memhouse 0.4.4 → 0.7.1

package/bin/memhouse.js

@@ -1,9 +1,9 @@
 #!/usr/bin/env node
-// memhouse — the mem-house CLI. One command to install, ship, serve, and query
-// agent conversation memory (see mem-house/DESIGN.md).
+// memhouse — the memhouse CLI. One command to install, ship, serve, and query
+// agent conversation memory (see memhouse/DESIGN.md).
 //
 // Thin orchestrator: heavy operations run the existing entrypoints
-// (mem-house/shipper/ship.js, mem-house/server/server.js) as children with the
+// (memhouse/shipper/ship.js, memhouse/server/server.js) as children with the
 // resolved MEMHOUSE_* env, so there is a single source of truth for shipping and
 // serving. The CLI owns: config (~/.memhouse/env), daemons (pidfiles), probes,
 // and the small read-only queries (status/search) done over ClickHouse HTTP.
@@ -19,12 +19,12 @@ const path = require('path');
 const { spawn, spawnSync } = require('child_process');
 
 const REPO_ROOT = path.join(__dirname, '..');
-const SHIP_JS = path.join(REPO_ROOT, 'mem-house', 'shipper', 'ship.js');
-const SERVER_JS = path.join(REPO_ROOT, 'mem-house', 'server', 'server.js');
-const DELIVERY = path.join(REPO_ROOT, 'mem-house', 'delivery');
+const SHIP_JS = path.join(REPO_ROOT, 'memhouse', 'shipper', 'ship.js');
+const SERVER_JS = path.join(REPO_ROOT, 'memhouse', 'server', 'server.js');
+const DELIVERY = path.join(REPO_ROOT, 'memhouse', 'delivery');
 const PKG = require(path.join(REPO_ROOT, 'package.json'));
-const { roomNames, ROOM_TYPES, mergeRooms } = require(path.join(REPO_ROOT, 'mem-house', 'per-member', 'rooms'));
-const envfile = require(path.join(REPO_ROOT, 'mem-house', 'envfile'));
+const { roomNames, ROOM_TYPES, mergeRooms, MEMBER_PRIVS, MEMBER_PROFILE, MEMBER_PROFILE_SETTINGS, installCommand } = require(path.join(REPO_ROOT, 'memhouse', 'per-member', 'rooms'));
+const envfile = require(path.join(REPO_ROOT, 'memhouse', 'envfile'));
 
 const HOME_DIR = process.env.MEMHOUSE_HOME || path.join(os.homedir(), '.memhouse');
 const ENV_FILE = path.join(HOME_DIR, 'env');
@@ -48,47 +48,7 @@ for (let i = 0; i < rest.length; i++) {
 }
 const JSON_OUT = flags.json === true;
 
-// A config written by the solo tier points at a shim this build cannot start. Left
-// alone it reads as an ordinary external house that happens to be down, so `start`
-// launches a shipper and dashboard against a dead endpoint and `doctor` reports a
-// generic connection failure. Refuse, and say the two things that actually work.
-//
-// Commands that are the way OUT stay allowed — including, emphatically, the ones the
-// refusal message itself recommends. A guard that blocks its own advice leaves the user
-// editing the env file by hand.
-//
-//   deploy   — `--local` rewrites the config, which is what ENDS this state; `--down`
-//              only removes a container.
-//   service  — `status` is how the stale-unit warning is seen and `uninstall` is how it
-//              is removed; only `service install` is blocked, since installing a unit
-//              pointed at the dead shim is the one thing here that makes it worse.
-const LEGACY_SOLO_OK = new Set([
-  'setup', 'uninstall', 'discover', 'plugins', 'prompt', 'stop', 'deploy', 'help', 'version', null,
-]);
-
-function legacySoloGuard() {
-  let file = {};
-  try { file = envfile.parse(fs.readFileSync(ENV_FILE, 'utf-8')); } catch { return false; }
-  if (file.MEMHOUSE_SOLO !== '1') return false;
-  if (LEGACY_SOLO_OK.has(cmd)) return false;
-  if (cmd === 'service' && positional[0] !== 'install') return false;
-  console.log(bad(`${ENV_FILE.replace(os.homedir(), '~')} was written by the solo tier, which this version removed.`));
-  console.log(`  It points at ${file.MEMHOUSE_URL || 'an embedded shim'}, and nothing here can start that.`);
-  console.log('');
-  console.log('  Your transcripts are not lost — memhouse ships FROM your local session stores,');
-  console.log('  so a new house rebuilds them. Point at one and re-ship:');
-  console.log('     memhouse deploy --local          (a ClickHouse in docker or podman)');
-  console.log('     memhouse setup --url … --user … --password …   (one you already run)');
-  console.log('     memhouse ship --full');
-  console.log('');
-  console.log('  The old embedded data is chdb-format and only readable by chdb; keep');
-  console.log(`  ${path.join(HOME_DIR, 'solo-data').replace(os.homedir(), '~')} if you want it, or delete it.`);
-  console.log('  Then, for anything the old version left behind:');
-  console.log('     memhouse stop              (reaps a shim still running)');
-  console.log('     memhouse service status    (shows a stale unit, if there is one)');
-  console.log('     memhouse service uninstall (removes it)');
-  return true;
-}
+let ONBOARDING = false;
 
