release 2026.08.29.03 — the todo board leaves, a plugin can claim a file type

no schema change and no dependency change, and the plan says so with the two
commands that prove it rather than the claim alone. so there is no db:push step and
no bun install step, and the plan says neither should be improvised. ten commits,
all code.

THE BEHAVIOUR CHANGE IS NAMED RATHER THAN DISCOVERED: /todos now 404s. the board is
the kanban plugin, in the marketplace, installed nowhere by default — the intended
state. `role_permissions` rows naming `todos` are orphaned and the plan says
explicitly NOT to clean them up: absence denies, a row naming a permission that does
not exist grants nothing, and a data edit nobody asked for does not belong in a
rollout.

the plan adds one verification this release earns: an `ls` call per host, because
the listing route changed to union plugin-claimed file types with core's own. a 500
there is a failed host.

surveyed the fleet while writing it. av-club is installed on fofos ALONE, so fofos
is the only host that gains HEIC — everywhere else the file browser is exactly what
it was, which is the property the extension point was built for and worth stating so
its absence elsewhere is not read as a fault.

edge-pertento-bridge did not answer the survey. not listed as skipped on that
evidence — one quiet moment is not a down host, and the last time this fleet assumed
otherwise it cost four attempts against a machine that was fine.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Officer-Session: 656f5c85-e49a-4f1f-b9f3-042a04b4d043

deploy/2026.08.29.03.md

@@ -0,0 +1,85 @@
+# 2026.08.29.03 — the todo board leaves, and a plugin can claim a file type
+
+**No schema change and no dependency change.** Verified rather than assumed:
+
+```bash
+git diff --name-only deploy/2026.08.29.02..deploy/2026.08.29.03 | grep -iE 'schema|/db/|databases'   # nothing
+git diff --stat deploy/2026.08.29.02..deploy/2026.08.29.03 -- package.json bun.lock                  # nothing
+```
+
+So **no `bun db:push` and no `bun install` step exist in this plan, and neither should be improvised.**
+Ten commits, all code.
+
+## What is in it
+
+- **`/todos` is gone from the platform.** It is now the `kanban` plugin, in the marketplace. The
+  `todos` permission, the route, the screen and the board were all removed.
+- **A plugin can claim a file type.** A manifest may declare `fileTypes`; the file browser then offers
+  thumbnails and a full-size render for formats the platform itself cannot read. av-club claims
+  `heic`/`heif`, so on a host with av-club installed, iPhone photographs get pictures instead of file
+  icons and open in the viewer.
+- Thumbnails retry rather than giving up, and list and grid ask for the same size.
+- The directory picker moved into the platform so more than one plugin can use it.
+
+## A behaviour change to expect, and it is deliberate
+
+**`/todos` now 404s.** Anyone with it bookmarked gets nothing. The board is the `kanban` plugin, which
+is in the marketplace and installed nowhere by default — that is the intended state, not an oversight.
+
+`role_permissions` rows naming `todos` are now orphaned. Harmless: absence denies, and the registry no
+longer has the key. **Do not clean them up as part of this rollout** — it is a data edit nobody asked
+for, and a row naming a permission that does not exist grants nothing.
+
+## Every host — the commands
+
+The standard steps in `prompts/deploy-commander.md` are the whole rollout this time (dirty check,
+`git fetch origin --tags`, `git merge --ff-only deploy/2026.08.29.03`, `bun run plugins:update`), plus:
+
+```bash
+pm2 restart officer
+```
+
+`officer` only — `plugins:update` has already restarted the plugin sidecars.
+
+### Verify it came back
+
+`pm2 jlist`: `officer` online and `restart_time` moved, then `/api/health` on the host's own port
+(9010 on `macbookpro` and `production-pertento-bridge`, 9000 elsewhere). `200` or `401` are healthy.
+
+### And check the file browser still lists
+
+This release touched the listing route, so one call per host is worth it:
+
+```bash
+bun -e "
+const { sign } = await import('./src/servers/jwt');
+const t = await sign({ id: 1, email: '<the owner on this host>' }, '2m');
+const r = await fetch('http://127.0.0.1:<PORT>/api/file-browser/ls?root=home&path=/', { headers: { Authorization: 'Bearer ' + t } });
+const b = await r.json(); console.log(r.status, (b.entries ?? []).length + ' entries');
+process.exit(0)"
+```
+
+A `200` with a plausible count. **A 500 here is a failed host** — report it and move on.
+
+## Per host
+
+Surveyed 2026-08-29 while writing this.
+
+| Host | Note |
+| --- | --- |
+| `officer-dev` | **SKIP ENTIRELY.** The rollout runs here and it is already at this code. Name it as skipped. |
+| `alpha` | No av-club, so no HEIC support — expected, not a fault. |
+| `fofos` | **The only host with av-club installed**, and already at this commit and verified: 6 HEICs thumbnail and one renders at full size. Bring it to the tag so its HEAD matches the fleet. |
+| `macbookpro` | macOS, port **9010**, a laptop. Unreachable is a SKIP with a note. |
+| `macbruno` | macOS, login `brunoalcadapadezmonteirodaconceicao`. |
+| `production-pertento-bridge` | Port **9010**. Its `pg_dump` is older than its server — irrelevant here, since this release takes no backup and touches no schema. |
+| `edge-pertento-bridge` | Did not answer the survey while this plan was written. It may simply have been busy; treat it as an ordinary target and report what you find. |
+| `deadpool-rezio-bridge` | Login **`br`**, checkout `/home/br/officerdev/platform`. |
+
+## What "done" looks like
+
+Per host: HEAD before and after, `plugins:update` result, `officer` back online with a moved
+`restart_time`, and the `ls` check's output.
+
+Nothing in this release needs a database query, a backup or an install. If you find yourself running
+one, stop — the plan is wrong and that is worth reporting rather than working around.