memhouse 0.4.4 → 0.7.0

package/{mem-house → memhouse}/per-member/schema-member.sql.tpl

@@ -1,4 +1,4 @@
--- mem — one member's rooms. Applied per member; {{MEMBER}} is the ClickHouse username.
+-- mem — one member's rooms. Applied per member — {{MEMBER}} is the ClickHouse username.
 --
 -- Room naming is TYPE-FIRST (sessions_<m>, not <m>_sessions) so the Merge rooms
 -- can anchor on a fixed room type and never match themselves.
@@ -7,7 +7,7 @@
 -- it keeps provenance across a share and keeps the Merge rooms meaningful. Writers must
 -- use async_insert=0 or the stamp does not happen.
 --
--- ClickHouse >= 26.2 natively; 25.11 works because the shipper passes
+-- ClickHouse >= 26.2 natively — 25.11 works because the shipper passes
 -- allow_experimental_full_text_index=1 per-query when applying this file.
 
 CREATE TABLE IF NOT EXISTS sessions_{{MEMBER}}
@@ -25,23 +25,27 @@ CREATE TABLE IF NOT EXISTS sessions_{{MEMBER}}
     message_count UInt32 DEFAULT 0,
     path String DEFAULT '',
     extra JSON,
-    -- Who put this row here. The shipper CLEARS a session before re-inserting it (a
-    -- shorter re-parse must not leave a stale seq tail), and that clear used to remove
-    -- every row for the session regardless of origin -- destroying imported history the
-    -- adapters cannot reproduce. The clear now binds origin='ship', so anything imported
-    -- survives a re-ship of the same session.
-    -- IN THE SORTING KEY, and that is the load-bearing half. Guarding the DELETE alone
-    -- is not enough: ReplacingMergeTree collapses on the sorting key, so an imported row
-    -- and a shipped row sharing (session_id, user_id, seq) are the SAME row and the newer
-    -- ingested_at wins. Measured: 3 imported + 2 shipped rows became 3, and the two
-    -- imported ones the shipper happened to overlap were gone. Same loss as the
-    -- unguarded delete, reached through the merge instead.
+    -- Who put this row here. Carried on every room so a reader can tell shipped rows
+    -- from imported ones, and so the shipper's clear can bind origin='ship'.
+    --
+    -- NOTE the sorting key below does NOT include origin, and sessions is the one room
+    -- where that is correct. A session has exactly ONE metadata row: title, counts,
+    -- bounds. If origin were in the key, an imported session and its shipped twin would
+    -- be two rows, and everything that reads sessions as one-row-per-session breaks --
+    -- sessions_v joins messages twice and over-reports (measured on a real house: one
+    -- duplicate row inflated the totals by 1,764 messages and 655M tokens), and the
+    -- incremental skip cannot decide which row is current. Collapsing them is what we
+    -- want: the newer ingested_at wins, which is the shipper's row for any session that
+    -- still exists on disk. Nothing is lost -- a session the adapters no longer see is
+    -- never cleared and never re-inserted, so its imported row stands untouched.
+    --
+    -- messages and tool_calls are the opposite case and DO key on origin -- see there.
     origin LowCardinality(String) DEFAULT 'ship',
     user_id String MATERIALIZED currentUser(),
     ingested_at DateTime64(3, 'UTC') DEFAULT now64(3)
 )
 ENGINE = ReplacingMergeTree(ingested_at)
-ORDER BY (session_id, user_id, origin);
+ORDER BY (session_id, user_id);
 
 CREATE TABLE IF NOT EXISTS messages_{{MEMBER}}
 (

package/{mem-house → memhouse}/per-member/schema-merge.sql.tpl

@@ -6,13 +6,13 @@
 --
 -- Three measured properties this relies on (ClickHouse 26.7.1):
 --   * fails closed on permissions — a caller sees only the underlying rooms they hold
---     grants for, with no leak and no error, so these can be granted broadly;
---   * auto-discovers rooms created after them, so member onboarding needs no DDL here;
+--     grants for, with no leak and no error, so these can be granted broadly —
+--   * auto-discovers rooms created after them, so member onboarding needs no DDL here —
 --   * tolerates schema drift, returning a column's default for rooms lacking it — which
 --     is what makes schema rollout progressive. Merge REJECTS mutations, so a new column
 --     is added with ADD COLUMN, on the Merge room FIRST.
 --
--- {{TEMPLATE_MEMBER}} is any existing member; the Merge room borrows its column list.
+-- {{TEMPLATE_MEMBER}} is any existing member — the Merge room borrows its column list.
 
