memhouse 0.18.10 → 0.18.11

package/CHANGELOG.md

@@ -4,6 +4,133 @@ Versions before 0.8.0 were beta-only. Beta installs of 0.7.x and earlier should
 uninstall and reinstall — the 0.8.0 layout is new, and an in-place `update` +
 migration path is planned work, not a promise the old versions can cash.
 
+## 0.18.11 — 2026-10-10
+
+Release notes: [`docs/releases/v0.18.11.md`](docs/releases/v0.18.11.md). Read its upgrade
+section first: the first pass after the upgrade re-sends every stored session with
+subagents once.
+
+- Sessions with subagents ship only their new rows.
+- **Security:** `invite` no longer sends a stored credential to `--url` (G4).
+- The 0.18.10 pre-tag list is finished, and the gentar kit is v0.9.3.
+- The dashboard ships the license notices of every package it bundles (`public/THIRD_PARTY_NOTICES.txt`).
+- **No drill was run for this release; waived (2026-10-08) under the pilot's 0.18.10 ruling. The drill runs before 0.19.0.**
+
+- **The dashboard now ships the license notices of what it bundles.** The built dashboard
+  (`public/`) includes React, chart.js, lucide-react (ISC), react-markdown, the remark and
+  micromark family, tailwindcss and others: every bundled package. Their licenses require the
+  notice to travel with every copy, and Vite's minifier strips the license comments, so
+  every published package so far carried those copies without one.
+  - `ui/third-party-notices.js`, a Vite plugin with no dependencies of its own, now writes
+    `public/THIRD_PARTY_NOTICES.txt` at build time from the bundle's module graph. It
+    lists each package with its version, declared license, and the license text it ships.
+  - A bundled package with no license text fails the build. The only exception is an
+    explicit, reasoned list of packages that truly ship none; it is empty today. Each
+    `name@version` is listed once, so a second bundled version keeps its own text.
+  - CI's tarball audit also fails if the file is missing or does not list the main
+    packages.
+- **A session with subagents ships only its new rows, like any other.** 0.18.8's tail-only
+  shipping did not reach the sessions that grow the most: folded subagent rows were numbered
+  by position after the parent's turns, so one new parent turn moved every one of them, the
+  session forked to a new epoch and re-sent itself whole on every pass. Measured on a real
+  house: 1.07 M message rows written in 24 h against 10.2 M in total, most of them full
+  copies of five sessions, one 6,120-line session stored 60 times in a day. A subagent's
+  rows now sit in a block of their own — `seq = 1,000,000,000 + slot × 100,000 + turn`,
+  `tool_calls.idx` the same — where `slot` is the subagent's rank by start time, so neither
+  the parent growing, a running subagent growing, nor a new subagent appearing moves an
+  existing row. The session's own turns keep `0, 1, 2, …`, so a session without subagents
+  is numbered exactly as before. Readers that `ORDER BY seq` see the parent first, then each
+  subagent contiguous, in the order they started (they were in agent-id order, which is
+  random). `seq` is sparse now: count with `count()`, never `max(seq) + 1`.
+  **Upgrade cost, once:** every stored session with subagents forks exactly one time, the
+  first time it is re-shipped after the upgrade (it grows, or `ship --full`), and is
+  tail-only from then on. The superseded epoch is kept, as every epoch is. Sessions without
+  subagents are not affected. Two things widen that first pass:
+  - A session whose subagent files are newer than the house's record of it is read again on
+    the first pass even if it did not grow. `lastUpdatedAt` now counts subagent writes; see
+    the next entry. So the first pass after the upgrade forks and re-sends every such
+    session whole, once.
+  - Two installs that ship the SAME session files (two instances on one machine, or a
+    synced directory) must be upgraded together. A 0.18.10 and a 0.18.11 number the same
+    session differently, and each would fork it back on every pass.
+
+  **The first pass is a one-time bulk write into the house.** Schedule it, and do not
+  run it on a house whose storage is degraded. A parse that does not fit the blocks (a parent past 1e9
+  turns, a subagent past 100,000, more than 32,949 subagents) falls back to positional
+  numbering, which is correct and merely re-ships whole.
+- **A subagent that runs on after its parent goes quiet is shipped on the next pass.** The
+  incremental skip compared only the parent file's mtime (or the index's `modified`), and a
+  subagent writes only its own file, so a background agent's turns waited for the parent's
+  next write, or were never shipped. A session's `lastUpdatedAt` is now the newest mtime of
+  the parent and every subagent transcript, Workflow-run agents included — stat calls only,
+  and only for sessions that have a subagent directory. After upgrading, a session whose
