release 2026.08.29.01 — sharp becomes infrastructure

every other deploy this month was code. this one changes what a machine must have,
so the plan has two verification steps no previous plan needed and one host gets a
command none of the others do.

SCHEMA UNCHANGED, and the plan says so with the command that proves it rather than
the claim on its own:

  git diff --name-only deploy/2026.08.28.01..HEAD | grep -iE 'schema|/db/|databases'

returns nothing. no db:push step exists and none should be improvised. the last
time a plan of mine asserted this without checking, `dav_app_passwords` had moved
to a plugin and a push would have dropped it on six hosts.

BUN INSTALL IS REQUIRED, not optional — package.json and bun.lock both moved. and
it gets a SEPARATE verification step, because sharp does not compile, it downloads
a prebuilt libvips for this exact platform and arch: the install can succeed and
the module still be unusable, and the symptom is not an error anywhere. it is a
file browser drawing generic icons over a folder of photographs.

FFMPEG IS CHECKED because it was never declared. it has been a hard dependency of
the file browser since long before thumbnails — subtitles, audio extraction, audio
tracks — and worked because every machine was set up by hand. surveyed all seven
hosts today: present everywhere except macbruno, which is the one per-host command
in the plan.

fofos already runs this code and was the test host before the tag. it found a real
bug that only a deploy could: `.ts` was in the video extension list, so every
TypeScript file in every repository drew a play badge and spawned an ffmpeg.

known and NOT fixed here: one test fails, ModelSelector's default selection. it is
in chat code this release does not touch, the file is unchanged across every commit
in this range, and it last moved in fe7fe49c. tagging over somebody else's red test
rather than editing their work mid-release.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Officer-Session: 656f5c85-e49a-4f1f-b9f3-042a04b4d043

