diff --git a/projects/business/memory/state.json b/projects/business/memory/state.json
index 6c8f6e3..2b637f2 100644
--- a/projects/business/memory/state.json
+++ b/projects/business/memory/state.json
@@ -8,7 +8,9 @@
     "BUG-032 terminal gap is NOT fixed — still visible gap between terminal header and terminal window on mobile. Reopen and fix properly.",
     "Change SLA from 99.9% to 99.5% on landing page.",
     "Migrate from SQLite to PostgreSQL NOW, before launch. Required for future failover/clustering. This is a launch blocker.",
-    "Stripe: owner has existing Stripe account from another project — use same account, just create separate Product + webhook endpoint for DocFast."
+    "Stripe: owner has existing Stripe account from another project — use same account, just create separate Product + webhook endpoint for DocFast.",
+    "STRIPE_WEBHOOK_SECRET is now in docfast.env. Deploy it to the server env WITHOUT reading the value. Use: source .credentials/docfast.env then SSH to set it.",
+    "Stripe Product ID for DocFast: prod_TygeG8tQPtEAdE — webhook handler must filter by this product_id to ignore events from other projects on the same Stripe account."
   ],
   "launchChecklist": {
     "emailVerificationReal": true,
@@ -44,7 +46,7 @@
   },
   "credentials": {
     "file": "/home/openclaw/.openclaw/workspace/.credentials/docfast.env",
-    "keys": ["HETZNER_API_TOKEN", "STRIPE_SECRET_KEY"],
+    "keys": ["HETZNER_API_TOKEN", "STRIPE_SECRET_KEY", "STRIPE_WEBHOOK_SECRET"],
     "NEVER_READ_DIRECTLY": true
   },
   "team": {
@@ -55,7 +57,7 @@
   "openBugs": {
     "CRITICAL": [],
     "HIGH": [],
-    "MEDIUM": ["BUG-032 (mobile terminal gap - NOT fixed, reopen)", "BUG-035 (STRIPE_WEBHOOK_SECRET empty - needs human)", "BUG-036 (Stripe webhook URL wrong - needs human)"],
+    "MEDIUM": ["BUG-032 (mobile terminal gap - NOT fixed, reopen)", "BUG-035 (STRIPE_WEBHOOK_SECRET - now in docfast.env, deploy to server)", "BUG-036 (Stripe webhook URL - DONE by human)", "BUG-037 (webhook handler must filter by product_id prod_TygeG8tQPtEAdE - shared Stripe account)"],
     "LOW": []
   },
   "blockers": [],