diff --git a/.gitea/workflows/diag.yml b/.gitea/workflows/diag.yml
new file mode 100644
index 0000000..5946f21
--- /dev/null
+++ b/.gitea/workflows/diag.yml
@@ -0,0 +1,26 @@
+name: diag-userbase
+
+# 只读诊断：在 160 的 act_runner 上通过宿主 docker.sock 查看 userbase-service 容器状态与日志。
+# 仅手动 dispatch 触发，不污染 CI。
+on:
+  workflow_dispatch:
+
+jobs:
+  diag:
+    runs-on: ubuntu-latest
+    container:
+      image: docker:24
+    steps:
+      - name: Inspect userbase-service on 160
+        run: |
+          echo "=== docker ps -a (userbase) ==="
+          docker ps -a --filter name=userbase-service --format 'table {{.Names}}\t{{.Status}}\t{{.Image}}'
+          echo
+          echo "=== restart count / state / health ==="
+          docker inspect --format 'RestartCount={{.RestartCount}} Status={{.State.Status}} Health={{.State.Health.Status}}' userbase-service 2>/dev/null || echo "container not found"
+          echo
+          echo "=== userbase-service images on host ==="
+          docker images --filter=reference='nexus:8083/docker-hosted/userbase-service:*' --format 'table {{.Repository}}:{{.Tag}}\t{{.CreatedSince}}\t{{.Size}}' | head -20
+          echo
+          echo "=== logs (tail 120) ==="
+          docker logs --tail 120 userbase-service 2>&1 || echo "no logs"