 // ── config ──────────────────────────────────────────────────────────────────────
 function readEnvFile() {
@@ -99,18 +59,56 @@ function resolveConfig() {
   const file = readEnvFile();
   const pick = (flag, env, dflt) => flags[flag] !== undefined && flags[flag] !== true
     ? flags[flag] : (process.env[env] ?? file[env] ?? dflt);
+  const stated = (flag, env) => (flags[flag] !== undefined && flags[flag] !== true)
+    || process.env[env] !== undefined || file[env] !== undefined;
   return {
     url: pick('url', 'MEMHOUSE_URL', 'http://localhost:8123'),
     user: pick('user', 'MEMHOUSE_USER', 'memhouse_root'),
     password: pick('password', 'MEMHOUSE_PASSWORD', ''),
     db: pick('db', 'MEMHOUSE_DB', 'mem'),
     port: pick('port', 'MEMHOUSE_PORT', '4640'),
+    // Did anything actually SAY which house this is, or are the values above just the
+    // defaults? The defaults are not neutral — localhost:8123 as memhouse_root is a real
+    // house on a lot of machines, usually the pilot's own. An agent whose config went
+    // missing (a temp HOME, a deleted env file, a service running as another user) would
+    // otherwise connect there and read or write someone else's memory, silently and with
+    // a plausible-looking result. Commands that expect YOUR house call requireConfig().
+    stated: stated('url', 'MEMHOUSE_URL') || stated('user', 'MEMHOUSE_USER'),
   };
 }
 
