memhouse 0.18.10 → 0.18.12

package/docs/releases/v0.18.11.md

@@ -0,0 +1,187 @@
+# memhouse 0.18.11 — 2026-10-10
+
+This release does three things:
+
+- **Sessions with subagents stop re-shipping.** A Claude Code session that used subagents
+  now ships only its new rows. Before, it re-sent itself whole on every pass, and that was
+  most of the house's write load.
+- **A security fix.** `invite` no longer sends a stored credential to whatever `--url` is
+  typed on the command line.
+- **The 0.18.10 pre-tag list is finished**, and the gentar test kit is bumped.
+
+**No drill was run for this release; waived (2026-10-08) under the maintainer's 0.18.10 ruling. The drill runs before 0.19.0.**
+
+## Read this before upgrading
+
+**The first pass after the upgrade is a one-time bulk write.** It re-sends, whole and once,
+every stored session that has subagents; after that, those sessions ship only their new
+rows. Two things widen that first pass:
+
+- **Sessions whose subagents wrote recently.** A session whose subagent files are newer
+  than the house's record of it is read again even if it did not grow, because
+  `lastUpdatedAt` now counts subagent writes.
+- **Installs that share session files.** Two installs that ship the same session files
+  (two instances on one machine, or a synced directory) must be upgraded together. A
+  0.18.10 and a 0.18.11 number the same session differently, and each would fork it back
+  on every pass.
+
+**Where that write lands, and when to do it (2026-10-08):**
+
+- Upgrade together any installs that ship the same session files (above).
+- A house whose data disk sits on degraded storage: back it up first (data and access
+  storage), and upgrade its machines only once the disk is off the degraded array or the
+  array is repaired.
+- Any house on healthy storage can upgrade normally.
+
+```bash
+memhouse update        # then: memhouse status — every line a check mark
+```
+
+## Security
+
+### `invite` never sends a stored credential to `--url` (G4)
+
+`--url` is the invitee's address, typed on a command line. A typo, a tunnel, or somebody
+else's server received credentials it should never have seen:
+
+- the member's own credential, through the reachability probe and the read of its grants;
+- an admin credential the install keeps, through provisioning.
+
+The cause: `resolveConfig()` lets a flag outrank the env file, so the "configured house" URL
+the code used *was* `--url`.
+
+Now:
+
+- **A stored credential goes only to the house it was saved for.** That covers the
+  member's own, a `--keep-admin` admin, and a password read from the env file.
+- **`--url` gets an unauthenticated `/ping`**, only to confirm the invitee can reach it.
+- **An admin given for this command** (`--admin-user`, or an exported
+  `MEMHOUSE_ADMIN_USER`, with its password from a file, stdin, the environment or a prompt)
+  still provisions at `--url`. That is what the person typing the command asked for.
+- **`misc/invite-matrix.sh` points `--url` at a spy server** and asserts that it receives
+  nothing but a ping. On 0.18.10 the spy received two authenticated requests.
+
+**Action:**
+
+- If you ran `memhouse invite … --url <something unusual>` on 0.18.10 or earlier against a
+  host you do not control, rotate the member's password with `memhouse passwd`.
+- If an admin credential is kept in the env file and the same applies, rotate that too.
+
+## The re-ship fix (#21)
+
+Folded subagent rows were numbered by position, after the parent's turns. One new parent
+turn moved every one of them, so the session forked to a new epoch and was re-sent whole.
+Measured on a real house:
+
+- 1.07 M message rows written in 24 h, against 10.2 M in total;
+- one 6,120-line session stored 60 times in a day;
+- one member's house at about 19 M message rows for roughly 295 k real ones.
+
+What changed:
+
+- **Subagent rows get a numbering block of their own:**
+  `seq = 1,000,000,000 + slot × 100,000 + turn`, and the same for tool calls' `idx`.
+  `slot` is the subagent's rank by start time, so neither the parent growing, a subagent
+  growing, nor a new subagent appearing moves a stored row.
+- **A session without subagents is numbered exactly as before.**
+- **`seq` is sparse.** Count rows with `count()`, never `max(seq) + 1`.
+- **`ORDER BY seq` groups subagents.** Readers see the parent first, then each subagent's
+  turns together, in the order the subagents started. They used to be in agent-id order,
+  which is random.
+- **A parse too big for the blocks falls back to positional numbering:**
+  - a parent past 1e9 turns;
+  - a subagent past 100,000 turns;
+  - more than 32,949 subagents.
+
+  Positional numbering is correct, and merely re-ships whole as before.
+- **Subagent writes count as session activity.** A subagent that keeps running after its
