memhouse 0.18.8 → 0.18.10

package/docs/guides/share.md

@@ -0,0 +1,102 @@
+# Share and revoke
+
+A share lets another member of the same server read your rooms. It is a ClickHouse
+`GRANT SELECT`, so it is read-only, and you can withdraw it. Run these on a machine
+installed as yourself. Each command acts on your own rooms only.
+
+```bash
+memhouse share bob                          # full: everything in mem.<you>_*
+memhouse share bob --only project=billing   # scoped: three rooms, filtered
+memhouse share --list                       # what memhouse has recorded
+memhouse share bob --revoke                 # take it back
+```
+
+## Full or scoped
+
+| | full (`share bob`) | scoped (`share bob --only …`) |
+|---|---|---|
+| grant | `SELECT ON mem.<you>_*` | `SELECT` on `<you>_sessions`, `<you>_messages`, `<you>_tool_calls` |
+| rows | all | those matching the scope, through row policies |
+| stats tables (`<you>_session_stats`, model and tool stats) | readable: first prompts, folders, projects and tokens of every session | not granted |
+| `<you>_meta`, `<you>_events` | readable, including your other share records | not granted |
+| rooms created later | readable | not granted |
+
+**A full share is for someone you would hand your laptop to.** It reaches every table in
+your pattern, including ones memhouse adds in a later release. The command says so when
+you run it.
+
+## Scopes
+
+`--only key=value[,key=value…]`. All the keys must hold (AND):
+
+| key | filters on |
+|---|---|
+| `project=` | the project name |
+| `folder=` | the working directory |
+| `session=` | one session id |
+| `host=` | one machine (its fingerprint, as `status` shows it) |
+| `source=` | one editor, by the value stored in the `source` column (below) |
+| `since=` / `until=` | a date range: message time, or session creation time for `sessions` |
+
+`source=` compares against the stored value, which is not always the adapter name you
+use in `MEMHOUSE_EDITORS`. Claude Code rows, for example, say `claude-code`, not `claude`.
+The values:
+
+| editor | `source` |
+|---|---|
+| Claude Code | `claude-code` |
+| Codex | `codex` |
+| Cursor / Cursor Agent | `cursor` / `cursor-agent` |
+| VS Code / VS Code Insiders | `vscode` / `vscode-insiders` |
+| GitHub Copilot / Copilot for JetBrains | `copilot-cli` / `copilot-jetbrains` |
+| Gemini CLI | `gemini-cli` |
+| Zed, OpenCode, Goose, Kiro, Codebuff, Antigravity | `zed`, `opencode`, `goose`, `kiro`, `codebuff`, `antigravity` |
+| Devin / Devin Next | `devin` / `devin-next` |
+| Command Code | `commandcode` |
+
+To see what your rooms actually hold:
+`SELECT source, count() FROM mem.<you>_sessions FINAL GROUP BY source`.
+
+An empty scope (`--only ""`, or `--only "$SCOPE"` with the variable unset) is refused.
+It never falls back to a full share.
+
+## How the server must be configured
+
+Row policies in ClickHouse have one sharp edge. On some server configurations, the first
+policy on a table hides every row from readers who have no policy of their own: you, and
+your full-share grantees. Before it creates the first policy, `share` measures how this
+server behaves, and refuses if a policy would blind you. The fix is server configuration
+(`users_without_row_policies_can_read_rows`), and it is the administrator's to make.
+
+## Changing a share
+
+- **Scoped to full:** `memhouse share bob`.
+- **Full to scoped:** `memhouse share bob --only …`. The wildcard grant is withdrawn
+  first, so a failure part-way leaves bob with less access, never more.
+- **One scope to another:** run `--only` again with the new scope. It replaces the
+  policies.
+
+**Scoped shares made before 0.18.10** granted the whole pattern while filtering only three
+rooms. Re-run `memhouse share <user> --only <scope>` once for each, and it is narrowed to
+the three rooms.
+
+## Revoking
+
+`--revoke` withdraws the grants (the wildcard and the three rooms), then drops the row
+policies. If the server refuses a step, the policies are kept unless every grant is
+confirmed gone, so a failed revoke never leaves an unfiltered share behind.
+
+A revoke cannot recall what was already read.
+
+## What `--list` shows
+
+`share --list` reads memhouse's own record, the `share:` keys in `<you>_meta`. A grant
+someone made by hand in SQL does not appear there. A member cannot read `system.grants`;
+an administrator can, with `SHOW GRANTS FOR <user>`.
+
+## Reading what was shared with you
+
+Shared rooms sit in the same database as yours, under the other member's name, for
+example `mem.alice_messages`. Query them with `/mem:sql` or any ClickHouse client, joining
+on `(session_id, user_id)` as you would on your own rooms. A table you were not granted is
+refused, and a scope you are under returns only its rows.

