diff --git a/deploy/migrations/m0032_permission_residue_cleanup.json b/deploy/migrations/m0032_permission_residue_cleanup.json
new file mode 100644
index 0000000..a2f840d
--- /dev/null
+++ b/deploy/migrations/m0032_permission_residue_cleanup.json
@@ -0,0 +1,20 @@
+{
+  "id": "m0032",
+  "title": "权限残留清理(对齐测试环境权威参照): 删51条历史注册残留——discount双段路径18条(文件不存在/菜单不引用/部分绑any匿名放行面)+pipeline-sdlc旧CRUD与options23条(冻结版load_path零注册/部分绑机构角色logined错配行)+userapp/userdepartment废弃表权限10条(技能既定清理项)。保留/pipeline_core/pipeline_tool_policies/*(冻结代码load_path明确注册,生产正确测试缺)。定性证据:文件存在性NOENT+菜单grep零引用+测试环境无此行。破坏性DELETE走apply-approved",
+  "destructive": true,
+  "backup_tables": [
+    "permission",
+    "rolepermission"
+  ],
+  "up": [
+    {
+      "op": "sql",
+      "sql": "DELETE FROM rolepermission WHERE permid IN (SELECT id FROM permission WHERE path IN ('/discount/discount','/discount/discount_marketing','/discount/discount_marketing/add_discount_marketing.dspy','/discount/discount_marketing/delete_discount_marketing.dspy','/discount/discount_marketing/get_discount_marketing.dspy','/discount/discount_marketing/index.ui','/discount/discount_marketing/update_discount_marketing.dspy','/discount/discount_promo_code','/discount/discount_promo_code/add_discount_promo_code.dspy','/discount/discount_promo_code/delete_discount_promo_code.dspy','/discount/discount_promo_code/get_discount_promo_code.dspy','/discount/discount_promo_code/index.ui','/discount/discount_promo_code/update_discount_promo_code.dspy','/discount/discount/add_discount.dspy','/discount/discount/delete_discount.dspy','/discount/discount/get_discount.dspy','/discount/discount/index.ui','/discount/discount/update_discount.dspy','/pipeline-sdlc/api/get_model_options.dspy','/pipeline-sdlc/api/get_pipeline_options.dspy','/pipeline-sdlc/api/get_project_options.dspy','/pipeline-sdlc/api/get_project_select_options.dspy','/pipeline-sdlc/api/get_role_options.dspy','/pipeline-sdlc/api/get_search_project_type.dspy','/pipeline-sdlc/api/get_search_status.dspy','/pipeline-sdlc/sd_project_list/*','/pipeline-sdlc/sd_project_list/**','/pipeline-sdlc/sd_project_list/index.ui','/pipeline-sdlc/sd_project_role_models/add_sd_project_role_models.dspy','/pipeline-sdlc/sd_project_role_models/delete_sd_project_role_models.dspy','/pipeline-sdlc/sd_project_role_models/get_sd_project_role_models.dspy','/pipeline-sdlc/sd_project_role_models/index.ui','/pipeline-sdlc/sd_project_role_models/update_sd_project_role_models.dspy','/pipeline-sdlc/sd_projects/','/pipeline-sdlc/sd_projects/*','/pipeline-sdlc/sd_projects/**','/pipeline-sdlc/sd_projects/add_sd_projects.dspy','/pipeline-sdlc/sd_projects/delete_sd_projects.dspy','/pipeline-sdlc/sd_projects/get_sd_projects.dspy','/pipeline-sdlc/sd_projects/index.ui','/pipeline-sdlc/sd_projects/update_sd_projects.dspy','/userapp/add_userapp.dspy','/userapp/delete_userapp.dspy','/userapp/get_userapp.dspy','/userapp/index.ui','/userapp/update_userapp.dspy','/userdepartment/add_userdepartment.dspy','/userdepartment/delete_userdepartment.dspy','/userdepartment/get_userdepartment.dspy','/userdepartment/index.ui','/userdepartment/update_userdepartment.dspy'))"
+    },
+    {
+      "op": "sql",
+      "sql": "DELETE FROM permission WHERE path IN ('/discount/discount','/discount/discount_marketing','/discount/discount_marketing/add_discount_marketing.dspy','/discount/discount_marketing/delete_discount_marketing.dspy','/discount/discount_marketing/get_discount_marketing.dspy','/discount/discount_marketing/index.ui','/discount/discount_marketing/update_discount_marketing.dspy','/discount/discount_promo_code','/discount/discount_promo_code/add_discount_promo_code.dspy','/discount/discount_promo_code/delete_discount_promo_code.dspy','/discount/discount_promo_code/get_discount_promo_code.dspy','/discount/discount_promo_code/index.ui','/discount/discount_promo_code/update_discount_promo_code.dspy','/discount/discount/add_discount.dspy','/discount/discount/delete_discount.dspy','/discount/discount/get_discount.dspy','/discount/discount/index.ui','/discount/discount/update_discount.dspy','/pipeline-sdlc/api/get_model_options.dspy','/pipeline-sdlc/api/get_pipeline_options.dspy','/pipeline-sdlc/api/get_project_options.dspy','/pipeline-sdlc/api/get_project_select_options.dspy','/pipeline-sdlc/api/get_role_options.dspy','/pipeline-sdlc/api/get_search_project_type.dspy','/pipeline-sdlc/api/get_search_status.dspy','/pipeline-sdlc/sd_project_list/*','/pipeline-sdlc/sd_project_list/**','/pipeline-sdlc/sd_project_list/index.ui','/pipeline-sdlc/sd_project_role_models/add_sd_project_role_models.dspy','/pipeline-sdlc/sd_project_role_models/delete_sd_project_role_models.dspy','/pipeline-sdlc/sd_project_role_models/get_sd_project_role_models.dspy','/pipeline-sdlc/sd_project_role_models/index.ui','/pipeline-sdlc/sd_project_role_models/update_sd_project_role_models.dspy','/pipeline-sdlc/sd_projects/','/pipeline-sdlc/sd_projects/*','/pipeline-sdlc/sd_projects/**','/pipeline-sdlc/sd_projects/add_sd_projects.dspy','/pipeline-sdlc/sd_projects/delete_sd_projects.dspy','/pipeline-sdlc/sd_projects/get_sd_projects.dspy','/pipeline-sdlc/sd_projects/index.ui','/pipeline-sdlc/sd_projects/update_sd_projects.dspy','/userapp/add_userapp.dspy','/userapp/delete_userapp.dspy','/userapp/get_userapp.dspy','/userapp/index.ui','/userapp/update_userapp.dspy','/userdepartment/add_userdepartment.dspy','/userdepartment/delete_userdepartment.dspy','/userdepartment/get_userdepartment.dspy','/userdepartment/index.ui','/userdepartment/update_userdepartment.dspy')"
+    }
+  ],
+  "down": []
+}
\ No newline at end of file