memhouse 0.17.0 → 0.18.1

package/memhouse/house/house.js

@@ -1,9 +1,8 @@
 // The house.
 //
-// A house is a ClickHouse DATABASE — any database, named whatever its people name it
-// (`polat`, `team_a`, even `default`). Its rooms are three plain tables: `sessions`,
-// `messages`, `tool_calls`. Everyone in the house writes into the SAME tables, each with
-// their own credential, and two columns say who and where every row came from:
+// A house is a ClickHouse DATABASE, `mem` by default. Its rooms are tables — `sessions`,
+// `messages`, `tool_calls` — one set per member, named for them, and two columns say who
+// and where every row came from:
 //
 //   user_id  String MATERIALIZED currentUser()   — stamped by the server, unforgeable by
 //                                                  clients (async_insert is pinned to 0
@@ -12,19 +11,30 @@
 //   host     LowCardinality(String)              — the machine's fingerprint, minted once
 //                                                  per install (../host.js)
 //
-// That pair IS the provenance model. Alice and Bob point their shippers at `team_a` and
-// both write; `WHERE user_id = 'alice'` is one person, `WHERE host = '…'` is one machine.
-// The model is collaborative — housemates trust each other with the house — and the
-// boundary between houses is the database: joining someone's ClickHouse takes a database
-// and a credential (`GRANT ALL ON team_a.* TO alice`), nothing else, because ALL on your
-// own database reaches nothing outside it.
+// That pair IS the provenance model.
 //
-// THIS REPLACES THE PER-MEMBER LAYOUT. Rooms were `sessions_<member>` with per-member
-// grants, Merge rooms for team reads, and isolation between members of one database.
-// All of it is gone: suffixed names made every client resolve its room names first (and
-// `FROM messages` a documented trap), the Merge rooms existed only to undo the
-// splitting, and per-member isolation inside a shared house solved an adversarial
-// problem the product does not have. Separate houses isolate; one house shares.
+// ONE LAYOUT. A house is a database — `mem` unless somebody has a reason — and every
+// member's rooms in it carry the member's name: `mem.alice_messages`, `mem.polat_messages`.
+// A member holds one grant, on the wildcard `mem.<name>_*`, and nothing else in the
+// database. That is the whole access model, and roomNames() below is the only place a
+// table name is produced.
+//
+//   alone on a laptop        mem.polat_*            a house of one
+//   a team on one server     mem.polat_*, mem.alice_*
+//   an agency on a kernel    the same, in the kernel's `mem`
+//
+// Nobody ever holds ALL ON <db>.*. That grant is dynamic — it covers rooms created later —
+// and it is what turned two members in one database into a leak: either could read and
+// re-grant the other's transcripts, measured. The wildcard reaches nothing outside the
+// member's own name: measured, a member cannot create, read, list or re-grant a
+// housemate's rooms, and can read their own grant back with SHOW GRANTS in one line.
+//
+// THIS FILE HAS SAID THREE OTHER THINGS. Shared tables with row policies (0.4.0: policies
+// are permissive and OR'd, a catch-all fails open). Suffixed per-member rooms with Merge
+// rooms over them (0.8.0: removed because clients had to resolve names first and
+// isolation "solved a problem the product did not have" — the second half was wrong).
+// Then a house per member with `ALL ON db.*`, plus a prefixed variant beside it, plus the
+// machinery to keep the two from meeting. All three were special cases of this one.
 //
 // `sessions_v` IS A SAVED QUERY, NOT AN OBJECT — substituted into the same `FROM … AS c`
 // position a view name would occupy, running under the caller's own credential. It was
@@ -38,7 +48,11 @@ const ROOM_TYPES = ['sessions', 'messages', 'tool_calls'];
  * them, the shipper's guards do not require them, and a member who cannot create them
  * still ships normally.
  */
-const META_TYPES = ['house_meta', 'house_events'];
+// `<member>_meta` / `<member>_events` since the one-layout: every row in them is about ONE
+// member (their schema version, their machines, their last ship, their shares), so the old
+// `house_` prefix named the wrong unit. A pre-one-layout house still has `house_meta` /
+// `house_events`; the shipper's legacy guard names the rename.
+const META_TYPES = ['meta', 'events'];
 
 /**
  * What generation of the schema a house is at. Bumped only when existing rooms have to be
@@ -75,7 +89,7 @@ const SUPPORTED_SCHEMAS = [2];
 
 /**
  * The floor a house may set under its writers, recorded by `memhouse migrate` in
- * house_meta['min_writer_schema']. Today it equals SCHEMA_VERSION; a future
+ * meta['min_writer_schema']. Today it equals SCHEMA_VERSION; a future
  * back-compatible generation can hold it one step lower for a grace window.
  */
 const MIN_WRITER_SCHEMA = 2;
@@ -233,15 +247,19 @@ const ROOM_MATERIALIZED = {
   tool_calls: ['user_id'],
 };
 