package/docs/guides/storage.md

@@ -0,0 +1,90 @@
+# How memory is stored
+
+## A house, rooms, and members
+
+- **A house is a ClickHouse database,** normally `mem`.
+- **A member is a ClickHouse user** who ships into it.
+- **Each member's rooms are tables named for them:**
+
+| room | holds |
+|---|---|
+| `<member>_sessions` | one row per session: editor, project, folder, branch, timestamps, title |
+| `<member>_messages` | every turn: role, text, model, tokens, timestamp, position |
+| `<member>_tool_calls` | every tool call: name, arguments, which message made it |
+| `<member>_session_stats`, `_session_model_stats`, `_session_tool_stats` | precomputed rollups for the dashboard, refreshed after each pass |
+| `<member>_meta` | memhouse's own records: schema version, writers, shares |
+| `<member>_events` | an append-only log: migrations, version changes |
+
+**A member holds one grant: `ON mem.<member>_*`.** That covers their own rooms, present and
+future, and nothing else in the database. Nobody is granted the database itself:
+`ALL ON mem.*` would also reach rooms created later, which is how two people in one
+database once leaked into each other. A member can read their isolation back with
+`SHOW GRANTS`.
+
+| | rooms | each member holds |
+|---|---|---|
+| alone on a laptop | `mem.polat_*` | one grant on `mem.polat_*` |
+| a team on one server | `mem.polat_*`, `mem.alice_*`, … | one grant each, on their own |
+
+Reading across members is a `UNION ALL` over the rooms you hold: your own, and any shared
+with you. Naming a room you were not granted is an error, never a silent omission.
+
+## Every row says where it came from
+
+- **`user_id`** is stamped by the server: `MATERIALIZED currentUser()`. Async inserts are
+  pinned off for members, so the stamp cannot be skipped. `WHERE user_id = 'alice'` is one
+  person.
+- **`host`** is the machine. Each install mints a random fingerprint once and keeps it in
+  `$MEMHOUSE_HOME/host.json`, and every row carries `<hostname>-<8 hex>`. It is random,
+  not derived from the machine:
+  - a derived id would merge two laptops that both answer to `MacBook-Pro`;
+  - a derived id would split one machine in two when it is renamed.
+
+  `memhouse status` shows this machine's id. `memhouse doctor` names every host in your
+  rooms.
+- **`origin`** says who wrote the row. The shipper writes `ship`; an import writes its own
+  value.
+
+## The house never destroys what it cannot rebuild
+
+**The shipper is insert-only.** It runs no `DELETE`, no `TRUNCATE`, and no mutation of
+any kind, so no privilege it holds can lose you a row.
+
+That has a cost. ReplacingMergeTree deduplicates but does not diff: a re-parse that yields
+*fewer* messages leaves the old, higher-positioned rows in place. A shorter re-parse has
+three possible causes:
+
+- an adapter bug was fixed, and the extra rows were junk;
+- Claude Code **compacted** the transcript;
+- the editor's retention window removed it.
+
+In the last two cases the house holds the only surviving copy. So rows carry an `epoch`,
+which says which parse of the session they belong to:
+
+- **Nothing changed**, or the session just grew: the same epoch. Rows deduplicate exactly,
+  and no extra storage is used.
+- **Shorter, or rewritten at a position the house already holds:** the new parse goes to
+  `epoch + 1`. The old parse stays complete and readable.
+
+Reads show one parse per session, the newest, so counts, tokens and cost are not
+inflated. The skills, the dashboard and `memhouse search` all filter this way; hand-written
+queries should too ([the clause](search-and-resume.md#writing-your-own-queries)).
+
+**Imported history is protected the same way.** `origin` is in the sorting key of
+`messages` and `tool_calls`, so a shipped row can never collapse an imported one. Anything
+imported from an older house, another product, or a machine that no longer exists survives
+every re-ship. `sessions` is the deliberate exception: it holds one row per session, with
+no `origin` or `epoch` in its key. A session's metadata has a single current version, and
+a second row would make every rollup count its messages twice.
+
+The shipper checks the rooms' sorting keys before it writes, and refuses if they are
+wrong. See [Update](update.md#when-the-house-itself-must-change).
+
+## What is not in the house
+
+- Nothing is embedded, summarised or rewritten. Text is stored as the editor wrote it,
+  truncated at 50,000 characters per message and 20,000 per tool argument.
+- No LLM runs anywhere in memhouse's write or read path. The skills are read by your agent,
+  which does the reading and reasoning.
+- The local transcript files stay where the editor put them. memhouse reads them and never
+  modifies them.

