docs(staging): record runtime role drift repair

docs/BUG_HISTORY.md

@@ -2314,9 +2314,25 @@
 - 用户现象：staging gate `1500` 已成功验证并发布 SHA `9a3d0d440f43deab66c1f8a4a08cdbfc6f9d73eb` 的 immutable artifact，但自动 deploy `1502` 在远端 env 校验时报 `invalid staging selector: ADMIN_USER_ORIGIN` 并 fail closed；公网继续健康运行旧 SHA `e59f15d352787f3d05425ba8c459d092e9801a20`。
 - 触发条件：包含双 host self-hosted identity validator 的 controller 部署到现有 staging host，而 `.env.staging` 尚未包含精确且唯一的 `ADMIN_USER_ORIGIN=https://admin.staging.jyotisha.chat`。
 - 根因：并发 admin rollout 将 admin host origin 加入应用和 validator 合同，但 staging host-managed env 未在发布前同步新增的非密钥 selector；quality gate 验证仓库合同，不读取主机 secret/env，因此直到 mutation 前远端校验才暴露漂移。
-- 修复：待在共享 staging mutation lock 下，仅向原文件原子补入公开 `ADMIN_USER_ORIGIN` selector，保留全部既有内容、`deploy:deploy` owner 和 `0600` mode；不得输出、复制或重写其他 secret 值。随后用 exact-SHA gate artifact 重新部署。
-- 验证：脱敏只读检查已确认 `.env.staging` 为 `deploy:deploy 0600`、`AUTH_USER_ORIGIN` 精确且唯一、`ADMIN_USER_ORIGIN` 计数为 0；待 selector validator、最新 staging gate、exact-SHA deploy、公网/host SHA、容器 restart、日志和未登录边界验收。
+- 修复：已在共享 staging mutation lock 下，仅向原文件原子补入公开 `ADMIN_USER_ORIGIN` selector，保留全部既有内容、`deploy:deploy` owner 和 `0600` mode；未输出、复制或重写其他 secret 值。随后完整 validator 暴露独立的 service runtime 漂移，转由 `BUG-135` 处理；仍待 exact-SHA artifact 重新部署。
+- 验证：脱敏只读检查先确认 `.env.staging` 为 `deploy:deploy 0600`、`AUTH_USER_ORIGIN` 精确且唯一、`ADMIN_USER_ORIGIN` 计数为 0；原子修复后 `ADMIN_USER_ORIGIN` 精确且唯一，正式 staging env validator 已通过。待最新 staging gate、exact-SHA deploy、公网/host SHA、容器 restart、日志和未登录边界验收。
 - 防复发：任何新增 staging host-managed selector 必须在同一 rollout runbook 中包含 deploy 前 presence/exact-value 检查；quality gate 成功不能替代 host env validation。env 修复必须共享 mutation lock、原子替换并保持 owner/mode，严禁打印 raw env。
 - 相关记录：BUG-128、BUG-133、ERR-093、ERR-097
 - 复发自：无
 - 修复版本：待 staging env selector 对齐与 exact-SHA 部署验收
+
+## BUG-135 | staging service runtime 缺失且 admin runtime 错误继承 BYPASSRLS 角色
+
+- 状态：investigating
+- 首次发现：2026-08-06
+- 最近更新：2026-08-06
+- 影响面：staging 私有 PostgreSQL runtime roles、`.env.staging`、`.env.staging.database`、个人报告 service client 与后台最小权限；production 未受影响。
+- 用户现象：补齐 `ADMIN_USER_ORIGIN` 后，正式 validator 继续报 `invalid staging identity setting: SERVICE_DATABASE_URL`。脱敏检查确认应用 env 缺少 `SERVICE_DATABASE_URL`、数据库 env 缺少 `SERVICE_RUNTIME_PASSWORD`、PostgreSQL 缺少 `service_runtime` login role；同时旧 `admin_runtime` 意外继承了带 BYPASSRLS 的 `service_role`。当前旧 web 容器同样没有 service URL，因此无法安全恢复旧明文。
+- 触发条件：在早期初始化的 staging 数据卷上部署依赖独立 service client 和最新 admin RBAC 的应用；bootstrap 脚本只在空数据卷初始化时执行，现有 host env/roles 未随 reviewed compatibility contract 对齐。
+- 根因：staging host bootstrap 漂移。数据库保留了 `service_role`、identity/app/admin runtime roles，但没有后来合同要求的 `service_runtime`；旧 admin runtime membership 又违反当前 bootstrap 和 RBAC 的明确 revoke 边界。quality gate 不读取 host env 或运行时 role catalog，因此直到远端部署前校验与现场权限审计才暴露。
+- 修复：在共享 mutation lock 下生成独立 staging-only 随机凭据，通过 PostgreSQL stdin 创建/设置 `service_runtime`，授予 `service_role` membership 和数据库 CONNECT；将 raw password 仅原子写入 `.env.staging.database`，percent-encoded URL 仅原子写入 `.env.staging`，两文件保持 `deploy:deploy 0600`。随后撤销 `admin_runtime` 的 `service_role` membership；未重启容器、未输出凭据、未改 production。已应用的 `20260806000000_personal_reports.sql` checksum 与仓库一致，保持历史迁移不可变。
+- 验证：两个正式 env validator 均通过；`service_runtime` 真实密码登录、`service_role` membership 和 CONNECT 均通过；`admin_runtime` membership=false，`service_runtime` membership=true；两份 service 配置各精确 1 条且非空，owner/mode 保持正确。PR gate `1503` 已通过；待最终合并 SHA 的 staging gate、migration check、exact-SHA deploy、service client smoke、RLS/容器/日志验收，完成前不得标记 resolved。
+- 防复发：非空数据卷不能依赖 `/docker-entrypoint-initdb.d` 自动重放；每次新增 runtime role 或 host-managed URL 都必须有兼容性 role repair、脱敏 pre-deploy presence 检查和真实登录/role-membership smoke。`admin_runtime` 永不得继承 `service_role`；service writes 只能使用独立 `SERVICE_DATABASE_URL`。已应用迁移不得为修正文案而改 checksum。
+- 相关记录：BUG-128、BUG-134、ERR-093、ERR-098
+- 复发自：无
+- 修复版本：待 staging service runtime 对齐与 exact-SHA 部署验收

