← back to Designerwallcoverings
TK-10895: hardened Tranche B executor for the verified 269
d5d3db4637193c334dadedc5cd59c9929ee1bb00 · 2026-09-10 09:24:08 -0700 · Steve
Separate from tk10895-trancheB-golive.mjs (parallel session, 234 scope, worklist
quarantined UNSAFE-DO-NOT-RUN). Key difference: this executor does not trust its
worklist. It re-reads the per-SKU evidence CSV and aborts the whole run if any row
fails, because three independent defect classes were found on this ticket and each
was invisible to the others:
G1 unit mill_unit=PER_ROLL AND yards=5 (an 11-yd pattern exists in this line)
G2 cost cell cost_cell_clean=YES (loader took token 1 of $172/$136, $216-$266)
G3 cost row cost_row_type_clean=YES (joined to the sheet FABRIC row, not its WP twin)
The standing abs(our_price - cost/0.65/0.85) check is structurally blind to all
three: it only proves the derivation is self-consistent with whatever cost was parsed.
All six guards proven to fire against poisoned inputs, with a clean control that
passes. Full 269 dry-run: 269 would add, 0 GET failures, 0 skips, 0 warnings.
Per-SKU widths (11 distinct labels, 18in-28in), not a hardcoded 27in.
DRY-RUN by default; --apply is Steve-gated and has not been run.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Files touched
A scripts/tk10895-trancheB-golive-269.mjs
Diff
commit d5d3db4637193c334dadedc5cd59c9929ee1bb00
Author: Steve <steve@designerwallcoverings.com>
Date: Thu Sep 10 09:24:08 2026 -0700
TK-10895: hardened Tranche B executor for the verified 269
Separate from tk10895-trancheB-golive.mjs (parallel session, 234 scope, worklist
quarantined UNSAFE-DO-NOT-RUN). Key difference: this executor does not trust its
worklist. It re-reads the per-SKU evidence CSV and aborts the whole run if any row
fails, because three independent defect classes were found on this ticket and each
was invisible to the others:
G1 unit mill_unit=PER_ROLL AND yards=5 (an 11-yd pattern exists in this line)
G2 cost cell cost_cell_clean=YES (loader took token 1 of $172/$136, $216-$266)
G3 cost row cost_row_type_clean=YES (joined to the sheet FABRIC row, not its WP twin)
The standing abs(our_price - cost/0.65/0.85) check is structurally blind to all
three: it only proves the derivation is self-consistent with whatever cost was parsed.
All six guards proven to fire against poisoned inputs, with a clean control that
passes. Full 269 dry-run: 269 would add, 0 GET failures, 0 skips, 0 warnings.
Per-SKU widths (11 distinct labels, 18in-28in), not a hardcoded 27in.
DRY-RUN by default; --apply is Steve-gated and has not been run.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
---
scripts/tk10895-trancheB-golive-269.mjs | 144 ++++++++++++++++++++++++++++++++
1 file changed, 144 insertions(+)
diff --git a/scripts/tk10895-trancheB-golive-269.mjs b/scripts/tk10895-trancheB-golive-269.mjs
new file mode 100644
index 0000000..75b076e
--- /dev/null
+++ b/scripts/tk10895-trancheB-golive-269.mjs
@@ -0,0 +1,144 @@
+#!/usr/bin/env node
+// TK-10895 Tranche B go-live — 269 verified China Seas hand-print wallpapers.
+//
+// SEPARATE FILE from tk10895-trancheB-golive.mjs on purpose: that one was written by a parallel
+// session against a 234 scope whose worklist is quarantined (UNSAFE-DO-NOT-RUN). Do not merge them.
+//
+// The difference that matters: this executor DOES NOT TRUST ITS WORKLIST. It re-reads the per-SKU
+// evidence CSV and re-asserts every row before a single write, then aborts the WHOLE RUN if any row
+// fails. Three independent guards, because three independent defect classes were found on this
+// ticket and each was invisible to the others:
+// G1 unit — mill_unit=PER_ROLL AND mill_yards_per_roll=5 (roll length; 11-yd pattern exists)
+// G2 cost cell — cost_cell_clean=YES (loader silently took token 1 of "$172/$136", "$216 - $266")
+// G3 cost row — cost_row_type_clean=YES (joined to the sheet's FABRIC row, not its WP twin)
+// A price that is self-consistent with a wrong cost passes the old abs() check perfectly.
+//
+// DRY-RUN by default. --apply performs LIVE customer-facing writes and is Steve-gated.
