Hazardous sequences of vulcanian explosions are thought to result from the repeated emplacement and destruction of degassed, highly crystalline magma plugs in the shallow conduit of arc volcanoes. The processes governing the timing and magnitude of these explosions are thought to be related to magma ascent rate and efficiency of degassing and crystallisation. We study a rare suite of time-constrained ballistic bombs from the 2004–2010 period of activity of Galeras volcano to reconstruct magma plug architecture prior to six individual vulcanian explosions. We find that each plug was vertically stratified with respect to crystallinity, vesicularity and melt volatile content, melt composition and viscosity. We interpret this structure as resulting from multiple bubble nucleation events and degassing-driven crystallisation during multi-step ascent of the magma forming the plug, followed by spatially variable crystallisation within the plug under contrasting conditions of effective undercooling created by degassing. We propose that the shallow conduit evolved from more open degassing conditions during 2004–2008 to more closed conditions during 2009–2010. This resulted in explosions becoming smaller and less frequent over time during 2004–2008, then larger and more frequent over time during 2009–2010. This evolution was controlled by changing average ascent rates and is recorded by systematic changes in plagioclase microlite textures. Our results suggest that small volume vulcanian explosions (~ 10
5
m
3
) should generally be associated with longer repose times (hundreds of days) and produce ballistics characterised by small numbers of large, prismatic plagioclase microlites. Larger volume vulcanian explosions (~ 10
6
m
3
) should be associated with shorter repose times (tens of days) and produce ballistics characterised by high numbers of small, more tabular plagioclase microlites.
Electronic supplementary material
The online version of this article (10.1007/s00445-018-1260-y) contains supplementary material, which is available to authorized users.