 CREATE TABLE IF NOT EXISTS all_sessions AS sessions_{{TEMPLATE_MEMBER}}
 ENGINE = Merge(currentDatabase(), '^sessions_');

package/memhouse/resume.js

@@ -0,0 +1,150 @@
+// Resume: hand the pilot back into a session memhouse only ever read.
+//
+// Nothing here needs a schema change. A stored session already carries everything a
+// resume needs: `session_id` is canonical `<source>:<native-id>` (ship.js:575) and
+// `folder` is the directory the session ran in. Resume is a read-time computation over
+// two columns.
+//
+// Two rules, both learned the hard way in this repo:
+//
+//   1. PRINT the command, never run it. A wrong cwd or a stale id does not fail — it
+//      starts a NEW session, and the transcript the pilot wanted is still lost while the
+//      tool reports success. The pilot pastes it, sees what it does, and owns the result.
+//
+//   2. Never write a flag from memory. Round 10 exists because a field name was asserted
+//      from a failed search rather than read from the source. Every entry below was read
+//      out of that CLI's own `--help` on a machine where it is installed, and the date and
+//      version are recorded with it. An editor whose flag has not been read that way is
+//      ABSENT from this table — an absent entry prints an honest refusal, a guessed entry
+//      prints a command that silently does the wrong thing.
+//
+// To add one: install the CLI, run `<cli> --help` (and `<cli> resume --help` if it is a
+// subcommand), copy the exact syntax, and record what you read it from.
+
+// Keyed by the string that is actually STORED in the `source` column, which is NOT the
+// adapter's module `name`: editors/claude.js is `const name = 'claude'` and emits
+// `source: 'claude-code'` on every chat it returns. This table was written against the
+// module names first and would have refused to resume a single Claude Code session — 508 of
+// them on the machine it was tested on. Read the values out of a real house
+// (`SELECT DISTINCT source FROM sessions_<you>`), never off the adapter's name.
+const RESUMERS = {
+  // claude --help, 2026-08-12: "-r, --resume [value]  Resume a conversation by session ID"
+  'claude-code': {
+    cli: 'claude',
+    argv: (id) => ['--resume', id],
+    verified: '2026-08-12',
+  },
+  // codex resume --help, 2026-08-12: "Usage: codex resume [OPTIONS] [SESSION_ID] [PROMPT]"
+  // — positional, and "UUIDs take precedence if it parses".
+  codex: {
+    cli: 'codex',
+    argv: (id) => ['resume', id],
+    verified: '2026-08-12',
+  },
+  // opencode --help, 2026-08-12: "-s, --session  session id to continue  [string]"
+  opencode: {
+    cli: 'opencode',
+    argv: (id) => ['--session', id],
+    verified: '2026-08-12',
+  },
+  // NOT here, deliberately, and each for a different reason:
+  //
+  //   goose, gemini-cli, cursor-agent — plausibly resumable, but not installed on the
+  //   machine this table was written on, so the flag could only have been guessed. Install
+  //   one, read its --help, add it.
+  //
+  //   everything in GUI_ONLY — no CLI entry point takes a session id there. Opening the
+  //   folder is not resuming the session and must not be dressed up as it.
+};
+
+// Surfaces with no CLI to resume into AT ALL, separated from "the flag has not been read
+// yet" so the refusal can say which of the two it is — the same reason `discover` separates
+// a skipped adapter from an editor you do not have.
+//
+// Stored `source` values again, and two corrections already: `copilot.js` emits
+// `copilot-cli` and IS a command line, so it does not belong here; and windsurf never emits
+// 'windsurf' at all — it emits its VARIANTS id, `devin` or `devin-next` — so the name this
+// list first carried matched nothing and every Devin session fell through to the wrong
+// refusal.
+//
+// Membership means: no command line takes a session id here, so no amount of checking will
