`verification/tk11114-remediation/ROLLBACK-MAP.md`

39 lines
# TK-11114 — Rollback Map (written BEFORE any mutation)

**Agent:** iterm-tk11114-george-repair · **Finalizer:** /root · delegation_chain `/root → iterm-tk11114-george-repair` (depth 1)
**Written:** 2026-09-02 (pre-mutation) · **Local git HEAD at capture:** `7c99f88`
**Store:** designer-laboratory-sandbox.myshopify.com (LIVE prod; legacy misnomer) · Admin API 2024-10
**Prod service:** dw-signup-fulfillment (Kamatera 45.61.58.125, `/root/Projects/dw-signup-fulfillment`, pm2, PORT 9862, DRY_RUN=0, PUBLIC https://signup.designerwallcoverings.com)

## Confirmed root cause (digests only — see before-george-cred-digests.txt)
The running prod pm2 process carries a **stale `GEORGE_BASIC_AUTH` process.env override**
(`len=36 last4=eB6P sha8=bd3d134d`) that mismatches George's current on-host Basic-auth
(`/root/DW-Agents/gmail-agent/.env` → `len=38 last4=DKJO sha8=29398480`). `config.js#firstEnv`
prefers `process.env` over the file, so every service→George `/api/send` authenticates with the
wrong password → **401 → 100% send failure**, and the error is **swallowed**. Secondary drift:
deployed `lib/email.js` (`5d35165a`) omits `message_class:'transactional'` present at HEAD
(`68f58a04`) — corrected by the same file sync.

## Mutations this task performs (each with a recorded undo)

| # | Change | Where | Undo |
|---|---|---|---|
| 1 | Add credential-safe failure logging to `lib/email.js` + `lib/verify.js` (+ a focused test) | LOCAL working tree, committed | `git revert <fix-sha>` (or `git checkout <prev-sha> -- lib/email.js lib/verify.js`) |
| 2 | Copy approved `lib/email.js` + `lib/verify.js` to prod, **with timestamped backups** `lib/email.js.tk11114.bak.<ts>` / `lib/verify.js.tk11114.bak.<ts>` on Kamatera | Kamatera `/root/Projects/dw-signup-fulfillment/lib/` | `cp lib/email.js.tk11114.bak.<ts> lib/email.js` (same for verify.js) then restart |
| 3 | Clear the stale `GEORGE_BASIC_AUTH` process.env override + restart ONLY `dw-signup-fulfillment` (via `--update-env` from a shell WITHOUT `GEORGE_BASIC_AUTH`, so config falls through to the correct on-host DKJO file) | Kamatera pm2 | `pm2 restart dw-signup-fulfillment` returns the service to running; if the override is ever wanted back it is re-exportable (it is NOT — it was the bug). Prior process env recorded in before-george-cred-digests.txt |
| 4 | ONE controlled R4 test customer, Steve-owned `steve+dwgolive-tk11114-<ts>@designerwallcoverings.com` (fires the already-registered customers/create webhook) + its `verified-sample` tag / `custom.sample_verify_sent` / `custom.sample_verified` metafields | LIVE Shopify store | `DELETE /admin/api/2024-10/customers/<TEST_ID>.json` (hard-deletes customer + its tags/metafields). Test id recorded in `test-customer.json` |

- **No webhook created/deleted** (customers/create already exists since 2026-08-06 → nothing to revert there).
- **Only `dw-signup-fulfillment` is restarted.** No other pm2 process is touched.
- **No backfill / list send / other Shopify or dw_unified write / DNS / remote push.**

## Critical-failure policy (brief action #4)
On ANY critical R4 failure: (a) restore the prod file backups (`.tk11114.bak.<ts>`) and restart
`dw-signup-fulfillment`; (b) delete the test customer by recorded id; (c) report PARTIAL/BLOCKED
with evidence. Never leave prod in a half-repaired state silently.

## Gate note
The prod file copy + pm2 restart are prod writes/exec. If the local Claude Code classifier blocks
autonomous prod SSH writes, the EXACT commands are drafted for Steve/finalizer to paste (`!`), and
the tab is orange-dotted. Nothing about the gate is loosened by this delegation.