+// Refuse to fall back to the built-in defaults. `install`, `deploy`, `discover`,
+// `doctor` and `prompt` are exempt by design — they exist precisely for the state where
+// there is no config yet, and doctor probes localhost on purpose.
+function requireConfig(cfg, what) {
+  if (cfg.stated) return cfg;
+  if (JSON_OUT) {
+    // A --json caller gets JSON even when refused. Prose on stderr and an empty stdout is
+    // an unparseable answer to a machine-readable request.
+    console.log(JSON.stringify({
+      error: 'no_config', command: what, env_file: ENV_FILE, home: HOME_DIR,
+      message: `no house configured, so ${what} has nothing to talk to`,
+      fix: ['memhouse install --url … --user … --password …', 'memhouse onboard'],
+    }, null, 2));
+    process.exit(2);
+  }
+  console.error(`memhouse: no house configured, so ${what} has nothing to talk to.`);
+  console.error(`  Nothing was read from ${ENV_FILE.replace(os.homedir(), '~')} and no MEMHOUSE_URL/MEMHOUSE_USER is set.`);
+  console.error('  Rather than guess http://localhost:8123 as memhouse_root — which on many');
+  console.error('  machines is a real house belonging to someone else — this stops here.');
+  console.error('  Fix it with one of:');
+  console.error('     memhouse install --url … --user … --password …   point at a house you have');
+  console.error('     memhouse onboard                                 set one up from scratch');
+  console.error('     MEMHOUSE_URL=… MEMHOUSE_USER=… memhouse …        state it for this run');
+  console.error(`  If your config lives elsewhere, set MEMHOUSE_HOME (currently ${HOME_DIR.replace(os.homedir(), '~')}).`);
+  process.exit(2);
+}
+
 function childEnv(cfg) {
   return {
     ...process.env,
+    // Set only by the install path, which prints its own refusal for this case.
+    ...(cfg._quietDenied ? { MEMHOUSE_QUIET_DENIED: '1' } : {}),
     MEMHOUSE_URL: cfg.url, MEMHOUSE_USER: cfg.user, MEMHOUSE_PASSWORD: cfg.password,
     MEMHOUSE_DB: cfg.db, MEMHOUSE_PORT: String(cfg.port), MEMHOUSE_HOME: HOME_DIR,
   };
@@ -122,7 +120,7 @@ function writeEnvFile(cfg) {
   // `. ~/.memhouse/env`), so metacharacters in a password must never be bare.
   const sq = envfile.quoteShell;
   const body = [
-    '# mem-house connection — written by `memhouse install/setup`',
+    '# memhouse connection — written by `memhouse install/setup`',
     `MEMHOUSE_URL=${sq(cfg.url)}`,
     `MEMHOUSE_USER=${sq(cfg.user)}`,
     `MEMHOUSE_PASSWORD=${sq(cfg.password)}`,
@@ -155,47 +153,6 @@ async function chRows(cfg, sql, opts) {
   return text ? text.split('\n').map((l) => JSON.parse(l)) : [];
 }
 
-/**
- * Is this house a pre-0.4 one?
- *
- * 0.3.x kept three rooms named `sessions`/`messages`/`tool_calls` plus a stored
- * `sessions_v` view, shared by everyone and separated by row policies. 0.4.0 deleted that
- * layout. The database NAME survives an upgrade — explicit MEMHOUSE_DB outranks the new
- * `mem` default — but the TABLES do not, so every read and write fails with UNKNOWN_TABLE
- * naming a room the user has never heard of.
- *
- * Saying "run memhouse install" to someone in that state is useless: they did install, and
- * their memory is sitting right there in the house. Detect it and say so.
- */
-async function looksLikePre040(cfg) {
-  try {
-    const rows = await chRows(cfg,
-      `SELECT name FROM system.tables WHERE database = '${cfg.db}' AND name IN ('sessions','messages','tool_calls','sessions_v')`,
-      { database: '' });
-    return rows.map((r) => r.name);
-  } catch { return []; }
-}
-
-function reportPre040(cfg, member, found) {
-  console.log(bad(`'${cfg.db}' holds a pre-0.4 house — ${found.join(', ')} — and 0.4.0 cannot read it.`));
-  console.log('  0.4.0 replaced the shared rooms with one set per member. The database name');
-  console.log('  survived your upgrade; the table names did not.');
-  console.log('');
-  console.log('  Your transcripts are NOT lost. memhouse ships FROM your local session stores,');
-  console.log('  so the new rooms rebuild from disk. Build them in a NEW house and leave this');
-  console.log('  one untouched:');
-  console.log(`     memhouse install --force --db mem --admin-user <user> --admin-password <pw> --member ${member}`);
-  console.log('     memhouse ship --full');
-  console.log('');
-  console.log(`  A NEW house, not this one, and --force because the config still points here.`);
-  console.log(`  Rebuilding into '${cfg.db}' would put the member rooms beside the old`);
-  console.log("  `sessions_v`, which the `^sessions_` team-room selector matches — every");
-  console.log('  session would then be counted twice.');
-  console.log('');
-  console.log('  Sessions whose transcripts you have since deleted locally live only in the old');
-  console.log(`  tables. Read them there before dropping anything: SELECT * FROM ${cfg.db}.sessions`);
-}
-
 /** Is anything listening on this loopback port? */
 function portInUse(port) {
   return new Promise((resolve) => {
@@ -236,7 +193,7 @@ function shipperHealth() {
   const pid = pidOf('shipper');
   if (pid) return { running: true, via: `daemon (pid ${pid})` };
   try {
-    const svc = require(path.join(REPO_ROOT, 'mem-house', 'service.js'));
+    const svc = require(path.join(REPO_ROOT, 'memhouse', 'service.js'));
     const st = svc.status();
     if (st.installed) return { running: st.running, via: `service (${st.kind})` };
   } catch { /* no service integration on this platform */ }
@@ -275,6 +232,46 @@ async function ask(question, dflt) {
   return a || dflt || '';
 }
 
