effectively on everywhere already. Env arms are banned by the constitution. |
arms:appfolio.accountBudgetEnforce | arms-registry | Whether `AppfolioClient.requestJson` actually WAITS on the shared per-account AppFolio request budget (`AppfolioAccountBudget`) before a request, versus only observing it. Disarmed (the default), nothing waits — the sync | 2026-09-12 #7924 A | env APPFOLIO_BUDGET_ENFORCE: Vercel: unset on Vercel prod; ECS/Lambda: not set (no lambda reads it) | Rate-limit protection is a guard, not a feature. Removal PR in flight (Fede 09-30). |
arms:maintenance.tickerSelfHeal | arms-registry | The work-order sync deriving and PERSISTING a missing `Property.ticker` instead of failing the property. Disarmed (the default), a ticker-less property keeps failing every `work_orders` tick with "has no ticker — require | 2026-09-11 #7876 H | env WO_TICKER_SELF_HEAL: Vercel: unset on Vercel prod; ECS/Lambda: not set (no lambda reads it) | Fix for the missing-ticker import bug; on at 70/70 Western Slope homes already. |
registry:record_transferred_legs | company/property setting (portfolio registry key) | registry key, writable at ['property']; type boolean | 2026-09-20 #10064 | JP&Co: absent; WesternSlope: absent; Situs: absent; TEST Willows/sandbox: true (property The Willows attach row 2026-09-21); TEST Fairhaven: absent | Fede 09-19: every call recorded end to end, always. Not a setting. |
registry:external_forward.via_bridge | company/property setting (portfolio registry key) | registry key, writable at ['org', 'group', 'property']; type boolean | 2026-09-22 #10784 | JP&Co: absent; WesternSlope: absent; Situs: absent; TEST Willows/sandbox: absent; TEST Fairhaven: absent | Transfer-path fix (urgent, 09-22). Permanent. |
registry:call_recording | company/property setting (portfolio registry key) | registry key, writable at ['org']; type object | 2026-09-19 #10047 | JP&Co: absent; WesternSlope: absent; Situs: absent; TEST Willows/sandbox: absent; TEST Fairhaven: absent | Fede 09-19: every call recorded end to end, always. Not a setting. |
registry:leasing.locationFactsEnabled | company/property setting (portfolio registry key) | registry key, writable at ['org']; type boolean | 2026-09-28 #13514 | JP&Co: absent; WesternSlope: absent; Situs: absent; TEST Willows/sandbox: absent; TEST Fairhaven: absent | Improvements to what Clara knows/offers on live leasing. tourTimeRanges was already ruled permanent on the 09-29 page and is still a switch. |
registry:leasing.tourTimeRangesEnabled | company/property setting (portfolio registry key) | registry key, writable at ['org']; type boolean | 2026-09-29 #13775 | JP&Co: absent; WesternSlope: absent; Situs: absent; TEST Willows/sandbox: absent; TEST Fairhaven: absent | Improvements to what Clara knows/offers on live leasing. tourTimeRanges was already ruled permanent on the 09-29 page and is still a switch. |
registry:leasing.staffContextTimeline | company/property setting (portfolio registry key) | registry key, writable at ['org']; type boolean | 2026-09-30 #14214 | JP&Co: absent; WesternSlope: absent; Situs: absent; TEST Willows/sandbox: absent; TEST Fairhaven: absent | Improvements to what Clara knows/offers on live leasing. tourTimeRanges was already ruled permanent on the 09-29 page and is still a switch. |
org field:locationFactsEnabled (org field; also registry key leasing.l | company setting (Organization row field) | Street & landmark facts for Clara | unknown | JP&Co: absent; WesternSlope: absent; Situs: absent; TEST Willows/sandbox: absent; TEST Fairhaven: absent | Improvements to what Clara knows/offers on live leasing. tourTimeRanges was already ruled permanent on the 09-29 page and is still a switch. |
org field:tourTimeRangesEnabled (org field mirror) | company setting (Organization row field) | Tour time windows | unknown | JP&Co: absent; WesternSlope: absent; Situs: absent; TEST Willows/sandbox: absent; TEST Fairhaven: absent | Improvements to what Clara knows/offers on live leasing. tourTimeRanges was already ruled permanent on the 09-29 page and is still a switch. |
org field:staffContextTimeline (org field mirror) | company setting (Organization row field) | Guest-card timeline importer for staff context | unknown | JP&Co: absent; WesternSlope: absent; Situs: absent; TEST Willows/sandbox: absent; TEST Fairhaven: absent | Improvements to what Clara knows/offers on live leasing. tourTimeRanges was already ruled permanent on the 09-29 page and is still a switch. |
settings.cadenceEndMarksGuestCardInactive | company setting (Organization.settings) | Mark guest card inactive when follow-ups end | 2026-09-29 #13935 | JP&Co: absent; WesternSlope: absent; Situs: absent; TEST Willows/sandbox: absent; TEST Fairhaven: absent | Overnight 09-29/30 improvements shipped behind company settings off everywhere. Removal PRs in flight (session 001). |
settings.cadenceEndSendsCloseText | company setting (Organization.settings) | Closing text after last follow-up | 2026-09-30 #14050 | JP&Co: absent; WesternSlope: absent; Situs: absent; TEST Willows/sandbox: absent; TEST Fairhaven: absent | Overnight 09-29/30 improvements shipped behind company settings off everywhere. Removal PRs in flight (session 001). |
settings.tourMessagesShortForm | company setting (Organization.settings) | Short-form tour reminders/confirmations | 2026-09-30 #14078 | JP&Co: absent; WesternSlope: absent; Situs: absent; TEST Willows/sandbox: absent; TEST Fairhaven: absent | Overnight 09-29/30 improvements shipped behind company settings off everywhere. Removal PRs in flight (session 001). |
property:escalatedTourBookingEnabled | property setting (Property row boolean) | per-property boolean gate (see name) | 2026-08-27 #6444 D | JP&Co: 1 of 2 properties on (1 rows set); WesternSlope: 1 of 70 properties on (1 rows set); Situs: absent on all 52 properties; TEST Willows/sandbox: 1 of 2 properties on (1 rows set); TEST Fairhaven: | Improvements to live tour/transfer behavior, on at one home each and off everywhere else by omission. |
property:sameThreadMemoryAckEnabled | property setting (Property row boolean) | per-property boolean gate (see name) | 2026-08-31 #6710 C | JP&Co: absent on all 2 properties; WesternSlope: absent on all 70 properties; Situs: absent on all 52 properties; TEST Willows/sandbox: 2 of 2 properties on (2 rows set); TEST Fairhaven: absent on all | Correctness rules for live behavior (2/2 on at JP&Co, or absent = off by accident). |
property:statedNameWinsEnabled | property setting (Property row boolean) | per-property boolean gate (see name) | 2026-09-05 #7113 T | JP&Co: absent on all 2 properties; WesternSlope: absent on all 70 properties; Situs: absent on all 52 properties; TEST Willows/sandbox: 1 of 2 properties on (1 rows set); TEST Fairhaven: absent on all | Correctness rules for live behavior (2/2 on at JP&Co, or absent = off by accident). |
property:teamTourEmailAfterCallEnabled | property setting (Property row boolean) | per-property boolean gate (see name) | 2026-09-12 #8131 T | JP&Co: absent on all 2 properties; WesternSlope: 1 of 70 properties on (1 rows set); Situs: absent on all 52 properties; TEST Willows/sandbox: absent on all 2 properties; TEST Fairhaven: 1 of 11 prope | Improvements to live tour/transfer behavior, on at one home each and off everywhere else by omission. |
property:tourPastDateTruthEnabled | property setting (Property row boolean) | per-property boolean gate (see name) | 2026-09-03 #6981 A | JP&Co: 2 of 2 properties on (2 rows set); WesternSlope: absent on all 70 properties; Situs: absent on all 52 properties; TEST Willows/sandbox: 2 of 2 properties on (2 rows set); TEST Fairhaven: absent | Correctness rules for live behavior (2/2 on at JP&Co, or absent = off by accident). |
property:tourRequestSmsEnabled | property setting (Property row boolean) | per-property boolean gate (see name) | 2026-09-05 #7135 W | JP&Co: absent on all 2 properties; WesternSlope: 0 of 70 properties on (1 rows set); Situs: absent on all 52 properties; TEST Willows/sandbox: absent on all 2 properties; TEST Fairhaven: 0 of 11 prope | Improvement to live tour flow, off everywhere by omission. |
property:transferMissedOutreachEnabled | property setting (Property row boolean) | per-property boolean gate (see name) | 2026-08-30 #6652 M | JP&Co: 1 of 2 properties on (1 rows set); WesternSlope: 1 of 70 properties on (1 rows set); Situs: absent on all 52 properties; TEST Willows/sandbox: absent on all 2 properties; TEST Fairhaven: 1 of 1 | Improvements to live tour/transfer behavior, on at one home each and off everywhere else by omission. |
property leasing/maint settings:guestCardWriteFromCalls | property setting (LEASING_SETTINGS / MAINTENANCE_SETTINGS row) | per-property boolean/enum on the property settings row | 2026-09-17 #9155 p | JP&Co: absent on all 2 properties; WesternSlope: 70 of 70 properties on (70 rows set); Situs: absent on all 52 properties; TEST Willows/sandbox: 1 of 2 properties on (1 rows set); TEST Fairhaven: 4 of | Proven live at Western Slope 09-18 (70/70 homes). Two switches for one thing. |
property leasing/maint settings:guestCardWriteFromTexts | property setting (LEASING_SETTINGS / MAINTENANCE_SETTINGS row) | per-property boolean/enum on the property settings row | 2026-09-24 #12083 | JP&Co: absent on all 2 properties; WesternSlope: absent on all 70 properties; Situs: absent on all 52 properties; TEST Willows/sandbox: 1 of 2 properties on (1 rows set); TEST Fairhaven: absent on all | Proven live at Western Slope 09-18 (70/70 homes). Two switches for one thing. |
property leasing/maint settings:autoLinkCoApplicants | property setting (LEASING_SETTINGS / MAINTENANCE_SETTINGS row) | per-property boolean/enum on the property settings row | 2026-09-08 #7417 C | JP&Co: absent on all 2 properties; WesternSlope: absent on all 70 properties; Situs: absent on all 52 properties; TEST Willows/sandbox: 1 of 2 properties on (1 rows set); TEST Fairhaven: absent on all | Correctness rules for live behavior (2/2 on at JP&Co, or absent = off by accident). |
