# Company employee sessions and mobile logout

## Application changes

Notification read flags now use a device-local key scoped to the authenticated
user and selected company. They do not enter the company synchronization payload.
Older remote `sunReadNotificationsV1` values are preserved, not overwritten or
removed by an employee. Read-only sections are taken from the remote snapshot
instead of uploading bootstrap defaults or empty caches as staff changes. Order
reconciliation respects the existing create/edit/delete permissions separately.
The server still enforces all permissions; no role or membership is granted.

On mobile, the main header contains labelled Profile and Logout buttons with SVG
icons. Profile also has a sticky top Logout button, including while its detail RPC
is pending or unavailable. Logout uses the existing bounded local-device sign-out
and tenant-cache preservation. Late account/company replies cannot restore stale
profile or sidebar information.

## Database change — must be deployed separately

Apply `supabase/migrations/20260920104500_workspace_sidebar_brand.sql` to the
Caterium database. It adds a membership-checked, selected-workspace sidebar RPC.
An exclusive branding assignment is associated with its owner's company only
when that company is unambiguous. Multiple owned companies need an explicit
assignment by an authorized database administrator, never a guessed name match.
Active confirmed employees of the assigned company receive the Solnce sidebar.
The old owner-only RPC remains compatible with older clients.

Publishing application assets does NOT apply SQL migrations. Until the database
migration is applied, the client safely falls back to the old owner-only RPC;
this release must not be reported as fixing employee branding on that server.
No company catalog, order, client, membership, or production account is changed
by the migration. The separate ai-staff project is outside this change.

## Verification scope

Browser scenarios use synthetic company accounts and do not access production
business data. They cover an empty employee device, pre-existing baselines,
allowed order edits with forbidden UI preferences, record-level permissions,
personal notification isolation, selected-workspace branding, old-server
compatibility, late replies, and visible mobile logout with unavailable details.
The recovery database suite checks the new RPC against actual SQL permissions.

The reported employee's actual company membership is a separate diagnosis and
requires the exact new email and an authorized server/account read. Empty UI alone
is not evidence that company orders were deleted.