memhouse 0.18.12 → 0.20.1

package/bin/memhouse.js

@@ -28,14 +28,19 @@ const {
   SCHEMA_VERSION, MIN_WRITER_SCHEMA, MIGRATIONS, META_TYPES, createStatement,
 } = require(path.join(REPO_ROOT, 'memhouse', 'house', 'house'));
 const envfile = require(path.join(REPO_ROOT, 'memhouse', 'envfile'));
+const schemaChoice = require(path.join(REPO_ROOT, 'memhouse', 'house', 'schema-choice'));
 const chan = require(path.join(REPO_ROOT, 'memhouse', 'channel'));
 const { consumeSecretChunk } = require(path.join(REPO_ROOT, 'memhouse', 'secret-input'));
 const { capabilitiesFrom } = require(path.join(REPO_ROOT, 'memhouse', 'capabilities'));
 const { unknownFlags, allowedFlags, suggestFlag } = require(path.join(REPO_ROOT, 'memhouse', 'flags'));
+const dashAuth = require(path.join(REPO_ROOT, 'memhouse', 'server', 'dashboard-auth'));
+const dashPort = require(path.join(REPO_ROOT, 'memhouse', 'server', 'dashboard-port'));
 
 const HOME_DIR = process.env.MEMHOUSE_HOME || path.join(os.homedir(), '.memhouse');
 const ENV_FILE = path.join(HOME_DIR, 'env');
 const RUN_DIR = path.join(HOME_DIR, 'run');
+// How long an invite's password works unless --expires says otherwise.
+const INVITE_DAYS = 7;
 const LOG_DIR = path.join(HOME_DIR, 'logs');
 
 // ── args ────────────────────────────────────────────────────────────────────────
@@ -45,6 +50,18 @@ const rest = cmd ? argv.slice(1) : argv;
 const { flags, positional } = require(path.join(REPO_ROOT, 'memhouse', 'flags')).parseArgv(rest);
 const JSON_OUT = flags.json === true;
 
+// An admin password on argv is in `ps` while the command runs and in shell history after it.
+// Deprecated in 0.18.10 and removed in 0.20.0: refused here, before any command reads it,
+// with the ways that keep it off the command line. The value is never echoed.
+if (flags['admin-password'] !== undefined) {
+  const { SAFE_FORMS } = require(path.join(REPO_ROOT, 'memhouse', 'admin-secret'));
+  console.error('memhouse: --admin-password on the command line was removed in 0.20.0: it shows in `ps` and in shell history.');
+  console.error('  Give the admin password one of these ways:');
+  for (const l of SAFE_FORMS) console.error(l);
+  console.error('  Nothing ran.');
+  process.exit(2);
+}
+
 // Unknown flags stop the run — see memhouse/flags.js for why a shrug is not enough.
 (() => {
   const bad = unknownFlags(cmd, flags);
@@ -61,6 +78,42 @@ const JSON_OUT = flags.json === true;
   process.exit(2);
 })();
 
+// The other passwords a command takes (--password, --member-password, --to-password): a
+// --<flag>-file or an environment value becomes the flag the command reads; a value given on
+// argv still works in 0.20, with a warning on every run. memhouse/argv-secrets.js.
+// SECRETS_ON_ARGV: which of them were typed on the command line, as opposed to filled in.
+let SECRETS_ON_ARGV = new Set();
+try {
+  const r = require(path.join(REPO_ROOT, 'memhouse', 'argv-secrets')).intake(flags, { cmd });
+  for (const w of r.warnings) console.error(`memhouse: ⚠ ${w}`);
+  SECRETS_ON_ARGV = new Set(r.fromArgv);
+} catch (e) {
+  console.error(`memhouse: ${e.message}`);
+  console.error('  Nothing ran.');
+  process.exit(2);
+}
+
+// A new minor version's first run here says so, once, with its release notes
+// (memhouse/version-notice.js). stderr only, like the skills refresh below. It runs first: it reads
+// the version that refresh records (skills-checked) before the refresh moves it.
+require(path.join(REPO_ROOT, 'memhouse', 'version-notice')).checkVersionNotice({
+  home: process.env.MEMHOUSE_HOME || path.join(os.homedir(), '.memhouse'),
+  version: require(path.join(REPO_ROOT, 'package.json')).version, repoRoot: REPO_ROOT,
+  log: (l) => console.error(`memhouse: ${l.replace(os.homedir(), '~')}`),
+});
+// A new version's first run refreshes the /mem skills bound to this home (an npm upgrade does
+// not run `update`, which used to be the only refresh). After that, one stamp read per call.
+// stderr only, so --json output stays clean. memhouse/plugin-copies.js.
+{
+  const r = require(path.join(REPO_ROOT, 'memhouse', 'plugin-copies')).refreshIfStale({
+    home: process.env.MEMHOUSE_HOME || path.join(os.homedir(), '.memhouse'),
+    version: require(path.join(REPO_ROOT, 'package.json')).version,
+    deliveryDir: path.join(REPO_ROOT, 'memhouse', 'delivery'), repoRoot: REPO_ROOT,
+    log: (l) => console.error(`memhouse: ${l.replace(os.homedir(), '~')}`),
+  });
+  for (const e of r.errors) console.error(`memhouse: could not refresh the /mem skills: ${e} — run: memhouse plugins install claude`);
+}
+
 let ONBOARDING = false;
 let _inviteFileToShred = null;
 let _inviteWantsRotate = false;
@@ -70,6 +123,12 @@ function readEnvFile() {
   try { return envfile.parse(fs.readFileSync(ENV_FILE, 'utf-8')); } catch { return {}; }
 }
 
+function passwordFromFile(f) {
+  if (!f) return '';
+  try { return fs.readFileSync(String(f).replace(/^~(?=$|\/)/, os.homedir()), 'utf-8').replace(/\r?\n$/, ''); }
+  catch (e) { console.error(warn(`MEMHOUSE_PASSWORD_FILE ${f}: ${e.code || e.message} — no password read`)); return ''; }
+}
+
 function resolveConfig() {
   const file = readEnvFile();
   const pick = (flag, env, dflt) => flags[flag] !== undefined && flags[flag] !== true
@@ -79,7 +138,11 @@ function resolveConfig() {
   return {
     url: pick('url', 'MEMHOUSE_URL', 'http://localhost:8123'),
     user: pick('user', 'MEMHOUSE_USER', 'memhouse_root'),
-    password: pick('password', 'MEMHOUSE_PASSWORD', ''),
+    // MEMHOUSE_PASSWORD_FILE: the password by reference (a root/owner-only
+    // file) — read only when no password is given directly. Never written back anywhere.
+    password: pick('password', 'MEMHOUSE_PASSWORD', '') || passwordFromFile(process.env.MEMHOUSE_PASSWORD_FILE ?? file.MEMHOUSE_PASSWORD_FILE),
+    // Remembered so a rewrite of the env file keeps the REFERENCE and never inlines the value.
+    passwordFile: pick('password', 'MEMHOUSE_PASSWORD', '') ? '' : (process.env.MEMHOUSE_PASSWORD_FILE ?? file.MEMHOUSE_PASSWORD_FILE ?? ''),
     // The house defaults to the USER'S OWN NAME (`sam` ships into `sam.messages`),
     // because a house is a database and the natural first house is your own. Any name
     // works — user 'alice' with house 'default' is a supported pairing.
@@ -92,20 +155,34 @@ function resolveConfig() {
     // invite/members need no --admin-* flags. Absent on an invited member's machine, and
     // nothing here invents one.
     adminUser: pick('admin-user', 'MEMHOUSE_ADMIN_USER', ''),
-    adminPassword: pick('admin-password', 'MEMHOUSE_ADMIN_PASSWORD', ''),
+    // Never from a flag: --admin-password is refused at startup (memhouse/admin-secret.js).
+    adminPassword: process.env.MEMHOUSE_ADMIN_PASSWORD ?? file.MEMHOUSE_ADMIN_PASSWORD ?? '',
     // What this install ships — editors/scope.js. Empty means everything on the machine.
     editors: pick('editors', 'MEMHOUSE_EDITORS', ''),
     claudeRoots: pick('claude-roots', 'MEMHOUSE_CLAUDE_ROOTS', ''),
     // The npm dist-tag `memhouse update` follows. Empty = inferred from the installed
     // version (memhouse/channel.js). Set for a house on a build that is not `latest`.
     channel: pick('channel', 'MEMHOUSE_CHANNEL', ''),
+    // Which tables this install reads and writes: '3' = harness-sessions-sql's profile (sessions,
+    // session_parts, session_usage, session_links, session_lifecycle, calls + the capture
+    // archive's session_units and session_sources); anything
+    // else = the 0.18 rooms. Persisted in the env file, so every child — shipper, dashboard,
+    // service unit — and every later command agree on it.
+    schema: pick('schema', 'MEMHOUSE_SCHEMA', ''),
+    // What the schema-3 capture reads. Empty = the machine's default (memhouse/shipper/
+    // source-roots.js: the same Claude Code and Codex dirs the 0.18 shipper reads).
+    sourceRoots: pick('source-roots', 'MEMHOUSE_SOURCE_ROOTS', ''),
     // Did anything actually SAY which house this is, or are the values above just the
     // defaults? The defaults are not neutral — localhost:8123 as memhouse_root is a real
-    // house on a lot of machines, usually the pilot's own. An agent whose config went
+    // house on a lot of machines, usually the user's own. An agent whose config went
     // missing (a temp HOME, a deleted env file, a service running as another user) would
     // otherwise connect there and read or write someone else's memory, silently and with
     // a plausible-looking result. Commands that expect YOUR house call requireConfig().
     stated: stated('url', 'MEMHOUSE_URL') || stated('user', 'MEMHOUSE_USER'),
+    // The two apart: an admin step needs the URL said, and takes the member names as its
+    // credential only when they were said (adminStepConfig), never the memhouse_root default.
+    urlStated: stated('url', 'MEMHOUSE_URL'),
+    userStated: stated('user', 'MEMHOUSE_USER'),
   };
 }
 
@@ -136,6 +213,47 @@ function requireConfig(cfg, what) {
   process.exit(2);
 }
 
+/** This machine's `host` in the install's own layout: sessions-model/host/v0 on schema 3 (what
+ * the capture writes, MEMHOUSE_HOST_ID first, as there), the 0.18 identity on the rooms. */
+function machineHost(cfg) {
+  const H = require(path.join(REPO_ROOT, 'memhouse', 'host.js'));
+  if (!isV3(cfg)) return H.identity(HOME_DIR);
+  return { id: process.env.MEMHOUSE_HOST_ID || H.sessionsHost(), label: H.hostLabel(), renamed: false };
+}
+
+/** Is this install on schema 3? Only the literal '3' — anything else is the 0.18 rooms. */
+function isV3(cfg) { return String(cfg && cfg.schema) === '3'; }
+
+/** The HTTP transport the schema-3 reads use (memhouse/house/q-cli.js): never `final=1`. */
+function v3Transport(cfg, { timeout = 60000 } = {}) {
+  return require(path.join(REPO_ROOT, 'memhouse', 'house', 'q-cli')).httpTransport({
+    url: cfg.url, user: cfg.user, password: cfg.password, db: cfg.db, timeout,
+  });
+}
+
+// The member's v3 tables, as a queries-v3 `rooms` object qualified with the house database.
+// `member` defaults to whoever the credential is (currentUser()); --member reads a housemate's
+// tables the caller was granted.
+const _v3rooms = new Map();
+async function v3RoomsFor(cfg, t, member = null) {
+  const Qv3 = require(path.join(REPO_ROOT, 'memhouse', 'house', 'queries-v3'));
+  // MEMHOUSE_MEMBER: whose tables, when the credential is not the member's own (an operator
+  // reading a member's house, as the dashboard and the capture already honour it).
+  member = member || process.env.MEMHOUSE_MEMBER || readEnvFile().MEMHOUSE_MEMBER || null;
+  // Each member's machines under their 0.18 id fold into the machine (host-alias.js), from that
+  // member's own meta: a housemate's share does not grant it, so theirs simply do not fold.
+  const withAliases = async (rooms) => Object.assign(rooms, { hostAliases: await require(path.join(REPO_ROOT, 'memhouse', 'house', 'host-alias')).load((sql) => t.q.rows(sql), rooms) });
+  if (member) return withAliases(Qv3.v3Rooms(member, cfg.db));
+  const key = JSON.stringify([cfg.url, cfg.user, cfg.db]);
+  if (!_v3rooms.has(key)) {
+    const rows = await t.q.rows('SELECT currentUser() AS u');
+    const me = rows[0] && rows[0].u;
+    if (!me) throw new Error('could not determine currentUser()');
+    _v3rooms.set(key, await withAliases(Qv3.v3Rooms(me, cfg.db)));
+  }
+  return _v3rooms.get(key);
+}
+
 function childEnv(cfg, override = {}) {
   const env = {
     ...process.env,
@@ -146,7 +264,10 @@ function childEnv(cfg, override = {}) {
     // Always set, even when empty: a child must ship THIS install's scope, never one
     // inherited from whatever shell started it.
     MEMHOUSE_EDITORS: cfg.editors || '', MEMHOUSE_CLAUDE_ROOTS: cfg.claudeRoots || '',
-      // environment would write into another member's rooms.
+    // The schema, always set for the same reason: a shipper started from a shell that exported
+    // MEMHOUSE_SCHEMA=3 must not run the capture for a schema-2 install, or the reverse. Empty
+    // source roots = the capture's own default (source-roots.js).
+    MEMHOUSE_SCHEMA: isV3(cfg) ? '3' : '', MEMHOUSE_SOURCE_ROOTS: isV3(cfg) ? (cfg.sourceRoots || '') : '',
     ...override,
   };
   // A daemon never needs the admin credential. Inherited from an exported shell variable
@@ -165,8 +286,10 @@ function writeEnvFile(cfg) {
     '# memhouse connection — written by `memhouse install/setup`',
     `MEMHOUSE_URL=${sq(cfg.url)}`,
     `MEMHOUSE_USER=${sq(cfg.user)}`,
-    `MEMHOUSE_PASSWORD=${sq(cfg.password)}`,
+    ...(cfg.passwordFile && cfg.password === passwordFromFile(cfg.passwordFile)
+      ? [`MEMHOUSE_PASSWORD_FILE=${sq(cfg.passwordFile)}`] : [`MEMHOUSE_PASSWORD=${sq(cfg.password)}`]),
     `MEMHOUSE_DB=${sq(cfg.db)}`,
+    '# The dashboard on this machine (memhouse start). The house\'s port is part of MEMHOUSE_URL.',
     `MEMHOUSE_PORT=${sq(cfg.port)}`,
     ...(cfg.editors || cfg.claudeRoots ? [
       '# What this install ships. Empty or absent means everything on this machine.',
@@ -177,6 +300,14 @@ function writeEnvFile(cfg) {
       '# The npm channel `memhouse update` follows (a dist-tag). Absent = latest.',
       `MEMHOUSE_CHANNEL=${sq(cfg.channel)}`,
     ] : []),
+    ...(isV3(cfg) ? [
+      '# Schema 3: harness-sessions-sql\'s profile tables and the capture archive.',
+      'MEMHOUSE_SCHEMA=3',
+      ...(cfg.sourceRoots ? [
+        '# What the capture reads (absent = every Claude Code and Codex dir the 0.18 shipper reads).',
+        `MEMHOUSE_SOURCE_ROOTS=${sq(cfg.sourceRoots)}`,
+      ] : []),
+    ] : []),
     ...(cfg.adminUser ? [
       '# The admin credential for this house — present because this machine administers it',
       '# (deploy --local, or an operator install). invite/members use it; nothing else does.',
@@ -206,7 +337,14 @@ async function ch(cfg, sql, { database = cfg.db, settings = null, timeout = 3000
     signal: AbortSignal.timeout(timeout),
   });
   const text = await res.text();
-  if (!res.ok) throw new Error(text.trim().split('\n')[0]);
+  if (!res.ok) {
+    const err = new Error(text.trim().split('\n')[0]);
+    // ClickHouse's own exception code, so a caller tells an authentication failure (516) from any
+    // other refusal by number, never by its prose (schema-choice.js isAuthFailure).
+    const code = Number(res.headers.get('x-clickhouse-exception-code'));
+    if (code) err.chCode = code;
+    throw err;
+  }
   return text.trim();
 }
 /**
@@ -270,15 +408,7 @@ function portOf(u) {
 // healthy machine. Returns { running, via }.
 function shipperHealth() {
   // "running" is the pid; whether it is DOING anything is the log. Both, always.
-  const lastPass = (() => {
-    try {
-      const passlog = require(path.join(REPO_ROOT, 'memhouse', 'shipper', 'passlog'));
-      const f = path.join(LOG_DIR, 'shipper.log'); const st = fs.statSync(f);
-      const fd = fs.openSync(f, 'r'); const len = Math.min(st.size, 65536); const buf = Buffer.alloc(len);
-      fs.readSync(fd, buf, 0, len, st.size - len); fs.closeSync(fd);
-      return passlog.lastPass(buf.toString('utf-8'));
-    } catch { return { outcome: null }; }
-  })();
+  const lastPass = require(path.join(REPO_ROOT, 'memhouse', 'shipper', 'passlog')).readLastPass(LOG_DIR);
   const pid = pidOf('shipper');
   if (pid) return { running: true, via: `daemon (pid ${pid})`, lastPass };
   try {
@@ -289,6 +419,29 @@ function shipperHealth() {
   return { running: false, via: null, lastPass };
 }
 
+// A daemon reads its settings and its code once, when it starts. `migrate --v3-switch` rewrites
+// the env file and `npm install -g` replaces the package under a running shipper, and the old
+// process keeps shipping with what it read: status then showed its failing passes as a "•" line
+// and exited 0. The pid file is written when the daemon is spawned, so its mtime is the start.
+// The daemon re-reads the env file itself when it adopts a moved house or a newer credential,
+// and records that in run/shipper.env-read (ship.js noteEnvRead): the env file is compared with
+// the later of the two. Returns what changed, or null (no daemon, a service-managed shipper,
+// or nothing).
+function shipperStale() {
+  if (!pidOf('shipper')) return null;
+  let started;
+  try { started = fs.statSync(path.join(RUN_DIR, 'shipper.pid')).mtimeMs; } catch { return null; }
+  let envRead = started;
+  try { envRead = Math.max(started, fs.statSync(path.join(RUN_DIR, 'shipper.env-read')).mtimeMs); } catch { /* never re-read */ }
+  const after = (p, since) => { try { return fs.statSync(p).mtimeMs > since + 1000; } catch { return false; } };
+  const reasons = [];
+  if (after(ENV_FILE, envRead)) reasons.push(`${short(ENV_FILE)} changed after it ${envRead > started ? 'last read it' : 'started'}`);
+  // A checkout's directory changes whenever a file is added; only an installed package's means
+  // it was installed (npm writes the package directory at install time).
+  if (!fs.existsSync(path.join(REPO_ROOT, '.git')) && after(REPO_ROOT, started)) reasons.push(`memhouse ${PKG.version} was installed after it started`);
+  return reasons.length ? reasons : null;
+}
+
 // Room routing for the CLI's own queries. The shipper and dashboard resolve rooms through
 // @clickhouse/client; the CLI speaks raw HTTP, so it asks the same question over its own
 // transport and builds the names with the same shared function.
@@ -361,9 +514,9 @@ function netReason(e) {
 // printed it back on the terminal — in a wizard whose whole audience is someone typing a
 // credential in front of whoever is in the room.
 // The admin password for `adminUser`: --admin-password-file (or - for stdin), then
-// --admin-password (warned), then MEMHOUSE_ADMIN_PASSWORD, then the stored credential
-// of that SAME admin, then a TTY prompt. null = none, and the caller has been told how
-// to give one without putting it on the command line. See memhouse/admin-secret.js.
+// MEMHOUSE_ADMIN_PASSWORD, then the stored credential of that SAME admin, then a TTY
+// prompt. null = none, and the caller has been told how to give one without putting it on
+// the command line. --admin-password is refused at startup. See memhouse/admin-secret.js.
 async function adminPasswordFor(adminUser, out = {}) {
   const as = require(path.join(REPO_ROOT, 'memhouse', 'admin-secret'));
   const file = readEnvFile();
@@ -373,8 +526,6 @@ async function adminPasswordFor(adminUser, out = {}) {
       adminUser, flags, stored: { user: file.MEMHOUSE_ADMIN_USER, password: file.MEMHOUSE_ADMIN_PASSWORD },
     });
   } catch (e) { console.log(bad(e.message)); return null; }
-  // stderr: `members --json` and friends must emit nothing but JSON on stdout.
-  if (r.source === 'flag') console.error(warn(as.ARGV_WARNING));
   out.source = r.source;
   if (r.password !== undefined) return r.password;
   if (process.stdin.isTTY) {
@@ -426,10 +577,16 @@ function pidOf(name) {
 }
 
 // Signal 0 tests for existence without delivering anything.
-// The port the RUNNING dashboard was started with, not the one currently configured.
+// The port the RUNNING dashboard listens on (it records it; memhouse/server/dashboard-port.js),
+// not the one currently configured.
 function runningPort(cfg) {
-  try { return fs.readFileSync(path.join(RUN_DIR, 'dashboard.port'), 'utf-8').trim() || cfg.port; }
-  catch { return cfg.port; }
+  return dashPort.readPort(HOME_DIR) || cfg.port;
+}
+
+/** A memhouse command as the user would type it for THIS home: an install under MEMHOUSE_HOME is
+ * addressed through it, or the command would act on the default home. */
+function selfCmd(sub) {
+  return process.env.MEMHOUSE_HOME ? `MEMHOUSE_HOME=${process.env.MEMHOUSE_HOME.replace(os.homedir(), '~')} memhouse ${sub}` : `memhouse ${sub}`;
 }
 
 function alive(pid) {
@@ -454,14 +611,20 @@ memhouse ${PKG.version} — agent conversation memory across 17 editors
 
 Setup        onboard              interactive wizard: discover → configure → ship → start
              install              scriptable setup (--url --user --password --db [--yes] [--no-ship])
+                                  a NEW house is schema 3 (harness-sessions-sql's profile + capture
+                                  archive); joining an existing house follows its schema
+                                  (--schema 2|3 states it; refused if it contradicts the
+                                  house). --source-roots DIRS pins what the capture reads
+                                  (default: every Claude Code and Codex dir)
                                   --print-sql            print the SQL, run it yourself
                                   with admin: --admin-user NAME [--member NAME] builds the
                                   member + grants, then verifies as the member. The admin
                                   password comes from MEMHOUSE_ADMIN_PASSWORD (with-secret),
-                                  --admin-password-file FILE|- (stdin), or a prompt; plain
-                                  --admin-password works but shows in ps/history. It is NOT
+                                  --admin-password-file FILE|- (stdin), or a prompt; never
+                                  the command line (--admin-password is refused). It is NOT
                                   saved unless --keep-admin (then invite needs no flags).
-                                  --env FILE installs from an invite file (see: invite)
+                                  --env FILE installs from an invite file (see: invite) and changes
+                                  its password; --keep-password keeps the invited one
              invite <name>        mint a member and write the env file their install needs
                                   (--url [--db NAME] [--out FILE]; --admin-user — password
                                   as for install — only if this install keeps no admin
@@ -469,7 +632,9 @@ Setup        onboard              interactive wizard: discover → configure →
                                   and one grant on exactly those. Refuses a name whose rooms
                                   already hold messages; --adopt takes them over (same
                                   person, new credential). Not an admin? --print-sql prints
-                                  the plan to hand to whoever is.
+                                  the plan to hand to whoever is. The invited password
+                                  expires after --expires DAYS (default 7); install's
+                                  password change lifts it
              passwd               rotate this member's password + rewrite the env file
                                   (admin-assisted: --admin-user, password as for install)
              setup                (re)write the connection config only (--yes = no prompts)
@@ -488,17 +653,35 @@ Setup        onboard              interactive wizard: discover → configure →
              reset                clear the shipper's rows and re-ship everything (--yes to skip confirm)
                                   imported rows are kept; --all-origins removes those too
 
-Data         ship                 one incremental pass (--full | --loop [sec])
-             stats                per-source session/message/token counts
+Data         ship                 one incremental pass (--full | --loop [sec]); on schema 3 the
+                                  capture engine (--backfill --reconcile --no-normalise --dry-run)
+             stats                per-source session/message/token counts (--json)
              search <terms…>      full-text search across all sessions
              resume <session-id>  print the command that reopens that session in its editor
              sessions-query       print the session rollup SQL for this credential
+             q <name> [--json]    schema 3: a named query — search, recent, session, window,
+                                  agents, spend, models, tools, tool, activity, hosts,
+                                  coverage, machines, count, version, aggregate
+                                  (memhouse q lists them; memhouse q schema prints 2 or 3)
+             room-sql "<SELECT>"  read-only SQL with bare table names resolved for you
+                                  (schema 3: sessions, session_parts, session_usage, calls, …) [--print] [--json]
+             import claude-ai <export zips | folder of them | export dir | archive dir>
+                                  schema 3 (the profile tables, or a dev house's 3.2 tables):
+                                  claude.ai conversations into the house as one batch; a dry run (counts only) unless --write. Adds the
+                                  conversations not imported yet; --update also rewrites
+                                  ones changed since; --batch ID names the batch
+             import claude-ai --undo <batch> [--write]   tombstone a batch
+             import claude-ai --list                     the batches this house holds
              instance             which memhouse this is: home, binary, house, rooms, scope, daemons, bound playbooks
              rooms                what your rooms are actually called (--json)
              members              who is in a house and what each can reach (--db, admin)
              convert              operator: move a pre-one-layout house (a database per member) to the one layout
                                   (--admin-user/--admin-password, --member, --print-sql, --dry-run, --guides --out DIR)
              start | stop |       shipper loop + dashboard as background daemons
+             dashboard            open the running dashboard in a browser: writes a page holding
+                                  its token (mode 600, in the memhouse home) and opens that file;
+                                  the URL with the token is printed only to a terminal
+                                  (--no-open writes the page and opens nothing)
              share <user>         let someone read this house (--only project=… |
                                   session=… | host=… | source=… | folder=… | since=… |
                                   until=… scopes it with row policies; --revoke
@@ -506,12 +689,18 @@ Data         ship                 one incremental pass (--full | --loop [sec])
              whoami               which credential is in play, and what it may do
                                   (--json; --admin reads MEMHOUSE_ADMIN_*)
              status               daemons, connection, counts, freshness (--json)
-             doctor               diagnose the whole pipeline
+             doctor               diagnose the whole pipeline (schema 3: --full widens the
+                                  identity and duplicate-ts checks to whole tables)
 
 Agents       plugins              list | install claude [--target DIR] | remove claude
+                                  the /mem skills are for Claude Code; other agents read the
+                                  house with the CLI (memhouse q, memhouse room-sql)
                                   acts on EVERY Claude config dir found (~/.claude,
                                   CLAUDE_CONFIG_DIR, ~/.claude-playbooks/*), all
                                   selected by default; --yes takes them all unasked
+             plugins install codex  Codex: a block in AGENTS.md (the rules) and a
+                                  memhouse skill (the read recipes), under CODEX_HOME or
+                                  ~/.codex; plugins remove codex takes out exactly those
              prompt               print the memory system-prompt snippet
              prompt --install     print an install prompt for an agent, with this
                                   machine's state and the one route that applies
@@ -522,6 +711,21 @@ House        deploy --local       run ClickHouse in docker/podman, then install
              migrate              run every migration this house still needs
                                   [--dry-run] [--yes]  (copy + atomic swap; deletes nothing)
              migrate-rooms        the same, scoped to the rooms
+             migrate --v3-prepare schema v3, step 1 (admin): fence the 0.18 writers off
+                                  (min_writer_schema 3) and rename the member's 0.18 rooms
+                                  into <db>_archive (*_pre_v3) [--member M] [--dry-run] [--yes]
+             migrate --v3-convert schema v3: convert <db>_archive.<m>_*_pre_v3 into
+                                  harness-sessions-sql's profile (admin; resumable)
+                                  [--member M] [--batch-rows N] [--dry-run] [--yes]
+             migrate --v3-reconcile  every converted row's shas and every bucket checked [--member M]
+             migrate --v3-shares  schema v3 (admin): re-create the member's recorded shares
+                                  on its schema-3 tables; refuses when the record and the
+                                  live grants disagree [--member M] [--dry-run] [--yes]
+             migrate --v3-switch  schema v3, on each machine: this install captures into
+                                  the converted house (MEMHOUSE_SCHEMA=3) [--dry-run]
+                                  the admin steps act as MEMHOUSE_ADMIN_USER / MEMHOUSE_ADMIN_PASSWORD
+                                  (or --admin-user, --admin-password-file), as invite does;
+                                  --v3-switch acts as this machine's member
              relocate --to URL    copy this whole house to a NEW ClickHouse (server-to-
                                   server) and repoint this install — the shipper does NOT
                                   re-ingest. [--to-user --to-password --to-db]
@@ -532,6 +736,8 @@ House        deploy --local       run ClickHouse in docker/podman, then install
              service stop | start | restart | uninstall | status
 
 Config: flags > MEMHOUSE_* env > ${ENV_FILE.replace(os.homedir(), '~')} > defaults.
+House:  MEMHOUSE_URL is the house: its ClickHouse HTTP(S) endpoint, port included.
+        MEMHOUSE_PORT is this machine's dashboard port (default 4640), never the house's.
 Engine: MEMHOUSE_ENGINE pins docker or podman when both are installed and one cannot answer.
 `;
 
@@ -566,8 +772,13 @@ async function cmdDiscover() {
     out.adapterErrors = getAdapterErrors();
   } catch (e) { out.editorsError = e.message; }
 
-  for (const url of [...new Set([resolveConfig().url, 'http://localhost:8123'])]) {
-    const probe = { url, reachable: false };
+  // The configured house, and the default local address as a discovery. An unreachable local
+  // address that nothing is configured to use is not a failure: it was flagged ✗ on machines
+  // whose house is elsewhere, and read as something to fix.
+  const stated = resolveConfig();
+  const configuredUrl = stated.stated ? stated.url : null;
+  for (const url of [...new Set([...(configuredUrl ? [configuredUrl] : []), 'http://localhost:8123'])]) {
+    const probe = { url, reachable: false, configured: url === configuredUrl };
     try {
       const res = await fetch(url.replace(/\/$/, '') + '/ping', { signal: AbortSignal.timeout(3000) });
       probe.reachable = res.ok;
@@ -600,7 +811,7 @@ async function cmdDiscover() {
   printAdapterErrors(out.adapterErrors);
   console.log('\nClickHouse endpoints:');
   for (const p of out.clickhouse) {
-    if (!p.reachable) console.log(bad(`${p.url} — unreachable`));
+    if (!p.reachable) console.log(p.configured ? bad(`${p.url} — unreachable (this install's house)`) : `  · ${p.url} — no ClickHouse answers here; nothing is configured to use it`);
     else if (p.auth) console.log(warn(`${p.url} — reachable, credentials needed`));
     else console.log(ok(`${p.url} — v${p.version}${p.hasHouse ? ', house present' : ''}${p.kernel ? ', KERNEL detected' : ''}`));
   }
@@ -608,7 +819,7 @@ async function cmdDiscover() {
   // This banner is shared with `onboard`, which was therefore telling the user, mid-wizard,
   // to run the wizard they are already inside.
   console.log(out.config ? ok(`config: ${out.config}`) : warn(ONBOARDING ? 'no config yet — setting one up now' : 'no config yet — run: memhouse install (or onboard)'));
-  if (out.memoryHouse) console.log(warn('memory-house detected on this machine (they coexist fine)'));
+  if (out.memoryHouse) console.log(warn('memhouse\'s predecessor tool detected on this machine (they coexist fine)'));
   return out;
 }
 
@@ -706,7 +917,8 @@ ${process.platform === 'linux' && engines.includes('podman')
 cannot finish this install alone — say so rather than improvising.
 