property leasing/maint settings:tourInviteV2Enabled | property setting (LEASING_SETTINGS / MAINTENANCE_SETTINGS row) | per-property boolean/enum on the property settings row | 2026-09-13 #8128 W | JP&Co: absent on all 2 properties; WesternSlope: absent on all 70 properties; Situs: absent on all 52 properties; TEST Willows/sandbox: 1 of 2 properties on (1 rows set); TEST Fairhaven: absent on all | Improvements to live tour/renewal flows, absent everywhere = off by accident. Prove by replay, then permanent. |
property leasing/maint settings:tourWindowMatchingEnabled | property setting (LEASING_SETTINGS / MAINTENANCE_SETTINGS row) | per-property boolean/enum on the property settings row | 2026-08-31 #6713 T | JP&Co: absent on all 2 properties; WesternSlope: absent on all 70 properties; Situs: absent on all 52 properties; TEST Willows/sandbox: 2 of 2 properties on (2 rows set); TEST Fairhaven: absent on all | Inverted env arms on leasing improvements; effectively on everywhere already. Env arms are banned by the constitution. |
property leasing/maint settings:tickerSelfHealEnabled | property setting (LEASING_SETTINGS / MAINTENANCE_SETTINGS row) | per-property boolean/enum on the property settings row | 2026-09-11 #7876 H | JP&Co: absent on all 2 properties; WesternSlope: 70 of 70 properties on (70 rows set); Situs: absent on all 52 properties; TEST Willows/sandbox: absent on all 2 properties; TEST Fairhaven: absent on a | Fix for the missing-ticker import bug; on at 70/70 Western Slope homes already. |
property leasing/maint settings:tourBookingBlockedTeamEmail | property setting (LEASING_SETTINGS / MAINTENANCE_SETTINGS row) | per-property boolean/enum on the property settings row | 2026-09-29 #13602 | JP&Co: absent on all 2 properties; WesternSlope: absent on all 70 properties; Situs: absent on all 52 properties; TEST Willows/sandbox: absent on all 2 properties; TEST Fairhaven: absent on all 11 pro | Improvements to live tour/renewal flows, absent everywhere = off by accident. Prove by replay, then permanent. |
property leasing/maint settings:lostTourSlotTeamEmail | property setting (LEASING_SETTINGS / MAINTENANCE_SETTINGS row) | per-property boolean/enum on the property settings row | 2026-09-29 #13418 | JP&Co: absent on all 2 properties; WesternSlope: absent on all 70 properties; Situs: absent on all 52 properties; TEST Willows/sandbox: absent on all 2 properties; TEST Fairhaven: absent on all 11 pro | Improvements to live tour/renewal flows, absent everywhere = off by accident. Prove by replay, then permanent. |
property leasing/maint settings:lostTourSlotProspectMessage | property setting (LEASING_SETTINGS / MAINTENANCE_SETTINGS row) | per-property boolean/enum on the property settings row | 2026-09-29 #13654 | JP&Co: absent on all 2 properties; WesternSlope: absent on all 70 properties; Situs: absent on all 52 properties; TEST Willows/sandbox: absent on all 2 properties; TEST Fairhaven: absent on all 11 pro | Improvements to live tour/renewal flows, absent everywhere = off by accident. Prove by replay, then permanent. |
property leasing/maint settings:renewalLapseDigestEnabled | property setting (LEASING_SETTINGS / MAINTENANCE_SETTINGS row) | per-property boolean/enum on the property settings row | 2026-09-04 #7104 G | JP&Co: absent on all 2 properties; WesternSlope: absent on all 70 properties; Situs: absent on all 52 properties; TEST Willows/sandbox: absent on all 2 properties; TEST Fairhaven: absent on all 11 pro | Improvements to live tour/renewal flows, absent everywhere = off by accident. Prove by replay, then permanent. |
ddb-config:APPFOLIO_BUDGET_ENFORCE#<account> | DDB config row (PK=CONFIG) | enforce per-account AppFolio request budget | 2026-09-12 2026-09 | all customers: jpco true (2026-09-13); westernslopepm true (2026-09-13); situsgroup true (2026-09-30) | Rate-limit protection is a guard, not a feature. Removal PR in flight (Fede 09-30). |
ddb-config:*_PORTFOLIO#<account> (BALANCES, GUEST_CARDS, LEASE_STATES, | DDB config row (PK=CONFIG) | per-account switch: one portfolio-wide AppFolio report call instead of per-property calls | 2026-09-12 2026-09 | all customers: ALL 10 arms enabled=true for jpco, westernslopepm and situsgroup (Situs armed 2026-09-30; jpco/ws 09-13..09-18). Exceptions: jpco LEASE_STATES_HISTORY armed 09-16; PAYMENTS jpco+ws 09-1 | Rate-limit protection is a guard, not a feature. Removal PR in flight (Fede 09-30). |
ddb-config:GUEST_CARD_WRITE_FROM_CALLS#<org> | DDB config row (PK=CONFIG) | org-level switch: write AppFolio guest card when a call ends | 2026-09-17 2026-09 | all customers: enabled=true for Western Slope (2026-09-18 Fede "now we are live"), org_sandbox (2026-09-18), Fairhaven (2026-09-22, dry-run scaffold row); JP&Co absent; Situs absent | Proven live at Western Slope 09-18 (70/70 homes). Two switches for one thing. |
env:TOUR_SCHEDULE_INLINE_CDC | env | Inline CDC on tour schedule writes. | 2026-07-21 #4274 A | Vercel prod: unset on Vercel prod; Lambda/ECS: not set (no lambda reads it); per-customer: n/a (global) | Inverted env arms on leasing improvements; effectively on everywhere already. Env arms are banned by the constitution. |
env:PROPFLOW_ROSTER_GATE | env | Org roster check on property scope. | 2026-09-10 #7682 f | Vercel prod: 1 (refuse); Lambda/ECS: not set (no lambda reads it); per-customer: n/a (global) | Cross-company isolation is a hard floor (Fede 09-07). Refuse everywhere, no gate, no bench list. |
WARM_CACHE_GATED_PROPERTY_IDS | code allowlist | Widened tour-slot horizon in the voice prompt plus real get_day_tour_times answers, and the background availability warm-cache refresher | 2026-08-24 #6164 | hardcoded targets: appfolio-45 (Willows); effective: ON for Willows only; every other property off | Marked TEMPORARY on 08-24, still Willows-only five weeks later. Permanent or delete. |
SLOT_HOLD_PROPERTY_IDS / config/calendar-slot-hold-properties.json | code allowlist | Store-backed tour slot hold at applyTourIntent (prevents double-booking); refusal is caller-audible | 2026-09-14 #8416 | hardcoded targets: yale-sandbox; effective: ON for yale-sandbox only | Double-booking prevention is correctness. Everywhere. |
ROSTER_REFUSE_PROPERTY_IDS / config/roster-refuse-properties.json | code allowlist | Roster gate: refuses cross-company reads with a 404 regardless of PROPFLOW_ROSTER_GATE env switch | 2026-09-13 #8374 | hardcoded targets: fairhaven-homes, appfolio-45; effective: Refuse ON for those 2 test properties; others follow env switch (unset = off) | Cross-company isolation is a hard floor (Fede 09-07). Refuse everywhere, no gate, no bench list. |
ddb-config:ONBOARDING_IMPORT_ARM#<org>#<account> | DDB config row (PK=CONFIG) | Connecting an AppFolio account creates property skeletons only; the 5-stage onboarding import that creates units and leases runs only when this row is armed by hand. Read by src/lib/data/dynamo/onboarding-import-arm.ts; default off; set only by scripts/run-onboarding-import-bench.ts. | 2026-09-30 (found after audit) | Situs Group: 448 declared units, 185 unit records; Alton 55 / Lampliter 41 / Carr Street 34 with zero | Fix-shaped switch, remove. The import runs on connect (or on Finish) with no arm. |
| Switch | Kind | What it gates | Since | Live state | Why this verdict |
|---|---|---|---|---|---|
arms:maintenance.boundedPhotoDeferral | arms-registry | Whether a tenant's maintenance report is guaranteed to become a work order. DISARMED (today): when the intake classifier says a photo would help, filing is deferred so Clara can ask for one — and it is deferred AGAIN on | 2026-08-31 #6714 f | property flag boundedPhotoDeferralEnabled: {'JP&Co': 'absent on all 2 properties', 'WesternSlope': 'absent on all 70 properties', 'Situs': 'absent on all 52 properties', 'TEST Willows/sandbox': '2 of | Per-property switches from the prototype era, off (or absent) at every real customer. Delete the switch and the path nobody runs. |
arms:vendor.transferFirst | arms-registry | Triage's greeting for recognized INBOUND vendor calls during office hours: when ON, Clara's greeting pre-announces the connect to the office before transferring; when OFF there is no pre-announcement. In both settings a | 2026-08-05 #5469 f | property flag vendorTransferFirstEnabled: {'JP&Co': '1 of 2 properties on (1 rows set)', 'WesternSlope': 'absent on all 70 properties', 'Situs': 'absent on all 52 properties', 'TEST Willows/sandbox': | Per-property switches from the prototype era, off (or absent) at every real customer. Delete the switch and the path nobody runs. |
arms:compliance.voiceFairHousingAlert | arms-registry | Whether a RED from the after-the-fact fair-housing judge on a VOICE turn posts the existing hold/alert card to the property's leasing-activity channel (fallback `alerts`). OFF (the default, and every property today): the | 2026-09-20 #9985 A | property flag voiceFairHousingAlertEnabled: {'JP&Co': 'absent on all 2 properties', 'WesternSlope': 'absent on all 70 properties', 'Situs': 'absent on all 52 properties', 'TEST Willows/sandbox': 'abse | Per-property switches from the prototype era, off (or absent) at every real customer. Delete the switch and the path nobody runs. |
arms:kill.turnIntegrityTypedToolResults | arms-registry | OFF lets raw thrown tool errors reach the model instead of curated typed failures. | 2026-07-17 #4061 F | AppSettings key turnIntegrityTypedToolResults: CONFIG/SETTINGS row lacks key -> default ON (all customers) | Four default-on kill switches from July, never flipped anywhere. Dead escape hatches. |
arms:kill.turnIntegritySingleWriter | arms-registry | OFF stops suppressing the ingestion-side confirmation send, so the agent is no longer the sole customer-facing writer per inbound (double-send risk). | 2026-07-17 #4061 F | AppSettings key turnIntegritySingleWriter: CONFIG/SETTINGS row lacks key -> default ON (all customers) | Four default-on kill switches from July, never flipped anywhere. Dead escape hatches. |
arms:kill.turnIntegrityReviewGate | arms-registry | OFF disables the Anomaly Review Gate on agent turns. | 2026-07-17 #4061 F | AppSettings key turnIntegrityReviewGate: CONFIG/SETTINGS row lacks key -> default ON (all customers) | Four default-on kill switches from July, never flipped anywhere. Dead escape hatches. |
