Sync the self-hosting stack

CHANGELOG.md

@@ -9,6 +9,34 @@ one of them changed. An entry says which artefact and which version, so `web 0.1
 Every version published to a channel appears here. Nothing is written from memory afterwards: a build
 cannot be published without its entry.
 
+## 2026-10-26 — Scheduled scripts `api 2.3.0` `web 2.3.0`
+
+**A script can run on a schedule.** In Scripts, a new Schedules tab lists them, and the run dialog's
+last step offers *Now* or *Schedule*: once at a date and time, or every hour, day, week or month, or
+by a cron expression, in a time zone you pick. The form shows the next fires in that zone, and
+refuses a schedule that would fire more often than every 15 minutes. Changes of clock time are
+followed: a 02:00 schedule in Europe/Luxembourg fires at 02:00 local time all year.
+
+**A schedule keeps its version and finds its machines each time.** It runs the script version it was
+saved with; when a newer one is published, the schedule offers to move to it. The machines are
+worked out again at every fire, as its owner sees them, so a machine added to a folder is included
+the next night. A machine still waiting from the previous fire, offline for instance, is given up
+when the next fire comes and queued by it instead.
+
+**A schedule says when it could not run.** A fire more than an hour late is skipped rather than run at
+the wrong time. A fire that cannot start — its owner no longer allowed, its version gone, a secret its
+owner can no longer use — is skipped and counted; three in a row pause the schedule. Retiring the
+version a schedule uses pauses it. Each of these sends its owner a notice in the bell. While scripts
+are switched off for the platform, fires are skipped and the schedule stays as it is.
+
+**Its owner runs it; others can stop it.** A schedule can be edited, resumed or run now by its owner,
+and paused or deleted by its owner, an auditor of the organization or a super-admin. Each change is in
+the audit log. Scheduled runs appear in the runs history beside the others. They run as SYSTEM or
+root, like every script for now; a second person's approval of a schedule comes in a later version.
+
+Update the web image first, or both images at once. The database does not change, and no agent
+update is required beyond 0.53.0.
+
 ## 2026-10-26 — The licence is a tab of Settings `web 2.2.2`
 
 **The Admin Center's rail is shorter.** The licence is now the first tab of Settings, and its own entry is gone;