+  parent goes quiet is shipped on the next pass.
+- **A subagent caught before its first line is written holds its session for one pass.**
+  It is then ranked by its real start time; it no longer ranks last and moves later. A
+  file that never gets a timestamped line stops holding the session after 10 minutes.
+- **Existing copies are not cleaned up.** Superseded epochs already in a house stay;
+  memhouse never deletes to make room. Reclaiming that space is a separate operator
+  decision, and no such cleanup may run on a house on degraded storage.
+
+## Also fixed
+
+- **The dashboard no longer goes empty on a quiet house (G11).** The stats tables carry a
+  one-day TTL and were refreshed only by passes that shipped something.
+  - The shipper now also refreshes them when the newest generation is over an hour old.
+  - The dashboard re-resolves its tables every five minutes, falling back to the live
+    rollup when a stats table is empty.
+- **The skills find their reference again (G26).** All five pointed at
+  `../reference/HOUSE.md`, a path that does not exist in the installed plugin; the file is
+  at `../../reference/HOUSE.md`.
+- **`/mem:recall`'s queries run (A2).**
+  - "Recent sessions" used a column the room does not have.
+  - The search now returns the `hit_seq` that the transcript read needs.
+  - The read takes its window by position, so the subagent blocks cannot break it.
+- **`HOUSE.md`'s subagent queries keep to the current parse (A3).** They used to double a
+  re-parsed session's subagent turns.
+- **An option that takes no value no longer swallows the next word (A6).**
+  `update --no-install yes` ran the install it was told to skip, and `share --revoke bob`
+  revoked nobody.
+- **`update --channel <name>` pins only a tag the registry has (A5).** Before, it never
+  wrote the pin at all.
+- **`update --no-install` restarts a tarball or nightly install.** That is the command
+  every nightly build prints for itself. On exactly those builds it stopped at "no
+  automatic update for this install" and exited 1, leaving the old shipper running old
+  code. It now restarts the daemons, runs any migration, and checks the schema; it needs
+  no channel.
+- **`update --no-install` (A6)** no longer prints "files updated", and it is no longer
+  refused on a project-dependency install.
+- **The epoch log line counts rows (A4).**
+- **Docs (A8): the host id is derived from the machine's own id**, as it has been since
+  0.18.6, so a reinstall keeps it. Stale prose about timestamps and `extra.turn` is fixed
+  too.
+
+## License notices
+
+**The dashboard now ships the license notices of what it bundles.** The built dashboard
+(`public/`) includes React, chart.js, lucide-react, react-markdown, tailwindcss and every
+other package it bundles. Their licenses (MIT, ISC) require the notice to travel with each
+copy, and minification strips it from the code.
+- `public/THIRD_PARTY_NOTICES.txt` is now generated at build time from the bundle's module
+  graph, and ships in the npm package.
+- CI fails a package that lacks it.
+
+Earlier published packages carried those copies without the notices.
+
+## Test infrastructure
+
+- **gentar kit v0.9.3 (#18).** In phase 1, `memhouse-house` is reported UNVERIFIED (bench
+  only) instead of being dry-run on the CI host.
+- **The suite tears down only a house it created.** It refuses to deploy over an existing
+  house, and a failed teardown fails it.
+- **`misc/skill-recipe.sh` runs the skills' queries verbatim, extracted from the docs.**
+  The fixture includes a superseded parse and a subagent block.
+
+## Pre-tag list (0.18.10 review): final status
+
+| item | where |
+|---|---|
+| A1 version bump | this release |
+| A2 `/mem:recall` queries | #22 |
+| A3 `HOUSE.md` subagent queries, epoch filter | #22 |
+| A4 epoch log count | #21 |
+| A5 `update --channel` validation | #21 |
+| A6 `--no-install` checks; switches swallowing values | #21 |
+| A7 upgrade-cost notes | #21, and this document |
+| A8 stale prose (ts, shrink, `extra` turn, host id) | #21 |
+| G4 `invite --url` and stored credentials (**security**) | #22 |
+| G26 skills' reference path | #22 |
+| G11 idle house's dashboard | #22 |
+| SUB-1 unstamped subagent file | #21 |
+
+## Verification
+
+- **Unit tests:** `npm test` passes on main, 125 checks.
+- **CI:** green on ClickHouse 25.11 and 26.7.
+- **Matrices in a lab**, on ClickHouse 26.7.4.58 (production's version) and 26.7.1.1315.
+  They were run during #22 on main with #21 and #18 merged:
+  - skill recipe 18/18;
+  - invite 58/58;
+  - one-layout 62/62.
+- **Second looks:** a second model reviewed #21 and #22.
+- **Labs:** kept light, because the lab host's RAID was degraded. No live house was touched.

