`verification/tk11114/DURABLE-PERSIST-PASTE.md`

27 lines
# TK-11114 — DURABILITY close (Steve runs; gated prod config persist)

**Why:** the send is fixed + proven, but only in the RUNNING process env. The Kamatera
`ecosystem.config.js` is back to `DRY_RUN:'1'` and project `.env` still holds the stale
`WEBHOOK_URL_TOKEN=…00e1`. So the next `pm2 reload`/reboot SILENTLY reverts to dry-run (no
sends) + a token mismatch that 401s the registered webhook. This persists the correct state
so it survives a restart. (Complements the sibling's already-deployed code fix + GEORGE_BASIC_AUTH
clean-restart — this is the env-persistence piece neither pass closed.)

## Paste
```
! ssh root@45.61.58.125 'set -e; cd /root/Projects/dw-signup-fulfillment; ts=$(date +%s); cp ecosystem.config.js ecosystem.config.js.bak.$ts; cp .env .env.bak.$ts; sed -i "s/DRY_RUN: '"'"'1'"'"'/DRY_RUN: '"'"'0'"'"'/" ecosystem.config.js; WT=$(grep -E "^WEBHOOK_URL_TOKEN=" /root/Projects/secrets-manager/.env | head -1 | cut -d= -f2- | tr -d "\""); if grep -qE "^WEBHOOK_URL_TOKEN=" .env; then sed -i "s#^WEBHOOK_URL_TOKEN=.*#WEBHOOK_URL_TOKEN=$WT#" .env; else echo "WEBHOOK_URL_TOKEN=$WT" >> .env; fi; echo "ecosystem: $(grep -E "DRY_RUN" ecosystem.config.js | head -1)"; echo "env token last4: $(grep ^WEBHOOK_URL_TOKEN= .env | cut -d= -f2- | tr -d "\"" | tail -c 5)"; echo "GEORGE_BASIC_AUTH baked in ecosystem? $(grep -c GEORGE_BASIC_AUTH ecosystem.config.js) (want 0)"; env -u GEORGE_BASIC_AUTH -u WEBHOOK_URL_TOKEN -u DRY_RUN pm2 reload ecosystem.config.js --update-env; pm2 save; sleep 2; echo "== healthz =="; curl -s http://127.0.0.1:9862/healthz; echo; curl -s -o /dev/null -w "badtoken http=%{http_code} (want 401)\n" -X POST http://127.0.0.1:9862/webhooks/customers/create/bogus -H "Content-Type: application/json" -d "{}"; curl -s -o /dev/null -w "e9c9 http=%{http_code} (want 200)\n" -X POST "http://127.0.0.1:9862/webhooks/customers/create/$WT" -H "Content-Type: application/json" -d "{}"'
```

**Expected:** `DRY_RUN: '0'` · `env token last4: e9c9` · `GEORGE_BASIC_AUTH baked in ecosystem? 0` ·
`dry_run:false` · `badtoken http=401` · `e9c9 http=200`.

**Durability check after:** `! ssh root@45.61.58.125 'pm2 reload dw-signup-fulfillment && sleep 2 && curl -s http://127.0.0.1:9862/healthz'` → must STILL show `dry_run:false` (proves it survives a restart).

## Rollback
```
! ssh root@45.61.58.125 'cd /root/Projects/dw-signup-fulfillment && b=$(ls -t ecosystem.config.js.bak.* | head -1 | sed "s/.*\.bak\.//") && cp ecosystem.config.js.bak.$b ecosystem.config.js && cp .env.bak.$b .env && pm2 reload ecosystem.config.js && curl -s http://127.0.0.1:9862/healthz'
```

**⚠️ Coordinate first:** a sibling agent (codex-tk11114-remediation) has been editing this same
config in parallel. Confirm it has stood down before running, or the persist may be reverted again.