`MORNING-HANDOFF-2026-05-26.md`

117 lines
# Morning Handoff — 2026-05-26

Read this before coffee. Run the scripts after.

---

## 1. The 30-Second Read

- **wallco.ai is crash-looping (135 pm2 restarts).** Root cause: two handlers (`server.js:17033` + `:18183`) query the WRONG TABLE — `spoon_all_designs` on prod, where the catalog actually lives in `all_designs`. Fix is mechanical, ~25 min, scripted.
- **`commit-agent` is missing from pm2 (57 days). DW-Agents is 696 commits / 71 days unpushed to Stevemdr.** If Kamatera dies tonight, every commit since 2026-03-16 is gone from off-site. One-line restart in Phase 2.
- **Two action scripts are ready** at `~/Projects/wallco-ai/` — Phase 1 (25 min, critical) and Phase 2 (follow-up). Both default to dry-run; `--execute` flips them live.
- **Yuri pipeline ran clean overnight: 62/67 (92.5%) success.** 30+ findings docs synthesized — see `findings-synthesis-2026-05-26.md`.
- **One open question before Phase 2:** Hollywood Wallcoverings might be Steve's house brand, not a vendor. Confirm before the vendor-name sweep runs against it.

---

## 2. Action Scripts Ready

Both scripts live at `/Users/stevestudio2/Projects/wallco-ai/` and default to **dry-run**. Preview first, then re-run with `--execute`.

### Phase 1 — `tomorrow-25min-fix.sh` (~25 min, CRITICAL)
1. Patch `server.js:17033` + `:18183` table-name bug (spoon_all_designs → all_designs)
2. `./deploy-kamatera.sh` + verify pm2 restarts settle
3. Kill momentum-crawler (155 restarts, ~300K wasted requests, Cloudflare-ban risk)
4. Delete 3 ghost wallpaper sites
5. Print revoke instructions for the top-2 `ghp_*` GitHub PATs

```bash
./tomorrow-25min-fix.sh            # preview
./tomorrow-25min-fix.sh --execute  # commit
```

### Phase 2 — `tomorrow-after-25min.sh` (follow-up)
1. Register + start `commit-agent` in pm2, then `git push` 696 commits to **Stevemdr**/DW-Agents
2. Vendor-name redaction sweep across the top-10 sister sites
3. Mac1 health probe (DeepSeek/Phi4/Mistral were returning 0-byte responses last night)
4. Full `ghp_*` revocation checklist

```bash
./tomorrow-after-25min.sh            # preview
./tomorrow-after-25min.sh --execute  # commit
```

> **Open question (block Phase 2 step 2 if unsure):** Is "Hollywood Wallcoverings" a vendor name or Steve's own house brand? If house brand, drop it from the denylist before running the sweep. Tag is in `MEMORY.md` under `project_dw_vendor_title_leak_20260526`.

---

## 3. What's Fixed Already (no further action)

| Item | When | State |
|------|------|-------|
| `callscompleted` agent | 22:02 UTC | `npm install` + pm2 restart; healthy on :9795 |
| Butlr historic syntax error | 17:06 UTC | patched + live traffic flowing |
| `norma-backup` `.git` restoration | this session | working tree tarball backup + alert path landed |
| Grid-card `<div>` wrapper | verified | live on /designs (verifier probe pass) |
| Vendor-name denylist on /designs | verified | live (verifier probe pass) |
| Sort + density controls | verified | live (verifier probe pass) |
| "Private Label" → "Exclusive" copy swap | verified | live (verifier probe pass) |
| FLIEPAPER redaction | verified | live (verifier probe pass) |
| `/api/designs` PII path leak | verified | closed (verifier probe pass) |
| Cron alert paths | verified | failure-side test passed (verifier probe pass) |
| Backup cadence | verified | 4/4 cron backups within window (verifier probe pass) |
| CNCP refactor | 4 local commits | `jsonStore` helper, `/api/assets` + `/api/mystack` canary, `URLSearchParams` eslint, `npm lint` script extension |

**8 of 10 verifier probes confirmed prior session fixes ARE live in prod.**

---

## 4. What's Still Open (ranked)

| Sev | Item | Where it's handled |
|-----|------|--------------------|
| **CRITICAL** | wallco-ai 135 restarts (table-name bug) | Phase 1 |
| **CRITICAL** | `commit-agent` missing + 696 unpushed commits to Stevemdr | Phase 2 step 1 |
| HIGH | momentum-crawler 155 restarts, ~300K wasted requests, Cloudflare-ban risk | Phase 1 step 3 |
| HIGH | 3 ghost wallpaper sites | Phase 1 step 4 |
| HIGH | 16 exposed credentials (top-2 `ghp_*` are dead-simple revokes) | Phase 1 step 5 + Phase 2 step 4 |
| HIGH | 73 of 91 `products.json` files leak vendor names | Phase 2 step 2 (top-11 in this pass) |
| MED | 13 sister sites at SEO doorway-page risk (Cluster 01 + 02) | `findings-synthesis-2026-05-26.md` §SEO doorway audit |
| MED | SDXL conv-padding architectural defect | manual: install `comfyui-seamless-tiling` ComfyUI custom node (Mac1) |
| LATER | Mac1 panel timeouts (DeepSeek/Phi4/Mistral 0-byte responses) | Phase 2 step 3 probes |

Full backlog + null findings: `~/Projects/wallco-ai/findings-synthesis-2026-05-26.md`.

---

## 5. Yuri Pipeline Stats

- **Runs:** 67
- **Success:** 62
- **Fail:** 5
- **Success rate:** 92.5%
- **Findings docs produced:** 30+ at `/root/DW-Agents/yolo-agent/findings/` (Kamatera; pull via `ssh my-server`)

5 failures were all transient (Anthropic rate-limit blip + Mac1 0-byte responses). None lost real work; codified in `feedback_yolo_loop_rate_limit_retry`.

---

## 6. The One Thing That Surprised Us

**The wallco-ai crash root cause was a WRONG-TABLE query, not a missing column.**

Two separate handlers (`server.js:17033` and `:18183`) read from `spoon_all_designs` — the table name Mac2's local catalog uses. Prod's actual catalog lives in `all_designs`. Both handlers had been silently throwing the same Postgres "relation does not exist" error on every request, pm2 was re-raising, and the auto-restart loop hit 135 before anyone noticed because the crash signature looked like an OOM / boot-time-syntax pattern.

This is the same architectural class as the `db-backup.sh` 11-day silent outage — code-paths that fail without producing a visible artifact. The fix is two `s/spoon_all_designs/all_designs/g` edits on the two specific lines (not a global replace — other handlers genuinely DO want `spoon_all_designs` on Mac2's local DB during dev). Phase 1 script handles the surgical patch.

Standing-rule reinforcement: every catalog-touching handler needs an explicit table-name comment naming the environment it targets. Tracked as a follow-up TODO in Phase 2 retrospective.

---

## Source Docs

- Executive synthesis: `~/Projects/wallco-ai/findings-synthesis-2026-05-26.md`
- Action script Phase 1: `~/Projects/wallco-ai/tomorrow-25min-fix.sh`
- Action script Phase 2: `~/Projects/wallco-ai/tomorrow-after-25min.sh`
- Raw Yuri findings: `ssh my-server "ls /root/DW-Agents/yolo-agent/findings/"`