+// produce one. Anything merely UNCHECKED belongs in UNVERIFIED — asserting "there is
+// nothing to resume into" about a tool nobody has looked at is the same invented fact as
+// guessing a flag.
+const GUI_ONLY = new Set([
+  'cursor', 'vscode', 'zed', 'kiro', 'copilot-jetbrains', 'antigravity',
+  'devin', 'devin-next',
+]);
+
+// A plausible CLI that nobody has verified. Listed explicitly instead of left to fall
+// through a default, so the completeness test can prove every source the adapters can emit
+// lands in exactly one bucket — which is what would have caught both corrections above
+// before they shipped.
+const UNVERIFIED = new Set([
+  'goose', 'gemini-cli', 'cursor-agent', 'copilot-cli', 'codebuff', 'commandcode', 'gsd',
+]);
+
+// A session_id is `<source>:<native-id>`. Split on the FIRST colon only: several editors
+// use colons inside their own ids, and slicing on the last one hands the CLI a truncated id
+// that resolves to nothing.
+function splitSessionId(sessionId) {
+  const i = String(sessionId).indexOf(':');
+  if (i <= 0) return null;
+  return { source: sessionId.slice(0, i), nativeId: sessionId.slice(i + 1) };
+}
+
+// Shell-quote for the line we PRINT. This never feeds an exec — it is text a human pastes
+// — but a session folder with a space in it must still paste correctly, and an id is
+// server-supplied data that has no business being read as shell syntax.
+function shq(s) {
+  return /^[A-Za-z0-9_@%+=:,./-]+$/.test(s) ? s : `'${String(s).replace(/'/g, `'\\''`)}'`;
+}
+
+/**
+ * Resolve a stored session row into something the pilot can paste.
+ *
+ * @param {{session_id: string, source?: string, folder?: string, origin?: string}} row
+ * @returns {{ok: boolean, source: string, nativeId: string|null, folder: string,
+ *            command: string|null, reason: string|null}}
+ */
+function resumeFor(row) {
+  const parts = splitSessionId(row.session_id);
+  // `source` is its own column, but the id prefix is what the CLI half of the pair is keyed
+  // on; prefer the column and fall back to the prefix so a row from an older house still
+  // resolves.
+  const source = row.source || (parts && parts.source) || '';
+  const nativeId = parts ? parts.nativeId : null;
+  const folder = row.folder || '';
+  const base = { source, nativeId, folder, command: null, ok: false, reason: null };
+
+  if (!nativeId) {
+    return { ...base, reason: `'${row.session_id}' is not a canonical <source>:<id> session id` };
+  }
+  // Imported rows come from an older house, another product, or a machine that no longer
+  // exists — the whole point of the `origin` guard the shipper carries. There is no local
+  // session store behind them, so no resume command can be right, and this is checked
+  // BEFORE the source table: 502 of the 1,304 sessions on the machine this was built on are
+  // imported `claude-ai` rows, and a source-only check would have offered to resume them.
+  if (row.origin && row.origin !== 'ship') {
+    return {
+      ...base,
+      reason: `this session was imported (origin='${row.origin}'), not read from a local editor — there is nothing on this machine to resume into`,
+    };
+  }
+  const r = RESUMERS[source];
+  if (!r) {
+    return {
+      ...base,
+      reason: GUI_ONLY.has(source)
+        ? `${source} is a GUI editor — it has no CLI that takes a session id, so there is nothing to resume into`
+        : `no verified resume command for ${source} — see memhouse/resume.js for how to add one`,
+    };
+  }
+  const cmd = [r.cli, ...r.argv(nativeId)].map(shq).join(' ');
+  // The cd is half the command. Claude Code and Codex both scope their session lists by
+  // working directory, so the same id run from the wrong folder opens the picker or a new
+  // session instead of the transcript that was asked for.
+  return { ...base, ok: true, command: folder ? `cd ${shq(folder)} && ${cmd}` : cmd };
+}
+
+module.exports = { RESUMERS, GUI_ONLY, UNVERIFIED, resumeFor, splitSessionId };