package/docs/releases/v0.18.12.md

@@ -0,0 +1,59 @@
+# memhouse 0.18.12 — 2026-10-29
+
+A patch release on the 0.18 line. It does one thing for users:
+
+- **The `/mem` skills pre-approve read-only commands only.** Each skill's `allowed-tools`
+  now lists the memhouse read commands it teaches, instead of `Bash` as a whole.
+
+No drill was run for this patch release. Its one user-facing change is held by
+`misc/skill-allowlist-test.js`, which runs in `npm test`.
+
+## Upgrade
+
+```bash
+memhouse update        # refreshes the /mem skills wherever they are installed
+```
+
+Then reload the skills in Claude Code with `/reload-plugins`, or restart the session.
+
+If you upgraded with `npm install -g memhouse` instead, run `memhouse plugins install claude`
+once, so the installed skills match the package.
+
+Nothing else changes: same house layout, same schema, same daemons.
+
+## Changed
+
+### Skills: allowed tools restricted to read-only commands
+
+Each `/mem` skill's `allowed-tools` names the memhouse read commands it uses:
+
+| skill | runs without a prompt |
+|---|---|
+| `/mem:house` | `memhouse instance`, `whoami`, `status`, `stats`, `doctor`, and `share --list` (with or without `--json`) |
+| `/mem:recall` | `memhouse search`, `resume`, `sessions-query`, `status`, `whoami` |
+| `/mem:sql` | `memhouse sessions-query`, `stats`, `status`, `whoami` |
+| `/mem:access` | `memhouse whoami`, `status`, and `share --list` (with or without `--json`) |
+| `/mem:admin` | `memhouse whoami`, `status`, `instance` |
+
+Any other command goes through Claude Code's normal permission prompt, as does a read
+command with another command chained to it. Expect a prompt where a skill used to run a
+command without one; approve it as you would any other command.
+
+## Repository and tests
+
+These do not change the installed package's behaviour:
+
+- `misc/skill-allowlist-test.js` keeps every skill's `allowed-tools` to read-only memhouse
+  commands. It joins `npm test`.
+- The test tooling's deploy targets (lab address, test machine, engine checkout) are read
+  from an untracked `deploy/targets.env`. `deploy/targets.example.env` shows the shape.
+- Test fixtures, examples, drill records and docs use stand-in names, hosts and paths.
+  `misc/env-guard-test.js` checks tracked files for real environment values, and it joins
+  `npm test`.
+- Security reports go through GitHub's private vulnerability reporting (`SECURITY.md`).
+- The 0.18 line is now cut from the `release/0.18` branch. `AGENTS.md` and
+  `misc/publish-guard.js` say so.
+
+## Deferred
+
+Nothing new. Later work ships on the current line's next release.

package/docs/tutorials/01-first-house.md

@@ -41,8 +41,8 @@ This does four things:
 1. It starts ClickHouse in a container bound to `127.0.0.1:8123`, so only this machine
    can reach it. The data lives in a named volume.
 2. It creates two users. `memhouse_root` administers the house. A **member** named after
-   your OS user (`polat`, say) ships your sessions, and holds one grant: `mem.polat_*`.
-   Your rooms are `mem.polat_sessions`, `mem.polat_messages`, `mem.polat_tool_calls`, and
+   your OS user (`sam`, say) ships your sessions, and holds one grant: `mem.sam_*`.
+   Your rooms are `mem.sam_sessions`, `mem.sam_messages`, `mem.sam_tool_calls`, and
    so on.
 3. It writes both credentials to `~/.memhouse/env`, mode 600. A local house is the one
    case where the admin credential is kept, so that `memhouse invite` works later with

package/editors/claude.js

@@ -7,7 +7,7 @@ const HOME = os.homedir();
 
 // Discover all Claude Code config roots — ports memory-house agent-sync's
 // discover_roots("claude-code"). Claude sessions don't live only under ~/.claude:
-// every CLAUDE_CONFIG_DIR (e.g. Kommander playbook installs under
+// every CLAUDE_CONFIG_DIR (e.g. playbook installs under
 // ~/.claude-playbooks/<name>[/playbook]) has its own projects/ dir. A dir qualifies
 // as a root if it holds a projects/ subdir or a history.jsonl. Deduped by realpath.
 function discoverClaudeRoots() {
@@ -60,7 +60,7 @@ function getChats() {
       const dir = path.join(PROJECTS_DIR, projDir);
       try { if (!fs.statSync(dir).isDirectory()) continue; } catch { continue; }
 
-    // Decode folder path from dir name (e.g. -Users-fka-Code-foo -> /Users/fka/Code/foo)
+    // Decode folder path from dir name (e.g. -Users-user-Code-foo -> /Users/user/Code/foo)
     const decodedFolder = projDir.replace(/-/g, '/');
 