+
+import fs from 'fs';
+
+const SHOP = 'designer-laboratory-sandbox.myshopify.com', VER = '2024-10';
+const TOK = fs.readFileSync(process.env.HOME + '/Projects/secrets-manager/.env', 'utf8')
+ .match(/^SHOPIFY_FULL_ACCESS_TOKEN=(.+)$/m)[1].trim().replace(/^["']|["']$/g, '');
+
+const APPLY = process.argv.includes('--apply');
+const LIMIT = (() => { const i = process.argv.indexOf('--limit'); return i > -1 ? +process.argv[i + 1] : 0; })();
+const EVI = process.argv.indexOf('--evidence');
+const EV = EVI > -1 ? process.argv[EVI + 1]
+ : process.env.HOME + '/.claude/yolo-queue/evidence/TK-10895/TrancheB-per-sku-evidence-20260910.csv';
+const WLI = process.argv.indexOf('--worklist');
+const WL = WLI > -1 ? process.argv[WLI + 1]
+ : process.env.HOME + '/.claude/yolo-queue/evidence/TK-10895/trancheB-worklist-269.json';
+const MAP = process.env.HOME + '/.claude/yolo-queue/executed-reversible/TK-10895-trancheB-rollback-map.jsonl';
+
+// ---- parse evidence CSV (quoted fields) ----
+function parseCsv(txt) {
+ const rows = []; let row = [], f = '', q = false;
+ for (let i = 0; i < txt.length; i++) {
+ const c = txt[i];
+ if (q) { if (c === '"' && txt[i + 1] === '"') { f += '"'; i++; } else if (c === '"') q = false; else f += c; }
+ else if (c === '"') q = true;
+ else if (c === ',') { row.push(f); f = ''; }
+ else if (c === '\n') { row.push(f); rows.push(row); row = []; f = ''; }
+ else if (c !== '\r') f += c;
+ }
+ if (f || row.length) { row.push(f); rows.push(row); }
+ const hdr = rows.shift();
+ return rows.filter(r => r.length === hdr.length).map(r => Object.fromEntries(hdr.map((h, i) => [h, r[i]])));
+}
+
+const ev = parseCsv(fs.readFileSync(EV, 'utf8'));
+const byMfr = Object.fromEntries(ev.map(r => [r.mfr_sku, r]));
+let work = JSON.parse(fs.readFileSync(WL, 'utf8'));
+
+// ---- PRE-FLIGHT: re-assert every row. Abort the whole run on any failure. ----
+const fail = [];
+for (const w of work) {
+ const e = byMfr[w.mfr];
+ if (!e) { fail.push([w.mfr, 'not in evidence CSV']); continue; }
+ if (e.decision !== 'GO') fail.push([w.mfr, `evidence says decision=${e.decision}`]);
+ if (e.mill_unit !== 'PER_ROLL') fail.push([w.mfr, `G1 unit=${e.mill_unit}`]);
+ if (e.mill_yards_per_roll !== '5') fail.push([w.mfr, `G1 yards=${e.mill_yards_per_roll}`]);
+ if (e.cost_cell_clean !== 'YES') fail.push([w.mfr, `G2 ambiguous cost cell ${e.cost_cell}`]);
+ if (e.cost_row_type_clean !== 'YES') fail.push([w.mfr, 'G3 priced off the sheet FABRIC row']);
+ if (!/^\d+$/.test(w.pid)) fail.push([w.mfr, `pid not bare numeric: ${w.pid}`]);
+ if (!(parseFloat(w.price) > 50)) fail.push([w.mfr, `price sanity: ${w.price}`]);
+ if (!/^Sold Per Single Roll - 5 Yards - [\d.]+In Wide$/.test(w.label)) fail.push([w.mfr, `label: ${w.label}`]);
+}
+console.log(`PRE-FLIGHT: ${work.length} rows · evidence rows ${ev.length} · failures ${fail.length}`);
+if (fail.length) {
+ fail.slice(0, 20).forEach(([m, r]) => console.log(` ABORT ${m}: ${r}`));
+ console.log('\nFAIL CLOSED — no writes attempted.');
+ process.exit(1);
+}
+console.log('PRE-FLIGHT PASS — G1 unit, G2 cost cell, G3 cost row all clean on every row.\n');
+
+if (LIMIT) work = work.slice(0, LIMIT);
+const sleep = ms => new Promise(r => setTimeout(r, ms));
+
+async function api(path, opts = {}, tries = 5) {
+ for (let a = 1; a <= tries; a++) {
+ try {
+ const r = await fetch(`https://${SHOP}/admin/api/${VER}${path}`, {
+ ...opts, headers: { 'X-Shopify-Access-Token': TOK, 'Content-Type': 'application/json', ...(opts.headers || {}) },
+ });
+ if (r.status === 429 || r.status >= 500) { await sleep(1500 * a); continue; }
+ const t = await r.text();
+ try { return { status: r.status, body: JSON.parse(t) }; } catch { await sleep(1200 * a); }
+ } catch { await sleep(1200 * a); }
+ }
+ return { status: 0, body: null };
+}
+async function gql(query, variables, tries = 5) {