deploy/2026.08.29.01.md

@@ -0,0 +1,122 @@
+# 2026.08.29.01 — sharp becomes infrastructure
+
+**This release changes what a machine must have.** Every other deploy this month was code; this one adds
+a dependency with a native binary and a system package, so `bun install` is a required step rather than
+an optional one, and there are two things to verify per host that no previous plan asked for.
+
+Read the whole file before starting a host. The per-host section at the bottom is not optional detail —
+one host needs a command none of the others do.
+
+## What is in it
+
+- **File browser thumbnails.** Images and videos draw a picture in both grid and list. New endpoint
+  `GET /api/file-browser/thumb`, cached under each user's `cache/thumbs/`.
+- **sharp is now a declared dependency** (`^0.35.3`, resolving 0.35.4). It does the images; ffmpeg keeps
+  the video. `package.json` and `bun.lock` both changed.
+- **ffmpeg is now declared in machine-setup's package list.** It was always a hard dependency of the file
+  browser — subtitles, audio extraction, audio tracks — and was never in the list. Existing hosts were
+  not provisioned by the new script, so this release checks rather than assumes.
+- Marketplace: install a plugin from a git URL; Marketplace overview section; nav restyle.
+- Dock and Spotlight clip bare plugin artwork to the tile shape.
+- The platform-skill generator emits an identifier for `name` again, so `docs:check` is green.
+
+## Schema: UNCHANGED. Do not run `db:push`.
+
+Verified, not assumed:
+
+```bash
+git diff --name-only deploy/2026.08.28.01..deploy/2026.08.29.01 | grep -iE 'schema|/db/|databases'
+```
+
+returns nothing. There is no table, no column and no constraint in this release. **No `bun db:push`
+step exists in this plan and none should be improvised.** If `bun run plugins:update` reports that a
+plugin moved, say so in the report — do not push a schema to cover it.
+
+## Every host — the commands
+
+Run these after the standard steps in `prompts/deploy-commander.md` (dirty check, `git fetch origin
+--tags`, `git merge --ff-only deploy/2026.08.29.01`, `bun run plugins:update`), in this order, in the
+checkout from PM2's `pm_cwd`.
+
+### 1. Install — REQUIRED, and it is the point of this release
+
+```bash
+bun install
+```
+
+The lockfile is frozen, so this resolves from `bun.lock` and nothing else. It should report installing
+around 14 packages — sharp and its platform-specific libvips binaries.
+
+**A failure here stops this host.** Do not continue to the restart, and do not reach for `--force` to get
+past it: if the lockfile and `package.json` disagree, that is the freeze doing its job and it wants a
+human.
+
+### 2. Prove sharp actually loads — the check that matters
+
+```bash
+bun -e "import('sharp').then(m => console.log('libvips', m.default.versions.vips)).catch(e => { console.error('SHARP FAILED:', e.message); process.exit(1) })"
+```
+
+Expect `libvips 8.18.6`.
+
+**This is a separate step from the install on purpose.** sharp does not compile — it downloads a prebuilt
+binary chosen by platform and architecture. So `bun install` can succeed and the module still be
+unusable, and the symptom is not an error anywhere: it is a file browser drawing generic icons over a
+folder of photographs, which nobody reads as "a native module is missing".
+
+A host where this fails is a **failed host**. Report it, move on. `bun install --force` is the usual
+repair and it is a human's to run, not this rollout's.
+
+### 3. ffmpeg must be present
+
+```bash
+command -v ffmpeg && ffmpeg -version | head -1
+```
+
+Video thumbnails need it, and so do three file-browser features that predate this release. Surveyed
+2026-08-29: present on every host **except `macbruno`** — see below.
+
+Absent and not covered by a per-host command below → report the host as deployed-with-a-caveat, name
+ffmpeg, and do not install it yourself. Adding a system package to a machine is not something a rollout
+improvises.
+
+### 4. Restart
+
+```bash
+pm2 restart officer
+```
+
+**`officer` only.** Nothing else in this release touches a sidecar. Never
+`pm2 restart ecosystem.config.cjs`.
+
+### 5. Verify it came back
+
+`pm2 jlist`: `officer` is `online` and its `restart_time` moved. Then, for this release specifically:
+
+```bash
+curl -s -o /dev/null -w '%{http_code}\n' --max-time 5 http://127.0.0.1:<PORT>/api/health
+```
+
+`200` or `401` are both healthy — the port is per host, in `docs/servers.md` (9010 on `macbookpro` and
+`production-pertento-bridge`, 9000 elsewhere).
+
+## Per host
+
+| Host | Extra command | Note |
+| --- | --- | --- |
+| `officer-dev` | — | **SKIP ENTIRELY.** The rollout runs here. Do not pull, do not restart. Name it as skipped. |
+| `alpha` | — | x86_64, ffmpeg present. |
+| `fofos` | — | **Already at this code and verified** — it was the test host on 2026-08-29 before the tag. Bring it to the tag anyway so its HEAD matches the fleet; `bun install` will be a no-op. 1.9GB box: expect the install to be the slowest part. |
+| `macbookpro` | — | macOS/arm64, port **9010**. A laptop — unreachable is a SKIP with a note, not a failure. |
+| `macbruno` | `brew install ffmpeg` **before step 4** | macOS/arm64, login `brunoalcadapadezmonteirodaconceicao`. **The only host without ffmpeg.** Without it, image thumbnails still work — sharp does those — and video ones do not, along with subtitles and audio extraction. If brew is missing or the install fails, deploy anyway and report the caveat: nothing in this release regresses without ffmpeg, it simply does not gain the video half. |
+| `production-pertento-bridge` | — | x86_64, port **9010**. |
+| `edge-pertento-bridge` | — | x86_64. Node v24 here where the fleet is v22; sharp ships binaries for both and this was not a problem for the install on any other host, but if step 2 fails anywhere it is most likely here. |
+| `deadpool-rezio-bridge` | — | x86_64, login **`br`**, checkout `/home/br/officerdev/platform`. |
+
+## What "done" looks like
+
+Per host: HEAD before and after, `bun install` result, the libvips version step 2 printed, whether ffmpeg
+was found, and `officer` back online with a moved `restart_time`.
+
+The two lines worth having in the summary that no previous report needed: **which hosts print a libvips
+version**, and **which hosts have ffmpeg**. Those are the two facts this release is actually about.

package.json

@@ -1,6 +1,6 @@
 {
   "name": "officer",
-  "version": "2026.08.28.01",
+  "version": "2026.08.29.01",
   "private": true,
   "type": "module",
   "workspaces": [