Sync the self-hosting stack

CHANGELOG.md

@@ -9,6 +9,33 @@ one of them changed. An entry says which artefact and which version, so `web 0.1
 Every version published to a channel appears here. Nothing is written from memory afterwards: a build
 cannot be published without its entry.
 
+## 2026-10-12 — An organization keeps its owner `api 0.139.1`
+
+**Deleting an account could leave an organization without an owner.** The Admin Center refuses to
+delete an account that is the only owner of an organization, and since `api 0.138.0` that check
+asked the old role word, which memberships stopped carrying when profiles replaced it. An owner made
+since then — a new organization's creator, or somebody given the Owner profile — was not an owner by
+that measure, so deleting them went through; a member moved off Owner since then still counted as a
+second one. It now asks the Owner profile, the same rule that already stops you removing or demoting
+an organization's last owner.
+
+Only an instance that followed the `dev` channel through `api 0.138.0` or `api 0.139.0` can have been
+affected, and only by an account deletion in that time. If you deleted one, open each organization
+it belonged to and check that somebody still holds Owner: a super-admin reaches every organization
+and can give the profile to one of its members.
+
+**Your Profile page names your profile in each organization again.** It printed "—" beside every one
+since `api 0.138.0`.
+
+**Worth knowing about `api 0.139.0`, which its entry did not say.** Seeing a machine became a right
+you can pose on a folder, so the access screens count it like the others: somebody who may only see
+a machine is listed among the people who reach it, with a "See assets" chip, and the machines
+figure on a person's access page counts it — the way the credentials figure always counted seeing a
+credential. Most profiles see every machine, so a machine's list names most of the organization
+until a line narrows who sees that branch.
+
+Update the API image. No web or agent update is required, and nothing in the schema changes.
+
 ## 2026-10-12 — You see the machines your access reaches `api 0.139.0` `web 0.169.0`
 
 **The machine list was the last place that still answered organization-wide.** Somebody whose only