Western Slope go-live

Hours source-of-truth audit (2026-09-18)

Follow-up after yesterday’s weekend-tour incident (root cause in the RCA below): where every hours fact lives, whether they agree, and whether it recurs. Read-only prod pull, 2026-09-18. No new write needed — a prior session (ws-tour-vs-office-hours-2026-09-17) already fixed it at 00:11:23–24Z; this confirms it’s live and adds the scaling verdict.

Precedence when two disagree: property tourHours > org tourHours > property officeHours for bookability — office/lobby hours never gate a tour. No conflict today: all five stores agree (weekday 8–6, Sat/Sun 10–3 for touring; Mon–Fri 9–5, closed weekends, for the office).

Verdict

• No single source of truth — five stores, two are free text. The two structured fields are the right shape; the knowledge-prose entries are a hand-maintained copy with no code link back to them.
• Fix: render the knowledge prose FROM the settings, never type it separately — a formatter, same pattern as formatOfficeHours, instead of typing and approving the sentence by hand in the gold set.
• This is exactly how it broke: the sentence was typed from the client’s website on 09-15, never compared to the setting that already existed, and drifted two days before a live call caught it.
• Voice has no dedicated tour-hours signal — email/SMS compute both officeHours and tourHours; voice only ever computed office hours. Covered today by the prose entry and the prompt guard, both hand-maintained; give voice its own tour_hours variable instead.
• We can repeat this at the next client. Nothing stops hand-typing hours into knowledge again (the provisioning-script version already happened once, #9188/#9214). A build check that fails on hour-like text in a field with a structured setting closes this — not written yet. Diagnosis + rule: onboarding playbook.

Why Western Slope launch surfaced so many bugs — root causes (2026-09-17)

The short answer. We did not suddenly write worse code. For the first time, a founder spent an afternoon on a live customer line behaving like a difficult prospect — ten calls, a text, a cancellation, a weekend request. Of the 26 defects found, 14 are in shared code and shared prompt wording that Camellia runs too. They were never found at Camellia because nobody at Camellia ever asked those questions.

Proof that these are not new bugs. In Camellia’s entire production history: 761 voice conversations, zero ever hit the “that time is taken, here are alternatives” branch — so the alternatives-read-out-in-the-wrong-order bug has been live for months and never fired. 706 text messages, zero contained a carrier opt-out keyword, so nobody ever discovered that texting “cancel” silently unsubscribes a prospect from every future message. Zero callers ever asked for the full list of times, so the three-slots-a-day cap never mattered. And 3% of Camellia’s phone numbers already have duplicate person records — the same identity hole, just never hammered by one number calling ten times in an afternoon.

Is it the same core agent prompt? No, and that matters less than it sounds. Camellia runs two long-lived prompts inside the fleet sync. Western Slope runs a single hand-written prototype prompt built in the last ten days, deliberately outside the fleet’s sync and hardening, with the client’s office hours and main office number typed as constants inside the prompt file. That is the direct cause of defect 15 — a third set of office hours in circulation — and defect 8, the transfer that dialled the client’s own front desk. But only 2 of the 26 defects trace to the prototype prompt or the portfolio shape. The rest are shared.

“We had explicit PRs for this” — the weekend hours. Six PRs since 2026-09-08 touched tour hours (#8900, #8913, #9013, #9039, #9046, #9156). Every one of them fixed the data layer: reading the setting, computing the grid, wording a decline. #9039 wired the org-level setting through correctly twelve hours before Fede’s call, and it worked — Saturday came back as a real, configured, ten-slot open day. It was then thrown away one layer later. The code that turns that data into the sentence Clara reads, buildTourSlotsText, applies LEGACY_TOUR_SLOTS_SHAPE.maxOpenDays = 2 — a cap written before org-level tour hours existed. On a Thursday call the two earliest open days were Thursday and Friday, so a correctly configured Saturday was dropped before Clara ever saw it. Six PRs fixed the data; none touched the sentence. #9198 was the first, at 23:24Z, and #9203 superseded it the same night.