     // Read sessions-index.json for indexed sessions
@@ -74,13 +74,18 @@ function getChats() {
     } catch { /* no index */ }
 
     // Scan all .jsonl files on disk (some may not be in the index)
-    let files;
-    try { files = fs.readdirSync(dir).filter(f => f.endsWith('.jsonl')); } catch { continue; }
+    let names;
+    try { names = fs.readdirSync(dir); } catch { continue; }
+    const files = names.filter(f => f.endsWith('.jsonl'));
+    // A session with subagents also has a directory named for it; one without has none, so
+    // this listing is how the mtime check below stays free for the sessions it cannot help.
+    const sessionDirs = new Set(names.filter(f => !f.endsWith('.jsonl')));
 
     for (const file of files) {
       const sessionId = file.replace('.jsonl', '');
       const fullPath = path.join(dir, file);
       const entry = indexed.get(sessionId);
+      const subTouched = sessionDirs.has(sessionId) ? newestSubagentMtime(path.join(dir, sessionId, 'subagents')) : 0;
 
       if (entry) {
         // Use index metadata
@@ -89,7 +94,7 @@ function getChats() {
           composerId: sessionId,
           name: cleanPrompt(entry.firstPrompt),
           createdAt: entry.created ? new Date(entry.created).getTime() : null,
-          lastUpdatedAt: entry.modified ? new Date(entry.modified).getTime() : null,
+          lastUpdatedAt: latest(entry.modified ? new Date(entry.modified).getTime() : null, subTouched),
           mode: 'claude',
           folder: entry.projectPath || decodedFolder,
           encrypted: false,
@@ -107,7 +112,7 @@ function getChats() {
             composerId: sessionId,
             name: meta.firstPrompt ? cleanPrompt(meta.firstPrompt) : null,
             createdAt: meta.timestamp || stat.birthtime.getTime(),
-            lastUpdatedAt: stat.mtime.getTime(),
+            lastUpdatedAt: latest(stat.mtime.getTime(), subTouched),
             mode: 'claude',
             folder: meta.cwd || decodedFolder,
             encrypted: false,
@@ -195,7 +200,7 @@ function cleanPrompt(prompt) {
 // Parse one Claude session .jsonl into the adapter's message shape. When
 // `isSubagent` is set, each message is tagged `[subagent]` so folded subagent turns
 // are clearly attributed in the transcript.
-function parseSessionFile(filePath, isSubagent, agent = null) {
+function parseSessionFile(filePath, isSubagent, agent = null, info = null) {
   const messages = [];
   let lines;
   try { lines = fs.readFileSync(filePath, 'utf-8').split('\n').filter(Boolean); } catch { return messages; }
@@ -205,7 +210,9 @@ function parseSessionFile(filePath, isSubagent, agent = null) {
   // cited, or told apart from a sibling's. An agent looking for the fork as its own session
   // concluded it was never shipped. Every turn now carries the agent's id, the description
   // the parent gave it, and its position within that subagent — in `extra`, which is not
-  // part of the line hash, so nothing already shipped is re-shipped for this.
+  // part of the line hash. The position is not only a label any more: the shipper numbers
+  // a subagent's rows from it (seq = block + turn, see subagentSeq in ship.js), so `turn`
+  // must count exactly the turns this parse keeps, in order.
   let turn = 0;
   const stamp = (m) => { if (agent) { m._agent = { ...agent, turn: turn++ }; } return m; };
 
@@ -228,6 +235,7 @@ function parseSessionFile(filePath, isSubagent, agent = null) {
     // time simply omit it.
     const _ts = obj.timestamp ? Date.parse(obj.timestamp) : undefined;
     const at = Number.isFinite(_ts) ? _ts : undefined;
+    if (info && info.firstTs === undefined && at !== undefined) info.firstTs = at;
 
     if (obj.type === 'user' && obj.message) {
       const content = extractContent(obj.message.content);
@@ -249,6 +257,10 @@ function parseSessionFile(filePath, isSubagent, agent = null) {
   return messages;
 }
 
