diff --git a/.gitea/workflows/debug-web-v2.yml b/.gitea/workflows/debug-web-v2.yml
index 15d0ada53..315330453 100644
--- a/.gitea/workflows/debug-web-v2.yml
+++ b/.gitea/workflows/debug-web-v2.yml
@@ -1,36 +1,60 @@
-name: Debug Web Container v2
+name: "Debug: Web container v2 (mount conflict)"
 on:
+  push:
+    branches: [debug/web-crash-v2]
   workflow_dispatch:
-
 jobs:
-  diag:
-    runs-on: ubuntu-latest
+  web-diag:
+    runs-on: runtime-builder
+    timeout-minutes: 10
     steps:
-      - name: SSH diagnose web container
-        uses: appleboy/ssh-action@v1.0.3
-        with:
-          host: 47.98.113.167
-          username: root
-          port: 22222
-          key: ${{ secrets.PREVIEW_SSH_KEY }}
-          script: |
-            set -x
-            echo "=== Docker ps (staging) ==="
-            docker ps -a --filter name=xiaoxia-*-staging --format "table {{.Names}}\t{{.Status}}\t{{.Image}}"
-            echo ""
-            echo "=== Web container logs ==="
-            docker logs xiaoxia-web-staging 2>&1 | tail -30
-            echo ""
-            echo "=== Web inspect (entrypoint/cmd/mounts/env) ==="
-            docker inspect xiaoxia-web-staging --format 'Entrypoint: {{.Config.Entrypoint}} Cmd: {{.Config.Cmd}}'
-            docker inspect xiaoxia-web-staging --format '{{range .Mounts}}{{.Type}} {{.Source}} -> {{.Destination}} ({{if .RW}}rw{{else}}ro{{end}}){{"\n"}}{{end}}'
-            docker inspect xiaoxia-web-staging --format '{{range .Config.Env}}{{.}}{{"\n"}}{{end}}' | grep -E "APP_ENV|VERSION"
-            echo ""
-            echo "=== Test rm on bind mount default.conf (reproduce) ==="
-            docker run --rm --name nginx-test \
-              -v /var/lib/xiaoxia-saas-staging/nginx-staging.conf:/etc/nginx/conf.d/default.conf:ro \
-              git.xiaoxiajianji.com/xiaoxia/xiaoxia-saas/xiaoxia-saas-web:29ca51da9c2e027c6662684ea6d3c1ce1e9777bd \
-              sh -c 'set -x; ls -la /etc/nginx/conf.d/; rm -f /etc/nginx/conf.d/default.conf 2>&1; echo "rm exit=$?"; ls -la /etc/nginx/conf.d/; nginx -t 2>&1' 2>&1 | tail -20
-            echo ""
-            echo "=== Also test newest image (if present locally) ==="
-            docker images | grep xiaoxia-saas-web | head -5
+      - name: Setup SSH and diagnose
+        shell: bash
+        env:
+          STAGING_SSH_KEY: ${{ secrets.PREVIEW_SSH_KEY }}
+        run: |
+          set -x
+          which ssh || (apt-get update -qq && apt-get install -y -qq openssh-client)
+          mkdir -p ~/.ssh && chmod 700 ~/.ssh
+          printf "%s" "$STAGING_SSH_KEY" > ~/.ssh/id_rsa
+          chmod 600 ~/.ssh/id_rsa
+          H=47.98.113.167; P=22222
+          ssh-keyscan -p $P -H $H >> ~/.ssh/known_hosts 2>/dev/null
+          ssh -p $P -i ~/.ssh/id_rsa -o StrictHostKeyChecking=no root@$H 'bash -s' <<'REMOTE'
+          set -x
+          echo "=== Current staging containers ==="
+          docker ps -a --filter name=xiaoxia-*-staging --format "table {{.Names}}\t{{.Status}}\t{{.Image}}"
+          echo ""
+          echo "=== Web container logs (current/current-rolledback) ==="
+          docker logs xiaoxia-web-staging 2>&1 | tail -40
+          echo ""
+          echo "=== Web inspect: env & mounts ==="
+          docker inspect xiaoxia-web-staging --format 'Entrypoint: {{.Config.Entrypoint}} Cmd: {{.Config.Cmd}}'
+          docker inspect xiaoxia-web-staging --format '{{range .Config.Env}}{{.}}{{"\n"}}{{end}}' | grep -E "APP_ENV|VERSION"
+          echo "Mounts:"
+          docker inspect xiaoxia-web-staging --format '{{range .Mounts}}{{.Type}} {{.Source}} -> {{.Destination}} (rw={{.RW}}){{"\n"}}{{end}}'
+          echo ""
+          echo "=== Reproduce: rm on read-only bind mount ==="
+          docker run --rm --name nginx-ro-test \
+            -v /var/lib/xiaoxia-saas-staging/nginx-staging.conf:/etc/nginx/conf.d/default.conf:ro \
+            git.xiaoxiajianji.com/xiaoxia/xiaoxia-saas/xiaoxia-saas-web:387514c \
+            sh -c '
+              set -x
+              echo "Before:"
+              ls -la /etc/nginx/conf.d/
+              echo "Try rm (as entrypoint does):"
+              rm -f /etc/nginx/conf.d/default.conf
+              echo "rm exitcode=$?"
+              echo "After rm:"
+              ls -la /etc/nginx/conf.d/
+              echo "Test ln:"
+              ln -s /etc/nginx/nginx-staging.conf /etc/nginx/conf.d/default.conf
+              echo "ln exitcode=$?"
+              ls -la /etc/nginx/conf.d/
+              echo "nginx -t:"
+              nginx -t 2>&1
+            ' 2>&1
+          echo ""
+          echo "=== Also test with NEW fixed image (9c0d4b1 if present) ==="
+          docker images | grep xiaoxia-saas-web | head -5
+REMOTE