docs: record the Tiny account and product findings

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

docs/ROADMAP.md

@@ -8,9 +8,10 @@
 > Add new findings at the bottom of the relevant block rather than rewriting history.
 
 **Current step (2026-09-25, last day of Week 2):** Still waiting on the client
-for Mercado Pago credentials and webhook access (1.1) and freight data (1.2);
-Tiny's app credentials are in production and the connection starts from the
-Kanban (1.3). Built and deployed without them: server-side print-file
+for Mercado Pago credentials and webhook access (1.1) and freight data (1.2).
+Tiny is connected in production and reads orders, but the connected user
+cannot read contacts (403) and the client's catalogue has no per-metre UV
+product; both wait on the client (1.3). Built and deployed without them: server-side print-file
 generation (1.4), the delivery address (3.8), the Kanban's payment-issue and
 print-file views and its redesign (1.5), the Site redesign (5.17), and Mercado
 Pago and Tiny adapters written from the public API documentation and tested
@@ -19,11 +20,11 @@ Every change passed the full integration sequence locally (Docker Engine in
 WSL) and on the Gitea runner, which publishes images on green pushes to `main`;
 the user verified each release in production after redeploying in Portainer.
 Operator and Site guides are in `docs/` (see Reporting).
-**Left for today:** product ids for the four products from the client's Tiny and
-one supervised real order (1.3); a Mercado Pago sandbox payment by PIX and card
-if the credentials arrive (1.1); the freight connector if the data arrives
-(1.2, otherwise the one Week 2 item that slips, on client inputs); the Week 2
-client report.
+**Left for today:** the Week 2 client report. Waiting on the client: the
+Contatos permission and the product decision, then product ids and one
+supervised real order (1.3); Mercado Pago credentials for the sandbox PIX and
+card payments (1.1); freight data (1.2, the one Week 2 item that slips, on
+client inputs).
 
 **Previous step (2026-09-23):** Payment safety fixes 2.13 and 2.14 and
 the local order-correctness work in 3.6/3.9 have passed integration checks.
@@ -289,6 +290,24 @@ From the report already sent. These are dated promises, not backlog.
   and whether a session grant has an undocumented maximum, is only known on
   the client's account. There is no alert channel yet (no e-mail; WhatsApp
   is fake): problems show on the Kanban only.
+  **Client account (2026-09-25):** connected in production with the
+  developer user the client provided. "Testar conexão": `pedidos` ok,
+  `contatos` 403, unchanged after reconnecting. The application's permissions
+  are correct (Contatos, Pedidos: read and include/edit; Produtos: read);
+  Olist documents that v3 calls also depend on the logged-in user's module
+  permissions, and that user's Cadastros menu shows only Produtos. Orders
+  need Contatos (search by CNPJ, create when new; delete never). **Client
+  to decide:** grant that user Clientes e Fornecedores, or reconnect with a
+  user that has it (a dedicated integration user is recommended).
+  **Products (2026-09-25),** from the client's product export: none of the
+  36 "DTF" products matches the four Site products. `951438842` "IMPRESSÃO
+  DTF PERSONALIZADO 57X100 (1 METRO)" (MT, R$ 19,90, active) fits Têxtil;
+  there is no per-metre UV product (the UV one is 27 cm, per 10 cm), and no
+  separate "artes avulsas" product. **Client to decide:** create four per-metre
+  products (recommended, copying `951438842`), or share `951438842` between
+  the two Têxtil modes; UV needs a product either way. The item note already
+  carries the Site mode and grade. No product ids are set in production yet;
+  both questions go to the client with the Mercado Pago credentials request.
 - `[~]` 1.4 — Final print-file generation (see 3.2 and 3.6: production instructions
   must survive checkout before an output engine can reproduce the approved job).
   **Built (2026-09-24):** each paid item gets a PDF the width of the film and