platform/deploy/2026.08.23.01.md

2026.08.23.01

The commander creation flow, rebuilt end to end — named, given a directory, and started by a button that makes it interview you rather than waiting for a prompt somebody else wrote. Plus the delete path that actually removes one, /minesweeper, and docs:check guarding the documentation's checkable claims.

SCHEMA CHANGE. bun db:push is a step. command_hq_spawned is new and command_hq_sessions gains name. Without the push, Command HQ fails on a missing column the first time it lists a commander.

No dependency change — bun.lock is untouched across deploy/2026.08.22.02..HEAD. package.json moved only to add engines.bun and two scripts. Do not run bun install.

What is in it

• A commander is created, not configured. Name it, choose its working directory, press Start. It reads the directory, works out whether the job is already written down there, and either reads its understanding back for confirmation or asks what it should be watching. The name is the brief — it is the only thing the owner says before anything else, and it now reaches the model instead of only titling the transcript.
• command_hq_sessions.name — the platform owns the name. It was only ever in the transcript's summary record, which the harness cannot write until the first turn ends, so the list showed the opening brief while the header showed the real name.
• Deleting a commander removes it. Four defects, each of which left something behind: the session kill ran in the wrong process and always failed; the transcript was deleted while the harness was still writing it, so it came straight back as an untitled chat; chat_session_events is keyed on officer's session key while everything else uses the transcript id, so its rows were never matched; and the key was resolved from an in-memory map that is empty for anything older than the process. The event rows carry both ids, so they are asked when the maps cannot answer.
• GET /chat/live?kind= — agent (the default), commander, or all, with counts always describing the whole set. Defaulting to agents means a client that forgets cannot be handed a commander; the web list asks for all explicitly.
• A dropped sidecar command says so. sendFire did nothing when no sidecar was registered — no log, no error — so answering a question during the reconnect window after a restart vanished and the card span forever. Question answers and plan decisions now report it.
• /minesweeper — a wine session streamed to the browser over RFB. The session is not running on officer-dev, so the route renders its "not running" state with a Start button. That is expected.
• Usage limits are read live. limitsCache was keyed on nothing, so switching Anthropic account showed the previous account's percentages under the new name. The cache remains for the failure path only, keyed per account.
• bun docs:check compares documented claims against values derived at run time — the permission count, the PM2 entry count, the generated platform skill. It found both claims it was written to check already wrong. Required before tagging a release.
• Empty transcripts no longer list. A file holding only harness metadata and no turns is not a conversation; four had accumulated as "(untitled) · 0 msgs".
• Bun is held at the 1.3 series — engines.bun and BUN_SERIES move together. Do not run bun upgrade on a host.

Every host

1. git pull --ff-only
2. bun db:push — new this release
3. bun run plugins:update
4. pm2 restart officer

officer only. Step 3 restarts each plugin's own sidecar; that is the script's behaviour and belongs in the report rather than being omitted.

macbookpro: append /opt/homebrew/bin to PATH for the bun commands, run pm2 separately. See docs/servers.md.

officer-dev — skip it

This is the machine the rollout runs from, and restarting officer here ends the agent performing it. Name it as skipped in the report. It is already current.