# Deployment record — QA (wonder-app-vq03/vq04) + prod (wonder-app-vd03) — 2026-08-21

Binary-only upgrade of all three ZB hosts from `da0bfe2b` to `main` @ **`691a2f2f`** (create-time
connection bindings: Create Instance page binds module groups via `IFlatteningPipeline.PreviewAsync`,
`NodeBrowserDialog.SelectableNodeClasses`, Create → bindings → Configure). **No EF migrations**
between the two builds (`git diff --stat da0bfe2b..691a2f2f -- '**/Migrations/*'` empty), so no
schema step and no DB backup. Driven entirely from psbridge on vq04; vq03 and vd03 over WinRM +
`E$` share, same recipe as the 2026-08-20 records.

| Item | Value |
|---|---|
| Publish | Host (`app\`, 520 files) + CLI (`cli\`, 223 files) `-c Release -r win-x64 --self-contained`, `scadabridge-691a2f2f.zip` 125 MB, `psbridge push --compress` (SHA-256 `c11bcf15…`). |
| Staging | `E:\psrem\releases\691a2f2f\unpacked` on vq04; robocopy `/MIR` to `\\wonder-app-vq03\E$\psrem-stage\691a2f2f` and `\\wonder-app-vd03\E$\psrem-stage\691a2f2f` (1246 files each, ProductVersion verified before the swap). |
| QA swap | 06:30:40 — Site pair stopped, Central pair stopped, `app`/`cli` → `app.bak.20260821T063040` / `cli.bak.20260821T063040` on both boxes, stage copied, each box's three `appsettings*.json` copied back, Central pair started, +20 s Site pair started. |
| Prod swap | 06:33:42 — same on vd03 (single host): `app.bak.20260821T063342`, `cli.bak.20260821T063342`. |
| Preserved | `appsettings*.json`, service registry environment, `central\data`, `site\data` on every host. |

### Verification
- `/health/ready` 200 Healthy on all six endpoints: `10.220.158.{2,3}:{8085,8084}` members=2,
  vd03 `:8085`/`:8084` members=1. `Host.dll` ProductVersion `1.0.0+691a2f2f…` on all three.
- Post-boot logs (8 min window): vq03 site/central 0 ERR/FTL; vd03 central 0, site 1 (first-probe
  `member status: Removed`); vq04 central 2 / site 3 — the two `Removed` first-probes plus one FTL
  (below).

### Observed, not a regression
- **vq04 site, `[FTL] ScadaBridge host terminated unexpectedly` at 06:31:20 — the OUTGOING
  `da0bfe2b` process.** `Stop-Service -Force` → CoordinatedShutdown took 10 s (singleton
  handover dead-letters, `Akka.NET actor system shutdown complete` 06:31:20.764), by which time
  `WindowsServiceLifetime.StopAsync` had cancelled its stop token, so `Host.StopAsync` surfaced an
  `OperationCanceledException` that the top-level catch logs as fatal. The process did exit
  (swap guard `Get-Process` passed) and the new build booted clean. Follow-up candidate: align
  `HostOptions.ShutdownTimeout` / the service's SCM stop window with CoordinatedShutdown's budget
  so a graceful stop is not reported as a crash.
- `SiteLocalDbHealthCheck` still reports `replicationConnected:false` on unreplicated vd03
  (cosmetic, noted 2026-08-20).

### Rollback
Per host: stop Site then Central (QA: both boxes together), rename `app` → `app.failed`,
`app.bak.20260821T0630xx` → `app` (same for `cli`), start Central then Site. No schema to revert.