Sync the self-hosting stack

CHANGELOG.md

@@ -9,6 +9,30 @@ one of them changed. An entry says which artefact and which version, so `web 0.1
 Every version published to a channel appears here. Nothing is written from memory afterwards: a build
 cannot be published without its entry.
 
+## 2026-10-13 — Each scope where it belongs `api 0.143.0` `web 0.173.0`
+
+**The Admin Center reads as two scopes.** Its rail has two titled groups: **Instance** — Licence,
+Settings, Users, Statistics and the Instance log — and **Organizations** — the organizations, and
+the roles their people hold.
+
+- **Two kinds of role, each beside what it is given to.** Admin roles, which say what an account may
+  administer on this instance, are a tab of **Users**. What a person may do in an organization was
+  called a profile; it is an **organization role** everywhere now, under **Organizations →
+  Organization roles**.
+- **An organization's conversations and audit log are in its own page**, for whoever may read its
+  audit log. Every conversation is listed, private ones included; opening one you take no part in is
+  still recorded. The list of every organization's conversations at once is gone, and so is the
+  admin role right that opened it — a role that held it keeps its other rights.
+- **The Instance log holds what was done to the instance itself**: its licence, settings, accounts
+  and roles. What was done in an organization is in that organization's log.
+- **The user directory says who each account works for** — the organization Quick Assist acts on
+  behalf of.
+- **Old links keep working**: the former roles, profiles and conversations addresses land on their
+  new place.
+
+Update the API and web images together. No agent update is required, and nothing in the schema
+changes.
+
 ## 2026-10-13 — The access of an object, on the object `web 0.172.0`
 
 **Who reaches a machine, a folder or a credential — and changing it — where it is.** A machine's