-function currentParse(table, epochSource = table) {
+function currentParse(table, epochSource = table, physical = null) {
+  // `table` names the ROOM (for the materialized-column lookup); `physical` is what goes
+  // into the FROM, which differs whenever a prefix is in play.
   const extra = (ROOM_MATERIALIZED[table] || ['user_id']).join(', ');
+  const from = physical || table;
+  const epochFrom = physical ? physical.replace(new RegExp(`${table}$`), epochSource) : epochSource;
   return `(
     SELECT *, ${extra}
-    FROM ${table} FINAL
+    FROM ${from} FINAL
     WHERE origin != 'ship'
        OR (session_id, user_id, epoch) IN (
             SELECT session_id, user_id, max(epoch)
-            FROM ${epochSource}
+            FROM ${epochFrom}
             WHERE origin = 'ship'
             GROUP BY session_id, user_id)
   )`;
@@ -302,24 +320,54 @@ const READ_SETTINGS = { final: 1, join_use_nulls: 1 };
  * name it produces. See ship.js's delete, which must BIND the user rather than call
  * currentUser() inside a mutation, where it is not evaluated in the caller's context.
  */
+/**
+ * The table a room type lands in. THE naming rule, and the only copy of it.
+ *
+ * ONE LAYOUT. Every member's rooms carry the member's own name: `mem.alice_messages`,
+ * and `mem.polat_messages` even when polat is the only one in there. A house with one
+ * member is a house of one, not a different kind of house — so there is no second case
+ * here, no prefix to configure, and nothing for an invite file to carry.
+ *
+ * Depends on nothing but the member, so a caller holding only a config can name a table
+ * without a server round-trip. That matters: when the rule lived only inside roomNames(),
+ * callers that could not afford `SELECT currentUser()` spelled tables by hand instead —
+ * eight of them, all swallowing the error — and a house silently had no metadata plane.
+ */
+function physicalRoom(type, user) {
+  if (!user) throw new Error(`physicalRoom(${type}): a room belongs to a member, and none was given`);
+  return `${user}_${type}`;
+}
+
+/** The wildcard every grant to a member is scoped to: `<member>_*`. */
+function roomPattern(user) {
+  if (!user) throw new Error('roomPattern: a member is required');
+  return `${user}_*`;
+}
+
 function roomNames(user) {
-  const out = { member: user, user };
+  if (!user) throw new Error('roomNames: a member is required');
+  const out = { member: user, user, pattern: roomPattern(user) };
+  // Every room name in the codebase comes from physicalRoom() above — through this
+  // function where a caller has the rooms, directly where it has only a member name.
+  const phys = (t) => physicalRoom(t, user);
+  out.physical = {};
+  for (const t of [...ROOM_TYPES, ...META_TYPES]) out.physical[t] = phys(t);
   // The raw table names — for INSERT, for DDL, and for the shipper's own bookkeeping
   // reads, which have to see every epoch to decide which one to write next.
-  for (const t of ROOM_TYPES) out[`${t}_raw`] = t;
+  for (const t of ROOM_TYPES) out[`${t}_raw`] = phys(t);
   // What everything else gets. `sessions` is unfiltered: it is one metadata row per
   // session by construction, latest-wins, and carries no epoch anyone may read.
-  out.sessions = 'sessions';
-  out.messages = currentParse('messages');
+  out.sessions = phys('sessions');
+  out.messages = currentParse('messages', 'messages', phys('messages'));
   // tool_calls takes its epoch from MESSAGES, not from itself. A parse that produces
   // messages but NO tool calls is ordinary — a compaction can remove every assistant turn
   // that called something — and it writes zero rows into this room at the new epoch. Asked
   // for its own max(epoch), the room would answer with the SUPERSEDED epoch and serve the
   // old parse's tool calls beside the new parse's messages. Both rooms are written by the
   // same pass at the same epoch, so messages is the authority for both.
-  out.tool_calls = currentParse('tool_calls', 'messages');
+  out.tool_calls = currentParse('tool_calls', 'messages', phys('tool_calls'));
   // The house's own record of itself — plain names, nothing to filter.
-  for (const t of META_TYPES) { out[t] = t; out[`${t}_raw`] = t; }
+  for (const t of META_TYPES) { out[t] = phys(t); out[`${t}_raw`] = phys(t); }
   out.sessions_v = sessionsRollup(out);
   return out;
 }
@@ -337,7 +385,42 @@ async function resolveRooms(client) {
   return roomNames(await currentUser(client));
 }
 
