up

docs/deploy/containers.md

@@ -12,6 +12,11 @@ This guide supplements existing deployment manuals with AOC-specific configurati
 ### 1.1 MongoDB validators
 
 - Apply JSON schema validators to `advisory_raw` and `vex_raw` collections before enabling AOC guards.
+- Before enabling validators or the idempotency index, run the duplicate audit helper to confirm no conflicting raw advisories remain:
+  ```bash
+  mongo concelier ops/devops/scripts/check-advisory-raw-duplicates.js --eval 'var LIMIT=200;'
+  ```
+  Resolve any reported rows prior to rollout.
 - Use the migration script provided in `ops/devops/scripts/apply-aoc-validators.js`:
 
 ```bash
@@ -31,6 +36,26 @@ kubectl exec -n excititor deploy/excititor-mongo -- \
 2. Roll out Concelier/Excititor images with guard middleware enabled (`AOC_GUARD_ENABLED=true`).
 3. Run smoke tests (`stella sources ingest --dry-run` fixtures) before resuming production ingestion.
 
+### 1.3 Supersedes backfill verification
+
+1. **Duplicate audit:** Confirm `mongo concelier ops/devops/scripts/check-advisory-raw-duplicates.js --eval 'var LIMIT=200;'` reports no conflicts before restarting Concelier with the new migrations.
+2. **Post-migration check:** After the service restarts, validate that `db.advisory` is a view pointing to `advisory_backup_20251028`:
+   ```bash
+   mongo concelier --quiet --eval 'db.getCollectionInfos({ name: "advisory" })[0]'
+   ```
+   The `type` should be `"view"` and `options.viewOn` should equal `"advisory_backup_20251028"`.
+3. **Supersedes chain spot-check:** Inspect a sample set to ensure deterministic chaining:
+   ```bash
+   mongo concelier --quiet --eval '
+     db.advisory_raw.aggregate([
+       { $match: { "upstream.upstream_id": { $exists: true } } },
+       { $sort: { "tenant": 1, "source.vendor": 1, "upstream.upstream_id": 1, "upstream.retrieved_at": 1 } },
+       { $limit: 5 },
+       { $project: { _id: 1, supersedes: 1 } }
+     ]).forEach(printjson)'
+   ```
+   Each revision should reference the previous `_id` (or `null` for the first revision). Record findings in the change ticket before proceeding to production.
+
 ---
 
 ## 2 · Container environment flags