package/docs/guides/troubleshooting.md

@@ -0,0 +1,78 @@
+# Troubleshooting
+
+Start with the two diagnostics. Both are read-only.
+
+```bash
+memhouse doctor      # the whole pipeline, one line per check
+memhouse discover    # what each editor adapter sees on this machine
+```
+
+## An editor ships nothing
+
+`discover` lists every adapter. Each one is in one of three states:
+
+- it has sessions, with a count;
+- it has none, because the editor is not used on this machine;
+- it was **skipped**, with the reason.
+
+A skipped adapter and an editor you do not have both contribute zero sessions, so
+memhouse always says which one it is. Common causes, one store at a time:
+
+- **A SQLite store locked by the running editor:** `state.vscdb` for Cursor and VS Code.
+  The next pass retries.
+- **A store the editor moved or changed** in a new release.
+- **A scope that excludes it:** `MEMHOUSE_EDITORS` or a `MEMHOUSE_<EDITOR>_ROOTS` in the
+  env file. See [Configuration](configuration.md#which-sessions-ship).
+
+SQLite comes from Node itself (`node:sqlite`), so there is no native module to rebuild.
+
+## Status says the shipper runs, but nothing new arrives
+
+`memhouse status` reads the shipper's last pass from its log, and shows a failing pass
+as a failure.
+
+- **`Authentication failed`:** the password in `~/.memhouse/env` is no longer the
+  member's. This happens after a `passwd` on another machine, or a reset by the admin. Put
+  the current password into `MEMHOUSE_PASSWORD` in `~/.memhouse/env` (or run
+  `memhouse setup`, which asks), then restart the shipper.
+- **A pass that keeps withholding a session:** an adapter returned nothing for a session
+  the house already holds. The shipper refuses to replace a transcript with an empty one,
+  and says so on every pass, until the store is readable again.
+- **Nothing to ship:** sessions are only shipped once the editor has written them.
+
+## Daemons don't survive a reboot
+
+`memhouse start` uses pidfiles. Its daemons outlive the shell but not a restart. Use
+`memhouse service install` ([Daemons](daemons.md)). On Linux, also enable lingering, or
+user services stop at logout. A rootless podman house from `deploy --local` has the same
+exposure, and `deploy` prints the fix.
+
+## The dashboard is empty, or stale
+
+- **It reads the house, not the machine.** Check `memhouse status` for the connection
+  first.
+- **It reads precomputed stats,** refreshed at the end of each pass that shipped
+  something. On a house where nothing has shipped for a day, the stats age out, and a
+  running dashboard keeps reading them. Restart it (`memhouse stop && memhouse start`). It
+  then reads the rooms directly, until the next pass that ships refreshes the stats.
+  A fix is planned.
+- **After an upgrade it shows the old version:** restart it (`memhouse update` does this).
+
+## `EACCES` during `npm install -g`
+
+See [Install](install.md#eacces-on-install). `sudo` is right only when the npm prefix is
+owned by root.
+
+## `refused`, `ACCESS_DENIED`, `Not enough privileges`
+
+- For a member, these are expected outside `mem.<you>_*` and the rooms shared with you.
+  `memhouse whoami` shows what your credential may do.
+- For `invite`, `members` or `convert`: you need the admin credential. See
+  [Admin password](admin-password.md).
+- A room that should be yours but is refused usually means the house is older than this
+  version. Run `memhouse doctor`, then `memhouse migrate` if it says so.
+
+## Still stuck
+
+Run `memhouse doctor` and `memhouse status --json`, and open an issue with both outputs.
+Check them before posting, and remove anything private, such as a host name.

