---
name: enterprise-operations
description: Plan CitusIO Enterprise node ownership, fencing and governed recovery using the installed operational contracts and whole-node routing boundary.
---

# Operate Enterprise nodes

Read [container-operations](../container-operations/SKILL.md),
[durable-recovery](../durable-recovery/SKILL.md), and installed Enterprise
configuration and `/usr/share/nginz-iot/operations/` contracts. Contracts can
include historical evidence/unqualified upgrade boundaries; retain their exact
source/image scope. Internal all-in-one includes this guidance for internal
use and is not a separate customer tier.

HA moves traffic between complete nodes: nginx, local authority/bridge and
local rings. SHM is not shared across nodes. External HA/router authority owns
fencing, writer-term acquisition and movement. Liveness detects suspicion but
does not grant ownership. Route only when
`node_ready && shard_ready && owns_current_writer_term` holds. Uncertain term,
frontier, generation or gate makes the node unroutable.

A standby becomes routable after old-writer fencing, current-term acquisition,
durable replay, fresh rings and readiness. Explicit standby startup `live` does
not grant traffic readiness. Exercise failure/timeout handling and one-owner
sink effects before selecting a production topology.

For governed operations, verify installed auth/RBAC, audit sink, secret refs,
operation status and allowed/denied results. Preserve accepted/pending versus
completed semantics and snapshot freshness. Use native CLI/API contracts and
the authorized identity; reading bundled guidance requires no panel action.

Use [panel operations](../panel-operations/SKILL.md) and the bundled
[admin operation guide](../references/agent-administration.md) for the four
governed workflows. Verified `operator_admin` covers node/selected-bridge drain
and support (API v1 compatibility); `config_admin` covers config preflight;
`support_admin` covers support; `viewer` reads only. Availability also depends on
the selected profile and exact live node/configuration/fences. A support request
does not grant configuration authority, and config preflight does not apply it.

Bind backup/restore or upgrade to actual identities, record/store/ring versions,
ownership and frontiers. Finish isolated recovery before moving traffic. An
unavailable compatible record migration remains a blocker. Collect redacted
support evidence and retain the first unfinished action for handoff.