+  subagents are newer than its parent is re-read once on the first pass, and ships the turns
+  it was missing.
+- **`memhouse update --no-install` restarts a tarball or nightly install.** It is the command
+  every nightly prints for itself, and on exactly those builds it stopped at "no automatic
+  update for this install" (a tarball is on no registry tag), exited 1, and left the old
+  shipper running the old code in memory. `--no-install` no longer needs a channel: the
+  files are already in place, and the restart, migrations and schema check run. Found while
+  upgrading testbed from 0.18.9 to a nightly of this release.
+
+- **A subagent caught before its first line is written holds its session for one pass.**
+  A subagent with no timestamped line ranked last. When its first line then landed with an
+  earlier time than a sibling's, it moved ahead of it, renumbered every sibling after it,
+  and the session forked and re-shipped whole. Now the shipper waits a pass (`held for one
+  pass` in the log) and ranks it by its real start time. A file that never gets a
+  timestamped line stops holding the session after 10 minutes. (GLM-F1)
+- **An option that takes no value no longer swallows the next word.**
+  - `memhouse update --no-install yes` set no-install to "yes", and ran the npm install it
+    was told to skip.
+  - `memhouse share --revoke bob` revoked nobody.
+  - Switches are now true when present, and the next word stays a positional.
+  (A6, review G34)
+- **`update --channel <name>` pins only a channel the registry has.** It compared the flag
+  with itself and never wrote the pin at all. A name that is not a tag is now refused, and
+  nothing is pinned. When the registry does not answer, the channel is not pinned. (A5)
+- **`update --no-install` no longer prints "files updated"** for files it did not touch.
+  It also now runs on a project-dependency install too; it installs nothing, so where the
+  files came from does not matter. (A6)
+- **The epoch log line counts rows, not the highest seq.** On a session with subagents it
+  read "1000000123 messages stored". (A4)
+- **Docs: the host id is derived from the machine's own id, not random,** since 0.18.6.
+  The guides, `HOUSE.md`, `host.js` and `uninstall --full-removal` said a reinstall mints a
+  new identity. It derives the same one again. (A8)
+- **`invite` never sends a credential this install keeps to `--url` (G4, security).** `--url`
+  is the invitee's address, typed on a command line. A typo, a tunnel or somebody else's
+  server got the member's own credential (the reachability probe and the grants read), or
+  a kept admin's (provisioning). `resolveConfig()` lets the flag outrank the env file, so
+  the "configured" URL the code used WAS `--url`.
+  - A stored credential now goes only to the house it was saved for: the member's, a
+    `--keep-admin` admin's, or a password resolved from the env file.
+  - `--url` gets an unauthenticated `/ping` to confirm the invitee can reach it.
+  - An admin given for this command (`--admin-user` or an exported
+    `MEMHOUSE_ADMIN_USER`, with its password from a file, stdin, the environment or a
+    prompt) still provisions at `--url`.
+  - `misc/invite-matrix.sh` points `--url` at a spy server and asserts it receives
+    nothing but a ping.
+- **The dashboard no longer goes empty on a quiet house (G11).** The stats tables carry a
+  one-day TTL and were refreshed only by a pass that shipped something. So a house whose
+  machines went quiet for a day lost every generation, and the dashboard, which had chosen
+  its tables once per process, kept reading the emptied one.
+  - The shipper now also refreshes when the newest generation is over an hour old.
+  - The dashboard re-resolves its rooms every five minutes, so it falls back to the inline
+    rollup when a stats table is empty.
+- **The skills find their reference again (G26).** All five said
+  `Read ../reference/HOUSE.md`, a path that does not exist in the installed plugin; the
+  file is at `../../reference/HOUSE.md`. A unit test now resolves every skill's reference
+  path from its own directory.
+- **`/mem:recall` queries that run (A2).**
+  - "Recent sessions" ordered by `started_at`, which the room does not have; it now uses
+    `created_at` / `last_updated_at`, read `FINAL`.
+  - The search now returns `hit_seq`, which the transcript read needs.
+  - The read takes its window by position (three turns before, twelve after) instead of
+    by `seq` arithmetic, which a subagent's block numbering defeats.
+- **`HOUSE.md`'s subagent queries keep to the current parse (A3).** They had no epoch
+  filter, so a re-parsed session doubled each subagent's turns.
+- `misc/skill-recipe.sh` now runs these queries verbatim, extracted from the docs, against
+  fixture rows with a superseded parse and a subagent block.
+
 ## 0.18.10 — 2026-10-08
 