 Tell the user they need one of:
-- a ClickHouse they already run (Cloud, a server, a kernel house) plus its credentials;
+- a ClickHouse they already run (Cloud, a server, or a kernel house, which requires the
+  Ultimagent kernel, not yet public) plus its credentials;
 - docker or podman installed, after which \`memhouse deploy --local\` does everything.
 
 You can still do the harmless half now: \`${installCommand()}\`,
@@ -802,9 +1014,25 @@ function memberSql(db, member) {
   return render(plan({ db, member, placeholder: true }), { db, member });
 }
 
+/** Schema 3's additions to the plan: the eight profile tables and the capture grants (admin). */
+function memberSqlV3(db, member) {
+  const v3 = require(path.join(REPO_ROOT, 'memhouse', 'house', 'schema-profile'));
+  const stmts = v3.renderStatements(v3.readTemplate(), { db, member });
+  return [
+    `-- schema 3: the conversation tables (covered by the grant on ${db}.${member}_* above) and the`,
+    `-- capture tables in ${v3.archiveDb(db)}, which only this member may read and write (no grant option).`,
+    `-- Run with allow_experimental_full_text_index = 1 on servers before 26.x.`,
+    `-- Tables made before harness-sessions-sql v1's types keep their old adapter_ver, child_stored and orig_sha256`,
+    `-- types under IF NOT EXISTS; \`memhouse install --schema 3 --admin-user …\` retypes them.`,
+    `CREATE DATABASE IF NOT EXISTS ${v3.archiveDb(db)};`,
+    ...stmts.map((x) => `${x.sql};`),
+    ...v3.captureGrants(db, member).map((g) => `${g};`),
+  ].join('\n');
+}
+
 // The handoff lines that follow a printed plan: an env file for the member, with the
 // password left as the placeholder the plan used. `invite` marks it MEMHOUSE_INVITE=1, so
-// the member's `install --env` offers to rotate it to one only they know.
+// the member's `install --env` changes it to one only their machine knows.
 function handoffLines({ url, db, member, invite }) {
   const { PASSWORD_PLACEHOLDER } = require(path.join(REPO_ROOT, 'memhouse', 'provision'));
   const lines = [
@@ -815,7 +1043,8 @@ function handoffLines({ url, db, member, invite }) {
     `--   MEMHOUSE_PASSWORD='${PASSWORD_PLACEHOLDER}'`,
     `--   MEMHOUSE_DB='${db}'`,
   ];
-  if (invite) lines.push('--   MEMHOUSE_INVITE=1');
+  if (isV3(resolveConfig())) lines.push('--   MEMHOUSE_SCHEMA=3');
+  if (invite) lines.push('--   MEMHOUSE_INVITE=1', "--   MEMHOUSE_INVITE_EXPIRES='<the same moment in UTC, e.g. 2026-11-06T09:00:00Z>'");
   lines.push('-- They install with:  memhouse install --env <that file>   (it deletes the file afterwards)');
   if (flags['member-password'] !== undefined) {
     lines.push('-- The --member-password you gave is not printed: use it where the placeholder stands.');
@@ -865,10 +1094,36 @@ async function adminBootstrap(cfg, admin) {
     }
     throw e;
   }
+  // A member's grant is the prefix wildcard <db>.<name>_*. A name that starts with another
+  // member's name and an underscore (bob, bob_smith), or that another member's starts with,
+  // would reach that member's tables, to read and to write. Refused before anything is created.
+  {
+    let collide = null;
+    try { collide = require(path.join(REPO_ROOT, 'memhouse', 'share')).memberCollisions(admin.member, (await chRows(adminCfg, `SELECT name FROM system.tables WHERE database = ${sqlStr(cfg.db)}`, { database: '' })).map((r) => r.name)); }
+    catch (e) { console.log(bad(`could not list the tables of '${cfg.db}' to check the name '${admin.member}': ${String(e.message).split('\n')[0]} — nothing was changed`)); return null; }
+    if (collide.length) {
+      const msg = `'${admin.member}' collides with ${collide.map((x) => `'${x}'`).join(', ')} in '${cfg.db}': one name is the other's plus an underscore, so one member's grant (${cfg.db}.<name>_*) would reach the other's tables`;
+      if (!exists) { console.log(bad(`${msg} — nothing was changed`)); console.log('  Pick a name that neither starts with another member\'s name and an underscore, nor is one\'s start: --member <name>'); return null; }
+      console.log(warn(`${msg}. This house needs fixing: docs/guides/troubleshooting.md, "Two member names that collide".`));
+    }
+  }
   let password = flags['member-password'] || null;
   if (exists) {
     if (!password) {
-      console.log(bad(`ClickHouse user '${admin.member}' already exists — pass --member-password to install as them.`));
+      // An account still carrying VALID UNTIL holds an invite nobody installed: install lifts it.
+      let pending = null;
+      try {
+        const r = await chRows(adminCfg, `SHOW CREATE USER \`${admin.member}\``, { database: '' });
+        const m = /VALID UNTIL '([^']+)'/.exec(String(r[0] ? Object.values(r[0])[0] : ''));
+        if (m && m[1] !== 'infinity') pending = m[1];
+      } catch { /* not readable: the plain refusal below */ }
+      if (pending) {
+        console.log(bad(`ClickHouse user '${admin.member}' already exists: invited, never installed (its invite password expires at ${pending}, server time)`));
+        console.log(`  To invite them again, remove that account first, as the administrator:  DROP USER \`${admin.member}\``);
+        console.log('  then run the invite again; its tables are kept and reused');
+        return null;
+      }
+      console.log(bad(`ClickHouse user '${admin.member}' already exists — give their password (MEMHOUSE_MEMBER_PASSWORD, or --member-password-file) to install as them.`));
       console.log(`  Or pick another handle:  --member <name>`);
       return null;
     }
@@ -894,7 +1149,7 @@ async function adminBootstrap(cfg, admin) {
       // we are here, name the real fix rather than leaving a raw ACCESS_DENIED.
       if (admin.quiet && /Not enough privileges|ACCESS_DENIED/i.test(e.message || '')) {
         console.log('  your configured credential can read users but not create them —');
-        console.log('  pass an admin that can:  memhouse invite … --admin-user <a> --admin-password <p>');
+        console.log('  pass an admin that can:  memhouse invite … --admin-user <a>   (its password from MEMHOUSE_ADMIN_PASSWORD, or --admin-password-file -)');
       }
       return null;
     }
@@ -925,7 +1180,7 @@ async function adminBootstrap(cfg, admin) {
         skipped.push(step.why.replace(/`/g, ''));
       }
     }
-    console.log(ok(`granted '${admin.member}' ${cfg.db}.${admin.member}_* — their rooms and nothing else; async_insert pinned`));
+    console.log(ok(`granted '${admin.member}' ${cfg.db}.${admin.member}_* — ${isV3(cfg) ? 'their tables (the capture archive is granted below)' : 'their rooms and nothing else'}; async_insert pinned`));
     for (const w of skipped) console.log(warn(`skipped (needs ACCESS MANAGEMENT): ${w}`));
   } catch (e) {
     console.log(bad(`could not grant the house to '${admin.member}': ${e.message}`));
@@ -945,6 +1200,24 @@ async function adminBootstrap(cfg, admin) {
     return null;
   }
 
+  // Schema 3: the admin builds the eight profile tables and grants the member its capture
+  // tables — a member may create the conversation tables under its own wildcard, but nothing in
+  // <db>_archive is the member's to create.
+  if (isV3(cfg)) {
+    const v3 = require(path.join(REPO_ROOT, 'memhouse', 'house', 'schema-profile'));
+    const ta = v3Transport(adminCfg, { timeout: 120000 });
+    try {
+      const r = await v3.ensureProfileSchema(ta.q, { db: cfg.db, member: admin.member, createDatabases: true, grantCapture: true });
+      const badT = Object.values(r.tables).filter((x) => x.problem);
+      if (badT.length || r.grant_failures.length) {
+        console.log(bad(`schema 3 tables for '${admin.member}' not ready: ${[...badT.map((x) => `${x.fq} ${x.problem}`), ...r.grant_failures].join('; ')}`));
+        for (const d of r.denied) console.log(warn(`not permitted for '${admin.user}': ${d}`));
+        return null;
+      }
+      console.log(ok(`schema 3: ${Object.values(r.tables).map((x) => x.fq).join(', ')}; capture tables granted to '${admin.member}'`));
+    } catch (e) { console.log(bad(`could not build the schema 3 tables: ${e.message.split('\n')[0]}`)); return null; }
+  }
+
   // The step that makes this trustworthy: stop being admin, and prove the credential we
   // are about to persist can build and reach the rooms itself.
   // The proof below runs the real shipper as the new member; it creates their rooms itself.
@@ -961,10 +1234,19 @@ async function adminBootstrap(cfg, admin) {
     return null;
   }
   try {
+    if (isV3(cfg)) {
+      // ship.js --ensure-schema above already verified all eight as the member (keys included).
+      const SP = require(path.join(REPO_ROOT, 'memhouse', 'house', 'schema-profile'));
+      const N = SP.profileNames(cfg.db, admin.member);
+      const inList = (ts) => ts.map((x) => `'${admin.member}_${x}'`).join(',');
+      const seen = await chRows(memberCfg, `SELECT count() AS n FROM system.tables WHERE (database = '${cfg.db}' AND name IN (${inList(SP.CONVERSATION_TYPES)})) OR (database = '${N.archive}' AND name IN (${inList(SP.CAPTURE_TYPES)}))`, { database: '' });
+      if (Number(seen[0]?.n) !== SP.PROFILE_TYPES.length) { console.log(bad(`'${admin.member}' cannot see its ${SP.PROFILE_TYPES.length} schema-3 tables — nothing written`)); return null; }
+    } else {
     const want = roomNames(admin.member);
     const names = ROOM_TYPES.map((t) => `'${want.physical[t]}'`).join(',');
     const seen = await chRows(memberCfg, `SELECT count() AS n FROM system.tables WHERE database = '${cfg.db}' AND name IN (${names})`, { database: '' });
     if (Number(seen[0]?.n) !== 3) { console.log(bad(`'${admin.member}' cannot see the three rooms — nothing written`)); return null; }
+    }
   } catch (e) { console.log(bad(`'${admin.member}' could not connect after provisioning: ${e.message}`)); return null; }
   // Whether the admin credential is kept is the CALLER's business: an operator's own
   // install keeps it in the env file beside the member's; an invitee's file never carries it.
@@ -989,7 +1271,7 @@ function resolveMemberHandle() {
   //
   // `default` is deliberately NOT on this list. It is ClickHouse's own catch-all user and
   // a poor choice of member, but it is a real one that existing houses are built on —
-  // refusing it would lock those pilots out of their own install.
+  // refusing it would lock those users out of their own install.
   if (member.toLowerCase() === 'root') {
     console.log(bad(`'${member}' cannot be a member — it is a container artefact, not a person.`));
     console.log('  Pick a name that identifies a person or a machine: memhouse install --member <name>');
@@ -1083,16 +1365,26 @@ async function cmdInstall({ interactive }) {
     } catch { /* not a URL; the missing-fields check above already spoke */ }
     // Clear ambient MEMHOUSE_* so ONLY the file speaks (exported vars normally win over the
     // file; an invite intake is the one place they must not).
-    for (const k of ['MEMHOUSE_URL', 'MEMHOUSE_USER', 'MEMHOUSE_PASSWORD', 'MEMHOUSE_DB', 'MEMHOUSE_PORT', 'MEMHOUSE_CHANNEL', 'MEMHOUSE_EDITORS', 'MEMHOUSE_CLAUDE_ROOTS']) delete process.env[k];
+    for (const k of ['MEMHOUSE_URL', 'MEMHOUSE_USER', 'MEMHOUSE_PASSWORD', 'MEMHOUSE_DB', 'MEMHOUSE_PORT', 'MEMHOUSE_CHANNEL', 'MEMHOUSE_EDITORS', 'MEMHOUSE_CLAUDE_ROOTS', 'MEMHOUSE_SCHEMA', 'MEMHOUSE_SOURCE_ROOTS']) delete process.env[k];
     for (const k of wanted) process.env[k] = parsed[k];
     // The invite also carries what the inviter's house is ON: its channel (a `team` house
     // is 0.18.x, published under `team`). Dropping it wrote an env with no pin, and the
     // member's first `memhouse update` followed `latest` — then the 0.17 line — and
     // downgraded a working team install onto the wrong layout. A flag still wins.
-    for (const k of ['MEMHOUSE_CHANNEL', 'MEMHOUSE_EDITORS', 'MEMHOUSE_CLAUDE_ROOTS']) if (parsed[k]) process.env[k] = parsed[k];
+    // MEMHOUSE_SCHEMA too: a schema-3 house's invite says so, and an install that dropped it
+    // would start the 0.18 shipper against a house that has none of its rooms.
+    for (const k of ['MEMHOUSE_CHANNEL', 'MEMHOUSE_EDITORS', 'MEMHOUSE_CLAUDE_ROOTS', 'MEMHOUSE_SCHEMA']) if (parsed[k]) process.env[k] = parsed[k];
     console.log(ok(`using the invite file ${String(flags.env)} (nothing persisted until the install proves out)`));
     _inviteFileToShred = path.resolve(String(flags.env));
     _inviteWantsRotate = parsed.MEMHOUSE_INVITE === '1';
+    // An expired invite: its password no longer works (VALID UNTIL), so say that, before the
+    // server answers with a bare "authentication failed".
+    const until = Date.parse(parsed.MEMHOUSE_INVITE_EXPIRES || '');
+    if (Number.isFinite(until) && Date.now() > until) {
+      console.log(bad(`this invite expired at ${parsed.MEMHOUSE_INVITE_EXPIRES} (UTC) — ask whoever invited you for a new one; nothing was changed`));
+      _inviteFileToShred = null;
+      return 1;
+    }
   }
   let cfg = resolveConfig();
   const adminUser = flags['admin-user'];
@@ -1107,6 +1399,16 @@ async function cmdInstall({ interactive }) {
   // by a memhouse one-liner.
   try { require(path.join(REPO_ROOT, 'memhouse', 'house', 'house')).assertUsableName(cfg.db, 'house'); }
   catch (e) { console.log(bad(e.message)); return 1; }
+  // --schema 3 (or MEMHOUSE_SCHEMA=3 in the env / invite file): the conversation layer and the
+  // capture archive instead of the 0.18 rooms. Only 2 and 3 exist; a typo is refused, never
+  // read as "the default".
+  if (!['', '2', '3'].includes(String(cfg.schema))) {
+    console.log(bad(`--schema ${cfg.schema}: only 2 (the 0.18 rooms) and 3 (harness-sessions-sql's profile) exist`));
+    return 1;
+  }
+  // As stated (flag, env or invite file), before the default applies: '' when nobody said.
+  const statedSchema = String(cfg.schema);
+  if (String(cfg.schema) === '2') cfg.schema = '';
 
   // Option 1 — print the SQL and stop. For the common case: you have admin on this
   // ClickHouse and would rather run four statements yourself than hand a credential to an
@@ -1114,7 +1416,10 @@ async function cmdInstall({ interactive }) {
   if (flags['print-sql'] === true) {
     const member = resolveMemberHandle();
     if (!member) return 1;
+    // Nothing is contacted here, so nothing is detected: schema 3 unless stated (a new house's default).
+    if (!statedSchema) cfg.schema = '3';
     console.log(memberSql(cfg.db, member));
+    if (isV3(cfg)) console.log(memberSqlV3(cfg.db, member));
     // Only echo a URL that was actually STATED. --print-sql is the path where the house is
     // typically someone else's, run by someone else, and cfg.url falls back to
     // http://localhost:8123 — the one address the rest of the product refuses to guess.
@@ -1129,6 +1434,11 @@ async function cmdInstall({ interactive }) {
     // From a file, stdin, the environment or a prompt — never REQUIRED on argv.
     const adminPassword = await adminPasswordFor(String(adminUser));
     if (adminPassword === null) return 1;
+    {
+      const pick = schemaChoice.chooseSchema(statedSchema, await schemaChoice.detectHouseSchema((sql) => chRows({ ...cfg, user: String(adminUser), password: adminPassword }, sql, { database: '' }), cfg.db, member), member, { user: String(adminUser), url: cfg.url });
+      if (pick.refuse) { console.log(bad(pick.refuse)); console.log('  nothing was changed'); return 1; }
+      cfg.schema = pick.schema === '3' ? '3' : '';
+    }
     const built = await adminBootstrap(cfg, {
       user: adminUser, password: adminPassword, member,
     });
@@ -1147,17 +1457,17 @@ async function cmdInstall({ interactive }) {
   // failed install is read as truth by the next command. Placed after the write, a
   // wrong-key house got four green ticks and a persisted config, and `status` then added
   // five more on a house that can never be shipped to.
-  const keyProblem = await sortingKeyProblem(cfg);
+  const keyProblem = isV3(cfg) ? null : await sortingKeyProblem(cfg);
   if (keyProblem) {
     console.log(bad(`the rooms are here, but their sorting keys are wrong: ${keyProblem}`));
     console.log('  a ship pass would corrupt them, so `memhouse ship` will refuse.');
     // migrate-rooms, not "rebuild by hand from the template" — this advice predated the
-    // command and survived it, so an UPGRADING pilot (the main person who ever sees this)
+    // command and survived it, so an UPGRADING user (the main person who ever sees this)
     // was pointed at a manual rebuild that the tool now does for them, atomically and
     // without deleting anything.
     // With the SAME connection flags — no config was written (see below), so a bare
     // `memhouse migrate-rooms` here would answer "no house configured" and strand the
-    // pilot in a loop between two refusals.
+    // user in a loop between two refusals.
     console.log('  rebuild them (a copy + swap; nothing is deleted), then install again:');
     console.log(`     memhouse migrate-rooms --url ${cfg.url} --db ${cfg.db} --user ${cfg.user} --password …`);
     console.log('  no config was written — nothing here reads as installed.');
@@ -1167,9 +1477,9 @@ async function cmdInstall({ interactive }) {
     console.log(ok(`config written: ${ENV_FILE}`));
     // Same as the member path below: the identity is minted where the machine joins.
     {
-      const me = require(path.join(REPO_ROOT, 'memhouse', 'host.js')).identity(HOME_DIR);
-      console.log(ok(`host identity: ${me.id}`));
-      console.log(`  every machine you install as '${cfg.user}' writes into the same rooms; this is what tells them apart`);
+      const me = machineHost(cfg);
+      console.log(ok(`host identity: ${me.id}${me.label ? ` (${me.label})` : ''}`));
+      console.log(`  every machine you install as '${cfg.user}' writes into the same ${isV3(cfg) ? 'tables' : 'rooms'}; this is what tells them apart`);
     }
     console.log(ok('installed'));
     if (cfg.adminUser) {
@@ -1193,7 +1503,7 @@ async function cmdInstall({ interactive }) {
   // haveAll so no prompt asked who you were, and resolveConfig's default was used AS A
   // CREDENTIAL. Refuse rather than do something else silently.
   // Every flag that only means something to the admin bootstrap. Left out, it was silently
-  // ignored on a member install (`--keep-admin` was — Codex P2 on #14).
+  // ignored on a member install (`--keep-admin` was — #14).
   const adminOnly = ['member', 'member-password', 'keep-admin', 'admin-password-file', 'admin-password'].filter((k) => flags[k] !== undefined);
   if (!adminUser && adminOnly.length) {
     console.log(bad(`--${adminOnly.join(', --')} ${adminOnly.length > 1 ? 'are' : 'is'} only read with --admin-user`));
@@ -1242,6 +1552,13 @@ async function cmdInstall({ interactive }) {
     console.log(bad(`invalid database name '${cfg.db}' — use letters, digits, underscore`));
     return 1;
   }
+  // Joining a house: its schema, detected, never the default (a 0.20 client on an unconverted
+  // 0.18 house stays on its rooms until the admin converts it and this machine switches).
+  {
+    const pick = schemaChoice.chooseSchema(statedSchema, await schemaChoice.detectHouseSchema((sql) => chRows(cfg, sql, { database: '' }), cfg.db, cfg.user), cfg.user, { user: cfg.user, url: cfg.url });
+    if (pick.refuse) { console.log(bad(pick.refuse)); console.log('  nothing was changed'); return 1; }
+    cfg.schema = pick.schema === '3' ? '3' : '';
+  }
   // An existing config pointing somewhere ELSE is not a thing to overwrite in passing: a
   // shipper or an installed service is still pointed at the old house, and rewriting the
   // file orphans it with no error anywhere.
@@ -1288,6 +1605,32 @@ async function cmdInstall({ interactive }) {
     catch { console.log(bad(`house '${cfg.db}' does not exist and cannot be created: ${e.message}`)); return 1; }
   }
   console.log(ok(`house '${cfg.db}' ready`));
+  if (isV3(cfg)) {
+    // Schema 3: the member's eight profile tables. A member may create the six conversation
+    // tables under its own grant; the two capture tables in <db>_archive are an admin's to create
+    // and grant. Verified either way — keys included — before anything is written.
+    const v3 = require(path.join(REPO_ROOT, 'memhouse', 'house', 'schema-profile'));
+    const t = v3Transport(cfg, { timeout: 120000 });
+    let r3;
+    try {
+      const member = (await v3RoomsFor(cfg, t)).member;
+      r3 = await v3.ensureProfileSchema(t.q, { db: cfg.db, member });
+      r3.member = member;
+    } catch (e) { console.log(bad(`could not check the schema 3 tables: ${e.message.split('\n')[0]}`)); return 1; }
+    const missing = Object.values(r3.tables).filter((x) => x.problem);
+    if (missing.length) {
+      console.log(bad(`schema 3: ${missing.map((x) => `${x.fq} ${x.problem}`).join('; ')}`));
+      console.log(`  '${r3.member}' may not create ${missing.length > 1 ? 'them' : 'it'} — the capture tables live in ${cfg.db}_archive and only an admin`);
+      console.log('  creates and grants them. Either hand it over:');
+      console.log(`     memhouse install --schema 3 --admin-user <admin> --member ${r3.member} --url ${cfg.url} --db ${cfg.db}`);
+      console.log('  or print the statements for whoever administers the server:');
+      console.log(`     memhouse install --schema 3 --print-sql --member ${r3.member} --db ${cfg.db}`);
+      console.log('  no config was written — nothing here reads as installed.');
+      return 1;
+    }
+    console.log(ok(`schema 3 tables for '${r3.member}': ${Object.values(r3.tables).map((x) => x.fq).join(', ')}`));
+    if (r3.unhealed.length) console.log(warn(`${r3.unhealed.join(', ')}: the capture writes the old types until an admin retypes them (memhouse install --schema 3 --admin-user …)`));
+  } else {
   // Rooms — the caller's own three. On a house you own this creates them and you are
   // done, which is the solo path. On a house someone else owns you hold no CREATE TABLE,
   // and that is not a failure to paper over: rooms and grants are minted by the owner, so
@@ -1313,7 +1656,7 @@ async function cmdInstall({ interactive }) {
     console.log(bad(`'${r.member}' has no ${missing.join(', ')} in '${cfg.db}', and could not create them`));
     console.log('  You hold no CREATE TABLE here. Someone with ACCESS MANAGEMENT has to run this —');
     console.log('  print it with:  memhouse install --print-sql --member ' + r.member);
-    console.log('  or hand it over:  memhouse install --admin-user … --admin-password …');
+    console.log('  or hand it over:  memhouse install --admin-user … --admin-password-file -   (password on stdin)');
     return 1;
   }
   console.log(ok(`rooms for '${r.member}': ${want.join(', ')}`));
@@ -1327,17 +1670,18 @@ async function cmdInstall({ interactive }) {
     console.log(bad(`the rooms are here, but their sorting keys are wrong: ${keyProblem}`));
     console.log('  a ship pass would corrupt them, so `memhouse ship` will refuse.');
     // migrate-rooms, not "rebuild by hand from the template" — this advice predated the
-    // command and survived it, so an UPGRADING pilot (the main person who ever sees this)
+    // command and survived it, so an UPGRADING user (the main person who ever sees this)
     // was pointed at a manual rebuild that the tool now does for them, atomically and
     // without deleting anything.
     // With the SAME connection flags — no config was written (see below), so a bare
     // `memhouse migrate-rooms` here would answer "no house configured" and strand the
-    // pilot in a loop between two refusals.
+    // user in a loop between two refusals.
     console.log('  rebuild them (a copy + swap; nothing is deleted), then install again:');
     console.log(`     memhouse migrate-rooms --url ${cfg.url} --db ${cfg.db} --user ${cfg.user} --password …`);
     console.log('  no config was written — nothing here reads as installed.');
     return 1;
   }
+  }
   // Written LAST, and only once everything above proved out. Writing it first leaves a
   // config file behind every failed attempt, and the next command reads it as truth.
   writeEnvFile(cfg);
@@ -1371,11 +1715,11 @@ async function cmdInstall({ interactive }) {
   // Mint this machine's identity here rather than leaving it to whatever runs first.
   // Installing is the moment a machine joins the member's rooms, and the id is what every
   // later `WHERE host = …` depends on — so it is worth naming once, out loud, at the point
-  // the pilot can still see it.
+  // the user can still see it.
   {
-    const me = require(path.join(REPO_ROOT, 'memhouse', 'host.js')).identity(HOME_DIR);
-    console.log(ok(`host identity: ${me.id}`));
-    console.log(`  every machine you install as '${cfg.user}' writes into the same rooms; this is what tells them apart`);
+    const me = machineHost(cfg);
+    console.log(ok(`host identity: ${me.id}${me.label ? ` (${me.label})` : ''}`));
+    console.log(`  every machine you install as '${cfg.user}' writes into the same ${isV3(cfg) ? 'tables' : 'rooms'}; this is what tells them apart`);
   }
   console.log(ok('installed'));
   printGettingStarted(cfg);
@@ -1385,15 +1729,23 @@ async function cmdInstall({ interactive }) {
   return 0;
 }
 
-// After a successful install FROM AN INVITE: offer to rotate the shared password to one
-// only this machine knows (the member holds ALTER USER on themselves, so no admin), then
-// delete the spent file. Interactive offers (default yes); --yes rotates unasked; a
-// non-TTY without --yes only advises. All best-effort — a failed rotation never fails the
-// install, it just leaves the inviter's password in place with a warning.
+// After a successful install FROM AN INVITE: change the shared password to one only this
+// machine knows (the member holds ALTER USER on themselves, so no admin), then delete the
+// spent file. A terminal is asked (default yes); --yes, or no terminal at all, rotates
+// unasked. Without a terminal nobody is there to decide, and keeping the inviter's working
+// password must never be what happens by default. The password is kept only on an explicit
+// no (the question, or --keep-password), and then the output says who still knows it. A failed
+// rotation never fails the install: it keeps the invite file and says how to retry.
+// A member holds ALTER USER on itself, so it can lift the invite's VALID UNTIL.
+async function clearInviteExpiry(cfg) {
+  try { const c = cfg || resolveConfig(); await ch(c, `ALTER USER \`${c.user}\` VALID UNTIL 'infinity'`, { database: '' }); return true; }
+  catch { return false; }
+}
+
 async function finishInvite(cfg) {
   if (_inviteWantsRotate) {
-    let go = flags.yes === true;
-    if (!go && process.stdin.isTTY) {
+    let go = flags['keep-password'] !== true;
+    if (go && flags.yes !== true && process.stdin.isTTY) {
       const a = (await ask('This password was set by whoever invited you. Change it to one only you know now? (Y/n)', 'Y')).toLowerCase();
       go = a === '' || a === 'y' || a === 'yes';
     }
@@ -1410,6 +1762,9 @@ async function finishInvite(cfg) {
         for (const k of drift.changed) process.env[k] = drift.values[k];
         if (drift.values.MEMHOUSE_PASSWORD !== undefined && flags.password !== undefined) flags.password = drift.values.MEMHOUSE_PASSWORD;
         if (cfg) cfg.password = process.env.MEMHOUSE_PASSWORD;
+        // The new password carries no expiry (a member's own ALTER USER … IDENTIFIED BY drops
+        // VALID UNTIL); say so explicitly, in case a server keeps it.
+        await clearInviteExpiry(cfg);
       }
       if (code !== 0) {
         // Rotation failed and its own state may be uncertain — KEEP the invite file (it
@@ -1419,7 +1774,9 @@ async function finishInvite(cfg) {
         return;
       }
     } else {
-      console.log(warn('keeping the invited password — rotate when ready:  memhouse passwd'));
+      console.log(warn('kept the invited password, as asked: whoever invited you still knows it. Change it with:  memhouse passwd'));
+      // Kept, so its expiry must go: the account would otherwise stop working on the invite's date.
+      if (!(await clearInviteExpiry(cfg))) console.log(warn('could not clear the invite\'s expiry: the password stops working on its date unless you change it (memhouse passwd)'));
     }
   }
   if (_inviteFileToShred) {
@@ -1432,7 +1789,7 @@ async function finishInvite(cfg) {
 
 /**
  * What now — printed once, at the end of a successful install. An install that ends with
- * one next-step line leaves the pilot at a working house they do not know how to use:
+ * one next-step line leaves the user at a working house they do not know how to use:
  * the dashboard, the agent skills, and the health check all exist, and nothing said so.
  * Kept to one screen; each line is a thing to DO, not a feature list.
  */
@@ -1443,7 +1800,7 @@ function printGettingStarted(cfg) {
   console.log('');
   console.log('  Your house is live. From here:');
   console.log(`     ${mh} start                  dashboard + shipper loop (background daemons)`);
-  console.log(`       -> http://localhost:${cfg.port || 4640}       browse, search, and analyze every session`);
+  console.log(`     ${mh} dashboard              open the dashboard: browse, search, and analyze every session`);
   console.log(`     ${mh} service install        or: ship at login, no terminal needed`);
   console.log(`     ${mh} plugins install claude give your agents /mem:house, /mem:recall,`);
   console.log('                                     /mem:sql, /mem:access, /mem:admin');
@@ -1501,7 +1858,7 @@ async function cmdOnboard() {
 
   // The skills were the one delivered thing onboarding never mentioned. They shipped,
   // they were packaged as a plugin, and the only way to find them was to already know
-  // `memhouse plugins install claude` — so a pilot completed the whole wizard and ended up
+  // `memhouse plugins install claude` — so a user completed the whole wizard and ended up
   // with a house their agent could not query. Offer them here, across every Claude instance
   // found, all selected.
   const targets = claudeTargets();
@@ -1519,10 +1876,9 @@ async function cmdOnboard() {
 async function cmdStart() {
   const cfg = requireConfig(resolveConfig(), 'start');
   fs.mkdirSync(RUN_DIR, { recursive: true });
-  // Record the port this run actually used. `start --port 4673` did not persist it, so
-  // `status` fell back to the env file and printed `dashboard → http://localhost:4640` —
-  // a live process on 4673 named alongside a link to someone else's dashboard on 4640.
-  try { fs.writeFileSync(path.join(RUN_DIR, 'dashboard.port'), String(cfg.port)); } catch { /* best effort */ }
+  // The port the dashboard listens on is recorded by the dashboard itself, once it listens
+  // ($MEMHOUSE_HOME/run/dashboard.port): when the configured port is in use it takes the next
+  // free one (memhouse/server/dashboard-port.js), so only the process knows which.
   fs.mkdirSync(LOG_DIR, { recursive: true });
   ensureUiBuilt();
   const daemons = [
@@ -1553,16 +1909,29 @@ async function cmdStart() {
         : `  start it with: launchctl kickstart gui/$(id -u)/com.${unit.replace('memhouse-', 'memhouse.')}`);
     }
   }
+  // The dashboard's token, made here when absent, so a token file that is refused (open to
+  // other users) is said before anything starts. The dashboard reads it from the file itself;
+  // it is not passed in argv or the environment.
+  if (daemons.some((d) => d.name === 'dashboard') && !pidOf('dashboard')) {
+    try { dashAuth.ensureToken(HOME_DIR); } catch (e) {
+      daemons.splice(daemons.findIndex((d) => d.name === 'dashboard'), 1);
+      console.log(warn(`dashboard not started — ${e.message}`));
+    }
+  }
   const started = [];
   for (const d of daemons) {
     if (pidOf(d.name)) { console.log(warn(`${d.name} already running (pid ${pidOf(d.name)})`)); continue; }
+    // A port recorded by an earlier dashboard is not this one's.
+    if (d.name === 'dashboard') { try { fs.unlinkSync(dashPort.portFile(HOME_DIR)); } catch { /* none recorded */ } }
     const log = fs.openSync(path.join(LOG_DIR, d.name + '.log'), 'a');
+    // Where this run's lines start: an exit is explained from them, not from an earlier run's.
+    const logFrom = fs.fstatSync(log).size;
     const child = spawn(process.execPath, [d.script, ...d.args], {
       env: childEnv(cfg), detached: true, stdio: ['ignore', log, log],
     });
     fs.writeFileSync(path.join(RUN_DIR, d.name + '.pid'), String(child.pid));
     child.unref();
-    started.push({ ...d, pid: child.pid });
+    started.push({ ...d, pid: child.pid, logFrom });
   }
 
