diff --git a/docs/deploy/vd03-upgrade-b8b4c18f-to-master.md b/docs/deploy/vd03-upgrade-b8b4c18f-to-master.md
index b38297953..4863087f3 100644
--- a/docs/deploy/vd03-upgrade-b8b4c18f-to-master.md
+++ b/docs/deploy/vd03-upgrade-b8b4c18f-to-master.md
@@ -1,4 +1,8 @@
-# wonder-app-vd03 upgrade: `b8b4c18f` → master `363f0d81`
+# wonder-app-vd03 upgrade: `b8b4c18f` → master `5fb4b4db`
+
+> **Status: EXECUTED 2026-11-12** — vd03 runs `5fb4b4db`. The readiness notes (§a–§g) were written against master
+> `363f0d81`; nothing between that and `5fb4b4db` changed the schema, configuration or preflight. The execution
+> record is §(h); the owner-action table and "Not determined" list below carry the outcomes.
 
 Upgrade-readiness notes for the DEV box wonder-app-vd03. The box runs the `OtOpcUaHost` service from
 `E:\ApiInstall\OtOpcUa`: one fused admin+driver node with one FOCAS driver (Makino Z-34184). The ConfigDb
@@ -18,14 +22,14 @@ migration at both is `20260731162342_AddApiKeyTable`.
 
 ## Owner actions, in order
 
-| # | Action | Blocks | Source |
-|---|---|---|---|
-| 1 | Run `scripts/preflight/vd03-preupgrade-b8b4c18f-configdb-checks.sql` against `OtOpcUaConfig`, then fix every `attention` + `blocking = YES` row. | The first deploy on master | §g |
-| 2 | **Add `Security__ApiKeys__Pepper`** to the service environment (at least 16 characters, or a `${secret:}` reference). The box does not have this setting. | **Host start**: the host exits with code 1 | §b |
-| 3 | Check that `Security__Jwt__SigningKey` is at least 32 UTF-8 bytes. | Host start | §b |
-| 4 | Apply the `EnableSnapshotIsolation` migration to `OtOpcUaConfig`. | Every deploy (SQL error 3952) | §a |
-| 5 | Check the 22 FOCAS tags for the `MaxRpm` → `MotorSpeedPct` and `AA_1/AA_2` → `AA6/AA7` renames, and for `String` on MACRO/PMC/PARAM addresses. Tell ScadaBridge about the FOCAS value changes. | Client-visible | §d, check 13 |
-| 6 | Make the #782 go/hold decision for SDK 2.0.1. The rollout runbook still marks it **HOLD**. | Policy | §c |
+| # | Action | Blocks | Source | Outcome (2026-11-12) |
+|---|---|---|---|---|
+| 1 | Run `scripts/preflight/vd03-preupgrade-b8b4c18f-configdb-checks.sql` against `OtOpcUaConfig`, then fix every `attention` + `blocking = YES` row. | The first deploy on master | §g | **Done.** Every blocking check `ok` (run with `sqlcmd -I`, see §g). |
+| 2 | **Add `Security__ApiKeys__Pepper`** to the service environment (at least 16 characters, or a `${secret:}` reference). The box does not have this setting. | **Host start**: the host exits with code 1 | §b | **Done.** Generated on the box; service environment 25 → 26 variables. |
+| 3 | Check that `Security__Jwt__SigningKey` is at least 32 UTF-8 bytes. | Host start | §b | **Done.** 59 bytes; Issuer/Audience set. |
+| 4 | Apply the `EnableSnapshotIsolation` migration to `OtOpcUaConfig`. | Every deploy (SQL error 3952) | §a | **Done.** `snapshot=ON`; post-deploy deploy had no 3952. |
+| 5 | Check the 22 FOCAS tags for the `MaxRpm` → `MotorSpeedPct` and `AA_1/AA_2` → `AA6/AA7` renames, and for `String` on MACRO/PMC/PARAM addresses. Tell ScadaBridge about the FOCAS value changes. | Client-visible | §d, check 13 | **OPEN.** One rename found (`Spindle/S1/MaxRpm`, TAG-000b5c2fdf3f), left as authored — it reads `BadNodeIdUnknown` until re-pointed to `MotorSpeedPct`. Nine value-change rows. ScadaBridge not yet told. |
+| 6 | Make the #782 go/hold decision for SDK 2.0.1. The rollout runbook still marks it **HOLD**. | Policy | §c | **Done.** Owner go for vd03, recorded in #782 (2026-11-12). The runbook's general HOLD for other hosts is unchanged. |
 
 ## (a) ConfigDb migration
 
@@ -314,14 +318,17 @@ since the baseline.
 
 ## Not determined
 
-- Whether the box's `ServerHistorian__Enabled` is true, and if so, which HistorianGateway build it points at
-  (client 1.0.0 compatibility).
-- Whether the box's JWT signing key is at least 32 bytes.
+Resolved during the 2026-11-12 run (§h):
+- ~~`ServerHistorian__Enabled`~~: enabled, pointing at `http://localhost:5221` — HistorianGateway `ea9f21c`
+  (Contracts/Client 1.0.0, deployed 2026-11-11).
+- ~~JWT signing key length~~: 59 bytes.
+- ~~#782 go/hold~~: owner go for vd03, recorded in #782.
+
+Still not determined:
 - Whether `Security:Acl:Enabled` is on.
 - ScadaBridge's security mode against vd03.
-- Whether `b8b4c18f` can reopen LocalDb or outbox files after master has written them; restore them from backup
-  on rollback.
-- The current #782 go/hold state. The repo runbook says HOLD.
+- Whether `b8b4c18f` can reopen LocalDb or outbox files after master has written them. Not exercised (no
+  rollback was needed); restore `data\` from the backup on rollback.
 
 ## (h) Execution record, 2026-11-12 (`b8b4c18f` → `5fb4b4db`)
 
@@ -349,7 +356,7 @@ Run over WinRM (owner-authorised for this upgrade) with staged scripts; the buil
   line "every stored and deployed reference is namespaced". OPC UA: ServiceLevel 255; raw and UNS `parts-count`
   Good; `Program/Name` carries the live program path.
 - **New log lines.** SDK 2 retries LDS `RegisterServer`/`RegisterServer2` against its own endpoint
-  (`BadServiceUnsupported`, backing off); this is visible now because #874 routes SDK warnings to Serilog. The
+  (`BadServiceUnsupported`, backing off); this is visible now because #874 routes SDK warnings to Serilog (#876). The
   mesh-PSK refresh warns that `ot-mesh-psk-dev` is absent; the box runs the default DPS mesh transport, so the
   PSK is not used.
 - **Post-deploy deploy (owner-authorised, 11:02 UTC).** `/deployments` "Deploy current configuration" →