 Release notes: [`docs/releases/v0.18.10.md`](docs/releases/v0.18.10.md), covering what

package/README.md

@@ -14,8 +14,8 @@ can search every past session, see what it cost, and reopen the one that solved
 before.
 
 Every row says where it came from, in a way no client can fake. `user_id` is stamped by
-the server (`MATERIALIZED currentUser()`), and `host` is a fingerprint minted once per
-install. A team pointed at one house gets a shared memory with real attribution.
+the server (`MATERIALIZED currentUser()`), and `host` is a fingerprint derived from
+the machine's own id. A team pointed at one house gets a shared memory with real attribution.
 
 ## Install
 

package/bin/memhouse.js

@@ -42,17 +42,7 @@ const LOG_DIR = path.join(HOME_DIR, 'logs');
 const argv = process.argv.slice(2);
 const cmd = argv[0] && !argv[0].startsWith('-') ? argv[0] : null;
 const rest = cmd ? argv.slice(1) : argv;
-const flags = {};
-const positional = [];
-for (let i = 0; i < rest.length; i++) {
-  const a = rest[i];
-  if (a.startsWith('--')) {
-    const key = a.slice(2);
-    const next = rest[i + 1];
-    if (next !== undefined && !next.startsWith('--')) { flags[key] = next; i++; }
-    else flags[key] = true;
-  } else positional.push(a);
-}
+const { flags, positional } = require(path.join(REPO_ROOT, 'memhouse', 'flags')).parseArgv(rest);
 const JSON_OUT = flags.json === true;
 
 // Unknown flags stop the run — see memhouse/flags.js for why a shrug is not enough.
@@ -341,6 +331,22 @@ async function ask(question, dflt) {
 // reason in .cause. `✗ not connected: fetch failed` names neither the host nor the problem,
 // while `ship` prints ECONNREFUSED for the identical condition — the three commands
 // disagreed about the same event.
+// Is `url` an HTTP endpoint that answers at all? ClickHouse's /ping needs no credential, so
+// this checks an address without sending one. Any HTTP response counts — a proxy that
+// wants auth on every path still proves the address is reachable.
+async function pingUrl(url) {
+  let target;
+  try { target = new URL('ping', String(url).endsWith('/') ? String(url) : `${url}/`); }
+  catch { return { ok: false, reason: 'not a URL' }; }
+  try {
+    await fetch(target, { signal: AbortSignal.timeout(8000), redirect: 'manual' });
+    return { ok: true };
+  } catch (e) {
+    const c = e && e.cause && (e.cause.code || e.cause.message);
+    return { ok: false, reason: c || (e && e.name === 'TimeoutError' ? 'timed out' : String(e && e.message || e)) };
+  }
+}
+
 function netReason(e) {
   const cause = e && e.cause;
   const inner = cause && (cause.message || cause.code);
@@ -358,7 +364,7 @@ function netReason(e) {
 // --admin-password (warned), then MEMHOUSE_ADMIN_PASSWORD, then the stored credential
 // of that SAME admin, then a TTY prompt. null = none, and the caller has been told how
 // to give one without putting it on the command line. See memhouse/admin-secret.js.
-async function adminPasswordFor(adminUser) {
+async function adminPasswordFor(adminUser, out = {}) {
   const as = require(path.join(REPO_ROOT, 'memhouse', 'admin-secret'));
   const file = readEnvFile();
   let r;
@@ -369,9 +375,11 @@ async function adminPasswordFor(adminUser) {
   } catch (e) { console.log(bad(e.message)); return null; }
   // stderr: `members --json` and friends must emit nothing but JSON on stdout.
   if (r.source === 'flag') console.error(warn(as.ARGV_WARNING));
+  out.source = r.source;
   if (r.password !== undefined) return r.password;
   if (process.stdin.isTTY) {
     const p = await askSecret(`  password for '${adminUser}'`);
+    out.source = 'prompt';
     if (p) return p;
     console.log(bad('no password given'));
     return null;
@@ -2248,15 +2256,31 @@ function installKind() {
 async function cmdUpdate() {
   const { kind, root } = installKind();
   const cfg0 = resolveConfig();
-  // --channel pins for this run AND every later one: the point of pinning is that the next
-  // person to type `memhouse update` does not have to remember it.
-  if (flags.channel && flags.channel !== true && String(flags.channel) !== cfg0.channel) {