+ for (let a = 1; a <= tries; a++) {
+ try {
+ const r = await fetch(`https://${SHOP}/admin/api/${VER}/graphql.json`, {
+ method: 'POST', headers: { 'X-Shopify-Access-Token': TOK, 'Content-Type': 'application/json' },
+ body: JSON.stringify({ query, variables }),
+ });
+ if (r.status === 429 || r.status >= 500) { await sleep(1500 * a); continue; }
+ return await r.json();
+ } catch { await sleep(1200 * a); }
+ }
+ return null;
+}
+const REORDER = `mutation r($productId: ID!, $positions: [VariantPositionInput!]!) {
+ productVariantsBulkReorder(productId: $productId, positions: $positions) { userErrors { field message } } }`;
+
+console.log(`${APPLY ? '*** APPLY — LIVE CUSTOMER-FACING WRITES ***' : 'DRY-RUN (no writes)'} — ${work.length} products\n`);
+let created = 0, skipped = 0, failed = 0, warn = 0;
+
+for (const [i, w] of work.entries()) {
+ const tag = `[${i + 1}/${work.length}] ${w.dw_sku} pid=${w.pid}`;
+ const got = await api(`/products/${w.pid}.json`);
+ if (got.status !== 200 || !got.body?.product) { console.log(`${tag} FAIL GET ${got.status} — fails closed, wrote nothing`); failed++; continue; }
+ const p = got.body.product, vs = p.variants || [];
+ if (vs.length >= 2) { console.log(`${tag} skip — ${vs.length} variants already (idempotent)`); skipped++; continue; }
+ // pre-write shape check: the lone variant must be the $4.25 sample we are adding alongside
+ if (vs.length === 1 && parseFloat(vs[0].price) > 50) { console.log(`${tag} SKIP — lone variant is $${vs[0].price}, not the $4.25 sample; unexpected shape`); skipped++; continue; }
+ if (!APPLY) { console.log(`${tag} would ADD "${w.label}" @ $${w.price} → reorder to position 1 [${w.mill_spec}]`); created++; continue; }
+
+ const mk = await api(`/products/${w.pid}/variants.json`, { method: 'POST', body: JSON.stringify({ variant: {
+ option1: w.label, price: w.price, sku: w.dw_sku,
+ inventory_management: null, inventory_policy: 'continue', taxable: true, requires_shipping: true } }) });
+ if (mk.status !== 201 || !mk.body?.variant) { console.log(`${tag} FAIL POST ${mk.status} ${JSON.stringify(mk.body).slice(0,180)}`); failed++; continue; }
+ const nv = mk.body.variant;
+ fs.appendFileSync(MAP, JSON.stringify({ ts: new Date().toISOString(), ticket: 'TK-10895', tranche: 'B-269',
+ product_id: w.pid, dw_sku: w.dw_sku, mfr: w.mfr, created_variant_id: nv.id, price: w.price, label: w.label,
+ prior_option_name: p.options?.[0]?.name ?? null,
+ undo: `DELETE /products/${w.pid}/variants/${nv.id}.json` }) + '\n');
+ const fresh = await api(`/products/${w.pid}.json`);
+ const all = fresh.body?.product?.variants || [];
+ const ordered = [nv.id, ...all.filter(v => v.id !== nv.id).map(v => v.id)];
+ const res = await gql(REORDER, { productId: `gid://shopify/Product/${w.pid}`,
+ positions: ordered.map((id, idx) => ({ id: `gid://shopify/ProductVariant/${id}`, position: idx + 1 })) });
+ const ue = res?.data?.productVariantsBulkReorder?.userErrors || [];
+ if (ue.length) { console.log(`${tag} ⚠ reorder userErrors ${JSON.stringify(ue)}`); warn++; }
+ if (p.options?.[0]?.name && p.options[0].name !== 'Size') {
+ await api(`/products/${w.pid}.json`, { method: 'PUT', body: JSON.stringify({ product: { id: +w.pid, options: [{ id: p.options[0].id, name: 'Size' }] } }) });
+ }
+ created++; console.log(`${tag} ✓ ${nv.id} "${w.label}" $${w.price} → position 1 VERIFY: https://designerwallcoverings.com/products/${p.handle}.json`);
+ await sleep(600);
+}
+console.log(`\nDONE created=${created} skipped=${skipped} failed=${failed} reorderWarnings=${warn}`);
+if (APPLY) console.log('NEXT: verify from the RENDERED STOREFRONT (not the Admin API) that position 1 is the roll price, not $4.25.');
← 46d265e auto-data-snapshot: 2026-09-10T09:22:46 (3 data files) — scr
·
back to Designerwallcoverings
·
guard TK-11357 Fix D: never stock a $0/quote-only variant in fab7c61 →