arms:kill.turnIntegrityOutputGate | arms-registry | OFF silences the output-gate verdict logs. Observe-only — it never blocks a send. | 2026-07-17 #4061 F | AppSettings key turnIntegrityOutputGate: CONFIG/SETTINGS row lacks key -> default ON (all customers) | Four default-on kill switches from July, never flipped anywhere. Dead escape hatches. |
arms:runtime.claraTraceCapturePrompt | arms-registry | Capturing the exact system prompt on persisted agent_traces (~5-15KB per trace) so the trace viewer can show what Clara read. Ships ON; the only off token is the literal `false`. | 2026-06-06 #1983 f | env CLARA_TRACE_CAPTURE_PROMPT: Vercel: unset on Vercel prod; ECS/Lambda: not set (no lambda reads it) | Infra env flags with one prod value. Make the prod value the code and delete the var. |
registry:capability_stage.<function> | company/property setting (portfolio registry key) | registry key, writable at ['org', 'group', 'property']; type enum | 2026-09-10 #7660 f | JP&Co: absent; WesternSlope: absent; Situs: absent; TEST Willows/sandbox: absent; TEST Fairhaven: absent | Registry keys with no reader and no row anywhere (design leftovers). |
registry:observe.sms | company/property setting (portfolio registry key) | registry key, writable at ['org', 'group', 'property']; type enum | 2026-09-10 #7409 T | JP&Co: absent; WesternSlope: absent; Situs: absent; TEST Willows/sandbox: absent; TEST Fairhaven: absent | Registry keys with no reader and no row anywhere (design leftovers). |
registry:observe.email | company/property setting (portfolio registry key) | registry key, writable at ['org', 'group', 'property']; type enum | 2026-09-11 #7708 f | JP&Co: absent; WesternSlope: absent; Situs: absent; TEST Willows/sandbox: absent; TEST Fairhaven: absent | Registry keys with no reader and no row anywhere (design leftovers). |
registry:cross_sell.same_owner_only | company/property setting (portfolio registry key) | registry key, writable at ['org', 'group']; type boolean | 2026-09-10 #7409 T | JP&Co: absent; WesternSlope: absent; Situs: absent; TEST Willows/sandbox: absent; TEST Fairhaven: absent | Registry keys with no reader and no row anywhere (design leftovers). |
registry:cross_sell.rule | company/property setting (portfolio registry key) | registry key, writable at ['org', 'group']; type object | 2026-09-10 #7409 T | JP&Co: absent; WesternSlope: absent; Situs: absent; TEST Willows/sandbox: absent; TEST Fairhaven: absent | Registry keys with no reader and no row anywhere (design leftovers). |
registry:home_picker | company/property setting (portfolio registry key) | registry key, writable at ['org', 'group', 'property']; type enum | 2026-09-07 #7251 P | JP&Co: absent; WesternSlope: absent; Situs: absent; TEST Willows/sandbox: absent; TEST Fairhaven: absent | Registry keys with no reader and no row anywhere (design leftovers). |
registry:pms_delivery_mode | company/property setting (portfolio registry key) | registry key, writable at ['org', 'group', 'property']; type unknown | 2026-09-11 #7708 f | JP&Co: absent; WesternSlope: absent; Situs: absent; TEST Willows/sandbox: absent; TEST Fairhaven: absent | Registry keys with no reader and no row anywhere (design leftovers). |
settings.smsEnabled | company setting (Organization.settings) | Outbound SMS for the company (per-org) | 2026-03-12 no PR# | JP&Co: false; WesternSlope: false; Situs: absent; TEST Willows/sandbox: false; TEST Fairhaven: absent | All false at every live customer while Clara texts and emails daily. Nothing reads them as intended. Delete. |
settings.emailsEnabled | company setting (Organization.settings) | Outbound email for the company | 2026-03-12 no PR# | JP&Co: false; WesternSlope: false; Situs: absent; TEST Willows/sandbox: false; TEST Fairhaven: absent | All false at every live customer while Clara texts and emails daily. Nothing reads them as intended. Delete. |
settings.emailShadowMode | company setting (Organization.settings) | Company email shadow mode | 2026-03-31 no PR# | JP&Co: false; WesternSlope: false; Situs: absent; TEST Willows/sandbox: false; TEST Fairhaven: absent | Per-property switches from the prototype era, off (or absent) at every real customer. Delete the switch and the path nobody runs. |
settings.vendorQuoteEmails | company setting (Organization.settings) | Vendor quote emails | 2026-02-22 no PR# | JP&Co: false; WesternSlope: false; Situs: absent; TEST Willows/sandbox: false; TEST Fairhaven: absent | All false at every live customer while Clara texts and emails daily. Nothing reads them as intended. Delete. |
settings.vendorDispatchEmails | company setting (Organization.settings) | Vendor dispatch emails | 2026-02-23 no PR# | JP&Co: false; WesternSlope: false; Situs: absent; TEST Willows/sandbox: false; TEST Fairhaven: absent | All false at every live customer while Clara texts and emails daily. Nothing reads them as intended. Delete. |
property:autoDraftLeaseOnApprovalEnabled | property setting (Property row boolean) | per-property boolean gate (see name) | 2026-09-06 #7178 N | JP&Co: absent on all 2 properties; WesternSlope: absent on all 70 properties; Situs: absent on all 52 properties; TEST Willows/sandbox: 1 of 2 properties on (1 rows set); TEST Fairhaven: absent on all | Per-property switches from the prototype era, off (or absent) at every real customer. Delete the switch and the path nobody runs. |
property:autoSyncEnabled | property setting (Property row boolean) | per-property boolean gate (see name) | 2026-04-07 no PR# | JP&Co: 1 of 2 properties on (1 rows set); WesternSlope: 0 of 70 properties on (1 rows set); Situs: absent on all 52 properties; TEST Willows/sandbox: absent on all 2 properties; TEST Fairhaven: 0 of 1 | Per-property switches from the prototype era, off (or absent) at every real customer. Delete the switch and the path nobody runs. |
property:disableEmailRentRollBalanceSync | property setting (Property row boolean) | per-property boolean gate (see name) | 2026-04-18 #187 fe | JP&Co: 1 of 2 properties on (1 rows set); WesternSlope: absent on all 70 properties; Situs: absent on all 52 properties; TEST Willows/sandbox: absent on all 2 properties; TEST Fairhaven: absent on all | Per-property switches from the prototype era, off (or absent) at every real customer. Delete the switch and the path nobody runs. |
property:emailShadowMode | property setting (Property row boolean) | per-property boolean gate (see name) | 2026-03-31 no PR# | JP&Co: 0 of 2 properties on (2 rows set); WesternSlope: 1 of 70 properties on (1 rows set); Situs: absent on all 52 properties; TEST Willows/sandbox: 0 of 2 properties on (2 rows set); TEST Fairhaven: | Per-property switches from the prototype era, off (or absent) at every real customer. Delete the switch and the path nobody runs. |
property:escalationBakeApprovalRequired | property setting (Property row boolean) | per-property boolean gate (see name) | 2026-08-30 #6654 E | Removed 2026-10-13 (PR #19357, #19366). JP&Co: 0 of 2 properties on (1 rows set); WesternSlope: 0 of 70 properties on (1 rows set); Situs: absent on all 52 properties; TEST Willows/sandbox: 0 of 2 properties on (1 rows set); TEST Fairhaven: | Per-property switches from the prototype era, off (or absent) at every real customer. Delete the switch and the path nobody runs. |
property:escalationCoworkerModeEnabled | property setting (Property row boolean) | per-property boolean gate (see name) | 2026-09-03 #6979 f | JP&Co: absent on all 2 properties; WesternSlope: absent on all 70 properties; Situs: absent on all 52 properties; TEST Willows/sandbox: 1 of 2 properties on (1 rows set); TEST Fairhaven: absent on all | Per-property switches from the prototype era, off (or absent) at every real customer. Delete the switch and the path nobody runs. |
property:pmsWritesAllowedWhileTest | property setting (Property row boolean) | per-property boolean gate (see name) | 2026-09-17 #9325 f | JP&Co: absent on all 2 properties; WesternSlope: absent on all 70 properties; Situs: absent on all 52 properties; TEST Willows/sandbox: 1 of 2 properties on (1 rows set); TEST Fairhaven: 3 of 11 prope | Per-property switches from the prototype era, off (or absent) at every real customer. Delete the switch and the path nobody runs. |
property:promiseLedgerCallerOutboundEnabled | property setting (Property row boolean) | per-property boolean gate (see name) | 2026-08-29 #6564 C | JP&Co: 0 of 2 properties on (1 rows set); WesternSlope: absent on all 70 properties; Situs: absent on all 52 properties; TEST Willows/sandbox: 0 of 2 properties on (1 rows set); TEST Fairhaven: 0 of 1 | Per-property switches from the prototype era, off (or absent) at every real customer. Delete the switch and the path nobody runs. |
property:rentRollDataApiEnabled | property setting (Property row boolean) | per-property boolean gate (see name) | 2026-09-15 #8630 M | JP&Co: 1 of 2 properties on (1 rows set); WesternSlope: absent on all 70 properties; Situs: absent on all 52 properties; TEST Willows/sandbox: absent on all 2 properties; TEST Fairhaven: absent on all | Per-property switches from the prototype era, off (or absent) at every real customer. Delete the switch and the path nobody runs. |
property:smsShadowMode | property setting (Property row boolean) | per-property boolean gate (see name) | 2026-08-24 #6215 P | JP&Co: 0 of 2 properties on (1 rows set); WesternSlope: 0 of 70 properties on (1 rows set); Situs: absent on all 52 properties; TEST Willows/sandbox: 0 of 2 properties on (1 rows set); TEST Fairhaven: | Per-property switches from the prototype era, off (or absent) at every real customer. Delete the switch and the path nobody runs. |
property:useAgentTourProcessing | property setting (Property row boolean) | per-property boolean gate (see name) | 2026-04-01 no PR# | JP&Co: 0 of 2 properties on (1 rows set); WesternSlope: absent on all 70 properties; Situs: absent on all 52 properties; TEST Willows/sandbox: absent on all 2 properties; TEST Fairhaven: absent on all | Per-property switches from the prototype era, off (or absent) at every real customer. Delete the switch and the path nobody runs. |
