fix: keep setup database config empty and isolate Baota mode

deploy/baota-init.sh

@@ -9,7 +9,6 @@ CONFIG_ROOT=/etc/kaidi
 STATE_ROOT=/var/lib/kaidi
 UPDATE_STATE_ROOT=/var/lib/kaidi-update
 LOG_ROOT=/var/log/kaidi
-UPDATER_ROOT=/opt/kaidi/bin
 PUBLIC_KEY_SHA256=807c6aec1dc3f7ce494db16aa9d763c66f292033c38f328afd0390d2715a8cd9
 RELEASE_API_URL=https://git.awaioi.com/api/v1/repos/ERP-Team/kaidi/releases/latest
 INIT_ARMED=false
@@ -29,7 +28,7 @@ rollback_initialization() {
     rm -f /etc/systemd/system/kaidi-update.service /etc/systemd/system/kaidi-update.path
     systemctl daemon-reload >/dev/null 2>&1 || true
     rm -f "$CONFIG_ROOT/kaidi.env" "$CONFIG_ROOT/update.env" \
-      "$CONFIG_ROOT/release-public.pem" "$UPDATER_ROOT/update.sh" \
+      "$CONFIG_ROOT/release-public.pem" \
       "$UPDATE_STATE_ROOT/status.json" /root/kaidi-first-login.txt
     rm -f "$INIT_APP_ROOT/current.next"
     if [ -n "$INIT_RELEASE_ROOT" ] \
@@ -95,7 +94,7 @@ main() {
   [ "$(uname -s)" = Linux ] || die "Baota initialization only supports Linux"
   command -v systemctl >/dev/null 2>&1 && [ -d /run/systemd/system ] \
     || die "systemd is required for the privileged background updater"
-  for command in find openssl setsid sha256sum; do
+  for command in find openssl sha256sum; do
     command -v "$command" >/dev/null 2>&1 || die "$command is required"
   done
 
@@ -137,7 +136,7 @@ main() {
 
   INIT_ARMED=true
   ensure_service_identity
-  install -d -o root -g "$SERVICE_GROUP" -m 0750 "$app_root" "$releases_root" "$UPDATER_ROOT"
+  install -d -o root -g "$SERVICE_GROUP" -m 0750 "$app_root" "$releases_root"
   install -d -o "$SERVICE_USER" -g "$SERVICE_GROUP" -m 0750 \
     "$STATE_ROOT" "$STATE_ROOT/files" "$STATE_ROOT/tmp" "$LOG_ROOT"
   install -d -o "$SERVICE_USER" -g "$SERVICE_GROUP" -m 0700 "$STATE_ROOT/setup"
@@ -163,9 +162,11 @@ main() {
     SERVER_ADDRESS 127.0.0.1 \
     SERVER_PORT "$app_port" \
     SESSION_COOKIE_SECURE false \
-    DB_URL 'jdbc:mysql://setup.invalid:3306/kaidi_finance' \
-    DB_USERNAME setup_pending \
-    DB_PASSWORD setup_pending \
+    # The setup context has no datasource. Empty values avoid Baota treating
+    # a development placeholder as a real local MySQL dependency.
+    DB_URL '' \
+    DB_USERNAME '' \
+    DB_PASSWORD '' \
     FIELD_ENCRYPTION_KEY "$field_key" \
     FILE_STORAGE_ROOT "$STATE_ROOT/files" \
     FILE_STORAGE_TEMP "$STATE_ROOT/tmp" \
@@ -187,39 +188,10 @@ main() {
   chown root:"$SERVICE_GROUP" "$CONFIG_ROOT/kaidi.env"
   chmod 0640 "$CONFIG_ROOT/kaidi.env"
 
+  # Baota owns the Java process in this mode. Do not install a second
+  # systemd updater; online update is intentionally systemd-only until the
+  # panel lifecycle can participate in the transaction state machine.
   install -m 0644 "$release_root/ops/release-public.pem" "$CONFIG_ROOT/release-public.pem"
-  install -m 0755 "$release_root/ops/update.sh" "$UPDATER_ROOT/update.sh"
-  write_env_file "$CONFIG_ROOT/update.env" \
-    UPDATE_RELEASE_BASE_URL '' \
-    UPDATE_RELEASE_API_URL "$RELEASE_API_URL" \
-    UPDATE_RELEASE_TOKEN '' \
-    UPDATE_REQUEST_FILE "$UPDATE_STATE_ROOT/inbox/request.json" \
-    UPDATE_STATUS_FILE "$UPDATE_STATE_ROOT/status.json" \
-    UPDATE_PUBLIC_KEY "$CONFIG_ROOT/release-public.pem" \
-    KAIDI_APP_ROOT "$app_root" \
-    KAIDI_UPDATE_STATE_ROOT "$UPDATE_STATE_ROOT" \
-    KAIDI_PROCESS_MANAGER baota \
-    KAIDI_PID_FILE "$STATE_ROOT/kaidi.pid" \
-    KAIDI_RUNTIME_ENV_FILE "$STATE_ROOT/setup/application.env" \
-    KAIDI_UPDATER_PATH "$UPDATER_ROOT/update.sh" \
-    KAIDI_SERVICE_USER "$SERVICE_USER" \
-    KAIDI_SERVICE_GROUP "$SERVICE_GROUP" \
-    KAIDI_UPDATE_PATH_NAME kaidi-update.path \
-    KAIDI_HEALTH_URL "http://127.0.0.1:$app_port/actuator/health" \
-    KAIDI_APP_INDEX_URL "http://127.0.0.1:$app_port/" \
-    KAIDI_DB_HOST setup.invalid \
-    KAIDI_DB_PORT 3306 \
-    KAIDI_DB_NAME kaidi_finance \
-    KAIDI_DB_USERNAME setup_pending \
-    KAIDI_DB_PASSWORD setup_pending
-  chmod 0600 "$CONFIG_ROOT/update.env"
-
-  install -m 0644 "$release_root/ops/kaidi-update.service" /etc/systemd/system/kaidi-update.service
-  install -m 0644 "$release_root/ops/kaidi-update.path" /etc/systemd/system/kaidi-update.path
-  systemd-analyze verify /etc/systemd/system/kaidi-update.service /etc/systemd/system/kaidi-update.path >/dev/null \
-    || die "The privileged update units failed validation"
-  systemctl daemon-reload
-  systemctl enable --now kaidi-update.path
 
   printf '{"state":"CURRENT","message":"Baota release is prepared","targetVersion":"%s","updatedAt":"%s"}\n' \
     "$version" "$(date -u +%Y-%m-%dT%H:%M:%SZ)" > "$UPDATE_STATE_ROOT/status.json"