+/**
+ * The text-index DDL for servers before the tokenizer grammar changed. 25.8 spells a
+ * tokenizer as a quoted name with options — `text(tokenizer = 'ngram', ngram_size = 3)`,
+ * `text(tokenizer = 'default')` — and rejects the function form with "Expected literal";
+ * 26.x spells it as a function — `ngrams(3)`, `splitByNonAlpha` — and rejects the quoted
+ * names as "Unknown tokenizer". Neither parses the other. The template carries the
+ * current grammar; this rewrites a statement to the older one when a server refuses it.
+ * `default` in the old grammar is the non-alphanumeric splitter, which is what
+ * `splitByNonAlpha` names in the new one, so the indexes built are the same.
+ */
+function legacyTextIndexDialect(sql) {
+  return sql
+    .replace(/TYPE text\(tokenizer = ngrams\((\d+)\)\)/g, "TYPE text(tokenizer = 'ngram', ngram_size = $1)")
+    .replace(/TYPE text\(tokenizer = splitByNonAlpha\)/g, "TYPE text(tokenizer = 'default')");
+}
+
+/**
+ * Which text-index grammar a server speaks, from `SELECT version()`. Measured on real
+ * builds: 25.8 and 25.9 want the quoted-name form, 25.10 onwards the function form, and
+ * each rejects the other. Anything unparseable is treated as current; the shipper still
+ * falls back on a grammar refusal, so a wrong guess costs one round-trip, not the install.
+ */
+function textIndexDialectFor(version) {
+  const m = /^(\d+)\.(\d+)/.exec(String(version || '').trim());
+  if (!m) return 'modern';
+  const major = Number(m[1]); const minor = Number(m[2]);
+  return (major < 25 || (major === 25 && minor < 10)) ? 'legacy' : 'modern';
+}
+
+/** True when a server's refusal is the grammar, not a privilege or a real mistake. */
+function isTextIndexGrammarRefusal(message) {
+  return /Expected literal|supports only 'default'|Unknown tokenizer/.test(String(message || ''));
+}
+
 module.exports = {
+  physicalRoom, roomPattern, legacyTextIndexDialect, isTextIndexGrammarRefusal, textIndexDialectFor,
   ROOM_TYPES, META_TYPES, SCHEMA_VERSION, SUPPORTED_SCHEMAS, MIN_WRITER_SCHEMA,
   MIGRATIONS, ROOM_KEYS, keyProblem,
   READ_SETTINGS, MEMBER_PIN,

package/memhouse/house/migrate.js

@@ -39,8 +39,8 @@
 //   the old table until the rename; a late-writes pass copies anything newer than the
 //   snapshot, and ReplacingMergeTree makes that idempotent.
 //
-//   EVERYTHING IS RECORDED. One house_events pending row before work, applied/failed
-//   after, per object; schema_version in house_meta only after a migration completes.
+//   EVERYTHING IS RECORDED. One events pending row before work, applied/failed
+//   after, per object; schema_version in meta only after a migration completes.
 
 const fs = require('fs');
 const path = require('path');
@@ -59,7 +59,7 @@ const { ROOM_TYPES, keyProblem, createStatement } = require('./house');
  *   toVersion  the SCHEMA_VERSION a house is at once this has run
  *   detect(q, ctx)        -> what still needs doing (any truthy non-empty value), or
  *                            null/[] when the house is already past this migration.
- *                            THE ROOMS ARE THE TRUTH, never house_meta: a hand-migrated
+ *                            THE ROOMS ARE THE TRUTH, never meta: a hand-migrated
  *                            house has no record, and a restored backup can carry a
  *                            record newer than its tables.
  *   plan(found)           -> lines of human text for the confirm prompt
@@ -81,7 +81,7 @@ function listMigrations() {
   const seen = new Set();
   let lastVersion = 0;
   for (const m of out) {
-    // The id is spliced into SQL (house_events predicates) and into kept-table suffixes.
+    // The id is spliced into SQL (events predicates) and into kept-table suffixes.
     // It is repo-controlled, but "repo-controlled" is one compromised dependency away
     // from "attacker-controlled" — validate like any other identifier.
     if (!/^[a-z0-9][a-z0-9-]*$/.test(m.id)) throw new Error(`migration id '${m.id}' must match [a-z0-9-]+`);
@@ -116,7 +116,7 @@ async function detectPending(q, ctx, { component = null } = {}) {
  * Refuse when another actor's run is unfinished. An `applied` newer than the last
  * `pending` means done; a dangling `pending` means someone is (or was) mid-copy, and two
  * concurrent rebuilds of one room end with one of them renaming the other's work.
- * Best-effort: a house without house_events cannot answer, and that is not a reason to
+ * Best-effort: a house without events cannot answer, and that is not a reason to
  * block the migration that will create it.
  */
 async function unfinishedBy(q, ctx, migrationId) {
@@ -124,7 +124,8 @@ async function unfinishedBy(q, ctx, migrationId) {
     const rows = await q.rows(
       `SELECT argMax(status, event_at) AS status, argMax(actor, event_at) AS actor,
               formatDateTime(max(event_at), '%Y-%m-%d %H:%i') AS at
-       FROM house_events WHERE kind = 'migration' AND id = '${migrationId}'`);
+       FROM ${(ctx.rooms && ctx.rooms.physical && ctx.rooms.physical.events) || 'events'}
+       WHERE kind = 'migration' AND id = '${migrationId}'`);
     const r = rows[0];
     if (r && r.status === 'pending' && r.actor && r.actor !== ctx.member) return r;
   } catch { /* no events table yet */ }

