Document payment verification and trezor safekeeping

08 - Operations/Incident Response.md

@@ -256,6 +256,38 @@ docker exec -it nickapp-backend node -e "
 
 If user data may have leaked, treat as sev 1 and follow your data-breach disclosure process.
 
+### 3.8 Request Network rollback + reconciliation
+
+Use when Request Network payments are failing, stalled, or out of sync with local payment state.
+
+**Immediate rollback (minutes):**
+
+1. Stop routing new intents to Request Network by setting:
+
+   - `REQUEST_NETWORK_ENABLED=false`
+   - `PAYMENT_ENABLED_PROVIDERS=shkeeper`
+   - keep `PAYMENT_ROLLBACK_PROVIDER=shkeeper`
+
+2. Restart backend and confirm new `/api/payment/request-network/*` checks are no longer in your checkout path.
+
+3. Confirm `PAYMENT_PROVIDER_MODE` is in a safe operational mode:
+
+   - `live`: standard operations
+   - `read-only`: observe only, no writes
+   - `dry-run`: status updates without on-chain actions
+
+**Reconciliation before re-enabling:**
+
+1. Keep `PAYMENT_RECONCILIATION_ENABLED=false` until investigation is complete.
+
+2. Run a dry reconciliation pass (dry-run) using the Request Network reconciliation service and capture summary counters.
+
+3. If summary is healthy, run with `apply=true` for the intended payment window.
+
+4. Re-enable RN intentionally only after two deployment health checks pass.
+
+Escalate if repeated `lookup_failed`, `missing_reference`, or coordinator-blocked outcomes block reconciliation for more than 10 minutes.
+
 ---
 
 ## 4. Communication templates