[Neup123]

Production incident / scope

Refs #52.

On 2026-11-10 18:10 Europe/Athens, production chabad-info entered terminal 401 / LOGOUT, with connectionStatus=close; QR re-pairing is broken by the unhandled companion_reg_refresh flow in the pinned Baileys rc14 (Baileys#2737). Required deployability: Friday 2026-11-13 16:52 Europe/Athens. The PR does not re-pair, publish, merge, or deploy anything.

Changes

• Vendors patches/baileys+7.0.0-rc14.patch from evolution-foundation/evolution-api#2727 (cloviscoli) with one upstream-sourced adaptation: the fix(deps): patch baileys to restore WhatsApp device pairing (companion_reg_refresh) evolution-foundation/evolution-api#2727 file lacks the one-line Baileys#2749 pre-login ack fix, so that hunk is added to the same compiled messages-recv.js patch. The two original patches are Baileys#2765 (rotate adv secret on companion_reg_refresh, re-render the current QR ref, preserve timer, skip registered sessions) and Baileys#2602 (skip incomplete link_code_companion_reg).
• Retains the exact "baileys": "7.0.0-rc14" in package.json and package-lock.json. No Baileys or Evolution 2.4.0 upgrade.
• Installs patch-package@^8.0.1 in dev dependencies (lockfile entries populated from upstream's verified develop lock; all newly added dependency edges resolved statically).
• Preserves node scripts/patch-libsignal-logging.mjs and follows it in postinstall with patch-package --error-on-fail.
• Docker builder copies patches/ before npm ci, and install output is no longer suppressed.
• Documents exact provenance, release gates, and patch retirement in docs/baileys-rc14-pairing-outage-build-plan.md.

Verification status (do not infer green from static inspection)

Required gate	Current evidence / status
Clean rm -rf node_modules && npm ci	NOT VERIFIED in this connector-only environment; no npm registry/network access. No patch-package success line is available yet.
npm run build (tsc --noEmit && tsup)	NOT VERIFIED: dependencies not installable here.
CI checks on PR	NO CHECKS REPORTED on head 429930eb4d4101c7eda423dc10cd533ff58bd812: GitHub Checks API: total_count=0, combined commit statuses: 0, pull-request workflow runs: 0. CI is not green.
Compiled lib/Socket/socket.js / companion utils grep	NOT VERIFIED AFTER INSTALL. Version-matched patch text contains companion_reg_refresh, handleCompanionRegRefresh, makePairingQRRenderer; no installed compiled node_modules/baileys tree available here.
Compiled messages-recv.js grep	NOT VERIFIED AFTER INSTALL. Patch contains guard for missing primary_identity_pub and one-line authState.creds.me?.id.
npx tsx ./test/connection-recovery.test.ts	NOT RUN here; unable to install dependencies.
npx tsx ./test/socket-watchdog.test.ts	NOT RUN here; unable to install dependencies.
npx tsx ./test/disconnection-fields.test.ts	NOT RUN here; unable to install dependencies.

Static patch inspection: 4 compiled-file sections, 9 unified-diff hunks, 0 hunk length/syntax discrepancies. GitHub reports the PR conflict-free (mergeable_state=clean). This validates only patch formatting, not application to installed Baileys.\n\nStatic evidence: Baileys manifest and lockfile both remain exactly rc14; postinstall retains libsignal + adds fail-fast patch-package; Docker copies patches/ before RUN npm ci; 19 lockfile nodes are supplied and the new dependency closure resolves statically. Static checks are not substitutes for the required runtime gates.

Required production-side/build-rig commands and grep/test evidence templates are in the in-repo build plan. Do not merge or deploy as verified without a clean install, green build, and the three test passes.

Retirement: remove the patch only when a published Baileys release containing evolution-foundation#2765 ships, followed by an independently reviewed, tested version upgrade.

Final evidence snapshot — head 429930eb4d4101c7eda423dc10cd533ff58bd812

Patch-file grep (static, not installed compiled output):

patches/baileys+7.0.0-rc14.patch:8: + const stanza = buildAckStanza(node, errorCode, authState.creds.me?.id);
patches/baileys+7.0.0-rc14.patch:16: + if (!getBinaryNodeChildBuffer(linkCodeCompanionReg, 'primary_identity_pub')) { break; }
patches/baileys+7.0.0-rc14.patch:75: + ws.on('CB:notification,type:companion_reg_refresh', (node) => {
patches/baileys+7.0.0-rc14.patch:76: + handleCompanionRegRefresh(node, {
patches/baileys+7.0.0-rc14.patch:204: + export const handleCompanionRegRefresh = (node, { creds, emitCredsUpdate, refreshQR, logger }) => {

Actual environment/network probe:

$ npm view patch-package version --fetch-retries=0 --fetch-timeout=3000
npm error code EAI_AGAIN
npm error syscall getaddrinfo
npm error request to https://registry.npmjs.org/patch-package failed, reason: getaddrinfo EAI_AGAIN registry.npmjs.org

A clean npm ci, build, Docker build, three runtime suites, and grep of installed compiled Baileys files were not runnable, so there is no install success line or test pass/fail count to report. GitHub at this head: 0 check runs, 0 commit statuses, 0 workflow runs; CI not verified. Static patch hunk validation: 4 files, 9 hunks, 0 inconsistent hunk lengths. GitHub reports mergeable=true, mergeable_state=clean (draft, unmerged). Release gates remain open.