-    writeEnvFile({ ...cfg0, channel: String(flags.channel) });
-    console.log(ok(`channel pinned in ${short(ENV_FILE)}: ${flags.channel}`));
-  }
-  const pinned = flags.channel && flags.channel !== true ? String(flags.channel) : (cfg0.channel || null);
+  const asked = flags.channel && flags.channel !== true ? String(flags.channel) : null;
+  // What is PINNED is what the env file says. resolveConfig folds --channel into cfg0, so
+  // comparing the flag with cfg0.channel compared it with itself, and the pin was never
+  // written at all.
+  const stored = readEnvFile().MEMHOUSE_CHANNEL || null;
+  const pinned = asked || cfg0.channel || null;
   const tags = await chan.fetchTags();
   const pick = chan.pickChannel({ version: PKG.version, pinned, tags });
+  // --channel pins for this run AND every later one: the point of pinning is that the next
+  // person to type `memhouse update` does not have to remember it. Only a channel the
+  // registry actually has is pinned. The pin used to be written before anything was
+  // checked, so `--channel tema` (or any typo) left every later `update` following a tag
+  // that does not exist, --no-install included, which checks no channel at all (A5).
+  if (asked && asked !== stored) {
+    if (!tags) {
+      console.log(warn(`the registry did not answer, so channel '${asked}' cannot be checked — not pinned`));
+    } else if (!tags[asked]) {
+      console.log(bad(`no channel '${asked}' on the registry — nothing pinned, nothing changed`));
+      console.log(`  channels: ${Object.keys(tags).join(', ')}`);
+      return 1;
+    } else {
+      writeEnvFile({ ...cfg0, channel: asked });
+      console.log(ok(`channel pinned in ${short(ENV_FILE)}: ${asked}`));
+    }
+  }
   const latest = pick.target;
   if (JSON_OUT && flags.check) return console.log(JSON.stringify({ kind, root, current: PKG.version, channel: pick.channel, target: pick.target, reason: pick.reason, tags }, null, 2));
   console.log(`  installed  ${PKG.version}  (${kind}: ${root})`);
@@ -2264,12 +2288,18 @@ async function cmdUpdate() {
   console.log(`  target     ${pick.target || (tags ? 'nothing to install' : 'unknown — the registry did not answer')}`);
   if (latest && latest === PKG.version && kind !== 'checkout') console.log(ok('already current'));
   if (flags.check) return 0;
-  if (!pick.channel && kind !== 'checkout') {
+  // --no-install asks for the restart and the house checks only; the files are already in
+  // place, so which channel they came from does not matter. Refusing here for want of one
+  // made the command every nightly prints for itself ("memhouse update --no-install")
+  // return 1 on exactly the builds that print it — a tarball is on no registry tag — and
+  // leave the old shipper running the old code.
+  const noInstall = flags['no-install'] === true;
+  if (!pick.channel && kind !== 'checkout' && !noInstall) {
     console.log(warn('no automatic update for this install'));
     console.log(`  ${pick.reason}`);
     return 1;
   }
-  if (pick.channel && !pick.target && kind !== 'checkout') {
+  if (pick.channel && !pick.target && kind !== 'checkout' && !noInstall) {
     console.log(bad(`channel '${pick.channel}' has no version on the registry — nothing to install, nothing changed`));
     return 1;
   }
@@ -2279,7 +2309,9 @@ async function cmdUpdate() {
     console.log('  to keep a version around: npm install -g memhouse');
     return 1;
   }
-  if (kind === 'local-dep') {
+  // --no-install installs nothing, so where the files came from does not matter: restart and
+  // check the house. The refusal used to come first and turned it away (A6).
+  if (kind === 'local-dep' && !noInstall) {
     console.log(warn('this is a project dependency, not a global install'));
     console.log(`  upgrade it where it lives: npm install memhouse@${pick.channel || 'latest'}`);
     return 1;
@@ -2292,7 +2324,7 @@ async function cmdUpdate() {
   try { svc = require(path.join(REPO_ROOT, 'memhouse', 'service.js')).status(); } catch { /* unsupported platform */ }
   const wasRunning = { shipper: !!pidOf('shipper'), dashboard: !!pidOf('dashboard') };
 
