`CHANGES2.md`

10 lines
## Round 2 Applied
- brand-router/create-vendor-collections.js:24 — replaced the remaining hardcoded Shopify token with `BRAND_ROUTER_SHOPIFY_TOKEN` and fail-fast validation — fixes the re-review missed call-site at line 24 and the `brand-router/server.js` token patch marked `concern`.
- brand-router/create-vendor-collections.js:29 — added `BRAND_ROUTER_PASSWORD` lookup with fail-fast validation — supports the same auth env var as `brand-router/server.js`, fixing the re-review `STATUS broken` companion-client password finding.
- brand-router/create-vendor-collections.js:487 — replaced the hardcoded `admin:<password>` regenerate auth with `admin:${BRAND_ROUTER_PASSWORD}` — fixes the re-review missed call-site and P1 new issue where `/api/regenerate-html` could return 401 after the server password moved to env.
- brand-router/create-vendor-collections.js:490 — made 401 regeneration responses fatal before the Shopify page push — addresses the re-review recommendation to avoid silently pushing stale HTML when auth fails.

## Still Deferred
- Original deferred items in `CHANGES.md` remain for Steve, including real secret rotation, `.env` files, PM2 ecosystem files, Shopify/auth webhook design, database behavior changes, and other out-of-scope infrastructure.
- No tests, installs, git operations, schema changes, migrations, package bumps, or public-facing copy/HTML/CSS changes were performed per round-2 constraints.