Phase 1 Streams B–E scaffold + Phase 2 Streams A–C scaffold — 8 new projects with ~70 new tests, all green alongside the 494 v1 IntegrationTests baseline (parity preserved: no v1 tests broken; legacy OtOpcUa.Host untouched). Phase 1 finish: Configuration project (16 entities + 10 enums + DbContext + DesignTimeDbContextFactory + InitialSchema/StoredProcedures/AuthorizationGrants migrations — 8 procs including sp_PublishGeneration with MERGE on ExternalIdReservation per decision #124, sp_RollbackToGeneration cloning rows into a new published generation, sp_ValidateDraft with cross-cluster-namespace + EquipmentUuid-immutability + ZTag/SAPID reservation pre-flight, sp_ComputeGenerationDiff with CHECKSUM-based row signature — plus OtOpcUaNode/OtOpcUaAdmin SQL roles with EXECUTE grants scoped to per-principal-class proc sets and DENY UPDATE/DELETE/INSERT/SELECT on dbo schema); managed DraftValidator covering UNS segment regex, path length, EquipmentUuid immutability across generations, same-cluster namespace binding (decision #122), reservation pre-flight, EquipmentId derivation (decision #125), driver↔namespace compatibility — returning every failing rule in one pass; LiteDB local cache with round-trip + ring pruning + corruption-fast-fail; GenerationApplier with per-entity Added/Removed/Modified diff and dependency-ordered callbacks (namespace → driver → device → equipment → poll-group → tag, Removed before Added); Core project with GenericDriverNodeManager (scaffold for the Phase 2 Galaxy port) and DriverHost lifecycle registry; Server project using Microsoft.Extensions.Hosting BackgroundService replacing TopShelf, with NodeBootstrap that falls back to LiteDB cache when the central DB is unreachable (decision #79); Admin project scaffolded as Blazor Server with Bootstrap 5 sidebar layout, cookie auth, three admin roles (ConfigViewer/ConfigEditor/FleetAdmin), Cluster + Generation services fronting the stored procs. Phase 2 scaffold: Driver.Galaxy.Shared (netstandard2.0) with full MessagePack IPC contract surface — Hello version negotiation, Open/CloseSession, Heartbeat, DiscoverHierarchy + GalaxyObjectInfo/GalaxyAttributeInfo, Read/WriteValues, Subscribe/Unsubscribe/OnDataChange, AlarmSubscribe/Event/Ack, HistoryRead, HostConnectivityStatus, Recycle — plus length-prefixed framing (decision #28) with a 16 MiB cap and thread-safe FrameWriter/FrameReader; Driver.Galaxy.Host (net48) implementing the Tier C cross-cutting protections from driver-stability.md — strict PipeAcl (allow configured server SID only, explicit deny on LocalSystem + Administrators), PipeServer with caller-SID verification via pipe.RunAsClient + WindowsIdentity.GetCurrent and per-process shared-secret Hello, Galaxy-specific MemoryWatchdog (warn at max(1.5×baseline, +200 MB), soft-recycle at max(2×baseline, +200 MB), hard ceiling 1.5 GB, slope ≥5 MB/min over 30-min rolling window), RecyclePolicy (1 soft recycle per hour cap + 03:00 local daily scheduled), PostMortemMmf (1000-entry ring buffer in %ProgramData%\OtOpcUa\driver-postmortem\galaxy.mmf, survives hard crash, readable cross-process), MxAccessHandle : SafeHandle (ReleaseHandle loops Marshal.ReleaseComObject until refcount=0 then calls optional unregister callback), StaPump with responsiveness probe (BlockingCollection dispatcher for Phase 1 — real Win32 GetMessage/DispatchMessage pump slots in with the same semantics when the Galaxy code lift happens), IsExternalInit shim for init setters on .NET 4.8; Driver.Galaxy.Proxy (net10) implementing IDriver + ITagDiscovery forwarding over the IPC channel with MX data-type and security-classification mapping, plus Supervisor pieces — Backoff (5s → 15s → 60s capped, reset-on-stable-run), CircuitBreaker (3 crashes per 5 min opens; 1h → 4h → manual cooldown escalation; sticky alert doesn't auto-clear), HeartbeatMonitor (2s cadence, 3 consecutive misses = host dead per driver-stability.md). Infrastructure: docker SQL Server remapped to host port 14330 to coexist with the native MSSQL14 Galaxy ZB DB instance on 1433; NuGetAuditSuppress applied per-project for two System.Security.Cryptography.Xml advisories that only reach via EF Core Design with PrivateAssets=all (fix ships in 11.0.0-preview); .slnx gains 14 project registrations. Deferred with explicit TODOs in docs/v2/implementation/phase-2-partial-exit-evidence.md: Phase 1 Stream E Admin UI pages (Generations listing + draft-diff-publish, Equipment CRUD with OPC 40010 fields, UNS Areas/Lines tabs, ACLs + permission simulator, Generic JSON config editor, SignalR real-time, Release-Reservation + Merge-Equipment workflows, LDAP login page, AppServer smoke test per decision #142), Phase 2 Stream D (Galaxy MXAccess code lift out of legacy OtOpcUa.Host, dual-service installer, appsettings → DriverConfig migration script, legacy Host deletion — blocked by parity), Phase 2 Stream E (v1 IntegrationTests against v2 topology, Client.CLI walkthrough diff, four 2026-04-13 stability findings regression tests, adversarial review — requires live MXAccess runtime).