+// How long a subagent transcript without a single timestamped line may hold back its
+// session (see getMessages). A real one gets its first line within seconds.
+const SUBAGENT_STAMP_GRACE_MS = 10 * 60 * 1000;
+
 function getMessages(chat) {
   const filePath = chat._fullPath;
   if (!filePath || !fs.existsSync(filePath)) return [];
@@ -262,30 +274,76 @@ function getMessages(chat) {
   const subagentsDir = path.join(filePath.replace(/\.jsonl$/, ''), 'subagents');
   const subFiles = subagentFiles(subagentsDir);
   const named = subFiles.length ? subagentNames(filePath) : new Map();
+  const folded = [];
+  let unstamped = null;
   for (const { file, workflow } of subFiles) {
     const id = path.basename(file).replace(/^agent-/, '').replace(/\.jsonl$/, '');
     const meta = named.get(id) || {};
     const agent = { id, description: meta.description || '', type: meta.type || (workflow ? 'workflow-subagent' : ''), file: path.basename(file) };
     if (workflow) agent.workflow = workflow;
-    const turns = parseSessionFile(file, true, agent);
+    const info = {};
+    const turns = parseSessionFile(file, true, agent, info);
     // A fork the parent never named (a Workflow-run agent, or a parent from before the
     // ids were reported) is described by its own first prompt — what it was told to do.
     if (!agent.description) {
       const first = turns.find((m) => m.role === 'user');
       if (first) { const d = String(first.content).replace(/^\[subagent\] /, '').replace(/\s+/g, ' ').trim().slice(0, 160); for (const m of turns) m._agent.description = d; }
     }
-    messages.push(...turns);
+    folded.push({ key: path.relative(subagentsDir, file), firstTs: info.firstTs, turns });
+    // A subagent caught before its first line is written has no start time, so it ranks
+    // last — and when its first line lands with an EARLIER timestamp than a sibling's, it
+    // moves, renumbers every sibling after it, and the session forks and re-ships whole
+    // (SUB-1). So a fresh one defers the whole session to the next pass, when it has a
+    // time. Bounded by age: a file that never gets a timestamped line stops deferring after
+    // SUBAGENT_STAMP_GRACE_MS and ranks last, as before.
+    if (info.firstTs === undefined && !unstamped) {
+      let age = Infinity;
+      try { age = Date.now() - fs.statSync(file).mtimeMs; } catch { /* gone: nothing to wait for */ }
+      if (age < SUBAGENT_STAMP_GRACE_MS) unstamped = path.relative(subagentsDir, file);
+    }
+  }
+  // Each subagent gets a SLOT, and the shipper numbers its rows from that slot rather than
+  // from where they happen to land in this array (see subagentSeq in ship.js). The slot is
+  // the subagent's rank by when it started — the timestamp on its transcript's first line —
+  // because that is the one order a new subagent cannot disturb: it started after every
+  // subagent already on disk, so it ranks last. The file-name order this used to fold in
+  // does not have that property: agent ids are random, so a new fork sorted into the middle
+  // and pushed every later subagent's rows down, and a session with subagents re-shipped
+  // whole on every pass (one 6,120-line session was stored 60 times in a day). A file with
+  // no timestamp yet ranks after every one that has one; the path breaks ties.
+  folded.sort((a, b) => (a.firstTs === undefined) - (b.firstTs === undefined)
+    || (a.firstTs || 0) - (b.firstTs || 0) || (a.key < b.key ? -1 : a.key > b.key ? 1 : 0));
+  folded.forEach(({ turns }, slot) => { for (const m of turns) m._agent.slot = slot; messages.push(...turns); });
+  if (unstamped) {
+    Object.defineProperty(messages, '_defer', { value: `subagent ${unstamped} has no timestamped line yet`, enumerable: false });
   }
 
   return messages;
 }
 
+/**
+ * When a session was last written, counting its subagents. The shipper's incremental skip
+ * compares `lastUpdatedAt` with what the house recorded, and a subagent writes only its own
+ * file: a background agent that runs on after its parent goes quiet left the parent's mtime
+ * (and the index's `modified`) where they were, so its turns shipped at the parent's next
+ * write, or never. Stat calls only, and only for a session that has a directory.
+ */
+function newestSubagentMtime(subagentsDir) {
+  let newest = 0;
+  for (const { file } of subagentFiles(subagentsDir)) {
+    try { newest = Math.max(newest, fs.statSync(file).mtimeMs); } catch { /* vanished mid-pass */ }
+  }
+  return Math.floor(newest);
+}
+function latest(a, b) { return b && (!a || b > a) ? b : a; }
+
 /**
  * Every subagent transcript under a session, wherever Claude Code put it:
  *   <session>/subagents/agent-<id>.jsonl                       — Agent tool forks
  *   <session>/subagents/workflows/wf_<id>/agent-<id>.jsonl     — Workflow-run agents
- * journal.jsonl and *.meta.json are bookkeeping, not transcripts. Sorted for a stable
- * fold order. On real data the workflow layer held 100 of 165 forks and shipped none.
+ * journal.jsonl and *.meta.json are bookkeeping, not transcripts. Sorted so the listing is
+ * deterministic; the fold ORDER is set by start time in getMessages, not by this.
+ * On real data the workflow layer held 100 of 165 forks and shipped none.
  */
 function subagentFiles(subagentsDir) {
   const out = [];

package/editors/cursor-agent.js

@@ -13,7 +13,7 @@ const name = 'cursor-agent';
 
