Sync the self-hosting stack

CHANGELOG.md

@@ -9,6 +9,32 @@ one of them changed. An entry says which artefact and which version, so `web 0.1
 Every version published to a channel appears here. Nothing is written from memory afterwards: a build
 cannot be published without its entry.
 
+## 2026-08-25 — A terminal goes over a route you choose `api 0.91.0` `web 0.118.0`
+
+**Opening a shell used to mean opening it through the Jarvis agent, from the Agents page.** A Linux
+host commonly answers on OpenSSH _and_ through an enrolled agent, and those are different networks,
+different credentials and different accounts at the other end — so which one your shell goes over is
+a decision. Until now it was made for you by whichever was available.
+
+You can now open a terminal from the **Assets** list as well, and pick the route by name. A machine
+with one way in opens straight away; one with several offers an entry per route. The choice is made
+before the shell opens, and it is recorded — on the session, in the audit trail, and in
+**Settings → Organization → Terminal sessions**, which now shows which route each session used.
+
+**SSH sessions are held to exactly the same rules as agent ones.** The same idle timeout, the same
+four-hour ceiling, the same output limit, the same recording under `VAULT_MASTER_KEY` and the same
+retention policy. A different route is not a different set of rules.
+
+**What decides who may do this has not changed.** The per-machine "may open a terminal" permission is
+the same one, and it still has no bearing on what the assistant may do on those machines. What it
+now permits is a shell by any route that machine has, and the access editor says so where you grant
+it.
+
+### Fixed
+
+- The agents list offered a terminal on a machine whose agent had no route recorded, which could
+  never open. It now says why instead.
+
 ## 2026-08-25 — Settled approval requests fold away `web 0.117.0`
 
 **A conversation with several approvals behind it was a wall of text.** Each settled request kept its

README.md

@@ -63,6 +63,12 @@ answers on OpenSSH *and* through an enrolled agent; a Proxmox node has a cluster
 agent. Each route carries its own address, its own credentials and its own health — so a vendor API
 that stops answering no longer makes a device unmanageable while its console is up.
 
+**And a terminal goes over a route you choose.** On a host reachable both ways, opening a shell asks
+which — its agent, or an SSH connection — because those are different networks, different credentials
+and different accounts on the far end. The choice is made before the shell opens, it is recorded on
+the session and in the audit trail, and every route is held to the same limits: the same idle and
+duration ceilings, the same recording, the same retention policy.
+
 **Documents.** A conversation accumulates what the assistant writes: reports and runbooks in
 Markdown, diagrams in Mermaid, tabular data as a workbook. What it writes is always a *source*, and
 Jarvis renders the file on download — PDF and Word from prose, Excel and CSV from a workbook, HTML