docs(deploy): #793 vd03 upgrade to 5fb4b4db executed — record, preflight needs sqlcmd -I

Claude-Session: https://claude.ai/code/session_01GT67AD99zQQqpLCVm3p7xk

docs/deploy/vd03-upgrade-b8b4c18f-to-master.md

@@ -13,8 +13,8 @@ notes. The evidence:
 Everything below is the `b8b4c18f..master` delta. The ConfigDb schema is the same at both commits. The last
 migration at both is `20260731162342_AddApiKeyTable`.
 
-> ⛔ The remote-exec hold on the wonder boxes still applies (root `CLAUDE.md`): no psbridge and no WinRM. The
-> owner runs every step on the box. SMB copies and direct SQL logins are allowed.
+> **Executed 2026-11-12 (master `5fb4b4db`), owner-authorised WinRM for this upgrade.** See §(h) for the record.
+> The general wonder-box remote-exec hold in the root `CLAUDE.md` is unchanged.
 
 ## Owner actions, in order
 
@@ -258,7 +258,10 @@ The source is `docs/plans/2026-11-10-opcua-sdk-2-rollout.md` (§Sequence, §Roll
 `b8b4c18f` schema and needs SQL Server 2016+ at compatibility level 130 or higher.
 
 **How to run it:**
-`sqlcmd -S <instance> -d OtOpcUaConfig -E -i vd03-preupgrade-b8b4c18f-configdb-checks.sql -W -s "|" -o preflight.txt`
+`sqlcmd -S <instance> -d OtOpcUaConfig -E -I -i vd03-preupgrade-b8b4c18f-configdb-checks.sql -W -s "|" -o preflight.txt`
+
+**`-I` is required.** `sqlcmd` starts with `QUOTED_IDENTIFIER OFF`, and the script's XML-method inserts then fail
+with Msg 1934 after check 2 (found on the 2026-11-12 run).
 
 **Output.**
 - Each check produces a header row (`ok` / `attention` / `info`, the row count, whether it blocks the deploy,
@@ -319,3 +322,36 @@ since the baseline.
 - Whether `b8b4c18f` can reopen LocalDb or outbox files after master has written them; restore them from backup
   on rollback.
 - The current #782 go/hold state. The repo runbook says HOLD.
+
+## (h) Execution record, 2026-11-12 (`b8b4c18f` → `5fb4b4db`)
+
+Run over WinRM (owner-authorised for this upgrade) with staged scripts; the build was a fresh
+`dotnet publish -r win-x64 --self-contained`, zip SHA-256 `D9B88959…4DD6`, 1396 files, staged at
+`E:\ApiInstall\_stage-otopcua-5fb4b4db`.
+
+- **Preflight.** The ConfigDb is on the app box's own instance (`WONDER-APP-VD03`, SQL 16.0.4245, compat 160),
+  not on wonder-sql-vd03. Every blocking check was `ok`. Check 13: one rename (`Spindle/S1/MaxRpm`, TAG-000b5c2fdf3f)
+  and nine value-change rows. The tag was left as authored; on master it reads `BadNodeIdUnknown` until it is
+  re-pointed to `MotorSpeedPct`. Inventory: 1 FOCAS driver, 22 raw tags, 2 UNS references, 0 API keys.
+- **Box facts.** JWT signing key 59 bytes, Issuer/Audience set. `ServerHistorian` enabled → `http://localhost:5221`
+  (HistorianGateway `ea9f21c`, deployed 2026-11-11). Box clock agrees with the Mac within seconds (w32tm source
+  USWAP-VDC-ZMR1); ScadaBridge runs on the same box, so #873 skew does not apply to it. PKI: only the self-signed
+  `A873DF51…` (not a CA); no `issuer\certs`.
+- **Phase 1 (service up).** Registry export and `BACKUP DATABASE … COPY_ONLY` (default backup directory,
+  `OtOpcUaConfig-pre-20261112-otopcua-5fb4b4db.bak`); snapshot-isolation migration applied (`snapshot=ON`, last
+  migration `20261022102459_EnableSnapshotIsolation`); `Security__ApiKeys__Pepper` generated on the box (48 random
+  bytes, base64, never left the box) and added to the service environment (25 → 26 variables).
+- **Phase 2.** Stop (1 s), robocopy of `E:\ApiInstall\OtOpcUa-data` to `E:\ApiInstall\OtOpcUa-backups\pre-20261112-otopcua-5fb4b4db`,
+  folder swap (previous install at `E:\ApiInstall\OtOpcUa.bak.20261112-pre-5fb4b4db`), box `appsettings*`, `pki\`,
+  `logs\` carried, start. **Downtime about 11 s.** Rollback script: `_stage-otopcua-5fb4b4db\rollback.ps1`.
+- **Verified.** `/healthz`, `/health/ready` (opcua-endpoint, script-runner, configdb, config-publish, akka) and
+  `/health/active` all 200. Boot log: `roles=[admin,driver]` with no disagreement warning, and the #815 preflight
+  line "every stored and deployed reference is namespaced". OPC UA: ServiceLevel 255; raw and UNS `parts-count`
+  Good; `Program/Name` carries the live program path.
+- **New log lines.** SDK 2 retries LDS `RegisterServer`/`RegisterServer2` against its own endpoint
+  (`BadServiceUnsupported`, backing off); this is visible now because #874 routes SDK warnings to Serilog. The
+  mesh-PSK refresh warns that `ot-mesh-psk-dev` is absent; the box runs the default DPS mesh transport, so the
+  PSK is not used.
+- **Not done.** The post-deploy "Deploy once" check. `/deployments` shows "Configuration drift", but `ConfigEdit`
+  has no rows after the last seal (2026-08-05), so the drift is master's composer re-serialising the same
+  configuration; the deploy itself was left to the owner.