Gatekeeper: what production shows, row by row

For the 11 gatekeeper-build rows that read "merged · untested": what each switch-off rule does, what real production data shows since it merged, and a verdict.

2026-10-01, read at about 12:30Z · window 2026-09-29 00:00Z to now · read-only (DynamoDB reads and CloudWatch Logs Insights; no writes, no sends, no calls) · board: gatekeeper-build · model: collections evidence

Details

Verdicts

Row	Verdict	What prod shows
gk-maint-front-door-fallback	Shown working	13 real Western Slope calls read Maintenance off; a repair caller was connected to their own maintenance line; 0 work orders filed. Plus the two live test calls.
gk-leasing-gates	Shown working	3 live test calls, and 78 refusals that all fell inside the test building's off windows. 0 bookings at a Leasing-off building. No real-customer traffic yet.
gk-exempt-triage	Shown working	All 189 real texts and emails since 9/29 named a module or an always-on kind; 0 unlabelled.
gk-retire-overlapping-switch	Shown working	All 73 buildings that carried the old switch carry Maintenance off as a building setting; 0 log lines from the deleted readers.
gk-drafts-mode	Shown dark	0 of 11 companies and 0 of 223 buildings have ever been set to Drafts, so it changes nothing yet.
gk-appfolio-writer-gate	No traffic yet	0 maintenance writes to AppFolio at off buildings (4 at on buildings, as normal). Nothing tried to write, so the refusal has not fired.
gk-maint-inflight-quiet	No traffic yet	No in-progress PropFlow work exists at an off building. 13 rating texts at Western Slope were refused by the earlier rating gate.
gk-maint-turned-on-rule	No traffic yet	No building or company has switched Maintenance back on since the merge.
gk-maint-action-list	No traffic yet	This row is a code check that runs in CI. No real-building maintenance tool has been refused yet.
gk-renewals-gates	No traffic yet	0 renewals started, prepared or sent at Renewals-off buildings, and 0 refusals logged.
gk-settings-page	No traffic yet	No staff member has used the back-office module cards in prod.

Who is switched off right now

This is the real exposure. A gate is only tested where a module is off and traffic arrives.

Company	Buildings	Maintenance	Leasing	Renewals	Collections
Western Slope (customer)	80	off	on at 70, off at 10*	off	off
Situs (customer)	52	off	off	off	off
JPCO (customer)	2	off at 1 building	on	on	on
Test companies (Fairhaven, Module Gate Probe, Test Client Co, mirrors)	87	mostly off	mixed	mixed	mixed

* The 10 Leasing-off Western Slope buildings were created today (2026-10-01) by AppFolio discovery with the building switched out of PropFlow. Situs had 0 active conversations in the window, so Situs exercised nothing.

Row by row

gk-maint-front-door-fallback · Shown working

Behaviour. When Maintenance is off, the phone sends callers to the building's own maintenance line or team, an unknown caller is pointed to the office, email and text get one short reply, and no work order is filed. Emergencies still get the safety script.

Real customer: 13 inbound Western Slope calls, 9/29 15:02Z to 9/30 21:59Z, logged "maintenance is OFF … a call-center forward stands". One resident who called about a repair was connected to Western Slope's maintenance call center. Another, who mentioned upcoming maintenance, asked for a person and was transferred. An unknown caller's maintenance intake was refused twice in one call (#13562). 0 work orders were filed for any of these calls.
Live test calls (Fairhaven, Maintenance off): conv_0101m3sdpgfze2tttdq7cqv8fet8 (9/30 15:07Z): a repair caller was told the office handles it. conv_0001m3rqhy2tf88r6es2b3ea9ca9 (9/30 08:40Z): a carbon-monoxide caller still got evacuate, 911 and the emergency line.
Test traffic: 21 after-call checks at the Fairhaven test building logged "no work order filed — maintenance_module_off".

