Staging roles in Kentico 9 is only syncing Module permissions, not Page Type or Custom Table ones

I hope someone can help me with a really frustrating issue. I have a local single-server multi-site (2 sites) Kentico 9 instance. I also have a another environment set up as a web farm with 2 servers. The former is configured to synchronize with the latter via the Staging module.

Everything works fine except for Roles. I'm finding that when a role is changed and synchronized, it's copying any permissions set against modules, but any changes made to permissions for page types or custom tables are not synced. In fact, if I add these permissions on the target then re-sync I see this permissions are actually wiped out. So the sync task is behaving as though I've removed all these permissions at source.

I'm sure I've set staging up correct. As I say, it's working for all other objects. My source has 2 staging servers configured, once for each site, and I've added the following web.config keys to ensure global objects are staged correctly:

<add key="CMSStagingTreatServerNamesAsInstances" value="true" />
<add key="CMSStagingLogGlobalObjectsOnlyForAssignedSites" value="true" />

Originally I had a series of objects excluded from staging in a CMSModuleLoader Init method, but I've completely removed all these and still observing the same behaviour. I've also tried with the above web.config keys removed. So as far as I'm concerned this has been tested in a vanilla staging setup.

Any advice you have would be appreciated. FYI, I've also raised this issue over on SO.

Update

I've discovered that the same thing happens when I export roles to the target using the import/export feature. So right now I have no means of deploying roles. I should also point out that there are no errors or warnings in the event log. Also, it might be worth mentioning that I have staging configured for all changes except content.

Update 2

Having investigated further, I'm now seeing that the same role is being created on both sites by the staging task, so I'm ending up with 2 roles on the target both with the same code name. I'm guessing this might be the cause of the problem. Is this a Kentico bug? The role in question is a site-level role, not a global role. When synchronizing I'm choosing 'all' servers but my understanding from this post was that global objects would only be synced once in this case. Although I'm not sure if site-level roles are even technically global objects. In any case there should not be the possibility of syncing a site's role to a different target site.