   // spawn() succeeding means the PROCESS started, not that it is still alive or that it
@@ -1571,7 +1940,19 @@ async function cmdStart() {
   // else owned the port, which on this machine was a different house's dashboard. Give
   // each a moment, then confirm, and dig the reason out of the log rather than making the
   // user find it.
-  if (started.length) await new Promise((r) => setTimeout(r, 900));
+  //
+  // The dashboard also gets until it has recorded its port (or up to 5 s), so the port said
+  // below is the one it took.
+  if (started.length) {
+    const dash = started.find((d) => d.name === 'dashboard');
+    const t0 = Date.now();
+    for (;;) {
+      await new Promise((r) => setTimeout(r, 100));
+      const waited = Date.now() - t0;
+      if (waited < 900) continue;
+      if (!dash || !alive(dash.pid) || dashPort.readPort(HOME_DIR) || waited >= 5000) break;
+    }
+  }
   let dashboardAlive = false;
   for (const d of started) {
     if (alive(d.pid)) {
@@ -1581,15 +1962,14 @@ async function cmdStart() {
     }
     try { fs.unlinkSync(path.join(RUN_DIR, d.name + '.pid')); } catch { /* already gone */ }
     const logPath = path.join(LOG_DIR, d.name + '.log');
-    let why = '';
-    try {
-      const tail = fs.readFileSync(logPath, 'utf-8').split('\n').filter(Boolean).slice(-40);
-      const err = tail.reverse().find((l) => /EADDRINUSE|Error|error:/i.test(l));
-      if (/EADDRINUSE/.test(err || '')) why = `port ${cfg.port} is already in use — free it, or set MEMHOUSE_PORT`;
-      else if (err) why = err.trim().slice(0, 200);
-    } catch { /* no log to read */ }
-    console.log(bad(`${d.name} exited immediately${why ? ` — ${why}` : ''}`));
-    if (!why) console.log(`  see ${logPath}`);
+    let tail = '';
+    try { tail = fs.readFileSync(logPath).subarray(d.logFrom).toString('utf-8').split('\n').slice(-40).join('\n'); } catch { /* no log to read */ }
+    // The shipper is what start keeps running: its exit fails the command. The dashboard is
+    // optional: its exit is a warning, and start exits 0 while the shipper runs.
+    const r = dashPort.earlyExit({ name: d.name, log: tail, port: cfg.port });
+    console.log((r.fatal ? bad : warn)(`${d.name} exited immediately${r.why ? ` — ${r.why}` : ''}`));
+    if (!r.why) console.log(`  see ${logPath}`);
+    if (!r.fatal) continue;
     process.exitCode = 1;
     // Partial success is the confusing case: exit 1 reads as "nothing started", and the
     // daemon that DID start keeps running unmentioned.
@@ -1599,8 +1979,75 @@ async function cmdStart() {
     }
   }
   if (dashboardAlive || (pidOf('dashboard') && !started.some((d) => d.name === 'dashboard'))) {
-    console.log(`  dashboard → http://localhost:${cfg.port}`);
+    const port = dashPort.readPort(HOME_DIR);
+    if (dashboardAlive && port && String(port) !== String(cfg.port)) console.log(warn(dashPort.inUseNote(cfg.port, port)));
+    console.log(`  ${port ? `dashboard on port ${port}` : 'dashboard starting'} — open it with: ${selfCmd('dashboard')}`);
+  }
+}
+
+/**
+ * Open a file with the platform's opener (macOS `open`, `xdg-open` elsewhere; none on Windows).
+ * Resolves { ok } once the opener has exited 0 or is still running after 3 s, and
+ * { ok: false, error } when it could not be run or exited non-zero.
+ */
+function openWithPlatform(file) {
+  const cmd = process.platform === 'darwin' ? 'open' : process.platform === 'win32' ? null : 'xdg-open';
+  if (!cmd) return Promise.resolve({ ok: false, error: `no opener is run on ${process.platform}` });
+  return new Promise((resolve) => {
+    let child;
+    try { child = spawn(cmd, [file], { detached: true, stdio: 'ignore' }); } catch (e) { resolve({ ok: false, error: `${cmd}: ${e.message}` }); return; }
+    const timer = setTimeout(() => { child.unref(); resolve({ ok: true }); }, 3000);
+    child.on('error', (e) => { clearTimeout(timer); resolve({ ok: false, error: `${cmd}: ${e.code === 'ENOENT' ? 'not found' : e.message}` }); });
+    child.on('exit', (code) => { clearTimeout(timer); resolve(code === 0 ? { ok: true } : { ok: false, error: `${cmd} exited ${code}` }); });
+  });
+}
+
+/**
+ * `memhouse dashboard`: open the running dashboard in a browser. First the server on
+ * 127.0.0.1:<port> must prove it holds this home's token (/api/proof, an HMAC of a fresh nonce):
+ * anything else listening there is never given the token. Then it writes
+ * $MEMHOUSE_HOME/dashboard.html (mode 600), a page that redirects to the dashboard with the token
+ * in the URL's fragment, and opens that FILE, so the token is in no process's argv. The URL with
+ * the token is printed only when stdout is a terminal; --json never carries it.
+ */
+async function cmdDashboard() {
+  const cfg = resolveConfig();
+  const pid = pidOf('dashboard');
+  if (!pid) {
+    if (JSON_OUT) console.log(JSON.stringify({ running: false, start: selfCmd('start') }, null, 2));
+    else { console.log(warn('dashboard: not running')); console.log(`  start it with: ${selfCmd('start')}`); }
+    return 1;
+  }
+  const port = Number(runningPort(cfg));
+  let token;
+  try { token = dashAuth.readToken(HOME_DIR); } catch (e) {
+    if (JSON_OUT) console.log(JSON.stringify({ running: true, pid, port, error: e.message }, null, 2));
+    else console.log(bad(e.message));
+    return 1;
+  }
+  if (!(await dashAuth.verifyServer(port, token))) {
+    const msg = `port ${port} is not your dashboard: what answers on ${dashAuth.LOOPBACK}:${port} could not prove it holds this home's token, so nothing was opened — restart yours: ${selfCmd('stop')} && ${selfCmd('start')}`;
+    if (JSON_OUT) console.log(JSON.stringify({ running: true, pid, port, error: msg }, null, 2));
+    else console.log(bad(msg));
+    return 1;
+  }
+  const file = dashAuth.writeOpener(HOME_DIR, dashAuth.openUrl(port, token));
+  const opened = flags['no-open'] === true ? { ok: false, skipped: true } : await openWithPlatform(file);
+  if (JSON_OUT) {
+    console.log(JSON.stringify({ running: true, pid, port, file, opened: opened.ok, ...(opened.error ? { open_error: opened.error } : {}) }, null, 2));
+    return 0;
   }
+  console.log(ok(`dashboard: running (pid ${pid}, port ${port})`));
+  if (opened.ok) console.log(ok(`opened ${file} in the browser`));
+  else {
+    if (!opened.skipped) console.log(warn(`could not open a browser (${opened.error})`));
+    console.log(`  open ${file} in a browser on this machine`);
+  }
+  console.log('  that file (mode 600) holds the dashboard\'s token; the page keeps it for this browser tab only');
+  // A terminal only: output written to a pipe or a file (how logs and most agent sessions
+  // capture it) never holds the token.
+  if (process.stdout.isTTY) console.log(`  or open: ${dashAuth.openUrl(port, token)}`);
+  return 0;
 }
 
 function cmdStop() {
@@ -1681,27 +2128,99 @@ function fleetAge(ms) {
   return `${Math.round(h / 24)}d ago`;
 }
 
+// Connected, but the configured member's tables are not where this install looks. ClickHouse
+// answers UNKNOWN_TABLE with the SQL that hit it, and status used to print that as "not
+// connected"; the person needs the reason and the next step. The cases seen so far: the house
+// was moved to schema 3 and this machine still reads the 0.18 rooms (the fix is --v3-switch),
+// the reverse, a credential that administers the server and owns no rooms, and no rooms at
+// all. Returns { kind, lines: [what, what to do] }, or null when the tables are where they
+// should be or nothing can be read to tell.
+async function roomsProblem(cfg) {
+  let member; let names;
+  try {
+    member = process.env.MEMHOUSE_MEMBER || readEnvFile().MEMHOUSE_MEMBER
+      || ((await chRows(cfg, 'SELECT currentUser() AS u', { database: '' }))[0] || {}).u;
+    if (!/^[A-Za-z][A-Za-z0-9_]*$/.test(String(member || '')) || !/^[A-Za-z0-9_]+$/.test(String(cfg.db || ''))) return null;
+    names = new Set((await chRows(cfg, `SELECT name FROM system.tables WHERE database = '${cfg.db}' AND startsWith(name, '${member}_')`, { database: '' })).map((r) => r.name));
+  } catch { return null; }
+  const onV3 = names.has(`${member}_session_parts`);
+  const onV2 = names.has(`${member}_messages`);
+  if (!isV3(cfg) && !onV2 && onV3) {
+    return { kind: 'moved', lines: [
+      'this house was moved to schema 3, and this machine still reads and ships the 0.18 rooms',
+      'switch it:  memhouse migrate --v3-switch   then:  memhouse stop && memhouse start'] };
+  }
+  if (isV3(cfg) && !onV3 && onV2) {
+    return { kind: 'not-moved', lines: [
+      `this machine reads schema 3, but '${member}' in '${cfg.db}' is still on the 0.18 rooms`,
+      `the house's administrator converts it first (docs/guides/upgrade-to-0.20.md); until then, MEMHOUSE_SCHEMA=2 in ${short(ENV_FILE)}`] };
+  }
+  if (!onV2 && !onV3) {
+    // A member whose own database was converted to the one layout: the env still names it,
+    // the rooms are in mem. `update` adopts that; `install` would be the wrong advice.
+    if (cfg.db !== 'mem' && (await adoptMovedHouse(cfg, { fix: false })) === 'moved') {
+      return { kind: 'moved-db', lines: [
+        `rooms moved to mem.${member}_* — this env still says MEMHOUSE_DB=${cfg.db}`,
+        'memhouse update   (rewrites the env and restarts the shipper)'] };
+    }
+    let caps = {};
+    try { caps = capabilitiesFrom((await chRows(cfg, 'SHOW GRANTS', { database: '' })).map((r) => Object.values(r).join(' '))); } catch { /* no grants to read */ }
+    if (caps.canMintUsers || caps.isSuperuser) {
+      return { kind: 'admin', lines: [
+        `'${cfg.user}' administers this server and owns no rooms, so there is nothing of its own to show`,
+        `member commands need a member credential:  memhouse install --admin-user ${cfg.user} --member <you>`] };
+    }
+    return { kind: 'none', lines: [
+      `no tables for '${member}' in '${cfg.db}'`,
+      `run: memhouse install (it builds them), or check the house name in ${short(ENV_FILE)}`] };
+  }
+  return null;
+}
+
 async function cmdStatus() {
   // requireConfig, not resolveConfig. `status` reads a house and reports its counts as
   // YOURS, which is exactly the answer that must not come from a guessed URL: with no
   // config it connected to localhost:8123 as memhouse_root and, wherever that credential
-  // works, printed a stranger's session and message counts as the pilot's own.
+  // works, printed a stranger's session and message counts as the user's own.
   const cfg = requireConfig(resolveConfig(), 'status');
   const out = {
     config: fs.existsSync(ENV_FILE) ? ENV_FILE : null,
     url: cfg.url, db: cfg.db, user: cfg.user,
     daemons: { shipper: pidOf('shipper'), dashboard: pidOf('dashboard') },
-    dashboard_url: pidOf('dashboard') ? `http://localhost:${runningPort(cfg)}` : null,
-    shipper: shipperHealth(),
+    // Where it listens, and how to open it. The token is never part of this output.
+    dashboard_url: pidOf('dashboard') ? `http://127.0.0.1:${runningPort(cfg)}` : null,
+    dashboard_port: pidOf('dashboard') ? Number(runningPort(cfg)) : null,
+    dashboard_open: pidOf('dashboard') ? selfCmd('dashboard') : null,
+    shipper: { ...shipperHealth(), stale: shipperStale() },
       update: null, // filled below from the registry; null when current, offline, or a checkout build
     // Which machine this is, in the rooms' own terms. All of a member's machines write
-    // into one set of rooms, so `WHERE host = ...` is how the pilot separates this laptop
+    // into one set of rooms, so `WHERE host = ...` is how the user separates this laptop
     // from the other one — and they cannot type it if nothing ever prints it.
-    host: require(path.join(REPO_ROOT, 'memhouse', 'host.js')).identity(HOME_DIR),
+    host: machineHost(cfg),
     connected: false,
   };
+  out.schema = isV3(cfg) ? 3 : 2;
   try {
-    out.connected = true && !!(await ch(cfg, 'SELECT 1'));
+    // No database here: a house name that does not exist is a rooms problem (named below),
+    // not an unreachable server.
+    out.connected = true && !!(await ch(cfg, 'SELECT 1', { database: '' }));
+    if (isV3(cfg)) {
+      // Schema 3: counts, freshness and the machines from sessions FINAL — one row per session,
+      // no scan of turns. The capture keeps no heartbeat row, so a machine's "last ship" is the
+      // newest write of a session row it owns (max(ingested_at)).
+      const t = v3Transport(cfg);
+      const rooms = await v3RoomsFor(cfg, t);
+      out.member = rooms.member;
+      out.tables = { session_parts: rooms.parts, session_usage: rooms.usage, calls: rooms.calls, sessions: rooms.sessions };
+      const st = await qc().statusV3(t.exec, rooms);
+      out.sessions = st.sessions; out.messages = st.messages; out.freshest = st.freshest;
+      out.fleet = st.hosts.map((h) => {
+        const ageMs = h.last_write_ms ? Date.now() - Number(h.last_write_ms) : null;
+        return { writer: `${rooms.member}@${h.host}`, host: h.host, version: null, schema: 3, lastShip: h.last_write_at, lastActive: h.last_active_at, sessions: Number(h.sessions), harnesses: h.harnesses, ageMs, verdict: ageMs !== null && ageMs > 48 * 3600 * 1000 ? 'stale' : 'ok' };
+      });
+      const sr = sourceRootsFor(cfg);
+      out.source_roots = { defaulted: sr.defaulted, error: sr.error, roots: sr.roots.map((r) => ({ harness: r.harness, name: r.name, dir: r.dir })) };
+    } else {
     const r = await roomsFor(cfg);
     out.member = r.member;
     const s = await chRows(cfg, `SELECT count() AS sessions FROM ${r.sessions_v}`);
@@ -1710,23 +2229,46 @@ async function cmdStatus() {
     out.messages = Number(m[0]?.msgs || 0);
     out.freshest = m[0]?.freshest || null;
     out.fleet = await fleetState(cfg);
+    }
     // Nobody runs `update --check`. A member sat four days behind a release that fixed the
     // very thing they were about to hit, with nothing on any screen saying so.
     try { out.update = chan.behind({ version: PKG.version, pinned: cfg.channel || null, tags: await chan.fetchTags() }); }
     catch { /* offline: say nothing rather than guess */ }
-  } catch (e) { out.connected = false; out.error = netReason(e); }
-
-  if (JSON_OUT) { console.log(JSON.stringify(out, null, 2)); return out.connected ? 0 : 1; }
+  } catch (e) {
+    // Connected, but the rooms could not be read: name why (roomsProblem) instead of
+    // reporting a reachable house as unreachable with ClickHouse's UNKNOWN_TABLE.
+    // `connected` keeps its meaning — the house answered AND the rooms read — because
+    // health checks gate on it; `reachable` says the server itself answered.
+    out.reachable = out.connected;
+    out.connected = false;
+    const p = out.reachable ? await roomsProblem(cfg) : null;
+    if (p) { out.rooms_problem = p.kind; out.problem = p.lines; } else out.error = netReason(e);
+  }
+  if (out.reachable === undefined) out.reachable = out.connected;
+
+  // A shipper that predates the switch or the install, and whose passes fail, is not a house
+  // that is fine: say so in the exit code too, since health checks and agents gate on it.
+  const staleFailing = !!(out.shipper.stale && out.shipper.lastPass && out.shipper.lastPass.outcome === 'failed');
+  const healthy = out.connected && !staleFailing;
+  if (JSON_OUT) { console.log(JSON.stringify(out, null, 2)); return healthy ? 0 : 1; }
   console.log(out.config ? ok(`config: ${out.config}`) : warn('no config (memhouse install)'));
-  console.log(out.connected
+  console.log(out.reachable
     ? ok(`connected: ${cfg.url} / ${cfg.db} as ${cfg.user}`)
     : bad(`not connected: ${cfg.url} — ${out.error || 'no reason given'}`));
-  if (!out.connected) console.log('  diagnose it with: memhouse doctor');
-  if (out.member) console.log(ok(`rooms for '${out.member}'`));
+  if (!out.reachable) console.log('  diagnose it with: memhouse doctor');
+  if (out.problem) { console.log(bad(out.problem[0])); console.log(`  ${out.problem[1]}`); }
+  else if (out.reachable && out.error) { console.log(bad(`the house answered, but reading it failed: ${out.error}`)); console.log('  diagnose it with: memhouse doctor'); }
+  if (out.member) console.log(ok(out.schema === 3 ? `schema 3 — tables for '${out.member}': ${Object.values(out.tables).join(', ')}` : `rooms for '${out.member}'`));
+  if (out.source_roots) {
+    const sr = out.source_roots;
+    console.log(sr.error ? bad(`capture roots: ${sr.error}`)
+      : sr.roots.length ? ok(`capture reads${sr.defaulted ? ' (default roots)' : ''}: ${sr.roots.map((r) => `${r.harness}:${r.name}=${short(r.dir)}`).join(', ')}`)
+        : warn('capture reads nothing: no Claude Code projects dir or Codex sessions dir here (set MEMHOUSE_SOURCE_ROOTS)'));
+  }
   // The member owns the rooms; the host says which of their machines wrote a row.
-  console.log(ok(`host: ${out.host.id}${out.host.renamed ? ` (this machine now answers to '${out.host.current_hostname}' — the id is kept so its history stays one machine)` : ''}`));
+  console.log(ok(`host: ${out.host.id}${out.host.label ? ` (${out.host.label})` : ''}${out.host.renamed ? ` (this machine now answers to '${out.host.current_hostname}' — the id is kept so its history stays one machine)` : ''}`));
   if (out.connected && !out.messages) console.log(ok(`house: empty — ${out.sessions} sessions, 0 messages (nothing shipped yet)`));
-  else if (out.connected) console.log(ok(`house: ${out.sessions} sessions, ${out.messages} messages (freshest ingest ${out.freshest} UTC)`));
+  else if (out.connected) console.log(ok(`house: ${out.sessions} sessions, ${out.messages} messages (freshest ingest ${String(out.freshest).replace('T', ' ').replace(/\.\d+Z$/, '')} UTC)`));
   if (out.fleet && out.fleet.length) {
     // A writer appears in this list because it has rows — the list is GROUP BY over the
     // messages, not a registry — so a machine that was re-identified (before host ids were
@@ -1746,7 +2288,7 @@ async function cmdStatus() {
         : f.verdict === 'outdated' ? '  ⚠ supports an older schema — refusing every pass until updated'
           : f.verdict === 'stale' ? '  • stale' : '';
       const tag = retired.includes(f) ? '  · retired' : mark;
-      console.log(`     ${f.writer.padEnd(28)} ${String(f.version || '?').padEnd(8)} last ship ${fleetAge(f.ageMs)}${tag}`);
+      console.log(`     ${f.writer.padEnd(28)} ${String(f.version || (f.harnesses ? f.harnesses.join(',') : '?')).padEnd(f.harnesses ? 18 : 8)} last ship ${fleetAge(f.ageMs)}${f.sessions !== undefined ? `, ${f.sessions} sessions` : ''}${tag}`);
     }
     if (retired.length && flags.all !== true) {
       const oldest = fleetAge(Math.max(...retired.map((f) => f.ageMs)));
@@ -1755,23 +2297,75 @@ async function cmdStatus() {
   }
   {
     const fail = require(path.join(REPO_ROOT, 'memhouse', 'shipper', 'passlog')).describeFailure(out.shipper.lastPass);
+    const stale = out.shipper.running && out.shipper.stale;
     console.log(!out.shipper.running ? warn('shipper: not running')
+      : stale ? (staleFailing ? bad : warn)(`shipper: running — ${out.shipper.via} — stale: ${stale.join('; ')}; it still runs what it read at start${staleFailing ? `, and its last pass failed (${out.shipper.lastPass.why.length > 90 ? `${out.shipper.lastPass.why.slice(0, 87)}…` : out.shipper.lastPass.why})` : ''}`)
       : fail ? warn(`shipper: running — ${out.shipper.via} — but ${fail}`)
       : ok(`shipper: running — ${out.shipper.via}`));
+    if (stale) console.log('  restart it:  memhouse stop && memhouse start');
   }
   if (out.update) console.log(warn(`update available: ${out.update.target} on '${out.update.channel}' — you have ${PKG.version} — run: memhouse update`));
-  console.log(out.daemons.dashboard ? ok(`dashboard: running (pid ${out.daemons.dashboard})`) : warn('dashboard: not running'));
-  if (out.daemons.dashboard) console.log(`  dashboard → http://localhost:${runningPort(cfg)}`);
+  console.log(out.daemons.dashboard
+    ? ok(`dashboard: running (pid ${out.daemons.dashboard}, port ${out.dashboard_port}) — open it with: ${out.dashboard_open}`)
+    : warn('dashboard: not running'));
   // Exit non-zero when the house is unreachable. `status` is what a health check, a
   // cron, or an agent gates on; printing '✗ not connected' and exiting 0 tells every
   // one of them the house is fine.
-  return out.connected ? 0 : 1;
+  return healthy ? 0 : 1;
+}
+
+/**
+ * `memhouse doctor --confirm-empty-store <harness>:<store>`: the store's sessions were deleted. A pass
+ * refuses to take an empty list for that (it is what an unreadable store looks like); this records,
+ * in this home's local state, that the next pass may, while the store is there and its list still
+ * empty. Each session is then taken as deleted only on the editor's reader's answer that it is gone
+ * (memhouse/shipper/adapter-capture.js, THE VANISH SWEEP).
+ */
+function confirmEmptyStore(value) {
+  const v = value === true || value == null ? '' : String(value);
+  const i = v.indexOf(':');
+  if (i <= 0 || i === v.length - 1) {
+    console.error(bad('--confirm-empty-store takes <harness>:<store>, as the shipper log\'s "vanish refused" line names it'));
+    return 2;
+  }
+  const harness = v.slice(0, i); const store = v.slice(i + 1);
+  const ac = require(path.join(REPO_ROOT, 'memhouse', 'shipper', 'adapter-capture'));
+  const pc = require(path.join(REPO_ROOT, 'memhouse', 'shipper', 'profile-capture'));
+  const done = ac.confirmEmptyStore(HOME_DIR, pc.NS, harness, store);
+  if (!done.confirmed.length) {
+    console.error(bad(done.notRefused.length
+      ? `${harness} ${store}: its last capture pass did not refuse it as empty, so there is nothing to confirm`
+      : `${harness} ${store}: no capture pass of this home has swept that store, so there is nothing to confirm`));
+    return 1;
+  }
+  const n = done.confirmed[0].n;
+  console.log(ok(`${harness} ${store}: confirmed empty, for the ${n} session${n === 1 ? '' : 's'} its last pass refused. The next capture pass takes each as deleted when the editor's reader answers it is gone; nothing else is removed. If the house holds other sessions of it by then, the confirmation is dropped.`));
+  if (!ac.storeReadable({ harness_path: store })) console.log(warn(`${store} is not there or cannot be read: the confirmation waits until it is, with its list still empty`));
+  return 0;
 }
 
+// Prices ship in the package (pricing.json, refreshed for each release). A model newer than this
+// build has none until a release adds it; nothing on the machine can price it before then.
+// Whether `memhouse update` helps depends on whether a newer release exists: on the latest one,
+// sending the reader to update loops (update says current, the gap stays).
+let _behind;
+// Whether a newer release is out on this install's channel, read once per doctor
+// (memhouse/release-hint.js). fetchTags returns null offline; that is "unknown", not "current".
+async function releaseBehind(cfg) {
+  if (_behind === undefined) {
+    let tags = null;
+    try { tags = await chan.fetchTags(); } catch { /* offline: unknown, not current */ }
+    _behind = require(path.join(REPO_ROOT, 'memhouse', 'release-hint')).releaseState({ version: PKG.version, pinned: cfg.channel || null, tags });
+  }
+  return _behind;
+}
+function pricingHint(b) { return require(path.join(REPO_ROOT, 'memhouse', 'release-hint')).pricingHint(b, PKG.version); }
+
 async function cmdDoctor() {
+  if (flags['confirm-empty-store'] !== undefined) return confirmEmptyStore(flags['confirm-empty-store']);
   const cfg = resolveConfig();
   const checks = [];
-  const add = (okFlag, label, hint) => checks.push({ ok: okFlag, label, hint });
+  const add = (okFlag, label, hint, o = {}) => checks.push({ ok: okFlag, label, hint, ...o });
 
   // 24 because SQLite comes from `node:sqlite`, which is stable there. It works on 22.13+
   // but prints an ExperimentalWarning on every command, and 20 is past EOL. Below the
@@ -1795,8 +2389,25 @@ async function cmdDoctor() {
     }
     return renderDoctor(checks);
   }
-  try { await ch(cfg, 'SELECT 1', { database: '' }); add(true, `clickhouse reachable (${cfg.url})`); }
-  catch (e) { add(false, `clickhouse reachable (${cfg.url})`, netReason(e)); }
+  let reachable = false;
+  try { await ch(cfg, 'SELECT 1', { database: '' }); add(true, `clickhouse reachable (${cfg.url})`); reachable = true; }
+  catch (e) {
+    // Reached, and the credential refused (ClickHouse's code): named as that, with its fix.
+    add(false, `clickhouse reachable (${cfg.url})`, schemaChoice.isAuthFailure(e)
+      ? `${schemaChoice.authFailureText(cfg.user, cfg.url)} — check MEMHOUSE_USER and MEMHOUSE_PASSWORD in ${short(ENV_FILE)}`
+      : netReason(e));
+  }
+  // The tables are not where this install looks (moved to schema 3, not yet moved, an
+  // administrator credential with no rooms, none at all): say which, with the fix, and skip the
+  // room checks, which would only repeat ClickHouse's UNKNOWN_TABLE at each one.
+  const problem = reachable ? await roomsProblem(cfg) : null;
+  if (problem) {
+    add(false, problem.lines[0], problem.lines[1]);
+    add(false, 'room checks', 'skipped — see the line above');
+    await doctorTail(cfg, add);
+    return renderDoctor(checks);
+  }
+  if (isV3(cfg)) return doctorV3(cfg, checks, add);
   let rooms = null;
   // Room resolution asks the server who you are (SELECT currentUser()). It fails when
   // the house is unreachable or the credential is rejected — both already reported by
@@ -1913,7 +2524,7 @@ async function cmdDoctor() {
     // What the house says about ITSELF — its schema generation and whether a rebuild was
     // left half-done. A migration that failed between the copy and the swap leaves rooms
     // that still work and a `<room>__migrating` nobody would notice; the events table is
-    // the only place that shows it, so doctor reads it rather than the pilot.
+    // the only place that shows it, so doctor reads it rather than the user.
     try {
       const meta = new Map((await chRows(cfg, `SELECT key, value FROM ${physicalRoom('meta', cfg.user)} FINAL`))
         .map((m) => [m.key, String(m.value)]));
@@ -1925,7 +2536,7 @@ async function cmdDoctor() {
       // The ROOMS are the truth; this table is the paperwork. A house whose keys are
       // already current but whose record is missing — a fresh install by an older client,
       // or a member with no rights on meta — is not un-migrated, and telling it to
-      // run migrate-rooms sends the pilot to rebuild rooms that are already correct.
+      // run migrate-rooms sends the user to rebuild rooms that are already correct.
       const recorded = at === String(SCHEMA_VERSION);
       add(!stuck && (recorded || keysCorrect),
         stuck ? `house record: migration ${last.id} is ${last.status} (last touched ${last.at})`
@@ -1945,7 +2556,7 @@ async function cmdDoctor() {
     // A pre-0.10 memhouse on ANOTHER machine reads none of this house's record and still
     // deletes before re-inserting — on migrated rooms that delete reaches every retained
     // parse of a session it re-ships. It cannot be stopped by code here; it can only be
-    // named, loudly, where the pilot looks.
+    // named, loudly, where the user looks.
     try {
       const fleet = await fleetState(cfg);
       if (fleet && fleet.length) {
@@ -2079,11 +2690,10 @@ async function cmdDoctor() {
     // beside a real number reads as "nothing is wrong", which is the opposite of the point.
     const pct = total ? (missed / total) * 100 : 0;
     const share = pct >= 0.5 ? `${Math.round(pct)}% of messages` : `${missed} message${missed === 1 ? '' : 's'}`;
-    add(unpriced.length === 0,
-      unpriced.length === 0
-        ? `pricing: every model in this house has a price (${rows.length} models)`
-        : `pricing: ${unpriced.length} model${unpriced.length > 1 ? 's' : ''} unpriced — ${share} cost nothing in the dashboard (${unpriced.map((r) => r.model).join(', ')})`,
-      'node sync-pricing.js --write   (then re-run doctor)');
+    // A gap in the cost figures, not a fault in the house: a warning, never a failure.
+    if (!unpriced.length) add(true, `pricing: every model in this house has a price (${rows.length} models)`);
+    else add(true, `pricing: ${unpriced.length} model${unpriced.length > 1 ? 's' : ''} unpriced — ${share} cost nothing in the dashboard (${unpriced.map((r) => r.model).join(', ')})`,
+      pricingHint(await releaseBehind(cfg)), { warn: true });
 
