Turnover money decisions went deterministic — shipped, deleted the old path, proved it live, and fixed the one thing the proof caught

The single-pass sampled projection is gone. Production now runs the ladder — one LLM call reads the walk, pure TypeScript makes every money call, an opus judge + unanimity panel handle only genuine ambiguity (ADR-0121, accepted; #5002 implementation, #5060 legacy deletion, English-language walks only by declared scope).

Live production proof (The Willows, real walk through the real endpoint): a vendor-dispatch ask minted a work task with no charge line; "charge the tenant $150 for cleaning" survived verbatim as a tenant charge; an ambiguous stain produced a "Who pays?" question instead of a silent zero. The judge never fired — code decided all three. Full numbers: before/after report.

6 of 13 identical prod runs returned a silently empty projection — the whole walk vanished behind a healthy-looking record, and placeholder junk reached PM-visible summaries. The replay corpus couldn't see this (it replays stored extractions). Fix shipped (#5075 + #5089): forced tool call + one retry, a junk-summary guard (zero false positives against all 22 real stored summaries), and a loud failure instead of persisting an empty draft. Re-verified: 0 silent-empties and 0 placeholders in 10 prod runs. The fix also closed a pre-existing wedge where any projection failure would have parked a voice-driven walk forever.

Your "Willows under Camellia" screenshot unraveled into: any authed user in any org could read Camellia's live invoice totals (/api/costs), confirm cross-org purchase-order bindings, and read metric history. All three fixed and prod-verified (#5038, #5041, #5059), then a sweep of all 97 property-id-reading routes fixed 10 more unscoped verbs across 8 routes — including a cross-org cascade delete — with bidirectional guard tests and a CI tripwire so new routes need a recorded verdict.

Held deliberately (decision 2 below): the app has no org-scope envelope at all — org_admin is unbounded on property/unit/work-order detail routes, and POST /api/turnovers has no auth check behind the session gate. Fixing it touches shared helpers across dozens of surfaces.

Not the overnight agents (all 196 transcripts rode subscription auth). CI eval workflows billed the metered production key on every PR (~$28–32 across 24 PRs), and promptfoo's graders billed it implicitly even when completions didn't. Now (#5055, #5070): every eval lane runs on the subscription bearer, the production key is absent from CI entirely, and two drift rules enforce it — the allowlist for metered use is empty, and the one declared exception (nightly trace-replay) must announce itself in-scope. Verified by credential log lines in every lane.

• "Duplicate" prod SMS sends — mostly a Twilio same-account logging artifact, but two real bugs found and fixed: Clara answering its own harness texts, and no idempotency receipt on handyman pages (#5052).
• Purchase orders — the 20-agent UX panel picked its home: Maintenance → Purchase Orders nav row + list + detail, command-palette search first, no lifecycle rail yet (panel verdict). Mining the surface found the live Costs numbers aren't defensible (the parser double-counts repeated amounts and silently zeroes anything ≥ $100k) plus PO-queue dead ends — handoff: Trello card, top of This Week.
• Charge-profile mining — deny-list keeps NSF/fee noise out of "typicals"; a $25 NSF-polluted typical re-mined to the real $87.79 (#4999).
• Harness honesty — walk+approve single-conversation scoping, truthful-cancel guard, tool-offer/routability drift test, flooring→carpet category fix, silent-zero → PM question (#5017/#5018/#5030/#5034 et al.), harness 12/12 green.

• Second-walk charges re-stage (#5110) — a follow-up walk now amends only the difference against a new per-line staged-charge ledger (the ledger ADR-0121 asks for by name); shrunk lines fail loud, unpriced findings still ask the PM. Prod delta-walk e2e deferred — it requires filing real charges on an AppFolio move-out draft.
• Org-scope envelope — ADR-0120 accepted and merged (#5109): org envelope before property scope, org_admin bounded to its org, no-auth routes become a build error, staged migration for the 21 legacy routes.
• PO sync arming prerequisites (#5111) — truncated fetches can no longer mark real POs removed, and truncation now shows on po-sync-health. Demo-seed teardown ran and verified zero, but a concurrent bench session re-seeded the 9 demo rows ~20 min later — teardown is idempotent, one command when that session finishes. PO mode remains armed nowhere.