Sync the self-hosting stack

CHANGELOG.md

@@ -9,6 +9,55 @@ one of them changed. An entry says which artefact and which version, so `web 0.1
 Every version published to a channel appears here. Nothing is written from memory afterwards: a build
 cannot be published without its entry.
 
+## 2026-10-12 — One line answers who can do what, and where `api 0.138.0` `web 0.168.0`
+
+**Access needed two locks open at once, and only one of them was visible.** Giving somebody the
+terminal permission did nothing unless a grant reaching the machine also carried `terminal` — it was
+the documented behaviour, and it is the shape of "I gave them the right and it does not work". The
+two are now one. A shell, the remote screen, taking control of it, and revealing a credential are
+permissions like any other, and **a profile posed on a node** is the whole answer: who, which
+profile, posed where, what that confers there, and until when.
+
+- **A profile can be posed on an organization, a folder, a machine, a credential folder or a single
+  credential**, for a person or for a team. The most specific line that says anything still decides;
+  that part has not changed.
+- **Pages are offered on what you hold anywhere, objects answer on the descent.** Somebody whose only
+  line is on one folder is offered the pages that line reaches, and sees that folder in them.
+- **Taking the mouse and keyboard is a named right.** It was the one capability of the product that
+  could not be read in a role. Control without the screen is refused when the profile is written,
+  rather than quietly corrected afterwards.
+- **"Visible but not revealable"** is now the view right without the reveal right at that node, in the
+  vocabulary everything else uses, instead of a flag on a table of its own.
+- **The member list stops implying the profile is the whole answer**: a name carries "+2 exceptions",
+  which open the access page.
+- **Three rights say how far they reach, where you hand them out.** A shell is administrative and is
+  not bounded by the assistant's risk ceiling; the remote screen is the whole screen on every monitor
+  the machine has, narrowable only by which machines; control is not watching.
+
+**What the assistant may do in your name is a separate question with its own name.** Connector
+domains, the risk ceiling, autonomy and the unbounded flag are the **assistant ceiling** — the same
+layering and the same places to write it, but no longer sharing a row with what a person may do, and
+the screens say which of the two they are about.
+
+**The Admin Center is an app with its own rail.** Inside it the sidebar lists its own pages instead of
+the RMM's, the top bar stops naming a customer where the scope is the whole instance, and the page
+title and the breadcrumb name the page you are on. On a phone the drawer follows.
+
+Update the API and the web image. No agent update is required. The API applies an **additive** schema
+update — profiles, authorizations, and a column on each membership — and then translates what you
+already have: each role becomes a profile, each grant and each credential row becomes an authorization
+or an assistant ceiling, and a profile it has to invent is named as a sentence, "Terminal only
+(migrated)", rather than as a combination. It is idempotent and reports what it moved.
+
+Two things are worth knowing about that translation. **A team holding both a machine grant and a
+credential grant organization-wide, with different expiry dates, cannot become one line**: the row
+written first stays, the other is named in the log with both dates and left for you to pose by hand,
+because choosing for you would either revoke an access somebody still has or extend one whose end
+somebody wrote on purpose. The count is reported at the end of the run. And **nothing is dropped
+here**: the old columns and the vault grant table are still present, no longer read and no longer
+written. A later release removes them in one go and will ask for `SCHEMA_ACCEPT_DATA_LOSS=true` for
+that one run — announced here when it comes.
+
 ## 2026-10-10 — Rights you can read, and an Admin Center that means one scope `api 0.137.0` `web 0.167.0`
 
 **Settings meant three different scopes at once** — your own account, the customer selected in the top