docs(deploy): #793 vd03 close-out — MaxRpm re-pointed (9adc5590), ACL off, ScadaBridge N/A, rollback compatible

docs/deploy/vd03-upgrade-b8b4c18f-to-master.md

@@ -2,7 +2,8 @@
 
 > **Status: EXECUTED 2026-11-12** — vd03 runs `5fb4b4db`. The readiness notes (§a–§g) were written against master
 > `363f0d81`; nothing between that and `5fb4b4db` changed the schema, configuration or preflight. The execution
-> record is §(h); the owner-action table and "Not determined" list below carry the outcomes.
+> record is §(h); the owner-action table and "Not determined" list below carry the outcomes. **All six owner actions
+> are closed and nothing is left undetermined (close-out 2026-11-12, §h last bullet).**
 
 Upgrade-readiness notes for the DEV box wonder-app-vd03. The box runs the `OtOpcUaHost` service from
 `E:\ApiInstall\OtOpcUa`: one fused admin+driver node with one FOCAS driver (Makino Z-34184). The ConfigDb
@@ -28,7 +29,7 @@ migration at both is `20260731162342_AddApiKeyTable`.
 | 2 | **Add `Security__ApiKeys__Pepper`** to the service environment (at least 16 characters, or a `${secret:}` reference). The box does not have this setting. | **Host start**: the host exits with code 1 | §b | **Done.** Generated on the box; service environment 25 → 26 variables. |
 | 3 | Check that `Security__Jwt__SigningKey` is at least 32 UTF-8 bytes. | Host start | §b | **Done.** 59 bytes; Issuer/Audience set. |
 | 4 | Apply the `EnableSnapshotIsolation` migration to `OtOpcUaConfig`. | Every deploy (SQL error 3952) | §a | **Done.** `snapshot=ON`; post-deploy deploy had no 3952. |
-| 5 | Check the 22 FOCAS tags for the `MaxRpm` → `MotorSpeedPct` and `AA_1/AA_2` → `AA6/AA7` renames, and for `String` on MACRO/PMC/PARAM addresses. Tell ScadaBridge about the FOCAS value changes. | Client-visible | §d, check 13 | **OPEN.** One rename found (`Spindle/S1/MaxRpm`, TAG-000b5c2fdf3f), left as authored — it reads `BadNodeIdUnknown` until re-pointed to `MotorSpeedPct`. Nine value-change rows. ScadaBridge not yet told. |
+| 5 | Check the 22 FOCAS tags for the `MaxRpm` → `MotorSpeedPct` and `AA_1/AA_2` → `AA6/AA7` renames, and for `String` on MACRO/PMC/PARAM addresses. Tell ScadaBridge about the FOCAS value changes. | Client-visible | §d, check 13 | **Done.** The one rename (`Spindle/S1/MaxRpm`, TAG-000b5c2fdf3f) was re-pointed and renamed `MotorSpeedPct` (address `FIXED:Spindle/S1/MotorSpeedPct`, Float64 / Double) and shipped in deployment `9adc5590` (11:06 UTC, Applied); it reads Good. Nine value-change rows. **ScadaBridge: not applicable on vd03** — its only data connection there is `MxGateway` (`localhost:5120`), with no OPC UA connection to OtOpcUa; the consumer-impact list lives in scadaproj `sister-project-history/otopcua.md` for when ScadaBridge binds OtOpcUa (QA is still on `b8b4c18f`). |
 | 6 | Make the #782 go/hold decision for SDK 2.0.1. The rollout runbook still marks it **HOLD**. | Policy | §c | **Done.** Owner go for vd03, recorded in #782 (2026-11-12). The runbook's general HOLD for other hosts is unchanged. |
 
 ## (a) ConfigDb migration
@@ -324,11 +325,17 @@ Resolved during the 2026-11-12 run (§h):
 - ~~JWT signing key length~~: 59 bytes.
 - ~~#782 go/hold~~: owner go for vd03, recorded in #782.
 
-Still not determined:
-- Whether `Security:Acl:Enabled` is on.
-- ScadaBridge's security mode against vd03.
-- Whether `b8b4c18f` can reopen LocalDb or outbox files after master has written them. Not exercised (no
-  rollback was needed); restore `data\` from the backup on rollback.
+- ~~`Security:Acl:Enabled`~~: **off.** Neither `appsettings.json` nor `appsettings.admin-driver.json` has a
+  `Security:Acl` section (default `false`), and the 05:56 boot log has no `node ACL enforcement is ENABLED`
+  warning, which `OtOpcUaServerHostedService` logs whenever it is on.
+- ~~ScadaBridge's security mode against vd03~~: **not applicable.** ScadaBridge's management API on vd03 lists one
+  data connection, `MxGateway` (`http://localhost:5120`); it has no OPC UA connection to this server.
+- ~~Rollback reopen of `data\`~~: **compatible.** LocalDb stays at `0.3.4` at both commits; master's only LocalDb
+  schema change is the additive `alarm_condition_comment` table (plus a move of the scripted-alarm comment trail
+  out of `alarm_condition_state.comments_json`). A copy of vd03's `otopcua-localdb.db` taken over SMB after the
+  upgrade has 0 rows in `alarm_condition_state` and `alarm_condition_comment`, so a rollback loses nothing. The
+  FasterLog outbox is not in use (`ContinuousHistorization:Enabled=false`), and neither is the alarm
+  store-and-forward (`AlarmHistorian:Enabled=false`). The rollback still restores `data\` from the backup.
 
 ## (h) Execution record, 2026-11-12 (`b8b4c18f` → `5fb4b4db`)
 
@@ -364,3 +371,8 @@ Run over WinRM (owner-authorised for this upgrade) with staged scripts; the buil
   degraded), no failure reason; no 3952. The drift had been master's composer re-serialising the 2026-08-05
   configuration (0 `ConfigEdit` rows since that seal). Afterwards: ServiceLevel 255, `parts-count` and
   `Program/Name` Good, `/health/ready` 200.
+- **Close-out (2026-11-12, after the deploy).** Done without WinRM: SMB reads of the box's appsettings, boot log
+  and a LocalDb copy; ScadaBridge's management API; the AdminUI; and the Client CLI. The `MaxRpm` tag had already
+  been re-pointed in the AdminUI and deployed as `9adc5590` (11:06:43 UTC, `/fleet` Applied, chip "In sync").
+  Client CLI reads: `…/Spindle/S1/MotorSpeedPct` Good (0, spindle idle), `…/Spindle/S1/Load` Good,
+  `…/Spindle/S1/MaxRpm` `BadNodeIdUnknown` as expected, and the UNS `parts-count`/`parts-required` still present.