-  if (flags['no-install'] === true) {
+  if (noInstall) {
     // The files were already replaced by other means — a hand-typed `npm i -g`, a tarball,
     // a configuration manager. The npm/git half is exactly what such a pilot has already
     // done, and the half a bare install leaves undone (restart, migrations, schema heal)
@@ -2326,7 +2358,9 @@ async function cmdUpdate() {
       return 1;
     }
   }
-  console.log(ok('files updated'));
+  // Said only when something was installed. Under --no-install it claimed "files updated"
+  // for files nobody touched (A6).
+  if (!noInstall) console.log(ok('files updated'));
   // The house may have been converted to the one layout since this machine last ran:
   // the member's rooms moved from <name>.* to mem.<name>_*. Fix the env here, before the
   // shipper restarts, or its first pass refuses the old address forever.
@@ -3709,14 +3743,36 @@ async function cmdInvite() {
   // itself is tried below — which works for whoever set the house up as its superuser.
   if (flags['admin-user'] === true) { console.log(bad('--admin-user needs a name, e.g. --admin-user default')); return 1; }
   let adminUser = (flags['admin-user'] ? String(flags['admin-user']) : '') || cfg.adminUser || undefined;
+  // Who named this admin decides where its credential may go (G4, memhouse/invite-target.js):
+  // one given for this command provisions at --url; one this install keeps provisions only
+  // at the house it was saved for.
+  const adminUserSource = flags['admin-user'] ? 'flag'
+    : (process.env.MEMHOUSE_ADMIN_USER ? 'env' : (adminUser ? 'file' : 'member'));
   let adminPass;
+  const pwSource = {};
   if (adminUser) {
     // --admin-password-file / --admin-password / MEMHOUSE_ADMIN_PASSWORD / the stored one
     // for this same admin / a prompt. `--admin-user` as a flag used to switch the
     // environment off, so the only scriptable path put the password on argv.
-    adminPass = await adminPasswordFor(adminUser);
+    adminPass = await adminPasswordFor(adminUser, pwSource);
     if (adminPass === null) return 1;
   }
+  const target = require(path.join(REPO_ROOT, 'memhouse', 'invite-target'))
+    .provisionTarget({ url, storedUrl: configuredUrl, adminUserSource, passwordSource: pwSource.source || null });
+  if (target.error) { console.log(bad(target.error)); return 1; }
+  // A stored credential is never sent to --url, so check that the INVITEE can reach it
+  // without one: ClickHouse answers /ping unauthenticated.
+  if (target.stored) {
+    const reach = await pingUrl(url);
+    if (!reach.ok) {
+      console.log(bad(`cannot reach ${url}: ${reach.reason}`));
+      console.log('  --url is the address the INVITEE will use, and invite checks it from here first.');
+      console.log('  A `deploy --local` house is bound to loopback on purpose, so no LAN address');
+      console.log('  reaches it and no invitee could either — publish it (tunnel, reverse proxy)');
+      console.log('  before inviting, or use --print-sql and let the invitee be told the address.');
+      return 1;
+    }
+  }
   if (!adminUser) {
     const c = requireConfig(cfg, 'invite');
     if (!c.user) return 1;
@@ -3735,20 +3791,18 @@ async function cmdInvite() {
     // unreachable host — a typo, a loopback-bound house, a tunnel that is down — come back
     // as "you are only a member", which sends the reader after a privilege they already
     // have. Caught on the testbed, where a wrong --url produced exactly that.
+    // The member credential is stored, so it is checked against the house it was saved for
+    // (target.url), never against --url; --url's reachability was checked above, unauthenticated.
     try {
-      await ch({ ...c, url }, 'SELECT 1', { database: '' });
+      await ch({ ...c, url: target.url }, 'SELECT 1', { database: '' });
     } catch (e) {
-      console.log(bad(`cannot reach ${url} as '${c.user}': ${netReason(e)}`));
-      console.log('  --url is the address the INVITEE will use, and invite checks it from here first.');
-      console.log('  A `deploy --local` house is bound to loopback on purpose, so no LAN address');
-      console.log('  reaches it and no invitee could either — publish it (tunnel, reverse proxy)');
-      console.log('  before inviting, or use --print-sql and let the invitee be told the address.');
+      console.log(bad(`cannot reach your house ${target.url} as '${c.user}': ${netReason(e)}`));
       return 1;
     }
     // What this credential may do, judged from its own grants and SCOPE-AWARE — a member
     // holds CREATE DATABASE inside `ON <their-db>.*`, which mints no new house at all.
     // Shared with `whoami` so the two can never disagree about who is an administrator.
-    const caps = capabilitiesFrom(await readGrants({ ...c, url }, c.user));
+    const caps = capabilitiesFrom(await readGrants({ ...c, url: target.url }, c.user));
     if (caps.canProvision) {
       adminUser = c.user; adminPass = c.password;
       console.log(ok(`inviting as your own credential '${c.user}' (it can create users and houses here)`));
@@ -3771,13 +3825,12 @@ async function cmdInvite() {
     }
   }
 