package/memhouse/house/relocate.js

@@ -12,8 +12,8 @@
 // not insertable even with insert_allow_materialized_columns.
 const DERIVED = ['text_ngram', 'text_word'];
 
-// house_meta keys that are DURABLE facts of the house — worth carrying to the new host.
-// Everything else in house_meta is a per-host heartbeat (client_version, client_schema,
+// meta keys that are DURABLE facts of the house — worth carrying to the new host.
+// Everything else in meta is a per-host heartbeat (client_version, client_schema,
 // last_ship:<writer>) that the new shipper rewrites for itself on its first run; carrying
 // a stale one would misreport which machine last shipped until that run lands.
 function isDurableMetaKey(key) {

package/memhouse/house/schema.sql.tpl

@@ -154,10 +154,10 @@ ORDER BY (session_id, user_id, origin, epoch, idx);
 -- authoritative and always current, and a mirror of them would be a second truth that
 -- goes stale. What is recorded is what those cannot say: intent, sequence, outcome.
 
-CREATE TABLE IF NOT EXISTS house_meta
+CREATE TABLE IF NOT EXISTS meta
 (
     -- House-wide keys only ('schema_version', 'house_created_at'). Anything per-member
-    -- or per-machine belongs in house_events, which is append-only — this room is
+    -- or per-machine belongs in events, which is append-only — this room is
     -- latest-wins, so two members writing one key would overwrite each other.
     key String,
     value String,
@@ -168,7 +168,7 @@ CREATE TABLE IF NOT EXISTS house_meta
 ENGINE = ReplacingMergeTree(updated_at)
 ORDER BY (key);
 
-CREATE TABLE IF NOT EXISTS house_events
+CREATE TABLE IF NOT EXISTS events
 (
     event_at DateTime64(3, 'UTC') DEFAULT now64(3),
     -- 'migration' — a room rebuild, one row per transition (pending → applied|failed)

package/memhouse/invitefile.js

@@ -0,0 +1,38 @@
+// An invite file found where the invitee is standing.
+//
+// The guide says "from the directory holding the file, run memhouse install --env <file>".
+// A person who just downloaded `invite-alice.env` and typed `memhouse` should not be shown
+// the help screen; they should be asked whether to join. This module finds candidate files
+// and reads what they promise; the CLI decides whether to ask, and install does the work.
+// Nothing here prints a value from the file — the URL, user and database are safe to show,
+// the password never is.
+
+const fs = require('fs');
+const path = require('path');
+const envfile = require('./envfile');
+
+const REQUIRED = ['MEMHOUSE_URL', 'MEMHOUSE_USER', 'MEMHOUSE_PASSWORD', 'MEMHOUSE_DB'];
+
+/** `invite-<name>.env` files in the given directories, first directory first. */
+function findInvites(dirs) {
+  const out = [];
+  for (const dir of dirs) {
+    let names = [];
+    try { names = fs.readdirSync(dir); } catch { continue; }
+    for (const n of names.sort()) if (/^invite-[A-Za-z0-9_]+\.env$/.test(n)) out.push({ file: path.join(dir, n), dir });
+  }
+  return out;
+}
+
+/** What the file promises, without the secret. */
+function describeInvite(text) {
+  const parsed = envfile.parse(String(text || ''));
+  const missing = REQUIRED.filter((k) => !parsed[k]);
+  return {
+    user: parsed.MEMHOUSE_USER || null, url: parsed.MEMHOUSE_URL || null, db: parsed.MEMHOUSE_DB || null,
+    channel: parsed.MEMHOUSE_CHANNEL || null, isInvite: parsed.MEMHOUSE_INVITE === '1',
+    complete: missing.length === 0, missing,
+  };
+}
+
+module.exports = { findInvites, describeInvite, REQUIRED };