Why the knowledge base said “closed weekends.” Nobody hallucinated it. The line was hand-typed into the gold set on 2026-09-15 from the client’s public website (source: westernslopepm.com), approved, and written verbatim into the knowledge record. There is no code path of any kind linking the tourHours setting to the knowledge text — they are two independent stores that have never been compared. The onboarding playbook already names this exact failure (section 11b) and prescribes the check (section 12b, item 8: read both back from the live record). The check was never built.

Process causes. (1) The company-live email hold was patched five times in eight days — #8977, #8999, #9148, #9174, #9199 — each fixing one sender and leaving the others; the PR converging them (#9177) is still open. Defect 6 — a callback request nobody was told about — is the cost. (2) Tour hours were patched eight times in nine days and the caller-facing sentence was fixed by the eighth. (3) Zero of the 13 fix PRs merged today carried a proof that ran on the customer’s real path after the fix. Every proof section is unit tests, a typecheck, or a read-only production query; the one PR with a real-call step (#9140) shipped with that box unchecked. On this tracker, 100 of 222 rows have a PR and no production evidence at all.

The 26 defects, one row each. “What would have caught it” is the specific check that did not exist.

What we change. Three things, in order of leverage. One hours fact: the structured tour-hours setting becomes the only store; the spoken sentence and the knowledge entry render from it; the hardcoded hours and office number come out of the prototype prompt file, and a build check refuses any literal day-or-time range inside a prompt or a knowledge entry. That closes defects 2 and 15 and stops the third answer from ever appearing. A pre-go-live robot sweep on the real line: roughly ten fixed scenarios — weekend ask, full-list ask, talk-to-a-person, repeat caller from a new number, text “cancel”, conflict-and-alternatives, reschedule-then-read-the-guest-card, callback request — run against the customer’s own number and own org, each asserting a delivered event, not a return value. Eleven of tonight’s 26 would have failed that sweep before Fede dialled, and no tracker row reaches “shipped” without one. Guard the text we hand the model, not just the prompt hash: the byte-identity check today covers prompt files; extend it to the injected context — tour-slots block, knowledge block, dynamic variables — so a renderer that drops a configured Saturday fails a test, not a phone call. With it, a standing rule: the third patch to a seam converges it.

Overnight evals, 2026-09-17/18

What this is. Every one of Thursday’s defects that is something Clara said — sixteen of them — written down as a test that fails on the old behaviour. Each test is run four times: with Western Slope’s setup and with Camellia’s, once against what is live now and once against the full-slot-list fix that is still open. Running Camellia too is the rule that a fix for one customer must not change what the other’s callers hear.

How it runs. On the Claude subscription, not a paid key, so it can run every night. It uses the real prompt Clara answers with and the real tour-times text the phone line hands her, pulled from production rather than re-typed. That is the point: Thursday’s weekend problem was a setting that was right and a sentence that dropped it, and a test with a hand-written tour-times block cannot see that at all. Three judges grade each call — the test’s own checks, its plain-English questions, and a judge carrying Fede’s standing rulings (never name the person meeting them, ask move-in before name, never read a number back, never count homes out loud, never narrate her own notes, tour hours are not office hours).

Result. Live today: 8 of 32 pass. With the remaining fix: 12 of 32. By customer, live today: Western Slope 7 of 16, Camellia 1 of 16. With the fix: Western Slope 8 of 16, Camellia 4 of 16. Model claude-sonnet-4-6, run 2026-09-18T02:39:09.631Z. Every row links to the words.