package/docs/guides/uninstall.md

@@ -0,0 +1,35 @@
+# Uninstall
+
+Three tiers. **None of them touches the memory in the house.**
+
+```bash
+memhouse uninstall                   # stop everything; KEEP the config and this machine's identity
+memhouse uninstall --credentials     # also forget the house and its password
+memhouse uninstall --full-removal    # all of ~/.memhouse, identity included
+npm uninstall -g memhouse            # then remove the package
+```
+
+- **The default is the conservative one.** Stopping the shipper is routine: before an
+  upgrade, while debugging, or when a laptop should go quiet for a week. It should not
+  also mean "forget which house I use and who this machine is".
+- **`--full-removal` asks first.** A later reinstall mints a **new** machine identity, and
+  this machine then reads as two machines in your history.
+- **Your memory stays.** The rooms in ClickHouse are untouched by every tier. What the
+  shipper wrote can be rebuilt from the local session stores with `memhouse ship --full`,
+  for as long as the editors keep them.
+
+## Removing the house itself
+
+- **A local house** from `deploy --local`: `memhouse deploy --down` removes the container
+  **and its data volume**. That deletes the memory, and there is no undo.
+- **A shared server:** an administrator drops your rooms and user. See
+  [Operate a house](operate.md).
+
+## Removing the skills
+
+```bash
+memhouse plugins remove claude
+```
+
+This removes the `/mem:*` skills, and the instance binding, from the Claude Code config
+directories they were installed into.

package/docs/guides/update.md

@@ -0,0 +1,68 @@
+# Update
+
+```bash
+memhouse update            # upgrade along this install's channel, restart the daemons, check the house
+memhouse update --check    # compare versions, change nothing
+```
+
+`update` does three things that a bare `npm install -g memhouse@latest` does not:
+
+1. **It restarts the daemons.** A running shipper keeps parsing with the code it booted
+   with. One once ran for 1 day 16 hours out of a directory that had since been moved.
+2. **It checks whether the house needs a migration** for the new version, and offers to run
+   it. `--migrate` runs it without asking.
+3. **It stays on your channel** (`MEMHOUSE_CHANNEL`). See
+   [Configuration](configuration.md#channels).
+
+Upgraded by hand already? Finish the job without reinstalling:
+
+```bash
+npm install -g memhouse@latest
+memhouse update --no-install
+```
+
+The daemons also notice on their own. Each one compares the installed version with the
+version it booted with, and hands over when they differ: under systemd or launchd it
+exits so the supervisor restarts it; with nothing supervising, it re-executes itself.
+`update` just makes the switch immediate.
+
+## Several machines on one house
+
+Every machine of every member runs its own shipper. Upgrade them all.
+
+- The release notes for each version say whether the order matters and whether mixed
+  versions can ship side by side. See [`docs/releases/`](../releases/).
+- `memhouse status` lists every machine writing to your rooms, with the version each
+  last reported and when it last shipped. A machine that is behind is named there.
+- Machines that stopped writing long ago are folded into one line. That is history, not
+  a fault. `memhouse status --all` lists them.
+
+## When the house itself must change
+
+Some releases need the rooms rebuilt, for example when a sorting key changes. The shipper
+checks the rooms' keys before it writes, and **refuses** to write into a house it does not
+match, so an old house cannot be corrupted by a new shipper. To bring the house up to
+date:
+
+```bash
+memhouse migrate --dry-run   # what would run
+memhouse migrate             # copy, atomic swap; nothing is deleted
+memhouse doctor              # every line a check mark
+```
+
+A migration copies each room, swaps it in atomically, and keeps the old one as
+`<room>_pre_<migration>` for you to drop when you are satisfied. The house records the move
+in its `events` room, and `doctor` reads it back.
+
+## Upgrading from 0.9.x
+
+0.9.x predates migrations, and `update` runs the **old** version's code (it replaces itself
+mid-run), so it cannot prompt. After the upgrade, the first ship refuses (nothing is lost)
+and names the one command to run by hand: `memhouse migrate`.
+
+## Upgrading a pre-0.18 house (a database per member)
+
+0.18 moved every member's rooms into one database, as `mem.<member>_*`. An operator moves
+an old house once with `memhouse convert`; see [Operate a house](operate.md#convert). After
+that, members upgrade with `memhouse update`, and the shipper adopts the moved rooms
+itself.