2026-09-30 21:59Z Voice: maintenance is OFF at PROP#<western-slope-building> — a call-center forward stands; with none, callers are told maintenance isn't handled on this line (safety carve-out unchanged)

gk-leasing-gates · Shown working

Behaviour. At a Leasing-off building Clara answers tour, reschedule and rent questions with the property-team disclosure. She does not offer or book a tour, and nothing is written to AppFolio.

Live calls at the Fairhaven test building on 2026-10-01, while its Leasing-off setting was live (02:20:58Z to 02:24:58Z):
- conv_7101m3tm8690esctjesp9k3b8ve3: tour request
- conv_0501m3tmakx3f97aa7c1x23tp0a4: reschedule
- conv_9101m3tmcyvvexettshsgqwxrvdg: rent and availability
In all three, Clara said "The property team handles leasing and tours for this property directly…" and made no offer or booking.
Refusals: 78 refusals at that test building (42 off-checks, 24 guest-card holds, 12 refused tour bookings), from 9/29 22:45Z to 10/01 02:24Z. All 78 fell inside the 7 recorded off windows, and none fell while Leasing was on.
Leak check since 9/29: 33 tours were created, 0 of them at a Leasing-off building. 0 prospects and 0 new-lease approvals were created at those buildings. All 37 Western Slope leasing messages came from buildings where Leasing is on.
Not yet shown: any real-customer refusal. 0 of 1,453 active conversations were at a real Leasing-off building.

ClaraLeasingTool: schedule_tour at property <fairhaven-test>: refusing schedule_tour — leasing.prospects_module_off

gk-exempt-triage · Shown working

Behaviour. The open "none" label is closed. Every send names its module or one of the always-on kinds. A promise or a Clara reply whose module is stored off is held, and disclosures always send.

The house replay (replay-module-send-gate.ts, read-only, 9/29 to 10/01) covered 43 real outbound texts and 146 real emails. 0 were unlabelled. 29 declared a module and 160 were an always-on kind (reactive replies, staff, human-written). 0 belonged to a module the company had off.
0 holds fired in prod. That is expected: no real reply or promise belonged to an off module. The four test companies and Western Slope are the only places a hold could have fired.

gk-retire-overlapping-switch · Shown working

Behaviour. The old rollout-stage switch is gone, and the module setting is the only switch.

73 buildings still have the dead old field. All 73 also have a building Maintenance-off setting, which was written 2026-09-29 03:41 to 04:21Z on Gera's go. No building has the old field without the new setting. Of the 73, 70 are Western Slope mirror test buildings, 2 are Fairhaven test buildings and 1 is the Western Slope front door. #13549 left the field in place on purpose.
0 log lines have referenced the deleted readers since 9/29 09:00Z. 0 work orders were created at those 73 buildings.

gk-drafts-mode · Shown dark

Behaviour. At a building set to Drafts, Clara's maintenance texts wait for staff approval. Until staff set a building to Drafts, nothing changes.

Census: 0 of 11 companies have a Drafts mode stored, and 0 of 223 buildings have a Drafts setting, live or in history. No Drafts setting has ever been written. 0 send-door refusals with reason module_drafts.
Before a customer is armed, the row's own note still applies: run a bench text test at a test building and re-measure topic-check recall.

gk-appfolio-writer-gate · No traffic yet

Behaviour. At a Maintenance-off building PropFlow writes nothing to AppFolio for maintenance. That covers create, note, update and close, plus the dev catalog, close-all and turnover move-out writes.

Leak check: 0 work-order flushes to AppFolio at any Maintenance-off building since 9/29. The control: 4 flushes at an on test building (Sandbox), so the pipeline is running. The last flush at an off building was 2026-09-28 17:22Z, before this gate merged. It came from a work order created by the after-call sweep at Western Slope, 45 minutes before that sweep's own gate (#13227) merged. That is the leak these rows were built to close.
Why no refusal yet: nothing tried. Every new Western Slope work order came from AppFolio (15 since 9/29, all mirrored in), and PropFlow skipped dispatching every one of them. Logs show 0 MaintenanceModuleOffWriteRefused lines.