What the remaining fix moves to green:

• weekend-ask-closed-weekends-knowledge on camellia
• cancel-one-save-attempt on western-slope
• greeting-matches-question on camellia
• spanish-caller on camellia

Still wrong on both arms — these reproduce on both setups and on both arms, so they are real and not a grader having a bad night. Each has an issue:

• full-list-of-times (western-slope) — banned pattern spoken — inventory-count: "Those are all the available times I have — every open slot across the next two weeks is what I just listed. Is there a particular day or time of day that works "
• full-list-of-times (camellia) — EL criteria failed: no-context-narration: The agent said 'here's everything I have listed' and 'I listed all the days and their times in my last message,' which describes what is 'listed' for it, violating the rule against saying anything a
• what-else-do-you-have (western-slope) — EL criteria failed: offers-new-times: When asked 'what else do you have,' Clara repeated the same deflecting questions without offering any tour times at all, let alone a new one not previously offered.
• what-else-do-you-have (camellia) — EL criteria failed: offers-new-times: When asked 'what else do you have,' Clara did not offer any tour times at all, let alone a new one not previously mentioned.
• morning-preference (western-slope) — EL criteria failed: morning-first: After the caller said 'Morning', Clara did not offer any specific morning tour time at all — she instead asked a follow-up question, failing to lead with a morning time as required.
• morning-preference (camellia) — Clara asked 'What's your name' before ever asking about move-in timing, violating the rule that move-in timing must be asked before a name.
• conflict-no-invented-reason (western-slope) — EL criteria failed: names-alternatives: Clara never named a specific alternative time; she only asked 'Do mornings or afternoons work better for you' without offering any concrete alternative slot.
• conflict-no-invented-reason (camellia) — Clara announced 'Saturday tours start at 1:00 PM' as the reason to deny 9 AM, which violates Rule 6 by using a standing schedule/hours rule to justify denying a day — she should have said the time is not open without citing a structural clo
• alternatives-chronological (camellia) — Rule 5 is broken: Clara said 'looking at the available tour times' and 'The next available Saturday I have is September 26th' and 'I do have plenty of weekday times open,' which narrates her own internal context and plumbing rather than sim
• person-ask-becomes-message (camellia) — forbidden tools called: transfer_to_number
• after-hours-person-ask-unknown-hours (camellia) — forbidden tools called: transfer_to_number
• callback-capture-no-readback (western-slope) — EL criteria failed: captures-callback: Clara never committed out loud to getting Fred's question to the leasing team for a callback — she only said she could 'take a message and make sure the team gets it,' which is hedged and conditional,
• callback-capture-no-readback (camellia) — EL criteria failed: captures-callback: Clara never committed out loud to getting Fred's application question to the leasing team for a callback; she instead transferred the call without making any such spoken promise.
• promised-note-calls-tool (western-slope) — Rule 12 requires that routine data work like correcting a caller's own name is done, not punted to a human — Clara instead deflected with 'I don't have a previous note or record pulled up' and asked the caller to explain further rather than
• promised-note-calls-tool (camellia) — Rule 12 requires that routine data work — correcting a caller's own name — is done, not punted to a human or stalled with clarifying questions; Clara's response 'I don't have a previous message or context here that mentions Fred or a note.
• name-correction-done-not-punted (camellia) — Rule 4 is broken: Clara stated 'we don't have any two-bedrooms available right now,' which is a count/availability statement ('zero') about homes/units, and further Rule 12 is broken because Clara never corrected the caller's name in the sy
• cancel-one-save-attempt (camellia) — Rule 9 allows one save attempt maximum, but Clara made a second attempt by saying 'Let me know if you'd like to set up another time!' and then 'Feel free to reach out anytime if you'd like to reschedule!' after the caller had already declin
• no-re-ask (western-slope) — Rule 10 is broken: Clara re-asked 'Are you calling about a specific home you saw, or are you looking around in general?' after the caller had already implicitly answered (they were ready to book for tomorrow), and more plainly, she repeated
• no-re-ask (camellia) — Clara asked for the caller's name before ever asking about move-in timing, violating Rule 2's requirement that move-in timing be asked before a name is requested.
• spanish-caller (western-slope) — Clara answered the tour-times question by reciting fixed office-hour windows ('lunes a viernes desde las 8:00 AM hasta las 5:30 PM, y los fines de semana de 10:00 AM a 2:30 PM'), which violates Rule 6 — lobby/office hours never decide wheth

Three things the bench caught about itself, before these numbers. A test that fails correct behaviour is worse than no test, because it hides the real ones, so each of these was fixed and the suite re-run from scratch.