+// undici reports every transport failure as the string 'fetch failed' and hides the real
+// reason in .cause. `✗ not connected: fetch failed` names neither the host nor the problem,
+// while `ship` prints ECONNREFUSED for the identical condition — the three commands
+// disagreed about the same event.
+function netReason(e) {
+  const cause = e && e.cause;
+  const inner = cause && (cause.message || cause.code);
+  const codes = cause && Array.isArray(cause.errors)
+    ? cause.errors.map((x) => x && (x.code || x.message)).filter(Boolean) : [];
+  const detail = inner || codes[0];
+  if (!detail) return e && e.message ? e.message : String(e);
+  return e.message && e.message !== detail ? `${e.message} (${detail})` : detail;
+}
+
+// Read without echoing. `onboard` and `setup` both prompt for the house password and
+// printed it back on the terminal — in a wizard whose whole audience is someone typing a
+// credential in front of whoever is in the room.
+function askSecret(label, dflt = '') {
+  if (!process.stdin.isTTY) return ask(label, dflt);
+  return new Promise((resolve) => {
+    process.stdout.write(`${label}${dflt ? ` [${'*'.repeat(Math.min(dflt.length, 8))}]` : ''}: `);
+    const stdin = process.stdin;
+    const wasRaw = stdin.isRaw;
+    stdin.setRawMode(true); stdin.resume(); stdin.setEncoding('utf-8');
+    let buf = '';
+    const onData = (ch) => {
+      if (ch === '\r' || ch === '\n' || ch === '\u0004') {
+        stdin.removeListener('data', onData);
+        stdin.setRawMode(!!wasRaw); stdin.pause();
+        process.stdout.write('\n');
+        return resolve(buf || dflt);
+      }
+      if (ch === '\u0003') { process.stdout.write('\n'); process.exit(130); }
+      if (ch === '\u007f' || ch === '\b') { buf = buf.slice(0, -1); return; }
+      buf += ch;
+    };
+    stdin.on('data', onData);
+  });
+}
+
 function pidOf(name) {
   try {
     const pid = parseInt(fs.readFileSync(path.join(RUN_DIR, name + '.pid'), 'utf-8'), 10);
@@ -283,6 +280,17 @@ function pidOf(name) {
   } catch { return null; }
 }
 
+// Signal 0 tests for existence without delivering anything.
+// The port the RUNNING dashboard was started with, not the one currently configured.
+function runningPort(cfg) {
+  try { return fs.readFileSync(path.join(RUN_DIR, 'dashboard.port'), 'utf-8').trim() || cfg.port; }
+  catch { return cfg.port; }
+}
+
+function alive(pid) {
+  try { process.kill(pid, 0); return true; } catch { return false; }
+}
+
 function ensureUiBuilt() {
   if (fs.existsSync(path.join(REPO_ROOT, 'public', 'index.html'))) return true;
   const uiDir = path.join(REPO_ROOT, 'ui');
@@ -307,18 +315,29 @@ Setup        onboard              interactive wizard: discover → configure →
                                   the member. The admin credential is never stored.
              setup                (re)write the connection config only (--yes = no prompts)
              discover             read-only preflight: editors, sessions, reachable ClickHouses
-             uninstall            stop daemons + remove ${HOME_DIR.replace(os.homedir(), '~')} (house data untouched)
-             reset                truncate the house tables and re-ship everything (--yes to skip confirm)
+             uninstall            stop daemons + service, clear runtime state.
+                                  KEEPS the config and this machine's host identity
+                                  --credentials    also forget the house and its password
+                                  --full-removal   all of ${HOME_DIR.replace(os.homedir(), '~')}, identity included
+                                  no tier touches the house data
+             update               upgrade, restart the daemons, and check the house schema
+                                  (--check to compare versions and change nothing)
+             reset                clear the shipper's rows and re-ship everything (--yes to skip confirm)
+                                  imported rows are kept; --all-origins removes those too
 