package/docs/releases/README.md

@@ -0,0 +1,10 @@
+# Release notes
+
+One document per release, from 0.18.10 onward. Each says what changed, what you need to
+do, how to upgrade, what is deprecated and when it goes, and what was deferred.
+
+| version | date | headline |
+|---|---|---|
+| [0.18.10](v0.18.10.md) | 2026-10-08 | security: the admin password never on argv; no member password printed; a scoped share reaches only its scope |
+
+Earlier versions: [`CHANGELOG.md`](../../CHANGELOG.md).

package/docs/releases/v0.18.10.md

@@ -0,0 +1,226 @@
+# memhouse 0.18.10 — 2026-10-08
+
+A security release:
+
+- an admin password no longer has to go on the command line;
+- no command prints a member password;
+- a scoped share no longer reaches past its scope.
+
+Everyone on 0.18.x should upgrade.
+
+**No drill was run for this release; waived by the pilot (2026-10-08). The drill runs before 0.19.0.**
+
+```bash
+memhouse update        # or: npm install -g memhouse@latest, then memhouse update --no-install
+memhouse status        # every line a check mark
+```
+
+Nothing in the house changes: no migration, no new room, no re-ship. Machines on 0.18.9
+and 0.18.10 can ship into the same house side by side.
+
+## Security
+
+### An admin password never has to go on the command line (#14)
+
+The admin-assisted commands (`install --member`, `invite`, `passwd`, `convert`,
+`members`) now take the admin password from, in order:
+
+1. `--admin-password-file <file>`, a file holding the password (one trailing newline is
+   dropped), or `--admin-password-file -` to read it from stdin;
+2. `--admin-password <value>` (still accepted, with a warning; see below);
+3. `MEMHOUSE_ADMIN_PASSWORD` in the environment, which is how `with-secret` lends a secret
+   to one command;
+4. a credential this install already keeps, but only for the same admin user;
+5. a prompt, when there is a terminal to prompt on.
+
+```bash
+with-secret MEMHOUSE_ADMIN_PASSWORD=keychain:pilot/house-admin -- \
+  memhouse invite alice --url https://house.example.com --admin-user default
+printf '%s' "$ADMIN_PASSWORD" | memhouse invite alice --url … --admin-user default --admin-password-file -
+```
+
+Before this release, `--admin-user` as a flag switched every other source off. The only
+scriptable admin path therefore put the password on argv, where `ps` shows it for as long
+as the command runs and shell history keeps it. Found by O's sandbox rehearsal (finding 6).
+With no source and no terminal, the command stops and prints the three ways above instead
+of hanging or guessing.
+
+### An admin install no longer saves the admin credential (#14)
+
+`install --admin-user …` builds the member and then ships as the member. It used to write
+the admin credential into `~/.memhouse/env` as well. The help said it was saved; every
+agent-facing text said it never was. Now it is saved only with `--keep-admin`, or when
+the env file already keeps that same admin. Credentials already saved keep working.
+
+### A daemon never carries the admin credential (#14)
+
+- Service units (systemd, launchd) drop `MEMHOUSE_ADMIN_*` before they inline the env.
+- The shipper and the dashboard are started without it, even when the shell exported it.
+- `deploy --local` passes the ClickHouse password to `docker run` through the environment,
+  no longer as `-e CLICKHOUSE_PASSWORD=<value>` on its argv.
+
+A unit test now fails on any spawn or exec in the shipped code that puts a password on
+argv.
+
+### No command prints a member password (G23)
+
+`install --admin-user` used to show the generated member password once, on the terminal.
+It was already written to the env file, so the terminal copy served no one. It landed in
+scrollback and, through `/mem:access` and `/mem:admin`, in an agent's transcript, which
+memhouse ships into the house, where the archive is insert-only. (#20)
+
+- **Install and invite never print a generated member password.** It goes to the env file
+  (install) or the invite file (invite), and nowhere else.
+- **A failed install cleans up after itself.** If the grant fails after the member was
+  created, the run drops that member, so no account is left with a password nobody holds.
+- **`install --print-sql` and `invite --print-sql` print a placeholder,