• Four graders were wrong, not four fixes. The first run scored worse with the fixes. The move-in-before-name rule was being read as “move-in must come first”; the callback test banned asking for a number rather than reading one back; the hours test failed Camellia for correctly reciting a schedule that has Saturday hours; and a clock time was flagged as a banned count of homes.
• The transcript was losing words. On any turn where Clara both spoke and used a tool, her sentence was dropped before the judges ever saw it — so a banned phrase said alongside a tool call scored green, and the test about promising a note graded a transcript the promise had been deleted from.
• Two settings were never pulled from production. Both properties are set to answer callers themselves, but the bench handed Clara the standing order for a property with a team to call back — the one that lets her promise a callback. And with no website on file for either, it told both customers their website was a leftover test URL. Every earlier number on this page was taken under those two.

Overnight real-line sweep — 2026-09-18 — Done, 4 of 12 passed

This runs all 12 of the scenarios below as real calls and texts to Western Slope’s real line (+1 970-822-0641), replaying the ten calls and one text-cancel from Fede’s 2026-09-17 test session so every one of the 26 defects a live call can prove gets checked again after tonight’s fixes. Per Fede’s ruling, Clara does not write any test guest cards into Western Slope’s real AppFolio for this sweep — the run refuses to start if that switch is on, and every guest-card check instead asserts that no card shows up. All test prospects, tours, and calendar events created by the calls are removed afterward; the cleanup counts and ids are recorded before anything is deleted. Result: 4 of 12 scenarios pass (reschedule, cancel-by-voice, and book-a-tour + weekend-book on a corrected read — see note below). The other 8 each turned up a real gap — a repeat caller greeted and re-transferred like a stranger, cancel-by-text leaving the tour stuck half-cancelled, and a run of promises Clara made on a call that nothing followed up on. No AppFolio guest card was written for any of the 12 calls, as required. Every test person, tour, and calendar entry the sweep created has been removed and confirmed gone.

Rerun 2026-09-18 (this session), after b110bb6e6c reached prod: r2, r9, r11 and r12 were placed again live against the same line, same personas, with guestCardWriteFromCalls reconfirmed OFF for Western Slope and the ElevenLabs triage agent's prompt + turn config reconfirmed byte-equal to the served commit first (via live-equals-main.drift.test.ts from a disposable worktree). Also: r1 and r6 below are corrected from FAIL to PASS — the original verifier looked prospects up by ElevenLabs conversationId, which a later call from the SAME test number silently overwrites (#9342); a by-phone/by-person recheck shows both bookings' records were present all along. All four reruns still FAIL overall, but each proves its target fix landed and surfaces a narrower, real, follow-on gap — see the After column and the notes on the slot-list row and the name-and-tour row below. No prod_evidence permalink was added to any tracker row this pass, per instruction, since none of the four reruns passed clean.

Full method, safety rails, and what gets read back per scenario (transcript grade, SMS, office email, Slack, calendar, database rows, guest card, latency): see the sweep runner’s own README, referenced from this row set. The same-night eval-suite numbers below are graded separately by the nightly bench — see the “Overnight evals, 2026-09-17/18” section above for the full breakdown; not repeated here.

What’s left to go live (2026-09-15, for Fede’s review)

Draft from the tracker, needs Fede’s corrections. Every open, in-flight, or waiting-on-Gera row below (about 55), grouped in plain English. Each line links to its row further down this page.