 Data         ship                 one incremental pass (--full | --loop [sec])
              stats                per-source session/message/token counts
              search <terms…>      full-text search across all sessions
+             resume <session-id>  print the command that reopens that session in its editor
              sessions-query       print the session rollup SQL for this credential
              start | stop |       shipper loop + dashboard as background daemons
              status               daemons, connection, counts, freshness (--json)
              doctor               diagnose the whole pipeline
 
 Agents       plugins              list | install claude [--target DIR] | remove claude
+                                  acts on EVERY Claude config dir found (~/.claude,
+                                  CLAUDE_CONFIG_DIR, ~/.claude-playbooks/*), all
+                                  selected by default; --yes takes them all unasked
              prompt               print the memory system-prompt snippet
              prompt --install     print an install prompt for an agent, with this
                                   machine's state and the one route that applies
@@ -342,7 +361,7 @@ function printAdapterErrors(errors) {
   if (blocked.length) {
     console.log(warn(`${blocked.length} adapter${blocked.length > 1 ? 's' : ''} skipped — better-sqlite3 has no native binding: ${blocked.map((e) => e.source).join(', ')}`));
     console.log('  their sessions are NOT being shipped. npm >= 12 blocks install scripts by default; rebuild with:');
-    console.log('    npm install -g memhouse --allow-scripts=better-sqlite3');
+    console.log('    ${installCommand()}');
     console.log('  (from a checkout: npm install --no-audit --no-fund, which package.json already allows)');
   }
   for (const e of other) console.log(warn(`${e.source.padEnd(16)} skipped: ${e.message}`));
@@ -382,7 +401,7 @@ async function cmdDiscover() {
   if (JSON_OUT) return console.log(JSON.stringify(out, null, 2));
   console.log('\nEditors with sessions on this machine:');
   if (out.editors.length === 0) console.log(warn('none found' + (out.editorsError ? ` (${out.editorsError})` : '')));
-  for (const e of out.editors) console.log(ok(`${e.source.padEnd(16)} ${e.sessions} sessions`));
+  for (const e of out.editors) console.log(ok(`${e.source.padEnd(16)} ${e.sessions} session${e.sessions === 1 ? '' : 's'}`));
   printAdapterErrors(out.adapterErrors);
   console.log('\nClickHouse endpoints:');
   for (const p of out.clickhouse) {
@@ -391,7 +410,9 @@ async function cmdDiscover() {
     else console.log(ok(`${p.url} — v${p.version}${p.hasHouse ? ', house present' : ''}${p.kernel ? ', KERNEL detected' : ''}`));
   }
   console.log('');
-  console.log(out.config ? ok(`config: ${out.config}`) : warn('no config yet — run: memhouse install (or onboard)'));
+  // This banner is shared with `onboard`, which was therefore telling the user, mid-wizard,
+  // to run the wizard they are already inside.
+  console.log(out.config ? ok(`config: ${out.config}`) : warn(ONBOARDING ? 'no config yet — setting one up now' : 'no config yet — run: memhouse install (or onboard)'));
   if (out.memoryHouse) console.log(warn('memory-house detected on this machine (they coexist fine)'));
   return out;
 }
@@ -459,9 +480,10 @@ endpoint does not answer. Do NOT reconfigure before finding out why.
   } else if (houseUp) {
     plan = `A ClickHouse is already reachable at \`${reachable[0].url}\`. Use it.
 
