Editing Tornedo.tetrain.com Upgrade Plan (section)

== 3. Step 0 — Facts to confirm before touching anything (read-only) ==

# ~~'''Topology'''~~ — '''resolved: single IPA server''', confirmed by client. No replica exists.
# ~~'''Enrolled clients'''~~ — '''resolved''': queried directly via LDAPI (SASL/EXTERNAL, no password needed). '''110 hosts enrolled''', full list in <code><nowiki>reports/tornedo_enrolled_hosts.txt</nowiki></code>. Critically: '''all 31 servers in our fleet inventory are enrolled here''', plus ~79 more (other customer mail/web servers). This is the identity backbone for essentially the whole environment, not just this project's server list — confirms "single point of failure" framing from Section 1 was not overstated.
# ~~'''Is this box virtualized?'''~~ — '''resolved: yes''', snapshot backup in progress as of this update, confirming snapshot/restore is available as the per-hop safety net.
# '''CA role / renewal master''' — not yet directly queried (<code><nowiki>ipa-cacert-manage list</nowiki></code> needs Directory Manager password, not available to this session). Given it's the only server, it's almost certainly the renewal master by default — treat as confirmed unless contradicted.
# ~~'''KRA in use?'''~~ — '''resolved: not used''', confirmed by client and corroborated (<code><nowiki>/var/lib/pki-kra</nowiki></code> does not exist on the box).
# ~~'''AD trust configured?'''~~ — '''resolved: no''', confirmed by client.
# ~~'''What postfix is actually for'''~~ — '''resolved: not needed/unused''', confirmed by client.
# ~~'''Exact current versions'''~~ — '''resolved''', checked directly: <code><nowiki>ipa-server</nowiki></code>, <code><nowiki>389-ds-base</nowiki></code>, <code><nowiki>krb5-server</nowiki></code>, <code><nowiki>pki-ca</nowiki></code> each show '''two versions registered simultaneously''' in the RPM database (e.g. <code><nowiki>ipa-server-4.6.6-11.el7.centos</nowiki></code> AND <code><nowiki>ipa-server-4.6.8-5.el7.centos.11</nowiki></code>). This is abnormal for non-parallel-installable packages and suggests a prior interrupted/incomplete update. '''New action item''': run <code><nowiki>package-cleanup --dupes</nowiki></code> and <code><nowiki>rpm -Va</nowiki></code> / <code><nowiki>yum check</nowiki></code> to find and resolve duplicate/orphaned RPM entries before attempting any leapp preupgrade check — leapp will likely flag or choke on this, and it should be cleaned up as part of "fully patch current release first" anyway.
# ~~'''Disk headroom'''~~ — '''resolved''': after log cleanup, now 44% used / 35G free, confirmed via re-run discovery. Sufficient margin for <code><nowiki>ipa-backup</nowiki></code>, leapp's pre-upgrade staging, and package work.