package/memhouse/self-update.js

@@ -0,0 +1,150 @@
+// A daemon that keeps executing the code it booted with.
+//
+// `npm i -g memhouse@latest` replaces the files under the global prefix and does not touch
+// the running processes, so the shipper keeps parsing with the old adapters and the
+// dashboard keeps serving the old bundle. Nothing reports it: `status` prints the version
+// of the CLI you just typed, not the version the daemon is running. On macminim a shipper
+// ran 1d16h out of a directory that had been MOVED — the fix was live, the machine was not.
+//
+// npm's own `postinstall` is the obvious hook and the wrong one. Install scripts are
+// blocked by default (`--allow-scripts`), which is the very condition this product already
+// has to work around, and a package install that restarts a user's daemons is a surprise
+// even when it works.
+//
+// So the daemon notices for itself. Once per loop pass it compares what is on disk against
+// what it booted with, and when they differ it hands over:
+//
+//   supervised (systemd/launchd set MEMHOUSE_SUPERVISED=1) — exit 0 and let the supervisor
+//     start a fresh process. Re-execing under a supervisor fights it: the unit's own
+//     restart would then race the child we spawned.
+//
+//   unsupervised (`memhouse start` pidfiles) — re-exec ourselves detached, rewrite the
+//     pidfile, exit. Nothing else would ever restart it, and exiting silently would stop
+//     collecting memory, which is worse than running one pass of stale code.
+//
+// Guards, because a daemon that restarts itself wrongly is worse than one that is stale:
+// a re-exec chain is counted in the environment and capped, and there is a floor on how
+// often a restart may happen at all.
+
+const fs = require('fs');
+const path = require('path');
+const { spawn } = require('child_process');
+
+const CHAIN_VAR = 'MEMHOUSE_REEXEC_CHAIN';
+const MAX_CHAIN = 3;
+const MIN_INTERVAL_MS = 60_000;
+
+function runDir() {
+  const home = process.env.MEMHOUSE_HOME || path.join(require('os').homedir(), '.memhouse');
+  return path.join(home, 'run');
+}
+
+// Read the version off DISK, never `require()`. require caches the first read for the
+// lifetime of the process, so a required package.json reports the version this daemon
+// booted with no matter how many times it is re-read — which is exactly the value we are
+// trying to detect a change in.
+function diskVersion(repoRoot) {
+  try { return JSON.parse(fs.readFileSync(path.join(repoRoot, 'package.json'), 'utf-8')).version || null; }
+  catch { return null; }
+}
+
+/**
+ * What this process is running, captured at boot.
+ * @param {string} entry absolute path of the daemon's own entry script
+ * @param {string} [repoRoot] where package.json lives; defaults two levels up from the
+ *   entry's directory, which is where both daemons sit (memhouse/<part>/<entry>.js).
+ *   Pass it explicitly rather than relying on that depth if you move an entry.
+ */
+function snapshot(entry, repoRoot = path.join(path.dirname(entry), '..', '..')) {
+  let real = null, mtimeMs = null;
+  try { real = fs.realpathSync(entry); mtimeMs = fs.statSync(real).mtimeMs; } catch { /* reported as drift */ }
+  return { entry, repoRoot, version: diskVersion(repoRoot), real, mtimeMs, at: Date.now() };
+}
+
+/**
+ * Has the installation underneath us changed?
+ * @returns {string|null} a human-readable reason, or null when nothing moved
+ */
+function driftReason(snap) {
+  const now = diskVersion(snap.repoRoot);
+  if (snap.version && now && now !== snap.version) return `version changed ${snap.version} → ${now}`;
+  let real = null, mtimeMs = null;