property:vendorVoiceCallingEnabled | property setting (Property row boolean) | per-property boolean gate (see name) | 2026-07-24 #4477 V | JP&Co: absent on all 2 properties; WesternSlope: absent on all 70 properties; Situs: absent on all 52 properties; TEST Willows/sandbox: 1 of 2 properties on (1 rows set); TEST Fairhaven: absent on all | Per-property switches from the prototype era, off (or absent) at every real customer. Delete the switch and the path nobody runs. |
property leasing/maint settings:newLeaseExecutionNoticesEnabled | property setting (LEASING_SETTINGS / MAINTENANCE_SETTINGS row) | per-property boolean/enum on the property settings row | 2026-07-01 #2823 f | JP&Co: 0 of 2 properties on (1 rows set); WesternSlope: absent on all 70 properties; Situs: absent on all 52 properties; TEST Willows/sandbox: 1 of 2 properties on (1 rows set); TEST Fairhaven: absent | Per-property switches from the prototype era, off (or absent) at every real customer. Delete the switch and the path nobody runs. |
property leasing/maint settings:renewalOutreachEnabled | property setting (LEASING_SETTINGS / MAINTENANCE_SETTINGS row) | per-property boolean/enum on the property settings row | 2026-03-18 no PR# | JP&Co: 0 of 2 properties on (1 rows set); WesternSlope: absent on all 70 properties; Situs: absent on all 52 properties; TEST Willows/sandbox: 1 of 2 properties on (1 rows set); TEST Fairhaven: absent | Per-property switches from the prototype era, off (or absent) at every real customer. Delete the switch and the path nobody runs. |
property leasing/maint settings:turnIntegrityTypedToolResults | property setting (LEASING_SETTINGS / MAINTENANCE_SETTINGS row) | per-property boolean/enum on the property settings row | 2026-07-17 #4061 F | JP&Co: absent on all 2 properties; WesternSlope: absent on all 70 properties; Situs: absent on all 52 properties; TEST Willows/sandbox: absent on all 2 properties; TEST Fairhaven: absent on all 11 pro | Four default-on kill switches from July, never flipped anywhere. Dead escape hatches. |
property leasing/maint settings:pmNotificationMode | property setting (LEASING_SETTINGS / MAINTENANCE_SETTINGS row) | per-property boolean/enum on the property settings row | 2026-08-27 #6441 O | JP&Co: absent on all 2 properties; WesternSlope: absent on all 70 properties; Situs: absent on all 52 properties; TEST Willows/sandbox: absent on all 2 properties; TEST Fairhaven: absent on all 11 pro | Per-property switches from the prototype era, off (or absent) at every real customer. Delete the switch and the path nobody runs. |
ddb-config:ONBOARDING_IMPORT_ARM#<org>#<account> | DDB config row (PK=CONFIG) | PMS onboarding import arm | 2026-09-12 2026-09 | all customers: Western Slope armed=true (2026-09-13); org_sandbox armed=false | Internal machinery arms already on (or one-property allowlists from Aug). Delete the row and the read. |
ddb-config:PMS_SYNC_DISPATCH | DDB config row (PK=CONFIG) | how the sync tick dispatches (per-connection) | 2026-09-09 2026-09 | all customers: mode=per-connection (2026-09-10) | Internal machinery arms already on (or one-property allowlists from Aug). Delete the row and the read. |
ddb-config:OPERATING_MODE_ARM | DDB config row (PK=CONFIG) | PropFlow-owned inbox operating mode (D9) | 2026-08-27 2026-08 | all customers: enabled=true, propertyAllowlist=[1773625952029] (the Yale/bench property; updatedBy fede-yale-e2e 2026-08-31) | Internal machinery arms already on (or one-property allowlists from Aug). Delete the row and the read. |
ddb-config:D8_PIPELINE_ARM | DDB config row (PK=CONFIG) | thumbs-down auto-drafts a regression test | 2026-08-23 2026-08 | all customers: armed=true (2026-08-23) | Internal machinery arms already on (or one-property allowlists from Aug). Delete the row and the read. |
ddb-config:FEATURES | DDB config row (PK=CONFIG) | global enabledModules fallback | unknown unknown | all customers: leasing.prospects/renewals true; maintenance.* and dashboard false | Camellia-era global rows. testMode=true is set GLOBALLY in prod today. Retire. |
ddb-config:SETTINGS | DDB config row (PK=CONFIG) | legacy global AppSettings row (Camellia-era) | 2026-03-12 2026-03 | all customers: emailsEnabled=true, smsEnabled=true, testMode=true, tenantIdentityValidation=true, renewalOutreachEnabled=false, callerIdPassthrough=false, huntAcceptMode=press1, emailShadowMode=false, | Camellia-era global rows. testMode=true is set GLOBALLY in prod today. Retire. |
env:PMS_OUTAGE_ALARM | env | PMS outage alarm. | 2026-09-11 #7796 f | Vercel prod: unset on Vercel prod; Lambda/ECS: not set (no lambda reads it); per-customer: n/a (global) | Infra env flags with one prod value. Make the prod value the code and delete the var. |
env:APPFOLIO_ENABLED | env | AppFolio data sync lambda runs. | 2026-04-17 #174 fe | Vercel prod: unset on Vercel prod; Lambda/ECS: appfolio-sync-prod: true; per-customer: n/a (global) | Infra env flags with one prod value. Make the prod value the code and delete the var. |
env:APPFOLIO_WORK_ORDERS_MODE / BALANCES_MODE / OCCUPANCIES_MODE | env | Per-job sync mode. | unknown | Vercel prod: unset on Vercel prod; Lambda/ECS: appfolio-sync-prod: all primary; per-customer: n/a (global) | Infra env flags with one prod value. Make the prod value the code and delete the var. |
env:WO_ENRICH_ENABLED | env | Work-order enrichment. | 2026-05-04 #630 fe | Vercel prod: unset on Vercel prod; Lambda/ECS: appfolio-sync-prod: true; per-customer: n/a (global) | Infra env flags with one prod value. Make the prod value the code and delete the var. |
env:MAINTENANCE_HANDYMAN_QUIET_HOURS | env | Handyman quiet-hours window. | 2026-06-09 #2077 f | Vercel prod: unset on Vercel prod; Lambda/ECS: appfolio-sync-prod: 22:00-22:01; per-customer: n/a (global) | Infra env flags with one prod value. Make the prod value the code and delete the var. |
env:TEMPORAL_USE_VERSIONING | env | Temporal worker versioning. | 2026-05-14 #927 Ph | Vercel prod: unset on Vercel prod; Lambda/ECS: ECS renewal-worker-prod task def :4317: not set; per-customer: n/a (global) | Infra env flags with one prod value. Make the prod value the code and delete the var. |
env:TRAFFIC_CAPTURE | env | Traffic capture. | 2026-07-25 #4535 f | Vercel prod: unset on Vercel prod; Lambda/ECS: not set (no lambda reads it); per-customer: n/a (global) | Infra env flags with one prod value. Make the prod value the code and delete the var. |
env:DATA_BACKEND | env | Storage backend. | unknown | Vercel prod: dynamodb; Lambda/ECS: dynamodb on all; per-customer: n/a (global) | Infra env flags with one prod value. Make the prod value the code and delete the var. |
env:SPINE_GSI_USE_SCAN | env | Escape hatch forcing scans. | 2026-08-02 #5283 p | Vercel prod: unset on Vercel prod; Lambda/ECS: not set (no lambda reads it); per-customer: n/a (global) | Infra env flags with one prod value. Make the prod value the code and delete the var. |
env:CLOUDWATCH_METRICS | env | Emit CloudWatch metrics. | unknown | Vercel prod: unset on Vercel prod; Lambda/ECS: not set (no lambda reads it); per-customer: n/a (global) | Infra env flags with one prod value. Make the prod value the code and delete the var. |
env:APPFOLIO_FUTURE_ARRIVALS | env | Future-arrivals writer. | 2026-07-28 #4774 f | Vercel prod: unset on Vercel prod; Lambda/ECS: not set (no lambda reads it); per-customer: n/a (global) | Infra env flags with one prod value. Make the prod value the code and delete the var. |
env:TEMPORAL_LIVE_PROPERTY_ALLOWLIST / TEMPORAL_SHADOW_ENABLED / TEMPO | env | Dead: set on Vercel prod but no code reads them. | 2026-05-16 #997 fe | Vercel prod: LIVE_ALLOWLIST='*', SHADOW_ENABLED='true', LEASE_EXEC='armed', DIGEST='armed', others hidden; Lambda/ECS: n/a; per-customer: n/a (global) | Six Vercel prod vars no code reads. Delete. |
env:RENEWAL_ARM_CACHE_TTL_MS, RENEWAL_LADDER_ALLOWED_PROPERTY_IDS, REN | env | tuning/allowlist | unknown | Vercel prod: unset on Vercel prod; Lambda/ECS: not set (no lambda reads it); per-customer: n/a (global) | Infra env flags with one prod value. Make the prod value the code and delete the var. |
DISARMED | code constant | Rollback kill switch: true = Western Slope 970 line agent bound with no tools and call-start webhook off | 2026-09-07 #7297 | hardcoded targets: Western Slope 970 line agent (whole prototype); effective: false (armed: tools bound, webhook on) | A code-constant rollback lever. Rollback is a revert, not a flag. |
propflow-concession-watcher-prod EventBridge rule | schedule | Daily concession-watcher Lambda trigger | 2026-09-27 #12898 | hardcoded targets: global; effective: DISABLED (rule kept, Vercel cron /api/cron/concession-watcher at 0 13 * * * is the single daily trigger) | Retired or informational; delete the rule/entry. |
inspo-sweep (Smith LaunchAgent, manifest enabled=false) | schedule | Weekly marketing-inspo sweep, Meta Ad Library vision taste-gate, digest to #marketing | 2026-09-21 unknown | hardcoded targets: n/a; effective: enabled=false (parked 2026-09-21) | Retired or informational; delete the rule/entry. |
appfolio-sync per-class EventBridge rules (act_now/answer_live/bookkee | schedule | Class cadence rules | 2026-09-12 #8136 ( | hardcoded targets: all; effective: ENABLED since cutover #8136 2026-09-13 (schedules.json header SUPERSEDED note); not disabled | Retired or informational; delete the rule/entry. |
| Switch | Kind | What it gates | Since | Live state | Why this verdict |
|---|---|---|---|---|---|
arms:newLease.autonomousSending | arms-registry | Whether approving a new-lease review item drives the AppFolio executor all the way to send-for-signature, or stops at the save-a-draft step. FALSE/ABSENT (the safe default): approve creates the lease document in AppFolio | 2026-08-31 #6731 A | property flag autonomousLeaseSendingEnabled: {'JP&Co': 'absent on all 2 properties', 'WesternSlope': 'absent on all 70 properties', 'Situs': 'absent on all 52 properties', 'TEST Willows/sandbox': 'abs | New engine or cutover switches: prove at the next customer, cut over, delete within the week. |
