ScadaBridge/docs/deployment/deployment-records/2026-08-21-zb-servers-691a2f2f.md

Deployment record — QA (wonder-app-vq03/vq04) + prod (wonder-app-vd03) — 2026-08-21

Binary-only upgrade of all three ZB hosts from da0bfe2b to main @ 691a2f2f (create-time connection bindings: Create Instance page binds module groups via IFlatteningPipeline.PreviewAsync, NodeBrowserDialog.SelectableNodeClasses, Create → bindings → Configure). No EF migrations between the two builds (git diff --stat da0bfe2b..691a2f2f -- '**/Migrations/*' empty), so no schema step and no DB backup. Driven entirely from psbridge on vq04; vq03 and vd03 over WinRM + E$ share, same recipe as the 2026-08-20 records.

Item	Value
Publish	Host (app\, 520 files) + CLI (cli\, 223 files) -c Release -r win-x64 --self-contained, scadabridge-691a2f2f.zip 125 MB, psbridge push --compress (SHA-256 c11bcf15…).
Staging	E:\psrem\releases\691a2f2f\unpacked on vq04; robocopy /MIR to \\wonder-app-vq03\E$\psrem-stage\691a2f2f and \\wonder-app-vd03\E$\psrem-stage\691a2f2f (1246 files each, ProductVersion verified before the swap).
QA swap	06:30:40 — Site pair stopped, Central pair stopped, app/cli → app.bak.20260821T063040 / cli.bak.20260821T063040 on both boxes, stage copied, each box's three appsettings*.json copied back, Central pair started, +20 s Site pair started.
Prod swap	06:33:42 — same on vd03 (single host): app.bak.20260821T063342, cli.bak.20260821T063342.
Preserved	appsettings*.json, service registry environment, central\data, site\data on every host.

Verification

• /health/ready 200 Healthy on all six endpoints: 10.220.158.{2,3}:{8085,8084} members=2, vd03 :8085/:8084 members=1. Host.dll ProductVersion 1.0.0+691a2f2f… on all three.
• Post-boot logs (8 min window): vq03 site/central 0 ERR/FTL; vd03 central 0, site 1 (first-probe member status: Removed); vq04 central 2 / site 3 — the two Removed first-probes plus one FTL (below).

Observed, not a regression

• vq04 site, [FTL] ScadaBridge host terminated unexpectedly at 06:31:20 — the OUTGOING da0bfe2b process. Stop-Service -Force → CoordinatedShutdown took 10 s (singleton handover dead-letters, Akka.NET actor system shutdown complete 06:31:20.764), by which time WindowsServiceLifetime.StopAsync had cancelled its stop token, so Host.StopAsync surfaced an OperationCanceledException that the top-level catch logs as fatal. The process did exit (swap guard Get-Process passed) and the new build booted clean. Follow-up candidate: align HostOptions.ShutdownTimeout / the service's SCM stop window with CoordinatedShutdown's budget so a graceful stop is not reported as a crash.
• SiteLocalDbHealthCheck still reports replicationConnected:false on unreplicated vd03 (cosmetic, noted 2026-08-20).

Rollback

Per host: stop Site then Central (QA: both boxes together), rename app → app.failed, app.bak.20260821T0630xx → app (same for cli), start Central then Site. No schema to revert.