GoTrue v2.158.1 emits an UPDATE right after inserting an OIDC-provisioned user (pop ORM resends the full struct incl. the zero-value role=''), which bypassed migration 013's BEFORE INSERT trigger and left prod users with role='' — breaking every PostgREST call with `role "" does not exist`. Add a matching BEFORE UPDATE trigger reusing the same guard function, and re-backfill the rows already clobbered. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>