     // A source whose rows carry NO tokens costs nothing in the dashboard, which reads as
     // "this editor is free" rather than "this editor's usage was never parsed". That is
@@ -2092,7 +2702,7 @@ async function cmdDoctor() {
     // case: editors/zed.js contains no usage handling at all.
     // origin='ship' only. Imported history came from another product that may never have
     // recorded usage — on this machine four of the five zero-token sources are imports
-    // from memory-house, which is a fact about the past, not an adapter that needs fixing.
+    // from the predecessor tool, which is a fact about the past, not an adapter that needs fixing.
     // Naming them alongside a live adapter gap makes the real one easy to dismiss.
     const zero = await chRows(cfg,
       `SELECT source, count() AS n FROM ${rooms.messages_raw} FINAL WHERE role = 'assistant' AND origin = 'ship' GROUP BY source HAVING sum(input_tokens) + sum(output_tokens) = 0 ORDER BY source`);
@@ -2109,30 +2719,406 @@ async function cmdDoctor() {
     const moved = await adoptMovedHouse(cfg, { fix: false });
     if (moved === 'moved') add(false, `rooms moved to mem.${physicalRoom('messages', cfg.user).replace(/_messages$/, '')}_* — this env still says MEMHOUSE_DB=${cfg.db}`, 'memhouse update   (rewrites the env and restarts the shipper)');
   } catch { /* connection problems are reported above */ }
+  await doctorTail(cfg, add);
+  return renderDoctor(checks);
+}
+
+// What every doctor ends with, on either schema: the release, the daemons, the UI.
+async function doctorTail(cfg, add) {
   {
     // The same shape doctor gives everything else: what is wrong, and the command.
-    let up = null;
-    try { up = chan.behind({ version: PKG.version, pinned: cfg.channel || null, tags: await chan.fetchTags() }); } catch { /* offline */ }
+    const { up } = await releaseBehind(cfg);
     if (up) add(false, `memhouse ${PKG.version} — ${up.target} is out on '${up.channel}'`, 'memhouse update');
   }
   const sh = shipperHealth();
   const shFail = require(path.join(REPO_ROOT, 'memhouse', 'shipper', 'passlog')).describeFailure(sh.lastPass);
-  add(sh.running && !shFail, `shipper${sh.via ? ` — ${sh.via}` : ''}${shFail ? ` — ${shFail}` : ''}`,
+  add(sh.running && !shFail, `shipper${sh.via ? ` — ${sh.via}` : ''}${shFail ? ` — ${shFail}` : ''}${isV3(cfg) && sh.running && !shFail ? ' (schema-3 capture)' : ''}`,
     shFail ? (sh.lastPass.auth ? 'memhouse stop && memhouse start' : 'read: ~/.memhouse/logs/shipper.log') : 'memhouse start (or: memhouse service install)');
-  add(!!pidOf('dashboard'), 'dashboard daemon', 'memhouse start');
-  add(fs.existsSync(path.join(REPO_ROOT, 'public', 'index.html')), 'dashboard UI built', 'built automatically by memhouse start');
+  // The last pass's vanish sweeps (passlog.js vanishChecks): a refused one fails, naming the command an
+  // emptied store needs; a listed session's source its list left out that still read is a warning.
+  for (const c of require(path.join(REPO_ROOT, 'memhouse', 'shipper', 'passlog')).vanishChecks(sh.lastPass)) add(c.ok, c.label, c.hint, { warn: !!c.warn });
+  // The dashboard is optional: the house, the capture and the /mem skills work without it. Not
+  // running is said as a warning, never a failure: doctor's exit is the house's health, and a
+  // reader chasing "memory looks wrong" must not be sent after a page nobody opened.
+  if (pidOf('dashboard')) add(true, 'dashboard daemon');
+  else add(true, 'dashboard daemon: not running — optional; memhouse start runs it', undefined, { warn: true });
+  if (fs.existsSync(path.join(REPO_ROOT, 'public', 'index.html'))) add(true, 'dashboard UI built');
+  else add(true, 'dashboard UI: not built — optional; memhouse start builds it', undefined, { warn: true });
+  // The /mem skills bound to this home: older than this memhouse means agents are taught a
+  // layout and verbs this version does not have. A first run refreshes them (plugin-copies.js);
+  // doctor names any that a refresh could not reach.
+  try {
+    const stale = pluginCopies.staleCopies({ home: HOME_DIR, version: PKG.version });
+    const mine = pluginCopies.claudeTargets().filter((t) => pluginCopies.isPluginInstalled(t.dir) && pluginCopies.boundHome(t.dir) && fs.realpathSync(pluginCopies.boundHome(t.dir)) === fs.realpathSync(HOME_DIR));
+    if (stale.length) add(false, `/mem skills older than memhouse ${PKG.version} in ${stale.map((s) => `${short(s.dir)} (${s.have || 'unknown version'})`).join(', ')}`, 'memhouse plugins install claude, then /reload-plugins in Claude Code');
+    else if (mine.length) add(true, `/mem skills ${PKG.version} in ${mine.map((t) => short(t.dir)).join(', ')}`);
+  } catch { /* nothing installed, or a home that does not exist yet */ }
+}
 
+/**
+ * doctor on a schema-3 install: the five v3 tables (memhouse/house/doctor-v3.js), what the
+ * capture will read, and the shared tail. Nothing here reads the 0.18 rooms. `--full` widens
+ * the identity and duplicate-ts checks from the last 14 days to the whole tables.
+ */
+async function doctorV3(cfg, checks, add) {
+  let t; let rooms = null;
+  try { t = v3Transport(cfg, { timeout: flags.full === true ? 600000 : 60000 }); rooms = await v3RoomsFor(cfg, t); }
+  catch (e) { add(false, 'member', `${e.message} — fix the connection above first`); }
+  if (rooms) {
+    add(true, `member is '${rooms.member}' — schema 3: ${rooms.sessions}, ${rooms.parts}, ${rooms.usage}, ${rooms.calls} (+ ${cfg.db}_archive.${rooms.member}_session_units, _session_sources)`);
+    const hostMod = require(path.join(REPO_ROOT, 'memhouse', 'host.js'));
+    const me = hostMod.identity(HOME_DIR);
+    // Schema 3 keys rows by sessions-model/host/v0; memhouse's own id is this machine's pre-0.20 alias.
+    const sessionsHost = process.env.MEMHOUSE_HOST_ID || hostMod.sessionsHost();
+    try {
+      for (const c of await require(path.join(REPO_ROOT, 'memhouse', 'house', 'doctor-v3')).houseChecks(t, {
+        db: cfg.db, member: rooms.member, full: flags.full === true, hostId: sessionsHost, hostAliases: me.id !== sessionsHost ? [me.id] : [],
+        user: cfg.user, url: cfg.url, pricingHint: pricingHint(await releaseBehind(cfg)),
+      })) add(c.ok, c.label, c.hint, c.warn ? { warn: true } : {});
+    } catch (e) { add(false, 'v3 house checks', e.message); }
+  }
+  // The package that captures Claude Code and Codex on the profile layout. Missing, a pass ships
+  // nothing for them; doctor says so instead of letting an empty house look healthy.
+  {
+    const ac = require(path.join(REPO_ROOT, 'memhouse', 'shipper', 'adapter-capture'));
+    const st = ac.packageStatus();
+    const said = st.ok ? null : ac.packageMessage(st.error);   // loadPackage's own errors say what and where
+    add(st.ok, st.ok ? `harness-session-adapters ${st.version || '(version unknown)'}: Claude Code and Codex are captured` : said,
+      st.ok || said === st.error ? undefined : `${st.error} — install @agent-realm/harness-session-adapters where memhouse is installed, or set MEMHOUSE_SESSION_ADAPTERS to a package checkout for development`);
+  }
+  // What the capture reads — the schema-3 counterpart of the 0.18 adapters check.
+  try {
+    const sr = sourceRootsFor(cfg);
+    if (sr.error) add(false, `capture roots: ${sr.error}`, 'fix MEMHOUSE_SOURCE_ROOTS / MEMHOUSE_CLAUDE_ROOTS in the env file');
+    else if (!sr.roots.length) add(false, 'capture roots: none — no Claude Code projects dir or Codex sessions dir found', 'set MEMHOUSE_SOURCE_ROOTS (comma-separated dirs) — memhouse setup --source-roots …');
+    else {
+      const ads = require(path.join(REPO_ROOT, 'memhouse', 'shipper', 'capture')).defaultAdapters();
+      const per = sr.roots.map((r) => { let n = 0; try { n = ads[r.harness].sessions(r).length; } catch { /* unreadable */ } return `${r.harness}:${r.name} ${n}`; });
+      add(true, `capture roots${sr.defaulted ? ' (default)' : ''}: ${per.join(', ')} sessions on disk — compare with what the house holds: memhouse stats`);
+    }
+  } catch (e) { add(false, 'capture roots', e.message); }
+  await doctorTail(cfg, add);
   return renderDoctor(checks);
 }
 
 function renderDoctor(checks) {
-  for (const c of checks) console.log(c.ok ? ok(c.label) : bad(`${c.label}${c.hint ? ` — ${c.hint}` : ''}`));
+  for (const c of checks) console.log(c.warn ? warn(`${c.label}${c.hint ? ` — ${c.hint}` : ''}`) : c.ok ? ok(c.label) : bad(`${c.label}${c.hint ? ` — ${c.hint}` : ''}`));
   return checks.every((c) => c.ok) ? 0 : 1;
 }
 
+// ── schema 3: the named queries from a shell ────────────────────────────────────
+//
+// `memhouse q <name>` runs one named query of memhouse/house/queries-v3.js (see q-cli.js for
+// the names and their flags) — what the /mem skills call on a schema-3 house instead of SQL
+// over the 0.18 rooms. `memhouse room-sql` is the escape hatch: read-only SQL over the member's
+// tables by their bare names. Neither ever sets `final=1`; FINAL is per table, in the SQL.
+
+function qc() { return require(path.join(REPO_ROOT, 'memhouse', 'house', 'q-cli')); }
+
+/** The roots a schema-3 capture on this install reads (the env file's scope applied). */
+function sourceRootsFor(cfg) {
+  const sr = require(path.join(REPO_ROOT, 'memhouse', 'shipper', 'source-roots'));
+  // discoverClaudeRoots reads process.env, so this install's scope goes there for the call.
+  const keep = { c: process.env.MEMHOUSE_CLAUDE_ROOTS, e: process.env.MEMHOUSE_EDITORS };
+  process.env.MEMHOUSE_CLAUDE_ROOTS = cfg.claudeRoots || '';
+  process.env.MEMHOUSE_EDITORS = cfg.editors || '';
+  try {
+    return sr.effectiveSourceRoots({ env: { ...process.env, MEMHOUSE_SOURCE_ROOTS: cfg.sourceRoots || '' } });
+  } finally {
+    for (const [k, v] of [['MEMHOUSE_CLAUDE_ROOTS', keep.c], ['MEMHOUSE_EDITORS', keep.e]]) {
+      if (v === undefined) delete process.env[k]; else process.env[k] = v;
+    }
+  }
+}
+
+function qError(e, extra = {}) {
+  const usage = e && (e.status === 400 || e.name === 'QueryInputError');
+  if (JSON_OUT) console.log(JSON.stringify({ error: usage ? (e.notFound ? 'not_found' : 'bad_request') : 'query_failed', message: e.message, ...extra }));
+  else console.log(bad(e.message));
+  return usage && !e.notFound ? 2 : 1;
+}
+
+async function cmdQ() {
+  const cfg = resolveConfig();
+  let parsed;
+  try { parsed = qc().parseQ(positional, flags); } catch (e) { return qError(e); }
+  const schema = isV3(cfg) ? 3 : 2;
+  if (parsed.name === 'schema' && !cfg.stated) {
+    // With no house there is no schema to report. "2" here read as a fact about a house that
+    // does not exist, and the skills branch on this answer.
+    if (JSON_OUT) console.log(JSON.stringify({ schema: null, source: null, configured: false }));
+    else console.log('none (no house configured: memhouse install)');
+    return 0;
+  }
+  if (parsed.name === 'schema' || parsed.name === 'list') {
+    const r = await qc().runQ(null, null, parsed, { schema });
+    if (JSON_OUT) console.log(JSON.stringify(parsed.name === 'schema'
+      ? { schema, source: qc().schemaOf({ env: process.env, file: readEnvFile() }).source, configured: cfg.stated } : r));
+    else for (const l of qc().renderQ(parsed.name, r)) console.log(l);
+    return 0;
+  }
+  if (schema !== 3) {
+    const msg = 'memhouse q reads the schema-3 tables (harness-sessions-sql\'s profile: sessions, session_parts, session_usage, calls); this install is on the 0.18 rooms (MEMHOUSE_SCHEMA is not 3). Use the SQL in the /mem skills, or memhouse search / stats.';
+    if (JSON_OUT) console.log(JSON.stringify({ error: 'schema', schema, message: msg })); else console.log(bad(msg));
+    return 2;
+  }
+  requireConfig(cfg, 'q');
+  try {
+    const t = v3Transport(cfg);
+    const rooms = await v3RoomsFor(cfg, t, parsed.member);
+    const r = await qc().runQ(t.exec, rooms, parsed, { schema });
+    if (JSON_OUT) console.log(JSON.stringify(r));
+    else for (const l of qc().renderQ(parsed.name, r)) console.log(l);
+    return r && r.error ? 1 : 0;
+  } catch (e) { return qError(e); }
+}
+
+async function cmdRoomSql() {
+  const cfg = resolveConfig();
+  let sql = positional.join(' ');
+  if ((!sql || sql === '-') && !process.stdin.isTTY) { try { sql = fs.readFileSync(0, 'utf-8'); } catch { sql = ''; } }
+  if (sql === '-') sql = '';
+  requireConfig(cfg, 'room-sql');
+  const schema = isV3(cfg) ? 3 : 2;
+  const names = schema === 3 ? ['sessions', 'session_parts', 'session_usage', 'session_links', 'session_lifecycle', 'calls', 'meta', 'events'] : ['messages', 'tool_calls', 'sessions', 'meta', 'events'];
+  try {
+    const t = v3Transport(cfg, { timeout: 120000 });
+    let member = flags.member && flags.member !== true ? String(flags.member) : (process.env.MEMHOUSE_MEMBER || readEnvFile().MEMHOUSE_MEMBER || null);
+    if (!member) member = ((await t.q.rows('SELECT currentUser() AS u'))[0] || {}).u;
+    if (!sql.trim()) {
+      const map = Object.fromEntries(names.map((n) => [n, `${cfg.db}.${member}_${n}`]));
+      if (JSON_OUT) { console.log(JSON.stringify({ schema, member, database: cfg.db, tables: map })); return 0; }
+      console.log(`memhouse room-sql "<SELECT …>"  (or SQL on stdin) — read-only, bare names resolve for '${member}' (schema ${schema}):`);
+      for (const [n, fq] of Object.entries(map)) console.log(`  ${n.padEnd(17)} → ${fq}`);
+      if (schema === 3) console.log('\n  Read them FINAL and filter is_deleted = 0 AND removed = 0; a session is (host, harness, harness_path, session_id, incarnation).');
+      return 0;
+    }
+    const body0 = qc().rewriteRooms(sql, { member, db: cfg.db, schema });
+    qc().assertRead(body0);
+    if (flags.print === true) { console.log(body0); return 0; }
+    const stripped = body0.trim().replace(/;\s*$/, '');
+    if (JSON_OUT) {
+      if (qc().hasFormat(stripped)) return qError(Object.assign(new Error('--json picks the format itself — drop the FORMAT clause'), { status: 400 }));
+      const text = await t.raw(`${stripped}\nFORMAT JSONEachRow`, { database: cfg.db });
+      console.log(JSON.stringify(text.split('\n').filter(Boolean).map((l) => JSON.parse(l))));
+      return 0;
+    }
+    const text = await t.raw(qc().hasFormat(stripped) ? stripped : `${stripped}\nFORMAT PrettyCompact`, { database: cfg.db });
+    process.stdout.write(text.endsWith('\n') || !text ? text : `${text}\n`);
+    return 0;
+  } catch (e) { return qError(e); }
+}
+
+// `memhouse import claude-ai`: a claude.ai export into the house (memhouse/import/). A dry run
+// unless --write; --undo <batch> tombstones a batch, --list shows them. Counts only, never content.
+const IMPORT_USAGE = [
+  'usage: memhouse import claude-ai <export zips… | folder of export zips | unpacked export folder | archive folder> [--update] [--batch ID] [--write]',
+  '       memhouse import claude-ai --undo <batch> [--write]',
+  '       memhouse import claude-ai --list',
+  '  A dry run unless --write. Guide: docs/guides/import-claude-ai.md',
+];
+
+function importOut(obj, lines) {
+  if (JSON_OUT) console.log(JSON.stringify(obj, null, 2));
+  else for (const l of lines) console.log(l);
+}
+
+async function cmdImport() {
+  const usage = (msg) => {
+    if (JSON_OUT) console.log(JSON.stringify({ error: 'usage', message: msg }));
+    else { if (msg) console.log(bad(msg)); for (const l of IMPORT_USAGE) console.log(l); }
+    return 2;
+  };
+  if (positional[0] !== 'claude-ai') return usage(positional[0] ? `nothing imports from '${positional[0]}' — the one source is claude-ai` : '');
+  const listing = flags.list === true;
+  const undoing = flags.undo !== undefined;
+  // The export arrives as part zips (conversations-000.zip, design_chats-000.zip, …): several
+  // inputs are the parts of one export.
+  const inputs = positional.slice(1);
+  const input = inputs.length > 0;
+  if (flags.undo === true) return usage('--undo takes the batch to undo (memhouse import claude-ai --list shows them)');
+  if (flags.batch === true) return usage('--batch takes a batch id');
+  if ([listing, undoing, input].filter(Boolean).length !== 1) return usage('give one of: the export (its zips, or a folder), --undo <batch>, --list');
+  if ((listing || undoing) && (flags.update === true || flags.batch !== undefined)) return usage('--update and --batch go with an input path');
+  if (listing && flags.write === true) return usage('--list writes nothing; drop --write');
+  const cfg = resolveConfig();
+  if (!isV3(cfg)) return usage('import writes schema-3 tables; this install is on the 0.18 rooms (MEMHOUSE_SCHEMA is not 3)');
+  requireConfig(cfg, 'import');
+  const IM = require(path.join(REPO_ROOT, 'memhouse', 'import', 'import'));
+  const CA = require(path.join(REPO_ROOT, 'memhouse', 'import', 'claude-ai'));
+  const V3 = require(path.join(REPO_ROOT, 'memhouse', 'house', 'schema-v3'));
+  const fail = (e) => {
+    const refusal = e instanceof IM.ImportRefusal || e instanceof CA.ImportInputError;
+    if (JSON_OUT) console.log(JSON.stringify({ error: refusal ? 'refused' : 'failed', message: e.message }));
+    else console.log(bad(e.message));
+    return refusal ? 2 : 1;
+  };
+  let parsed = null;
+  if (input) {
+    try { parsed = CA.readInput(inputs.map((p) => p.replace(/^~(?=\/|$)/, os.homedir()))); } catch (e) { return fail(e); }
+  }
+  try {
+    const t = v3Transport(cfg, { timeout: 600000 });
+    const rooms = await v3RoomsFor(cfg, t);
+    const names = V3.v3Names(cfg.db, rooms.member);
+    const house = IM.houseOver({ rows: (sql) => t.q.rows(sql), write: (sql, settings) => t.raw(sql, { write: true, settings }) });
+    if (listing) {
+      const batches = await IM.list(house, names);
+      importOut({ member: names.member, batches }, batches.length
+        ? [`claude.ai import batches for '${names.member}':`, ...batches.map((b) => `  ${b.batch.padEnd(32)} ${String(b.sessions).padStart(6)} sessions  ${String(b.messages).padStart(7)} messages  ${b.first || '-'} .. ${b.last || '-'}${b.status ? `  (${b.status})` : ''}`)]
+        : [warn(`no claude.ai import batch in '${names.member}'`)]);
+      return 0;
+    }
+    if (undoing) {
+      const batch = IM.checkBatchId(flags.undo);
+      const r = await IM.undo(house, names, batch, { write: flags.write === true, version: PKG.version });
+      const b = r.before;
+      const what = `${b.sessions} sessions, ${b.turns} turns, ${b.calls} calls`;
+      if (!b.sessions && !b.turns && !b.calls && !r.finishing) { importOut(r, [warn(`batch '${batch}' holds no live rows — nothing to undo`)]); return 0; }
+      if (!r.written) {
+        importOut({ ...r, dry_run: true }, [`undo ${batch} — dry run, nothing written`,
+          r.finishing ? '  an undo of it stopped after its last tombstone; it would be recorded as undone' : `  would tombstone ${what}`,
+          `  to do it: memhouse import claude-ai --undo ${batch} --write`]);
+        return 0;
+      }
+      if (r.finishing) { importOut(r, [ok(`undo ${batch}: its rows were already tombstoned; recorded as undone`)]); return 0; }
+      const left = r.after.sessions + r.after.turns + r.after.calls;
+      importOut(r, [left ? bad(`undo ${batch}: ${left} live rows remain`) : ok(`undo ${batch}: tombstoned ${what}; FINAL reads no longer show them`)]);
+      return left ? 1 : 0;
+    }
+    const p = await IM.plan(house, names, parsed, { update: flags.update === true });
+    const batch = flags.batch !== undefined ? IM.checkBatchId(flags.batch) : IM.newBatchId();
+    const cats = Object.entries(p.input.categories).map(([k, v]) => `${k} ${v}`).join(', ');
+    const skipped = Object.entries(p.skipped_blocks).sort().map(([k, v]) => `${k} ${v}`).join(', ');
+    const s = p.sessions;
+    const repairN = p.repair.length;
+    const stopped = p.stopped_batches;
+    const report = [
+      `  input       ${p.input.kind}: ${p.input.conversations} conversations${cats ? ` (${cats})` : ''}${p.input.kind === 'parts' ? ` from ${p.input.read.join(', ')}` : ''}`,
+      ...(p.input.ignored.length ? [`  ignored     ${p.input.ignored.join(', ')} (not conversations)`] : []),
+      `  house       '${names.member}', layout ${p.layout}: ${p.house.claude_ai_sessions} claude.ai sessions`,
+      `  sessions    new ${s.new} · already imported ${s.same}${s.older ? ` (${s.older} older in the input than in the house)` : ''} · changed since ${s.changed}${s.changed ? ` (${s.changed_newer} newer, ${s.changed_content} same time, other content)` : ''}${s.changed && !s.update ? ', not written; --update rewrites them' : ''} · empty ${s.empty}${s.duplicates ? ` · duplicates ${s.duplicates}` : ''}`,
+      `  ${flags.write === true ? 'writing' : 'would write'}  ${p.write.sessions} sessions, ${p.write.turns} turns, ${p.write.calls} calls${p.write.rewritten ? ` (${p.write.rewritten} rewritten over earlier rows)` : ''}`,
+      ...(p.span ? [`  span        ${p.span[0]} .. ${p.span[1]}`] : []),
+      ...(skipped ? [`  not stored  ${skipped}`] : []),
+      ...(repairN ? [`  repair      ${repairN} session row(s) a stopped run left unfilled: ${flags.write === true ? 'refreshing' : 'a --write refreshes them'}`] : []),
+      ...(stopped.length ? [`  stopped     batch ${stopped.join(', ')}: its rows went in, its run did not finish; ${flags.write === true ? 'recording it applied' : 'a --write records it applied'}`] : []),
+    ];
+    // A repair alone uses no batch.
+    const summary = { ...p, work: undefined, batch: p.write.sessions ? batch : null };
+    if (flags.write !== true) {
+      importOut({ ...summary, dry_run: true }, ['memhouse import claude-ai — dry run, nothing written', ...report,
+        ...(p.write.sessions || repairN || stopped.length ? [`  to ${p.write.sessions ? 'write it' : 'repair'}: memhouse import claude-ai ${inputs.map((x) => (/^[\w@%+=:,./~-]+$/.test(x) ? x : `'${x.replace(/'/g, "'\\''")}'`)).join(' ')} --write${s.update ? ' --update' : ''}`] : [ok('nothing to write')])]);
+      return 0;
+    }
+    if (!p.write.sessions) {
+      // Nothing to write; the rows a stopped run left are still refreshed (no batch is recorded).
+      const r = repairN || stopped.length ? await IM.apply(house, names, p, { batch, version: PKG.version }) : null;
+      const done = [...(r && r.repaired ? [`${r.repaired} session row(s) refreshed`] : []), ...(r && r.completed.length ? [`batch ${r.completed.join(', ')} applied`] : [])];
+      importOut({ ...summary, batch: null, written: null, repaired: r ? r.repaired : 0, completed: r ? r.completed : [] }, ['memhouse import claude-ai', ...report,
+        ok(done.length ? `nothing to write; ${done.join('; ')}` : 'nothing to write')]);
+      return 0;
+    }
+    if (!JSON_OUT) { console.log(`memhouse import claude-ai — batch ${batch}`); for (const l of report) console.log(l); }
+    const r = await IM.apply(house, names, p, { batch, version: PKG.version, onProgress: (m) => { if (!JSON_OUT) console.log(`  ${m}`); } });
+    const c = r.counts;
+    const match = c.sessions === r.written.sessions && c.turns === r.written.turns && c.calls === r.written.calls;
+    importOut({ ...summary, ...r }, [
+      match ? ok(`batch ${batch}: ${c.sessions} sessions, ${c.messages} messages, ${c.turns} turns, ${c.calls} calls read back`)
+        : bad(`batch ${batch}: read back ${c.sessions} sessions, ${c.turns} turns, ${c.calls} calls against ${r.written.sessions}, ${r.written.turns}, ${r.written.calls} written`),
+      ...(r.completed.length ? [`  stopped batch ${r.completed.join(', ')} applied`] : []),
+      `  undo: memhouse import claude-ai --undo ${batch} --write`,
+    ]);
+    return match ? 0 : 1;
+  } catch (e) { return fail(e); }
+}
+
+async function cmdSearchV3(cfg) {
+  const p = { ...flags };
+  delete p.json;
+  try {
+    const parsed = qc().parseQ(['search', ...positional], p);
+    const t = v3Transport(cfg);
+    const r = await qc().runQ(t.exec, await v3RoomsFor(cfg, t), parsed);
+    if (JSON_OUT) console.log(JSON.stringify(r.hits, null, 2));
+    else if (!r.hits.length) console.log(warn(`no matches for ${r.terms.map((x) => `'${x}'`).join(' and ')}`));
+    else for (const l of qc().renderQ('search', r)) console.log(l);
+    return 0;
+  } catch (e) { return qError(e); }
+}
+
+async function cmdResumeV3(cfg) {
+  const { resumeFor } = require(path.join(REPO_ROOT, 'memhouse', 'resume'));
+  let rows; let label;
+  try {
+    const t = v3Transport(cfg);
+    const rooms = await v3RoomsFor(cfg, t);
+    const ref = qc().parseRef(positional[0], flags);
+    label = rooms.sessions;
+    rows = await t.exec(qc().resumeSpec(rooms, ref));
+  } catch (e) { return qError(e); }
+  // The ref names the session's store, so the same id on two hosts or in two stores is never confused.
+  const view = (r) => ({ session_id: require(path.join(REPO_ROOT, 'memhouse', 'house', 'queries-v3')).sessionRef(r), harness: r.harness, native_id: r.session_id, source: r.harness, folder: r.folder, name: r.name, origin: r.origin, at: r.ended_ms ? new Date(Number(r.ended_ms)).toISOString().slice(0, 16).replace('T', ' ') : null });
+  if (!rows.length) {
+    if (JSON_OUT) return console.log(JSON.stringify({ error: 'no such session', session_id: positional[0] }, null, 2)), 1;
+    console.log(bad(`no session '${positional[0]}' in ${label}`));
+    console.log('  find one with: memhouse search <terms>');
+    return 1;
+  }
+  if (rows.length > 1) {
+    if (JSON_OUT) return console.log(JSON.stringify({ error: 'ambiguous', matches: rows.map(view) }, null, 2)), 1;
+    console.log(warn(`'${positional[0]}' matches ${rows.length} sessions — name one exactly:`));
+    for (const r of rows.map(view)) console.log(`  ${r.session_id}  ${r.at || '-'}  ${r.name || '-'}`);
+    return 1;
+  }
+  const row = view(rows[0]);
+  const res = resumeFor(row);
+  if (JSON_OUT) return console.log(JSON.stringify({ ...row, ...res }, null, 2)), (res.ok ? 0 : 1);
+  console.log(`\x1b[1m${row.session_id}\x1b[0m  ${row.at || '-'}  ${row.name || '-'}`);
+  if (!res.ok) { console.log(bad(res.reason)); if (res.folder) console.log(`  the session ran in: ${res.folder}`); return 1; }
+  console.log('');
+  console.log(`  ${res.command}`);
+  console.log('');
+  if (!res.folder) console.log(warn('no folder was recorded for this session — run it from the right directory yourself'));
+  return 0;
+}
+
+async function cmdStats(cfg) {
+  requireConfig(cfg, 'stats');
+  // Same reasons status names, before a query (or the shipper's --stats) meets the missing
+  // tables and passes ClickHouse's error and SQL through.
+  const problem = await roomsProblem(cfg);
+  if (problem) {
+    if (JSON_OUT) console.log(JSON.stringify({ error: problem.kind, message: problem.lines.join(' — ') }));
+    else { console.log(bad(problem.lines[0])); console.log(`  ${problem.lines[1]}`); }
+    return 1;
+  }
+  if (isV3(cfg)) {
+    try {
+      const t = v3Transport(cfg);
+      const s = await qc().statsV3(t.exec, await v3RoomsFor(cfg, t));
+      if (JSON_OUT) console.log(JSON.stringify(s, null, 2)); else for (const l of qc().renderStats(s)) console.log(l);
+      return 0;
+    } catch (e) { return qError(e); }
+  }
+  if (!JSON_OUT) return run(SHIP_JS, ['--stats'], cfg);
+  // Schema 2, --json: the same per-source rollup ship.js --stats prints, as data.
+  try {
+    const r = await roomsFor(cfg);
+    const rows = await chRows(cfg, `SELECT source, count() AS sessions, sum(total_msgs) AS messages,
+      sum(input_tokens + output_tokens + cache_read_tokens + cache_write_tokens) AS tokens
+      FROM ${r.sessions_v} GROUP BY source ORDER BY sessions DESC`);
+    const out = rows.map((x) => ({ source: x.source, sessions: Number(x.sessions), messages: Number(x.messages), tokens: Number(x.tokens) }));
+    const total = out.reduce((a, x) => ({ sessions: a.sessions + x.sessions, messages: a.messages + x.messages, tokens: a.tokens + x.tokens }), { sessions: 0, messages: 0, tokens: 0 });
+    console.log(JSON.stringify({ schema: 2, sources: out, total }, null, 2));
+    return 0;
+  } catch (e) { console.log(JSON.stringify({ error: 'query_failed', message: netReason(e) })); return 1; }
+}
+
 async function cmdSearch() {
   if (!positional.length) { console.log('usage: memhouse search <terms…>'); return 2; }
   const cfg = requireConfig(resolveConfig(), 'search');
+  if (isV3(cfg)) return cmdSearchV3(cfg);
   const needle = positional.join(' ').toLowerCase().replace(/[%_\\]/g, '\\$&').replace(/'/g, "\\'");
   const r = await roomsFor(cfg);
   const rows = await chRows(cfg, `
@@ -2154,14 +3140,14 @@ async function cmdSearch() {
   }
 }
 
