diff --git a/docs/deployment/deployment-records/2026-08-21-zb-servers-691a2f2f.md b/docs/deployment/deployment-records/2026-08-21-zb-servers-691a2f2f.md
new file mode 100644
index 00000000..89dcc1e3
--- /dev/null
+++ b/docs/deployment/deployment-records/2026-08-21-zb-servers-691a2f2f.md
@@ -0,0 +1,39 @@
+# Deployment record — QA (wonder-app-vq03/vq04) + prod (wonder-app-vd03) — 2026-08-21
+
+Binary-only upgrade of all three ZB hosts from `da0bfe2b` to `main` @ **`691a2f2f`** (create-time
+connection bindings: Create Instance page binds module groups via `IFlatteningPipeline.PreviewAsync`,
+`NodeBrowserDialog.SelectableNodeClasses`, Create → bindings → Configure). **No EF migrations**
+between the two builds (`git diff --stat da0bfe2b..691a2f2f -- '**/Migrations/*'` empty), so no
+schema step and no DB backup. Driven entirely from psbridge on vq04; vq03 and vd03 over WinRM +
+`E$` share, same recipe as the 2026-08-20 records.
+
+| Item | Value |
+|---|---|
+| Publish | Host (`app\`, 520 files) + CLI (`cli\`, 223 files) `-c Release -r win-x64 --self-contained`, `scadabridge-691a2f2f.zip` 125 MB, `psbridge push --compress` (SHA-256 `c11bcf15…`). |
+| Staging | `E:\psrem\releases\691a2f2f\unpacked` on vq04; robocopy `/MIR` to `\\wonder-app-vq03\E$\psrem-stage\691a2f2f` and `\\wonder-app-vd03\E$\psrem-stage\691a2f2f` (1246 files each, ProductVersion verified before the swap). |
+| QA swap | 06:30:40 — Site pair stopped, Central pair stopped, `app`/`cli` → `app.bak.20260821T063040` / `cli.bak.20260821T063040` on both boxes, stage copied, each box's three `appsettings*.json` copied back, Central pair started, +20 s Site pair started. |
+| Prod swap | 06:33:42 — same on vd03 (single host): `app.bak.20260821T063342`, `cli.bak.20260821T063342`. |
+| Preserved | `appsettings*.json`, service registry environment, `central\data`, `site\data` on every host. |
+
+### Verification
+- `/health/ready` 200 Healthy on all six endpoints: `10.220.158.{2,3}:{8085,8084}` members=2,
+  vd03 `:8085`/`:8084` members=1. `Host.dll` ProductVersion `1.0.0+691a2f2f…` on all three.
+- Post-boot logs (8 min window): vq03 site/central 0 ERR/FTL; vd03 central 0, site 1 (first-probe
+  `member status: Removed`); vq04 central 2 / site 3 — the two `Removed` first-probes plus one FTL
+  (below).
+
+### Observed, not a regression
+- **vq04 site, `[FTL] ScadaBridge host terminated unexpectedly` at 06:31:20 — the OUTGOING
+  `da0bfe2b` process.** `Stop-Service -Force` → CoordinatedShutdown took 10 s (singleton
+  handover dead-letters, `Akka.NET actor system shutdown complete` 06:31:20.764), by which time
+  `WindowsServiceLifetime.StopAsync` had cancelled its stop token, so `Host.StopAsync` surfaced an
+  `OperationCanceledException` that the top-level catch logs as fatal. The process did exit
+  (swap guard `Get-Process` passed) and the new build booted clean. Follow-up candidate: align
+  `HostOptions.ShutdownTimeout` / the service's SCM stop window with CoordinatedShutdown's budget
+  so a graceful stop is not reported as a crash.
+- `SiteLocalDbHealthCheck` still reports `replicationConnected:false` on unreplicated vd03
+  (cosmetic, noted 2026-08-20).
+
+### Rollback
+Per host: stop Site then Central (QA: both boxes together), rename `app` → `app.failed`,
+`app.bak.20260821T0630xx` → `app` (same for `cli`), start Central then Site. No schema to revert.