Phone line (9)

• One phone number should answer for all 14 houses, transfer by name, and never go dead on an outage, In flight (see row)
• The 970 line’s tour calendar is a shared test mailbox right now, so we cannot trust which times are actually free, Open (see row)
• Turn on the missed-call email for Western Slope, Open (see row)
• Decide how one shared phone number figures out which house the caller means, Open (see row)
• Decide the voice merge plan (six open questions) and which number to test it on, Open (see row)
• Fix a security gap: the property record stores live Outlook login tokens in plain, unencrypted text, Open (see row)
• After hours, calls should go straight to the message-taking desk instead of routing to leasing first, Open (see row)
• Record a demo call on the real line for Fede to play back to the client, In flight (see row)
• Confirmation and reminder texts currently invite a reply, but the line can’t receive one, that needs fixing, Open (see row)

Tours (4)

• Prove that booking, rescheduling, and cancelling any number of home tours works correctly on a real call, In flight (see row)
• Fix Jay’s second Tuesday tour by hand, it is missing an address and only one of his two tours exists, Open (see row)
• Jay asked for a more urgent alert than a calendar notice when a tour books, pushed straight to the leasing agent, Open (see row)
• Add Kat as a user and have her connect her own Outlook calendar so tours can book on it, Open (see row)

Leasing inbox and lead emails (8)

• We now know what actually lands in the leasing inbox and what has to change before Clara can answer it, Open (see row)
• A guest card that arrives in the company mailbox needs to land on the right house, Open (see row)
• Log every mailbox/calendar connect attempt so we stop guessing why one failed, Open (see row)
• Every lead email should land on the correct house’s guest card automatically, Open (see row)
• Get Western Slope’s leasing mailbox (leasing@westernslopepm.com) actually connected, Open (see row)
• Match each lead email to the right one of the 14 houses by its address, Open (see row)
• Get one company-level Microsoft 365 approval covering the shared leasing mailbox and the company calendar, In flight (see row)
• Three failed attempts to connect the shared leasing mailbox traced to a missing Microsoft permission, with a fix proposed above, In flight (see row)

Knowledge base (2)

• Western Slope needs to review the knowledge base, confirm it answers every leasing question, and confirm old answers never get repeated, In flight (see row)
• First-draft knowledge base is built from AppFolio and the review page was sent to Jay and Kat this week, Open (see row)

Guest cards and AppFolio (3)

• Guest cards Clara is assigned, plus syncing Clara’s notes back into AppFolio, is stuck behind an AppFolio login budget limit, Waiting on Gera (see row)
• Work-order syncing is broken for all 82 Western Slope properties (nothing is ticking them forward), Open (see row)
• On Western Slope’s side: fix Zillow so it creates AppFolio guest cards directly and clean up the duplicates this made (not a go-live blocker), Open (see row)

Listings (3)

• Listings and availability for all 14 houses should refresh automatically, with no one typing them in by hand, In flight (see row)
• Build the importer that pulls in Western Slope’s real 14-property listings feed, Open (see row)
• A cleanup task in November will fold the anchor test record into Gera’s larger re-key list, Open (see row)

Sign-in and invites (3)

• Make a typed code the default way to sign in, with a passkey or text as backup, working cleanly on real Gmail and Outlook accounts, In flight (see row)
• Run a real production invite test with Fede (invite, accept, verify, open the app) on a test company before Western Slope gets invited, Open (see row)
• Fix a gap in the membership model: right now one email address is assumed to belong to only one company, Open (see row)

Onboarding UI (3)

• A new customer’s admin should finish the setup wizard and see only what they bought, In flight (see row)
• Give our team a back-office screen to add a customer, set what they bought, and invite their admin, Open (see row)
• Proposed plan to clean up roughly 160 settings and 55 switches, with 15 decisions waiting on Fede, Waiting on Gera (see row)

Data import (2)

• Prove another company’s admin can never see a Western Slope row, on every screen, checked automatically, In flight (see row)
• Add database-level locks so that isolation is enforced automatically, not just by app logic, Open (see row)

Test bench (4)

• Every portfolio test scenario needs to pass on our test bench before we touch a live property, In flight (see row)
• Get one Twilio test phone number so six blocked test scenarios can run, Open (see row)
• Build a nightly automatic grader for Western Slope’s real calls, In flight (see row)
• Set up a weekly automatic test call against the Fairhaven test line, In flight (see row)

Other (14)