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

src/ZB.MOM.WW.OtOpcUa.Server/NodeBootstrap.cs

@@ -0,0 +1,64 @@
+using Microsoft.Data.SqlClient;
+using Microsoft.Extensions.Logging;
+using ZB.MOM.WW.OtOpcUa.Configuration.LocalCache;
+
+namespace ZB.MOM.WW.OtOpcUa.Server;
+
+/// <summary>
+///     Bootstraps a node: fetches the current generation from the central DB via
+///     <c>sp_GetCurrentGenerationForCluster</c>. If the DB is unreachable and a LiteDB cache entry
+///     exists, falls back to cached config per decision #79 (degraded-but-running).
+/// </summary>
+public sealed class NodeBootstrap(
+    NodeOptions options,
+    ILocalConfigCache localCache,
+    ILogger<NodeBootstrap> logger)
+{
+    public async Task<BootstrapResult> LoadCurrentGenerationAsync(CancellationToken ct)
+    {
+        try
+        {
+            await using var conn = new SqlConnection(options.ConfigDbConnectionString);
+            await conn.OpenAsync(ct);
+
+            await using var cmd = conn.CreateCommand();
+            cmd.CommandText = "EXEC dbo.sp_GetCurrentGenerationForCluster @NodeId=@n, @ClusterId=@c";
+            cmd.Parameters.AddWithValue("@n", options.NodeId);
+            cmd.Parameters.AddWithValue("@c", options.ClusterId);
+
+            await using var reader = await cmd.ExecuteReaderAsync(ct);
+            if (!await reader.ReadAsync(ct))
+            {
+                logger.LogWarning("Cluster {Cluster} has no Published generation yet", options.ClusterId);
+                return BootstrapResult.EmptyFromDb();
+            }
+
+            var generationId = reader.GetInt64(0);
+            logger.LogInformation("Bootstrapped from central DB: generation {GenerationId}", generationId);
+            return BootstrapResult.FromDb(generationId);
+        }
+        catch (Exception ex) when (ex is SqlException or InvalidOperationException or TimeoutException)
+        {
+            logger.LogWarning(ex, "Central DB unreachable; trying LiteDB cache fallback (decision #79)");
+            var cached = await localCache.GetMostRecentAsync(options.ClusterId, ct);
+            if (cached is null)
+                throw new BootstrapException(
+                    "Central DB unreachable and no local cache available — cannot bootstrap.", ex);
+
+            logger.LogWarning("Bootstrapping from cache: generation {GenerationId} cached at {At}",
+                cached.GenerationId, cached.CachedAt);
+            return BootstrapResult.FromCache(cached.GenerationId);
+        }
+    }
+}
+
+public sealed record BootstrapResult(long? GenerationId, BootstrapSource Source)
+{
+    public static BootstrapResult FromDb(long g) => new(g, BootstrapSource.CentralDb);
+    public static BootstrapResult FromCache(long g) => new(g, BootstrapSource.LocalCache);
+    public static BootstrapResult EmptyFromDb() => new(null, BootstrapSource.CentralDb);
+}
+
+public enum BootstrapSource { CentralDb, LocalCache }
+
+public sealed class BootstrapException(string message, Exception inner) : Exception(message, inner);