package/memhouse/provision.js

@@ -0,0 +1,100 @@
+// Provisioning a member — THE plan, whether memhouse executes it or a DBA does.
+//
+// There used to be three copies of this: the live path (adminBootstrap), the printed one
+// (--print-sql), and install --admin-user. They drifted, and the printed copy handed a
+// non-admin the one configuration the live path refuses — found in a drill, not by a
+// test. A plan that is data cannot drift from itself: the live path executes it,
+// --print-sql prints it, and the unit tests assert on it.
+//
+// The plan is a member and a database, and its centre is one statement:
+//
+//   GRANT <room privileges> ON <db>.<member>_* TO <member> WITH GRANT OPTION
+//
+// A wildcard on the member's own name. It covers rooms that do not exist yet, so the
+// member's shipper creates their rooms itself, a schema rebuild can CREATE and EXCHANGE
+// inside the pattern, and a share can name the whole set or one table. It reaches nothing
+// outside the pattern — measured on 26.7: a member cannot create, read, list, drop or
+// re-grant a housemate's rooms — and a colleague can read it back with SHOW GRANTS in one
+// line, which is the property the whole product rests on.
+//
+// Nobody is ever granted ALL ON <db>.*. That grant is dynamic (it covers rooms created
+// later), and it is what turned two members in one database into a leak.
+
+const { MEMBER_PIN, assertUsableName, roomPattern } = require('./house/house');
+
+/**
+ * What a member may do inside their own pattern. Each entry earns its place:
+ *   SELECT, INSERT           the shipper writes, everything else reads
+ *   ALTER, OPTIMIZE          ensureSchema adds columns in place; doctor compacts
+ *   CREATE TABLE, DROP TABLE their own rooms on first ship; a rebuild on migrate
+ *   ROW POLICY *             `share --only` scopes a grantee to a project or a session
+ */
+const ROOM_PRIVILEGES = [
+  'SELECT', 'INSERT', 'ALTER', 'OPTIMIZE',
+  'CREATE TABLE', 'DROP TABLE',
+  'CREATE ROW POLICY', 'ALTER ROW POLICY', 'DROP ROW POLICY', 'SHOW ROW POLICIES',
+];
+
+function roomGrant(db, member) {
+  return `GRANT ${ROOM_PRIVILEGES.join(', ')} ON ${db}.${roomPattern(member)} TO ${member} WITH GRANT OPTION`;
+}
+
+function sqlString(v) {
+  return `'${String(v).replace(/\\/g, '\\\\').replace(/'/g, "\\'")}'`;
+}
+
+/**
+ * The statements that make `member` a member of house `db`, in order.
+ *
+ * `optional` marks steps that need ACCESS MANAGEMENT the admin may not hold. The live
+ * path skips those on refusal and says what the member loses; a refused required step
+ * aborts. `password` may be null for a member that already exists (an invite re-run, an
+ * install against an account the DBA made) — then the CREATE USER step is omitted and the
+ * rest still applies.
+ *
+ * @returns {Array<{sql:string, why:string, optional:boolean}>}
+ */
+function plan({ db, member, password = null }) {
+  assertUsableName(db, 'house');
+  assertUsableName(member, 'member');
+  const steps = [
+    { sql: `CREATE DATABASE IF NOT EXISTS ${db}`, why: 'the house', optional: false },
+  ];
+  if (password !== null) {
+    steps.push({ sql: `CREATE USER IF NOT EXISTS ${member} IDENTIFIED BY ${sqlString(password)}`, why: 'the member', optional: false });
+  }
+  steps.push(
+    { sql: roomGrant(db, member), why: `their rooms — ${db}.${roomPattern(member)} — and nothing else in the house`, optional: false },
+    { sql: `ALTER USER ${member} ADD SETTING ${MEMBER_PIN}`, why: 'user_id is stamped on every row; an async insert would skip the stamp', optional: false },
+    { sql: `GRANT ALTER USER ON ${member} TO ${member}`, why: '`memhouse passwd` without an admin (their own account only)', optional: true },
+    { sql: `GRANT SHOW USERS ON *.* TO ${member}`, why: 'see who to share with — names only, never data', optional: true },
+    { sql: `GRANT REMOTE ON *.* TO ${member}`, why: '`memhouse relocate` pulls the old house over remoteSecure()', optional: true },
+  );
+  return steps;
+}
+
+/**
+ * The plan as SQL a person runs — clickhouse-client, the play UI, curl. One statement per
+ * line so it can be split on ';' by anything, comments above each saying why.
+ */
+function render(steps, { db, member }) {
+  const out = [
+    `-- memhouse: make '${member}' a member of house '${db}'.`,
+    '-- Run as a user with ACCESS MANAGEMENT (a stock \'default\' with access_management=1 will do).',
+    '--',
+    `-- One grant, on ${db}.${roomPattern(member)}: their rooms and nothing else in the database.`,
+    '-- Housemates keep their own rooms beside these and cannot read them. Do NOT widen it to',
+    `-- ${db}.* — that reaches every housemate's rooms, present and future.`,
+    '--',
+    `-- Their rooms are created by their own first \`memhouse ship\`; nothing to pre-build.`,
+    '',
+  ];
+  for (const s of steps) {
+    out.push(`-- ${s.why}${s.optional ? '  (optional: needs ACCESS MANAGEMENT; skip if refused)' : ''}`);
+    out.push(`${s.sql};`);
+    out.push('');
+  }
+  return out.join('\n');
+}
+
+module.exports = { ROOM_PRIVILEGES, roomGrant, plan, render };