+  try { real = fs.realpathSync(snap.entry); mtimeMs = fs.statSync(real).mtimeMs; } catch { real = null; }
+  // The entry is gone: the directory this daemon runs out of was deleted, moved, or
+  // replaced. Reported, but NOT restartable — see maybeRestart, which refuses to re-exec a
+  // path that no longer resolves.
+  if (!real) return 'the directory this daemon runs from no longer exists';
+  if (snap.real && real !== snap.real) return `entry moved ${snap.real} → ${real}`;
+  // mtime alone, with the version unchanged, is a checkout being rebuilt or edited in
+  // place. Worth acting on for the same reason the version is: the running process is not
+  // the code on disk.
+  if (snap.mtimeMs && mtimeMs && mtimeMs !== snap.mtimeMs) return 'the entry script changed on disk';
+  return null;
+}
+
+function chainCount() {
+  const n = Number(process.env[CHAIN_VAR]);
+  return Number.isFinite(n) && n > 0 ? n : 0;
+}
+
+// Only ever rewrite a pidfile that names US. A daemon started by hand has no pidfile, and a
+// pidfile naming some other process belongs to that process — overwriting it would point
+// `memhouse stop` at ours and leave theirs running forever.
+function adoptPidfile(name, newPid, log) {
+  const file = path.join(runDir(), name + '.pid');
+  try {
+    if (Number(fs.readFileSync(file, 'utf-8').trim()) !== process.pid) return;
+    fs.writeFileSync(file, String(newPid));
+  } catch { log(`[memhouse] could not update ${file} — 'memhouse stop' may not find the new process`); }
+}
+
+/**
+ * Act on drift. Returns false when nothing was done, and does not return at all when it
+ * hands over (the process exits).
+ *
+ * @param {object} o
+ * @param {ReturnType<snapshot>} o.snap  what we booted with
+ * @param {string} o.name                daemon name, matching its pidfile ('shipper' | 'dashboard')
+ * @param {(s: string) => void} [o.log]
+ */
+function maybeRestart({ snap, name, log = console.error }) {
+  const reason = driftReason(snap);
+  if (!reason) return false;
+  if (Date.now() - snap.at < MIN_INTERVAL_MS) return false;
+
+  const supervised = process.env.MEMHOUSE_SUPERVISED === '1';
+  log(`[memhouse] ${reason} — this ${name} is running code that is no longer installed`);
+
+  if (supervised) {
+    log('[memhouse] exiting so the service manager starts the new version');
+    process.exit(0);
+  }
+  // An entry that does not resolve cannot be re-executed, and there is no supervisor to
+  // resolve a fresh one. Keep shipping with what is loaded and say so every pass: a stale
+  // daemon still collects sessions, a dead one collects nothing.
+  let real = null;
+  try { real = fs.realpathSync(snap.entry); } catch { /* handled next */ }
+  if (!real) {
+    log(`[memhouse] cannot restart — nothing to exec. Fix it with: memhouse stop && memhouse start`);
+    return false;
+  }
+  if (chainCount() >= MAX_CHAIN) {
+    log(`[memhouse] already restarted ${MAX_CHAIN} times in this chain — not restarting again. Fix it with: memhouse stop && memhouse start`);
+    return false;
+  }
+
+  const child = spawn(process.execPath, [real, ...process.argv.slice(2)], {
+    env: { ...process.env, [CHAIN_VAR]: String(chainCount() + 1) },
+    detached: true,
+    // The daemon's stdout/stderr are already the log file `memhouse start` opened, and a
+    // detached child inherits those descriptors — so the new process keeps writing to the
+    // same log with no second file to find.
+    stdio: 'inherit',
+  });
+  child.unref();
+  adoptPidfile(name, child.pid, log);
+  log(`[memhouse] restarted as pid ${child.pid}`);
+  process.exit(0);
+}
+
+module.exports = { snapshot, driftReason, maybeRestart, CHAIN_VAR, MAX_CHAIN, MIN_INTERVAL_MS };

