服务器长跑不再堆积取消监听，数据库少走几趟。

报告工人的等待到点就摘掉取消监听。本地数据库缓存表结构，并把设置身份合成一条语句，对照通过后默认打开，写成 off 仍走原来的语句。交付、重算和限流的内存表会过期。登录读缓存默认关闭，要开再设 IDENTITY_SESSION_COOKIE_CACHE=on。

自测：tsc 通过，lint 0 error，点名测试 134 通过，test:db 开关关和开都只有已知的 13 条失败，往返 49 降到 32。

Co-Authored-By: Grok (agent loop)

deploy/.env.staging.identity.example

@@ -31,3 +31,11 @@ JYOTISH_DYNAMIC_RECTIFICATION_TOKEN=<independent-openssl-rand-base64-32-output>
 # these server-side values through env_file; they are not NEXT_PUBLIC values.
 PERSONAL_REPORT_ENABLED=true
 PERSONAL_REPORT_DAILY_LIMIT=5
+
+# Local Postgres adapter. Unset or on enables both. Exact off restores the
+# previous per-statement sequence. Measured default is on (2026-10-14).
+JYOTISHA_PG_METADATA_CACHE=on
+JYOTISHA_PG_MERGED_SESSION_SETUP=on
+# Ordinary session reads stay uncached unless this is exactly on. Password
+# change, account deletion, and admin routes bypass the cache. maxAge is 300s.
+#IDENTITY_SESSION_COOKIE_CACHE=off

deploy/README.md

@@ -194,6 +194,8 @@ SITE_ADDRESS=https://staging.jyotisha.chat
 
 Staging is fully self-hosted: set `AUTH_PROVIDER=self-hosted` and `SELF_HOSTED_IDENTITY_ENABLED=true`. Add the four role-specific server-only database URLs, the exact `AUTH_USER_ORIGIN=https://staging.jyotisha.chat` and `ADMIN_USER_ORIGIN=https://admin.staging.jyotisha.chat`, the single `BETTER_AUTH_USER_SECRET`, and staging-only Resend settings listed in `deploy/.env.staging.identity.example`. Both hosts run the same application and Better Auth service, but cookies remain host-only; the admin host `/` redirects to `/admin`, and unauthenticated admin requests continue to `/login` on that host. Better Auth trusts only those two origins, while unknown identity hosts fail closed. Persisted `identity.users.role=admin` is the only self-hosted backend role, while `viewer` and ordinary users are denied. Browser code uses same-origin APIs; it receives neither database credentials nor Supabase keys. Production uses the same architecture only after the reviewed migration and cutover. See `docs/operations/self-hosted-identity.md` for identity validation.
 
+The web service already loads its env file, so these server-only switches do not need a Compose change. `JYOTISHA_PG_METADATA_CACHE` and `JYOTISHA_PG_MERGED_SESSION_SETUP` default to on when unset; set either to `off` to restore the previous database roundtrip sequence. `IDENTITY_SESSION_COOKIE_CACHE` defaults to off; set it to `on` to cache ordinary user-session reads for 300 seconds. Names and defaults are also in `deploy/.env.staging.identity.example`. Do not put secrets in these three values.
+
 After source sync and before `up`, the workflow validates `.env.staging` mode/selectors, explicitly pins the three staging selectors against ambient shell overrides, and runs `docker compose --env-file .env.staging -f deploy/docker-compose.server.yml config --quiet`. For later manual inspections, run the same checks only after the tracked deployment files exist on the server. Do not use a manual gate run from `main` as the first publishing path: publishing requires a successful push to `staging`, while manual `Deploy staging` requires a successful push gate for the exact SHA and must use the staging workflow ref.
 
 ### First-deploy sequence