CMM/DODA: restore on DODA bays + grant Full on whole C:\Apps\DODA

- Restore-CMM: drop the skip-on-doda gate. DODA bays now restore the
  config-version PC-DMIS + goCMM settings like any other bay (they have backups
  now; DODA itself installs separately to C:\Apps\DODA and is unaffected).
- sync-cmm-backups.sh: update the stale "do not back up DODA bays" note.
- Install-DODA.ps1: grant Users + Authenticated Users Full on the WHOLE
  C:\Apps\DODA (was PreProcess only) - DODA writes output/temp throughout the
  folder as the locked-down operator. /T covers PreProcess.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

playbook/shopfloor-setup/gea-shopfloor-cmm/Install-DODA.ps1

@@ -39,15 +39,16 @@ if (-not (Test-Path $preProcess)) {
     Write-Host "Created $preProcess"
 }
 
-# MergeFiles.exe writes into PreProcess\ at runtime AS THE LOCKED-DOWN OPERATOR,
-# not admin. Without write access the GetDoDAFolder/merge step fails. Grant
-# Users + Authenticated Users Full (object+container inherit). SIDs, not names,
-# to stay locale-independent. Applied every run so it re-asserts after any
-# lockdown pass that strips the ACE.
+# DODA runs as the LOCKED-DOWN OPERATOR (not admin) and writes throughout its
+# install folder at runtime - PreProcess\ (MergeFiles GetDoDAFolder) plus
+# output/temp elsewhere under C:\Apps\DODA. Grant Users + Authenticated Users
+# Full on the WHOLE folder (object+container inherit; /T applies it to every
+# existing child incl PreProcess). SIDs, not names, to stay locale-independent.
+# Applied every run so it re-asserts after any lockdown pass that strips the ACE.
 foreach ($sid in '*S-1-5-32-545','*S-1-5-11') {   # BUILTIN\Users, NT AUTHORITY\Authenticated Users
-    & icacls $preProcess /grant "${sid}:(OI)(CI)F" /T /C 2>&1 | Out-Null
+    & icacls $installDir /grant "${sid}:(OI)(CI)F" /T /C 2>&1 | Out-Null
 }
-Write-Host "Granted Users + Authenticated Users Full on $preProcess"
+Write-Host "Granted Users + Authenticated Users Full on $installDir (recursive)"
 
 if (Test-Path (Join-Path $installDir 'DovetailAnalysis.exe')) {
     Write-Host "DovetailAnalysis.exe verified present"

playbook/shopfloor-setup/gea-shopfloor-cmm/scripts/Restore-CMM.ps1

@@ -11,8 +11,10 @@ resolve-cmm-bay-config.ps1 at the WinPE picker):
                   version it ever had (2016.0 + 2019 R2); we restore ONLY the
                   one the bay-config pins, matched by substring (2019 -> the
                   '2019 R2' zip, 2016 -> the '2016.0' zip).
-  doda.txt      - 'no' to proceed; anything else SKIPS restore (DODA bays are
-                  handled separately and must not get a settings overlay).
+  doda.txt      - read for logging only. DODA bays now restore like any other:
+                  once they are properly backed up + staged, the config-version
+                  zip is restored the same way. (The old skip-on-doda policy was
+                  dropped 2026-06-17; DODA bays had no backups when it was added.)
   partgroup.txt - optional goCMM Selected Part Group (friendly S:\ form), used
                   as the authoritative per-bay override even if the backup is stale.
 
@@ -50,7 +52,9 @@ $doda  = (ReadTxt 'doda.txt').ToLower()
 $pgRaw = ReadTxt 'partgroup.txt'
 
 if (-not $cmmid) { Log "no cmmid.txt (manual CMM id, or not a bay-config bay) - nothing to restore. Skipping."; exit 0 }
-if ($doda -eq 'yes') { Log "DODA bay ($cmmid) - skipping settings restore by policy."; exit 0 }
+# DODA bays restore like any other now (skip-on-doda dropped 2026-06-17). DODA
+# itself installs separately via the manifest to C:\Apps\DODA - independent of
+# the goCMM (C:\geaofi) + PC-DMIS settings this restore lays back.
 
 $bdir = Join-Path $BackupRoot $cmmid
 if (-not (Test-Path -LiteralPath $bdir)) { Log "no staged backup at $bdir - skipping (stage it with sync-cmm-backups.sh)."; exit 0 }

playbook/sync-cmm-backups.sh

@@ -13,8 +13,8 @@
 # Pushes the NEWEST backup set per cmm_id to:
 #   /srv/samba/enrollment/installers-post/cmm/backups/<cmm_id>/
 #
-# DODA bays: do NOT back them up (don't put them under cmm-bk/). 09-Setup-CMM
-# also gates restore on cmm-bay-config doda=no as a second guard.
+# DODA bays ARE backed up + restored like any other now (the old skip-on-doda
+# policy in Restore-CMM was dropped 2026-06-17). Stage them here the same way.
 #
 # Usage:  ./playbook/sync-cmm-backups.sh           (all cmm_id folders)
 #         CMM_ID=CMM3 ./playbook/sync-cmm-backups.sh   (just one)