-1. \`npm install -g memhouse --allow-scripts=better-sqlite3\`
-   The flag is not optional — six adapters (cursor, zed, opencode, goose, windsurf,
-   antigravity) read SQLite stores and silently drop out without the native build.
+1. \`${installCommand()}\`
+   The flag is not optional — five adapters (cursor, zed, opencode, goose, antigravity)
+   read SQLite stores and silently drop out without the native build. (windsurf needs it
+   too but is excluded upstream, so discover names five; the two numbers agree.)
 2. Ask the user for the ClickHouse username and password for that endpoint.
 3. \`memhouse install --url ${reachable[0].url} --user <user> --password <pw>\`
    If they hold admin on it and want memhouse to create the user, database, rooms and
@@ -474,8 +496,8 @@ endpoint does not answer. Do NOT reconfigure before finding out why.
     plan = `There is no ClickHouse to point at, but **${engines.join(' and ')}** is available,
 so memhouse can run one:
 
-1. \`npm install -g memhouse --allow-scripts=better-sqlite3\`
-   The flag is not optional — six adapters read SQLite stores and silently drop out
+1. \`${installCommand()}\`
+   The flag is not optional — five adapters read SQLite stores and silently drop out
    without the native build.
 2. \`memhouse deploy --local\`
    This starts a loopback-only ClickHouse, generates a credential, installs, creates the
@@ -483,7 +505,7 @@ so memhouse can run one:
 3. \`memhouse start\`.
 
 ${process.platform === 'linux' && engines.includes('podman')
-    ? 'On Linux with rootless podman the container stops at logout unless lingering is on.\nIf memhouse warns about this, run what it prints (`loginctl enable-linger <user>`)\nand tell the user why it matters.' : ''}`;
+    ? 'On Linux with rootless podman the container MAY stop at logout — it depends on the\ndistro (Ubuntu 24.04 keeps it). If memhouse warns about this, run what it prints\n(`loginctl enable-linger <user>`) and tell the user why it matters.' : ''}`;
   } else {
     plan = `There is no ClickHouse reachable and no container engine to run one with. You
 cannot finish this install alone — say so rather than improvising.
@@ -492,12 +514,16 @@ Tell the user they need one of:
 - a ClickHouse they already run (Cloud, a server, a kernel house) plus its credentials;
 - docker or podman installed, after which \`memhouse deploy --local\` does everything.
 
-You can still do the harmless half now: \`npm install -g memhouse --allow-scripts=better-sqlite3\`,
+You can still do the harmless half now: \`${installCommand()}\`,
 then \`memhouse discover\` to show them what would be shipped once a house exists.`;
   }
 
   const out = body
     .replaceAll('{{VERSION}}', PKG.version)
+    // The install prompt is otherwise entirely per-machine — db, url, editors, engines —
+    // and then told the agent the config lands at a hardcoded ~/.memhouse/env. `prompt`
+    // without --install already got this right; the fix had landed in one of the two.
+    .replaceAll('{{ENV_FILE}}', ENV_FILE)
     .replaceAll('{{PLATFORM}}', `${process.platform}/${process.arch}`)
     .replaceAll('{{NODE}}', process.versions.node)
     .replaceAll('{{STATE}}', state)
@@ -528,7 +554,7 @@ async function withSuppressedOutput(fn) {
  * "fix the connection" by the one command whose whole job is to get them connected.
  */
 function deployableEngines() {
-  try { return require(path.join(REPO_ROOT, 'mem-house', 'deploy.js')).availableEngines() || []; }
+  try { return require(path.join(REPO_ROOT, 'memhouse', 'deploy.js')).availableEngines() || []; }
   catch { return []; }
 }
 