package/memhouse/shipper/ship.js

@@ -61,12 +61,11 @@ const selfUpdate = require('../self-update');
 // gets. Taking it later would record whatever an upgrade had already replaced.
 const selfSnap = selfUpdate.snapshot(__filename);
 const {
-  resolveRooms, READ_SETTINGS, ROOM_TYPES, META_TYPES, SCHEMA_VERSION, MEMBER_PIN,
-  SUPPORTED_SCHEMAS, keyProblem,
-} = require('../house/house');
+  resolveRooms, READ_SETTINGS, ROOM_TYPES, META_TYPES, SCHEMA_VERSION, MEMBER_PIN, createStatement,
+  SUPPORTED_SCHEMAS, keyProblem, legacyTextIndexDialect, isTextIndexGrammarRefusal, textIndexDialectFor } = require('../house/house');
 // Rooms plus the house's own record of itself. Every table the template declares, which
 // is what the column healer and the drift warning have to cover — a column added to
-// house_events would otherwise roll out to nobody.
+// events would otherwise roll out to nobody.
 const ALL_TABLES = [...ROOM_TYPES, ...META_TYPES];
 
 const BATCH_ROWS = 2000;   // insert batch ceiling by ROW COUNT
@@ -410,17 +409,25 @@ async function assertRoomKeys(client, rooms) {
   }
 }
 
+// The shipper reads the prefix straight from its environment: it is spawned with the
+// resolved MEMHOUSE_* env by the CLI, and every room name it touches comes from
+// resolveRooms, so this is the only line that needs to know.
+
 async function ensureSchema(client) {
   const rooms = await resolveRooms(client);
   // BEFORE the CREATEs and ALTERs, not beside the end-of-function asserts. A house whose
   // record says a newer release moved it forward may have columns this template does not
   // know; running this template's DDL first could add back what that release removed —
   // the exact write the guard exists to prevent.
+  await assertNotLegacyLayout(client, rooms);
   await assertWriterSupported(client, rooms);
   const tpl = fs.readFileSync(path.join(__dirname, '..', 'house', 'schema.sql.tpl'), 'utf-8');
-  const sql = tpl; // plain shared tables — nothing to render
-  const stripped = sql.split('\n').map((l) => l.replace(/--.*$/, '')).join('\n');
-  const stmts = stripped.split(';').map((s) => s.trim()).filter(Boolean);
+  // Rendered per room rather than taken as one blob, because a prefixed house names its
+  // rooms `<prefix>_messages` and the template says `messages`. With no prefix the two
+  // are identical, so this is the same statements in the same order as before.
+  const stmts = [...ROOM_TYPES, ...META_TYPES]
+    .map((t) => createStatement(tpl, t, rooms.physical ? rooms.physical[t] : t)
+      .replace('CREATE TABLE ', 'CREATE TABLE IF NOT EXISTS '));
   // Two failure shapes are survivable here and both are skipped rather than fatal:
   //
   //   - a permission denial. A read-only credential can still run --ensure-schema for
@@ -431,16 +438,24 @@ async function ensureSchema(client) {
   //     the loser can get TABLE_ALREADY_EXISTS or a metadata-file collision. The table
   //     exists either way, which is the outcome this function wants.
   let denied = 0;
-  for (const q of stmts) {
+  // The text-index grammar changed at 25.10 and neither side parses the other (measured:
+  // 25.8/25.9 take the quoted form, 25.10+ the function form). Pick by the server's own
+  // version, then keep one fallback: if the chosen form is refused on grammar alone —
+  // never on privilege — send the other. A wrong guess costs a round-trip, not the install.
+  const version = await serverVersion(client);
+  const dialect = textIndexDialectFor(version);
+  if (dialect === 'legacy') console.error(`[memhouse] ClickHouse ${version}: text indexes in the pre-25.10 grammar`);
+  const create = (q) => client.command({ query: q, clickhouse_settings: { async_insert: 0, allow_experimental_full_text_index: 1 } });
+  for (const modern of stmts) {
+    const legacy = legacyTextIndexDialect(modern);
+    const [first, second] = dialect === 'legacy' ? [legacy, modern] : [modern, legacy];
     try {
-      await client.command({
-        query: q,
-        // allow_experimental_full_text_index: on 25.x the messages text indexes
-        // are gated behind this flag (SUPPORT_IS_DISABLED without it); 26.x+
-        // accepts it as a no-op. Query-scoped, so no server config or admin
-        // rights are needed. Verified on 25.11 and 26.7.
-        clickhouse_settings: { async_insert: 0, allow_experimental_full_text_index: 1 },
-      });
+      try { await create(first); }
+      catch (e) {
+        const m = e && e.message ? e.message : String(e);
+        if (!(first !== second && isTextIndexGrammarRefusal(m))) throw e;
+        await create(second);
+      }
     } catch (e) {
       const m = e && e.message ? e.message : String(e);
       if (/Not enough privileges|ACCESS_DENIED/i.test(m)) { denied++; continue; }
@@ -449,8 +464,16 @@ async function ensureSchema(client) {
     }
   }
   if (denied) {
-    console.error(`[memhouse] ${denied} schema statement(s) needed rights you do not hold — continuing with what you can do.`);
-    console.error('[memhouse] creating or replacing a ROOM is the house owner\'s job; adding a missing COLUMN is not.');
+    // In a SHARED house this is the designed state, not a shortfall: the operator creates
+    // each member's rooms during `invite` precisely so the member cannot — a member who
+    // could CREATE TABLE here could add tables beside every housemate's. Saying "you do
+    // not hold these rights" and then "schema ensured" about the same statements reads as
+    // a contradiction on every routine ship, which is how often a member sees it.
+    // A member holds CREATE TABLE on their own name pattern, so this is no longer the
+    // ordinary path — it is a credential provisioned outside memhouse with less than the
+    // plan gives. Say what to ask for rather than whose job it is.
+    console.error(`[memhouse] ${denied} schema statement(s) needed rights this credential does not hold — continuing with what it can do.`);
+    console.error('[memhouse] the memhouse grant is one line — `memhouse install --print-sql` shows it; ask whoever administers the house to run it.');
   }
   // A house created before origin existed has no such column, and every read and write
   // scopes by it. Add it in place; ReplacingMergeTree backfills the DEFAULT, so every
@@ -503,7 +526,7 @@ async function ensureSchema(client) {
   // There used to be a second, hardcoded `ADD COLUMN … origin` here, from when the healer
   // above could only add that one column. It is redundant now that the generic loop reads
   // the template correctly — and it would have been actively wrong once this loop covered
-  // house_meta and house_events, which have no origin and want none.
+  // meta and events, which have no origin and want none.
 