package/{mem-house → memhouse}/server/queries.js

@@ -1,12 +1,12 @@
-// queries.js — mem-house read/query layer.
+// queries.js — memhouse read/query layer.
 //
 // Serves the SAME response shapes as the root cache.js (the agentlytics API
-// contract) but computed over the mem-house typed schema — one set of rooms per member,
+// contract) but computed over the memhouse typed schema — one set of rooms per member,
 // `sessions_<m>` / `messages_<m>` / `tool_calls_<m>` (../per-member/schema-member.sql.tpl),
 // plus the session rollup, which is a SAVED QUERY and not an object
 // (../per-member/rooms.js). The dashboard SPA consumes these shapes unchanged.
 //
-// Schema mapping notes (root cache schema → mem-house):
+// Schema mapping notes (root cache schema → memhouse):
 //   chats            → sessions_<m> / the rollup  (id → session_id, bubble_count → total_msgs)
 //   chat_stats       → rollup aggregates          (token/char sums, models array)
 //   messages.content → messages_<m>.text          (cache_read → cache_read_tokens, …)
@@ -16,7 +16,7 @@
 // All reads run with the `final: 1` setting so ReplacingMergeTree collapses
 // duplicate versions at read time (see DESIGN.md data-plane rules).
 
-const { createClient } = require('@clickhouse/client');
+const { createClient, ClickHouseLogLevel } = require('@clickhouse/client');
 const { calculateCost, normalizeModelName } = require('../../pricing');
 const { resolveRooms, READ_SETTINGS } = require('../per-member/rooms');
 
@@ -31,6 +31,9 @@ let _client = null;
 function getClient() {
   if (_client) return _client;
   _client = createClient({
+    // See the note in shipper/ship.js: the driver's ERROR-level dump lands ahead of every
+    // message we print, so a handled refusal reads like a crash. MEMHOUSE_DEBUG=1 restores it.
+    log: { level: process.env.MEMHOUSE_DEBUG ? ClickHouseLogLevel.DEBUG : ClickHouseLogLevel.OFF },
     url: config.url,
     username: config.username,
     password: config.password,
@@ -74,9 +77,10 @@ function applyRooms(sql, r) {
   });
 }
 
-async function q(query, params = {}) {
+async function q(query, params = {}, settings = undefined) {
   const rs = await getClient().query({
     query: applyRooms(query, await rooms()), query_params: params, format: 'JSONEachRow',
+    ...(settings ? { clickhouse_settings: settings } : {}),
   });
   return rs.json();
 }
@@ -145,18 +149,30 @@ function normalizedModelFreq(rows) {
   }
   return freq;
 }
+// The same exclusions as EXCLUDED_MODELS, usable in JS.
+const EXCLUDED_MODEL_SET = new Set(['', '<synthetic>']);
 const topN = (freq, n) => Object.entries(freq).sort((a, b) => b[1] - a[1]).slice(0, n)
   .map(([name, count]) => ({ name, count }));
 
 // ── overview ────────────────────────────────────────────────────────────────────
 async function getOverview(opts = {}) {
   const f = filters(opts);
-  const totalChats = Number((await q1(`SELECT count() AS cnt FROM {{sessions_v}} AS c WHERE 1=1${f.and}`, f.params)).cnt);
-
-  // Root parity: without a folder filter the editor breakdown is global.
-  const editors = opts.folder
-    ? await q(`SELECT source, count() AS count FROM {{sessions_v}} AS c WHERE 1=1${f.and} GROUP BY source ORDER BY count DESC`, f.params)
-    : await q('SELECT source, count() AS count FROM {{sessions_v}} GROUP BY source ORDER BY count DESC');
+  // Same definition as getChats(). The nav bar read this and the Sessions page read
+  // getChats, so a house with one placeholder session showed "9 sessions" beside
+  // "8 sessions" in the same header, and the depth histogram summed to 7. A session row
+  // with no name and no messages is a placeholder the shipper keeps to absorb the
+  // incremental skip; it is not a conversation, and only one of the two counters knew.
+  const totalChats = Number((await q1(
+    `SELECT count() AS cnt FROM {{sessions_v}} AS c WHERE 1=1${f.and} AND (c.name != '' OR c.total_msgs > 0)`,
+    f.params)).cnt);
+
+  // Root parity WAS: without a folder filter the editor breakdown is global — which put
+  // "34 + 3" chips under a header reading "3 sessions" when an editor filter was applied,
+  // and 12 under a header of 11 with no filter at all. Parity with a wrong number is not a
+  // feature.
+  const editors = await q(
+    `SELECT source, count() AS count FROM {{sessions_v}} AS c
+     WHERE (c.name != '' OR c.total_msgs > 0)${f.and} GROUP BY source ORDER BY count DESC`, f.params);
 