2026-09-30 23:10Z WoEnrichDispatch: WO wo_appfolio_<id> dispatch skipped (maintenance_module_off)

gk-maint-inflight-quiet · No traffic yet

Behaviour. Reminders, status relays, vendor completion messages and vendor chases stop for work already in progress at an off building.

No PropFlow-dispatched work is in progress at any off building, so this row's own legs had nothing to stop. In the window, every maintenance comms, vendor-completion and chase log line came from the nightly maintenance bench at an on test building.
Related, and not this row's code: 13 rating texts for completed Western Slope work orders were refused (9/30 01:59Z to 23:11Z) by the rating gate that predates this row (#9978).

gk-maint-turned-on-rule · No traffic yet

Behaviour. When Maintenance is switched back on, work created before that moment is treated as off.

0 Maintenance off-to-on flips since the merge. No company carries a stored on-moment. The only building flips back to on were two Fairhaven test toggles on 9/26, before the rule existed. The rule first applies on the next real flip.

gk-maint-action-list · No traffic yet

Behaviour. Every action tool declares its module, and a syntax-tree test fails any write tool that can act before its own module's refusal.

This is a code check, and its proof is the CI gate on main. At runtime, the only tool refusals were the Fairhaven test building's tour refusals (see the leasing row). No maintenance tool was refused at a real building, and 0 Clara-created work orders were made at an off building.

gk-renewals-gates · No traffic yet

Behaviour. At a Renewals-off building nothing is prepared in AppFolio, no renewal auto-starts or rolls to month-to-month, Clara's renewal tools refuse, and in-flight renewals close quietly.

0 renewal-off refusal lines in any log group.
The daily auto-start covers only one JPCO building, where Renewals is on. On 9/30 it rolled one lease to month-to-month there, which is correct.
4 renewal records appeared at Renewals-off buildings since 9/29 (3 Situs, 1 Western Slope). Each only notes a move-out notice read from AppFolio. Each opened and closed at the same instant, with nothing prepared or sent.
0 renewal messages went to Western Slope or Situs. The control: JPCO, where Renewals is on, received 3.

gk-settings-page · No traffic yet

Behaviour. In the back office, staff set each module to Off, Drafts or Live, per company and per building.

Since the cards merged on 9/30, module setting writes came only from AppFolio discovery (10 new Western Slope buildings) and the bench script (5 Fairhaven windows). 0 came from the cards. No company record has changed since 9/30.

Side notes (not leaks)

The prod table holds 11 send-door refusal records, all stamped env=local. Nine are deliberate probes at the Module Gate Probe test company (9/29 16:25 to 16:40Z). Two are at the Western Slope front door (9/30 03:19Z and 03:25Z) with no module recorded. All 11 are refusals, so nothing went out. 0 records are stamped env=prod. A prod-wide count of these records includes these 11.
4 Western Slope renewals have sat at "offer prepared" since 9/11 and 9/12, before the gate. Nothing has touched them since.

How this was measured

Module state: propflow-prod Organization rows (settings.enabledModules) and each building's live and history ATTACH#setting# rows, folded as company AND building-in-PropFlow AND building module. Leaks: WorkOrder rows (created and lastSyncFlushAt since 2026-09-28 23:59Z, by source), Tour, Prospect, renewal and NewLeasePackageReview rows, DispatchDecision rows, and MODULE_REFUSAL# rows. Sends: scripts/eval/replay-module-send-gate.ts --since 2026-09-29 --until 2026-10-01 run read-only on origin/main (0154406). Logs: CloudWatch Logs Insights on /propflow/vercel/runtime (production only), /aws/ecs/propflow-renewal-worker-prod and the prod lambdas (appfolio-sync, agent-runtime, inbound-processor, renewal-outreach). Each row is credited only with log lines its own PRs emit. Older gates are named as such. Resident names, phone numbers, AppFolio ids and company ids are left out.