Tk10895 GroupB

- Keychain/token fetches no longer abort under set -euo pipefail, so the
  explicit missing-credential checks actually run and report.
- Pass GEORGE_TOKEN/GEORGE_BASIC via env instead of argv so the send token
  and admin Keychain password aren't visible in ps during the send.
- Successful-send behavior unchanged; only failure-path diagnostics and
  secret transport changed.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01GCskP2LLkHeL4xp2yDUyQ7

The hand-typed version had 3 of 6 rows false — 702521 is Aqua IV not Edo,
710321 is Brighton Reverse not Brighton, 717921 is Clementine All Over at 23in
not Des Gardes at 28in. It would have asked the mill to correct their pricing
using item numbers belonging to other patterns.

Rebuilt from sibling-flags.json under a hard gate (identical pattern name AND
identical width on both rows), then re-asserted every field against the sheet.
7/7 verified. Send stays an interactive confirm: George fails closed on external
recipients without a human-approval token and the agent must not extract it.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

Steve ungated; the build's own audit stopped it, which is the point.

Two guards the first sizer lacked, both proven by a negative test on a
known-bad input (Beau Rivage trips both):
  1. the sheet's Fabric/Wallpaper COLUMN is unreliable — mfr 708621 is typed
     Wallpaper while its Pattern reads 'Beau Rivage FABRIC' at the fabric cost
     $194, beside AP980-05 'Beau Rivage WP' at the real $136. The pattern-name
     suffix overrides the column.
  2. a cheaper same-pattern/same-width sibling means a likely fabric-row join.

Without these the sizer would have RAISED 6 correct Beau Rivage products from
$246.15 to $351.13, undoing today's verified fix.

Generalising guard 2 over the whole sheet finds 207 rows / 32 patterns where our
six-digit item number costs more than the mill's own code row; 139 are live.
$5,761 if the code row is the right join — recorded as a HYPOTHESIS and routed
to the vendor, not to a script: unlike Beau Rivage none of them carries an
independent falsifier.

Tranche C needs no writes: all 69 cohort-A products are already live and correct.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

Erica Nyarko (Quadrille) 2026-09-10: 'First price is the fabric, the second is
the wallpaper $Fabric/$WP.' The mill sheet's own Fabric/Wallpaper column is the
selector, so the token is chosen per-plane and not per-pattern.

- live-by-pid.mjs   read-only audit of all 31 adjudicated SKUs, keyed by product id
- reprice-erica.mjs reversible fix for the 11 live overpriced rows (dry-run default)
- erica-live-audit.json verified live state

Overturns today's fill-down ruling: the 6 Wildflowers II WALLPAPERS took the
fabric token ($172) and are live $54.30/roll over. The corroborating siblings
that appeared to confirm $172 are both F/W=Fabric — right evidence, wrong plane.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_016hho8N5fqKPc14Ec64LW9A

Light behavior-preserving cleanup: named the 0.65/0.85 margin constants, the
>10 sellable-price floor, and the 600ms write pace instead of leaving them
as bare literals; set process.exitCode=1 when any variant write/restore
fails so a partial failure can't read as success to a caller or canary.
No pricing math, API calls, dry-run default, or read-back assert changed.