An independent product exploration of a small operational problem: a handover can preserve what happened while losing the decision that made somebody wait, act or deliberately leave a system alone.
The useful context is usually the first thing to disappear
An alert, a deployment and an incident log can tell the next person what happened. They do not always explain why somebody chose to wait instead of rolling back, or what would make that decision no longer hold.
The prototype keeps that missing context small: the decision, the reason it was appropriate at the time and one condition for reopening it.
A handover should contain decisions, not an archive
The queue carries three active decisions forward. Each has an owner, a short rationale and a review condition. Routine events stay out of the queue because they do not require later interpretation.
The interaction is intentionally dense but quiet. A new operator should be able to scan what still matters without reading through every action from the previous shift.
The hard state is when the condition becomes true
The checkout example is where the idea gets tested. The system knows that a latency condition was crossed, but it does not convert that signal into an automatic rollback.
Instead, it changes the decision state and makes the original reasoning available at the point where a person needs to reassess it. The action records a local outcome in the prototype, not a live operational command.
The boundary matters as much as the mechanism
A receipt is not useful for every routine action. Requiring one for all changes would make a handover into another inbox.
The final state makes the rule explicit: write a receipt when a choice carries risk, cost or a service-level consequence and when someone can name what would make that choice worth revisiting.
What changed is not why.
A handover surface for decisions that are still active when their original context has disappeared.
Keep traffic at 25%
Error rate was recovering after the cache change. A rollback would create a second unknown while the incident was already stabilising.
Revisit if p95 latency stays above 1.2 s for 10 minutes.
The original decision is still active, but its reason to wait is no longer true.
The interface is a coded product hypothesis. Names, times and operational readings are fictional, included to test the handover states rather than claim a live integration.