• Jay should get one weekly report for all his houses, not one email per house, Open (see row)
• All 14 Western Slope houses need to live under one company, with Jay and Jason seeing only their own, In flight (see row)
• Merge the two Western Slope test companies and bring in Jason’s real 14 properties, In flight (see row)
• Tie all 14 Western Slope properties together under one company record, In flight (see row)
• Prove every maintenance-request scenario works end to end on the test bench, twice in a row clean, Open (see row)
• We don’t actually know the state of the maintenance-request handling, the repo doesn’t say, Open (see row)
• Go-live target is Thursday September 17: Jay needs to forward 970-434-7000 to 970-822-0641, Open (see row)
• When someone asks for a person, take a message and email leasing@ instead of transferring back into their phone tree, Open (see row)
• Set the showing rules per location: bookable hours, treating same-street homes as one tour, travel time between towns, Open (see row)
• Set the question order Clara asks: move-in timing first, then budget, then open questions, with a rich guest card and context on the calendar invite, Open (see row)
• Availability should be whatever is published in AppFolio, accepting up to about 48 hours of lag; no Monday.com hookup at launch, Open (see row)
• Western Slope needs to tell us which properties are affordable or Section 8 housing, since the screening questions differ, Open (see row)
• Roles and permissions work is paused, waiting on an inventory and a handoff, Waiting on Gera (see row)
• Delete both Western Slope test companies, stand up the real one fresh, then Fede sends Jay’s invite, Open (see row)

Not on the tracker yet (from today’s sessions)

• Turning Clara’s email on for Western Slope, once we have the test-org proof
• The inbox-reader stack: the poller running on AWS, the seam that feeds it, and a harness proving it works
• Lead-flow design decisions still open on the email architecture page: matching a lead to a home, guest card vs. email reply, Zillow relays, application requests, and tour requests with proposed dates
• Turning on AppFolio’s listing syndication for Western Slope (client-side, free, part of AppFolio) so Zillow leads become guest cards
• Giving Clara the ability to write guest cards, not just read them, which is all she does today
• The 12-month leasing inbox audit itself (see the audit section above)
• Google verification for Situs Group, tracked on its own separate page

Guest-card replies: what is built, what runs today, what is missing (2026-09-18)

Brief for Fede. Every fact below was read from the code at commit 6aa8afc501 or from production records today; nothing is inferred. File and line are given so anyone can check. Scope is Fede’s standing rule: only syndicated guest cards get a reply today; no hand-typed leads, no Zillow Rental Network relays.

TL;DR. Three separate pieces exist. (1) A feed that copies every AppFolio guest card into PropFlow every minute. (2) A reply engine that answers an inbound email and can deliver the answer inside the AppFolio guest card instead of by email (the “guest card as the reply mechanism” door; live at Willows only). (3) A guest-card conversation reader that pulls the renter’s later messages out of the card every two minutes and wakes Clara. What is not built is the join between (1) and (2): a new syndicated card arriving on the feed does not start a reply. Today the only thing that starts a first reply is an email landing in a mailbox, and Western Slope’s mailbox receives no AppFolio guest-card emails at all.

0. Today’s lane: a call creates the guest card (state at 11:30 MT, 2026-09-18)

Fede paused the assigned-to-Clara build at 10:40 MT (“Let’s pause that build. For today only focus on creating the guest card”). PRs #9425 and #9483 are on hold. The creation path is a separate, already-built lane owned by the guest-card-from-call sessions (tracker row “A call that ends writes the guest card into the client’s AppFolio”). Read from production just now:

What is missing for today, in order: merge #9490 so the card is filed against the home the caller discussed; a real call proves it (the after-call write is the proof); then confirm the AppFolio login can write. Nothing in the reply brief below is needed for this lane.

