Sync the self-hosting stack

CHANGELOG.md

@@ -9,6 +9,27 @@ one of them changed. An entry says which artefact and which version, so `web 0.1
 Every version published to a channel appears here. Nothing is written from memory afterwards: a build
 cannot be published without its entry.
 
+## 2026-10-07 — Consent profiles for workstations, infrastructure and shared servers `api 0.120.0` `web 0.148.0` `agent 0.32.0`
+
+Choose a remote-desktop access profile by how a machine is used, independently of its Windows
+edition. The organization supplies the default; an administrator can override it per machine.
+Existing consent settings stay in force until a profile is chosen.
+
+**User workstation** asks before sharing an occupied user session. **Infrastructure server** opens
+administrative access immediately with the visible notice. **Shared server / RDS** separates
+**Administer the server** from **Assist a user**: direct administration targets the empty console
+or an explicitly authorized Windows account; assisting an occupied session asks for its consent.
+The connection screen names the target account and explains whether approval is needed.
+
+The agent checks the current Windows account and logon before capture and input, so a session
+identifier reused by another user cannot inherit an earlier agreement. After a technical connection
+loss, the same operator may reuse acknowledged user consent for up to 60 seconds, for the same
+Windows logon and unchanged policy. An explicit close, a different account or an expired agreement
+requires a fresh decision. Access and consent provenance remain recorded.
+
+Update the API, web console and agent release image. The API applies an additive schema update;
+existing policies and records are preserved. Configured profiles require agent 0.32.0 or later.
+
 ## 2026-10-07 — Accurate remote-desktop consent status and countdown `api 0.119.2` `agent 0.31.3`
 
 While remote-desktop permission is waiting for an answer, Windows shows only the consent prompt.

README.md

@@ -434,12 +434,11 @@ Four things worth knowing about it:
   never the audit entry.
 - **It carries a remote desktop, on Windows.** The same permission model, one level up: a person
   with the right watches the signed-in session's screen from the browser. **Nobody is ever watched
-  invisibly.** Each organization picks one of two policies under **Settings → Organization → Remote
-  desktop** — a banner that stands on the screen for the whole session, or a prompt the person must
-  answer before anything is captured, which auto-accepts only when nobody is signed in. There is no
-  third option and no way to turn the notice off, which is the one decision in this feature that is
-  not configurable. The session ends the moment the banner cannot be kept visible. Nothing of the
-  screen is stored: there is no recording, no thumbnail and no still, so the audit entry is the
+  invisibly.** Each organization chooses its access policy under **Settings → Organization → Remote
+  desktop** — its existing banner/prompt policy, or an access profile suited to workstations,
+  infrastructure and shared servers. Every path keeps a visible notice once access is active;
+  a pending consent request shows its prompt first. The session ends if the notice cannot be kept
+  visible. Nothing of the screen is stored: there is no recording, no thumbnail and no still, so the audit entry is the
   whole of the trail. Linux and macOS are not supported yet, and a session opened against one is
   refused rather than silently downgraded.
 
@@ -459,13 +458,25 @@ ever opened by the assistant — a person opens them. Decide who holds those bef
 you care about. The desktop has one protection the shell does not, and it is not a permission: the
 person sitting at the machine is told, every time, for as long as it lasts.
 
-**Being told is not the same as being able to stop it, and the difference matters.** The notice is
-click-through on purpose — it takes no click, it has no menu and it has no keyboard — so that it can
-never sit between somebody and the work they are doing, and so that it cannot be closed by accident
-or by a script. The cost of that choice is that the person at the keyboard cannot dismiss the viewer
-from the notice itself. Their ways out are elsewhere: refusing the prompt under the ask policy,
-before anything is captured; signing out, which ends the session with it; or an administrator
-turning the feature off for the instance. What the banner guarantees is that watching is never
+**Consent profiles.** An administrator can choose a default under **Settings → Remote desktop**
+and a machine exception from **Agents → Access profile**. Profiles describe the machine's use,
+independently of its Windows edition: a workstation asks its signed-in user; an infrastructure
+server allows administration with the visible notice; a shared server separates administration
+from user assistance. Shared-server administrative accounts must be exact `DOMAIN\account` or
+`MACHINE\account` identities. User assistance always asks before sharing an occupied session.
+The connection screen names the selected session and explains whether approval is needed.
+Suggestions based on the Windows edition or remote sessions never apply a profile automatically.
+
+Existing consent settings remain active until a profile is chosen. Profiles require an agent that
+announces support for them; older agents remain usable with existing policies and are asked to
+update before applying an explicit profile. A brief technical reconnect can reuse acknowledged
+consent for 60 seconds, bound to the same operator, Windows logon and policy. Closing explicitly
+or changing the user requires a fresh decision. Both paths keep the visible notice and audit trail.
+
+**The visible notice stays for the session.** It can be dragged on its screen without taking
+keyboard focus and has no dismiss control. The person at the keyboard can refuse a pending prompt
+before anything is captured. An administrator can turn remote desktop off for the instance,
+which ends active sessions. What the banner guarantees is that watching is never
 secret. It does not guarantee consent once it has started, and under the banner policy it is not
 asking for any.