   const modes = await q(`SELECT mode, count() AS count FROM {{sessions_v}} AS c WHERE mode != ''${f.and} GROUP BY mode`, f.params);
   const byMode = {};
@@ -253,7 +269,11 @@ async function getDashboardStats(opts = {}) {
     SELECT COALESCE(sum(input_tokens), 0) AS input, COALESCE(sum(output_tokens), 0) AS output,
            COALESCE(sum(cache_read_tokens), 0) AS cacheRead, COALESCE(sum(cache_write_tokens), 0) AS cacheWrite,
            COALESCE(sum(user_chars), 0) AS userChars, COALESCE(sum(assistant_chars), 0) AS assistantChars,
-           count() AS sessions
+           COALESCE(sum(total_msgs), 0) AS messages,
+           -- The SAME definition the KPI beside it uses. A plain count() here put a
+           -- fourth session number on a screen that already had three: nav 11, chips 12,
+           -- avg depth 40/12, histogram 10.
+           countIf(c.name != '' OR c.total_msgs > 0) AS sessions
     FROM {{sessions_v}} AS c WHERE 1=1${f.and}`, f.params);
 
   const streakRows = await q(`
@@ -323,7 +343,7 @@ async function getDashboardStats(opts = {}) {
     tokens: {
       input: inputTokens, output: outputTokens, cacheRead: Number(tokenRow.cacheRead), cacheWrite: Number(tokenRow.cacheWrite),
       userChars: Number(tokenRow.userChars), assistantChars: Number(tokenRow.assistantChars),
-      sessions: Number(tokenRow.sessions), estimated: tokensEstimated,
+      sessions: Number(tokenRow.sessions), messages: Number(tokenRow.messages), estimated: tokensEstimated,
     },
     streaks: { current: currentStreak, longest: longestStreak, totalDays: streakRows.length },
     monthlyTrend: { months: Object.keys(monthEditors).sort(), sources: [...allSources], data: monthEditors },
@@ -359,26 +379,30 @@ async function getChats(opts = {}) {
   const rows = await q(sql, params);
   if (rows.length === 0) return [];
 
-  // Top model per rollup = most frequent model across THAT WRITER's messages
-  // (session_id alone would blend colliding sessions across members).
-  const ids = rows.map(r => r.id);
-  const tmRows = await q(`
-    SELECT session_id, user_id, argMax(model, cnt) AS top_model
-    FROM (SELECT session_id, user_id, model, count() AS cnt FROM {{messages}}
-          WHERE session_id IN {ids:Array(String)} AND model NOT IN ${EXCLUDED_MODELS}
-          GROUP BY session_id, user_id, model)
-    GROUP BY session_id, user_id`, { ids });
+  // ONE cost implementation, shared with the Costs page.
+  //
+  // getChats used to compute its own, and the two disagreed three times running: first the
+  // whole session priced at its dominant model ($10.02 against $150), then sessions whose
+  // rows carry no model at all ($0 against $10.50), then sessions with zero tokens but
+  // non-zero chars ($0 against $0.033). Each round fixed the case that had been measured
+  // and left the next one. computePerChatCosts already handles all of them — the orphan
+  // bucket, the source-dominant and global-dominant fallbacks, the char estimate — so call
+  // it instead of growing a second copy of the same logic.
+  const perChat = await computePerChatCosts(f);
+  const costBySession = {};
   const topModelBySession = {};
-  for (const r of tmRows) topModelBySession[`${r.session_id}::${r.user_id}`] = r.top_model;
+  for (const r of perChat) {
+    // computePerChatCosts already emits the composite key as `id`.
+    const k = r.id;
+    costBySession[k] = { total: r.totalCost, unpriced: !!r.hasUnpriced };
+    if (r.byModel[0]) topModelBySession[k] = r.byModel[0].model;
+  }
 