1. Current state — the three pieces and how they connect

flowchart LR
  AF[(AppFolio guest cards)]
  subgraph FEED["1. Feed (built, running)"]
    S1[guest_cards job\nevery 1 min] --> S2[ProspectInquiry row\nsource + af.* fields]
    S2 -. "onFreshProspectMinted\ndeclared, never called" .-> X1((no reply))
  end
  subgraph EMAIL["2. Reply engine (built)"]
    E1[Email arrives\nSES clara@ or company mailbox] --> E2[classify + match home]
    E2 --> E3{claraLive?}
    E3 -- no --> H[held: org_not_live]
    E3 -- yes --> E4{messagingDelivery\n= pms?}
    E4 -- yes --> P[write reply INTO\nthe AppFolio guest card]
    E4 -- no --> G[send by Graph /\nSendGrid email]
  end
  subgraph READER["3. Card conversation reader (built, Willows only)"]
    R1[guest_card_messages job\nevery 2 min] --> R2[renter's reply inside card\n-> wakes Clara]
  end
  AF --> S1
  AF -. "notification email\n(only if AppFolio's own\ntoggle is on)" .-> E1
  P --> AF
  AF --> R1
  R2 --> E2
  style X1 fill:#fee,stroke:#c33
  style H fill:#ffe9c7,stroke:#b45309

2. What happens to a Western Slope lead today, by origin

flowchart TD
  L1[Syndicated lead\nZillow Rental Network / Apartments.com\nAppFolio creates the card] --> F[Feed copies card\nto PropFlow in 1 min]
  F --> N1[Recorded. No reply.\nHook not wired]
  L2[Zillow relay email\nconvo.zillow.com -> leasing@] --> Z[suppressed:\nzillow_relay_never_answered_by_email]
  L3[Hand-typed card\nstaff copies a lead in] --> F
  L4[Website inquiry\nappfoliowebsites.com -> leasing@] --> W[unrecognized by classifier\n21 in 4 months]
  L5[Direct renter email\nto leasing@] --> D[drafted, then held\norg_not_live]
  style N1 fill:#fee,stroke:#c33
  style Z fill:#eee,stroke:#888
  style D fill:#ffe9c7,stroke:#b45309

Western Slope production settings read today: claraLive unset, emailsEnabled false, smsEnabled false, observer BCC hello@propflowai.co, one mailbox attached (leasing@westernslopepm.com, connected), one calendar attached. No property carries messagingDelivery or pmsMessagingSync. Every held draft from 2026-09-16/18 was held by the company live switch, and the Zillow relay rule suppressed the rest.

3. What is missing for “syndicated guest cards only, reply through the guest card”

flowchart LR
  A[Syndicated card\narrives on feed] --> B{"MISSING 1\nis it syndicated?\nfeed row has no created-by"}
  B -- yes --> C{"MISSING 2\nnew-card trigger\nhook declared, never called"}
  C --> D[Draft first reply\nreply engine exists]
  D --> E{"MISSING 3\nmessagingDelivery = pms\nat each WS home\n(and a Clara seat in their AppFolio)"}
  E --> P[Reply written into\nthe guest card]
  P --> R[Reader picks up\nrenter's answer\nMISSING 4: pmsMessagingSync\nnot enabled at WS]
  R --> D
  style B fill:#fee,stroke:#c33
  style C fill:#fee,stroke:#c33
  style E fill:#fee,stroke:#c33

What “already built” is true and what is not. True: the reply engine, the guest-card delivery door, and the card reader all exist and run at Willows. Not true: any path where a syndicated card by itself makes Clara reply. Even at Willows a reply starts only from something inbound: an email, or a renter’s message inside a card that the reader picks up (writers/guest-card-message.ts:6: only a new prospect reply wakes Clara). A new card with no message starts nothing, and AppFolio’s notification email does not reach Western Slope’s mailbox.

4. Options (recommendation first)

1. Recommended: wire the feed to the reply engine. Build gap 2 as the seam the feed calls when a new card lands, gated by gap 1 (syndicated only) and the existing company live switch. Reuse the reply engine as-is. Delivery door stays “direct email” until 3 and 4 are enabled. Nothing new to invent; one small PR plus the in-flight setting.
2. Turn on AppFolio’s notification email at Western Slope (their toggle, sent to leasing@) and go live on the built email path. Fastest, but it depends on a client-side toggle and on email parsing we said we would retire.
3. Full guest-card loop now: options 1 plus gaps 3 and 4 at Western Slope. Needs a Clara seat and write access in their AppFolio. Right end state, not a today change.