-// `search` finds the session; this hands the pilot back into it. memhouse has been a
+// `search` finds the session; this hands the user back into it. memhouse has been a
 // read-only archive — you could find the conversation that solved this before and not
 // return to it.
 //
 // It PRINTS the command and does not run it, and that is the whole design. Running it would
 // have to guess a terminal, inherit this process's cwd, and hope the id is still live; when
-// any of that is wrong the CLI does not fail, it opens a NEW session — the pilot loses the
-// transcript they asked for while the tool reports success. Printed, the pilot reads it,
+// any of that is wrong the CLI does not fail, it opens a NEW session — the user loses the
+// transcript they asked for while the tool reports success. Printed, the user reads it,
 // pastes it, and owns the result.
 async function cmdResume() {
   if (!positional.length) {
@@ -2169,12 +3155,13 @@ async function cmdResume() {
     return 2;
   }
   const cfg = requireConfig(resolveConfig(), 'resume');
+  if (isV3(cfg)) return cmdResumeV3(cfg);
   const { resumeFor } = require(path.join(REPO_ROOT, 'memhouse', 'resume'));
   // Same escaping as search: this value is interpolated into SQL, and a session id is not
   // guaranteed to be tame — it comes from whatever the editor wrote on disk.
   const want = positional[0].replace(/[\\']/g, '\\$&');
   const r = await roomsFor(cfg);
-  // Two ways to name a session, because there are two ways it gets in front of the pilot:
+  // Two ways to name a session, because there are two ways it gets in front of the user:
   // the canonical `<source>:<id>` that search and the prompt print, and the bare native id
   // that the editor's own UI shows. FINAL because sessions is a ReplacingMergeTree and a
   // re-shipped session has an older row underneath — without it a moved project resolves to
@@ -2212,7 +3199,7 @@ async function cmdResume() {
   if (!res.ok) {
     console.log(bad(res.reason));
     // The folder is still worth printing: for a GUI editor it is the one actionable thing
-    // memhouse knows, and opening it is what the pilot would do next anyway.
+    // memhouse knows, and opening it is what the user would do next anyway.
     if (res.folder) console.log(`  the session ran in: ${res.folder}`);
     return 1;
   }
@@ -2226,7 +3213,7 @@ async function cmdResume() {
 // Which kind of installation is this process running out of? Every upgrade path below
 // depends on the answer, and getting it wrong is not a no-op: running `git pull` in a
 // global install does nothing visible, and `npm i -g` from a checkout installs the
-// PUBLISHED version over the branch the pilot was testing.
+// PUBLISHED version over the branch the user was testing.
 function installKind() {
   const root = fs.realpathSync(REPO_ROOT);
   // npx unpacks into a cache directory keyed by a hash. Nothing there is upgradable — the
@@ -2262,7 +3249,11 @@ async function cmdUpdate() {
   // written at all.
   const stored = readEnvFile().MEMHOUSE_CHANNEL || null;
   const pinned = asked || cfg0.channel || null;
-  const tags = await chan.fetchTags();
+  // The tags come from the registry npm installs from (npm config get registry), not always npmjs.
+  const reg = await chan.readTags();
+  const tags = reg.tags;
+  const registry = chan.shownRegistry(reg.registry);
+  const unanswered = `the registry (${registry}) could not be read: ${reg.error}`;
   const pick = chan.pickChannel({ version: PKG.version, pinned, tags });
   // --channel pins for this run AND every later one: the point of pinning is that the next
   // person to type `memhouse update` does not have to remember it. Only a channel the
@@ -2271,7 +3262,7 @@ async function cmdUpdate() {
   // that does not exist, --no-install included, which checks no channel at all (A5).
   if (asked && asked !== stored) {
     if (!tags) {
-      console.log(warn(`the registry did not answer, so channel '${asked}' cannot be checked — not pinned`));
+      console.log(warn(`${unanswered} — channel '${asked}' cannot be checked, so it is not pinned`));
     } else if (!tags[asked]) {
       console.log(bad(`no channel '${asked}' on the registry — nothing pinned, nothing changed`));
       console.log(`  channels: ${Object.keys(tags).join(', ')}`);
@@ -2282,10 +3273,14 @@ async function cmdUpdate() {
     }
   }
   const latest = pick.target;
-  if (JSON_OUT && flags.check) return console.log(JSON.stringify({ kind, root, current: PKG.version, channel: pick.channel, target: pick.target, reason: pick.reason, tags }, null, 2));
+  if (JSON_OUT && flags.check) return console.log(JSON.stringify({ kind, root, current: PKG.version, registry, registry_error: reg.error, channel: pick.channel, target: pick.target, reason: pick.reason, tags }, null, 2));
   console.log(`  installed  ${PKG.version}  (${kind}: ${root})`);
+  console.log(`  registry   ${registry}${tags ? '' : `  (could not be read: ${reg.error})`}`);
   console.log(`  channel    ${pick.channel || '—'}  (${pick.reason})`);
-  console.log(`  target     ${pick.target || (tags ? 'nothing to install' : 'unknown — the registry did not answer')}`);
+  console.log(`  target     ${pick.target || (tags ? 'nothing to install' : 'unknown')}`);
+  // A registry that does not answer is a network or npm-config matter: --channel cannot help,
+  // since a channel is checked against the same registry.
+  const registryHint = () => console.log(`  npm installs from ${registry} (npm config get registry); once it answers, run memhouse update again`);
   if (latest && latest === PKG.version && kind !== 'checkout') console.log(ok('already current'));
   if (flags.check) return 0;
   // --no-install asks for the restart and the house checks only; the files are already in
@@ -2296,10 +3291,11 @@ async function cmdUpdate() {
   const noInstall = flags['no-install'] === true;
   if (!pick.channel && kind !== 'checkout' && !noInstall) {
     console.log(warn('no automatic update for this install'));
-    console.log(`  ${pick.reason}`);
+    if (!tags) { console.log(`  ${unanswered}`); registryHint(); } else console.log(`  ${pick.reason}`);
     return 1;
   }
   if (pick.channel && !pick.target && kind !== 'checkout' && !noInstall) {
+    if (!tags) { console.log(bad(`${unanswered} — nothing to install, nothing changed`)); registryHint(); return 1; }
     console.log(bad(`channel '${pick.channel}' has no version on the registry — nothing to install, nothing changed`));
     return 1;
   }
@@ -2326,7 +3322,7 @@ async function cmdUpdate() {
 
   if (noInstall) {
     // The files were already replaced by other means — a hand-typed `npm i -g`, a tarball,
-    // a configuration manager. The npm/git half is exactly what such a pilot has already
+    // a configuration manager. The npm/git half is exactly what such a user has already
     // done, and the half a bare install leaves undone (restart, migrations, schema heal)
     // is exactly what they came here for.
     console.log(warn('--no-install: files assumed current; restarting and checking the house only'));
@@ -2364,7 +3360,13 @@ async function cmdUpdate() {
   // The house may have been converted to the one layout since this machine last ran:
   // the member's rooms moved from <name>.* to mem.<name>_*. Fix the env here, before the
   // shipper restarts, or its first pass refuses the old address forever.
-  try { await adoptMovedHouse(resolveConfig()); } catch { /* doctor will say */ }
+  // (Schema 3 has no such move: its tables were created in place, under the configured house.)
+  // A machine with no member install (an administrator's, with only MEMHOUSE_URL and the
+  // MEMHOUSE_ADMIN_* variables) has no house of its own to bring up to date: the steps below would
+  // connect as the default member and print its authentication failures as the house's state.
+  const memberHere = !!resolveConfig().userStated;
+  if (!memberHere) console.log(ok('no member install on this machine: no house schema or migration to check here (members and the admin do that on theirs)'));
+  if (memberHere && !isV3(resolveConfig())) { try { await adoptMovedHouse(resolveConfig()); } catch { /* doctor will say */ } }
 
   // Bring the house to the schema the NEW code expects, before any daemon restarts.
   // A release that adds rooms (0.18.3's stat tables) used to land after the restart, so
@@ -2373,7 +3375,7 @@ async function cmdUpdate() {
   // 500'd — all of it self-healing eventually, all of it alarming meanwhile. Two real
   // members hit this within an hour of each other. The new binary owns the new schema, so
   // it runs it here, in the one moment the daemons are already down.
-  {
+  if (memberHere) {
     const r = spawnSync(process.execPath, [path.join(REPO_ROOT, 'memhouse', 'shipper', 'ship.js'), '--ensure-schema'],
       { env: childEnv(resolveConfig()), encoding: 'utf-8', stdio: 'pipe', timeout: 120000 });
     const said = `${r.stdout || ''}${r.stderr || ''}`.trim().split('\n').filter((l) => l.includes('[memhouse]')).pop();
@@ -2406,19 +3408,19 @@ async function cmdUpdate() {
   }
 
   // Restarting is the half a bare `npm i -g` leaves undone. The daemons notice on their own
-  // within a loop interval (memhouse/self-update.js), but a pilot who typed `update` should
+  // within a loop interval (memhouse/self-update.js), but a user who typed `update` should
   // not have to wait for it, and the dashboard's stale bundle is visible immediately.
   if (svc.installed) {
     // REINSTALL the unit, do not merely advise a restart. Two reasons, both measured on
-    // testbed. The unit inlines its template AND the env at service-install time, so a
+    // a test VM. The unit inlines its template AND the env at service-install time, so a
     // fix shipped in a release (Restart=on-failure -> always was one; the self-update
     // handover exits 0 and an on-failure unit stays DEAD after every upgrade) never
     // reaches an existing install through a restart. And the advice route ends with a
-    // pilot who did everything `update` said and still has a dead shipper.
+    // user who did everything `update` said and still has a dead shipper.
     // service.js install is idempotent: same home replaces in place and starts it.
     try {
       const svcmod = require(path.join(REPO_ROOT, 'memhouse', 'service.js'));
-      // Keep the interval the pilot chose. The refresh used to hardcode 300, silently
+      // Keep the interval the user chose. The refresh used to hardcode 300, silently
       // rewriting a `service install --interval 30` unit on every update.
       let interval = 300;
       try {
@@ -2452,14 +3454,23 @@ async function cmdUpdate() {
     console.log(warn('no daemons were running — start them with: memhouse start'));
   }
 
-  // The new release may need the HOUSE moved too, and upgrade time is when the pilot is
+  // The new release may need the HOUSE moved too, and upgrade time is when the user is
   // watching — a migration named here beats one discovered as a refusing service in a log
-  // nobody reads. Three behaviours, chosen by the pilot:
+  // nobody reads. Three behaviours, chosen by the user:
   //   memhouse update --migrate   run whatever is pending, unasked (--yes implies it)
   //   interactive                 name what is pending and ask
   //   non-interactive, no flag    name it and print the command; NEVER auto-run — a cron
   //                               or CI invocation must not start a house-wide copy
   const cfg = resolveConfig();
+  if (!memberHere) return 0;
+  if (cfg.url && cfg.user && isV3(cfg)) {
+    // Schema 3: the 0.18 migrations are about the 0.18 rooms, which this install neither reads
+    // nor writes. What it needs is its five tables, verified — ship.js --ensure-schema does that
+    // on a schema-3 install (it never runs a capture pass in that mode).
+    const code = run(SHIP_JS, ['--ensure-schema'], cfg);
+    if (code !== 0) { console.log(warn('the schema 3 tables need attention — memhouse doctor')); return code; }
+    return 0;
+  }
   if (cfg.url && cfg.user) {
     try {
       const r = await roomsFor(cfg);
@@ -2497,91 +3508,17 @@ async function cmdUpdate() {
   return 0;
 }
 
-// Every Claude Code instance on this machine, not just the default one.
-//
-// A pilot rarely has one. `~/.claude` is the stock install, `CLAUDE_CONFIG_DIR` points at
-// whichever they are running right now, and playbook installs live under
-// `~/.claude-playbooks/<name>[/playbook]`, each a complete config directory with its own
-// skills/. Installing into one and calling it done leaves /mem:recall missing from
-// every other instance the pilot uses — silently, because a missing skill does not announce
-// itself, it just never appears.
-//
-// The discovery is the ADAPTER's (editors/claude.js discoverClaudeRoots), reused rather
-// than reimplemented: it already ports memory-house's discover_roots and runs on every
-// ship. A second copy here would drift the first time a playbook layout changes — which is
-// the same defect this repo just retired in install.sh.
-function claudeTargets() {
-  const seen = new Map(); // realpath -> { dir, why }
-  const add = (dir, why) => {
-    if (!dir) return;
-    let isDir = false;
-    try { isDir = fs.statSync(dir).isDirectory(); } catch { /* missing */ }
-    if (!isDir) return;
-    let rp; try { rp = fs.realpathSync(dir); } catch { rp = dir; }
-    if (!seen.has(rp)) seen.set(rp, { dir, why });
-  };
-  // The instance the caller is running under comes first, and is NOT subject to the
-  // adapter's "has this been used?" test — a fresh config dir has no projects/ yet, and it
-  // is exactly where the pilot wants the skills.
-  add(process.env.CLAUDE_CONFIG_DIR, 'CLAUDE_CONFIG_DIR');
-  add(path.join(os.homedir(), '.claude'), 'default');
-  try {
-    const { discoverClaudeRoots } = require(path.join(REPO_ROOT, 'editors', 'claude'));
-    for (const r of discoverClaudeRoots()) add(r, 'playbook');
-  } catch { /* adapter unavailable — the two above still stand */ }
-  return [...seen.values()];
-}
-
+// The plugin's installed copies: discovery, install and the first-run refresh live in
+// memhouse/plugin-copies.js, so the shipper keeps them current too.
+const pluginCopies = require(path.join(REPO_ROOT, 'memhouse', 'plugin-copies'));
+const claudeTargets = () => pluginCopies.claudeTargets();
 const short = (p) => p.replace(os.homedir(), '~');
-const PLUGIN_MARK = path.join('skills', 'mem', '.claude-plugin', 'plugin.json');
-const isPluginInstalled = (dir) => fs.existsSync(path.join(dir, PLUGIN_MARK));
-
-function installPluginInto(dir) {
-  // The plugin was named `memhouse` until 0.10.0. A leftover copy under the old name
-  // would load BESIDE the new one — /memhouse:search and /mem:recall both resolving, one
-  // of them stale forever. Remove it only when it is provably OURS (it carries our
-  // plugin.json); a directory someone else named `memhouse` is not ours to delete.
-  const legacy = path.join(dir, 'skills', 'memhouse');
-  const legacyManifest = path.join(legacy, '.claude-plugin', 'plugin.json');
-  if (fs.existsSync(legacyManifest)) {
-    let lname = null;
-    try { lname = JSON.parse(fs.readFileSync(legacyManifest, 'utf-8')).name; } catch { /* unreadable */ }
-    if (lname === 'memhouse' || lname === 'mem') {
-      fs.rmSync(legacy, { recursive: true });
-      console.log(ok(`removed the pre-0.10 plugin at ${short(legacy)} (renamed to 'mem')`));
-    }
-  }
-  const dst = path.join(dir, 'skills', 'mem');
-  // REPLACE, not overlay. cpSync over an existing install refreshes the skills and
-  // leaves anything else standing — a machine that once had a build with extra skills
-  // kept offering /mem:replay and /mem:house forever, stale, beside the real ones.
-  // Ownership means OUR MANIFEST, checked by name — "any plugin.json" would have deleted
-  // an unrelated plugin that happened to pick the same directory name.
-  const dstManifest = path.join(dst, '.claude-plugin', 'plugin.json');
-  if (fs.existsSync(dstManifest)) {
-    let name = null;
-    try { name = JSON.parse(fs.readFileSync(dstManifest, 'utf-8')).name; } catch { /* unreadable */ }
-    if (name === 'mem' || name === 'memhouse') fs.rmSync(dst, { recursive: true });
-    else throw new Error(`skills/mem in ${dir} belongs to plugin '${name || '(unreadable manifest)'}' — refusing to replace it`);
-  }
-  fs.mkdirSync(dst, { recursive: true });
-  fs.cpSync(path.join(DELIVERY, 'plugin'), dst, { recursive: true });
-  // Stamp the manifest with THIS memhouse's version. The source plugin.json carries a
-  // FROZEN number — it sat at 0.11.0 through several releases, so every install
-  // advertised the wrong version (`memhouse --version` said one thing, the plugin
-  // another). The package version is the single truth; write it into the copy.
-  try {
-    const m = JSON.parse(fs.readFileSync(dstManifest, 'utf-8'));
-    if (m.version !== PKG.version) {
-      m.version = PKG.version;
-      fs.writeFileSync(dstManifest, `${JSON.stringify(m, null, 2)}\n`);
-    }
-  } catch { /* manifest unreadable — leave the copied one rather than guess */ }
-  return dst;
-}
+const PLUGIN_MARK = pluginCopies.PLUGIN_MARK;
+const isPluginInstalled = (dir) => pluginCopies.isPluginInstalled(dir);
+const installPluginInto = (dir) => pluginCopies.installInto(dir, { deliveryDir: DELIVERY, version: PKG.version, log: (l) => console.log(ok(short(l))) });
 
 // Which instances to act on. EVERYTHING IS SELECTED BY DEFAULT: with several Claude
-// installs the answer is almost always "all of them", and a pilot who wanted one would have
+// installs the answer is almost always "all of them", and a user who wanted one would have
 // passed --target. Numbers narrow it, 'n' skips.
 //
 // No prompt at all when there is nothing to choose (one target), when an agent is driving
@@ -2599,7 +3536,7 @@ async function chooseTargets(targets, verb) {
   if (a === 'y' || a === 'yes' || a === '') return targets;
   const picked = [...new Set(a.split(/[\s,]+/).map(Number).filter((n) => Number.isInteger(n) && n >= 1 && n <= targets.length))];
   // An unparseable answer must not quietly mean "all" — that would install into places the
-  // pilot was in the middle of narrowing down. Say so and take none.
+  // user was in the middle of narrowing down. Say so and take none.
   if (!picked.length) { console.log(warn(`did not understand '${a}' — nothing selected`)); return []; }
   return picked.map((n) => targets[n - 1]);
 }
@@ -2649,8 +3586,23 @@ async function cmdPlugins() {
   // somewhere else than the directory just inspected.
   const self = `memhouse plugins install claude${flags.target ? ` --target ${flags.target}` : ''}`;
 
+  // Codex: one block in <codex home>/AGENTS.md and one skill, opt-in (memhouse/codex-plugin.js).
+  const cxp = require(path.join(REPO_ROOT, 'memhouse', 'codex-plugin'));
+  const cxHome = cxp.codexHome();
+  const codexLine = () => {
+    const st = cxp.status({ codexHome: cxHome });
+    if (st.installed) {
+      const o = st.owner;
+      const runs = cxp.invocation({ home: o.home, bin: o.bin });
+      console.log(ok(`codex: installed in ${short(cxHome)} (${o.version || 'unknown version'}) — runs \`${runs}\`${st.block ? '' : '; the AGENTS.md block is missing'}`));
+    } else if (st.foreignSkill) console.log(warn(`codex: ${short(st.foreignSkill)} is not memhouse's — left alone`));
+    else console.log(`  codex: not installed in ${short(cxHome)} — memhouse plugins install codex`);
+    if (st.damaged) console.log(warn(`codex: ${st.damaged}`));
+  };
+
   if (sub === 'list') {
     console.log(`skills available: ${invocations}`);
+    codexLine();
     if (!targets.length) { console.log(warn('no Claude Code config directory found')); return 0; }
     for (const t of targets) {
       console.log(isPluginInstalled(t.dir)
@@ -2697,7 +3649,33 @@ async function cmdPlugins() {
     return 0;
   }
 
-  console.log('usage: memhouse plugins [list | install claude | remove claude] [--target DIR] [--yes]');
+  if (sub === 'install' && positional[1] === 'codex') {
+    try {
+      const r = cxp.install({ codexHome: cxHome, home: HOME_DIR, bin: thisBin, version: PKG.version, deliveryDir: DELIVERY });
+      console.log(ok(`codex: ${r.created ? 'created' : 'updated'} the memhouse block in ${short(r.file)}`));
+      console.log(ok(`codex: skill ${short(r.dir)} — Codex lists it as 'memhouse'`));
+      console.log(`  the block and the skill run \`${r.mh}\`; remove both with: memhouse plugins remove codex`);
+      console.log('  loads in the next Codex session');
+      return 0;
+    } catch (e) { console.log(bad(`codex: ${e.message}`)); return 1; }
+  }
+
+  if (sub === 'remove' && positional[1] === 'codex') {
+    let r;
+    try { r = cxp.remove({ codexHome: cxHome }); } catch (e) { console.log(bad(`codex: ${e.message}`)); return 1; }
+    if (r.block) {
+      const f = short(cxp.agentsFile(cxHome));
+      console.log(ok(r.fileDeleted ? `codex: removed ${f} (it held only the memhouse block)`
+        : r.emptiedLink ? `codex: removed the memhouse block from ${f}; it held only the block, so its link target is now empty and the link stays`
+          : `codex: removed the memhouse block from ${f}; the rest of the file is as it was`));
+    }
+    if (r.skill) console.log(ok(`codex: removed the skill ${short(cxp.skillDir(cxHome))}`));
+    if (r.foreignSkill) console.log(warn(`codex: ${short(r.foreignSkill)} is not memhouse's (no ${cxp.OWNER_FILE}) — left alone`));
+    if (!r.block && !r.skill) console.log(warn(`codex: nothing of memhouse's in ${short(cxHome)}`));
+    return 0;
+  }
+
+  console.log('usage: memhouse plugins [list | install claude|codex | remove claude|codex] [--target DIR] [--yes]');
   return 2;
 }
 
@@ -2790,11 +3768,46 @@ async function houseEvent(cfg, e) {
   } catch { /* an unwritable log is not a reason to abandon a rebuild */ }
 }
 
+/** Write one meta row. Returns null, or the error: a caller whose record matters checks it. */
 async function houseMeta(cfg, key, value) {
   try {
     await ch(cfg, `INSERT INTO ${physicalRoom('meta', cfg.user)} (key, value) VALUES (${sqlStr(key)}, ${sqlStr(value)})`,
       { settings: { async_insert: 0 } });
-  } catch { /* same */ }
+    return null;
+  } catch (e) { return e; }
+}
+
+/**
+ * Record a share's state (`share:<user>` in the member's meta), then read it back: meta is
+ * latest-wins, so a record that did not land leaves the old one standing. A revoke still recorded
+ * as granted is the dangerous case: `migrate --v3-shares` would take a leftover grant for a share
+ * to move and grant it again. The read-back decides, even after a write error: an INSERT whose
+ * answer was lost may have landed. (A read that reaches a replica the write has not reached yet
+ * would report a landed record as lost: a false alarm, never a silent loss.) Returns null, or why
+ * the record could not be confirmed.
+ */
+async function shareRecord(cfg, user, value) {
+  const e = await houseMeta(cfg, `share:${user}`, value);
+  try {
+    const r = await chRows(cfg, `SELECT argMax(value, updated_at) AS v FROM ${physicalRoom('meta', cfg.user)} WHERE key = ${sqlStr(`share:${user}`)}`);
+    const v = r[0] ? String(r[0].v) : '';
+    if (v === value) return null;
+    return e ? `the write failed: ${netReason(e)}` : `it reads back as '${v}'`;
+  } catch (e2) { return e ? `the write failed: ${netReason(e)}` : `it could not be read back: ${netReason(e2)}`; }
+}
+
+/**
+ * Say that a share's new state could not be confirmed as recorded, what follows, and how to record
+ * it: the record still says what it said before, and share --list and migrate --v3-shares act on
+ * that. `rerun` is the command, its scope quoted for the shell.
+ */
+function shareRecordLost({ user, revoked, why, rerun }) {
+  console.log(bad(`${revoked ? `'${user}''s grants are withdrawn` : `'${user}' is shared`}, but memhouse could not confirm the ${revoked ? 'revoke' : 'share'} is recorded: ${why}.`));
+  console.log('  Until it is, the record still says what it said before: memhouse share --list shows that, and memhouse migrate --v3-shares acts on it.');
+  console.log(revoked
+    ? '  If it says granted, --v3-shares would take a grant the reader still holds for a share to move, and grant it again.'
+    : '  With no record before, --v3-shares refuses the grant as one memhouse did not record; with an older one, it would put that one back.');
+  console.log(`  Run again: ${rerun}`);
 }
 
 /**
@@ -2908,12 +3921,12 @@ async function cmdMigrate({ component = null, quiet = false, assumeYes = false }
   // A 0.9.0 shipper passes its own key check against the migrated rooms (it only looks
   // for `origin`) and keeps writing — harmless — but its per-session DELETE clear removes
   // a re-shipped session's rows across ALL epochs, destroying exactly the superseded
-  // parses this schema exists to keep. Say so here, where the pilot is looking.
+  // parses this schema exists to keep. Say so here, where the user is looking.
   console.log(warn('if OTHER machines ship into this house as you, upgrade them promptly:'));
   console.log('  a pre-0.10 shipper elsewhere still deletes before re-inserting, and on the');
   console.log('  migrated rooms that delete reaches every retained parse of a session it re-ships.');
   // assumeYes carries a consent ALREADY GIVEN one level up — `update` prompted (or took
-  // --migrate/--yes) before calling here, and asking twice teaches pilots that prompts
+  // --migrate/--yes) before calling here, and asking twice teaches users that prompts
   // are noise. It is never set on a direct `memhouse migrate`.
   if (flags.yes !== true && !assumeYes) {
     const what = pending.map((x) => x.migration.id).join(', ');
@@ -2946,7 +3959,12 @@ async function cmdMigrate({ component = null, quiet = false, assumeYes = false }
   // The floor under future writers: any 0.10+ memhouse reads this at pass start and
   // refuses if it is too old for the house. Pre-0.10 releases read nothing — hence the
   // REVOKE advice below, which is the only enforcement that reaches them.
-  await houseMeta(cfg, 'min_writer_schema', String(MIN_WRITER_SCHEMA));
+  const fence = await houseMeta(cfg, 'min_writer_schema', String(MIN_WRITER_SCHEMA));
+  if (fence) {
+    // The same write failing failed the migrations' schema_version too (memhouse/house/migrate.js).
+    console.log(warn(`could not record min_writer_schema = ${MIN_WRITER_SCHEMA}: ${netReason(fence)}. memhouse writers older than this schema will not refuse this house.`));
+    console.log(`  Record it by hand, as this member or the house's admin: INSERT INTO ${cfg.db}.${physicalRoom('meta', cfg.user)} (key, value) VALUES ('schema_version', '${SCHEMA_VERSION}'), ('min_writer_schema', '${MIN_WRITER_SCHEMA}')`);
+  }
 
   console.log(`\n${ok(`house is at schema ${SCHEMA_VERSION}`)}`);
   console.log('  verify with: memhouse doctor');
@@ -2961,6 +3979,611 @@ async function cmdMigrate({ component = null, quiet = false, assumeYes = false }
   return 0;
 }
 
