docs: record first-deployment model and manual schema initialization

.project-docs/30-worklog/current-state.md

@@ -8,13 +8,14 @@ This file is the integrated default-branch snapshot. Feature tasks record progre
 - `79d29bb` (cross-platform ACK manifest validation fix)
 - `4485899` (task-scoped Next.js frontend plus Go backend target design and explicit not-implemented progress record)
 - `064e155` (canonical ADR-003, architecture, current-state, history, and commitment promotion)
-- `b8db39d` (merge of `aef5a97` — completed Go backend modules: foundation, identity, current-session, password lifecycle, plus remaining modules; tasks `20260812-go-migration-foundation-b74c9e21`, `20260813-go-identity-vertical-c4e91a72`, `20260813-go-auth-me-http-8d6f3a21`, `20260813-go-auth-lifecycle-3f9a6c12`, `20260813-go-remaining-modules-7d3a9e42`)
+- `b8db39d` (merge of `aef5a97` — completed Go backend modules; tasks `20260812-go-migration-foundation-b74c9e21`, `20260813-go-identity-vertical-c4e91a72`, `20260813-go-auth-me-http-8d6f3a21`, `20260813-go-auth-lifecycle-3f9a6c12`, `20260813-go-remaining-modules-7d3a9e42`)
 - `d0fb346` (merge of `c1cbd78` — Go backend implementation, contract fixtures, migration 0002, and task-scoped records into `main`; tasks `20260813-go-remaining-modules-7d3a9e42` and `20260814-go-remaining-integration-5e7c9a1b`)
 - `f10cdd9` (record of completed task `20260812-architecture-task-breakdown-a83f61c2`)
+- `ff055c9` (config-driven super-admin bootstrap in the Go backend, task `20260814-go-bootstrap-admin-6e2b7d9c`)
 
 ## Current Focus
 
-ADR-003's Go modular-monolith backend is implemented and merged into `main` under `backend/`: `cmd/zhinian-api` plus 18 `internal/` packages (154 Go files), 24 language-neutral contract fixtures under `contracts/`, and lifecycle-fencing migration `0002_generation_lifecycle_fencing.sql`. The deployed production architecture remains the Next.js full-stack Web plus HTTP-polling Node Worker (ACK-001): no Go traffic cutover, Next Route Handler deletion, or manifest/Secret ownership change has happened, and no Go workload is deployed.
+ADR-003's Go modular-monolith backend is implemented and merged into `main` under `backend/` (`cmd/zhinian-api`, 18 `internal/` packages, 24 contract fixtures, migration 0002). There is no production instance of this application yet: the **first production deployment** will run the ADR-003 split topology directly — Next.js serves pages/static/SSR, Go owns `/api`, `/uploads`, and `/generated-results` — so there is no legacy cutover, no Node Worker drain, and no legacy production session compatibility to preserve. Next.js route handlers remain in the repository for local development only. The production schema is initialized by manually executing the versioned SQL files; the ACK migration Job is not part of the deployment path.
 
 ## Recently Completed
 
@@ -22,31 +23,33 @@ ADR-003's Go modular-monolith backend is implemented and merged into `main` unde
 - 2026-08-12: Added versioned PostgreSQL migrations, strict backend selection, verified-CA TLS, database readiness, and ACK Web/Worker/migration manifests.
 - 2026-08-12: Accepted and documented the Next.js frontend plus Go backend target, migration contracts, and acceptance criteria.
 - 2026-08-14: Implemented and merged the Go backend (foundation, identity, administration, assets, billing, usage, jobs/providers/webhooks/worker loop, public and compatibility HTTP surfaces) with language-neutral contract fixtures and migration 0002.
-- 2026-08-14: Reconciliated canonical architecture, decision, history, commitment, and positioning memory with the merged Go implementation (task `20260814-go-memory-reconcile-7f2a9c41`).
+- 2026-08-14: Reconciled canonical architecture, decision, history, commitment, and positioning memory with the merged Go implementation (task `20260814-go-memory-reconcile-7f2a9c41`).
+- 2026-08-14: Added config-driven first-super-administrator bootstrap to the Go backend (task `20260814-go-bootstrap-admin-6e2b7d9c`).
+- 2026-08-14: Recorded the first-deployment model: no production cutover, manual schema initialization without the migration Job pod (task `20260814-deploy-model-reconcile-9b4c2e7f`).
 
 ## In Progress
 
-- None. All Go implementation feature tasks are merged; five feature worktrees remain `ready_for_integration` with completed records and can be released after review.
+- None.
 
