DATABASE_URL_SYNC uses the postgres superuser whose password is unavailable in Railway after Phase 1 switched runtime to the app role. resolutionflow_admin (BYPASSRLS) is the correct role for migrations. Derive a psycopg2 sync URL from ADMIN_DATABASE_URL; fall back to DATABASE_URL_SYNC for local dev environments where ADMIN_DATABASE_URL is not set separately. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>