   await assertRoomsExist(client, rooms);
   await assertRoomKeys(client, rooms);
@@ -534,7 +557,7 @@ async function ensureSchema(client) {
  * Keep the house's record of itself current: which schema generation it is at, and which
  * memhouse version is writing into it.
  *
- * Written only when something CHANGED. A row per pass would turn house_events into a
+ * Written only when something CHANGED. A row per pass would turn events into a
  * heartbeat log — under `--loop` at the default interval that is 288 rows a day per
  * machine, and the one question the table exists to answer ("when did this house move,
  * and who moved it") would be buried in noise.
@@ -548,7 +571,7 @@ async function recordHouseState(client, rooms, host) {
   const writer = `${rooms.user}@${host}`;
   try {
     const rs = await client.query({
-      query: `SELECT key, value FROM ${rooms.house_meta} FINAL WHERE key IN ('schema_version', {ck:String}, {cs:String})`,
+      query: `SELECT key, value FROM ${rooms.meta} FINAL WHERE key IN ('schema_version', {ck:String}, {cs:String})`,
       // Keyed per member AND host. Keyed by member alone, two machines of one member
       // overwrote each other's entry on every pass, so the fleet view could only ever
       // show the machine that shipped last — the exact machine that needs no attention.
@@ -588,15 +611,15 @@ async function recordHouseState(client, rooms, host) {
     }
     // The heartbeat, EVERY pass — the fleet view's health column. Latest-wins on the key,
     // so it is one live row per writer however often it fires; version/schema above stay
-    // change-only so house_events remains a record of moves, not a pulse trace.
+    // change-only so events remains a record of moves, not a pulse trace.
     metas.push({ key: `last_ship:${writer}`, value: new Date().toISOString(), host });
     await client.insert({
-      table: rooms.house_meta_raw, values: metas, format: 'JSONEachRow',
+      table: rooms.meta_raw, values: metas, format: 'JSONEachRow',
       clickhouse_settings: { async_insert: 0 },
     });
     if (events.length) {
       await client.insert({
-        table: rooms.house_events_raw, values: events, format: 'JSONEachRow',
+        table: rooms.events_raw, values: events, format: 'JSONEachRow',
         clickhouse_settings: { async_insert: 0 },
       });
     }
@@ -609,8 +632,8 @@ async function recordHouseState(client, rooms, host) {
  *
  * Distinct from assertRoomKeys, which inspects key SHAPES — a future generation could be
  * a data transform the keys do not show. This reads what the house says about itself:
- * house_meta['schema_version'] (what generation the rooms are at) and
- * house_meta['min_writer_schema'] (the floor `memhouse migrate` sets under writers).
+ * meta['schema_version'] (what generation the rooms are at) and
+ * meta['min_writer_schema'] (the floor `memhouse migrate` sets under writers).
  * Too new -> the fix is on THIS machine: memhouse update. Below the floor -> same.
  * (A house OLDER than this release is not an error here — the room checks catch it and
  * name `memhouse migrate`; this guard must not fire on a pre-0.10 house that has no
@@ -619,17 +642,52 @@ async function recordHouseState(client, rooms, host) {
  * Releases before 0.10.0 never read this — for them the floor is enforced by the
  * pilot's GRANTs, not by code.
  */
+/**
+ * A house from before the one-layout holds plain rooms — `messages`, not `<member>_messages`.
