docs(staging): close exact-SHA release acceptance

docs/operations/personal-report-staging-acceptance-2026-08-06.md

@@ -11,8 +11,10 @@ This record contains only release identities, aggregate operational evidence, sc
 - Security/control-plane merge: `f7a615a5bf11ed95b3a6c7e6d28dfe8150a825ef`
 - Staging migration and application-under-test SHA: `f7a615a5bf11ed95b3a6c7e6d28dfe8150a825ef`
 - Docs-only acceptance attestation deployment SHA: `02cc483b7c303e6cc0f26fb31462c50adb007f12`
-- Final gate-attested controller deployment SHA: `e59f15d352787f3d05425ba8c459d092e9801a20`
-- Application rollback target: `49da8f916960030d5760d8dedf4e77820732a527`, subject to retained successful gate artifacts. The additive database migration remains in place after application rollback.
+- Prior gate-attested controller deployment SHA: `e59f15d352787f3d05425ba8c459d092e9801a20`
+- Final combined report/admin/control-plane deployment SHA: `6c1dcbe857006ec6ae7463b57b2b7d5947da4851`
+- Final immutable staging artifact: gate run `1525`, artifact ID `12`; target and controller SHA both equal the final deployment SHA.
+- Application rollback target before the final release: `e59f15d352787f3d05425ba8c459d092e9801a20`, subject to retained successful gate artifacts. Additive database migrations remain in place after application rollback.
 
 At deployment verification, Gitea `main`, Gitea `staging`, `/opt/jyotisha-staging/.state/deployed-revision`, and public `/api/health` all reported the same full SHA.
 
@@ -44,7 +46,13 @@ The complete frontend suite could not be made fully executable on the local macO
 - Docs-only attestation deploy `1474`: success. The trusted-main fetch paused for an extended period before recovering; no SSH/staging mutation occurred during the pause. Public health and host state then moved to the exact attestation SHA with zero container restarts.
 - First bounded-fetch staging gate `1479`: success; automatic deploy `1480` then exhausted all three 120-second full-history fetch attempts and failed closed before SSH. Public/state remained on the prior healthy SHA.
 - Gate-attested controller PR gate `1481` and staging gate `1483`: success. Gate `1483` published the first four-field manifest plus SHA-256-bound `controller.tar` bundle for `e59f15d352787f3d05425ba8c459d092e9801a20`.
-- Final automatic deploy `1484`: success in one minute. Mutation-time `git fetch` count was zero; controller hash validation ran; the staging SSH secret remained masked and no private-key material appeared. Public health, host state, Gitea `main`, and Gitea `staging` all matched the exact final SHA. See `BUG-129` / `ERR-095`.
+- Final automatic deploy `1484`: success in one minute. Mutation-time `git fetch` count was zero; controller hash validation ran; the staging SSH secret remained masked and no private-key material appeared. Public health, host state, Gitea `main`, and Gitea `staging` all matched that release SHA. See `BUG-129` / `ERR-095`.
+- Later combined rollout gate `1514` succeeded for `8dc61e3135d8afb96b6683714f41a1716761164e`; automatic deploy `1515` correctly stopped before application mutation because seven admin/control-plane migrations were pending.
+- Manual staging migration `1516`: success. It applied `20260806010000_admin_rbac.sql` through `20260806070000_admin_mfa.sql`; previously applied personal-report migrations remained unchanged.
+- Deploys `1517`/`1518` and `1522` failed closed and restored the prior application while exposing two controller-only defects: one-shot proxy identity verification and a stale Caddy single-file bind mount/admin-host mismatch. No failed run advanced deployed-revision.
+- Controller PR gates `1519` and `1523`: success, including frontend 1472/1472, lint with zero errors, production build, database fixtures, workflow contracts, and bounded build execution.
+- Final staging push gate `1525`: success for full SHA `6c1dcbe857006ec6ae7463b57b2b7d5947da4851`; artifact ID `12` bound immutable API/web digests and the SHA-256 controller bundle.
+- Final automatic deploy `1526`: success. It consumed target/controller gate run `1525`, reported `verified_sha=6c1dcbe857006ec6ae7463b57b2b7d5947da4851`, refreshed Caddy's reviewed bind mount, passed dual-host identity boundaries, and left all containers at restart count zero.
 
 ## Security incident and containment
 
@@ -72,7 +80,10 @@ Post-deploy schema inspection reported:
 - policies: owner SELECT and owner DELETE;
 - `authenticated`: SELECT, DELETE only;
 - `service_role`: SELECT, INSERT, UPDATE, DELETE;
-- personal-report migration ledger count: 1.
+- personal-report migration ledger count: 1;
+- personal-report migration checksum: `fc03b6f48a62a615d4ed1c601451f30ef2e72bbb30c0f7ff6e8a935ea72be970`, matching the immutable repository file;
+- seven combined admin/billing/operations migrations reported present after migration run `1516`;
+- final runtime-role audit: service role membership/login/CONNECT true; admin service membership and BYPASSRLS false.
 
 A two-owner synthetic RLS test ran entirely inside one PostgreSQL transaction and then rolled back:
 
@@ -90,6 +101,8 @@ No report document or birth fact was needed or persisted for this check.
 - Public `/api/health`: `ok`; deployment SHA exact match.
 - `/login`: 200.
 - Logged-out `/api/account`: 401.
+- User host `/admin` and `/api/admin/session`: 404.
+- Admin host `/`: 308 to `/admin`; `/admin`: 307 to `/login`; logged-out `/api/admin/session`: 401.
 - Logged-out report GET and POST: 401.
 - Logged-out report reader route: reachable; its data API remains authenticated.
 - Internal Python `/api/health`: 200, `status=ok`, `swisseph_available=true`.
@@ -120,7 +133,7 @@ This is an idle snapshot only. It does not satisfy the planned single-user/two-u
 - Post-deploy encrypted staging backup: success.
 - Retention after post-deploy backup: 3 archives.
 - Backup directory mode: 0700.
-- Latest archive mode: 0600; non-empty (717,008 bytes).
+- Latest archive mode: 0600; non-empty. Final post-release archive size: 915,952 bytes.
 - No secret was passed in argv or printed.
 
 ## Blocked / user handoff