docs/research/pre_work_error_ledger.md

@@ -163,6 +163,12 @@ Staging gate `1500` successfully validated and published the exact SHA, but auto
 
 Prevention: when a reviewed identity rollout adds a host-managed non-secret selector, update the staging env under the shared mutation lock before deploying the dependent controller. Modify only the named public selector through a mode-`0600` atomic replacement that preserves deployment-tree UID/GID; never print or copy the raw env. Re-run the exact validator and require the same gate-attested SHA in `main`, `staging`, host state, and public health before closure.
 
+## ERR-098 | Non-empty staging volume missed service runtime bootstrap and retained an obsolete privileged membership | investigating 2026-08-06
+
+After the admin-origin selector was repaired, the full staging validators exposed that both service runtime env entries were absent. Redacted role inspection then showed `service_role` existed but `service_runtime` did not, while `admin_runtime` retained membership in the BYPASSRLS role contrary to the reviewed bootstrap/RBAC contract. The running old web image had no recoverable service URL, so no password was guessed or copied. Under the shared mutation lock, a new staging-only credential was generated, the dedicated login role and CONNECT/membership were established through PostgreSQL stdin, the two host env files were atomically updated with their separate raw/URL representations, and the obsolete admin membership was revoked. Both validators and a real service login passed; production was not involved.
+
+Prevention: `/docker-entrypoint-initdb.d` is not a compatibility mechanism for an existing PostgreSQL volume. Every newly required runtime role must have a reviewed non-destructive repair path plus pre-deploy role/presence probes. Keep `admin_runtime` outside `service_role`; only `service_runtime` may assume the BYPASSRLS role through the dedicated service URL. Never display role passwords, pass them in argv, or edit an already-ledgered migration checksum to retrofit host bootstrap behavior.
+
 ## Fragment Sweep Command Set
 
 ## ERR-086 | Steve Jobs jyotishganit artifacts used non-San-Francisco coordinates | mitigated 2026-07-21