src/ZB.MOM.WW.OtOpcUa.Server/NodeOptions.cs

@@ -0,0 +1,23 @@
+namespace ZB.MOM.WW.OtOpcUa.Server;
+
+/// <summary>
+///     Bootstrap configuration read from <c>appsettings.json</c> (decision #18) — the minimum a
+///     node needs to reach the central config DB and identify itself. Everything else comes from
+///     the DB after bootstrap succeeds.
+/// </summary>
+public sealed class NodeOptions
+{
+    public const string SectionName = "Node";
+
+    /// <summary>Stable node ID matching <c>ClusterNode.NodeId</c> in the central config DB.</summary>
+    public required string NodeId { get; init; }
+
+    /// <summary>Cluster this node belongs to.</summary>
+    public required string ClusterId { get; init; }
+
+    /// <summary>SQL Server connection string for the central config DB.</summary>
+    public required string ConfigDbConnectionString { get; init; }
+
+    /// <summary>Path to the LiteDB local cache file.</summary>
+    public string LocalCachePath { get; init; } = "config_cache.db";
+}

src/ZB.MOM.WW.OtOpcUa.Server/OpcUaServerService.cs

@@ -0,0 +1,45 @@
+using Microsoft.Extensions.Hosting;
+using Microsoft.Extensions.Logging;
+using ZB.MOM.WW.OtOpcUa.Core.Hosting;
+
+namespace ZB.MOM.WW.OtOpcUa.Server;
+
+/// <summary>
+///     BackgroundService that owns the OPC UA server lifecycle (decision #30, replacing TopShelf).
+///     Bootstraps config, starts the <see cref="DriverHost"/>, and runs until stopped.
+///     Phase 1 scope: bootstrap-only — the OPC UA transport layer that serves endpoints stays in
+///     the legacy Host until the Phase 2 cutover.
+/// </summary>
+public sealed class OpcUaServerService(
+    NodeBootstrap bootstrap,
+    DriverHost driverHost,
+    ILogger<OpcUaServerService> logger) : BackgroundService
+{
+    protected override async Task ExecuteAsync(CancellationToken stoppingToken)
+    {
+        logger.LogInformation("OtOpcUa.Server starting");
+
+        var result = await bootstrap.LoadCurrentGenerationAsync(stoppingToken);
+        logger.LogInformation("Bootstrap complete: source={Source} generation={Gen}", result.Source, result.GenerationId);
+
+        // Phase 1: no drivers are wired up at bootstrap — Galaxy still lives in legacy Host.
+        // Phase 2 will register drivers here based on the fetched generation.
+
+        logger.LogInformation("OtOpcUa.Server running. Hosted drivers: {Count}", driverHost.RegisteredDriverIds.Count);
+
+        try
+        {
+            await Task.Delay(Timeout.InfiniteTimeSpan, stoppingToken);
+        }
+        catch (OperationCanceledException)
+        {
+            logger.LogInformation("OtOpcUa.Server stopping");
+        }
+    }
+
+    public override async Task StopAsync(CancellationToken cancellationToken)
+    {
+        await base.StopAsync(cancellationToken);
+        await driverHost.DisposeAsync();
+    }
+}