+/**
+ * `memhouse migrate --v3-convert | --v3-reconcile [--member <m>] [--batch-rows N] [--dry-run]`
+ * — the conversion of memhouse 0.18's rooms into harness-sessions-sql's profile (harness-sessions-sql §4.8, step
+ * B3), and its check. An ADMIN step: it reads `<db>_archive.<m>_*_pre_v3`, which no member is
+ * granted. So it acts as the admin (adminStepConfig: MEMHOUSE_ADMIN_USER / MEMHOUSE_ADMIN_PASSWORD
+ * or --admin-user, as invite and members) and --member names whose rooms are converted; it
+ * defaults to the member this machine is configured as.
+ *
+ * The work lives in memhouse/house/convert-profile.js (its SQL reads the 0.18 rooms through
+ * convert-v3.js); this is transport and conversation only.
+ */
+const V3_MIGRATE_FLAGS = ['v3-prepare', 'v3-convert', 'v3-reconcile', 'v3-shares', 'v3-switch'];
+
+/** Schema 3: the house's own record (meta, events) — created on a new house, kept from 0.18 on a converted one. */
+async function ensureMetaTablesV3(cfg, member) {
+  const tpl = fs.readFileSync(path.join(REPO_ROOT, 'memhouse', 'house', 'schema.sql.tpl'), 'utf-8');
+  for (const t of ['meta', 'events']) {
+    try { await ch(cfg, createStatement(tpl, t, `${cfg.db}.${member}_${t}`).replace('CREATE TABLE ', 'CREATE TABLE IF NOT EXISTS '), { database: '' }); }
+    catch { /* no rights, or already there */ }
+  }
+}
+
+/** Run plan steps of one phase in order; stops at the first refusal. Returns null, or the error. */
+async function runPhase(run, steps, phase) {
+  for (const st of steps.filter((x) => x.phase === phase)) {
+    try { await run(st.sql); } catch (e) { return e; }
+  }
+  return null;
+}
+
+/**
+ * `memhouse share` on schema 3 (memhouse/share.js shareV3Plan): SELECT on exactly this member's
+ * six conversation tables, a scope as a row policy on each, the 0.18 wildcard never granted (and
+ * taken back where an old share left one). Fails closed at every step, as the 0.18 share does.
+ */
+async function cmdShareV3(cfg, share) {
+  const Q = require(path.join(REPO_ROOT, 'memhouse', 'house', 'queries-v3'));
+  const db = cfg.db; const member = cfg.user;
+  const run = (sql) => ch(cfg, sql, { database: db });
+  const rows = (sql) => chRows(cfg, sql, { database: db });
+  await ensureMetaTablesV3(cfg, member);
+  const tables = share.V3_TABLES.map((t) => `${db}.${member}_${t}`);
+  const bare = !positional[0] && flags.only === undefined && flags.revoke === undefined;
+  if (flags.list === true || bare) return shareList(cfg, share);
+  const user = positional[0];
+  if (!user) { console.log(bad('usage: memhouse share <user> [--only <scope>] [--revoke]  |  memhouse share --list')); return 2; }
+  try { require(path.join(REPO_ROOT, 'memhouse', 'house', 'house')).assertUsableName(user, 'user'); }
+  catch (e) { console.log(bad(e.message)); return 1; }
+  if (user === member) { console.log(bad(`'${user}' is you — you already read your own house`)); return 1; }
+
+  // A 0.18 full share is the wildcard <m>_*, which a schema-3 share never grants. Does the reader
+  // still hold one (a share made before the conversion that the admin has not moved)? null: could
+  // not be read. And what else does that wildcard match: the tables of a colliding member, or a
+  // table that is not ours (share.memberCollisions, share.wildcardOnRevoke)? The users too, since a
+  // member with no table in sight has no table to find it by: those whose names collide with ours
+  // and who may be members here (share.holdsMemberGrant; unreadable counts). null: not listed.
+  let heldWildcard = null;
+  try {
+    heldWildcard = (await rows(`SHOW GRANTS FOR ${share.ident(user)}`)).map((r) => String(Object.values(r)[0]))
+      .some((l) => { const m = /^GRANT\s+(.+?)\s+ON\s+(\S+)\s+TO\b/.exec(l); return !!m && /\bSELECT\b|\bALL\b/.test(m[1]) && m[2].replace(/`/g, '') === `${db}.${member}_*`; });
+  } catch { /* not readable with this credential: said below */ }
+  let collisions = null; let houseTables = null; let users = null;
+  try {
+    houseTables = (await rows(`SELECT name FROM system.tables WHERE database = ${sqlStr(db)}`)).map((r) => r.name);
+    collisions = share.memberCollisions(member, houseTables);
+  } catch { /* unlisted: collisions stays null */ }
+  try {
+    users = await share.collidingUsers({ users: (await rows('SELECT name FROM system.users')).map((r) => r.name), member, db,
+      read: async (x) => (await rows(`SHOW GRANTS FOR ${share.ident(x)}`)).map((r) => String(Object.values(r)[0])) });
+  } catch { users = null; }
+
+  if (flags.revoke === true) {
+    const steps = share.revokeV3Plan({ db, member, user });
+    // The wildcard too when the reader holds it, unless it also matches a table that is not ours:
+    // then a REVOKE would strip the reader's grants there (share.wildcardOnRevoke).
+    const wc = share.wildcardOnRevoke({ member, collisions, heldWildcard, tables: houseTables, users });
+    if (wc.revoke) steps.unshift(share.wildcardRevoke({ db, member, user }));
+    // Every grant first; the filters only once that is confirmed (the other order fails open).
+    const e = await runPhase(run, steps, 'grant');
+    if (e) {
+      console.log(bad(`could not revoke: ${netReason(e)}`));
+      console.log(`  Nothing else was changed: any row policies for '${user}' are still in place.`);
+      return 1;
+    }
+    // The grants are gone, so the share is revoked whatever happens to the filters next. The record
+    // is read back (shareRecord): a lost "revoked" is said, and the command exits 1.
+    const lost = await shareRecord(cfg, user, `revoked ${new Date().toISOString().slice(0, 10)}`);
+    const sayLost = () => { if (lost) shareRecordLost({ user, revoked: true, why: lost, rerun: `memhouse share ${user} --revoke` }); };
+    // What the reader still reads of this member: a REVOKE from them leaves a role's privileges and
+    // any grant memhouse did not make, so the revoke is not done while any remain, nor while that
+    // cannot be read. Said plainly, exit 1 (share.revokeCheck). Checked before the filters go, so a
+    // filter that cannot be dropped never hides it.
+    const N3 = require(path.join(REPO_ROOT, 'memhouse', 'house', 'schema-v3')).v3Names(db, member);
+    const known3 = share.memberTargets({ db, archive: N3.archive, member, legacy: N3.legacy });
+    const readGrants = async (name) => {
+      try { return (await rows(`SHOW GRANTS FOR ${share.ident(name)}`)).map((r) => String(Object.values(r)[0])); }
+      catch (e) { throw new Error(`${name === user ? `the grants of '${user}'` : `what role '${name}' gives`} could not be read: ${String(e.message || e).split('\n')[0]}`); }
+    };
+    // Every colliding name, by table or by user (wc.colliding; null: unknown), so a colliding
+    // member's own grant is never called a stray one.
+    const roleCheck = await share.revokeCheck({ read: readGrants, user, known: known3.known, wildcard: known3.wildcard, db, collisions: wc.colliding });
+    const ec = await runPhase(run, steps, 'clear');
+    for (const l of roleCheck.lines) console.log(bad(l));
+    const withdrawn = roleCheck.done ? `revoked '${user}' on ${tables.join(', ')}` : `withdrew '${user}''s own grants on ${tables.join(', ')}`;
+    if (ec) {
+      console.log(warn(`${withdrawn}, but a row policy could not be dropped: ${ec.message.split('\n')[0]}`));
+      console.log(`  It filters nothing without a grant, but a later share would inherit it. Run again: memhouse share ${user} --revoke`);
+      sayLost();
+      return 1;
+    }
+    // Both are said when both hold: what remains, and a 0.18 wildcard left for the admin.
+    if (wc.left) {
+      console.log(warn(`${withdrawn}, but ${heldWildcard
+        ? `they still hold your 0.18 grant ${db}.${member}_*, and ${share.wildcardReachText(wc, db)}, so it was left for the admin`
+        : `whether they still hold a 0.18 grant on ${db}.${member}_* could not be read`}.`));
+      // The share is recorded as revoked now, so --v3-shares would refuse it (share.classifyShare).
+      // Not when that record was lost: what --v3-shares would do then is said by sayLost, and the
+      // run it asks for says this line once the record lands.
+      if (!lost) console.log(`  ${share.wildcardAdminLine({ wc, db, member, user })}`);
+    }
+    sayLost();
+    if (!roleCheck.done || wc.left || lost) return 1;
+    console.log(ok(`revoked '${user}' — SELECT withdrawn from ${tables.join(', ')} and its row policies dropped`));
+    return 0;
+  }
+
+  const scopeRaw = flags.only !== undefined && flags.only !== true ? String(flags.only).trim() : null;
+  if (flags.only === true || scopeRaw === '') { console.log(bad('--only needs a scope, e.g. --only project=memhouse or --only session=<ref>')); return 1; }
+  let scope = null;
+  if (scopeRaw) {
+    try {
+      scope = share.parseScope(scopeRaw);
+      for (const t of share.V3_TABLES) share.scopePredicateV3(scope, t, sqlStr, Q.parseSessionRef);   // a malformed ref fails here, before anything
+    } catch (e) { console.log(bad(e.message)); return 1; }
+    // Proven, or nothing: an unanswered probe is no evidence that a policy is safe here.
+    const verdict = await probePermissive(cfg, db);
+    if (verdict !== true) {
+      console.log(bad(verdict === false ? 'this ClickHouse hides every row from readers that have no row policy.' : 'could not verify how this ClickHouse treats readers without a row policy.'));
+      console.log('  Scoping one person could blindfold everyone else you have shared with, and yourself.');
+      console.log('  Nothing was changed. Ask whoever runs the server for users_without_row_policies_can_read_rows = true.');
+      return 1;
+    }
+  }
+  // Only a known "no 0.18 wildcard" lets a share through: beside the wildcard it would narrow
+  // nothing, and an answer that could not be read is no evidence (share.shareGate).
+  const gate = share.shareGate(heldWildcard);
+  if (gate) {
+    // Only where a revoke would take it back (share.wildcardOnRevoke) is that the advice, and then
+    // the admin is not needed.
+    const wc = share.wildcardOnRevoke({ member, collisions, heldWildcard: true, tables: houseTables, users });
+    if (gate.refuse === 'held') {
+      console.log(bad(`'${user}' still holds your 0.18 share, ${db}.${member}_* — every table of yours, meta and events included.`));
+      console.log(`  A schema-3 share would sit beside it, not replace it. Nothing was changed. ${wc.revoke
+        ? `Take it back first: memhouse share ${user} --revoke`
+        : `A revoke would leave it for the admin: ${share.wildcardReachText(wc, db)}.`}`);
+    } else {
+      console.log(bad(`could not read what '${user}' holds, so whether they still hold your 0.18 share (${db}.${member}_*) is unknown.`));
+      console.log('  A schema-3 share beside it would narrow nothing. Nothing was changed.');
+    }
+    if (!(gate.refuse === 'held' && wc.revoke)) {
+      // --v3-shares moves a share recorded as granted (share.classifyShare): beside a held wildcard
+      // only a full one, so a scoped one whose reader's grants could not be read is 'check'.
+      // null: the record could not be read.
+      let movable = null;
+      try {
+        const r = await rows(`SELECT argMax(value, updated_at) AS v FROM ${physicalRoom('meta', member)} WHERE key = ${sqlStr(`share:${user}`)}`);
+        const rec = share.parseShareRecord(r[0] ? r[0].v : '');
+        movable = !rec.granted ? false : !rec.scopeRaw ? true : gate.refuse === 'held' ? false : 'check';
+      } catch { /* unread */ }
+      console.log(`  ${share.wildcardAdminLine({ wc, movable, db, member, user })}`);
+    }
+    return 1;
+  }
+  let steps;
+  try { steps = share.shareV3Plan({ db, member, user, scope, sqlStr, parseSessionRef: Q.parseSessionRef }); }
+  catch (e) { console.log(bad(e.message)); console.log('  nothing was changed'); return 1; }
+  // A scoped share writes its filters BEFORE it grants anything: a refusal leaves the grantee
+  // with exactly what they had before.
+  const ef = await runPhase(run, steps, 'filter');
+  if (ef) {
+    console.log(bad(`could not scope: ${ef.message.split('\n')[0]}`));
+    console.log(`  NOTHING WAS GRANTED — '${user}' can read no more than before. \`memhouse share ${user} --revoke\` clears any filter written.`);
+    return 1;
+  }
+  const eg = await runPhase(run, steps, 'grant');
+  if (eg) {
+    console.log(bad(`could not grant: ${netReason(eg)}`));
+    // Withdraw what landed, and drop filters only once that is confirmed.
+    const back = share.revokeV3Plan({ db, member, user });
+    const withdrawn = !(await runPhase(run, back, 'grant'));
+    if (withdrawn) { await runPhase(run, back, 'clear'); console.log(`  '${user}' was left with no access to your tables — nothing wider than before.`); }
+    else if (scope) console.log(`  Could not confirm '${user}' lost every grant, so the filters stay. Retry, or: memhouse share ${user} --revoke`);
+    else console.log(`  Could not confirm what '${user}' holds now. Retry, or: memhouse share ${user} --revoke`);
+    return 1;
+  }
+  // A full share drops leftover filters last. If that fails the reader is narrower than asked,
+  // never wider: not recorded as full, and said so.
+  const ec = await runPhase(run, steps, 'clear');
+  if (ec) {
+    console.log(bad(`'${user}' holds SELECT on ${tables.join(', ')}, but an earlier filter could not be dropped: ${ec.message.split('\n')[0]}`));
+    console.log(`  They see no more than that filter allows. Run again: memhouse share ${user}`);
+    return 1;
+  }
+  const lost = await shareRecord(cfg, user, `granted ${new Date().toISOString().slice(0, 10)}${scopeRaw ? ` scope=${scopeRaw}` : ''}`);
+  if (!scope) {
+    console.log(ok(`'${user}' can now read every session in ${tables.join(', ')}`));
+    console.log('  Those six tables only: not the capture archive, not meta or events.');
+  } else {
+    console.log(ok(`'${user}' can read your sessions where ${scopeRaw}`));
+    for (const t of share.V3_TABLES) {
+      try {
+        const r = await rows(`SELECT count() AS n FROM ${member}_${t} WHERE ${share.scopePredicateV3(scope, t, sqlStr, Q.parseSessionRef)}`);
+        const all = await rows(`SELECT count() AS n FROM ${member}_${t}`);
+        console.log(`  ${t.padEnd(9)} ${r[0].n} of ${all[0].n} rows`);
+      } catch { /* counting is a courtesy */ }
+    }
+  }
+  console.log(`  Withdraw with:  memhouse share ${user} --revoke`);
+  if (lost) { shareRecordLost({ user, revoked: false, why: lost, rerun: `memhouse share ${user}${scopeRaw ? ` --only ${envfile.quoteShell(scopeRaw)}` : ''}` }); return 1; }
+  return 0;
+}
+
+/**
+ * `memhouse migrate --v3-shares [--member M] [--dry-run] [--yes]` — after --v3-convert, the
+ * member's shares re-created on its schema-3 tables (admin). Only shares memhouse recorded in the
+ * member's meta are re-created, each printed before it is applied. Refuses — changing nothing — when
+ * the record and the live grants on the 0.18 rooms disagree, and lists the difference. The 0.18
+ * grants (the wildcard, the room grants) and row policies are taken back as each share moves.
+ * The member's own SHOW ROW POLICIES, which members made before 0.20 hold, is taken back too
+ * (share.showPoliciesRevokes): it opens every member's scoped shares, and a share does not need it.
+ * Safe to run again on a member whose shares have moved; then that is all it does.
+ */
+async function cmdV3Shares(cfg, member, q, N) {
+  const share = require(path.join(REPO_ROOT, 'memhouse', 'share'));
+  const Q = require(path.join(REPO_ROOT, 'memhouse', 'house', 'queries-v3'));
+  const db = cfg.db;
+  // Every read fails closed: a record, a grant list or a policy list that cannot be read stops
+  // the command before anything changes (share.readLiveShares).
+  const targets = share.memberTargets({ db, archive: N.archive, member, legacy: N.legacy });
+  const NEW = targets.after;
+  let st0;
+  try { st0 = await share.readLiveShares(q, { db, member, meta: N.meta, targets, sqlStr }); }
+  catch (e) { console.log(bad(`${e.message} — nothing changed`)); return 1; }
+  const { recorded, started, live, viaRole, admins, collisions, policiesOf } = st0;
+  let own;
+  try { own = share.showPoliciesRevokes((await q.rows(`SHOW GRANTS FOR ${share.ident(member)}`)).map((r) => String(Object.values(r)[0])), member); }
+  catch (e) { console.log(bad(`could not read the grants of '${member}': ${e.message.split('\n')[0]} — nothing changed`)); return 1; }
+  const ownLine = () => {
+    if (!own.length) return;
+    console.log(`  '${member}' still holds SHOW ROW POLICIES, which members no longer receive. Take it back by hand:`);
+    for (const s of own) console.log(`    ${s};`);
+  };
+  // Two members whose names collide (bob, bob_smith): the shorter name's grant `<db>.bob_*` matches
+  // bob_smith's tables too, and a longer name's can match the shorter one's (bob_session_* matches
+  // bob_session_parts). No share is safe to move in such a house, and a REVOKE on a wildcard that
+  // matches another member's tables would strip the grants there.
+  if (collisions.length) {
+    console.log(bad(`'${member}' shares its name's prefix with ${collisions.map((x) => `'${x}'`).join(', ')}: one name's grant <db>.<name>_* reaches the other's tables, to read and to write.`));
+    console.log('  Nothing was changed. This is the house to fix first: docs/guides/troubleshooting.md, "Two member names that collide".');
+    ownLine();
+    return 1;
+  }
+  const diffs = []; const plan = [];
+  for (const [u, rec] of recorded) {
+    try { share.assertName(u, 'user'); } catch (e) { diffs.push(`${u}: ${e.message}`); continue; }
+    const on = live.get(u) || new Set();
+    const st = share.classifyShare({ rec, on, policies: policiesOf(u), started: started.has(u), targets });
+    if (st.diff) { diffs.push(`${u}: ${st.diff}`); continue; }
+    if (st.skip) continue;
+    let scope = null;
+    if (rec.scopeRaw) {
+      try { scope = share.parseScope(rec.scopeRaw); for (const t of share.V3_TABLES) share.scopePredicateV3(scope, t, sqlStr, Q.parseSessionRef); }
+      catch (e) { diffs.push(`${u}: recorded scope '${rec.scopeRaw}' does not translate: ${e.message}`); continue; }
+    }
+    const steps = share.moveSharePlan({ db, member, user: u, scope, legacy: N.legacy, holdsWildcard: on.has(targets.wildcard), sqlStr, parseSessionRef: Q.parseSessionRef });
+    plan.push({ user: u, scope, scopeRaw: rec.scopeRaw, resume: !!st.resume, steps });
+  }
+  for (const u of live.keys()) if (!recorded.has(u)) diffs.push(`${u}: holds ${[...live.get(u)].join(', ')}, but memhouse recorded no share — a grant made by hand?`);
+  // memhouse grants a share to the reader itself, never through a role: what a role reaches is a
+  // grant it did not record, and a move would leave it in place (a REVOKE from the reader does not
+  // touch the role's privileges).
+  diffs.push(...share.roleDifferences(viaRole));
+  if (diffs.length) {
+    console.log(bad(`the shares memhouse recorded for '${member}' and the grants ClickHouse holds disagree — nothing was changed:`));
+    for (const d of diffs) console.log(bad(`  ${d}`));
+    console.log('  Settle each one (re-share or revoke it on 0.18, or by hand), then run this again.');
+    ownLine();
+    return 1;
+  }
+  if (admins.length) console.log(`  server administrators (they read everything by their own global grants; any other grant of theirs was checked like anyone's): ${admins.join(', ')}`);
+  if (!plan.length && !own.length) { console.log(ok(`'${member}': no share to move`)); return 0; }
+  // A scoped share is a row policy, and on a server that hides rows from readers without one,
+  // the first policy would blind the member and every full reader. Proven before, or nothing.
+  if (plan.some((p) => p.scope)) {
+    const verdict = await probePermissive(cfg, db);
+    if (verdict !== true) {
+      console.log(bad(verdict === false ? 'this ClickHouse hides every row from readers that have no row policy.' : 'could not verify how this ClickHouse treats readers without a row policy.'));
+      console.log('  A scoped share is a row policy; nothing was changed. Ask whoever runs the server for users_without_row_policies_can_read_rows = true.');
+      return 1;
+    }
+  }
+  if (own.length) {
+    console.log(`  ${member}  its own grant: SHOW ROW POLICIES, which members no longer receive`);
+    for (const s of own) console.log(`    ${s}`);
+  }
+  for (const p of plan) {
+    console.log(`  ${p.user}  ${p.scopeRaw ? `scoped: ${p.scopeRaw}` : 'full'}${p.resume ? '  (finishing an earlier run)' : ''}`);
+    for (const st of p.steps) console.log(`    ${st.sql}`);
+  }
+  if (flags['dry-run'] === true) { console.log('  dry run: nothing changed'); return 0; }
+  if (flags.yes !== true) {
+    const a = (await ask(`Apply these grants for '${member}'? (yes/no)`, 'no')).toLowerCase();
+    if (a !== 'yes' && a !== 'y') return console.log('aborted'), 1;
+  }
+  const run = (sql) => q.sql(sql);
+  for (const s of own) {
+    try { await run(s); } catch (e) { console.log(bad(`could not take SHOW ROW POLICIES back from '${member}' (${e.message.split('\n')[0]}); stopped — nothing else changed`)); return 1; }
+  }
+  if (own.length) console.log(ok(`'${member}' no longer holds SHOW ROW POLICIES`));
+  if (!plan.length) { console.log(ok(`'${member}': no share to move`)); return 0; }
+  // meta is latest-wins on updated_at: each mark gets a time strictly after the one before, so
+  // 'done' can never tie with its 'started'.
+  let lastMs = 0;
+  const mark = (u, v) => {
+    lastMs = Math.max(Date.now(), lastMs + 1);
+    return q.sql(`INSERT INTO ${share.qual(N.meta)} (key, value, updated_at) VALUES (${sqlStr(`v3share:${u}`)}, ${sqlStr(`${v} ${new Date(lastMs).toISOString().slice(0, 10)}`)}, fromUnixTimestamp64Milli(${lastMs}))`);
+  };
+  for (const p of plan) {
+    // Marked before the first change: a run stopped part-way is finished by the next one, which
+    // accepts only the states between the recorded 0.18 share and its schema-3 form.
+    try { await mark(p.user, 'started'); } catch (e) { console.log(bad(`${p.user}: could not record the start (${e.message.split('\n')[0]}) — nothing changed for ${p.user}; stopped`)); return 1; }
+    const ef = await runPhase(run, p.steps, 'filter');
+    if (ef) { console.log(bad(`${p.user}: could not scope (${ef.message.split('\n')[0]}) — nothing granted for ${p.user}; stopped`)); return 1; }
+    const eg = await runPhase(run, p.steps, 'grant');
+    if (eg) { console.log(bad(`${p.user}: could not grant (${eg.message.split('\n')[0]}); stopped — run again once fixed (each step is safe to repeat)`)); return 1; }
+    const ec = await runPhase(run, p.steps, 'clear');
+    if (ec) { console.log(bad(`${p.user}: the schema-3 share is in place, but a 0.18 grant or filter could not be removed (${ec.message.split('\n')[0]}); stopped — run again once fixed`)); return 1; }
+    // Fail closed here too: a 'started' left behind would keep the next run's relaxed checks on.
+    try { await mark(p.user, 'done'); } catch (e) { console.log(bad(`${p.user}: the share is moved, but its completion could not be recorded (${e.message.split('\n')[0]}); stopped — run again`)); return 1; }
+    console.log(ok(`${p.user}: ${p.scopeRaw ? `scoped share (${p.scopeRaw})` : 'full share'} now on ${NEW.join(', ')}`));
+  }
+  return 0;
+}
+
+/**
+ * `memhouse migrate --v3-prepare [--member M] [--dry-run] [--yes]` — the first admin step of the
+ * schema-3 upgrade (docs/guides/upgrade-to-0.20.md; source-identity.md §7 steps 2 and 7):
+ *   1. fence: meta min_writer_schema = 3 in the member's house, so every 0.18 writer refuses
+ *      (ship.js assertWriterSupported) — and a 0.20 one still on the rooms is told to switch;
+ *   2. rename the member's three 0.18 rooms into <db>_archive as *_pre_v3, in ONE statement,
+ *      which is what `--v3-convert` reads. Nothing is deleted.
+ * Refuses before changing anything: a room missing, a target already there (prepared before:
+ * said so, exit 0 when complete), or no admin rights. --dry-run prints the plan only.
+ */
+async function cmdV3Prepare(cfg, member, q, N) {
+  const LEGACY = ['messages', 'tool_calls', 'sessions'];
+  const src = Object.fromEntries(LEGACY.map((t) => [t, `${cfg.db}.${member}_${t}`]));
+  const dst = Object.fromEntries(LEGACY.map((t) => [t, N.legacy[t]]));
+  const fq = (x) => x.split('.').map((p) => `\`${p}\``).join('.');
+  const names = [...Object.values(src), ...Object.values(dst)];
+  const have = new Map((await q.rows(`SELECT concat(database, '.', name) AS fq, total_rows AS n FROM system.tables
+    WHERE concat(database, '.', name) IN (${names.map(sqlStr).join(', ')})`)).map((r) => [r.fq, Number(r.n) || 0]));
+  const missing = LEGACY.filter((t) => !have.has(src[t])); const there = LEGACY.filter((t) => have.has(dst[t]));
+  if (missing.length === LEGACY.length && there.length === LEGACY.length) {
+    console.log(ok(`'${member}' is prepared already: ${Object.values(dst).join(', ')}`));
+    console.log('  next: memhouse migrate --v3-convert --member ' + member);
+    return 0;
+  }
+  if (missing.length || there.length) {
+    console.log(bad(`'${member}' cannot be prepared as it stands — nothing was changed:`));
+    for (const t of missing) console.log(bad(`  ${src[t]} is not there`));
+    for (const t of there) console.log(bad(`  ${dst[t]} exists already`));
+    console.log('  A half-done earlier attempt? Compare with the guide (docs/guides/upgrade-to-0.20.md) before going on.');
+    return 1;
+  }
+  console.log(`  fence:  ${cfg.db}.${member}_meta  min_writer_schema = 3   (0.18 writers stop; a 0.20 one is told to switch)`);
+  for (const t of LEGACY) console.log(`  rename: ${src[t]} (${have.get(src[t])} rows)  ->  ${dst[t]}`);
+  if (flags['dry-run'] === true) { console.log('  dry run: nothing changed'); return 0; }
+  if (flags.yes !== true) {
+    const a = (await ask(`Prepare '${member}' for schema 3? (yes/no)`, 'no')).toLowerCase();
+    if (a !== 'yes' && a !== 'y') return console.log('aborted'), 1;
+  }
+  try {
+    await q.sql(`INSERT INTO ${fq(`${cfg.db}.${member}_meta`)} (key, value) VALUES ('min_writer_schema', '3')`, { async_insert: 0 });
+    await q.sql(`CREATE DATABASE IF NOT EXISTS ${fq(N.archive)}`);
+    await q.sql(`RENAME TABLE ${LEGACY.map((t) => `${fq(src[t])} TO ${fq(dst[t])}`).join(', ')}`);
+  } catch (e) {
+    console.log(bad(`stopped: ${e.message.split('\n')[0]}`));
+    console.log('  What completed stands (the fence is harmless alone); re-run once the cause is fixed.');
+    return 1;
+  }
+  console.log(ok(`'${member}' prepared: 0.18 writers fenced off, the rooms are ${Object.values(dst).join(', ')}`));
+  console.log('  next: memhouse migrate --v3-convert --member ' + member + '   then --v3-reconcile, then --v3-switch on each machine');
+  return 0;
+}
+
+/**
+ * `memhouse migrate --v3-switch [--dry-run]` — on each machine of a converted house: this install
+ * captures into schema 3 from now on (MEMHOUSE_SCHEMA=3 in its env file; nothing else in the file
+ * changes). Refuses unless the house holds this member's conversation tables; a running shipper
+ * keeps the old setting until it is restarted.
+ */
+async function cmdV3Switch(cfg) {
+  if (isV3(cfg)) { console.log(ok('this install is on schema 3 already')); return 0; }
+  const N = require(path.join(REPO_ROOT, 'memhouse', 'house', 'schema-profile')).profileNames(cfg.db, cfg.user);
+  const [db, parts] = N.session_parts.split('.');
+  let present = 0;
+  try { present = Number(((await chRows(cfg, `SELECT count() AS n FROM system.tables WHERE database = ${sqlStr(db)} AND name = ${sqlStr(parts)}`, { database: '' }))[0] || {}).n) || 0; }
+  catch (e) {
+    // The member's own step: a refused credential is this machine's, so its env file is the fix.
+    console.log(bad(schemaChoice.isAuthFailure(e)
+      ? `${schemaChoice.authFailureText(cfg.user, cfg.url)} — check MEMHOUSE_USER and MEMHOUSE_PASSWORD in ${short(ENV_FILE)}`
+      : `could not check the house: ${e.message.split('\n')[0]}`));
+    return 1;
+  }
+  if (!present) {
+    console.log(bad(`the house has no ${N.session_parts} yet — it is not converted. Nothing changed.`));
+    console.log('  An admin converts it first: memhouse migrate --v3-prepare, --v3-convert, --v3-reconcile (docs/guides/upgrade-to-0.20.md).');
+    return 1;
+  }
+  // The conversion lays the tables first: a member fenced off its 0.18 rooms is converted only once
+  // the conversion ran to the end (its profile_converted mark).
+  const det = await require(path.join(REPO_ROOT, 'memhouse', 'house', 'schema-choice')).detectHouseSchema((sql) => chRows(cfg, sql, { database: '' }), cfg.db, cfg.user);
+  if (det.fenced && !det.converted) {
+    console.log(bad(`the conversion of '${cfg.user}' has not finished. Nothing changed.`));
+    console.log('  Its admin runs memhouse migrate --v3-convert to the end first (a re-run skips the finished buckets).');
+    return 1;
+  }
+  console.log(`  ${path.join(HOME_DIR, 'env')}: MEMHOUSE_SCHEMA=3`);
+  if (flags['dry-run'] === true) { console.log('  dry run: nothing changed'); return 0; }
+  writeEnvFile({ ...cfg, schema: '3' });
+  console.log(ok('this install captures into schema 3 from now on'));
+  // This machine knows both its ids; record them so its converted rows read as this machine
+  // (host-alias.js). The capture records it too, so a failure here costs nothing but a pass.
+  try {
+    const hostMod = require(path.join(REPO_ROOT, 'memhouse', 'host'));
+    const neu = process.env.MEMHOUSE_HOST_ID || hostMod.sessionsHost();
+    const old = (() => { try { return hostMod.identity().id; } catch { return ''; } })();
+    const t = v3Transport(cfg);
+    const wrote = await require(path.join(REPO_ROOT, 'memhouse', 'house', 'host-alias')).record(
+      { rows: (sql) => t.q.rows(sql), run: (sql) => t.q.sql(sql) },
+      { meta: N.meta, sessions: N.sessions }, old, neu);
+    if (wrote) console.log(ok(`this machine's 0.18 id ${old} is recorded as ${neu}: its converted sessions read as this machine`));
+  } catch { /* the first capture pass records it */ }
+  console.log('  restart the shipper so it reads the new setting: memhouse stop && memhouse start');
+  return 0;
+}
+
+/**
+ * The credential an admin step acts as (memhouse/admin-secret.js adminStepCredential): the admin
+ * names, as invite, members and convert take them, with the password from adminPasswordFor; for
+ * 0.20 also the member names, with a note on stderr. Refused before anything connects otherwise,
+ * naming what is missing. The URL and the house stay the configured ones.
+ * Returns { cfg }, or { exit } once the refusal is said.
+ */
+async function adminStepConfig(base, step) {
+  if (flags['admin-user'] === true) { console.log(bad('--admin-user needs a name, e.g. --admin-user default')); return { exit: 1 }; }
+  const pick = require(path.join(REPO_ROOT, 'memhouse', 'admin-secret')).adminStepCredential({
+    step, adminUser: base.adminUser,
+    adminPasswordGiven: Boolean(process.env.MEMHOUSE_ADMIN_PASSWORD) || flags['admin-password-file'] !== undefined,
+    memberUser: base.userStated ? base.user : '', urlStated: base.urlStated,
+  });
+  if (pick.refuse) {
+    if (JSON_OUT) console.log(JSON.stringify({ ok: false, error: 'no_admin_credential', command: step, missing: pick.missing, message: pick.refuse, fix: pick.fix }, null, 2));
+    else {
+      console.log(bad(pick.refuse));
+      console.log(`  Set ${pick.missing.length > 1 ? 'them' : 'it'} for this shell, then run the step again:`);
+      for (const l of pick.fix) console.log(`     ${l}`);
+    }
+    return { exit: 2 };
+  }
+  // stderr, so a --json reader's stdout stays one document.
+  if (pick.via === 'member') { console.error(`memhouse: ${pick.note}`); return { cfg: base }; }
+  const password = await adminPasswordFor(pick.user);
+  if (password === null) return { exit: 1 };
+  return { cfg: { ...base, user: pick.user, password } };
+}
+
+async function cmdMigrateV3() {
+  // --v3-switch is the member's step, on each of its machines: its own credential, never an admin's.
+  if (flags['v3-switch'] === true) return cmdV3Switch(requireConfig(resolveConfig(), 'migrate'));
+  const base = resolveConfig();
+  const step = `migrate --${['v3-prepare', 'v3-shares', 'v3-reconcile'].find((f) => flags[f] === true) || 'v3-convert'}`;
+  const house = require(path.join(REPO_ROOT, 'memhouse', 'house', 'house'));
+  // Whose rooms: --member, else the member this machine is configured as. Never the memhouse_root
+  // default, which on an admin's machine with no install named nobody.
+  const member = flags.member !== undefined && flags.member !== true ? String(flags.member) : (base.userStated ? base.user : '');
+  if (!member) { console.log(bad(`${step} needs --member <m>: no member is configured here to default to — nothing was contacted`)); return 2; }
+  try { house.assertUsableName(base.db, 'house'); house.assertUsableName(member, 'member'); }
+  catch (e) { console.log(bad(e.message)); return 1; }
+  const got = await adminStepConfig(base, step);
+  if (!got.cfg) return got.exit;
+  const cfg = got.cfg;
+  const v3 = require(path.join(REPO_ROOT, 'memhouse', 'house', 'schema-v3'));
+  const SP = require(path.join(REPO_ROOT, 'memhouse', 'house', 'schema-profile'));
+  const conv = require(path.join(REPO_ROOT, 'memhouse', 'house', 'convert-v3'));
+  const cp = require(path.join(REPO_ROOT, 'memhouse', 'house', 'convert-profile'));
+  // Long ceilings: a bucket is one server-side INSERT … SELECT whose response only returns
+  // when it finishes.
+  const q = {
+    sql: (sql, settings) => ch(cfg, sql, { settings, timeout: 3600000, database: '' }),
+    rows: (sql, settings) => chRows(cfg, sql, { settings, timeout: 3600000, database: '' }),
+  };
+  const N = v3.v3Names(cfg.db, member);
+  const PN = SP.profileNames(cfg.db, member);
+  // Every admin step reads the house's tables first, and that is where its credential is first
+  // used: a credential the server refuses is named as that (by ClickHouse's code), never as tables
+  // that could not be listed.
+  const det = await schemaChoice.detectHouseSchema((sql) => chRows(cfg, sql, { database: '' }), cfg.db, member);
+  if (det.authFailed) {
+    const msg = `${schemaChoice.authFailureText(cfg.user, cfg.url)} — set MEMHOUSE_ADMIN_USER and MEMHOUSE_ADMIN_PASSWORD to the house's administrator; nothing changed`;
+    if (JSON_OUT) console.log(JSON.stringify({ ok: false, error: 'authentication', member, user: cfg.user, url: cfg.url, message: msg })); else console.log(bad(msg));
+    return 2;
+  }
+  // Imported sessions on the development layout live only in <m>_turns: preparing or converting
+  // the member moves it to the profile, where they would be gone. Refused until this build can
+  // import into the profile (schema-choice.js importsNotice).
+  if (flags['v3-prepare'] === true || (flags['v3-shares'] !== true && flags['v3-reconcile'] !== true)) {
+    // Fail closed: a house whose tables cannot be listed may hold imports nobody counted.
+    if (det.unreadable) {
+      const msg = `could not list ${cfg.db}'s tables, so imported sessions on the development layout cannot be ruled out — nothing changed`;
+      if (JSON_OUT) console.log(JSON.stringify({ ok: false, error: 'unreadable', member, message: msg })); else console.log(bad(msg));
+      return 2;
+    }
+    const notice = schemaChoice.importsNotice(det, member);
+    if (notice && !schemaChoice.importWritesProfile() && flags['dry-run'] !== true) {
+      if (JSON_OUT) console.log(JSON.stringify({ ok: false, error: 'imports', member, imported_sessions: det.devImports, message: notice }));
+      else { console.log(bad(notice)); console.log('  Nothing changed.'); }
+      return 2;
+    }
+    if (notice && !JSON_OUT) console.log(warn(notice));
+  }
+  if (flags['v3-prepare'] === true) return cmdV3Prepare(cfg, member, q, N);
+  if (flags['v3-shares'] === true) return cmdV3Shares(cfg, member, q, N);
+  const out = (o) => { if (JSON_OUT) console.log(JSON.stringify(o, null, 2)); };
+  const batchRows = flags['batch-rows'] !== undefined ? Number(flags['batch-rows']) : conv.BATCH_ROWS;
+  if (!(batchRows > 0)) { console.log(bad('--batch-rows must be a positive number')); return 1; }
+
+  if (flags['v3-reconcile'] === true) {
+    // The profile conversion's check: every converted row's shas from its columns, every bucket complete.
+    const r = await cp.reconcileProfile(q, { db: cfg.db, member }, { batchRows });
+    if (JSON_OUT) { out(r); return r.ok ? 0 : 1; }
+    for (const [t, x] of Object.entries(r.tables)) {
+      const wrong = (x.mismatched || 0) + (x.msg_mismatched || 0) + (x.cmp_mismatched || 0);
+      console.log((wrong ? bad : ok)(`${PN[t]}: ${x.rows || 0} converted row(s), ${wrong} whose sha does not match its columns`));
+    }
+    for (const t of ['parts', 'calls', 'sessions']) console.log((r[t].converted_keys === r[t].legacy_keys ? ok : bad)(`${t}: ${r[t].converted_keys}/${r[t].legacy_keys} keys`));
+    if (r.incomplete_buckets.length) console.log(bad(`${r.incomplete_buckets.length} of ${r.buckets} bucket(s) incomplete — re-run memhouse migrate --v3-convert`));
+    return r.ok ? 0 : 1;
+  }
+
+  const dry = flags['dry-run'] === true;
+  if (!dry) {
+    if (flags.yes !== true) {
+      console.log(`  convert ${N.legacy.messages}, ${N.legacy.tool_calls}, ${N.legacy.sessions}`);
+      console.log(`     into ${PN.session_parts}, ${PN.session_usage}, ${PN.calls}, ${PN.sessions}  (nothing is deleted or altered)`);
+      const a = (await ask(`Convert '${member}'? (yes/no)`, 'no')).toLowerCase();
+      if (a !== 'yes' && a !== 'y') return console.log('aborted'), 1;
+    }
+    // Admin rights create the databases and grant the member its capture tables; a member's
+    // own credential skips what it may not do, and the verification below says what is missing.
+    const s = await SP.ensureProfileSchema(q, { db: cfg.db, member, createDatabases: true, grantCapture: true });
+    if (!JSON_OUT) {
+      console.log(`  ClickHouse ${s.version}`);
+      for (const [t, x] of Object.entries(s.tables)) console.log((x.problem ? bad : ok)(`${x.fq}${x.problem ? `: ${x.problem}` : ''}`));
+      for (const d of s.denied) console.log(warn(`not permitted: ${d}`));
+      for (const d of s.grant_failures) console.log(warn(`grant failed: ${d}`));
+    }
+    if (!SP.CONVERSATION_TYPES.every((t) => !s.tables[t].problem)) {
+      out({ ok: false, schema: s });
+      if (!JSON_OUT) console.log(bad('the conversation tables are not there — nothing converted'));
+      return 1;
+    }
+  }
+  const ledger = {
+    event: (e) => ch(cfg, `INSERT INTO ${N.events} (kind, id, status, host, to_version, rows_before, rows_after, detail) VALUES (`
+      + [e.kind, e.id, e.status, e.host || '', '3'].map(sqlStr).join(', ')
+      + `, ${Number(e.rows_before) || 0}, ${Number(e.rows_after) || 0}, ${sqlStr(e.detail || '')})`,
+    { settings: { async_insert: 0 }, database: '' }),
+  };
+  const host = require(path.join(REPO_ROOT, 'memhouse', 'host.js')).identity().id;
+  const ui = JSON_OUT ? null : { ok: (m) => console.log(ok(m)) };
+  let r;
+  try { r = await cp.convertProfile(q, { db: cfg.db, member, ledger, host, forceAfterDedupe: flags['force-after-dedupe'] === true }, { batchRows, dryRun: dry }, ui); }
+  catch (e) {
+    out({ ok: false, error: e.message.split('\n')[0] });
+    if (!JSON_OUT) {
+      console.log(bad(`conversion stopped: ${e.message.split('\n')[0]}`));
+      console.log('  what completed stands; re-run the same command — finished buckets are skipped.');
+    }
+    return 1;
+  }
+  // A dry run is a report: it succeeds whatever it finds pending, in JSON as in text.
+  if (JSON_OUT) { out(r); return r.ok || (dry && !r.refused) ? 0 : 1; }
+  if (r.refused) { console.log(bad(r.refused)); console.log('  --force-after-dedupe overrides, knowingly.'); return 1; }
+  const line = (t) => `${t}: ${r[t].converted_keys}/${r[t].legacy_keys} keys`
+    + (r[t].legacy_rows !== undefined ? ` from ${r[t].legacy_rows} legacy rows` : '')
+    + (dry ? '' : ` — ${r[t].buckets_inserted} bucket(s) written, ${r[t].buckets_skipped} already complete`);
+  for (const t of ['parts', 'calls', 'sessions']) console.log((r[t].converted_keys === r[t].legacy_keys ? ok : warn)(line(t)));
+  if (r.parts.collisions) console.log(warn(`${r.parts.collisions} legacy message row(s) share a profile key with another (different user_id on one session/seq)`));
+  if (dry) console.log(warn(`dry run — ${r.pending_buckets.length} of ${r.buckets} bucket(s) pending, nothing was changed`));
+  else console.log((r.ok ? ok : bad)(r.ok ? `converted in ${r.seconds}s — check with: memhouse migrate --v3-reconcile --member ${member}` : 'incomplete — re-run; finished buckets are skipped'));
+  return r.ok || dry ? 0 : 1;
+}
+
 /**
  * `memhouse relocate --to <url>` — copy a whole house to a NEW ClickHouse, server-to-
  * server, then repoint this install at it. The point is to move WITHOUT the shipper
@@ -2968,7 +4591,7 @@ async function cmdMigrate({ component = null, quiet = false, assumeYes = false }
  * sees every old session already present and ships only genuinely new work.
  *
  * The copy is a ClickHouse remoteSecure() INSERT SELECT — the destination pulls each room
- * directly from the source over the native protocol; the pilot's laptop is never in the
+ * directly from the source over the native protocol; the user's laptop is never in the
  * data path. Provenance is carried, not restamped (insert_allow_materialized_columns=1),
  * exactly as `migrate`'s rebuildRoom does, so a shared house keeps every member's user_id.
  *
@@ -2976,7 +4599,7 @@ async function cmdMigrate({ component = null, quiet = false, assumeYes = false }
  * destination and the local env file, so a failed run leaves the old house intact.
  *
  * SECURITY: the source password is spliced into the remoteSecure() call, which runs on
- * the DESTINATION and lands in ITS query_log. Two consequences, both stated to the pilot:
+ * the DESTINATION and lands in ITS query_log. Two consequences, both stated to the user:
  * it never touches THIS transcript (the SQL is never printed), but rotate the source
  * credential afterward if the destination's logs are not yours to trust.
  *
@@ -3184,7 +4807,7 @@ async function cmdNightly() {
   const { kind, root } = installKind();
   if (kind !== 'checkout') {
     console.log(bad(`nightly builds come from a checkout — this is a ${kind} install (${root})`));
-    console.log('  git clone https://github.com/agent-realm/memhouse && cd memhouse && memhouse nightly');
+    console.log('  run `memhouse nightly` from inside a git checkout of the memhouse repository');
     return 1;
   }
   // A dirty package.json cannot be restored by checkout without eating the user's edits.
@@ -3231,7 +4854,7 @@ async function cmdNightly() {
 }
 
