fix(#2235): a second WebhookInbox target slot, so the platform-release target stops being shadowed

deploy/aks/values.aks.yaml

@@ -86,6 +86,13 @@ config:
     # provisioned for anything to read the inbox — an allowlisted target with no watcher
     # stores deliveries nobody consumes.
     WebhookInbox__Targets__0: "Hosting/PlatformBuilds"
+    # A deployment that ALSO needs a second inbox target (e.g. memex-cloud additionally listens
+    # on Store/Payments for Stripe) sets __1 too — never a second writer of __0. See #2235: a
+    # hand-set `kubectl set env WebhookInbox__Targets__0=...` on the live Deployment permanently
+    # shadows whatever this ConfigMap renders for that SAME name (explicit `env:` beats `envFrom`),
+    # so the platform-build target silently never took effect even though the ConfigMap was
+    # correct. Leave empty when only one target is needed.
+    WebhookInbox__Targets__1: ""
     # ---- Instance branding (per-env) ----------------------------------------
     # Large Safari bookmark / Start-Page / Add-to-Dock tile (apple-touch-icon, 180×180 PNG).
     # This ships the PROJECT's own mark (Systemorph builds MeshWeaver — the chart's

deploy/helm/templates/memex-portal/config.yaml

@@ -316,7 +316,17 @@ data:
   # exactly how the 2026-08-23 memex operator-enablement deploy wedged. A typed key needs a real
   # default; "empty = inert" is only true for strings.
   SelfUpdate__MinRollInterval: "{{ .Values.config.memex_portal.SelfUpdate__MinRollInterval | default "01:00:00" }}"
-  WebhookInbox__Targets__0: "{{ .Values.config.memex_portal.WebhookInbox__Targets__0 }}"
+  WebhookInbox__Targets__0: "{{ .Values.config.memex_portal.WebhookInbox__Targets__0 | default "" }}"
+  # 🚨 #2235: a SECOND slot, because index 0 is not this template's alone to give. memex-cloud
+  # hand-set WebhookInbox__Targets__0=Store/Payments directly on the Deployment (kubectl set env,
+  # unrecorded, pre-dating this chart key) BEFORE the platform-release broadcast existed. Explicit
+  # `env:` entries win over the SAME-named var sourced via `envFrom` (this ConfigMap), so that
+  # stray override silently shadows whatever this template renders for __0 forever — the overlay
+  # correctly set Targets__0=Hosting/PlatformBuilds, helm reported success, the ConfigMap held the
+  # right value, and the live pod still ran with Store/Payments. CD's notify-platform-update then
+  # 404'd on every promoted build with no error anywhere until #2268 made the 404 fail loud. A
+  # deployment needing more than one inbox target sets __0 AND __1 (not two writers of __0).
+  WebhookInbox__Targets__1: "{{ .Values.config.memex_portal.WebhookInbox__Targets__1 | default "" }}"
   # The MODULES a deployment refuses to run without (MeshBuilderModuleActivation.RequiredKey).
   # The image ships a baseline list in appsettings; a deployment OVERRIDES an entry by name here,
   # and blanks one it cannot satisfy.