 /**
  * Decode project directory name back to folder path.
- * e.g. "Users-fka-Code-Wapple" → "/Users/fka/Code/Wapple"
+ * e.g. "Users-user-Code-myapp" → "/Users/user/Code/myapp"
  */
 function decodeProjectDir(dirName) {
   // The encoding replaces "/" with "-". We reconstruct by prepending "/"

package/examples/01-local-one-machine/README.md

@@ -46,8 +46,8 @@ Trimmed from a run on a Linux VM with Docker, ClickHouse 26.7 and memhouse 0.18.
 == 1. a house: ClickHouse in a container, bound to loopback, plus the install
   ✓ ClickHouse starting via docker on http://localhost:8123 (loopback only)
   ✓ ClickHouse ready
-  ✓ member 'polat' holds mem.polat_* and nothing else; 'memhouse_root' administers the house
-  ✓ rooms for 'polat': polat_sessions, polat_messages, polat_tool_calls
+  ✓ member 'sam' holds mem.sam_* and nothing else; 'memhouse_root' administers the house
+  ✓ rooms for 'sam': sam_sessions, sam_messages, sam_tool_calls
   ✓ installed
   ✓ shipper started in the background (pid 617049) — loading your history now
 
@@ -55,10 +55,10 @@ Trimmed from a run on a Linux VM with Docker, ClickHouse 26.7 and memhouse 0.18.
 [memhouse] shipped 2 sessions (0 skipped) → 6 msg rows, 2 tool rows in 0.7s
 
 == 3. what the house holds
-  ✓ connected: http://localhost:8123 / mem as polat
+  ✓ connected: http://localhost:8123 / mem as sam
   ✓ house: 2 sessions, 6 messages (freshest ingest 2026-10-07 21:08:06 UTC)
   ✓ fleet: 1 active writer(s)
-     polat@testbed-7edeca38       0.18.9   last ship 0m ago
+     sam@linux-vm-1f2e3d4c        0.18.9   last ship 0m ago
   ✓ shipper: running — daemon (pid 617049)
 
 == 4. find a past conversation

package/examples/02-existing-clickhouse/README.md

@@ -74,10 +74,10 @@ Trimmed from a run against ClickHouse 26.7.1.1315 with memhouse 0.18.9 (the test
   credential from: MEMHOUSE_ADMIN_* environment
   may create users:    yes
 
-== 2. install: build member 'polat' with the admin credential, then verify as the member
-  ✓ created ClickHouse user 'polat'
-  ✓ granted 'polat' mem.polat_* — their rooms and nothing else; async_insert pinned
-  ✓ verified as 'polat' with the member credential
+== 2. install: build member 'sam' with the admin credential, then verify as the member
+  ✓ created ClickHouse user 'sam'
+  ✓ granted 'sam' mem.sam_* — their rooms and nothing else; async_insert pinned
+  ✓ verified as 'sam' with the member credential
   ✓ installed
   the admin credential was used for this install and not saved. To invite later:
      with-secret MEMHOUSE_ADMIN_PASSWORD=<reference> -- memhouse invite <name> --url … --admin-user admin
@@ -87,7 +87,7 @@ Trimmed from a run against ClickHouse 26.7.1.1315 with memhouse 0.18.9 (the test
 [memhouse] shipped 2 sessions (0 skipped) → 6 msg rows, 2 tool rows in 0.2s
 
 == 4. whoami: the credential this machine keeps, and what it may do
-  ✓ polat at https://ch.example.com:8443 — member
+  ✓ sam at https://ch.example.com:8443 — member
   may create users:    no
 
 == 5. status
@@ -108,8 +108,8 @@ Deletes the example's home. The member and its rooms stay in the house: dropping
 an administrator's decision. As the admin:
 
 ```sql
-DROP USER polat;
--- then each of mem.polat_sessions, _messages, _tool_calls, _meta, _events,
+DROP USER sam;
+-- then each of mem.sam_sessions, _messages, _tool_calls, _meta, _events,
 -- _session_stats, _session_model_stats, _session_tool_stats
 ```
 

