`verification/tk11114/R4-VERIFIED.md`

30 lines
# TK-11114 — R4 E2E Proof: VERIFIED (outage fixed) · 2026-09-02

**Driver:** iterm-tk11114-webhook (Steve-assigned sole owner) · **Store:** designer-laboratory-sandbox.myshopify.com (LIVE)
**Service:** dw-signup-fulfillment (Kamatera :9862) — post-fix state `dry_run:false`, `WEBHOOK_URL_TOKEN` aligned to the registered webhook (`…e9c9`).

## What was actually broken (corrected root cause)
NOT a missing webhook. Two real faults on the LIVE send path:
1. **Verify-email send silently failed for 100% of signups** (George call failed, error swallowed) — the systemic cause of Kelly's report. Fixed by the current-code redeploy (un-swallow logging in `lib/email.js`/`lib/verify.js`) + `DRY_RUN=0`, so George now returns `status=200`.
2. **Webhook token drift** — a concurrent restart left the running `WEBHOOK_URL_TOKEN=…00e1`, mismatching the month-old registered webhook (`…e9c9`); every real Shopify delivery would have 401'd. Fixed by aligning the service env to `…e9c9` (the registered token, confirmed byte-identical sha `8ab7a3a16ad4`).

## Proof (controlled test customer 8412274655283, Steve-owned +dwgolive alias)
| Check | Verdict | Evidence |
|---|---|---|
| webhook persisted + wired | PASS | probes: bad→401, e9c9→200, 00e1→401 |
| real customers/create → handler | PASS | prod log `[webhook] customers/create id=8412274655283` |
| George send | PASS | prod log `[email] sent via George: source=retail-verify status=200`; `retail result {"ok":true,dryRun:false}` |
| verify email delivered (UTF-8-safe) | PASS | landed in steve-office inbox, subject "Confirm your email — your 3 complimentary samples are ready 🎁" |
| verify click → tag | PASS | GET verify → 200 "all set/confirmed" |
| `verified-sample` tag persisted | PASS | customer tags = `[tk11114-test, verified-sample]` |
| negative (invalid token) | PASS | bad token → 401 |
| duplicate-delivery idempotency | PARTIAL | simultaneous double-fire → 2 emails (flag not yet written); a later re-delivery correctly skips (`already_sent`). Eventual, not concurrency-safe. |
| cleanup | PASS | DELETE 200 → GET 404 |

## Remaining (GATED — not fired)
- **Backfill**: real signups that got no email during the outage window (e.g. `jolainajones@me.com`, Kelly per TK-10830) still need their verify letter re-sent. This is a **send-to-list → hard-gated**; drafted, awaits Steve. Not executed here.
- **Idempotency hardening** (optional): make the metafield write atomic/locked so a same-instant double-delivery can't double-send. Low severity.

## Attribution note (honesty)
The live service reached the correct state (e9c9 + dry_run:false) amid concurrent work by a sibling agent (codex-tk11114-remediation), which also redeployed the current code and ran its own test. I do not claim my paste alone achieved it; what is certain and proven is the **current end-to-end result works** (controlled test above).