   return rows.map(r => {
-    const topModel = topModelBySession[`${r.id}::${r.user_id}`] || null;
-    let inTok = Number(r._inTok) || 0, outTok = Number(r._outTok) || 0;
-    if (inTok === 0 && outTok === 0 && ((r._uChars || 0) > 0 || (r._aChars || 0) > 0)) {
-      inTok = Math.round((r._uChars || 0) / 4);
-      outTok = Math.round((r._aChars || 0) / 4);
-    }
-    const cost = topModel ? (calculateCost(topModel, inTok, outTok, Number(r._cacheR) || 0, Number(r._cacheW) || 0) || 0) : 0;
+    const k = `${r.id}::${r.user_id}`;
+    const topModel = topModelBySession[k] || null;
+    const summed = costBySession[k];
+    const cost = summed ? summed.total : 0;
     return {
       // Composite API id: rollups are keyed (session_id, user_id), so the id a
       // client clicks must pin BOTH — otherwise opening one of two colliding
@@ -388,6 +412,9 @@ async function getChats(opts = {}) {
       source: r.source, name: r.name, mode: r.mode, folder: r.folder,
       createdAt: r.created_at, lastUpdatedAt: r.last_updated_at,
       encrypted: false, bubbleCount: Number(r.bubble_count), topModel, cost,
+      // Surfaced, not just computed. A session containing an unpriced model reports a cost
+      // that silently omits part of itself; the caller can now say so.
+      costPartial: !!(summed && summed.unpriced),
     };
   });
 }
@@ -643,7 +670,7 @@ async function getToolCalls(toolName, opts = {}) {
 // ── cost estimation ─────────────────────────────────────────────────────────────
 // Messages with model '' or '<synthetic>' are "orphans": their tokens are
 // attributed to the session's dominant model (root cache.js treats model IS NULL
-// the same way; '' is the mem-house null and synthetic models have no pricing).
+// the same way; '' is the memhouse null and synthetic models have no pricing).
 const ORPHAN_TOKENS = '(m.input_tokens > 0 OR m.output_tokens > 0 OR m.cache_read_tokens > 0 OR m.cache_write_tokens > 0)';
 
 // session_id → dominant model (most frequent across the session's messages).
@@ -821,15 +848,19 @@ async function computePerChatCosts(f) {
       if (srcDom) add(srcDom, c.ti, c.to_, c.cr, c.cw);
     }
     let totalCost = 0; const byModel = [];
+    // A model with no price contributes nothing to totalCost, so the number a session
+    // reports silently omits part of itself. Carry the fact alongside the number.
+    let hasUnpriced = false;
     for (const [model, tok] of Object.entries(tokenMap)) {
       const cost = calculateCost(model, tok.input, tok.output, tok.cacheRead, tok.cacheWrite);
       if (cost !== null) { totalCost += cost; byModel.push({ model, cost }); }
+      else hasUnpriced = true;
     }
     byModel.sort((a, b) => b.cost - a.cost);
     out.push({
       id: key, user: c.user_id, source: c.source, name: c.name, folder: c.folder,
       last_updated_at: c.last_updated_at, created_at: c.created_at,
-      msgs: Number(c.msgs), month: c.month, totalCost, byModel,
+      msgs: Number(c.msgs), month: c.month, totalCost, byModel, hasUnpriced,
     });
   }
   return out;
@@ -881,10 +912,22 @@ async function getCostAnalytics(opts = {}) {
 }
 
 // ── raw SQL / schema (SqlViewer) ────────────────────────────────────────────────
+// Bounded at the SERVER, not in JS. `q()` buffers every row into memory, so
+// `SELECT number FROM numbers(2000000000)` killed the whole dashboard process —
+// "FATAL ERROR: Ineffective mark-compacts near heap limit", unauthenticated, on the bound
+// port. Capping after the rows arrive is too late; ClickHouse has to stop sending.
+const RAW_MAX_ROWS = 10000;
+const RAW_MAX_BYTES = 64 * 1024 * 1024;
 async function rawQuery(sql) {
-  const rows = await q(sql);
+  const rows = await q(sql, {}, {
+    max_result_rows: RAW_MAX_ROWS,
+    max_result_bytes: RAW_MAX_BYTES,
+    // Cut the result off rather than failing a query that was legitimately large.
+    result_overflow_mode: 'break',
+    max_execution_time: 30,
+  });
   const columns = rows.length > 0 ? Object.keys(rows[0]) : [];
-  return { columns, rows, count: rows.length };
+  return { columns, rows, count: rows.length, truncated: rows.length >= RAW_MAX_ROWS };
 }
 
 async function schema() {
@@ -925,4 +968,7 @@ module.exports = {
   getProjects, getDeepAnalytics, getToolCalls,
   estimateCosts, getCostAnalytics,
   rawQuery, schema,
+  // Used only by the server's own guard to learn which database names are real. Not
+  // reachable from any route.
+  rawQueryUnguarded: (sql) => q(sql),
 };