-  // WHERE to connect to provision. --url is the address the INVITEE will use — it may be
-  // a LAN IP or tunnel that is not this admin's own endpoint, and sending the stored
-  // credential there would hand it to whatever answers a typo'd or hostile --url. So the
-  // stored-credential path provisions at the admin's OWN configured cfg.url; only an
-  // EXPLICIT --admin-* (where the admin typed the target themselves) provisions at --url.
-  // Either way the invite FILE carries --url, the invitee's path.
-  const provisionUrl = flags['admin-user'] ? url : cfg.url;
+  // WHERE to connect to provision: decided above by provisionTarget(). A stored credential
+  // provisions at the house it was saved for; one given for this command, at --url. Either
+  // way the invite FILE carries --url, the invitee's path. (This used to read
+  // `flags['admin-user'] ? url : cfg.url` — but cfg.url IS --url once the flag is given, so
+  // the stored credential went to whatever --url named.)
+  const provisionUrl = target.url;
 
   // Is there already a house here, with somebody's memory in it? The house is created
   // with CREATE DATABASE IF NOT EXISTS, so inviting a name whose database already exists
@@ -4037,8 +4090,10 @@ async function cmdUninstall() {
   //
   //   (default)         daemons, service, runtime state. Config and identity KEPT.
   //   --credentials     also forget the house: the env file, with its password.
-  //   --full-removal    all of MEMHOUSE_HOME, fingerprint included. The next install is a
-  //                     NEW host whose rows do not join this machine's history.
+  //   --full-removal    all of MEMHOUSE_HOME, host.json included. The next install
+  //                     derives the same fingerprint from the OS machine id (0.18.6+), so it
+  //                     is the same host unless the machine was renamed meanwhile or has no
+  //                     readable machine id (then it falls back to random: a new host).
   //
   // No tier touches the house: transcripts live in ClickHouse and re-ship from the local
   // session stores regardless.
@@ -4059,8 +4114,9 @@ async function cmdUninstall() {
     if (flags.yes !== true && process.stdin.isTTY) {
       const id = hostjs.read(HOME_DIR);
       console.log(warn(`--full-removal also discards this machine's host identity${id ? ` (${id.id})` : ''}.`));
-      console.log('  Rows already shipped keep that name, a future install gets a new one, and');
-      console.log("  this machine then reads as two. Your transcripts themselves are safe.");
+      console.log('  A reinstall derives it again from this machine\'s own id, so it normally comes');
+      console.log('  back the same — unless the machine is renamed first, or has no readable machine');
+      console.log("  id, and then it reads as two machines. Your transcripts themselves are safe.");
       const a = (await ask('Remove everything, including the host identity? (yes/no)', 'no')).toLowerCase();
       if (a !== 'yes' && a !== 'y') { console.log('aborted — daemons are stopped, nothing was removed'); return; }
     }

package/docs/guides/storage.md

@@ -34,11 +34,14 @@ with you. Naming a room you were not granted is an error, never a silent omissio
 - **`user_id`** is stamped by the server: `MATERIALIZED currentUser()`. Async inserts are
   pinned off for members, so the stamp cannot be skipped. `WHERE user_id = 'alice'` is one
   person.
-- **`host`** is the machine. Each install mints a random fingerprint once and keeps it in
-  `$MEMHOUSE_HOME/host.json`, and every row carries `<hostname>-<8 hex>`. It is random,
-  not derived from the machine:
-  - a derived id would merge two laptops that both answer to `MacBook-Pro`;
-  - a derived id would split one machine in two when it is renamed.
+- **`host`** is the machine. Every row carries `<hostname>-<8 hex>`, where the 8 hex come
+  from a fingerprint of the OS's own machine id (IOPlatformUUID on macOS,
+  `/etc/machine-id` on Linux), hashed so the raw id never leaves the machine. It is kept in
+  `$MEMHOUSE_HOME/host.json`. It is not taken from the hostname:
+  - two laptops that both answer to `MacBook-Pro` still get different ids;
+  - a renamed machine keeps its id, and `status` reports the new name beside it;
+  - reinstalling, even after `uninstall --full-removal`, brings the same machine back
+    under the same id. Where no machine id can be read, it falls back to a random one.
 
   `memhouse status` shows this machine's id. `memhouse doctor` names every host in your
   rooms.

package/docs/guides/uninstall.md

@@ -12,8 +12,10 @@ npm uninstall -g memhouse            # then remove the package
 - **The default is the conservative one.** Stopping the shipper is routine: before an
   upgrade, while debugging, or when a laptop should go quiet for a week. It should not
   also mean "forget which house I use and who this machine is".
-- **`--full-removal` asks first.** A later reinstall mints a **new** machine identity, and
-  this machine then reads as two machines in your history.
+- **`--full-removal` asks first.** It deletes `host.json`. A later reinstall derives the
+  same identity again from the machine's own id, so your history stays one machine, unless
+  the machine was renamed in between or has no readable machine id. Then it comes back as
+  a new host.
 - **Your memory stays.** The rooms in ClickHouse are untouched by every tier. What the
   shipper wrote can be rebuilt from the local session stores with `memhouse ship --full`,
   for as long as the editors keep them.

package/docs/releases/README.md

@@ -5,6 +5,7 @@ do, how to upgrade, what is deprecated and when it goes, and what was deferred.
 
 | version | date | headline |
 |---|---|---|
+| [0.18.11](v0.18.11.md) | 2026-10-10 | sessions with subagents stop re-shipping; security: no stored credential sent to `invite --url` |
 | [0.18.10](v0.18.10.md) | 2026-10-08 | security: the admin password never on argv; no member password printed; a scoped share reaches only its scope |
 
 Earlier versions: [`CHANGELOG.md`](../../CHANGELOG.md).