5. Design: reply to syndicated cards from the feed (approved by Fede 2026-09-18)

Brief standalone version: /a/syndicated-guest-card-replies

Decision. Fede's ruling, 2026-09-18 evening: Clara replies only to guest cards whose oldest activity-log entry is “Guest Card Received” by System. No setting, no value, no transition path. Staff-typed cards are parked. Once the client stops typing cards, every card passes on its own.

Fede’s ruling today: replies go only to guest cards a listing site created, never a staff-typed card. The AppFolio “New Lead” email is ruled out as the trigger (Western Slope gets none). Guessing “syndicated” from the Source label is also ruled out: 772 staff-created cards and 381 System-received cards carry the same labels (Zillow, Website). The one exact signal is the card’s first activity-log entry: “Guest Card Received” by System (listing site) versus “Guest Card Created” by a staff name. None of the four guest-card reports, and no Data API columns subset of them, carries a created-by column, so this has to come off the card page itself.

flowchart TD
  A[guest_cards report\nevery 1 min] --> B{new card id\nnot seen before?}
  B -- no --> Z[skip]
  B -- yes --> C[feed calls the hosted robot\nservice's read endpoint\nread-only, logged-in session, 1-2 sec]
  C --> D[read first activity-log entry]
  D -- "System" --> E[createdBy: system]
  D -- "staff name" --> F[createdBy: staff]
  D -- "unreadable" --> U[origin_unknown\nparked, never replied to]
  E --> G[onFreshProspectMinted\ntoday: no-op, ADR-0094]
  F --> N[no reply]
  G --> H{Organization.claraLive?}
  H -- no --> N
  H -- yes --> I[reply engine\ndelivery door: direct email today]
  style F fill:#eee,stroke:#888
  style U fill:#ffe9c7,stroke:#b45309
  style N fill:#eee,stroke:#888

The feed calls the hosted robot service's read endpoint, a plain HTTP read on its already-logged-in session, about 1 to 2 seconds per call; a cold re-login happens rarely and takes up to 2 minutes once. Cost at Western Slope: 1 to 3 reads a day (new cards only). Idempotency key: card uuid. Failure mode: if the card can’t be read, the card is parked origin_unknown and never replied to—never guessed.

Rollout. Ship dark: default off, a company setting. Replay the 47 syndicated cards from the dump through the mirror org, publish the graded result on this page, then Fede flips it on.

Three decisions, answered:

Tonight’s build:

• Creator field added to the robot service's read endpoint.
• Created-by stamped on every new card.
• Hand-off wired with the System-only rule and the company live switch.
• The first-touch composer pair is finished.
• The replay driver now runs through the real path.
• A graded replay of the 47 past cards is published on this page for Fede to inspect before the switch goes on.

Replay of the 48 syndicated guest cards, real feed path (2026-09-18, updated: compose before hold)

Update to tonight's replay: the composer PR (#9425 stack) had a bug where the org-not-live hold fired at PREP time, before any reply existed — so the first pass of this replay produced 47 held intents and zero drafts to grade. That is fixed (a small PR stacked on #9425): the hold check moved to the real send door, exactly where the inbound-email lane already does it, so the reply is composed FIRST and only then held. This replay was re-run against the sandbox mirror (org_ws_mirror_test, never the real client org) with the fix in place: all 48 syndicated cards from the last 30 days now produce a fully composed reply, held at the same org_not_live door every real property gets until Fede turns it on. Nothing sent. Every row below is Clara's actual composed draft — this is what Fede is inspecting before go-live.

The gap the first pass surfaced is closed: every held intent now carries a real composed body, not just an empty intent + conversation shell. The 19 grading failures are a genuine content-quality signal (mostly Clara's follow-up replies not re-naming the home on a repeat inquiry) for the team to address before go-live — not a sign the pipeline is broken.