package/memhouse/DESIGN.md

@@ -134,8 +134,15 @@ Config file: `~/.memhouse/config.json` (`hiddenProjects`, future prefs).
 - Per-message `ts`: interpolated across the session's `[createdAt, lastUpdatedAt]`
   (adapters don't expose per-message timestamps; monotonic by `seq`; documented
   approximation, refine per-adapter later).
-- `seq` is the message index within the session (0-based). `tool_calls.idx` is the
-  call index within the session. `is_subagent` = message content begins with
+- `seq` is the message's place in the session. The session's own turns are dense from 0;
+  a folded subagent's turns are numbered from their own block,
+  `1,000,000,000 + slot × 100,000 + turn`, where `slot` is the subagent's rank by start
+  time. `tool_calls.idx` is laid out the same way (the session's own calls dense from 0,
+  a subagent's counted within its block). A row's key therefore never depends on how long
+  the parent or any other subagent is, which is what lets a session with subagents ship
+  tail-only; positional numbering moved every subagent row whenever the parent grew. A
+  parse that does not fit the blocks falls back to positional numbering. Readers order by
+  `seq` and count with `count()`; nothing may treat `seq` as dense. `is_subagent` = message content begins with
   `[subagent]` (the fold marker from the Claude adapter).
 - Incremental shipping: read existing `(session_id, last_updated_at, message_count)`
   (FINAL) and skip chats that haven't grown/changed; a full re-ship must remain

package/memhouse/RESUME-AND-UPDATE.md

@@ -136,7 +136,7 @@ the supervisor's own restart line.
 ### The gap
 
 Nothing tells a running daemon that its files were replaced. `status` prints the version of
-the CLI you just typed, not the version the daemon is executing. On macminim a shipper ran
+the CLI you just typed, not the version the daemon is executing. On one machine a shipper ran
 **1d16h** out of a directory that had been moved.
 
 ### Why not `postinstall`

package/memhouse/capabilities.js

@@ -9,7 +9,7 @@
 //
 // SCOPE IS THE WHOLE POINT. A grant is `GRANT <privileges> ON <scope> TO <user>`, and a
 // privilege only means what its scope allows: an ordinary member holds CREATE DATABASE
-// inside `ON polat.*`, which lets them do nothing whatsoever about creating a NEW
+// inside `ON sam.*`, which lets them do nothing whatsoever about creating a NEW
 // database. Matching the privilege name anywhere in the text — which an earlier draft of
 // this did — reads that member as a server administrator. So parse the line, keep the
 // scope, and only count a privilege that is granted server-wide.

package/memhouse/convert.js

@@ -1,8 +1,8 @@
 // Convert a pre-one-layout house to the one layout — the plan, as SQL, pure.
 //
-// Before 0.18 every member owned a DATABASE named for them: `polat.messages`,
-// `polat.house_meta`, granted ALL ON polat.*. The one layout puts everyone in one database
-// as `mem.polat_messages`, `mem.polat_meta`, with one wildcard grant and nothing on the
+// Before 0.18 every member owned a DATABASE named for them: `sam.messages`,
+// `sam.house_meta`, granted ALL ON sam.*. The one layout puts everyone in one database
+// as `mem.sam_messages`, `mem.sam_meta`, with one wildcard grant and nothing on the
 // database itself. Moving is a RENAME per table — metadata only, nothing copied — plus the
 // grant swap, and shares re-expressed on the new names. The 0.17.1 dashboard views are
 // dropped: in the one layout the shipper fills the stat tables (a refreshable view needs

package/memhouse/delivery/PROMPT.md

@@ -79,6 +79,6 @@ the retained epochs are the only place that content still exists.
   when the user may want to dig deeper.
 - Other users' HOUSES (other databases on the same server) are readable only when
   shared with this credential (`/mem:access` on their side). Query a shared house by
-  qualified names — `polat.messages` — with the same CUR filter. An empty result
+  qualified names — `sam.messages` — with the same CUR filter. An empty result
   means "nothing visible", not "nothing ever happened".
 - Do not paste credentials from `{{ENV_FILE}}` into responses, commits, or logs.

package/memhouse/delivery/plugin/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "mem",
   "description": "Conversation memory for AI agents over the memhouse typed ClickHouse store: recall past sessions and answer from them, run analytics, check the house, bring people in, and administer the server. Skills install as /mem:recall, /mem:sql, /mem:house, /mem:access, and /mem:admin.",
-  "version": "0.18.10",
+  "version": "0.18.12",
   "author": {
     "name": "Ramazan Polat"
   },

package/memhouse/delivery/plugin/reference/HOUSE.md

@@ -73,8 +73,8 @@ server, not by discipline.
 
 **The `sed` is what makes every query below work in both layouts** — write room names
 bare and it supplies the prefix when there is one. It rewrites only after `FROM`/`JOIN`,
-so a needle like `LIKE '%messages%'` is untouched, and `FROM yigit_messages` is left
-alone — the room name must follow whitespace, and there is none inside `yigit_messages`.
+so a needle like `LIKE '%messages%'` is untouched, and `FROM bob_messages` is left
+alone — the room name must follow whitespace, and there is none inside `bob_messages`.
 With no prefix set it expands to nothing and the query passes through verbatim.
 