 ## Next Recommended Steps
 
-1. Validate the merged Go backend against a non-production RDS instance (real application role, verified-CA TLS), real OSS, provider credentials, external Webhooks, and production-like Worker recovery before any Go traffic cutover.
-2. Obtain the product/release decisions deferred by ADR-003: parse existing `zhinian_session` cookies without logout versus one-time global re-login, and the public `/api/v1` compatibility promise.
-3. After validation, plan the single-writer cutover: route `/api`, `/uploads`, and `/generated-results` to Go, drain and stop the Node Worker, and only then delete Next Route Handlers and relocate RDS/provider/OSS Secrets and ACK manifests.
-4. Release the five completed Go feature worktrees once their records and merges are confirmed.
+1. Build the Go workload deployment artifacts for the first production deployment: Go container image, ACK Deployment/Service manifests, and Ingress routing that sends page/static paths to Next.js and `/api`, `/uploads`, `/generated-results` to Go.
+2. Initialize the production schema by manually executing `database/migrations/0001_initial_schema.sql` then `0002_generation_lifecycle_fencing.sql` as the migration role, then apply the application-role grants (tables plus the two concurrency functions).
+3. Configure `ZHINIAN_BOOTSTRAP_ADMIN_*` on the first Go startup; the process creates the first super administrator exactly once.
+4. Validate against non-production RDS (real application role, verified-CA TLS), real OSS, provider credentials, and external Webhooks before the first production rollout.
+5. Confirm the public `/api/v1` compatibility promise for external consumers.
 
 ## Open Questions / Blockers
 
 - Target RDS PostgreSQL version, connection budget, endpoint, TLS enforcement, CA bundle, database roles, and ACK network policy remain deployment inputs.
-- Go Cookie compatibility (no-logout parsing versus forced re-login) still needs a product decision.
-- Public `/api/v1` compatibility obligations for the cutover need explicit confirmation.
+- Real OSS bucket/credential configuration is still needed for shared asset storage.
+- Public `/api/v1` support promises for external consumers need explicit confirmation.
 
 ## Risky Areas
 
-- Database migrations and least-privilege grants must be tested against the actual RDS instance before production cutover.
-- Web pods still own runtime files; PostgreSQL does not make local uploads/generated assets safe for horizontal Web scaling.
+- Database grants and least-privilege roles must be tested against the actual RDS instance before the first rollout.
 - The current image runs as root; moving to a non-root user requires an explicit writable-path ownership design.
-- The merged Go code is contract-tested but unrouted; parity gaps can only surface under real provider, OSS, RDS, and Webhook traffic.
+- The Go code is contract-tested but has never run against real provider, OSS, RDS, and Webhook traffic; parity gaps can only surface under real dependencies.
 
 ## Last Updated
 

.project-docs/30-worklog/tasks/20260814-deploy-model-reconcile-9b4c2e7f.md

@@ -0,0 +1,47 @@
+# Task: Record first-deployment model and manual schema initialization
+
+## Identity
+
+- Task ID: 20260814-deploy-model-reconcile-9b4c2e7f
+- Mode: Integration
+- Branch: main
+- Worktree: /Users/brother7/Documents/AI/NianAIGC
+- Base commit: ff055c972de50f34ac6eabf3e977610949482bba
+- Owner: dsh
+- Status: Ready for Integration
+
+## Scope
+
+- Apply two human decisions from 2026-08-14 to canonical memory and deployment documentation:
+  1. There is no production cutover: the first production deployment runs the ADR-003 split topology (Next.js frontend + Go backend) directly; no legacy production instance, no Node Worker in production.
+  2. Schema initialization is executed manually with the versioned SQL files; the ACK migration Job pod is not deployed.
+- Related: the first super administrator is created from `ZHINIAN_BOOTSTRAP_ADMIN_*` configuration at Go startup (implemented in task `20260814-go-bootstrap-admin-6e2b7d9c`); legacy account import is not required.
+
+## Intent And Constraints
+
+- Keep the versioned-SQL discipline (RDS-002); only the execution mechanism changes from the one-shot Job to manual execution.
+- Do not claim any production validation that has not happened.
+- Keep the migration Job manifest on disk, marked deprecated, for optional future automation.
+
+## Outcome
+
+- Added `DEP-001` to the decision index; moved `ACK-001` to Superseded Decisions; amended `RDS-002` execution detail; updated the ADR-003 status to "first production deployment pending".
+- Rewrote `current-state.md` Current Focus, Next Recommended Steps, Open Questions, and Risky Areas around the first-deployment model; recorded `ff055c9` under Integrated Through.
+- Updated `system-overview.md`, `module-map.md`, and `data-flow.md` to describe the split-topology first deployment and manual schema initialization.
+- Updated `commitments.md` (dropped cutover obligations; added Go deployment artifacts, manual schema init, bootstrap config, and first-rollout validation commitments) and `business-rules.md` (manual schema execution rule; removed the moot cookie-compatibility question).
+- Updated deployment guidance in `docs/DEPLOYMENT.md`, `README.md`, and `README.zh-CN.md` to manual SQL execution and config-driven bootstrap; marked `deploy/ack/migration-job.yaml` deprecated with a header comment.
+
+## Verification
+
+- `check_project_docs.py` and `check_doc_drift.py --task-id 20260814-deploy-model-reconcile-9b4c2e7f` pass.
+- `npm run deploy:check` passes with the deprecated manifest comment in place.
+
+## Follow-ups
+
+- Build the Go workload deployment artifacts (image, manifests, Ingress split) for the first production deployment.
+- Execute the manual schema initialization and role grants against the real RDS before the first rollout.
+- Decide whether to delete the deprecated `migration-job.yaml` later.
+
+## Promotion Candidates
+
+- None beyond what this integration task already applied.