[Neup123]

Coordinator verification — PR #53 (head 429930eb4d4101c7eda423dc10cd533ff58bd812)

Verified independently on the home-PC rig. The builder's sandbox had no npm-registry access, so every execution check below was run by the coordinator; the builder's static validation matches what I found in the diff.

Patch provenance & diff (read in full)

• patches/baileys+7.0.0-rc14.patch is the evolution-foundation/evolution-api PR fix(deps): patch baileys to restore WhatsApp device pairing (companion_reg_refresh) evolution-foundation/evolution-api#2727 file (cloviscoli), no fallback needed.
• It contains all three vendored fixes: Baileys fix(docker): pin Node.js to patched 24.22.1 for October 2026 CVEs evolution-foundation/evolution-api#2765 (CB:notification,type:companion_reg_refresh handler + handleCompanionRegRefresh in Utils — mints a new 32-byte advSecretKey, emits creds.update, re-renders the same QR ref, leaves creds.me sessions alone), Update generate_database.sh evolution-foundation/evolution-api#2602 (skip link_code_companion_reg without primary_identity_pub), and the fix(meta): validate and preserve Coexistence webhook batches evolution-foundation/evolution-api#2749 line (sendMessageAck reads creds.me?.id).
• Baileys pin untouched (exactly 7.0.0-rc14). package.json: postinstall gains && patch-package --error-on-fail, patch-package@^8.0.1 devDependency. Dockerfile copies patches/ before npm ci. Build plan doc included. No src/ changes.

Clean install applies the patch (3 independent runs)

• Home-PC host clone: npm ci exit 0 — patch-package 8.0.1, Applying patches... baileys@7.0.0-rc14 ✔.
• Docker builder stage (production Dockerfile): same success line.
• Linux container (node:24-alpine) fresh copy: npm ci exit 0, same success line.

Compiled output contains the handler

• Installed node_modules/baileys/lib/Socket/socket.js: ws.on('CB:notification,type:companion_reg_refresh', ...) + handleCompanionRegRefresh import and call site.
• node_modules/baileys/lib/Utils/companion-reg-client-utils.js present with handleCompanionRegRefresh and COMPANION_REG_REFRESH_CHILDREN = ['companion_reg_refresh', 'pair-device-rotate-qr'].
• Same grep confirmed inside the built production image (/evolution/node_modules/baileys/...).

Build

• prisma generate (DATABASE_PROVIDER=postgresql) exit 0; tsc --noEmit clean (zero TS errors).
• Production Docker build GREEN and the image was produced from the pristine PR tree (git status clean). One build-environment note: on this PC the stock build died with Node heap OOM, so the image was built with a scratch wrapper Dockerfile byte-identical to the repo's except one added builder-stage line, ENV NODE_OPTIONS=--max-old-space-size=8192 (build-time heap ceiling only; the repo Dockerfile is untouched and all artifact inputs/commands are the stock ones).

Existing fork suites — 3/3 PASS (same rig method as the 2026-11-09 round)

• connection-recovery — "Connection recovery tests passed", exit 0.
• disconnection-fields — "Disconnection field reset tests passed", exit 0.
• socket-watchdog — "Socket watchdog tests passed", exit 0.
• Method note: the suites cannot start on Node ≥24 without the rig workaround documented on 2026-11-09 — whatsapp-rust-bridge is ESM-only and tsx's CJS register fails with ERR_PACKAGE_PATH_NOT_EXPORTED before any test code runs (pre-existing, in a package this PR does not touch). The workaround (patch the installed package's exports inside the disposable rig copy, plus prisma generate) was applied to the rig copy only; the repo is untouched.

CI

• No GitHub Actions runs exist for this branch, and none can be triggered: GitHub Actions is disabled for this repository (workflow dispatch returns HTTP 422, same as on 2026-11-08). Stated plainly rather than claimed green; the local verification above stands in for it.

Publication

• Route used: home-PC build + push (Actions route unavailable, see above).
• ghcr.io/neup123/evolution-api:latest pushed; registry digest sha256:823648dc83108b166204adbf5d6654eebe3494c73e97ba5cbda9d1be8dfb1d38 (cross-checked via the GHCR API: newest package version). Image labels: org.opencontainers.image.revision=429930eb4d4101c7eda423dc10cd533ff58bd812, version 5.5.3.

Not done here (by design)

• PR not merged, nothing deployed. The pairing itself is NOT verified — that needs the owner's QR scan after deployment; expect pair-success and the instance returning to open.