arms:email.ntvFirmRouting | arms-registry | Treating a high-confidence formal-notice EMAIL as a firm NTV: declines the renewal, starts turnover + move-out inspection, and drafts the AppFolio move-out. Fleet-wide — no per-property factor. | 2026-06-10 #2129 f | env EMAIL_NTV_FIRM_ROUTING_ENABLED: Vercel: armed; ECS/Lambda: not set (no lambda reads it) | Superseded by the durable arms row (all true). Delete the env copies; then collapse the row into the module settings. |
arms:newLease.pipeline | arms-registry | Whether an APPROVED rental application may create a "next-steps package" review item on /review at all. DISARMED = approvals never create an item, exactly as today. ARMED (plus the property opt-in) still sends nothing on | 2026-08-22 #6078 N | property flag newLeasePipelineEnabled: {'JP&Co': '1 of 2 properties on (1 rows set)', 'WesternSlope': 'absent on all 70 properties', 'Situs': 'absent on all 52 properties', 'TEST Willows/sandbox': '1 | New engine or cutover switches: prove at the next customer, cut over, delete within the week. |
registry:call_routing.v2 | company/property setting (portfolio registry key) | registry key, writable at ['org']; type boolean | 2026-09-23 #10960 | JP&Co: absent; WesternSlope: absent; Situs: absent; TEST Willows/sandbox: true; TEST Fairhaven: true | New engine or cutover switches: prove at the next customer, cut over, delete within the week. |
org field:guestCardFirstEmailEngineEnabled | company setting (Organization row field) | New engine composes the first email to a guest-card prospect (org field) | 2026-09-24 #11694 | JP&Co: absent; WesternSlope: true (2026-09-26 "fede-relayed ws-autonomous"); Situs: absent; TEST Willows/sandbox: absent; TEST Fairhaven: absent | New engine or cutover switches: prove at the next customer, cut over, delete within the week. |
settings.pmsSideEffectMode | company setting (Organization.settings) | shadow|apply for PMS writes | 2026-09-20 #10375 | JP&Co: absent; WesternSlope: absent; Situs: absent; TEST Willows/sandbox: apply; TEST Fairhaven: absent | New engine or cutover switches: prove at the next customer, cut over, delete within the week. |
property:guestCardFirstEmailEngineEnabled | property setting (Property row boolean) | per-property boolean gate (see name) | 2026-09-24 #11694 | JP&Co: absent on all 2 properties; WesternSlope: absent on all 70 properties; Situs: absent on all 52 properties; TEST Willows/sandbox: 1 of 2 properties on (1 rows set); TEST Fairhaven: absent on all | New engine or cutover switches: prove at the next customer, cut over, delete within the week. |
ddb-config:RENEWAL_ARMS | DDB config row (PK=CONFIG) | autoStart/autonomousSending/holdoverConversion/turnoverSending/newLeasePipelineSending/maintenanceSending/listingAutoPublish/etc. durable arms (one row, global) | 2026-06-09 2026-06 | all customers: all TRUE except walkerSpawn=false, holdoverInWorkflow=false; stableWorkflowIdentity + workflowOwnedDispatch allowlists = appfolio-45 (Willows) + 1773625953462; walkerSpawnPropertyGate/h | Superseded by the durable arms row (all true). Delete the env copies; then collapse the row into the module settings. |
env:MAINTENANCE_AUTONOMOUS_SENDING | env | Only read by pipeline-lab script in code; prod maintenance arm is durable row maintenanceSending. | 2026-05-26 #1496 f | Vercel prod: armed; Lambda/ECS: not set (no lambda reads it); per-customer: n/a (global) | Superseded by the durable arms row (all true). Delete the env copies; then collapse the row into the module settings. |
env:READER_SHADOW_MODE | env | Shadow-reads through new reader. | 2026-05-06 #680 fe | Vercel prod: true; Lambda/ECS: inbound-processor-prod: true; appfolio-sync-prod: true; per-customer: n/a (global) | Shadow reader has been "true" everywhere since May. Finish the cutover, delete the shim. |
env:SHADOW_SHIM_TIMEOUT_MS | env | Timeout for shadow shim. | unknown | Vercel prod: 20000; Lambda/ECS: 20000 on both; per-customer: n/a (global) | Shadow reader has been "true" everywhere since May. Finish the cutover, delete the shim. |
flipped dispatch orgs / config/flipped-dispatch-orgs.json | code allowlist | Which orgs pick work-order vendors through pickVendor instead of autoAssignVendor | 2026-09-13 #8351 | hardcoded targets: org_sandbox; effective: ON for org_sandbox (test company) only | Rollout ramps from 09-13 that never widened past the test company. Finish or delete. |
flipped addresses / config/flipped-addresses.json | code allowlist | Which phone/mail addresses route on their address-head record (one address at a time) | 2026-09-13 #8253 | hardcoded targets: phones +18442853526 (appfolio-45 toll-free) and +17208071724 (fairhaven-homes bench line); effective: ON for those 2 test lines only | Rollout ramps from 09-13 that never widened past the test company. Finish or delete. |
unmappedLineFleet staging refusal | code allowlist | Refuses calls to a number that maps to no property, only on the staging fleet; production keeps fail-open | 2026-09-11 #7731 | hardcoded targets: fleet==staging (appfolio-45 / portfolio bench via AGENT_FLEETS_BY_PROPERTY); effective: Staging refuses; production fail-open unchanged | Rollout ramps from 09-13 that never widened past the test company. Finish or delete. |
| Switch | Kind | What it gates | Since | Live state | Why this verdict |
|---|---|---|---|---|---|
env:PMS_CANCEL_ENABLED | env | Publishes AppFolio work-order cancel job on close. | 2026-05-06 #712 Pi | Vercel prod: true; Lambda/ECS: inbound-processor-prod: false; per-customer: n/a (global) | Vercel and the Lambda disagree (spam filter OFF on web, ON in the mail Lambda; cancel ON on web, OFF in Lambda). Pick one value, make it code, delete the env var. |
env:SPAM_FILTER_ENABLED | env | Inbound email spam filter. | 2026-04-09 no PR# | Vercel prod: false (filter OFF); Lambda/ECS: not set on inbound-processor (default on); per-customer: n/a (global) | Vercel and the Lambda disagree (spam filter OFF on web, ON in the mail Lambda; cancel ON on web, OFF in Lambda). Pick one value, make it code, delete the env var. |
DARK_FEATURE_BENCH_IDS / isDarkFeatureBench | code allowlist | Caller-audible dark voice features: soft language prior on ring (personalization route:2706), post-call guest-card contact capture, bedroom-range directive, hangup mid-message backstop (hangupBackstopPropertyAllowed), ca | 2026-09-11 #7801 ( | hardcoded targets: yale-sandbox; effective: ON for yale-sandbox only (call-integrity also ON for portfolio-mode companies) | Caller-audible voice improvements gated to one bench property; their own comments say turn-on = delete the condition. Fede: delete now? |
appfolio-sync work_orders | schedule | EventBridge rule for work_orders: Syncs AppFolio work orders into PropFlow read model (PMS owns WO ids) | 2026-09-12 #7946 ( | hardcoded targets: all AppFolio accounts (jpco, situsgroup); global; effective: DISABLED (rule upserted but not firing; declared state survives deploys) cadence rate(1 minute) | Parked 09-12 during the storm; the protections now exist. renewals off = stale lease end dates at every customer. Lift work_orders + renewals; vendors stays off by product ruling. |
appfolio-sync renewals | schedule | EventBridge rule for renewals: Syncs AppFolio renewal rows (rent-roll poller seam) | 2026-09-12 #7946 ( | hardcoded targets: all AppFolio accounts (jpco, situsgroup); global; effective: DISABLED (rule upserted but not firing; declared state survives deploys) cadence rate(1 minute) | Parked 09-12 during the storm; the protections now exist. renewals off = stale lease end dates at every customer. Lift work_orders + renewals; vendors stays off by product ruling. |
appfolio-sync vendors | schedule | EventBridge rule for vendors: Mirrors the AppFolio vendor directory into the read model | 2026-09-12 #7946 ( | hardcoded targets: all AppFolio accounts (jpco, situsgroup); global; effective: DISABLED (rule upserted but not firing; declared state survives deploys) cadence rate(1 hour) | Parked 09-12 during the storm; the protections now exist. renewals off = stale lease end dates at every customer. Lift work_orders + renewals; vendors stays off by product ruling. |
appfolio-sync vendor_contact | schedule | EventBridge rule for vendor_contact: L4 browser-robot sweep refreshing stale vendor phone/email/owner | 2026-09-12 #7946 ( | hardcoded targets: all AppFolio accounts (jpco, situsgroup); global; effective: DISABLED (rule upserted but not firing; declared state survives deploys) cadence cron(30 1,7,13,19 * * ? *) | Parked 09-12 during the storm; the protections now exist. renewals off = stale lease end dates at every customer. Lift work_orders + renewals; vendors stays off by product ruling. |
pm-action-reminder-backstop | temporal schedule | Temporal schedule pm-action-reminder-backstop (registered by upsertPmActionReminderBackstopSchedule) | 2026-07-21 #4243 | hardcoded targets: global; effective: Code default: paused unless opts.paused===false. LIVE prod pause state is unknown from code (scripts/temporal/upsert-*.ts set it at run time) | Ten Temporal schedules ship paused by code default and nobody knows the live pause state. Each is either running (then remove the paused default) or dead (delete it). |
tour-cohort-walker | temporal schedule | Temporal schedule tour-cohort-walker (registered by upsertTourCohortWalkerSchedule) | 2026-05-22 #1341 | hardcoded targets: global; effective: Code default: paused unless opts.paused===false. LIVE prod pause state is unknown from code (scripts/temporal/upsert-*.ts set it at run time) | Ten Temporal schedules ship paused by code default and nobody knows the live pause state. Each is either running (then remove the paused default) or dead (delete it). |
bench-borrow-expiry-daily | temporal schedule | Temporal schedule bench-borrow-expiry-daily (registered by upsertBenchBorrowExpirySchedule) | 2026-09-04 #7056 | hardcoded targets: global; effective: Code default: paused unless opts.paused===false. LIVE prod pause state is unknown from code (scripts/temporal/upsert-*.ts set it at run time) | Ten Temporal schedules ship paused by code default and nobody knows the live pause state. Each is either running (then remove the paused default) or dead (delete it). |