package/docs/releases/v0.18.11.md

@@ -0,0 +1,191 @@
+# memhouse 0.18.11 — 2026-10-10
+
+This release does three things:
+
+- **Sessions with subagents stop re-shipping.** A Claude Code session that used subagents
+  now ships only its new rows. Before, it re-sent itself whole on every pass, and that was
+  most of the house's write load.
+- **A security fix.** `invite` no longer sends a stored credential to whatever `--url` is
+  typed on the command line.
+- **The 0.18.10 pre-tag list is finished**, and the gentar test kit is bumped.
+
+**No drill was run for this release; waived (2026-10-08) under the pilot's 0.18.10 ruling. The drill runs before 0.19.0.**
+
+## Read this before upgrading
+
+**The first pass after the upgrade is a one-time bulk write.** It re-sends, whole and once,
+every stored session that has subagents; after that, those sessions ship only their new
+rows. Two things widen that first pass:
+
+- **Sessions whose subagents wrote recently.** A session whose subagent files are newer
+  than the house's record of it is read again even if it did not grow, because
+  `lastUpdatedAt` now counts subagent writes.
+- **Installs that share session files.** Two installs that ship the same session files
+  (two instances on one machine, or a synced directory) must be upgraded together. A
+  0.18.10 and a 0.18.11 number the same session differently, and each would fork it back
+  on every pass.
+
+**Where that write lands, and when to do it (2026-10-08):**
+
+- The pilot's machines (macminim, macbokum) ship to **zeo.memhouse.io**: VM 146 on arf,
+  ClickHouse 26.7.4.58.
+- It is **not** LXC 112 "memhouse-production"; that is an archive, not a live house.
+- zeo's data disk still sits on arf's degraded array. It was backed up to SSD on
+  2026-10-08 (data and access storage), but the disk itself has not moved.
+- **Upgrade those machines only once zeo's data disk is off the degraded array, or once
+  the array is repaired. Time it against the SSD moves.**
+- Any house on healthy storage can upgrade normally.
+
+```bash
+memhouse update        # then: memhouse status — every line a check mark
+```
+
+## Security
+
+### `invite` never sends a stored credential to `--url` (G4)
+
+`--url` is the invitee's address, typed on a command line. A typo, a tunnel, or somebody
+else's server received credentials it should never have seen:
+
+- the member's own credential, through the reachability probe and the read of its grants;
+- an admin credential the install keeps, through provisioning.
+
+The cause: `resolveConfig()` lets a flag outrank the env file, so the "configured house" URL
+the code used *was* `--url`.
+
+Now:
+
+- **A stored credential goes only to the house it was saved for.** That covers the
+  member's own, a `--keep-admin` admin, and a password read from the env file.
+- **`--url` gets an unauthenticated `/ping`**, only to confirm the invitee can reach it.
+- **An admin given for this command** (`--admin-user`, or an exported
+  `MEMHOUSE_ADMIN_USER`, with its password from a file, stdin, the environment or a prompt)
+  still provisions at `--url`. That is what the person typing the command asked for.
+- **`misc/invite-matrix.sh` points `--url` at a spy server** and asserts that it receives
+  nothing but a ping. On 0.18.10 the spy received two authenticated requests.
+
+**Action:**
+
+- If you ran `memhouse invite … --url <something unusual>` on 0.18.10 or earlier against a
+  host you do not control, rotate the member's password with `memhouse passwd`.
+- If an admin credential is kept in the env file and the same applies, rotate that too.
+
+## The re-ship fix (#21)
+
+Folded subagent rows were numbered by position, after the parent's turns. One new parent
+turn moved every one of them, so the session forked to a new epoch and was re-sent whole.
+Measured on a real house:
+
+- 1.07 M message rows written in 24 h, against 10.2 M in total;
+- one 6,120-line session stored 60 times in a day;
+- polat's house at about 19 M message rows for roughly 295 k real ones.
+
+What changed:
+
+- **Subagent rows get a numbering block of their own:**
+  `seq = 1,000,000,000 + slot × 100,000 + turn`, and the same for tool calls' `idx`.
+  `slot` is the subagent's rank by start time, so neither the parent growing, a subagent
+  growing, nor a new subagent appearing moves a stored row.
+- **A session without subagents is numbered exactly as before.**
+- **`seq` is sparse.** Count rows with `count()`, never `max(seq) + 1`.
+- **`ORDER BY seq` groups subagents.** Readers see the parent first, then each subagent's
+  turns together, in the order the subagents started. They used to be in agent-id order,
+  which is random.
+- **A parse too big for the blocks falls back to positional numbering:**
+  - a parent past 1e9 turns;
+  - a subagent past 100,000 turns;
+  - more than 32,949 subagents.
+
+  Positional numbering is correct, and merely re-ships whole as before.
