Tier 3 last1-admin — PAUSED (2026-08-28)¶
Status: Pause lifted for T3-4 only (2026-09-14). Parallel 44bf00b proven on :5001. Live :5000 untouched.
Correction: Prod DNS already points at R940 (SPRINT-8 T6, 2026-08-31). Railway origin is 404. See TIER_3_ADMIN_T3-4_REPORT.md.
Do not: replace live last1admin-app on :5000, flip prod DNS, or delete Railway until Ryan authorizes the promote step.
What stays warm (zero teardown)¶
| Asset | State | Action |
|---|---|---|
VM 115 admin-r940 |
Provisioned, running | Keep powered on |
Docker last1admin-app |
Deployed on 192.168.1.97:5000 |
Keep running |
BWS LAST1ADMIN_R940_PROD_* |
36 keys synced + rendered .env |
Retain (hosted Supabase URLs; update when upstream moves) |
| Parallel soak | Cron */30 + Prometheus alerts |
Continue (low cost; validates R940 stack health) |
| Tunnel ingress | admin.last1.enterprises + staged admin-r940 rule prepared, not required for pause |
No DNS cutover |
| Railway prod | admin.last1.enterprises production |
Unchanged |
Work completed before pause¶
| Phase | Status | Report |
|---|---|---|
| T3-0 Audit | Done | TIER_3_ADMIN_MIGRATION_AUDIT.md |
| T3-1 VM + BWS prep | Done | TIER_3_ADMIN_T3-1_REPORT.md |
| T3-2 Code deploy | Done | TIER_3_ADMIN_T3-2_REPORT.md |
| T3-3 Parallel soak + tunnel prep | Done | TIER_3_ADMIN_T3-3_REPORT.md |
| T3-4 Browser E2E | Not started | TIER_3_ADMIN_T3-4_TEST_PLAN.md on hold |
| T3-5 DNS cutover | Not started | Blocked |
| T3-6 / T3-7 | Not started | Blocked |
Why paused (sequencing rationale)¶
last1-admin holds service-role keys and proxies to:
- last1.app, RealOutcomes, RadioCheck, Onset Supabase projects
- last1.id (
auth.last1.id), LastVet API, Angel Worker
Migrating admin to R940 while upstream DBs remain on hosted Supabase would require:
- Point admin at hosted Supabase/APIs (current partial state), then
- Re-point every connection when each product's DB moves to R940.
Better: migrate database-owning products first (full stack each), then last1-admin last (new Tier 6) with one reconnect + one browser E2E pass.
Resume criteria¶
Resume admin migration when Ryan authorizes after:
- Upstream product migrations complete (Railway + Supabase → R940 per product tier plan).
- BWS
LAST1ADMIN_R940_*keys updated to sovereign upstream URLs (not hosted Supabase refs). - New tier kickoff approved (see TIER_RESEQUENCING_2026-08-28.md).
Resume phases: T3-4 browser E2E → env refresh → DNS cutover → soak → Railway teardown.
Related Muster item¶
migrate-last1-admin-railway-to-r940 — status hold, blocked by upstream product migration items.