deploy/2026.08.28.01 — sign in as a user

two commits, one feature, and a plan that leaves things out for stated reasons.

NO SCHEMA, NO DEPENDENCY, NO PLUGIN CHANGE — checked with git rather than
asserted, because asserting it is exactly what sank 2026.08.27.01.

db:push is deliberately not a step. yesterday's report established that it prints
"Changes applied" when it applies nothing, so its output is not evidence, and on
this fleet it re-applies a default on command_hq_sessions.reference_paths every
time plus churns pk_music_now_playing on two hosts. running it here would be
noise against a database this release does not touch.

so the rollout is a merge and one restart. the verification step is an
unauthenticated POST to the new route: 401 means mounted, 404 means the bundle
did not move — a check that works without a session, on an owner-only feature.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Officer-Session: 656f5c85-e49a-4f1f-b9f3-042a04b4d043

deploy/2026.08.28.01.md

@@ -0,0 +1,71 @@
+# 2026.08.28.01
+
+**One feature: sign in as a user, from user management.** Owner-only, one hour, on a token that carries
+`impersonatedBy` so an impersonated action is never mistaken for the person's own.
+
+Two commits since `2026.08.27.02`, one of which is that release's own report.
+
+## No schema change. No dependency change. No plugin change.
+
+Checked, not asserted — `git diff --name-only deploy/2026.08.27.02..HEAD` matches no `schema.ts`, no
+`drizzle` config, no `bun.lock`, and nothing under `plugins/`. That was the claim the `2026.08.27.01`
+plan got wrong, so it is stated here as a check that was run rather than a belief.
+
+## `bun db:push` is deliberately NOT a step
+
+Every previous plan ran it "because it is cheap and proves the database agrees with the code". The
+`2026.08.27.02` report showed it proves nothing of the sort: it prints **"Changes applied" even when it
+applies nothing**, including on a second run against an unchanged database. And on this fleet it is not
+free — every host re-applies a default on `command_hq_sessions.reference_paths`, and `alpha` and
+`edge-pertento-bridge` drop and re-add `pk_music_now_playing`, which is the drizzle-kit composite-key
+mis-diff in `src/databases/CLAUDE.md`.
+
+Nothing in this release touches a schema, so running it would be churn against a database for no reason,
+using a command whose output cannot be checked. **If you run it anyway, it is not evidence of anything.**
+
+`bun run plugins:update` is skipped for the same reason: no plugin changed, and `2026.08.27.02` updated
+them across the fleet yesterday.
+
+## Every host
+
+1. `git fetch origin --tags` then `git merge --ff-only deploy/2026.08.28.01`
+2. `pm2 restart officer`
+
+That is the whole rollout. The change is a route and a frontend bundle; nothing else runs it.
+
+**`macbookpro`:** prepend `/opt/homebrew/bin` to PATH for `bun`; run `pm2` separately. Asleep is a skip
+with a note.
+
+**`deadpool-rezio-bridge`:** login `br`, checkout `/home/br/officerdev/platform`. Its SSH is intermittent
+— it refused once during the `2026.08.27.02` survey and answered minutes later. One retry, not a loop.
+
+**Do not restart `officer-claude-code`** — it ends every live agent session on the host and nothing here
+needs it. **`officer-opencode` does not need a restart either**: this release changes nothing it reads at
+boot.
+
+## Verify, per host
+
+The feature is owner-only, so an unauthenticated probe proving the route EXISTS is the honest check —
+401 or 403 means mounted, 404 means the bundle did not move:
+
+```
+curl -s -o /dev/null -w '%{http_code}\n' -X POST http://127.0.0.1:<port>/api/users/1/impersonate
+```
+
+Expect **401**. A **404** means step 2 did not take effect. Ports are in `docs/servers.md` —
+`macbookpro` and `production-pertento-bridge` are on **9010**, everything else 9000.
+
+## Risk
+
+Low. One new route behind the existing owner gate, and one frontend bundle. The route refuses a
+self-impersonation, an unknown user, a non-Active account, and any caller whose own token is already
+impersonated — that last one is what stops it chaining into owner powers.
+
+Nothing to roll back but the merge: no data is written and no schema is touched.
+
+## Hosts
+
+alpha · fofos · macbookpro · macbruno · production-pertento-bridge · edge-pertento-bridge ·
+deadpool-rezio-bridge
+
+`officer-dev` is skipped: it is the host running the rollout, and it is already at this code.