 /**
- * `memhouse invite <name> --url <house-url> --admin-user <a> --admin-password <p>
+ * `memhouse invite <name> --url <house-url> --admin-user <a>` (password from MEMHOUSE_ADMIN_PASSWORD or --admin-password-file)
  *                  [--db <house>] [--out <file>]`
  *
  * Mint a member on the server and hand back the ONE FILE their install needs — this
@@ -3268,6 +4891,7 @@ async function cmdShare() {
   const share = require(path.join(REPO_ROOT, 'memhouse', 'share'));
   const cfg = requireConfig(resolveConfig(), 'share');
   if (!cfg.user) return 1;
+  if (isV3(cfg)) return cmdShareV3(cfg, share);
   const db = cfg.db;
   // In a SHARED database a member owns three named rooms, not the database. Granting
   // `ON <db>.*` there would hand over every housemate's rooms as well — it fails closed
@@ -3322,10 +4946,11 @@ async function cmdShare() {
       try { await run(`DROP ROW POLICY IF EXISTS ${share.policyName(user, room)} ON ${db}.${mine.physical[room]}`); dropped++; }
       catch (e) { console.log(warn(`could not drop the policy on ${room}: ${e.message.split('\n')[0]}`)); }
     }
-    await houseMeta(cfg, `share:${user}`, `revoked ${new Date().toISOString().slice(0, 10)}`);
+    const lost = await shareRecord(cfg, user, `revoked ${new Date().toISOString().slice(0, 10)}`);
     console.log(ok(`revoked '${user}' — SELECT withdrawn and ${dropped} row polic${dropped === 1 ? 'y' : 'ies'} dropped`));
     console.log('  Dropping the grant alone would have left the policies, and a later re-share');
     console.log('  would have quietly reinherited this scope.');
+    if (lost) { shareRecordLost({ user, revoked: true, why: lost, rerun: `memhouse share ${user} --revoke` }); return 1; }
     return 0;
   }
 
@@ -3421,26 +5046,30 @@ async function cmdShare() {
 
   if (!scope) {
     // A previous partial share leaves policies that would still be filtering. Widening to
-    // a full share has to clear them or "full" is a lie.
-    let cleared = 0;
+    // a full share has to clear them or "full" is a lie. They are dropped by name, unseen:
+    // members do not hold SHOW ROW POLICIES, so whether this was a scoped share is told by
+    // memhouse's own record of it, read before the new one replaces it.
+    let wasScoped = false;
+    try {
+      const r = await rows(`SELECT argMax(value, updated_at) AS v FROM ${physicalRoom('meta', cfg.user)} WHERE key = ${sqlStr(`share:${user}`)}`);
+      wasScoped = !!share.parseShareRecord(r[0] ? r[0].v : '').scopeRaw;
+    } catch { /* unread: the drops below run all the same */ }
     for (const room of ROOM_TYPES) {
-      try {
-        const had = await rows(`SELECT count() AS n FROM system.row_policies WHERE database = ${sqlStr(db)} AND short_name = ${sqlStr(share.policyName(user, room))}`);
-        if (Number(had[0] && had[0].n) > 0) { await run(`DROP ROW POLICY IF EXISTS ${share.policyName(user, room)} ON ${db}.${mine.physical[room]}`); cleared++; }
-      } catch { /* nothing to clear */ }
+      try { await run(`DROP ROW POLICY IF EXISTS ${share.policyName(user, room)} ON ${db}.${mine.physical[room]}`); } catch { /* nothing to clear */ }
     }
-    await houseMeta(cfg, `share:${user}`, `granted ${new Date().toISOString().slice(0, 10)}`);
+    const lost = await shareRecord(cfg, user, `granted ${new Date().toISOString().slice(0, 10)}`);
     console.log(ok(`'${user}' can now read every session in your rooms (${db}.${mine.pattern})`));
-    if (cleared) console.log(warn(`cleared ${cleared} row polic${cleared === 1 ? 'y' : 'ies'} from an earlier scoped share — this is now a FULL share`));
+    if (wasScoped) console.log(warn('cleared the row policies of an earlier scoped share — this is now a FULL share'));
     console.log(`  Everything: every project, machine and editor, including anything ever pasted`);
     console.log("  into a session of yours — housemates' rooms are untouched.");
     console.log(`  Narrow it with:  memhouse share ${user} --only project=<name>`);
     console.log(`  Withdraw with:                   memhouse share ${user} --revoke`);
+    if (lost) { shareRecordLost({ user, revoked: false, why: lost, rerun: `memhouse share ${user}` }); return 1; }
     return 0;
   }
 
   // The filters are already in place — built above, before the grant.
-  await houseMeta(cfg, `share:${user}`, `granted ${new Date().toISOString().slice(0, 10)} scope=${scopeRaw}`);
+  const lost = await shareRecord(cfg, user, `granted ${new Date().toISOString().slice(0, 10)} scope=${scopeRaw}`);
 
   // Say what they can actually reach, counted through their own filter.
   console.log(ok(`'${user}' can read your rooms in '${db}' where ${scopeRaw}`));
@@ -3455,6 +5084,7 @@ async function cmdShare() {
   console.log('  per-session filter, so a scoped reader gets none of them.');
   console.log(`  Widen to everything:  memhouse share ${user}`);
   console.log(`  Withdraw:             memhouse share ${user} --revoke`);
+  if (lost) { shareRecordLost({ user, revoked: false, why: lost, rerun: `memhouse share ${user} --only ${envfile.quoteShell(scopeRaw)}` }); return 1; }
   return 0;
 }
 
@@ -3485,22 +5115,64 @@ async function probePermissive(cfg, db) {
   }
 }
 
+/**
+ * Whose sessions this credential can read in the house: a share received is the housemate's
+ * tables in this same database, and system.tables lists only what a credential may read. Every
+ * member has a <name>_sessions table on either layout. Returns { all } for a credential that
+ * reads every house (an administrator: everyone would be listed), else { members }, or null when
+ * the tables cannot be listed.
+ */
+async function sharesReceived(cfg) {
+  try {
+    const caps = capabilitiesFrom(await readGrants(cfg, cfg.user));
+    if (caps.canReadEveryHouse || caps.isSuperuser) return { all: true, members: [] };
+    const rows = await chRows(cfg, `SELECT name FROM system.tables WHERE database = ${sqlStr(cfg.db)} AND endsWith(name, '_sessions')`, { database: '' });
+    const members = rows.map((r) => String(r.name).slice(0, -'_sessions'.length))
+      .filter((m) => m && m !== cfg.user && /^[A-Za-z][A-Za-z0-9_]*$/.test(m)).sort();
+    return { all: false, members };
+  } catch { return null; }
+}
+
+/** The received half of `share --list`: whose sessions this credential reads, and how. */
+function printReceived(cfg, received) {
+  console.log('');
+  if (!received) { console.log(`  whose sessions you can read: could not list the tables in '${cfg.db}'`); return; }
+  if (received.all) { console.log(`  this credential reads every member's sessions in '${cfg.db}' (it administers the server)`); return; }
+  if (!received.members.length) { console.log(`  nobody has shared their sessions with you in '${cfg.db}'`); return; }
+  console.log(`  whose sessions you can read in '${cfg.db}' (shared with you; a scoped share shows only the rows its owner chose):`);
+  for (const m of received.members) {
+    console.log(`    ${m.padEnd(16)} ${isV3(cfg) ? `memhouse q recent --member ${m}` : `memhouse room-sql "SELECT … FROM ${m}_messages …"`}`);
+  }
+}
+
 /** Who can read this house, what they are scoped to, and any policy left behind. */
 async function shareList(cfg, share) {
   const db = cfg.db;
+  const received = await sharesReceived(cfg);
+  const receivedJson = received ? (received.all ? { all: true } : received.members.map((m) => ({ member: m }))) : null;
   let recorded = [];
   try {
     recorded = await chRows(cfg, `SELECT substring(key, 7) AS user, value AS state FROM ${physicalRoom('meta', cfg.user)} FINAL WHERE key LIKE 'share:%' ORDER BY key`, { database: db });
   } catch { /* unreadable record */ }
-  let policies = [];
+  // The policies themselves only where this credential may list them: a member does not hold
+  // SHOW ROW POLICIES (provision.js), so a member's list is memhouse's record, scope included.
+  let policies = []; let policiesReadable = true;
   try {
     policies = await chRows(cfg, `SELECT short_name, table, select_filter FROM system.row_policies WHERE database = ${sqlStr(db)} ORDER BY short_name`, { database: db });
-  } catch { /* members may not read system.row_policies on every server */ }
+  } catch { policiesReadable = false; }
+  // Only the policies on this member's own tables (share.ownPolicies). The list can include other
+  // members' policies, on tables this credential cannot see: those are theirs, and checked against
+  // system.tables they would read as orphans to drop.
+  const own = share.ownPolicies(policies, { db, member: cfg.user, schema3: isV3(cfg) });
+  policies = own.mine;
+  // What a share covers: on schema 3 the six profile tables, never the 0.18 wildcard.
+  const covers = isV3(cfg) ? { tables: share.V3_TABLES.map((t) => `${cfg.user}_${t}`) } : { rooms: `${cfg.user}_*` };
 
   if (!recorded.length && !policies.length) {
-    if (JSON_OUT) { console.log(JSON.stringify({ database: db, rooms: `${cfg.user}_*`, grantees: [] }, null, 2)); return 0; }
+    if (JSON_OUT) { console.log(JSON.stringify({ database: db, ...covers, grantees: [], received: receivedJson }, null, 2)); return 0; }
     console.log(ok(`nobody has been granted a read of your rooms in '${db}'`));
     console.log(`  Share it with:  memhouse share <user> [--only project=<name>]`);
+    printReceived(cfg, received);
     return 0;
   }
   // In a shared house a grantee reads YOUR ROOMS, never the database — every other member
@@ -3510,27 +5182,38 @@ async function shareList(cfg, share) {
     // and any caller parsing it got prose. It is the audit surface; it should be readable
     // by something other than a person.
     console.log(JSON.stringify({
-      database: db, rooms: `${cfg.user}_*`,
+      database: db, ...covers,
       grantees: recorded.map((r) => ({
-        user: r.user, state: r.state,
-        scoped: policies.filter((p) => String(p.short_name).startsWith(`mh_share_${r.user}_`))
-          .map((p) => ({ room: p.table, filter: p.select_filter })),
+        user: r.user, state: r.state, scope: share.parseShareRecord(r.state).scopeRaw,
+        // The live filters, or null where this credential cannot list them.
+        scoped: policiesReadable ? own.grants.filter((p) => String(p.short_name).startsWith(`mh_share_${r.user}_`))
+          .map((p) => ({ room: p.table, filter: p.select_filter })) : null,
       })),
+      policies_readable: policiesReadable,
       note: "memhouse's own record, not ClickHouse's grant table — a grant made by hand does not appear here",
+      received: receivedJson,
     }, null, 2));
     return 0;
   }
-  console.log(`  who can read your rooms in '${db}' — memhouse's own record, not ClickHouse's grant table:`);
+  console.log(`  who can read your ${isV3(cfg) ? 'sessions' : 'rooms'} in '${db}' — memhouse's own record, not ClickHouse's grant table:`);
   for (const r of recorded) {
-    const scoped = policies.filter((p) => String(p.short_name).startsWith(`mh_share_${r.user}_`));
-    const whole = '  (all your rooms)';
-    console.log(`    ${String(r.user).padEnd(16)} ${r.state}${scoped.length ? '' : (String(r.state).startsWith('granted') ? whole : '')}`);
+    const scoped = own.grants.filter((p) => String(p.short_name).startsWith(`mh_share_${r.user}_`));
+    const whole = isV3(cfg) ? `  (every session: ${share.V3_TABLES.join(', ')})` : '  (all your rooms)';
+    // Full only when neither the record nor a live filter says otherwise.
+    const full = String(r.state).startsWith('granted') && !share.parseShareRecord(r.state).scopeRaw && !scoped.length;
+    console.log(`    ${String(r.user).padEnd(16)} ${r.state}${full ? whole : ''}`);
     for (const p of scoped) console.log(`      ${String(p.table).padEnd(11)} ${p.select_filter}`);
   }
   console.log('  A grant made by hand does not appear here — this list is what memhouse recorded.');
+  printReceived(cfg, received);
 
   // Policies whose room is gone: dropping a house does NOT drop its policies, and a house
-  // later recreated under the same name silently inherits them.
+  // later recreated under the same name silently inherits them. Listing them takes a credential
+  // that may read system.row_policies, which a member's does not: an admin's check.
+  if (!policiesReadable) {
+    console.log('  Row policies left behind by a dropped table are listed by an admin: docs/guides/operate.md.');
+    return 0;
+  }
   const orphans = [];
   for (const p of policies) {
     try {
@@ -3687,9 +5370,15 @@ async function offerInvite() {
 
 async function cmdInvite() {
   const name = positional[0];
-  if (!name) { console.log('usage: memhouse invite <name> --url <house-url> [--admin-user … [--admin-password …]] [--db <house>] [--out <file>] [--adopt] [--print-sql]'); return 2; }
+  if (!name) { console.log('usage: memhouse invite <name> --url <house-url> [--admin-user … [--admin-password-file FILE|-]] [--db <house>] [--out <file>] [--adopt] [--schema 2|3] [--expires DAYS] [--print-sql]'); return 2; }
   try { require(path.join(REPO_ROOT, 'memhouse', 'house', 'house')).assertUsableName(name, 'member'); }
   catch (e) { console.log(bad(e.message)); return 1; }
+  // How long the invite's password works (VALID UNTIL): checked before anything is contacted.
+  const expiresDays = flags.expires === undefined ? INVITE_DAYS : flags.expires === true ? NaN : Number(flags.expires);
+  if (!Number.isInteger(expiresDays) || expiresDays < 1 || expiresDays > 365) {
+    console.log(bad(`--expires takes a whole number of days, 1 to 365 (default ${INVITE_DAYS}); got '${flags.expires === true ? '' : flags.expires}'`));
+    return 2;
+  }
   const cfg = resolveConfig();
   // The URL must be STATED and must work from the INVITEE's machine. cfg.url falls back
   // to localhost:8123 — dead, or worse, someone else's house, on every other machine.
@@ -3725,11 +5414,25 @@ async function cmdInvite() {
   // admin" is only useful if you can hand them something exact. This prints the same
   // statements adminBootstrap would run, so the person with the credential runs four
   // lines instead of installing anything. Nothing is contacted and nothing is written.
+  // The invitee's layout. --schema states it, and so does an exported MEMHOUSE_SCHEMA (set
+  // for this command, as an exported MEMHOUSE_ADMIN_USER is). The inviter's own env file
+  // says nothing about the house, and an empty admin home says nothing at all (found by
+  // example 03: an invite from one minted 0.18 rooms in a schema-3 house).
+  const statedSchema = flags.schema && flags.schema !== true ? String(flags.schema) : String(process.env.MEMHOUSE_SCHEMA || '');
+  if (!['', '2', '3'].includes(statedSchema)) {
+    console.log(bad(`--schema ${statedSchema}: only 2 (the 0.18 rooms) and 3 (harness-sessions-sql's profile) exist`));
+    return 1;
+  }
   if (flags['print-sql'] === true) {
     // memberSql prints its own header naming the house and the credential it needs; a
     // second one above it said the same thing twice, and in a shared house said the wrong
     // thing ("their own house" — they get rooms in a shared one).
     console.log(memberSql(db, name));
+    // Nothing is contacted, so nothing is detected: schema 3 unless stated, as install --print-sql.
+    if (statedSchema !== '2') console.log(memberSqlV3(db, name));
+    // The same expiry a run of invite sets. A placeholder, like the password's: the statement
+    // does not parse until a quoted moment in the server's time zone stands in its place.
+    console.log(`-- The invited password expires, as \`memhouse invite\` sets it: put the moment ${expiresDays} day${expiresDays === 1 ? '' : 's'}\n-- from now, quoted, in the server's time zone, where <valid-until> stands. install lifts it.\nALTER USER \`${name}\` VALID UNTIL <valid-until>;`);
     console.log(handoffLines({ url, db, member: name, invite: true }));
     return 0;
   }
@@ -3790,7 +5493,7 @@ async function cmdInvite() {
     // Reachability FIRST, and reported as itself. Folding it into the grants read makes an
     // unreachable host — a typo, a loopback-bound house, a tunnel that is down — come back
     // as "you are only a member", which sends the reader after a privilege they already
-    // have. Caught on the testbed, where a wrong --url produced exactly that.
+    // have. Caught on a test VM, where a wrong --url produced exactly that.
     // The member credential is stored, so it is checked against the house it was saved for
     // (target.url), never against --url; --url's reachability was checked above, unauthenticated.
     try {
@@ -3846,12 +5549,21 @@ async function cmdInvite() {
   // to invite, and a house that does not exist yet is the ordinary case.
   const adminCfg = { ...cfg, url: provisionUrl, user: adminUser, password: adminPass || '', db, stated: true };
 
-  const room = physicalRoom('messages', name);
+  // The house decides, as for an install: a new house is schema 3, one on the 0.18 rooms
+  // keeps them, and an ambiguous one is refused.
+  {
+    const pick = schemaChoice.chooseSchema(statedSchema, await schemaChoice.detectHouseSchema((sql) => chRows(adminCfg, sql, { database: '' }), db, name), name, { user: adminCfg.user, url: adminCfg.url });
+    if (pick.refuse) { console.log(bad(pick.refuse)); console.log('  nothing was changed'); return 1; }
+    cfg.schema = pick.schema === '3' ? '3' : '';
+  }
+
+  // Schema 3: the conversation table that holds the messages is <name>_session_parts.
+  const room = isV3(cfg) ? `${name}_session_parts` : physicalRoom('messages', name);
   let occupied = null;
   try {
     const exists = await chRows(adminCfg, `SELECT count() AS n FROM system.tables WHERE database = '${db.replace(/'/g, "\\'")}' AND name = '${room.replace(/'/g, "\\'")}'`, { database: '' });
     if (Number(exists[0] && exists[0].n) > 0) {
-      const r = await chRows(adminCfg, `SELECT count() AS msgs, uniqExact(user_id) AS writers FROM ${room}`, { database: db });
+      const r = await chRows(adminCfg, `SELECT count() AS msgs, uniqExact(${isV3(cfg) ? 'writer' : 'user_id'}) AS writers FROM ${room}`, { database: db });
       const msgs = Number(r[0] && r[0].msgs) || 0;
       if (msgs > 0) occupied = { msgs, writers: Number(r[0].writers) || 0 };
     }
@@ -3877,22 +5589,39 @@ async function cmdInvite() {
   if (built) built.url = url; // the invitee reaches the house at --url, not the admin's endpoint
   if (!built) return 1;
 
+  // The invite's password expires: a file that sits unused, or was read where it should not
+  // have been, stops working on its own. The server's own clock sets the date (VALID UNTIL is
+  // read in its time zone); install's rotation clears it, as does --keep-password.
+  let expires = null;
+  try {
+    const adminCfg = { ...cfg, url: provisionUrl, db, user: adminUser, password: adminPass || '' };
+    const r = (await chRows(adminCfg, `SELECT toString(now() + toIntervalDay(${expiresDays})) AS lit, toUnixTimestamp(now() + toIntervalDay(${expiresDays})) AS ts`, { database: '' }))[0];
+    await ch(adminCfg, `ALTER USER \`${name}\` VALID UNTIL ${sqlStr(r.lit)}`, { database: '' });
+    expires = new Date(Number(r.ts) * 1000).toISOString().replace(/\.\d{3}Z$/, 'Z');
+  } catch (e) {
+    console.log(warn(`could not set the invite's expiry (${String(e.message).split('\n')[0]}): its password works until install changes it`));
+  }
+
   const out = path.resolve(flags.out && flags.out !== true ? String(flags.out) : `invite-${name}.env`);
   const sq = envfile.quoteShell;
   const body = [
-    `# memhouse invite for '${name}' — THIS FILE IS A CREDENTIAL. Treat it like a password:`,
-    '# hand it over a channel you trust, and delete it after install.',
-    '# The person who created it knows the password inside — so when you install, memhouse',
-    '# OFFERS to change it to one only you know (you were granted ALTER USER on yourself).',
+    `# memhouse invite for '${name}' — THIS FILE IS A CREDENTIAL. Do not print it, paste it,`,
+    '# or open it in an agent: it holds a password, and whatever an agent reads stays in its',
+    '# transcript. Hand it over a channel you trust.',
     `# Install: memhouse install --env ${path.basename(out)}`,
+    '# Install changes the password inside to a new one only your machine knows (whoever made',
+    '# this file knows the current one), saves it in ~/.memhouse/env, and deletes this file.',
     `MEMHOUSE_URL=${sq(built.url)}`,
     `MEMHOUSE_USER=${sq(built.user)}`,
     `MEMHOUSE_PASSWORD=${sq(built.password)}`,
     `MEMHOUSE_DB=${sq(built.db)}`,
     ...(cfg.channel ? [`MEMHOUSE_CHANNEL=${sq(cfg.channel)}`] : []),
-    '# This credential was issued by an invitation (no admin access here); memhouse offers',
-    '# to rotate it on install so the inviter no longer knows it.',
+    ...(isV3(cfg) ? ['# Schema 3: harness-sessions-sql\'s profile tables and the capture archive.', 'MEMHOUSE_SCHEMA=3'] : []),
+    '# Issued by an invitation (no admin access here): install changes it so the inviter',
+    '# no longer knows it.',
     'MEMHOUSE_INVITE=1',
+    ...(expires ? [`# The password above stops working at ${expires} (UTC): install before then, or ask for a new invite.`,
+      `MEMHOUSE_INVITE_EXPIRES=${sq(expires)}`] : []),
     '',
   ].join('\n');
   // Atomic + private + no symlink follow: write a fresh temp with O_EXCL at 0600, then
@@ -3913,13 +5642,12 @@ async function cmdInvite() {
     return 1;
   }
   console.log(ok(`invite written: ${out}`));
-  // The guide that travels with the credential. Rendered, not linked: it names THIS
-  // invitee's file, this house, and — until the build is published — the exact tarball
-  // to install, none of which a static page can carry. Nothing secret goes into it.
+  // The guide that travels with the credential (memhouse/invitation.js). Rendered, not
+  // linked: it names THIS invitee's file, this house, the tables this invite created, and —
+  // until the build is published — the exact tarball to install, none of which a static page
+  // can carry. Nothing secret goes into it.
   const prerelease = /-/.test(PKG.version);
-  const guide = path.join(path.dirname(out), 'MEMHOUSE-INVITATION.md');
   try {
-    const tpl = fs.readFileSync(path.join(DELIVERY, 'INVITATION.md.tpl'), 'utf-8');
     // A nightly stamps its own version into the filename, so the guide names the shape of
     // the file, not a name it cannot know; the version check below matches on the base.
     const base = PKG.version.split('-')[0];
@@ -3931,27 +5659,27 @@ async function cmdInvite() {
         ? `This house runs a pre-release build, so install the tarball you were sent rather than the\n`
           + `published package. From the directory you saved it in:\n\n\`\`\`\nnpm install -g ./memhouse-*.tgz\n\`\`\``
         : `\`\`\`\nnpm install -g memhouse@${PKG.version}\n\`\`\``;
-    fs.writeFileSync(guide, tpl
-      .replaceAll('{{NAME}}', name)
-      .replaceAll('{{FILE}}', path.basename(out))
-      .replaceAll('{{URL}}', url)
-      .replaceAll('{{DB}}', built.db)
-      .replaceAll('{{VERSION}}', prerelease ? `${base}-…` : PKG.version)
-      .replaceAll('{{INSTALL}}', install)
-      .replaceAll('{{INVITER}}', cfg.user || require('os').userInfo().username));
-    console.log(ok(`guide written:  ${guide}`));
+    // The layout is the one provisioned above (schemaChoice), never the inviter's own install.
+    const page = require(path.join(REPO_ROOT, 'memhouse', 'invitation')).invitationPage({
+      out, name, url, db: built.db, schema: isV3(cfg) ? '3' : '', install,
+      version: prerelease ? `${base}-…` : PKG.version,
+      inviter: cfg.user || require('os').userInfo().username, expires,
+    });
+    fs.writeFileSync(page.path, page.text);
+    console.log(ok(`guide written:  ${page.path}`));
   } catch (e) { console.log(warn(`could not write the invitation guide: ${e.message}`)); }
+  if (expires) console.log(ok(`the invite expires at ${expires} (UTC), in ${expiresDays} day${expiresDays === 1 ? '' : 's'} (--expires <days> sets it); after that, invite again`));
   console.log(`  send ${name} BOTH files over a channel you trust (croc, a password manager — not chat):`);
   console.log(`     ${path.basename(out)}   their credential — one-time, install deletes it`);
   console.log(`     MEMHOUSE-INVITATION.md  the steps, nothing secret`);
   if (prerelease && !cfg.channel) console.log(`     and the tarball this build came from (memhouse nightly --out …) — ${PKG.version} is not on npm`);
-  console.log(`  they run:   memhouse install --env ${path.basename(out)}   (rotates the password to one only they know)`);
+  console.log(`  they run:   memhouse install --env ${path.basename(out)}   (changes the password to one only their machine knows, then deletes the file)`);
   console.log(`  once installed, they are a member — sharing works both ways: /mem:access ${name}`);
   return 0;
 }
 