+  `IDENTIFIED BY <member-password>`.** As printed, that line does not parse. The
+  administrator puts a quoted password they generate in its place, and the same password
+  goes into the env-file lines the command prints for the member. From `invite`, those
+  lines carry `MEMHOUSE_INVITE=1`, so the member's `install --env` offers to rotate it.
+  A `--member-password` given with `--print-sql` is not echoed.
+- **Tests guard it.**
+  - A unit test fails on any print call that evaluates a password: as an argument,
+    concatenated, or interpolated.
+  - `misc/invite-matrix.sh` runs every install, invite and passwd path against a real
+    ClickHouse and checks each output against the real passwords.
+
+### A scoped share shares only what its scope filters (#13)
+
+`memhouse share <user> --only <scope>` granted `SELECT` on the member's whole pattern,
+`mem.<member>_*`, while its row policies covered only `sessions`, `messages` and
+`tool_calls`. A grantee scoped to one project could therefore read these in full:
+
+- `<member>_session_stats`: the opening prompt, folder, project and token totals of
+  every session in every project;
+- the model and tool stats;
+- `<member>_meta`, including the member's other `share:` records;
+- `<member>_events`;
+- any table the pattern matched later.
+
+Now:
+
+- **A scoped share is granted table by table,** on exactly the three filtered rooms.
+  Narrowing an existing full share to a scope takes the wildcard back first, so a failure
+  part-way leaves the grantee with less access, never more.
+- **`--revoke` withdraws the grants before it drops the row policies.** The old order
+  failed open: a `REVOKE` refused after the policies were gone left an unfiltered share.
+  A failed cleanup now keeps the policies unless every grant is confirmed withdrawn.
+- **`--only ""` and whitespace-only scopes are refused.** An unset `--only "$SCOPE"`
+  used to fall through to a full share.
+- **The permissive-server check before a scoped share runs.** Its probe table sat
+  outside the member's grant, so it was refused on every server and always reported
+  "could not verify".
+
+A full share (no `--only`) is unchanged: it reaches everything in `mem.<member>_*`, by
+design, and says so.
+
+**Action for existing scoped shares:** they keep their old wildcard until re-run. On the
+sharing member's machine, run `memhouse share <user> --only <scope>` again for each one;
+`memhouse share --list` shows them.
+
+## Deprecations
+
+| what | since | removed in | use instead |
+|---|---|---|---|
+| `--admin-password <value>` on the command line | 0.18.10 (2026-10-08) | **0.19.0** | `MEMHOUSE_ADMIN_PASSWORD` (via `with-secret`), `--admin-password-file <file>`, or `--admin-password-file -` |
+
+It still works in 0.18.x and prints one warning on stderr. Move scripts now.
+
+## Upgrading
+
+- **One machine:** `memhouse update`. The daemons restart on the new code.
+- **Upgraded by hand** (`npm install -g memhouse@latest`): run
+  `memhouse update --no-install` afterwards to restart the daemons.
+- **Several machines on one house:** no ordering is needed. This release changes no row
+  shape, no room and no shipper behaviour.
+- **Share owners:** re-run each scoped share once (above).
+- **Scripts and CI that pass `--admin-password`:** move to `MEMHOUSE_ADMIN_PASSWORD` or
+  `--admin-password-file` before 0.19.0.
+- **Scripts that read a member password from `install --admin-user` output:** read
+  `MEMHOUSE_PASSWORD` from the env file instead. The output no longer contains it.
+- **Scripts that run `--print-sql` output as is:** put a quoted password where
+  `<member-password>` stands. As printed, the line is refused by the server.
+- **If an admin credential is in `~/.memhouse/env`** and you did not mean to keep it,
+  remove the `MEMHOUSE_ADMIN_USER` / `MEMHOUSE_ADMIN_PASSWORD` lines. memhouse never
+  needs it to ship.
+
+## Also in this release
+
+- **The documentation standard** (#17). See [Documentation](#documentation) below. This
+  does change the package: it now also ships `docs/`, `examples/`, `AGENTS.md`,
+  `SECURITY.md` and `CHANGELOG.md`.
+
+These do not change the installed package:
+
+- **CI's tarball audit can fail now.** Its forbidden-file check was `! grep`, which
