deploy/2026.08.27.02 — seven hosts, and a push that lies about applying changes

Every target host is at the tag. The one destructive step ran on six of them and
was guarded by a count each time; alpha kept its table and its 8 rows.

The finding is that `bun db:push` prints "Changes applied" unconditionally — it
said so on an unchanged database, twice in a row. `--verbose` shows the truth:
what it re-applies everywhere is pre-existing composite-key drift, and nothing
touches dav_app_passwords on any host.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

deploy/2026.08.27.02.report.md

@@ -0,0 +1,96 @@
+# 2026.08.27.02 — report
+
+**7 of 7 target hosts succeeded.** `officer-dev` skipped: it is the host that ran the rollout.
+
+Every host moved to `91147b40` (`deploy/2026.08.27.02`) by `git merge --ff-only` onto the TAG. No host
+was dirty in tracked files, none diverged, none needed a skip.
+
+## Per host
+
+| Host | HEAD before | HEAD after | Step 2 (drop) | `dav_app_passwords` after | Restarted |
+| --- | --- | --- | --- | --- | --- |
+| `alpha` | `e867fe72` | `91147b40` | skipped by plan | **present, 8 rows** | officer 0→1, opencode 0→1 |
+| `fofos` | `c14b6867` | `91147b40` | dropped (count 0) | GONE | officer 3→4, opencode 0→1 |
+| `macbookpro` | `c14b6867` | `91147b40` | dropped (count 0) | GONE | officer 0→1, opencode 0→1 |
+| `macbruno` | `c14b6867` | `91147b40` | dropped (count 0) | GONE | officer 3→4, opencode 1→2 |
+| `production-pertento-bridge` | `c14b6867` | `91147b40` | dropped (count 0) | GONE | officer 1→2, opencode 0→1 |
+| `edge-pertento-bridge` | `c14b6867` | `91147b40` | dropped (count 0) | GONE | officer 2→3, opencode 0→1 |
+| `deadpool-rezio-bridge` | `c14b6867` | `91147b40` | dropped (count 0) | GONE | officer 19→20, opencode 0→1 |
+
+Every process the plan named came back `online` with `restart_time` moved, on every host. No officer
+process was left `errored` or `stopped` anywhere.
+
+## The schema, verified by query per host
+
+The plan's claim was checked on each host, against that host's own database, **after** the rollout —
+not inferred from an exit code. Final sweep:
+
+```
+alpha                        caldav=yes  dav_app_passwords=present  rows=8
+fofos                        caldav=no   dav_app_passwords=GONE
+macbookpro                   caldav=no   dav_app_passwords=GONE
+macbruno                     caldav=no   dav_app_passwords=GONE
+production-pertento-bridge   caldav=no   dav_app_passwords=GONE
+edge-pertento-bridge         caldav=no   dav_app_passwords=GONE
+deadpool-rezio-bridge        caldav=no   dav_app_passwords=GONE
+```
+
+The count guard held on all six drop hosts: every one read exactly `0` before the `drop table`, and the
+drop was verified by re-querying `to_regclass` after. `alpha` was never touched by step 2, and its 8 rows
+are intact.
+
+**Two counts the survey could not read are now read.** `macbookpro` (bun/psql behind Homebrew) and
+`deadpool-rezio-bridge` (SSH refused at survey time) both held **0 rows**, so both qualified for the drop
+under the plan's own guard rather than under an assumption.
+
+`officer_marketplace` and its `tags` column: nothing applied, correctly — no host runs
+`officer-marketplace`, confirmed zero of seven.
+
+## `bun db:push` prints `Changes applied` even when it changes nothing
+
+Worth recording, because it makes the plan's "expect no changes" unverifiable from stdout. `db:push`
+printed `[✓] Changes applied` on **every** host, including on an immediate second run against an
+unchanged database. It is unconditional output, not evidence.
+
+What settled it was `drizzle-kit push --verbose`, which prints the statements first. Rerun per host, the
+real content was:
+
+- **every host** — `ALTER TABLE "command_hq_sessions" ALTER COLUMN "reference_paths" SET DEFAULT '{}'`
+- **`alpha` and `edge-pertento-bridge` also** — `music_now_playing` dropping and re-adding
+  `pk_music_now_playing` as the same two-column key
+
+Both re-appear on every push and neither is destructive. This is the drizzle-kit composite-key mis-diff
+already documented in `src/databases/CLAUDE.md`, and it is **pre-existing drift, unrelated to this
+release**. Nothing in it drops or recreates `dav_app_passwords` on any host — which is the positive
+result: plugin schema generation scoped the table to the one host with the plugin, exactly as the plan
+said it would.
+
+Not fixed here. A rollout is the wrong place for a schema-code change.
+
+## Plugins
+
+`bun run plugins:update` exited 0 everywhere. It also started sidecars beyond the two the plan named, so
+"restarted" above understates what moved: `officer-gitea` was added on `fofos` and
+`production-pertento-bridge`, and `officer-offscale` on `edge-pertento-bridge` and
+`deadpool-rezio-bridge`. Counts: alpha 15/15, fofos 3/3, macbruno 1/1, production 1/1, edge 2/2,
+deadpool 2/2, macbookpro none installed.
+
+## What was not done
+
+- **`officer-dev` — skipped entirely**, as the plan requires. Not pulled, nothing restarted. It is the
+  host this rollout ran on, and restarting `officer-claude-code` there would have ended the rollout. The
+  owner restarts it deliberately.
+- **`officer-claude-code` was not restarted anywhere.** The plan forbids it.
+- **`deadpool-rezio-bridge` refused SSH on the first probe** (`Connection closed by 100.64.0.21 port 22`)
+  and answered on a second attempt a few minutes later. One retry, not a loop. It then deployed normally,
+  so it is a success rather than the skip the plan allowed for. Its SSH is intermittent and that is worth
+  knowing.
+- **`fofos` carries one untracked file**, `scripts/chk.ts`. A note, not a skip — a fast-forward could not
+  touch it and it was left alone.
+- **`2026.08.27.01` remains claimed and undeployed**, which is correct: this release replaces it.
+
+## Worth a look, per the plan's own risk note
+
+Untested by this rollout, because they need a browser: `useThemeAsset` now reads in
+`requestAnimationFrame` (a themed logo or wallpaper failing to appear points there), and the notify
+router's mount order changed (device registration is worth one check).