 It is spelled with `[[:space:]]` classes rather than `\b` because **BSD `sed` does not
@@ -84,7 +84,7 @@ which is the right way round — but it fails.
 
 **Reading a housemate's memory.** A share is `GRANT SELECT ON mem.<them>_*` — their
 rooms, not the database. `SHOW TABLES` lists exactly what you may read: your own rooms plus
-any shared with you. Name a housemate's rooms in full (`FROM yigit_messages`); the `q()`
+any shared with you. Name a housemate's rooms in full (`FROM bob_messages`); the `q()`
 rewrite leaves an already-prefixed name alone, since applying yours would point at the
 wrong rooms. Say whose memory an answer came from.
 
@@ -101,23 +101,35 @@ session finds nothing — look inside the parent:
 ```sql
 -- the subagents a session spawned
 SELECT toString(extra.agent.id) AS agent, any(toString(extra.agent.description)) AS asked_to, count() AS turns
-FROM messages WHERE session_id = '<sid>' AND is_subagent GROUP BY agent   -- toString: a JSON path cannot be a GROUP BY key
+FROM messages FINAL
+WHERE session_id = '<sid>' AND user_id = '<uid>' AND is_subagent
+  AND (origin != 'ship' OR epoch = (SELECT max(epoch) FROM messages
+       WHERE session_id = '<sid>' AND user_id = '<uid>' AND origin = 'ship'))
+GROUP BY agent   -- toString: a JSON path cannot be a GROUP BY key
 -- one subagent's transcript, in order
-SELECT seq, role, substring(text, 1, 2000) FROM messages
-WHERE session_id = '<sid>' AND extra.agent.id = '<agent>' ORDER BY seq
+SELECT seq, role, substring(text, 1, 2000) AS text FROM messages FINAL
+WHERE session_id = '<sid>' AND user_id = '<uid>' AND toString(extra.agent.id) = '<agent>'
+  AND (origin != 'ship' OR epoch = (SELECT max(epoch) FROM messages
+       WHERE session_id = '<sid>' AND user_id = '<uid>' AND origin = 'ship'))
+ORDER BY seq
 ```
 
+Both carry the current-epoch filter (trap 1 below). A session whose subagents were
+re-parsed holds every parse, so an unfiltered count doubles each subagent's turns, and an
+unfiltered transcript repeats them. `<uid>` is the session's `user_id`, from whatever
+query found it (trap 2).
+
 **`messages`** — one row per turn.
 
 | column | meaning |
 |---|---|
 | `session_id` | `<source>:<adapter-local id>`, e.g. `claude-code:6b1f…` |
-| `seq` | position in the session, from 0 |
+| `seq` | order within the session. The session's own turns are `0, 1, 2, …`; a subagent's turns sit in their own block, `1,000,000,000 + slot × 100,000 + turn` (slot = the subagent's rank by start time), so `seq` is **sparse** — count rows with `count()`, never `max(seq) + 1` |
 | `source` | editor: `claude-code`, `codex`, `cursor`, … |
-| `host` | the machine, `<hostname>-<8 hex>` — random per install, not derived |
+| `host` | the machine, `<hostname>-<8 hex>` — the 8 hex are derived from the OS machine id (random only where none can be read), so a reinstall keeps it and same-named machines differ |
 | `ts` | when the turn happened (`DateTime64(3,'UTC')`) |
 | `role` | `user`, `assistant`, `system` |
-| `is_subagent` | 1 for a turn that a Claude Code **subagent** (a fork) produced; folded into the parent session after the parent's own turns. Subagents are never separate sessions. |
+| `is_subagent` | 1 for a turn that a Claude Code **subagent** (a fork) produced; folded into the parent session after the parent's own turns, each subagent's turns contiguous and the subagents in the order they started. Subagents are never separate sessions. |
 | `extra` | JSON. For a subagent turn: `extra.agent.id`, `extra.agent.description` (what the parent asked it to do, else the fork's own first prompt), `extra.agent.type` (`general-purpose`, `workflow-subagent`, …), `extra.agent.turn` (position within that subagent), and `extra.agent.workflow` (`wf_…`) when a Workflow run spawned it. Empty `{}` otherwise, and on rows shipped before 0.18.3. |
 | `model`, `input_tokens`, `output_tokens`, `cache_read_tokens`, `cache_write_tokens` | usage; **empty for several adapters** — see below |
 | `text` | the turn, **truncated at 50,000 chars** |