maintenance-eval-daily | temporal schedule | Temporal schedule maintenance-eval-daily (registered by upsertMaintenanceEvalSchedule) | 2026-05-29 #1717 | hardcoded targets: global; effective: Code default: paused by default (ship paused). LIVE prod pause state is unknown from code (scripts/temporal/upsert-*.ts set it at run time) | Ten Temporal schedules ship paused by code default and nobody knows the live pause state. Each is either running (then remove the paused default) or dead (delete it). |
pms-sync-eval-daily | temporal schedule | Temporal schedule pms-sync-eval-daily (registered by upsertPmsSyncEvalSchedule) | 2026-06-01 #1807 | hardcoded targets: global; effective: Code default: paused by default (ship paused). LIVE prod pause state is unknown from code (scripts/temporal/upsert-*.ts set it at run time) | Ten Temporal schedules ship paused by code default and nobody knows the live pause state. Each is either running (then remove the paused default) or dead (delete it). |
topic-label-sweep-nightly | temporal schedule | Temporal schedule topic-label-sweep-nightly (registered by upsertTopicLabelSweepSchedule) | 2026-08-19 #5902 | hardcoded targets: global; effective: Code default: paused unless armed:true. LIVE prod pause state is unknown from code (scripts/temporal/upsert-*.ts set it at run time) | Ten Temporal schedules ship paused by code default and nobody knows the live pause state. Each is either running (then remove the paused default) or dead (delete it). |
onsite-pricing-daily | temporal schedule | Temporal schedule onsite-pricing-daily (registered by upsertOnsitePricingSchedule) | 2026-07-06 #3170 | hardcoded targets: global; effective: Code default: paused unless armed:true. LIVE prod pause state is unknown from code (scripts/temporal/upsert-*.ts set it at run time) | Ten Temporal schedules ship paused by code default and nobody knows the live pause state. Each is either running (then remove the paused default) or dead (delete it). |
availability-warm-cache-refresh | temporal schedule | Temporal schedule availability-warm-cache-refresh (registered by upsertAvailabilityWarmCacheSchedule) | 2026-08-24 #6164 | hardcoded targets: global; effective: Code default: paused unless armed:true. LIVE prod pause state is unknown from code (scripts/temporal/upsert-*.ts set it at run time) | Ten Temporal schedules ship paused by code default and nobody knows the live pause state. Each is either running (then remove the paused default) or dead (delete it). |
connection-health-sweep | temporal schedule | Temporal schedule connection-health-sweep (registered by upsertConnectionHealthSweepSchedule) | 2026-09-29 #13585 | hardcoded targets: global; effective: Code default: paused unless armed:true. LIVE prod pause state is unknown from code (scripts/temporal/upsert-*.ts set it at run time) | Ten Temporal schedules ship paused by code default and nobody knows the live pause state. Each is either running (then remove the paused default) or dead (delete it). |
voice-injection-cache-refresh-daily | temporal schedule | Temporal schedule voice-injection-cache-refresh-daily (registered by upsertVoiceInjectionCacheSchedule) | 2026-07-07 #3237 | hardcoded targets: global; effective: Code default: paused unless armed:true. LIVE prod pause state is unknown from code (scripts/temporal/upsert-*.ts set it at run time) | Ten Temporal schedules ship paused by code default and nobody knows the live pause state. Each is either running (then remove the paused default) or dead (delete it). |
prep-namespace.ts registers ALL 12 schedules paused (target-namespace | temporal schedule | Creates renewal-auto-start-daily, renewal-cohort-walker-daily, tour-cohort-walker, turnover-cohort-walker, collections-cohort-walker-daily, conversation-review-daily, pm-action-reminder-backstop, bench-borrow-expiry-dail | 2026-07-06 #3088 | hardcoded targets: new/target namespace only; effective: Paused in target namespace prep | Ten Temporal schedules ship paused by code default and nobody knows the live pause state. Each is either running (then remove the paused default) or dead (delete it). |
| Switch | Kind | What it gates | Since | Live state | Why this verdict |
|---|---|---|---|---|---|
arms:renewal.sending | arms-registry | Clara sending renewal offers/nudges to real tenants. | 2026-05-24 #1376 r | property flag autonomousRenewalEnabled: {'JP&Co': '1 of 2 properties on (1 rows set)', 'WesternSlope': '0 of 70 properties on (1 rows set)', 'Situs': 'absent on all 52 properties', 'TEST Willows/sandb | Real autonomy choices (Clara sends to tenants/vendors). But 12 per property is the sprawl: collapse into the per-module settings above, one switch per module. |
arms:renewal.holdover | arms-registry | The BILLING mutation when a lease lapses unsigned (flip to month-to-month + change recurring rent), and the D5 reminder copy promising it. | 2026-06-04 #1941 f | property flag autonomousHoldoverEnabled: {'JP&Co': '1 of 2 properties on (1 rows set)', 'WesternSlope': 'absent on all 70 properties', 'Situs': 'absent on all 52 properties', 'TEST Willows/sandbox': ' | Real autonomy choices (Clara sends to tenants/vendors). But 12 per property is the sprawl: collapse into the per-module settings above, one switch per module. |
arms:renewal.autoStart | arms-registry | The daily scanner that walks tenants and opens renewal sagas. Its env fallback was retired 2026-07-07 — a row-less environment is disarmed and cannot be armed by a stale env. | 2026-06-09 #2069 D | durable CONFIG row field autoStart: {'RENEWAL_ARMS row': 'see DDB config rows'} | Real autonomy choices (Clara sends to tenants/vendors). But 12 per property is the sprawl: collapse into the per-module settings above, one switch per module. |
arms:collections.halt | arms-registry | HUMAN-APPROVED SENDS ONLY — the cadence itself texts nobody, whatever this row says. Every composed reminder lands on /review and a person approving it there is the only thing that sends it (ADR-0125). The tenant past-du | 2026-07-28 #4806 f | durable CONFIG row field collectionsHalt: {'RENEWAL_ARMS row': 'see DDB config rows'} | Real autonomy choices (Clara sends to tenants/vendors). But 12 per property is the sprawl: collapse into the per-module settings above, one switch per module. |
arms:turnover.sending | arms-registry | Turnover-domain outbound sends. | 2026-05-25 #1426 f | property flag autonomousTurnoverEnabled: {'JP&Co': '1 of 2 properties on (1 rows set)', 'WesternSlope': '0 of 70 properties on (1 rows set)', 'Situs': 'absent on all 52 properties', 'TEST Willows/sand | Real autonomy choices (Clara sends to tenants/vendors). But 12 per property is the sprawl: collapse into the per-module settings above, one switch per module. |
arms:listing.autoPublish | arms-registry | Auto-publishing a unit listing when notice-to-vacate lands (ADR-0105). The global arm was REMOVED 2026-08-07 — it shipped disarmed and was never armed, so the hook ran in shadow for every property and vacant units sat un | 2026-07-21 #4219 A | property flag autonomousListingPublishEnabled: {'JP&Co': '1 of 2 properties on (1 rows set)', 'WesternSlope': '0 of 70 properties on (1 rows set)', 'Situs': 'absent on all 52 properties', 'TEST Willow | Real autonomy choices (Clara sends to tenants/vendors). But 12 per property is the sprawl: collapse into the per-module settings above, one switch per module. |
arms:vendor.dispatch | arms-registry | Autonomous dispatch messages to vendors. | 2026-06-18 #2439 f | property flag autonomousVendorDispatchEnabled: {'JP&Co': 'absent on all 2 properties', 'WesternSlope': 'absent on all 70 properties', 'Situs': 'absent on all 52 properties', 'TEST Willows/sandbox': '0 | Real autonomy choices (Clara sends to tenants/vendors). But 12 per property is the sprawl: collapse into the per-module settings above, one switch per module. |
registry:notifications.staffObserverBcc | company/property setting (portfolio registry key) | registry key, writable at ['org']; type boolean | 2026-09-18 #9520 f | JP&Co: org settings.staffObserverBcc=true (legacy field); WesternSlope: org settings.staffObserverBcc=true (legacy field); Situs: absent; TEST Willows/sandbox: absent; TEST Fairhaven: absent | A capability a customer can reasonably want off (a channel, an outbound, a review hold, a module). |
registry:notifications.observerBcc | company/property setting (portfolio registry key) | registry key, writable at ['org', 'group', 'property']; type object | 2026-09-16 #9001 f | JP&Co: absent; WesternSlope: legacy field settings.observerBcc {enabled:true, 1 email}; Situs: absent; TEST Willows/sandbox: absent; TEST Fairhaven: absent | A capability a customer can reasonably want off (a channel, an outbound, a review hold, a module). |
registry:pm_action_reminders.enabled | company/property setting (portfolio registry key) | registry key, writable at ['org', 'property']; type boolean | 2026-09-19 #9756 p | JP&Co: org.pmActionReminders.enabled=true (legacy org field); Camellia property leasing settings enabled:true interval 24h max 3; WesternSlope: 70 of 70 property leasing-settings rows pmActionReminder | A capability a customer can reasonably want off (a channel, an outbound, a review hold, a module). |
registry:dispatch.roster_walk.enabled | company/property setting (portfolio registry key) | registry key, writable at ['org']; type boolean | 2026-09-21 #10537 | JP&Co: absent; WesternSlope: absent; Situs: absent; TEST Willows/sandbox: absent; TEST Fairhaven: absent | A capability a customer can reasonably want off (a channel, an outbound, a review hold, a module). |
registry:human_handoff.text_on_ring | company/property setting (portfolio registry key) | registry key, writable at ['org', 'property']; type boolean | 2026-09-20 #10250 | JP&Co: absent; WesternSlope: absent; Situs: absent; TEST Willows/sandbox: absent; TEST Fairhaven: absent | A capability a customer can reasonably want off (a channel, an outbound, a review hold, a module). |
registry:human_handoff.acceptMode | company/property setting (portfolio registry key) | registry key, writable at ['org']; type enum | 2026-09-21 #10567 | JP&Co: registry row absent; CONFIG/SETTINGS huntAcceptMode=press1 (global legacy); WesternSlope: absent; Situs: absent; TEST Willows/sandbox: absent; TEST Fairhaven: absent | A capability a customer can reasonably want off (a channel, an outbound, a review hold, a module). |
