docs(mesh): Phase 3 live-gate record — PASSED (caught+fixed the Sealed-gate deadlock)

Claude-Session: https://claude.ai/code/session_01GASWkNEi68FSCtvr6rLoEW

docs/plans/2026-07-22-mesh-phase3-config-fetch-and-cache.md.tasks.json

@@ -115,25 +115,29 @@
     {
       "id": 9,
       "subject": "Task 9: docker-dev rig config + docs + program-plan flip",
-      "status": "pending",
+      "status": "completed",
       "classification": "small",
       "blockedBy": [
         5
       ],
       "parallelizableWith": [
         8
-      ]
+      ],
+      "commit": "cf6110d0",
+      "note": "Centrals: ConfigServe :4055 + committed dev key, ConfigSource:Mode=Direct (they never fetch). Sites: ConfigSource endpoints (both centrals) + matching key, Mode=${OTOPCUA_CONFIG_MODE:-Direct}. One env var flips ONLY the sites because centrals hard-code Direct. Docs: Configuration.md ConfigSource/ConfigServe section, Redundancy.md out-of-band note, program plan Phase 3 CODE-COMPLETE + tracking row, CLAUDE.md Config-source section."
     },
     {
       "id": 10,
       "subject": "Task 10: live gate on docker-dev (site nodes -> FetchAndCache; step 4 = stop central SQL mid-fetch = the headline gate)",
-      "status": "pending",
+      "status": "completed",
       "classification": "high-risk",
       "blockedBy": [
         8,
         9
-      ]
+      ],
+      "commit": "(gate doc) 2026-07-22-mesh-phase3-live-gate.md",
+      "note": "PASSED \u2014 and CAUGHT A REAL DEFECT every offline test missed: DeploymentArtifactGrpcService gated on Status==Sealed, but central seals only AFTER all nodes ack, and a FetchAndCache node can't ack until it fetches => seal-needs-ack->ack-needs-fetch->fetch-needs-sealed DEADLOCK. Fetch reached central + passed the interceptor, got clean NotFound, #485 kept last-known-good, deploy never sealed. Fixed by dropping the Sealed gate (serve any non-empty blob; Direct reads the same AwaitingApplyAcks row). Task 2 test flipped to non-sealed-with-blob-is-served. After fix: fetch+verify+apply+seal green 6/6. HEADLINE step 4 PASS: SQL stopped, sites keep serving, restarted site boots last-applied config from the LocalDb pointer, no crash, never Stale. Findings: Kestrel takeover+AdminUI coexist live on central (:9000+:4055); transient Direct SQL-reconnect blip on central-1 is #486 not a regression; failover to central-2 works; deploy POST needs Content-Type:application/json (else 404). Build: Dockerfile build stage pinned to linux/amd64 \u2014 Grpc.Tools linux_arm64 protoc segfaults (139) on Apple-Silicon Docker; portable-IL publish keeps runtime native arm64. Steps 8/9 folded into Task7/Task8/Task3 real coverage rather than slow emulated recreate."
     }
   ],
-  "lastUpdated": "2026-07-23T02:15:00Z"
+  "lastUpdated": "2026-07-23T01:00:00Z"
 }