+- **Subagent writes count as session activity.** A subagent that keeps running after its
+  parent goes quiet is shipped on the next pass.
+- **A subagent caught before its first line is written holds its session for one pass.**
+  It is then ranked by its real start time; it no longer ranks last and moves later. A
+  file that never gets a timestamped line stops holding the session after 10 minutes.
+- **Existing copies are not cleaned up.** Superseded epochs already in a house stay;
+  memhouse never deletes to make room. Reclaiming that space is a separate operator
+  decision, and no such cleanup may run on a house on degraded storage.
+
+## Also fixed
+
+- **The dashboard no longer goes empty on a quiet house (G11).** The stats tables carry a
+  one-day TTL and were refreshed only by passes that shipped something.
+  - The shipper now also refreshes them when the newest generation is over an hour old.
+  - The dashboard re-resolves its tables every five minutes, falling back to the live
+    rollup when a stats table is empty.
+- **The skills find their reference again (G26).** All five pointed at
+  `../reference/HOUSE.md`, a path that does not exist in the installed plugin; the file is
+  at `../../reference/HOUSE.md`.
+- **`/mem:recall`'s queries run (A2).**
+  - "Recent sessions" used a column the room does not have.
+  - The search now returns the `hit_seq` that the transcript read needs.
+  - The read takes its window by position, so the subagent blocks cannot break it.
+- **`HOUSE.md`'s subagent queries keep to the current parse (A3).** They used to double a
+  re-parsed session's subagent turns.
+- **An option that takes no value no longer swallows the next word (A6).**
+  `update --no-install yes` ran the install it was told to skip, and `share --revoke bob`
+  revoked nobody.
+- **`update --channel <name>` pins only a tag the registry has (A5).** Before, it never
+  wrote the pin at all.
+- **`update --no-install` restarts a tarball or nightly install.** That is the command
+  every nightly build prints for itself. On exactly those builds it stopped at "no
+  automatic update for this install" and exited 1, leaving the old shipper running old
+  code. It now restarts the daemons, runs any migration, and checks the schema; it needs
+  no channel.
+- **`update --no-install` (A6)** no longer prints "files updated", and it is no longer
+  refused on a project-dependency install.
+- **The epoch log line counts rows (A4).**
+- **Docs (A8): the host id is derived from the machine's own id**, as it has been since
+  0.18.6, so a reinstall keeps it. Stale prose about timestamps and `extra.turn` is fixed
+  too.
+
+## License notices
+
+**The dashboard now ships the license notices of what it bundles.** The built dashboard
+(`public/`) includes React, chart.js, lucide-react, react-markdown, tailwindcss and every
+other package it bundles. Their licenses (MIT, ISC) require the notice to travel with each
+copy, and minification strips it from the code.
+- `public/THIRD_PARTY_NOTICES.txt` is now generated at build time from the bundle's module
+  graph, and ships in the npm package.
+- CI fails a package that lacks it.
+
+Earlier published packages carried those copies without the notices.
+
+## Test infrastructure
+
+- **gentar kit v0.9.3 (#18).** In phase 1, `memhouse-house` is reported UNVERIFIED (bench
+  only) instead of being dry-run on the CI host.
+- **The suite tears down only a house it created.** It refuses to deploy over an existing
+  house, and a failed teardown fails it.
+- **`misc/skill-recipe.sh` runs the skills' queries verbatim, extracted from the docs.**
+  The fixture includes a superseded parse and a subagent block.
+
+## Pre-tag list (0.18.10 review): final status
+
+| item | where |
+|---|---|
+| A1 version bump | this release |
+| A2 `/mem:recall` queries | #22 |
+| A3 `HOUSE.md` subagent queries, epoch filter | #22 |
+| A4 epoch log count | #21 |
+| A5 `update --channel` validation | #21 |
+| A6 `--no-install` checks; switches swallowing values | #21 |
+| A7 upgrade-cost notes | #21, and this document |
+| A8 stale prose (ts, shrink, `extra` turn, host id) | #21 |
+| G4 `invite --url` and stored credentials (**security**) | #22 |
+| G26 skills' reference path | #22 |
+| G11 idle house's dashboard | #22 |
+| GLM-F1 unstamped subagent file | #21 |
+
+## Verification
+
+- **Unit tests:** `npm test` passes on main, 125 checks.
+- **CI:** green on ClickHouse 25.11 and 26.7.
+- **Matrices in a lab**, on ClickHouse 26.7.4.58 (production's version) and 26.7.1.1315.
+  They were run during #22 on main with #21 and #18 merged:
+  - skill recipe 18/18;
+  - invite 58/58;
+  - one-layout 62/62.
+- **Second looks:** agy (gemini-3.8-flash-high) on #21 and #22. Codex was at its daily
+  quota.
+- **Labs:** kept light, because arf's RAID is degraded. No live house was touched.