`verification/tk11285/DEPLOY-RUNBOOK.md`

56 lines
# TK-11285 deploy runbook — approved by Steve 2026-09-10 (all 5 commits)

Master is at `a95eaa2`. Local suites green: trade-approval 27/27, commitRows 9/9,
DRY_RUN selftest pass. Delete-guard dry-run against prod: PASS.

## STEP 1 — back up prod's live applications (do this first)

```sh
ssh root@45.61.58.125 'cd /root/Projects/dw-signup-fulfillment && cp -a data/trade-applications.jsonl data/trade-applications.jsonl.predeploy-$(date +%Y%m%dT%H%M%S) && ls -la data/trade-applications.jsonl*'
```

## STEP 2 — deploy

```sh
cd ~/Projects/dw-signup-fulfillment && bash ~/Projects/_shared/scripts/deploy.sh
```

Expect: delete-guard `✓ no runtime data at risk`, one deletion
(`lib/retail-webhook.js.bak.1788467958`, a stale backup), pm2 reload, `/healthz` 200.

If the delete-guard aborts, STOP and re-read it — do NOT set `DEPLOY_ALLOW_DELETE=1`.
That override is what would destroy the applications.

## STEP 3 — verify (NOT with npm test)

```sh
ssh root@45.61.58.125 'curl -s http://127.0.0.1:9862/healthz; echo; cd /root/Projects/dw-signup-fulfillment && grep -c DECISION_OWNED lib/trade.js && wc -l data/trade-applications.jsonl && pm2 logs dw-signup-fulfillment --lines 20 --nostream'
```

Expect: `healthz` ok with `"dry_run":false`; `grep -c DECISION_OWNED` = **2** (the fix landed);
`wc -l` = **23** (applications intact — this is the number that must not change).

⛔ Do NOT run `npm test` / `npm run selftest` on prod. `selftest.js` snapshots the real store,
writes its own rows into it, and restores the snapshot on exit — not gated by DRY_RUN. It will
destroy whatever arrived during the run.

## ROLLBACK

Code only — never revert the JSONL wholesale:

```sh
cd ~/Projects/dw-signup-fulfillment && git revert --no-edit a95eaa2 5fd4868 && bash ~/Projects/_shared/scripts/deploy.sh
```

If applications themselves look wrong, restore the STEP 1 backup by name (do not use an
older recovery-bak):

```sh
ssh root@45.61.58.125 'cd /root/Projects/dw-signup-fulfillment && ls -la data/trade-applications.jsonl.predeploy-*'
```

## NOT authorized by this deploy

A real customer / Shopify / email canary needs its own separately named approval.
Deploying does not authorize approving a live trade application as a test.