Tier 3 T3-4 Report — Deploy + E2E (parallel, live untouched)¶

Date: 2026-09-14
Status: T3-4 PARALLEL STACK PROVEN. Live last1admin-app on :5000 was not replaced.
Parent: TIER_3_ADMIN_T3-3_REPORT.md · TIER_3_ADMIN_T3-4_TEST_PLAN.md

0. Critical correction (do not skip)¶

The T3-4 premise "DNS still points at Railway, zero lockout" is false.

Signal	Result
`https://admin.last1.enterprises/` HTML	Identical to `http://192.168.1.97:5000/`
Bundle	Both `index-DzGaQkaW.js`, Last-Modified `2026-09-02T20:52:03Z`
`x-railway-edge` on prod	Absent
Railway rollback origin `b3rep7ek.up.railway.app`	404 + `x-railway-fallback` / `x-railway-edge: lax1`
VM 115 `last1admin-app`	Started `2026-09-02T20:52:11Z` (same minute as live Last-Modified)
SPRINT-8 T6 (2026-08-31)	Already cut `admin.last1.enterprises` to tunnel `4c8550f2-…` → `192.168.1.97:5000`

Live admin is already R940. Railway is a dead 404 origin, not a rollback net. Replacing last1admin-app would have been a live production deploy.

T3-4 therefore deployed 44bf00b as a parallel container on :5001 and pointed only the existing staging hostname at it. Prod DNS and the live container were not changed.

1. What was deployed (parallel only)¶

Item	Value
Commit	`44bf00b` (includes `03bd61c` C1 + `db79370` DD-214)
Source on VM	`/opt/last1-admin/src-t34` (git archive, not the dirty working tree)
Image / container	`last1admin-app:t34` / `last1admin-app-t34`
Bind	`192.168.1.97:5001`
Env file	`/opt/last1-admin/.env-t34` (live `/opt/last1-admin/.env` untouched, dated Sep 2)
Ops digest	Disabled on t34 (`LASTVET_OPS_DIGEST_ENABLED=false`) so it cannot double-send
Live container	`last1admin-app` still Up since 2026-09-02, `:5000`

Render change: render-last1admin-env-app.sh now also passes through BWS LAST1ORG_DB_PROD_* (C1 keys are unprefixed).

Hygiene: VM /opt/last1-admin/src origin had an embedded GitHub token. Remote reset to https://github.com/Last-1-Enterprises/last1-admin.git.

2. Env on t34 (hosts only)¶

Runtime key	Host
`VITE_SUPABASE_URL` / `SUPABASE_URL`	`https://api.last1.app`
`ONSET_SUPABASE_URL`	`https://onset-api.theonset.app`
`LAST1ORG_DB_PROD_SUPABASE_URL`	`https://data.last1.org`
`RADIOCHECK_SUPABASE_URL`	`https://api.last1.app`

No tcthzak, no *.supabase.co as live targets.

3. Bundle / C3¶

Surface	Bundle	Notes
Prod `admin.last1.enterprises`	`index-DzGaQkaW.js`	Unchanged (live Sep 2 build)
Live LAN `:5000`	`index-DzGaQkaW.js`	Same
Staging `admin-app.last1.enterprises`	`index-DFPzBw9w.js`	t34 / `44bf00b`
LAN `:5001`	`index-DFPzBw9w.js`	Same

C3 quarantine is in the t34 bundle: tcthzak appears only as the fail-closed matcher (live Sep 2 bundle has no tcthzak string). Baked client origin is api.last1.app. Login page is not "Configuration Error".

GET https://api.last1.app/auth/v1/authorize?provider=google&redirect_to=https://admin-app.last1.enterprises/auth/callback → 302 to Google. Hosted tcthzakppndkykatoefx.supabase.co does not resolve.

4. C1 / C2 store split (runtime query from t34)¶

Using the t34 container's own env (counts only):

Product	Store	Count
last1org	`https://data.last1.org`	6
onset	`https://onset-api.theonset.app`	3
lastvet	`https://onset-api.theonset.app`	1

Matches the C1/C2 isolation lock.

5. Staging tunnel (not T3-5)¶

lastvet-edge /etc/cloudflared/config.yml:

Hostname	Origin
`admin.last1.enterprises`	`http://192.168.1.97:5000` (live, unchanged)
`admin-app.last1.enterprises`	`http://192.168.1.97:5001` (t34)

Backup: /etc/cloudflared/config.yml.bak-t3-4-t34-20260914T005643
api.last.vet still 200 after cloudflared restart.

GoTrue already allows https://admin-app.last1.enterprises/auth/callback. last1.app GoTrue was not restarted.

6. Browser E2E¶

ID	Result	Notes
PF-1 staging reaches t34	PASS	`admin-app.last1.enterprises` serves `index-DFPzBw9w.js`, no Railway header
PF-2 prod unchanged	PASS	`admin.last1.enterprises` still `index-DzGaQkaW.js`
Login shell	PASS	Sign in with Google; not Configuration Error
A-1 Google start	PARTIAL	Click starts OAuth to Last1.app / Google. `redirect_to` is the staging callback. Stopped at Google identifier (needs Ryan)
A-2..X-3 authenticated units	NOT RUN	Waiting on Ryan Google sign-in

Staging login URL for Ryan: https://admin-app.last1.enterprises/login

7. What T3-5 is (corrected)¶

T3-5 DNS cutover already happened on 2026-08-31 (SPRINT-8 T6). Prod is R940.

The remaining careful step is not DNS. It is:

Recreate live last1admin-app on :5000 from 44bf00b / the t34 image + env (including LAST1ORG_DB_PROD_*).
Point staging back at :5000 (or delete the t34 container).
Railway teardown (origin is already 404).

Do that when Ryan is fresh. Live session on admin.last1.enterprises is the safety net. t34 stays up for the authenticated pass.

8. Not done¶

Authenticated unit landing / marketing UI pages
Promoting t34 to live :5000
Railway project delete
Restoring staging hostname to :5000