+  `set -e` never acts on, so it passed whatever the tarball held.
+- **gentar arena adoption** (#10). memhouse is now a gentar subject. Its suites are
+  `memhouse-house` and `memhouse-install`, kit v0.9.2, and they install from `npm pack`
+  exactly as a publish ships. The phase-1 check runs on GitHub-hosted runners on every
+  push and PR. Full arena runs need a self-hosted bench; the one used before the
+  repository went public was deregistered then.
+- **memhouse.io describes 0.18** (#12): one layout, five skills, the honest editor count
+  (16 adapters reading 18 apps).
+- `memhouse.io/.wrangler` (wrangler's local cache) is no longer tracked.
+- `misc/one-layout-matrix.sh` now asserts the scoped-share boundary, and
+  `misc/invite-matrix.sh` the admin-password sources: environment, stdin, `--keep-admin`,
+  and none. The file source is covered by unit tests. CI runs both matrices against
+  ClickHouse 25.11 and 26.7.
+
+## Not in this release
+
+**The gentar kit v0.9.3 bump (#18) also moves to 0.18.11.** It changes CI only.
+
+**The subagent re-ship fix moves to 0.18.11.** It is on branch `claude/subagent-stable-seq`
+and stops a Claude Code session with subagents from re-shipping whole on every pass, which
+is what grew one house to 16.2 M message rows for about 295 k real ones. It was reviewed
+before release by four models. Three said "ship with fixes"; the fourth said "do not ship",
+mostly for pre-existing issues. Its pre-tag fixes are not all done, and this release was
+not held for them.
+
+Status of the 0.18.10 pre-tag list (`review-0.18.10-consolidated`):
+
+| item | what | status |
+|---|---|---|
+| B1 | scoped share reads past its scope | **landed** (#13) |
+| G3 | share re-scope or revoke fails open | **landed** (#13) |
+| G24 | `--only ""` is a full share | **landed** (#13) |
+| B7 | permissive-server probe never runs | **landed** (#13) |
+| B5 (part) | admin password in argv, units and daemons | **landed** (#14); `0600` enforcement on existing env/unit files is still open |
+| A1 | version bump incl. `package-lock.json` | **landed** here |
+| G23 | admin install and `--print-sql` print the member password | **landed** (#20) |
+| A2 | `/mem:recall` "recent sessions" uses a column the table lacks | deferred to 0.18.11 |
+| A3 | plugin `HOUSE.md` subagent queries lack the epoch filter | deferred to 0.18.11 (with the RC, which makes it matter) |
+| A4–A7 | RC log text, `update --no-install` checks, RC changelog notes | deferred to 0.18.11 (they are the RC's own surface) |
+| A8 | stale prose (ts interpolation, shrink, host id) | deferred to 0.18.11 |
+| G4 | `invite --url` connects with the stored credential to the invitee-facing URL | deferred to 0.18.11 (security) |
+| G26 | skills point at `../reference/HOUSE.md`; the file is `../../reference/HOUSE.md` | deferred to 0.18.11 |
+| G11 | an idle house's dashboard goes empty after the stats TTL | deferred to 0.18.11 |
+| GLM-F1 | a subagent file read before its first line is written re-sorts its siblings | deferred to 0.18.11 (with the RC) |
+
+## Documentation
+
+This release meets the documentation standard (#17):
+
+- a short README: what memhouse is, why, and how to install it;
+- `docs/`, with three tutorials and twelve guides;
+- `examples/`, four runnable setups from one machine to a self-hosted team house, each
+  with its own README;
+- an install and deploy section for agents in `AGENTS.md`.
+
+The npm package now ships `docs/`, `examples/`, `AGENTS.md`, `SECURITY.md` and
+`CHANGELOG.md`, so an installed copy carries its own manual. `change.log` (#19) lists
+every tag and what it changed.
+
+## Verification
+
+- `npm test` passes.
+- CI is green on `main` at the release commit: the syntax gate, unit tests, the
+  one-layout and invite matrices, and a headless e2e on ClickHouse 25.11 and 26.7.
+- No live house was touched to prepare this release.
+- **No drill was run for this release; waived by the pilot (2026-10-08). The drill runs before 0.19.0.**
+  `AGENTS.md` asks for a drill before a release that changes a surface a person touches,
+  and this one changes install, invite and share. A drill was prepared on the testbed, but
+  its setup was refused by this session's permission layer, and the pilot chose to release
+  without it.