`docs/tk-12173-versa-404-finding.md`

29 lines
# TK-12173 — "versa-designed-surfaces is a live 546-product vendor with a 404 microsite": FALSE POSITIVE

Verified 2026-09-24 (read-only; $0 — local psql, curl, free Shopify Admin GETs).

## The claim (ad-hoc audit session 9195751c, iTerm clipping)
`versa-designed-surfaces.designerwallcoverings.com` and `-internal` both 404 even though `versa-designed-surfaces`
is "a live vendor with 546 products". The suggested fix was to rebuild the microsite.

## What is actually true
| Check | Result |
|---|---|
| `versa-designed-surfaces(-internal)` hosts | 404, as reported. But `*.designerwallcoverings.com` is a **wildcard DNS** record, so every unconfigured name (for example `zzqq-nonexistent-xyz`) resolves and gets nginx's default 404. |
| all.dw `data/microsites.json` (1,067 entries) | **No** `versa-designed-surfaces` slug. The registered Versa hosts are `versa-design-surfaces(-internal)` (both 401 = gated, healthy) and `versa-commercial-wallcoverings(-internal)` (200/401, 0 products). |
| Live Shopify `productsCount vendor:'Versa Designed Surfaces'` | **0** (also 0 for `Versa Design Surfaces` and `Versa Commercial Wallcoverings`). |
| Where Versa products actually are | Under the private-label vendor **Hollywood Wallcoverings**. Spot-check: 3 of 3 `versa_catalog.shopify_product_id` values return vendor=Hollywood Wallcoverings, ACTIVE. |
| Where "546" came from | The **Versace** row total in the mirror: 454 ACTIVE + 84 ARCHIVED + 5 DELETED + 3 DRAFT = 546. Live Shopify has Versace at 541 (454 active). This fits a `%versa%` match that picked up Versace. |
| Old "Versa Designed Surfaces Wallcoverings" collection (the leak-scan hit from 2026-08-17) | No longer exists. A title `*Versa*` search returns only "Versace Wallcovering", and the storefront URL returns 301. |

## Decision
No action. Leave the 404. A public `versa-designed-surfaces` microsite would put the upstream name
(Momentum/Versa) in front of customers, which the Hollywood Wallcoverings private-label rule forbids.
The report came from a one-off audit session, not a standing canary, so there is no detector to patch.

Side note (not in scope, no change made): the public host `versa-commercial-wallcoverings.designerwallcoverings.com`
returns 200 with a generic "All Products" title and 0 products. The hostname itself still contains "versa".
Retiring it is a DNS/vhost change, so that decision stays with Steve.

Second-model check: local `ask-openai` agreed (false positive; the 546 is a Versace query artifact).