registry:building.in_propflow | company/property setting (portfolio registry key) | registry key, writable at ['property']; type object | 2026-09-29 #13913 | JP&Co: absent; WesternSlope: absent; Situs: absent; TEST Willows/sandbox: absent; TEST Fairhaven: absent | A capability a customer can reasonably want off (a channel, an outbound, a review hold, a module). |
registry:maintenance.module | company/property setting (portfolio registry key) | registry key, writable at ['org', 'property']; type object | 2026-09-25 #12416 | JP&Co: enabled:false at 1 property (Yale 25 Station, 2026-09-26); WesternSlope: enabled:false at company-line property (2026-09-29; property row); Situs: absent; TEST Willows/sandbox: absent; TEST Fai | A capability a customer can reasonably want off (a channel, an outbound, a review hold, a module). |
registry:leasing.prospects.module | company/property setting (portfolio registry key) | registry key, writable at ['org', 'property']; type object | 2026-09-26 #12465 | JP&Co: absent; WesternSlope: absent; Situs: absent; TEST Willows/sandbox: absent; TEST Fairhaven: absent | A capability a customer can reasonably want off (a channel, an outbound, a review hold, a module). |
registry:leasing.renewals.module | company/property setting (portfolio registry key) | registry key, writable at ['org', 'property']; type object | 2026-09-26 #12465 | JP&Co: absent; WesternSlope: absent; Situs: absent; TEST Willows/sandbox: absent; TEST Fairhaven: absent | A capability a customer can reasonably want off (a channel, an outbound, a review hold, a module). |
registry:collections.module | company/property setting (portfolio registry key) | registry key, writable at ['org', 'property']; type object | 2026-09-26 #12465 | JP&Co: absent; WesternSlope: absent; Situs: absent; TEST Willows/sandbox: absent; TEST Fairhaven: absent | A capability a customer can reasonably want off (a channel, an outbound, a review hold, a module). |
registry:lease_billing.module | company/property setting (portfolio registry key) | registry key, writable at ['org']; type object | 2026-09-22 #10769 | JP&Co: absent; WesternSlope: enabled:false (org row); Situs: absent; TEST Willows/sandbox: absent; TEST Fairhaven: absent | A capability a customer can reasonably want off (a channel, an outbound, a review hold, a module). |
registry:leasing.guestCardReplyScope | company/property setting (portfolio registry key) | registry key, writable at ['org']; type enum | 2026-09-25 #12111 | JP&Co: absent; WesternSlope: absent; Situs: absent; TEST Willows/sandbox: absent; TEST Fairhaven: absent | A capability a customer can reasonably want off (a channel, an outbound, a review hold, a module). |
registry:leasing.applicationLinkMode | company/property setting (portfolio registry key) | registry key, writable at ['org']; type enum | 2026-09-19 #9779 l | JP&Co: absent; WesternSlope: legacy org field applicationLinkMode=pms_generated; Situs: absent; TEST Willows/sandbox: legacy org field pms_generated; TEST Fairhaven: absent | A capability a customer can reasonably want off (a channel, an outbound, a review hold, a module). |
registry:leasing.applicationLinkClaraTexts | company/property setting (portfolio registry key) | registry key, writable at ['org']; type boolean | 2026-09-29 #13626 | JP&Co: absent; WesternSlope: absent; Situs: absent; TEST Willows/sandbox: absent; TEST Fairhaven: absent | A capability a customer can reasonably want off (a channel, an outbound, a review hold, a module). |
registry:buildings.customer_control | company/property setting (portfolio registry key) | registry key, writable at ['org']; type enum | 2026-09-30 #14130 | JP&Co: absent; WesternSlope: absent; Situs: absent; TEST Willows/sandbox: absent; TEST Fairhaven: absent | A capability a customer can reasonably want off (a channel, an outbound, a review hold, a module). |
org field:claraLive | company setting (Organization row field) | Clara answers/acts for the company at all (master live switch) | 2026-04-25 no PR# | JP&Co: true (2026-09-11); WesternSlope: true (2026-09-20); Situs: false; TEST Willows/sandbox: true; TEST Fairhaven: false; ConAm: false | A capability a customer can reasonably want off (a channel, an outbound, a review hold, a module). |
org field:reviewOutboundEmails | company setting (Organization row field) | Holds Clara outbound emails for staff Slack review before send | 2026-09-19 #9948 R | Removed 2026-10-13 (PR #19357, #19366). JP&Co: absent; WesternSlope: false (set 2026-09-26); Situs: absent; TEST Willows/sandbox: false; TEST Fairhaven: absent | A capability a customer can reasonably want off (a channel, an outbound, a review hold, a module). |
org field:pmsShowingSyncEnabled | company setting (Organization row field) | Writes booked showings into AppFolio | 2026-09-21 #10678 | JP&Co: absent; WesternSlope: true (2026-09-22, "fede-relayed showing-sync go"); Situs: absent; TEST Willows/sandbox: true; TEST Fairhaven: absent | Writes into the customer's AppFolio calendar; a customer can want that off. |
org field:tourCheckinTextEnabled | company setting (Organization row field) | After-tour check-in text to prospects | 2026-09-26 #12672 | JP&Co: false (2026-09-30); WesternSlope: true (2026-09-29); Situs: absent; TEST Willows/sandbox: true; TEST Fairhaven: true | A capability a customer can reasonably want off (a channel, an outbound, a review hold, a module). |
org field:staffTextLeasingEnabled | company setting (Organization row field) | Clara takes leasing instructions from staff by text | 2026-09-25 #12247 | JP&Co: absent; WesternSlope: true (2026-09-27); Situs: absent; TEST Willows/sandbox: true; TEST Fairhaven: false | A capability a customer can reasonably want off (a channel, an outbound, a review hold, a module). |
org field:staffAskByTextEnabled | company setting (Organization row field) | Staff can ask Clara by text | 2026-09-27 #12673 | JP&Co: absent; WesternSlope: absent; Situs: absent; TEST Willows/sandbox: true; TEST Fairhaven: absent | A capability a customer can reasonably want off (a channel, an outbound, a review hold, a module). |
org field:vendorCalendarCapture | company setting (Organization row field) | Capture vendor calendar replies | 2026-09-16 #8835 f | JP&Co: absent; WesternSlope: absent; Situs: absent; TEST Willows/sandbox: absent; TEST Fairhaven: absent | A capability a customer can reasonably want off (a channel, an outbound, a review hold, a module). |
org field:reviewRenewalMessages | company setting (Organization row field) | Hold renewal texts for approve/reject | 2026-09-28 #12956 | JP&Co: absent; WesternSlope: absent; Situs: absent; TEST Willows/sandbox: absent; TEST Fairhaven: absent | A capability a customer can reasonably want off (a channel, an outbound, a review hold, a module). |
org field:selfGuidedToursEnabled | company setting (Organization row field) | Self-guided tour mode | 2026-09-29 #12855 | JP&Co: absent; WesternSlope: absent; Situs: absent; TEST Willows/sandbox: absent; TEST Fairhaven: absent | A capability a customer can reasonably want off (a channel, an outbound, a review hold, a module). |
settings.enabledModules | company setting (Organization.settings) | Which product modules the company sees/uses | unknown | JP&Co: prospects, renewals, workorders, routine, turnovers, costs, dashboard = true; WesternSlope: prospects true; renewals, maintenance, collections false; Situs: all four false; TEST Willows/sandbox | A capability a customer can reasonably want off (a channel, an outbound, a review hold, a module). |
settings.maintenance.ratingPromptEnabled | company setting (Organization.settings) | Repair rating texts | 2026-09-27 #12857 | JP&Co: false; WesternSlope: absent; Situs: absent; TEST Willows/sandbox: absent; TEST Fairhaven: absent | A capability a customer can reasonably want off (a channel, an outbound, a review hold, a module). |
settings.prospectRecordOwner | company setting (Organization.settings) | Which system owns prospect records (appfolio|propflow_crm) | unknown | JP&Co: propflow_crm; WesternSlope: appfolio; Situs: absent; TEST Willows/sandbox: appfolio; TEST Fairhaven: absent | A capability a customer can reasonably want off (a channel, an outbound, a review hold, a module). |
property:autonomousLeasingDigestEnabled | property setting (Property row boolean) | per-property boolean gate (see name) | 2026-06-16 #2397 W | JP&Co: 1 of 2 properties on (1 rows set); WesternSlope: absent on all 70 properties; Situs: absent on all 52 properties; TEST Willows/sandbox: absent on all 2 properties; TEST Fairhaven: absent on all | Real autonomy choices (Clara sends to tenants/vendors). But 12 per property is the sprawl: collapse into the per-module settings above, one switch per module. |
property:autonomousLeasingReportingDigestEnabled | property setting (Property row boolean) | per-property boolean gate (see name) | 2026-07-08 #3313 f | JP&Co: 1 of 2 properties on (1 rows set); WesternSlope: absent on all 70 properties; Situs: absent on all 52 properties; TEST Willows/sandbox: absent on all 2 properties; TEST Fairhaven: absent on all | Real autonomy choices (Clara sends to tenants/vendors). But 12 per property is the sprawl: collapse into the per-module settings above, one switch per module. |
property:autonomousMaintenanceEnabled | property setting (Property row boolean) | per-property boolean gate (see name) | 2026-05-26 #1496 f | JP&Co: 0 of 2 properties on (2 rows set); WesternSlope: absent on all 70 properties; Situs: absent on all 52 properties; TEST Willows/sandbox: 1 of 2 properties on (2 rows set); TEST Fairhaven: absent | Real autonomy choices (Clara sends to tenants/vendors). But 12 per property is the sprawl: collapse into the per-module settings above, one switch per module. |
property:autonomousPostTourChaseEnabled | property setting (Property row boolean) | per-property boolean gate (see name) | 2026-07-26 #4667 f | JP&Co: 1 of 2 properties on (1 rows set); WesternSlope: absent on all 70 properties; Situs: absent on all 52 properties; TEST Willows/sandbox: absent on all 2 properties; TEST Fairhaven: absent on all | Real autonomy choices (Clara sends to tenants/vendors). But 12 per property is the sprawl: collapse into the per-module settings above, one switch per module. |
