TK-11285: deploy runbook with pre-deploy backup, verify, and rollback

fea5a31d7b06d46d378726164c4cd2f0113a6c58 · 2026-09-10 08:19:21 -0700 · Steve Abrams

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01NEDp3MXiKVJ5GDKaQCHZon

Files touched

A verification/tk11285/DEPLOY-RUNBOOK.md

Diff

commit fea5a31d7b06d46d378726164c4cd2f0113a6c58
Author: Steve Abrams <steve@designerwallcoverings.com>
Date:   Thu Sep 10 08:19:21 2026 -0700

    TK-11285: deploy runbook with pre-deploy backup, verify, and rollback
    
    Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
    Claude-Session: https://claude.ai/code/session_01NEDp3MXiKVJ5GDKaQCHZon
---
 verification/tk11285/DEPLOY-RUNBOOK.md | 55 ++++++++++++++++++++++++++++++++++
 1 file changed, 55 insertions(+)

diff --git a/verification/tk11285/DEPLOY-RUNBOOK.md b/verification/tk11285/DEPLOY-RUNBOOK.md
new file mode 100644
index 0000000..73c1cb1
--- /dev/null
+++ b/verification/tk11285/DEPLOY-RUNBOOK.md
@@ -0,0 +1,55 @@
+# TK-11285 deploy runbook — approved by Steve 2026-09-10 (all 5 commits)
+
+Master is at `a95eaa2`. Local suites green: trade-approval 27/27, commitRows 9/9,
+DRY_RUN selftest pass. Delete-guard dry-run against prod: PASS.
+
+## STEP 1 — back up prod's live applications (do this first)
+
+```sh
+ssh root@45.61.58.125 'cd /root/Projects/dw-signup-fulfillment && cp -a data/trade-applications.jsonl data/trade-applications.jsonl.predeploy-$(date +%Y%m%dT%H%M%S) && ls -la data/trade-applications.jsonl*'
+```
+
+## STEP 2 — deploy
+
+```sh
+cd ~/Projects/dw-signup-fulfillment && bash ~/Projects/_shared/scripts/deploy.sh
+```
+
+Expect: delete-guard `✓ no runtime data at risk`, one deletion
+(`lib/retail-webhook.js.bak.1788467958`, a stale backup), pm2 reload, `/healthz` 200.
+
+If the delete-guard aborts, STOP and re-read it — do NOT set `DEPLOY_ALLOW_DELETE=1`.
+That override is what would destroy the applications.
+
+## STEP 3 — verify (NOT with npm test)
+
+```sh
+ssh root@45.61.58.125 'curl -s http://127.0.0.1:9862/healthz; echo; cd /root/Projects/dw-signup-fulfillment && grep -c DECISION_OWNED lib/trade.js && wc -l data/trade-applications.jsonl && pm2 logs dw-signup-fulfillment --lines 20 --nostream'
+```
+
+Expect: `healthz` ok with `"dry_run":false`; `grep -c DECISION_OWNED` = **2** (the fix landed);
+`wc -l` = **23** (applications intact — this is the number that must not change).
+
+⛔ Do NOT run `npm test` / `npm run selftest` on prod. `selftest.js` snapshots the real store,
+writes its own rows into it, and restores the snapshot on exit — not gated by DRY_RUN. It will
+destroy whatever arrived during the run.
+
+## ROLLBACK
+
+Code only — never revert the JSONL wholesale:
+
+```sh
+cd ~/Projects/dw-signup-fulfillment && git revert --no-edit a95eaa2 5fd4868 && bash ~/Projects/_shared/scripts/deploy.sh
+```
+
+If applications themselves look wrong, restore the STEP 1 backup by name (do not use an
+older recovery-bak):
+
+```sh
+ssh root@45.61.58.125 'cd /root/Projects/dw-signup-fulfillment && ls -la data/trade-applications.jsonl.predeploy-*'
+```
+
+## NOT authorized by this deploy
+
+A real customer / Shopify / email canary needs its own separately named approval.
+Deploying does not authorize approving a live trade application as a test.

← a95eaa2 TK-11285: stop the deploy itself from destroying the live ap · back to Dw Signup Fulfillment · TK-10836: live checkout render blocked by mandatory customer ff9bd17 →