Recommendation · review aid

Broadwater pilot acceptance checklist

A suggested first-site pass for the always-on collector and dual-UPS shape already used in the design. The handoff does not define a commercial pilot, a service level, or a release order.

Recommendation Names such as bw-pi-01, broadwater-lan, and the enroll code WDJB-MJHT are synthetic examples from the design fleet. A checked box is a review mark in this browser. It is not a measurement from deployed equipment, and it is not a commitment that other platforms wait behind Broadwater.

Marks are stored locally under mk-guide-broadwater-pilot-v1. Clearing site data removes them. Printing shows the boxes as they are on screen.

Site shape this list assumes

Match the design’s Broadwater example, not a generic lab. See Chapter 1.

Piece	Design example	What the pass is checking
Site	Broadwater · `broadwater-lan`	One namespace for network UPS identity
Site witness	Always-on Pi `bw-pi-01`	Expected contact. Sleep is not a normal state for this collector.
UPS assets	Rack UPS on USB, office UPS on the network	One collector, two sources, mixed USB and SNMP
Out of this shape	Shop ESP32, Home sleeping laptop	Those patterns stay in the product scope. They are not gates on this list.

1. Enrollment through the first reading

Walk the enrollment sequence. Accepted behaviour, Proposed wire.

Enroll shows a short code and keeps the polling secret off the URL and the CLI transcript.
Design lifetime is 10 minutes. WDJB-MJHT is the synthetic sample, not a credential to reuse.
Approval, first contact, and the first UPS reading are stored as separate times.
Approving the code is not contact. Contact is the check-in that stores the device credential.
Roles apply before the collector is treated as monitoring.
UPS monitoring and site witness are independent. A witness that has not applied its role is not yet the site’s expected contact.
The office network source follows add, local auth, test, identity, then use.
Identity includes namespace, protocol, host, port, and NUT name where the protocol has one. A host alone is not an identity. A hard duplicate is blocked. A trustworthy serial match asks; it does not auto-merge.
The first reading is not earlier than first contact.
Observation time is the UPS reading time. Receipt time may be later and is shown when it explains delay.
UPS and SNMP secrets stay on the collector.
The dashboard shows Configured, Missing, or Rejected only. There is no dashboard field that accepts the secret.

2. Buffer, replay, and acknowledgement

Walk the Broadwater outage walkthrough and the replay sequence. The walkthrough is the scenario this section is checking. It is also the replay case in Chapter 8. A missing heartbeat is silence, not a proven power failure.

While the WAN is down, new observations remain on the collector with their observation times.
The dashboard does not convert that silence into an on-battery incident.
After reconnect, replayed rows keep the original observation time and are marked received late.
Replay means received more than 2 minutes after observation while the buffer drains. Ordinary seconds of latency are not replay.
Historical replay does not open a fresh emergency for the condition that already happened.
A new active condition observed while the backlog drains is still alertable.
Acknowledgement advances a contiguous prefix, and a duplicate batch does not double-write.
Dedupe uses the collector identity and sequence. A failed upload retries the unacknowledged span.
If the bounded buffer overflows, the dropped span is a gap.
Charts do not draw a line across it. Dropped counts are visible. The gap is not stored as zero runtime or as a confirmed outage.

3. Contact and evidence honesty

Silence of bw-pi-01, the only witness in this shape, is site contact lost with cause unknown.
Contact lost stays distinct from a connectivity failure confirmed by a local probe. This site shape has no second witness. Do not borrow the Home “other witness still reporting” story and call it Broadwater.
Reachability of the site does not stand in for a UPS reading.
Collector contact age and UPS reading age are shown separately. Last known stays labelled last known.
UPS runtime on screen is the estimate, and observed minutes on battery are a different figure.
Full charge is not capacity. A self-test PASS reported by the UPS is evidence of that report, not a discharge test MainsKeeper started.

4. Revoke and re-enroll

Revoking the collector rejects later uploads and leaves history and UPS links in place.
The design’s rejection for a revoked credential is HTTP 401 on the proposed upload path. History does not disappear with the credential.
Re-enroll issues a new credential and keeps those same links.
mainskeeper enroll --reenroll is the designed command. The old credential does not start working again.

5. Desired configuration

A dashboard change stays pending until check-in applies it, or it fails with a reason.
Contact lost does not display the desired value as applied. See configuration states.
Storage path, disk cap, retention target, and log level remain local settings.
The dashboard may show the effective value and “set locally.” It does not become the editor for those keys. Production retention policy is still an open decision.

6. Battery Assurance on a replacement

Rules are Accepted. Using them in a pilot does not require automated discharge tests, which stay deferred.

Replacing the cartridge creates a new battery installation and keeps the UPS identity.
Prior evidence remains on the retired installation and does not qualify the replacement. See battery installation.
A protection finding stays open until a documented resolution.
Restoring utility power, acknowledging an incident, snoozing a reminder, or installing a new battery does not by itself resolve the finding.
The pilot never asks MainsKeeper to start a self-test, discharge, shutdown, or outlet change.
Monitoring only is the boundary. Source connectivity tests stay read-only.

Explicitly outside this pass

These items stay on the decision register. Closing the checklist does not close them.

Storage engine and retention tiers — open, with a recommendation only.
Operator authentication provider — Cloudflare Access with GitHub is the explored UI, not a locked choice.
ESP32 board and UPS matrix, including sample flash-ring numbers — illustrative until validated. Shop uses that pattern; Broadwater’s Pi does not settle it.
Cloudflare edge placement, Tailscale or another bridge, and UniFi or modem diagnostics — open or proposed extensions.
Vendor prices and free-tier operation — not claimed. Cost still scales with collectors, cadence, and retention.

Platform targets in the design remain macOS, Windows, Fedora/Linux, Raspberry Pi, and a validated ESP32 probe. This list is a suggested development pass for one site shape. It is not a statement that the other targets are optional.