src/ZB.MOM.WW.OtOpcUa.Server/Program.cs

@@ -0,0 +1,39 @@
+using Microsoft.Extensions.Configuration;
+using Microsoft.Extensions.DependencyInjection;
+using Microsoft.Extensions.Hosting;
+using Serilog;
+using ZB.MOM.WW.OtOpcUa.Configuration.LocalCache;
+using ZB.MOM.WW.OtOpcUa.Core.Hosting;
+using ZB.MOM.WW.OtOpcUa.Server;
+
+var builder = Host.CreateApplicationBuilder(args);
+
+Log.Logger = new LoggerConfiguration()
+    .ReadFrom.Configuration(builder.Configuration)
+    .WriteTo.Console()
+    .WriteTo.File("logs/otopcua-.log", rollingInterval: RollingInterval.Day)
+    .CreateLogger();
+
+builder.Services.AddSerilog();
+builder.Services.AddWindowsService(o => o.ServiceName = "OtOpcUa");
+
+var nodeSection = builder.Configuration.GetSection(NodeOptions.SectionName);
+var options = new NodeOptions
+{
+    NodeId = nodeSection.GetValue<string>("NodeId")
+             ?? throw new InvalidOperationException("Node:NodeId not configured"),
+    ClusterId = nodeSection.GetValue<string>("ClusterId")
+             ?? throw new InvalidOperationException("Node:ClusterId not configured"),
+    ConfigDbConnectionString = nodeSection.GetValue<string>("ConfigDbConnectionString")
+             ?? throw new InvalidOperationException("Node:ConfigDbConnectionString not configured"),
+    LocalCachePath = nodeSection.GetValue<string>("LocalCachePath") ?? "config_cache.db",
+};
+
+builder.Services.AddSingleton(options);
+builder.Services.AddSingleton<ILocalConfigCache>(_ => new LiteDbConfigCache(options.LocalCachePath));
+builder.Services.AddSingleton<DriverHost>();
+builder.Services.AddSingleton<NodeBootstrap>();
+builder.Services.AddHostedService<OpcUaServerService>();
+
+var host = builder.Build();
+await host.RunAsync();

src/ZB.MOM.WW.OtOpcUa.Server/ZB.MOM.WW.OtOpcUa.Server.csproj

@@ -0,0 +1,35 @@
+<Project Sdk="Microsoft.NET.Sdk">
+
+    <PropertyGroup>
+        <OutputType>Exe</OutputType>
+        <TargetFramework>net10.0</TargetFramework>
+        <Nullable>enable</Nullable>
+        <ImplicitUsings>enable</ImplicitUsings>
+        <LangVersion>latest</LangVersion>
+        <TreatWarningsAsErrors>true</TreatWarningsAsErrors>
+        <GenerateDocumentationFile>true</GenerateDocumentationFile>
+        <NoWarn>$(NoWarn);CS1591</NoWarn>
+        <RootNamespace>ZB.MOM.WW.OtOpcUa.Server</RootNamespace>
+        <AssemblyName>OtOpcUa.Server</AssemblyName>
+    </PropertyGroup>
+
+    <ItemGroup>
+        <PackageReference Include="Microsoft.Extensions.Hosting" Version="10.0.0"/>
+        <PackageReference Include="Microsoft.Extensions.Hosting.WindowsServices" Version="10.0.0"/>
+        <PackageReference Include="Microsoft.Extensions.Configuration.Json" Version="10.0.0"/>
+        <PackageReference Include="Serilog.Extensions.Hosting" Version="9.0.0"/>
+        <PackageReference Include="Serilog.Settings.Configuration" Version="9.0.0"/>
+        <PackageReference Include="Serilog.Sinks.Console" Version="6.0.0"/>
+        <PackageReference Include="Serilog.Sinks.File" Version="7.0.0"/>
+    </ItemGroup>
+
+    <ItemGroup>
+        <ProjectReference Include="..\ZB.MOM.WW.OtOpcUa.Core\ZB.MOM.WW.OtOpcUa.Core.csproj"/>
+    </ItemGroup>
+
+    <ItemGroup>
+        <NuGetAuditSuppress Include="https://github.com/advisories/GHSA-37gx-xxp4-5rgx"/>
+        <NuGetAuditSuppress Include="https://github.com/advisories/GHSA-w3x6-4m5h-cxqf"/>
+    </ItemGroup>
+
+</Project>

src/ZB.MOM.WW.OtOpcUa.Server/appsettings.json

@@ -0,0 +1,11 @@
+{
+  "Serilog": {
+    "MinimumLevel": "Information"
+  },
+  "Node": {
+    "NodeId": "node-dev-a",
+    "ClusterId": "cluster-dev",
+    "ConfigDbConnectionString": "Server=localhost,14330;Database=OtOpcUaConfig;Integrated Security=True;TrustServerCertificate=True;Encrypt=False;",
+    "LocalCachePath": "config_cache.db"
+  }
+}