部署(arm-public-health-monitor-controlled-rollout): 完成 ARM 公网健康监控升级

.trellis/spec/hyb-oa/deployment-trialrun.md

@@ -1432,6 +1432,10 @@ PGPASSWORD="$POSTGRES_PASSWORD" docker exec -e PGPASSWORD db pg_dump ...
   timer, application-health alert states or the shared WeCom group-alert helper.
 - Purpose: detect an unavailable OA host, edge/TLS path, application or database
   readiness signal without adding a time-series platform or relying on traffic.
+- Topology boundary: the Tencent Cloud server is the OA production host; ARM is
+  the off-host backup and external-health-monitor node and does not run OA.
+  Changing the ARM probe is an operations-monitor rollout, not an OA application
+  deployment.
 
 ### 2. Signatures
 
@@ -1442,6 +1446,9 @@ PGPASSWORD="$POSTGRES_PASSWORD" docker exec -e PGPASSWORD db pg_dump ...
   install|enable|uninstall`.
 - Units: `hyb-oa-public-app-health.service` and
   `hyb-oa-public-app-health.timer`; the timer uses `OnCalendar=*:0/5`.
+- Runtime direction: `ARM monitor -> public HTTPS /ready -> Tencent Cloud OA`.
+  `DEPLOY_SERVER` continues to identify the OA production host and must never be
+  inferred from the ARM monitoring alias.
 - Local contract: `bash scripts/qa/run-app-health-monitor-contract.sh`.
 - Application statuses: `FAIL_APP_HEALTH`, `PASS_APP_HEALTH_READY` and
   `FAIL_APP_HEALTH_FLAPPING`.
@@ -1452,6 +1459,10 @@ PGPASSWORD="$POSTGRES_PASSWORD" docker exec -e PGPASSWORD db pg_dump ...
 
 - Run the probe from the existing ARM host against an exact HTTPS `/ready` URL.
   Success requires trusted TLS, HTTP 2xx, bounded JSON and `data.ok === true`.
+- Classify the remote role before any write. ARM may receive only the fixed
+  probe/helper/monitor units and its independent state; OA application,
+  database, Caddy, Compose and migrations remain on the Tencent Cloud production
+  host and follow their separate deployment workflow.
 - Classify DNS resolution and TCP connection failures separately before the
   shared fallback catches `OSError`; keep TLS, timeout, HTTP, response-size and
   response-contract categories stable. Count any stable failure category toward
@@ -1520,6 +1531,9 @@ PGPASSWORD="$POSTGRES_PASSWORD" docker exec -e PGPASSWORD db pg_dump ...
   is incomplete even when the timer is healthy.
 - ARM itself or its network/robot path unavailable -> the monitor can be silent;
   do not report this design as having an independent third-party dead-man.
+- Treating ARM as the OA production server, or selecting it as `DEPLOY_SERVER`
+  for an application rollout -> stop before upload or mutation and correct the
+  topology classification in the active task.
 
 ### 5. Good/Base/Bad Cases
 
@@ -1530,6 +1544,8 @@ PGPASSWORD="$POSTGRES_PASSWORD" docker exec -e PGPASSWORD db pg_dump ...
   as ready for an approved rollout, not as an active monitor.
 - Bad: run the timer only on the OA host, send raw `/ready` errors, install and
   enable in one unapproved step, or deploy the probe without its helper revision.
+- Bad: describe ARM as the OA production host or deploy OA application artifacts
+  there because the monitor itself is production-facing.
 
 ### 6. Tests Required
 
@@ -1553,6 +1569,10 @@ PGPASSWORD="$POSTGRES_PASSWORD" docker exec -e PGPASSWORD db pg_dump ...
   helper allowlist or behavior changes.
 - ARM install, enabled/active timer status and real failure/recovery messages are
   external evidence and may not be inferred from the local contract.
+- The rollout task and evidence must name the two roles without addresses or
+  accounts: Tencent Cloud = OA production; ARM = off-host monitoring/backup.
+  Assert that the ARM command set contains no OA deploy, Compose, migration or
+  database mutation entrypoint.
 
 ### 7. Wrong vs Correct
 
@@ -1563,6 +1583,8 @@ PGPASSWORD="$POSTGRES_PASSWORD" docker exec -e PGPASSWORD db pg_dump ...
 # alternating alert/recovery messages during a flapping link.
 bash scripts/qa/run-app-health-monitor-contract.sh
 bash deploy/trialrun/install-offhost-app-health-monitor.sh enable
+# Wrong target classification: the off-host monitor is not DEPLOY_SERVER.
+DEPLOY_SERVER=<arm-monitor-target> bash deploy/trialrun/deploy-existing.sh
 ```
 
 #### Correct
@@ -1576,6 +1598,8 @@ bash scripts/qa/run-automatic-backup-contract.sh
 # enable/real-message/drill approval before claiming the monitor is active.
 <explicit-controlled-paths> \
   bash deploy/trialrun/install-offhost-app-health-monitor.sh install
+# OA application deployment keeps its separately approved Tencent Cloud target.
+DEPLOY_SERVER=<tencent-oa-production-target> bash deploy/trialrun/deploy-existing.sh
 ```
 
 ## Scenario: Existing Deployment Preflight And Cache Stability