diff --git a/docs/deploy/vd03-upgrade-b8b4c18f-to-master.md b/docs/deploy/vd03-upgrade-b8b4c18f-to-master.md index 4863087f3..6523e4f45 100644 --- a/docs/deploy/vd03-upgrade-b8b4c18f-to-master.md +++ b/docs/deploy/vd03-upgrade-b8b4c18f-to-master.md @@ -2,7 +2,8 @@ > **Status: EXECUTED 2026-11-12** — vd03 runs `5fb4b4db`. The readiness notes (§a–§g) were written against master > `363f0d81`; nothing between that and `5fb4b4db` changed the schema, configuration or preflight. The execution -> record is §(h); the owner-action table and "Not determined" list below carry the outcomes. +> record is §(h); the owner-action table and "Not determined" list below carry the outcomes. **All six owner actions +> are closed and nothing is left undetermined (close-out 2026-11-12, §h last bullet).** Upgrade-readiness notes for the DEV box wonder-app-vd03. The box runs the `OtOpcUaHost` service from `E:\ApiInstall\OtOpcUa`: one fused admin+driver node with one FOCAS driver (Makino Z-34184). The ConfigDb @@ -28,7 +29,7 @@ migration at both is `20260731162342_AddApiKeyTable`. | 2 | **Add `Security__ApiKeys__Pepper`** to the service environment (at least 16 characters, or a `${secret:}` reference). The box does not have this setting. | **Host start**: the host exits with code 1 | §b | **Done.** Generated on the box; service environment 25 → 26 variables. | | 3 | Check that `Security__Jwt__SigningKey` is at least 32 UTF-8 bytes. | Host start | §b | **Done.** 59 bytes; Issuer/Audience set. | | 4 | Apply the `EnableSnapshotIsolation` migration to `OtOpcUaConfig`. | Every deploy (SQL error 3952) | §a | **Done.** `snapshot=ON`; post-deploy deploy had no 3952. | -| 5 | Check the 22 FOCAS tags for the `MaxRpm` → `MotorSpeedPct` and `AA_1/AA_2` → `AA6/AA7` renames, and for `String` on MACRO/PMC/PARAM addresses. Tell ScadaBridge about the FOCAS value changes. | Client-visible | §d, check 13 | **OPEN.** One rename found (`Spindle/S1/MaxRpm`, TAG-000b5c2fdf3f), left as authored — it reads `BadNodeIdUnknown` until re-pointed to `MotorSpeedPct`. Nine value-change rows. ScadaBridge not yet told. | +| 5 | Check the 22 FOCAS tags for the `MaxRpm` → `MotorSpeedPct` and `AA_1/AA_2` → `AA6/AA7` renames, and for `String` on MACRO/PMC/PARAM addresses. Tell ScadaBridge about the FOCAS value changes. | Client-visible | §d, check 13 | **Done.** The one rename (`Spindle/S1/MaxRpm`, TAG-000b5c2fdf3f) was re-pointed and renamed `MotorSpeedPct` (address `FIXED:Spindle/S1/MotorSpeedPct`, Float64 / Double) and shipped in deployment `9adc5590` (11:06 UTC, Applied); it reads Good. Nine value-change rows. **ScadaBridge: not applicable on vd03** — its only data connection there is `MxGateway` (`localhost:5120`), with no OPC UA connection to OtOpcUa; the consumer-impact list lives in scadaproj `sister-project-history/otopcua.md` for when ScadaBridge binds OtOpcUa (QA is still on `b8b4c18f`). | | 6 | Make the #782 go/hold decision for SDK 2.0.1. The rollout runbook still marks it **HOLD**. | Policy | §c | **Done.** Owner go for vd03, recorded in #782 (2026-11-12). The runbook's general HOLD for other hosts is unchanged. | ## (a) ConfigDb migration @@ -324,11 +325,17 @@ Resolved during the 2026-11-12 run (§h): - ~~JWT signing key length~~: 59 bytes. - ~~#782 go/hold~~: owner go for vd03, recorded in #782. -Still not determined: -- Whether `Security:Acl:Enabled` is on. -- ScadaBridge's security mode against vd03. -- Whether `b8b4c18f` can reopen LocalDb or outbox files after master has written them. Not exercised (no - rollback was needed); restore `data\` from the backup on rollback. +- ~~`Security:Acl:Enabled`~~: **off.** Neither `appsettings.json` nor `appsettings.admin-driver.json` has a + `Security:Acl` section (default `false`), and the 05:56 boot log has no `node ACL enforcement is ENABLED` + warning, which `OtOpcUaServerHostedService` logs whenever it is on. +- ~~ScadaBridge's security mode against vd03~~: **not applicable.** ScadaBridge's management API on vd03 lists one + data connection, `MxGateway` (`http://localhost:5120`); it has no OPC UA connection to this server. +- ~~Rollback reopen of `data\`~~: **compatible.** LocalDb stays at `0.3.4` at both commits; master's only LocalDb + schema change is the additive `alarm_condition_comment` table (plus a move of the scripted-alarm comment trail + out of `alarm_condition_state.comments_json`). A copy of vd03's `otopcua-localdb.db` taken over SMB after the + upgrade has 0 rows in `alarm_condition_state` and `alarm_condition_comment`, so a rollback loses nothing. The + FasterLog outbox is not in use (`ContinuousHistorization:Enabled=false`), and neither is the alarm + store-and-forward (`AlarmHistorian:Enabled=false`). The rollback still restores `data\` from the backup. ## (h) Execution record, 2026-11-12 (`b8b4c18f` → `5fb4b4db`) @@ -364,3 +371,8 @@ Run over WinRM (owner-authorised for this upgrade) with staged scripts; the buil degraded), no failure reason; no 3952. The drift had been master's composer re-serialising the 2026-08-05 configuration (0 `ConfigEdit` rows since that seal). Afterwards: ServiceLevel 255, `parts-count` and `Program/Name` Good, `/health/ready` 200. +- **Close-out (2026-11-12, after the deploy).** Done without WinRM: SMB reads of the box's appsettings, boot log + and a LocalDb copy; ScadaBridge's management API; the AdminUI; and the Client CLI. The `MaxRpm` tag had already + been re-pointed in the AdminUI and deployed as `9adc5590` (11:06:43 UTC, `/fleet` Applied, chip "In sync"). + Client CLI reads: `…/Spindle/S1/MotorSpeedPct` Good (0, spindle idle), `…/Spindle/S1/Load` Good, + `…/Spindle/S1/MaxRpm` `BadNodeIdUnknown` as expected, and the UNS `parts-count`/`parts-required` still present.