+ * Shipping into it would quietly create a second, empty set of rooms beside the full ones
+ * and write there: every past session invisible to the member's own reads, the dashboard
+ * and the skills, with nothing anywhere saying why. Refuse, and say exactly what moves the
+ * old rooms across — a RENAME, instant, nothing copied.
+ *
+ * Trips only when the member's rooms are ABSENT and the plain ones PRESENT; a house holding
+ * both is mid-conversion and is left alone.
+ */
+async function serverVersion(client) {
+  try {
+    const rs = await client.query({ query: 'SELECT version() AS v', format: 'JSONEachRow' });
+    return String(((await rs.json())[0] || {}).v || '');
+  } catch { return ''; }
+}
+
+async function assertNotLegacyLayout(client, rooms) {
+  const rs = await client.query({
+    query: `SELECT name FROM system.tables WHERE database = currentDatabase() AND name IN ('messages', '${rooms.physical.messages}')`,
+    format: 'JSONEachRow',
+  });
+  const names = new Set((await rs.json()).map((r) => r.name));
+  if (names.has(rooms.physical.messages) || !names.has('messages')) return;
+  // The plain rooms of a pre-one-layout house: the transcript rooms by type name, and the
+  // two bookkeeping rooms under the names they had then.
+  const legacyName = { meta: 'house_meta', events: 'house_events' };
+  const moves = [...ROOM_TYPES, ...META_TYPES].map((t) => `RENAME TABLE ${legacyName[t] || t} TO ${rooms.physical[t]};`).join('\n     ');
+  throw new Error(
+    'this house holds plain rooms (messages, sessions, tool_calls) — the layout before rooms were named for their member.\n'
+    + `  Shipping now would create empty ${rooms.pattern} rooms beside them and write there, hiding every past session.\n`
+    + `  Move the old rooms across (a rename — instant, nothing copied), then ship again:\n     ${moves}\n`
+    + `  Then replace the database-wide grant with the one-layout grant:  memhouse install --print-sql --member ${rooms.member}`);
+}
+
 async function assertWriterSupported(client, rooms) {
   let have;
   try {
     const rs = await client.query({
-      query: `SELECT key, value FROM ${rooms.house_meta} FINAL WHERE key IN ('schema_version', 'min_writer_schema')`,
+      query: `SELECT key, value FROM ${rooms.meta} FINAL WHERE key IN ('schema_version', 'min_writer_schema')`,
       format: 'JSONEachRow',
     });
     have = new Map((await rs.json()).map((r) => [r.key, toInt(r.value)]));
   } catch (e) {
     // ONLY a missing table means a pre-0.10 house (the room checks own that case). Any
-    // other failure — an ACCESS_DENIED on house_meta, a timeout — used to fall through
+    // other failure — an ACCESS_DENIED on meta, a timeout — used to fall through
     // here too, and a writer that merely could not READ the record was treated as if the
     // record did not exist: on a newer-schema house whose key shapes happen to match,
     // that bypassed the whole compatibility guard. Not being able to check is a reason
@@ -1004,6 +1062,7 @@ async function runShip(client, opts = {}) {
   // shape: writing at the wrong epoch either forks a session that did not change, or
   // overwrites a stored parse that did.
   const rooms = await resolveRooms(client);
+  await assertNotLegacyLayout(client, rooms);
   await assertWriterSupported(client, rooms);
   await assertRoomsExist(client, rooms);
   await assertRoomKeys(client, rooms);