I can't tell if "the roofing company" is the drawer or the endorser, but the situation is unclear enough that it probably looks like it's your fault whether it is or not. It is highly unlikely that your regulator's employee knows anything more about the UCC other than how to spell the acronym. If you can organize your facts correctly, you may be able to defend yourself, but drop the references to "post no debits," it's nothing but an internal phrase not something sanctioned by law or regulation.
In this world you must be oh so smart or oh so pleasant. Well, for years I was smart. I recommend pleasant.