[object Object]

← back to Dw Validator Debug TK11314

chore: fail-closed activation guard + SQL-safety note, v-patch (session close)

911eb4d66ae7920bd23d23a2d7ff2389297a4a58 · 2026-08-11 18:50:19 -0700 · steve@designerwallcoverings.com

Files touched

Diff

commit 911eb4d66ae7920bd23d23a2d7ff2389297a4a58
Author: steve@designerwallcoverings.com <steve@designerwallcoverings.com>
Date:   Tue Aug 11 18:50:19 2026 -0700

    chore: fail-closed activation guard + SQL-safety note, v-patch (session close)
---
 package.json                                         | 2 +-
 shopify/scripts/cadence/activate-gated.js            | 3 +++
 shopify/scripts/cadence/pierre-frey-activate-drip.sh | 7 +++----
 3 files changed, 7 insertions(+), 5 deletions(-)

diff --git a/package.json b/package.json
index 2da31f47..bf20afee 100644
--- a/package.json
+++ b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "designer-wallcoverings",
-  "version": "1.2.12",
+  "version": "1.2.13",
   "description": "Designer Wallcoverings Shopify Management",
   "scripts": {
     "build": "tsc --noEmit",
diff --git a/shopify/scripts/cadence/activate-gated.js b/shopify/scripts/cadence/activate-gated.js
index e86db18e..2878a076 100644
--- a/shopify/scripts/cadence/activate-gated.js
+++ b/shopify/scripts/cadence/activate-gated.js
@@ -264,6 +264,9 @@ const SL = 'single_line_text_field';
           // intentionally ARCHIVED/DELETED before. Matching on title (not SKU) is what
           // catches a re-imported / renamed-prefix dupe that the completeness gate misses.
           // Mirrors the proven rotation-order.js guard. Fail-safe: only ever keeps DRAFT.
+          // SQL-safety: psql() uses execFileSync (no shell) and the DB runs
+          // standard_conforming_strings=on, so doubling single-quotes ('') is the complete,
+          // correct Postgres string-literal escaping for the externally-sourced title.
           const t = String(n.title || '').replace(/'/g, "''");
           const reintro = t && (psql(
             `SELECT 1 FROM shopify_products WHERE title='${t}' `
diff --git a/shopify/scripts/cadence/pierre-frey-activate-drip.sh b/shopify/scripts/cadence/pierre-frey-activate-drip.sh
index ccce06ac..c48df2eb 100755
--- a/shopify/scripts/cadence/pierre-frey-activate-drip.sh
+++ b/shopify/scripts/cadence/pierre-frey-activate-drip.sh
@@ -13,10 +13,9 @@ cd "$SHOP" || exit 1
 LOG="/tmp/dw-pierre-frey-activate.log"
 LIMIT="${PF_ACTIVATE_LIMIT:-60}"
 echo "=== $(date) pierre-frey activate drip (limit $LIMIT) ===" >> "$LOG"
-# --- re-intro guard pre-check (TK-10474): abort this tick if the guard drifted ---
+# --- re-intro guard pre-check (TK-10474): FAIL-CLOSED — abort if the guard is missing/non-exec OR trips ---
 GUARD="$HOME/Projects/dw-activation-calendar/scripts/check-reintro-guard.sh"
-if [ -x "$GUARD" ] && ! "$GUARD" >> "$LOG" 2>&1; then
-  echo "ABORT $(date): re-intro guard drift detected — activation skipped this tick" >> "$LOG"; exit 1
-fi
+if [ ! -x "$GUARD" ]; then echo "ABORT $(date): re-intro guard missing/not executable — failing closed" >> "$LOG"; exit 1; fi
+if ! "$GUARD" >> "$LOG" 2>&1; then echo "ABORT $(date): re-intro guard drift detected — activation skipped this tick" >> "$LOG"; exit 1; fi
 node scripts/cadence/activate-gated.js --vendor "Pierre Frey" --limit "$LIMIT" --commit >> "$LOG" 2>&1
 echo "exit $? at $(date)" >> "$LOG"

← 4f485a9f auto-data-snapshot: 2026-08-11T16:56:53 (1 data files) — sho  ·  back to Dw Validator Debug TK11314  ·  auto-data-snapshot: 2026-08-11T19:00:12 (1 data files) — pac 8c994be3 →