release 2026.08.26.01

22 commits. no schema change, no dependency change.

the reason it is being cut tonight rather than tomorrow: officerdev gained an
export that a SHIPPED plugin already imports. proxy-manager is in the catalogue
now and its ChatPanel imports ChatHeader, which exists only from 2ed47fa6. on a
host running 2026.08.25.01 the plugin installs, the frontend rebuild fails with
"No matching export for import ChatHeader", and the SPA keeps its previous
bundle — so the plugin looks installed and its route redirects to home. that
happened on fofos tonight and is what this release fixes.

the plan says explicitly not to restart officer-claude-code: the widened chat
credential lives there rather than in officer, and bouncing it ends every live
agent session including the one running the rollout. pending is the honest
report, not something to take.

edge stays excluded, unchanged and for unchanged reasons.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Officer-Session: 656f5c85-e49a-4f1f-b9f3-042a04b4d043

deploy/2026.08.26.01.md

@@ -0,0 +1,82 @@
+# 2026.08.26.01
+
+A plugin can own a chat — its own directory, its own brief, its own history — and a dead commander watcher
+wakes itself up.
+
+22 commits. **No schema change** and **no dependency change**: nothing under `src/databases/**/schema.ts`
+moved and `bun.lock` is untouched. **Do not run `bun install`.**
+
+`bun db:push` stays a step because it is cheap and proves the database agrees with the code, but **it must
+report no changes to the platform's own tables.** A host with the `proxy-manager` plugin installed will see
+that plugin's three tables created — that is the plugin, not this release, and it is expected.
+
+## Why this one matters more than its size suggests
+
+**`officerdev` gained an export that a shipped plugin already imports.** The `proxy-manager` plugin in the
+catalogue imports `ChatHeader` from `officerdev`, which exists only from `2ed47fa6` — after the last
+release. On a host running `2026.08.25.01` the plugin installs, its frontend rebuild fails with
+`No matching export … for import "ChatHeader"`, and the SPA silently keeps its previous bundle: the plugin
+appears installed and its route redirects to home.
+
+That is exactly what happened on `fofos` tonight. **So this release is what makes that plugin installable
+anywhere**, and any host that has already installed it is in the broken state until this lands.
+
+## What is in it
+
+- **A plugin can declare a chat context.** `ChatPanelWrapper` takes `chatContext`, so a plugin's chats run
+  in `$DATA_PATH/<email>/plugins/<appName>/chats` — resolved server-side, never a path from the client.
+  `plugins` joins `commanders` as a sibling of `home` that a member OWNS, or their turn dies on its own
+  working directory (the `general_chat_sessions` failure, third time).
+- **A plugin briefs its chats with a file.** `plugins/<name>/chat/CLAUDE.md` is copied into that directory
+  on every chat that starts there, replacing per-turn prompt prefixes.
+- **A plugin can list its own chats** — `/chat/sessions?context=plugin&contextId=<appName>`.
+- **Sonnet is the default when nobody chose.** Every surface without a picker was running Opus, because the
+  fallback was the bare harness and bare means "whatever the CLI picks". A stored bare harness is now read
+  as unset, which is what made the change appear to do nothing on machines that had one.
+- **A chat's API key follows its holder, minus `admin`** — was `notify` only. Note this takes effect in
+  `officer-claude-code`, NOT `officer`.
+- **A locked screen persists sizes, not structure.** A plugin or core screen changing its layout now
+  reaches people who have already opened it, and the `appTypes` repair can no longer be written back as
+  though the user had chosen it.
+- **A dead commander watcher wakes its commander**, and the guard that was silently disabling that is
+  fixed — it asked about background tasks when it meant "is the agent mid-turn", and a commander's watcher
+  is itself a background task.
+- Theme browser and Spotlight keybindings; two `todo/` entries; the CLAUDE.md touchpoints audit.
+
+## Every host
+
+1. `git fetch origin --tags` then `git merge --ff-only deploy/2026.08.26.01`
+2. `bun db:push` — expect **no changes** to platform tables. If it wants to alter one, stop and report it.
+3. `bun run plugins:update`
+4. `pm2 restart officer`
+
+**`macbookpro`:** append `/opt/homebrew/bin` to PATH for the `bun` commands, run `pm2` separately. Asleep
+is a skip with a note, not a failure.
+
+## `officer-claude-code` is NOT restarted by this, and that is deliberate
+
+One change in here — the widened chat credential — lives in the agent sidecar rather than in `officer`, so
+step 4 does not activate it. **Do not restart `officer-claude-code` as part of the rollout.** It ends every
+live agent session on that host, including any agent running the rollout itself, and it is the owner's call
+when to take that. Say in the report that it is pending; do not do it.
+
+## Hosts
+
+- **`officer-dev`** — skip it. Restarting `officer` there ends the rollout. It already has this code.
+- **`edge-pertento-bridge`** — skipped, unchanged from last release. It is 300+ commits behind with **no
+  `roles` table**, and a plain `db:push` there would create a foreign key onto an empty table. Its catch-up
+  is a by-hand job the owner is doing separately. Do not contact it.
+- **`alpha`**, **`fofos`**, **`production-pertento-bridge`**, **`deadpool-rezio-bridge`** — the targets.
+- **`macbookpro`** — a target if it is awake.
+
+## What to check, this release
+
+**On `fofos` specifically**, because it is the reason for the release: after step 4, `/proxy-manager` should
+render rather than redirecting to home, and the log should say `[plugins] frontend built` with no
+`rebuild failed` line after it. If it still redirects, the bundle is stale — hard refresh before concluding
+anything.
+
+Everywhere else: a chat should default to **sonnet** rather than opus or fable in the model picker. That is
+the most visible change and the easiest to confirm.
+
+No direct SQL is needed on any host, and none is authorised.