property:autonomousProspectOutreachEnabled | property setting (Property row boolean) | per-property boolean gate (see name) | 2026-06-18 #2470 A | JP&Co: 1 of 2 properties on (1 rows set); WesternSlope: absent on all 70 properties; Situs: absent on all 52 properties; TEST Willows/sandbox: 0 of 2 properties on (1 rows set); TEST Fairhaven: absent | Real autonomy choices (Clara sends to tenants/vendors). But 12 per property is the sprawl: collapse into the per-module settings above, one switch per module. |
property:autonomousSchedulingReengagementEnabled | property setting (Property row boolean) | per-property boolean gate (see name) | 2026-07-26 #4667 f | JP&Co: 1 of 2 properties on (1 rows set); WesternSlope: absent on all 70 properties; Situs: absent on all 52 properties; TEST Willows/sandbox: absent on all 2 properties; TEST Fairhaven: absent on all | Real autonomy choices (Clara sends to tenants/vendors). But 12 per property is the sprawl: collapse into the per-module settings above, one switch per module. |
property:autonomousTourConfirmNudgeEnabled | property setting (Property row boolean) | per-property boolean gate (see name) | 2026-07-26 #4667 f | JP&Co: 1 of 2 properties on (1 rows set); WesternSlope: absent on all 70 properties; Situs: absent on all 52 properties; TEST Willows/sandbox: absent on all 2 properties; TEST Fairhaven: absent on all | Real autonomy choices (Clara sends to tenants/vendors). But 12 per property is the sprawl: collapse into the per-module settings above, one switch per module. |
property:isTest | property setting (Property row boolean) | Marks a property as a test property (test-sender containment, SMS/email sinks) | unknown | JP&Co: absent on all 2 properties; WesternSlope: 0 of 70 properties on (1 rows set); Situs: absent on all 52 properties; TEST Willows/sandbox: 2 of 2 properties on (2 rows set); TEST Fairhaven: 10 of | Test containment / dev-tool guards, not behavior flags. |
ddb-config:PMS_SYNC_PAUSE#<org> | DDB config row (PK=CONFIG) | durable per-organization AppFolio sync pause | 2026-09-11 2026-09 | all customers: Situs paused (2026-09-29, Gera: locked off until founders turn on). No row for JP&Co, Western Slope | Operational hold or a cadence parameter, not a feature flag. |
ddb-config:WO_ENRICHMENT_CADENCE#<org> | DDB config row (PK=CONFIG) | work-order enrichment cadence per org | 2026-09-19 2026-09 | all customers: Western Slope weekly (weekday 0) row; JP&Co absent -> daily default | Operational hold or a cadence parameter, not a feature flag. |
ddb-config:PMS_SYNC_CANARY_FIXTURES, PIPELINE_STATE, WO_COUNTER, STALE | DDB config row (PK=CONFIG) | not on/off gates (fixtures/state/counters) | n/a n/a | all customers: n/a | Operational hold or a cadence parameter, not a feature flag. |
env:MACHINE_SENDER_SUPPRESS_LIST | env | List of machine senders to suppress. | 2026-06-13 #2341 f | Vercel prod: set (value hidden); Lambda/ECS: not set (no lambda reads it); per-customer: n/a (global) | Test containment / dev-tool guards, not behavior flags. |
env:RATE_LIMIT_EXEMPT_SENDERS | env | Senders exempt from rate limit. | 2026-03-23 no PR# | Vercel prod: unset on Vercel prod; Lambda/ECS: not set (no lambda reads it); per-customer: n/a (global) | Test containment / dev-tool guards, not behavior flags. |
env:VENDOR_DISPATCH_RECIPIENT_ALLOWLIST | env | Restricts vendor dispatch recipients. | 2026-06-18 #2439 f | Removed 2026-10-13 (PR #19346). Vercel prod: unset on Vercel prod; Lambda/ECS: not set (no lambda reads it); per-customer: n/a (global) | Test containment / dev-tool guards, not behavior flags. |
env:MOCK_PMS_ENABLED | env | Mock PMS. | 2026-07-02 #2736 f | Vercel prod: preview only; Lambda/ECS: not set (no lambda reads it); per-customer: n/a (global) | Test containment / dev-tool guards, not behavior flags. |
env:MAILPIT_DISABLED | env | Local mail catcher. | unknown | Vercel prod: unset on Vercel prod; Lambda/ECS: not set (no lambda reads it); per-customer: n/a (global) | Test containment / dev-tool guards, not behavior flags. |
env:ANTHROPIC_FORCE_METERED | env | Allow metered key. | unknown | Vercel prod: unset on Vercel prod; Lambda/ECS: not set (no lambda reads it); per-customer: n/a (global) | Test containment / dev-tool guards, not behavior flags. |
env:HARNESS_SUPPRESS_OUTBOUND | env | Harness kill switch for outbound. | unknown | Vercel prod: unset on Vercel prod; Lambda/ECS: not set (no lambda reads it); per-customer: n/a (global) | Test containment / dev-tool guards, not behavior flags. |
AGENT_FLEETS_BY_PROPERTY | code allowlist | Which property gets a dedicated (staging) voice-agent fleet; also drives V4 refusal of unmapped-number calls on the staging fleet and dialed-number fleet lookup | 2026-08-24 #6164 | hardcoded targets: appfolio-45 (fleet staging); effective: appfolio-45 has dedicated staging fleet; every other property production (fail-closed default) | Test containment / dev-tool guards, not behavior flags. |
TEST_PROPERTY_IDS | code constant | Write-side/safety gates: test-sender containment, email sinks, SMS shadow, collections send policy, prod-write guards, bench tooling (isTestProperty). Deliberately NOT a behaviour switch since 2026-09-11 | unknown (e #7447 ( | hardcoded targets: appfolio-45, fairhaven-homes; effective: Both treated as test properties | Test containment / dev-tool guards, not behavior flags. |
BENCH_PROPERTY_IDS | code constant | Bench-only replay profile that runs history with hand-off gates off | 2026-09-04 #7102 | hardcoded targets: appfolio-45; effective: Bench property list | Test containment / dev-tool guards, not behavior flags. |
CANONICAL_TEST_PROPERTY_IDS | code constant | Which property Pipeline Lab may reset | 2026-05-06 #712 | hardcoded targets: appfolio-45; effective: Test property only | Test containment / dev-tool guards, not behavior flags. |
ALLOWED_PROPERTIES (admin WO list) | code constant | Pipeline Lab work-order list dev tool | 2026-05-08 #760 | hardcoded targets: appfolio-45; effective: Test property only | Test containment / dev-tool guards, not behavior flags. |
APPFOLIO_LIST_ALLOWED_PROPERTIES | code constant | Pipeline Lab live AppFolio WO browse | 2026-05-08 #765 | hardcoded targets: appfolio-45; effective: Test property only | Test containment / dev-tool guards, not behavior flags. |
ALLOWED_PROPERTIES (close-all-for-tenant) | code constant | Bulk-close WOs tool | 2026-05-09 #772 | hardcoded targets: appfolio-45; effective: Test property only | Test containment / dev-tool guards, not behavior flags. |
Hardcoded number->property map (test lines) | code constant | Which test phone numbers resolve to appfolio-45, yale-sandbox, fairhaven-homes (routing, not a behaviour gate) | unknown unknown | hardcoded targets: 3+ test numbers; effective: n/a routing | Test containment / dev-tool guards, not behavior flags. |
Scan result: no hardcoded customer org ids, shadow-mode defaults, or E | code constant | Searched org_jpco/org_sandbox/org_<uuid> literals, shadowMode, dryRun defaults, module-level *_ENABLED/DARK/KILL_SWITCH boolean consts, TODO-remove gates | n/a n/a | hardcoded targets: none in production gate position (org_jpco/org_sandbox only in NEVER_DISPOSABLE_ORG_IDS is-test-organization.ts:59, SENTINEL org lists, and config/flipped-dispatch-orgs.json). Only | Test containment / dev-tool guards, not behavior flags. |
A parallel read-only inventory of all 431 settings defined in code (copy kept at ~/agents/006/settings-code-inventory-2e5bed57-2026-09-30.md) adds these findings, not double-counted above:
weekendBookingCutoff, videoTourLink, maintenance.ratingPromptEnabled, and looks for pmActionReminders at the wrong level.Settings inventory: read from the app's single settings list in the code, as of 2026-09-29, cross-checked against the commit that introduced each one. 61 of the 88 client-choice settings were all added on the same day (2026-09-11), the day that list was first built; the rest were added individually since then as specific client needs came up (ring lists, recording, renewal terms, and similar).
Rollout-switch on/off status: read directly from the live production database (read-only lookups), one company at a time, on 2026-09-29. Test and sandbox companies were excluded from the count. The reader was checked against known-on settings elsewhere to confirm it wasn't silently failing.
PR count: a text search over merged pull requests since 2026-08-30 for wording like "default off," "ship dark," or "shipped dark." This will undercount, because a standard label for this was only required starting 2026-09-28 — before that, people described it in their own words or not at all.
Three settings were left "unclear" rather than forced into a bucket: a staff reminder-email setting, a setting that copies client notices to our own staff, and a setting for how a transferred call counts as picked up. Each behaves a little like a client choice and a little like leftover rollout plumbing; worth a quick read before the cleanup batches in option A.
| Setting (code name) | Class | Added |
|---|---|---|
call_routing.v2 | Rollout switch | 2026-09-23 |
external_forward.via_bridge | Rollout switch | 2026-09-23 |
record_transferred_legs | Rollout switch | 2026-09-20 |
dispatch.roster_walk.enabled | Rollout switch | 2026-09-21 |
leasing.locationFactsEnabled | Rollout switch | 2026-09-28 |
leasing.tourTimeRangesEnabled | Rollout switch | 2026-09-29 |
leasing.applicationLinkClaraTexts | Rollout switch | 2026-09-29 |
human_handoff.text_on_ring | Rollout switch | 2026-09-20 |
pm_action_reminders.enabled | Unclear | 2026-09-19 |
human_handoff.acceptMode | Unclear | 2026-09-21 |
notifications.staffObserverBcc | Unclear | 2026-09-24 |
| (88 more) | Client choice, identity, or legal rule | mostly 2026-09-11, plus ongoing additions |
Full list of the 88 client-choice settings is in the code's settings registry, not reproduced here — they cover things like office hours, tour rules, phone routing, fees, screening, fair-housing text, and per-company identity (property email, caller ID, brand name, and similar).