docs(migration): record post-migration state and concrete rollback values

Migration executed 2026-04-21 10:04 UTC. Playbook now carries the actual
SHAs, backup paths, stripped credentials inventory, verification evidence,
and a rollback block with filled-in values for this specific cutover.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

MIGRATION-PLAYBOOK.md

@@ -1,14 +1,61 @@
 # OpenClaw → Echo-Core Migration Playbook
 
-> **⚠️ This document should NOT be run by an AI agent.**
+> **Status: EXECUTED 2026-04-21 10:04 UTC.** See "Post-migration state" below.
-> Marius runs it by hand, one step at a time, verifying between steps.
+> This playbook is kept as a living reference for rollback + cleanup.
-> Each step has a "before" and "after" state. Never batch.
 
 Run this after the PR `feat/openclaw-consolidation-2026-04` has merged to master.
 Estimated downtime: 5–10 minutes. Rollback path at the bottom.
 
 ---
 
+## Post-migration state (reference for rollback)
+
+**Migration date:** 2026-04-21 10:04 UTC
+**Downtime window:** ~2 minutes (10:02–10:04 UTC)
+
+### Git SHAs
+- **Pre-migration master tip:** `4e78ef7` ("claude gstack") — rollback target if everything goes wrong.
+- **Post-merge master tip:** `d741541` ("test(dashboard): cover constants, git helper, cron endpoint, files sandbox") — last commit of the migration PR.
+- **Current origin/master:** moved forward as Marius tested dashboard commit button post-cutover.
+
+### Backups
+- **`/home/moltbot/clawd-backup-2026-04-21/`** — full copy of `clawd/dashboard` (807K) + `clawd/memory` (11M) taken during pre-flight step 3. Keep until 2026-05-21.
+
+### Services at cutover
+- `echo-core.service` — active (running), uses echo-core/.venv + echo-core paths
+- `echo-taskboard.service` — active (running), new unit at `~/.config/systemd/user/echo-taskboard.service`, WorkingDirectory=`/home/moltbot/echo-core/dashboard`, ExecStart=`.venv/bin/python3 api.py`
+- `echo-whatsapp-bridge.service` — active (running), unchanged
+- `openclaw-gateway.service` — **inactive + disabled**, credentials stripped
+
+### Credentials stripped from `~/.openclaw/`
+- `credentials/` dir (Discord + Telegram + WhatsApp pairing) — deleted
+- `identity/` dir (device auth) — deleted
+- `devices/` dir (paired devices) — deleted
+- `agents/*/agent/auth-profiles.json` (20 files) — deleted
+- `agents/*/sessions/sessions.json` (20 files) — deleted
+- **Preserved:** `cron/jobs.json` (+bak) as audit artifact; `openclaw.json` (main config, no known secrets); npm `lib/` (harmless).
+
+### What's enabled after migration
+- **Shell jobs (5):** `anaf-monitor`, `security-audit-daily`, `kb-index-refresh`, `archive-tasks-daily`, `backup-config` — all enabled
+- **Claude jobs enabled (2):** `newsletter-test`, `heartbeat-2h`
+- **Claude jobs disabled (13):** morning-report, evening-report, morning-coaching, evening-coaching, weekly-planning-sun, content-discovery, provocare-reminder, exercise-snack-1/2/3, grup-sprijin-5feb, grup-sprijin-pregatire — ready to enable after Marius reviews each
+
+### Crontab
+- `0 2 * * * /home/moltbot/echo-core/tools/backup_config.sh` (was clawd)
+- `10 14 * * 4,5,1 ... check_newsletter_cercetasi.py` (unchanged)
+- `0 9 21 5 * ...` — **May 21 2026 cleanup reminder** (writes to `$HOME/REMINDER-openclaw-cleanup.txt` and appends to `logs/migration-reminder.log`)
+
+### Verification PASS
+- ANAF `status.json.anaf.lastCheck` moved from **03 Apr 2026, 22:07** → **21 Apr 2026, 10:04** with 3 real changes detected on first manual trigger.
+- `GSTACK-CRON: changes=3` marker emitted correctly; scheduler↔anaf contract verified.
+- `/api/cron` returns 7 jobs (enabled shell + claude).
+- `/api/agents` and `/api/activity` return 404 (removed as planned).
+- Dashboard /api/status OK.
+
+---
+
+---
+
 ## Pre-flight (read-only)
 
 1. Confirm clean git state on echo-core master:
@@ -137,18 +184,52 @@ Estimated downtime: 5–10 minutes. Rollback path at the bottom.
 
 ## Rollback path (if anything breaks badly)
 
-```
+**Concrete values for this migration (executed 2026-04-21):**
-systemctl --user stop echo-core echo-taskboard echo-whatsapp-bridge
-rm -rf /home/moltbot/echo-core/memory
-cp -rp /home/moltbot/clawd-backup-YYYY-MM-DD/memory /home/moltbot/clawd/memory    # restore
-ln -s /home/moltbot/clawd/memory /home/moltbot/echo-core/memory                    # restore symlink
 
-# Restore old systemd unit from git history in clawd repo if available, else rewrite manually.
-git -C /home/moltbot/echo-core checkout master   # revert to pre-merge state
-systemctl --user daemon-reload
-systemctl --user start echo-core echo-taskboard echo-whatsapp-bridge
-systemctl --user start openclaw-gateway          # if wanted
 ```
+# Stop current services
+systemctl --user stop echo-core echo-taskboard echo-whatsapp-bridge
+
+# Restore memory directory
+rm -rf /home/moltbot/echo-core/memory
+cp -rp /home/moltbot/clawd-backup-2026-04-21/memory /home/moltbot/clawd/memory
+ln -s /home/moltbot/clawd/memory /home/moltbot/echo-core/memory
+
+# Restore dashboard source (symlinks will come back with it)
+cp -rp /home/moltbot/clawd-backup-2026-04-21/dashboard /home/moltbot/clawd/dashboard
+
+# Restore old systemd unit (paths back to clawd/dashboard + /usr/bin/python3)
+cat > ~/.config/systemd/user/echo-taskboard.service <<'EOF'
+[Unit]
+Description=Echo Task Board API
+After=network.target
+
+[Service]
+Type=simple
+WorkingDirectory=/home/moltbot/clawd/dashboard
+ExecStart=/usr/bin/python3 /home/moltbot/clawd/dashboard/api.py
+Restart=always
+RestartSec=5
+
+[Install]
+WantedBy=default.target
+EOF
+
+# Revert git to pre-migration state
+git -C /home/moltbot/echo-core reset --hard 4e78ef7
+
+# Restore crontab backup_config line (sed in reverse)
+crontab -l | sed -E 's#/home/moltbot/echo-core/tools/backup_config\.sh#/home/moltbot/clawd/tools/backup_config.sh#g' | crontab -
+
+# Re-enable openclaw (credentials are GONE — you'll need to re-pair Discord/Telegram/WhatsApp)
+systemctl --user enable openclaw-gateway
+systemctl --user daemon-reload
+
+# Restart everything
+systemctl --user start echo-core echo-taskboard echo-whatsapp-bridge openclaw-gateway
+```
+
+**Note:** After rollback, OpenClaw credentials are gone (stripped during migration). Re-pairing requires going through OpenClaw's pairing flows for Discord/Telegram/WhatsApp. If you want clean rollback without losing pairing, do the rollback within the 30-day window **before** running the May 21 cleanup reminder.
 
 ---