 /**
- * `memhouse passwd [--password <new>] --admin-user <a> --admin-password <p>`
+ * `memhouse passwd [--password <new>] --admin-user <a>` (admin password from MEMHOUSE_ADMIN_PASSWORD or --admin-password-file)
  *
  * Rotate THIS install's member password and rewrite the env file. Admin-assisted by
  * ClickHouse's rules — changing any password takes the ALTER USER privilege, which a
@@ -4040,7 +5768,7 @@ async function cmdUninstall() {
   if (flags.yes !== true) {
     const fullT = flags['full-removal'] === true;
     const credsT = fullT || flags.credentials === true;
-    const removes = ['the shipper/dashboard daemons and the OS service'];
+    const removes = ['the shipper/dashboard daemons and the OS service', "the dashboard's token"];
     if (credsT) removes.push(`the house connection and its credential (${ENV_FILE.replace(os.homedir(), '~')})`);
     if (fullT) removes.push("this machine's host identity (a reinstall becomes a NEW host)");
     const keeps = [];
@@ -4132,7 +5860,10 @@ async function cmdUninstall() {
     const p = path.join(HOME_DIR, d);
     if (fs.existsSync(p)) fs.rmSync(p, { recursive: true });
   }
-  console.log(ok('removed runtime state (pidfiles, logs)'));
+  // The dashboard's token, and the page `memhouse dashboard` writes with it. The next start
+  // makes a new token.
+  for (const f of [dashAuth.tokenPath(HOME_DIR), dashAuth.openerPath(HOME_DIR)]) fs.rmSync(f, { force: true });
+  console.log(ok("removed runtime state (pidfiles, logs, the dashboard's token)"));
 
   if (creds) {
     if (fs.existsSync(ENV_FILE)) {
@@ -4164,11 +5895,35 @@ async function cmdUninstall() {
   // invite, uninstall and friends act on first call with no separate confirm step, so a
   // --help that fell through to the default branch would DO the thing instead of
   // describing it. One check ahead of the switch, for every command, is the whole fix.
+  // The command's own entries, not the whole page (memhouse/help.js); `q` lists its named queries.
   if (cmd && (flags.help === true || process.argv.slice(2).some((a) => a === '-h' || a === '--help'))) {
-    console.log(HELP); return;
+    if (cmd === 'q') {
+      const schema = isV3(resolveConfig()) ? 3 : 2;
+      for (const l of qc().renderQ('list', await qc().runQ(null, null, qc().parseQ([], {}), { schema }))) console.log(l);
+      return;
+    }
+    console.log(require(path.join(REPO_ROOT, 'memhouse', 'help')).helpFor(HELP, cmd, PKG.version) || HELP); return;
   }
   const cfg = resolveConfig();
 
+  // Commands that act on the 0.18 rooms — deleting, re-shipping, granting, rebuilding or moving
+  // them. On a schema-3 install they would act on tables this install no longer reads (or fail
+  // halfway), so they stop here and say so. Reset and relocate on schema 3 come later (share is ported).
+  {
+    const legacyOnly = ['reset', 'relocate', 'migrate-rooms', 'convert'];
+    const v3Migrate = V3_MIGRATE_FLAGS.some((f) => flags[f] === true);
+    if (isV3(cfg) && (legacyOnly.includes(cmd) || (cmd === 'migrate' && !v3Migrate))) {
+      const msg = `memhouse ${cmd} works on the 0.18 rooms; this install is on schema 3 (MEMHOUSE_SCHEMA=3) — nothing ran.`;
+      if (JSON_OUT) console.log(JSON.stringify({ error: 'schema', schema: 3, command: cmd, message: msg }));
+      else {
+        console.log(bad(msg));
+        if (cmd === 'migrate') console.log('  the schema-3 steps are: memhouse migrate --v3-prepare | --v3-convert | --v3-reconcile [--member M], then --v3-switch on each machine');
+      }
+      process.exitCode = 2;
+      return;
+    }
+  }
+
   switch (cmd) {
     case null: {
       // Bare `memhouse`. If an invite file is where the user is standing — or in their
@@ -4219,6 +5974,50 @@ async function cmdUninstall() {
         process.exitCode = 1;
         break;
       }
+      if (!['', '2', '3'].includes(String(c.schema))) {
+        console.log(bad(`--schema ${c.schema}: only 2 (the 0.18 rooms) and 3 (harness-sessions-sql's profile) exist`));
+        process.exitCode = 1;
+        break;
+      }
+      // A credential that administers the server, saved here, is an administrator password on
+      // disk that every process running as this user can read — and memhouse ships as a
+      // member, so it buys nothing day to day. Store one only on request (--keep-admin, as
+      // install says it), or on a yes at a terminal; never because --yes waved it through.
+      // Re-saving the credential already configured here (a port change) does not ask again.
+      // An administrator password given as --password is refused outright, --keep-admin or
+      // not: it is the admin password on the command line, which --admin-password no longer
+      // accepts either.
+      const prior = readEnvFile();
+      const same = prior.MEMHOUSE_URL === c.url && prior.MEMHOUSE_USER === c.user;
+      const onArgv = SECRETS_ON_ARGV.has('password');
+      if (onArgv || (!same && flags['keep-admin'] !== true)) {
+        let grants = [];
+        try { grants = (await chRows(c, 'SHOW GRANTS', { database: '' })).map((r) => Object.values(r).join(' ')); } catch { /* unreachable: nothing to judge by */ }
+        const caps = capabilitiesFrom(grants);
+        if ((caps.canMintUsers || caps.isSuperuser) && onArgv) {
+          console.log(bad(`'${c.user}' administers this server, and an administrator password on the command line is refused (it shows in \`ps\` and in shell history).`));
+          console.log('  Give it in MEMHOUSE_PASSWORD, or --password-file <file, mode 600> / --password-file - (stdin), or at the prompt, and add --keep-admin to store it.');
+          console.log('  Nothing written.');
+          process.exitCode = 2;
+          break;
+        }
+        if ((caps.canMintUsers || caps.isSuperuser) && !same && flags['keep-admin'] !== true) {
+          console.log(warn(`'${c.user}' administers this server${caps.isSuperuser ? ' (reads every house, creates users and houses)' : ' (creates users)'}.`));
+          console.log(`  Saving it puts an administrator password in ${short(ENV_FILE)}, readable by every process run as you.`);
+          console.log('  memhouse ships as a member: make one with  memhouse install --admin-user ' + c.user + ' --member <you>');
+          console.log('  (the admin password from MEMHOUSE_ADMIN_PASSWORD or --admin-password-file, and not stored).');
+          let go = false;
+          if (process.stdin.isTTY && flags.yes !== true) {
+            const a = (await ask('  Store this administrator credential anyway? (y/N)', 'N')).toLowerCase();
+            go = a === 'y' || a === 'yes';
+          }
+          if (!go) {
+            console.log(bad('nothing written. To store an administrator credential on purpose:  memhouse setup … --keep-admin'));
+            process.exitCode = 1;
+            break;
+          }
+        }
+      }
       writeEnvFile(c);
       console.log(ok(`config written: ${ENV_FILE}`));
       break;
@@ -4231,11 +6030,17 @@ async function cmdUninstall() {
       if (flags['ensure-schema'] === true) args.push('--ensure-schema');
       if (flags.full === true) args.push('--full');
       if (flags.loop !== undefined) { args.push('--loop'); if (flags.loop !== true) args.push(String(flags.loop)); }
+      // Schema v3 capture (memhouse/shipper/capture.js): --v3, or MEMHOUSE_SCHEMA=3 in the env.
+      for (const f of ['v3', 'backfill', 'reconcile', 'no-dedupe', 'duplicates', 'redupe', 'no-bridge', 'no-normalise', 'cleanup', 'no-cleanup', 'dry-run']) if (flags[f] === true) args.push(`--${f}`);
       process.exitCode = run(SHIP_JS, args, cfg);
       break;
     }
-    case 'stats': requireConfig(cfg, 'stats'); process.exitCode = run(SHIP_JS, ['--stats'], cfg); break;
+    case 'stats': process.exitCode = await cmdStats(cfg); break;
+    case 'q': process.exitCode = await cmdQ(); break;
+    case 'room-sql': process.exitCode = await cmdRoomSql(); break;
+    case 'import': process.exitCode = await cmdImport(); break;
     case 'start': await cmdStart(); break;
+    case 'dashboard': process.exitCode = await cmdDashboard(); break;
     case 'stop': cmdStop(); break;
     case 'status': process.exitCode = await cmdStatus(); break;
     case 'doctor': process.exitCode = await cmdDoctor(); break;
@@ -4247,6 +6052,15 @@ async function cmdUninstall() {
     // configured credential is — the substitute for that name.
     case 'sessions-query': {
       const cfg = requireConfig(resolveConfig(), 'sessions-query');
+      if (isV3(cfg)) {
+        // Schema 3: the sessions table IS the rollup (exact totals, one row per session).
+        const t = v3Transport(cfg);
+        let rooms;
+        try { rooms = await v3RoomsFor(cfg, t); } catch (e) { process.exitCode = qError(e); break; }
+        if (!JSON_OUT) console.log(`-- memhouse sessions for '${rooms.member}' (schema 3) — the sessions table read FINAL, tombstones dropped; 0.18 column names kept as aliases.`);
+        console.log(qc().sessionsQueryV3(rooms));
+        break;
+      }
       const r = await roomsFor(cfg);
       // On STDOUT and inside the SQL. This used to go to stderr, so `sessions-query >
       // q.sql` kept the query and dropped the instruction it depended on. The rollup now
@@ -4266,7 +6080,7 @@ async function cmdUninstall() {
       const au = flags['admin-user'] && flags['admin-user'] !== true ? String(flags['admin-user']) : (cfg.adminUser || null);
       const ap = au ? await adminPasswordFor(au) : '';
       if (ap === null) { process.exitCode = 1; break; }
-      if (!au) { console.log(bad('convert needs an admin credential: --admin-user/--admin-password (or the one this instance keeps)')); process.exitCode = 1; break; }
+      if (!au) { console.log(bad('convert needs an admin credential: --admin-user with MEMHOUSE_ADMIN_PASSWORD or --admin-password-file (or the one this instance keeps)')); process.exitCode = 1; break; }
       const who = { ...cfg, user: au, password: ap };
       const only = flags.member && flags.member !== true ? String(flags.member) : null;
       // Candidates: a user whose own database holds `messages` and who has no rooms in `db` yet.
@@ -4358,42 +6172,64 @@ async function cmdUninstall() {
       // Reading ANOTHER account's grants needs privilege; without it ClickHouse simply
       // returns fewer rows. Say so rather than presenting a short list as the whole truth.
       const who = au ? { ...cfg, user: au, password: ap } : cfg;
-      let rows = [];
+      let rows = []; let rolesUnread = false;
       try {
         // `is_wildcard` arrived in 26.x. On 25.11 — the default local tag — a wildcard grant
         // is enforced identically but its row carries only the bare prefix (`alice_`), so
         // without the column the trailing underscore is the marker.
         const hasWild = Number((await chRows(who, "SELECT count() AS n FROM system.columns WHERE database = 'system' AND table = 'grants' AND name = 'is_wildcard'", { database: '' }))[0]?.n) > 0;
-        const star = hasWild ? "if(is_wildcard, '*', '')" : "if(endsWith(table, '_'), '*', '')";
-        rows = await chRows(who,
-          `SELECT user_name AS u, max(table IS NULL) AS db_wide,
-                  arrayStringConcat(arraySort(groupUniqArray(concat(table, ${star}))), ', ') AS tables
-             FROM system.grants
-            WHERE database = ${sqlStr(db)} AND user_name IS NOT NULL
-            GROUP BY user_name ORDER BY user_name`, { database: '' });
+        // The house and its capture archive: a grant on a member's archive tables is access too.
+        const archive = require(path.join(REPO_ROOT, 'memhouse', 'house', 'schema-profile')).archiveDb(db);
+        const share = require(path.join(REPO_ROOT, 'memhouse', 'share'));
+        const grants = await chRows(who, share.membersGrantsSQL({ db, archive, hasWild, sqlStr }), { database: '' });
+        // Who holds which role: a credential that cannot read it is told so, never shown less silently.
+        let roleGrants = [];
+        try { roleGrants = await chRows(who, share.MEMBERS_ROLE_GRANTS_SQL, { database: '' }); }
+        catch (e) {
+          rolesUnread = true;
+          // stderr: a --json reader gets only JSON on stdout (and roles_read: false in it).
+          console.error(warn(`could not read who holds which role (${String(e.message).split('\n')[0]}): access held through a role is not shown`));
+        }
+        rows = share.membersAccess({ grants, roleGrants, db });
+        // Whether a share is scoped: its row policies, where this credential can list them.
+        try { rows.policies = await chRows(who, `SELECT short_name, table FROM system.row_policies WHERE database = ${sqlStr(db)}`, { database: '' }); }
+        catch { rows.policies = null; }
       } catch (e) {
         console.log(bad(`could not read the grant table: ${e.message}`));
-        console.log('  Pass an admin credential:  memhouse members --admin-user <a> --admin-password <p>');
+        console.log('  Pass an admin credential:  memhouse members --admin-user <a>   (its password from MEMHOUSE_ADMIN_PASSWORD, or --admin-password-file -)');
         process.exitCode = 1; break;
       }
+      const share = require(path.join(REPO_ROOT, 'memhouse', 'share'));
+      const described = (r) => share.describeAccess(r, { policies: rows.policies });
       if (JSON_OUT) {
-        console.log(JSON.stringify({ database: db, members: rows.map((r) => ({
+        console.log(JSON.stringify({ database: db, roles_read: !rolesUnread, policies_read: rows.policies !== null, members: rows.map((r) => ({
           name: r.u, scope: Number(r.db_wide) === 1 ? 'database' : 'rooms',
-          rooms: Number(r.db_wide) === 1 ? null : String(r.tables || '').split(', ').filter(Boolean),
+          rooms: Number(r.db_wide) === 1 ? null : r.list,
+          ...(Number(r.db_wide) === 1 ? {} : described(r)),
         })) }, null, 2));
         break;
       }
       if (!rows.length) {
         console.log(ok(`no member holds a grant on '${db}'`));
         console.log(`  Either it is empty, or this credential cannot see other accounts' grants.`);
-        console.log('  With an admin:  memhouse members --db ' + db + ' --admin-user <a> --admin-password <p>');
+        console.log('  With an admin:  memhouse members --db ' + db + ' --admin-user <a>   (its password from MEMHOUSE_ADMIN_PASSWORD, or --admin-password-file -)');
         break;
       }
       const owners = rows.filter((r) => Number(r.db_wide) === 1);
       console.log(`  '${db}' — ${rows.length} member(s):`);
+      // Each account's own tables, the members it reads (a share: scoped or full where the row
+      // policies can be listed), and anything else, which memhouse does not grant itself.
       for (const r of rows) {
-        if (Number(r.db_wide) === 1) console.log(`    ${String(r.u).padEnd(16)} the whole database`);
-        else console.log(`    ${String(r.u).padEnd(16)} ${String(r.tables || '(none)')}`);
+        if (Number(r.db_wide) === 1) { console.log(`    ${String(r.u).padEnd(16)} the whole database`); continue; }
+        const d = described(r);
+        const pad = ' '.repeat(21);
+        const lines = [];
+        if (d.own.length) lines.push(`own: ${d.own.join(', ')}`);
+        for (const s of d.shares) lines.push(`reads ${s.from}'s sessions (a share${s.scoped === null ? '' : s.scoped ? ', scoped' : ', full'}): ${s.tables.join(', ')}`);
+        if (d.other.length) lines.push(`other grants (not memhouse's own shape — check them): ${d.other.join(', ')}`);
+        if (!lines.length) lines.push('(none)');
+        console.log(`    ${String(r.u).padEnd(16)} ${lines[0]}`);
+        for (const l of lines.slice(1)) console.log(`${pad}${l}`);
       }
       if (owners.length && rows.length > 1) {
         console.log('');
@@ -4425,7 +6261,16 @@ async function cmdUninstall() {
         try { return fs.realpathSync(b.home) === realHome; } catch { return b.home === HOME_DIR; }
       });
       let rooms = null; let counts = {};
-      if (cfg.stated && cfg.user) {
+      if (cfg.stated && cfg.user && isV3(cfg)) {
+        // Schema 3: the conversation tables in the house, the capture tables in <db>_archive.
+        const SP = require(path.join(REPO_ROOT, 'memhouse', 'house', 'schema-profile'));
+        const N = SP.profileNames(cfg.db, cfg.user);
+        const list = [...SP.PROFILE_TYPES, 'meta', 'events'].map((k) => N[k]);
+        try {
+          for (const r of await chRows(cfg, `SELECT concat(database, '.', name) AS fq, total_rows AS n FROM system.tables WHERE (database = ${sqlStr(cfg.db)} OR database = ${sqlStr(N.archive)}) AND startsWith(name, ${sqlStr(`${cfg.user}_`)})`, { database: '' })) counts[r.fq] = Number(r.n);
+        } catch { /* unreachable house: tables still listed, counts absent */ }
+        rooms = { v3: list };
+      } else if (cfg.stated && cfg.user) {
         rooms = roomNames(cfg.user);
         try {
           // system.tables, not system.parts: a member holds no grant on the latter, and the
@@ -4437,21 +6282,42 @@ async function cmdUninstall() {
       const out = {
         instance: name, home: HOME_DIR, envFile: ENV_FILE, binary: thisBin, version: PKG.version, channel: cfg.channel || null,
         house: cfg.stated ? { url: cfg.url, db: cfg.db, member: cfg.user, adminCredential: !!cfg.adminUser, adminUser: cfg.adminUser || null } : null,
-        rooms: rooms ? [...ROOM_TYPES, ...META_TYPES].map((t) => ({ table: `${cfg.db}.${rooms.physical[t]}`, rows: counts[rooms.physical[t]] ?? null })) : [],
-        ships: scope.describe({ MEMHOUSE_EDITORS: cfg.editors, MEMHOUSE_CLAUDE_ROOTS: cfg.claudeRoots }),
-        host: host ? host.id : null, daemons: { ...daemons, dashboardUrl: daemons.dashboard ? `http://localhost:${cfg.port}` : null },
+        schema: isV3(cfg) ? 3 : 2,
+        rooms: !rooms ? [] : rooms.v3 ? rooms.v3.map((fq) => ({ table: fq, rows: counts[fq] ?? null }))
+          : [...ROOM_TYPES, ...META_TYPES].map((t) => ({ table: `${cfg.db}.${rooms.physical[t]}`, rows: counts[rooms.physical[t]] ?? null })),
+        ships: isV3(cfg) ? (() => { const sr = sourceRootsFor(cfg); return sr.error ? `capture roots: ${sr.error}` : `capture (schema 3)${sr.defaulted ? ', default roots' : ''}: ${sr.roots.map((r) => `${r.harness}:${r.name}=${short(r.dir)}`).join(', ') || 'none found'}`; })()
+          : scope.describe({ MEMHOUSE_EDITORS: cfg.editors, MEMHOUSE_CLAUDE_ROOTS: cfg.claudeRoots }),
+        host: host ? host.id : null,
+        daemons: { ...daemons, dashboardUrl: daemons.dashboard ? `http://127.0.0.1:${runningPort(cfg)}` : null, dashboardOpen: daemons.dashboard ? selfCmd('dashboard') : null },
         boundPlaybooks: bound,
       };
+      // `schema` above is what THIS install reads. On a machine left behind by a conversion it
+      // printed "schema 2" as if that were the house's, beside a house that had moved on, and
+      // only `status` told the truth. Ask the house the same question status asks.
+      if (cfg.stated && cfg.user) {
+        let p = null;
+        try { p = await roomsProblem(cfg); } catch { /* unreachable house: nothing to compare */ }
+        if (p) { out.rooms_problem = p.kind; out.problem = p.lines; out.stranded = ['moved', 'not-moved', 'moved-db'].includes(p.kind); }
+      }
       if (JSON_OUT) { console.log(JSON.stringify(out, null, 2)); break; }
       const line = (k, v) => console.log(`  ${k.padEnd(9)} ${v}`);
       line('instance', `${name}   (${short(HOME_DIR)})`);
       line('binary', `${short(thisBin)}   ${PKG.version}${cfg.channel ? `   channel ${cfg.channel}` : ''}`);
       if (!out.house) { line('house', 'none configured — memhouse install'); break; }
-      line('house', `${cfg.url}   db ${cfg.db}   member ${cfg.user}   admin credential: ${cfg.adminUser ? `yes (${cfg.adminUser})` : 'no'}`);
-      line('rooms', out.rooms.map((r) => `${r.table}${r.rows === null ? '' : ` ${r.rows}`}`).join('  ·  '));
+      line('house', `${cfg.url}   db ${cfg.db}   member ${cfg.user}   schema ${out.schema}${out.stranded ? ' (what this install reads; the house disagrees)' : ''}   admin credential: ${cfg.adminUser ? `yes (${cfg.adminUser})` : 'no'}`);
+      if (out.problem) {
+        console.log(bad(`${out.stranded ? 'stranded: ' : ''}${out.problem[0]}`));
+        console.log(`  ${out.problem[1]}`);
+        console.log('  details:  memhouse status');
+      }
+      // Rows, not sessions: a table's row count holds every version not yet merged (a session is
+      // rewritten on each change), so beside status's session count it read as a second, different
+      // number of sessions. Said as rows, with where sessions are counted.
+      line(out.schema === 3 ? 'tables' : 'rooms', out.rooms.map((r) => `${r.table}${r.rows === null ? '' : ` ${r.rows} rows`}`).join('  ·  '));
+      if (out.rooms.some((r) => r.rows !== null)) line('', 'rows on disk, versions not yet merged included: sessions are counted by memhouse status and stats');
       line('ships', out.ships);
       line('host', host ? host.id : 'not minted yet (first ship mints it)');
-      line('daemons', `shipper ${daemons.shipper ? `running (pid ${daemons.shipper})` : 'stopped'}   dashboard ${daemons.dashboard ? `running (pid ${daemons.dashboard}) → http://localhost:${cfg.port}` : 'stopped'}`);
+      line('daemons', `shipper ${daemons.shipper ? `running (pid ${daemons.shipper})` : 'stopped'}   dashboard ${daemons.dashboard ? `running (pid ${daemons.dashboard}, port ${runningPort(cfg)}) — open it with: ${selfCmd('dashboard')}` : 'stopped'}`);
       line('bound', bound.length ? bound.map(short).join(', ') : 'no playbook is bound to this instance — memhouse plugins install claude');
       break;
     }
@@ -4460,6 +6326,21 @@ async function cmdUninstall() {
       // configured house. It resolves through roomNames(), so it cannot drift from what the
       // shipper writes to.
       const cfg = requireConfig(resolveConfig(), 'rooms');
+      if (isV3(cfg)) {
+        const t = v3Transport(cfg);
+        let member;
+        try { member = (await v3RoomsFor(cfg, t)).member; } catch (e) { process.exitCode = qError(e); break; }
+        const SP = require(path.join(REPO_ROOT, 'memhouse', 'house', 'schema-profile'));
+        const N = SP.profileNames(cfg.db, member);
+        const tables = Object.fromEntries([...SP.PROFILE_TYPES, 'meta', 'events'].map((k) => [k, N[k]]));
+        if (JSON_OUT) { console.log(JSON.stringify({ schema: 3, database: cfg.db, archive: N.archive, member, pattern: `${member}_*`, tables }, null, 2)); break; }
+        console.log(`${cfg.db} — your tables, schema 3 (harness-sessions-sql's profile, ${cfg.db}.${member}_*):`);
+        for (const k of SP.CONVERSATION_TYPES) console.log(`  ${tables[k]}`);
+        console.log(`  capture layer (the shipper's only): ${N.session_units}, ${N.session_sources}`);
+        console.log(`  record of the house: ${N.meta}, ${N.events}`);
+        console.log(`\n  Bare names in memhouse room-sql resolve to these. Read them FINAL and filter is_deleted = 0 AND removed = 0; a session is (host, harness, harness_path, session_id, incarnation).`);
+        break;
+      }
       const r = await roomsFor(cfg);
       const names = {};
       for (const t of [...ROOM_TYPES, ...META_TYPES]) names[t] = r.physical[t];
@@ -4484,7 +6365,9 @@ async function cmdUninstall() {
         // wrong for anyone whose house or MEMHOUSE_HOME differs, which is the whole point
         // of having those knobs. `--install` already renders; bare `prompt` did not.
         const pcfg = resolveConfig();
-        process.stdout.write(fs.readFileSync(path.join(DELIVERY, 'PROMPT.md'), 'utf-8')
+        // The snippet for THIS install's schema: the schema-3 text teaches `memhouse q` and the
+        // profile tables; the schema-2 text the 0.18 rooms and their epoch filter.
+        process.stdout.write(qc().renderSchemaBlocks(fs.readFileSync(path.join(DELIVERY, 'PROMPT.md'), 'utf-8'), isV3(pcfg) ? 3 : 2)
           .replaceAll('{{DB}}', pcfg.db)
           .replaceAll('{{ENV_FILE}}', ENV_FILE));
       }
@@ -4495,7 +6378,17 @@ async function cmdUninstall() {
     case 'invite': process.exitCode = await cmdInvite(); break;
     case 'passwd': process.exitCode = await cmdPasswd(); break;
     case 'nightly': process.exitCode = await cmdNightly(); break;
-    case 'migrate': process.exitCode = await cmdMigrate({}); break;
+    case 'migrate': {
+      // The admin flags are read by the admin steps only. Beside --v3-switch (the member's step) or
+      // a plain migrate (the member's rooms) they would be ignored, so they are refused.
+      const adminOnly = ['admin-user', 'admin-password-file'].filter((k) => flags[k] !== undefined);
+      if (adminOnly.length && (flags['v3-switch'] === true || !V3_MIGRATE_FLAGS.some((f) => flags[f] === true))) {
+        console.log(bad(`--${adminOnly.join(', --')} ${adminOnly.length > 1 ? 'are' : 'is'} read by the admin steps only: --v3-prepare, --v3-convert, --v3-reconcile, --v3-shares`));
+        process.exitCode = 2; break;
+      }
+      process.exitCode = V3_MIGRATE_FLAGS.some((f) => flags[f] === true) ? await cmdMigrateV3() : await cmdMigrate({});
+      break;
+    }
     case 'migrate-rooms': process.exitCode = await cmdMigrate({ component: 'rooms' }); break;
     case 'relocate': process.exitCode = await cmdRelocate(); break;
     case 'deploy': {
@@ -4611,7 +6504,7 @@ async function cmdUninstall() {
         console.log('  to start over (DESTROYS the memory):  memhouse deploy --down');
         process.exitCode = 2; break;
       }
-      // Who owns this house. A local deploy is the pilot's own machine and their own
+      // Who owns this house. A local deploy is the user's own machine and their own
       // memory, so the house user is THEM — suggested from the OS username (`sam`, not
       // `memhouse_root`) — created by the container itself at first init with full
       // rights. No admin/member split, no provisioning dance: a URI and a credential is
@@ -4627,7 +6520,7 @@ async function cmdUninstall() {
         const storedUser = readEnvFile().MEMHOUSE_USER;
         // No stored user means the env file is gone or emptied — the stored PASSWORD is
         // gone with it, so the `initialised && !reusable` refusal below already owns this
-        // case. Refusing `--user` here on a guessed 'memhouse_root' would tell the pilot
+        // case. Refusing `--user` here on a guessed 'memhouse_root' would tell the user
         // their house "was initialised with memhouse_root" on no evidence at all.
         if (storedUser && flags.user && flags.user !== true && flags.user !== storedUser) {
           console.log(bad(`--user cannot rename the user of an existing house — the image creates it only when it initialises the data directory.`));
@@ -4788,6 +6681,25 @@ async function cmdUninstall() {
           process.exitCode = 1; break;
         }
         console.log(ok(`member '${houseUser}' holds ${targetDb}.${houseUser}_* and nothing else; '${superUser}' administers the house`));
+        // Schema 3, the layout a new house gets (a member already on the 0.18 rooms keeps
+        // them): its capture tables live in <db>_archive, which only an admin creates and
+        // grants. The superuser is at hand here, so they are built now, and the member install
+        // below finds them ready. Without this, deploy --local on 0.20 stopped at the install.
+        const pick = schemaChoice.chooseSchema(flags.schema && flags.schema !== true ? String(flags.schema) : '',
+          await schemaChoice.detectHouseSchema((sql) => chRows(adminCfg, sql, { database: '' }), targetDb, houseUser), houseUser, { user: adminCfg.user, url: adminCfg.url });
+        if (pick.refuse) { console.log(bad(pick.refuse)); process.exitCode = 1; break; }
+        if (pick.schema === '3') {
+          const v3 = require(path.join(REPO_ROOT, 'memhouse', 'house', 'schema-profile'));
+          let built = null;
+          try { built = await v3.ensureProfileSchema(v3Transport(adminCfg, { timeout: 120000 }).q, { db: targetDb, member: houseUser, createDatabases: true, grantCapture: true }); }
+          catch (e) { console.log(bad(`could not build the schema 3 tables: ${String(e.message).split('\n')[0]}`)); process.exitCode = 1; break; }
+          const badT = Object.values(built.tables).filter((x) => x.problem);
+          if (badT.length || built.grant_failures.length) {
+            console.log(bad(`schema 3 tables for '${houseUser}' not ready: ${[...badT.map((x) => `${x.fq} ${x.problem}`), ...built.grant_failures].join('; ')}`));
+            process.exitCode = 1; break;
+          }
+          console.log(ok(`schema 3: ${Object.values(built.tables).map((x) => x.fq).join(', ')}; capture tables granted to '${houseUser}'`));
+        }
       } else if (initialised && !priorCfg.adminUser) {
         console.log(warn(`'${houseUser}' is both member and superuser here — this house predates fencing. It works; \`memhouse doctor\` says how to fence it.`));
       }
@@ -4796,7 +6708,7 @@ async function cmdUninstall() {
       // volume survives, so nothing is lost, but the house is gone with no explanation.
       //
       // Whether it happens depends on logind's KillUserProcesses. Measured once on a
-      // testbed VM as `Exited (143)` twenty seconds after the ssh session ended; measured
+      // test VM as `Exited (143)` twenty seconds after the ssh session ended; measured
       // again later on Ubuntu 24.04, which ships KillUserProcesses=no, and the container
       // and the user manager both survived 44 seconds with zero sessions and Linger=no.
       // So the warning is conditional, and it is worded as a possibility rather than a