Changeset 0.24.3 (#159)

docs/DESIGN-0.24.0.md

@@ -663,7 +663,7 @@ separate table. This avoids a join-heavy permission resolution
 path and keeps the grant model simple.
 
 ```sql
--- 019_v024_permissions.sql
+-- 020_permissions.sql
 
 ALTER TABLE groups
     ADD COLUMN IF NOT EXISTS permissions JSONB NOT NULL DEFAULT '[]'::jsonb;
@@ -895,10 +895,10 @@ type SessionParticipant struct {
 }
 ```
 
-### Migration 020
+### Migration 021
 
 ```sql
--- 020_v024_sessions.sql
+-- 021_sessions.sql
 
 CREATE TABLE IF NOT EXISTS session_participants (
     id            TEXT PRIMARY KEY DEFAULT gen_random_uuid()::text,
@@ -1054,7 +1054,7 @@ session participant activity attributed to the session identity:
 
 ### What Ships
 
-- Migration 020 (session_participants table)
+- Migration 021 (session_participants table, channels.allow_anonymous)
 - `server/auth/session.go` (session creation/resume)
 - `middleware/session_auth.go` (AuthOrSession)
 - Session-scoped message and completion handlers
@@ -1092,11 +1092,12 @@ Each subversion is independently testable:
 
 ```
 018_v024_auth.sql          — users.handle, auth_source, external_id
-019_v024_permissions.sql   — groups.permissions, token_budget, allowed_models
-020_v024_sessions.sql      — session_participants table
+019_v024_oidc.sql          — oidc_auth_state, groups.source
+020_permissions.sql        — groups.permissions, token_budget, allowed_models, Everyone group
+021_sessions.sql           — session_participants table, channels.allow_anonymous
 ```
 
-All three are additive (new columns, new tables). No destructive
+All four are additive (new columns, new tables). No destructive
 changes. Can be applied sequentially as each subversion merges.
 SQLite equivalents for each.