fix(staging): refresh dual-host edge verification

docs/BUG_HISTORY.md

@@ -2368,3 +2368,19 @@
 - 相关记录：BUG-129、BUG-136、ERR-099、ERR-100
 - 复发自：无
 - 修复版本：待 staging verification convergence gate 与 exact-SHA deploy 验收
+
+## BUG-138 | staging Caddy 保留旧单文件 bind inode 且 admin 验证误走用户域名
+
+- 状态：investigating
+- 首次发现：2026-08-06
+- 最近更新：2026-08-06
+- 影响面：staging Caddy 双 host 路由、admin TLS、`Deploy staging` 未登录边界验证；production 未受影响。
+- 用户现象：修复公网 SHA 收敛后，deploy `1522` 明确观测目标 SHA、私有 API 和 Swiss Ephemeris 均正常，但在用户域名上得到 `/admin -> 307 /` 与 `/api/admin/session -> 403`；同时 `admin.staging.jyotisha.chat` TLS 握手失败。workflow 在 60 秒后自动恢复旧应用，未写入新 deployed-revision。
+- 触发条件：controller 通过原子目录同步替换 `deploy/Caddyfile.staging`，但长期运行的 Caddy 容器仍持有旧单文件 bind mount inode；随后 checker 又把 admin 页面/API 请求错误发送到 `STAGING_URL` 而不是 `ADMIN_USER_ORIGIN`。
+- 根因：host 文件与 Caddy 容器 mount inode 漂移。只读现场证据显示 host Caddyfile 含 admin host、运行容器内文件不含，inode/size/mtime 均不同；staging VPS 从两台权威 nameserver 查询 admin A 记录均为 `118.26.111.127`，排除 DNS 缺失。用户域名按新 Caddy 合同本应对 admin paths 404，因此旧 checker 的 307/401 期待也违反双 host 边界。
+- 修复：应用 Compose 切换后显式 `--force-recreate --no-deps caddy`，使其重新挂载 gate-attested Caddyfile；完整 convergence 同轮要求用户域名 admin page/API 均 404、admin origin page 307 到 `/login`、admin API 401，并继续要求 exact public SHA、account 401、私有 API/Swiss 健康。失败仍 bounded、fail closed 并自动恢复旧应用。
+- 验证：待 shell/workflow 合同、PR gate、新 exact-SHA push artifact、真实 Caddy admin 证书/路由和 deploy 验收；完成前不得标记 resolved。
+- 防复发：原子替换单文件 bind mount 后必须 recreate/reload 长期运行服务；部署 smoke 必须分别使用各自主机 origin，不能在 user host 上测试 admin host 合同。保留 authority DNS、mount inode 和 TLS 检查作为脱敏现场证据。
+- 相关记录：BUG-134、BUG-137、ERR-097、ERR-100、ERR-101
+- 复发自：无
+- 修复版本：待 Caddy mount refresh 与双 host exact-SHA staging 验收

docs/research/pre_work_error_ledger.md

@@ -181,6 +181,12 @@ Exact-SHA gate `1514` and migration `1516` succeeded, but deploy runs `1517` and
 
 Prevention: within the existing bounded 60-second budget, retry the complete predicate set together: login, admin redirect, logged-out admin/account responses, public exact SHA, private API status, and Swiss Ephemeris availability. Success requires every predicate in the same attempt. On exhaustion, fail closed and emit only redacted status codes, observed SHA, and health booleans; never log response bodies, env, credentials, or error stacks.
 
+## ERR-101 | Atomic Caddyfile replacement left the running Caddy bind-mounted to the old inode | investigating 2026-08-06
+
+The bounded verifier in deploy `1522` proved that public health had converged to the target exact SHA and private API/Swiss checks passed, but admin checks on the user host returned the expected application fail-closed statuses rather than admin-host statuses. Read-only host inspection then found the reviewed host `deploy/Caddyfile.staging` contained the admin virtual host while `/etc/caddy/Caddyfile` inside the long-running Caddy container did not; their inode, size, and mtime differed even though Docker reported the expected bind source. The tree sync atomically replaced the source file, leaving the existing bind mount attached to the old inode. Both authoritative Spaceship nameservers returned the staging VPS address for the admin host when queried from the VPS, so this was not an absent DNS record. The failed deploy restored the prior application and did not advance deployed-revision.
+
+Prevention: after syncing a gate-attested single-file bind mount, force-recreate Caddy under the shared host lock before public verification. Verify user and admin origins separately: user-host admin paths must be 404; admin-host anonymous page/API must be 307-to-login and 401. Preserve bounded convergence, exact public SHA, private health, automatic rollback, and redacted diagnostics. Do not weaken identity host routing or modify DNS based on intercepted local resolver results.
+
 ## Fragment Sweep Command Set
 
 ## ERR-086 | Steve Jobs jyotishganit artifacts used non-San-Francisco coordinates | mitigated 2026-07-21