@@ -574,7 +600,7 @@ function generatePassword() {
  * same templates provision.js applies, so the two cannot drift into different houses.
  */
 function memberSql(db, member, password) {
-  const here = path.join(REPO_ROOT, 'mem-house', 'per-member');
+  const here = path.join(REPO_ROOT, 'memhouse', 'per-member');
   // The templates are written unqualified because provision.js applies them with the
   // house already selected. A human pastes this somewhere unknown — clickhouse-client,
   // the play UI, curl — so every name is qualified here and there is no `USE`.
@@ -591,8 +617,14 @@ function memberSql(db, member, password) {
     .replaceAll('{{MEMBER}}', member));
   const merge = qualify(fs.readFileSync(path.join(here, 'schema-merge.sql.tpl'), 'utf-8')
     .replaceAll('{{TEMPLATE_MEMBER}}', member));
+  // The SAME grant set provision.js issues. These two paths build the same house, and when
+  // only one of them was narrowed, `install --print-sql` — the path INSTALL.md calls the
+  // common case — still emitted GRANT ALL, which includes CREATE TABLE on the member's own
+  // room name. A member provisioned that way could drop their room, recreate it as
+  // Merge('<db>','^messages_'), and double every other member's rows in the team room:
+  // exactly the attack the narrowing was for, fully reachable, one release later.
   const grants = ROOM_TYPES.flatMap((t) => [
-    `GRANT ALL ON ${db}.${t}_${member} TO ${member};`,
+    `GRANT ${MEMBER_PRIVS} ON ${db}.${t}_${member} TO ${member};`,
     `GRANT SELECT ON ${db}.${t}_${member} TO ${member} WITH GRANT OPTION;`,
   ]).join('\n');
   const mergeGrants = Object.values(mergeRooms())
@@ -619,12 +651,14 @@ function memberSql(db, member, password) {
 SET allow_experimental_full_text_index = 1;
 
 CREATE DATABASE IF NOT EXISTS ${db};
-CREATE USER ${member} IDENTIFIED BY '${password.replace(/'/g, "\\'")}';
+CREATE USER IF NOT EXISTS ${member} IDENTIFIED BY '${password.replace(/'/g, "\\'")}';
 
 ${rooms.trim()}
 
--- ALL is not re-grantable; SELECT is. The member owns their rooms outright — DROP
--- included, it is their memory — but a share can only ever be read-only.
+-- Exactly what the shipper uses, and nothing that defines an object: no CREATE TABLE, no
+-- DROP, no TRUNCATE. A member who owned the room NAME rather than its data could replace
+-- it with a Merge over every member's rooms and double their rows in the team room.
+-- Only SELECT is re-grantable, so a share can only ever be read-only.
 ${grants}
 
 -- Team-wide reads. A Merge room reduces to the rooms the CALLER holds grants for, so
@@ -632,6 +666,20 @@ ${grants}
 ${merge.trim()}
 
 ${mergeGrants}
+
+-- Resource ceilings. Confidentiality isolation is a grant that is absent; this is the
+-- availability half, and it did not exist until 0.4.7 — a member could raise
+-- max_memory_usage, zero max_execution_time and take a shared server down for everyone.
+-- CONST, not MAX: a plain default is advisory, and MAX is not enough either because 0 means
+-- UNLIMITED in ClickHouse and 0 satisfies any MAX. Measured — with a MAX ceiling in force,
+-- SETTINGS max_memory_usage = 0 was accepted and the ceiling was gone.
+-- CREATE ... OR REPLACE, which this used, DETACHES every user already on the profile, so
+-- provisioning a second member silently stripped the first member's ceilings. IF NOT
+-- EXISTS + ALTER edits the same object in place and keeps every assignment.
+CREATE SETTINGS PROFILE IF NOT EXISTS ${MEMBER_PROFILE};
+ALTER SETTINGS PROFILE ${MEMBER_PROFILE} SETTINGS NONE;
+ALTER SETTINGS PROFILE ${MEMBER_PROFILE} SETTINGS ${MEMBER_PROFILE_SETTINGS};
+ALTER USER ${member} SETTINGS PROFILE '${MEMBER_PROFILE}';
 `;
 }
 
@@ -644,6 +692,8 @@ ${mergeGrants}
  * log. A shipper running as the house owner makes per-member rooms decoration.
  */
 async function adminBootstrap(cfg, admin) {
+  // What this run has already changed on the server, for an honest failure message.
+  let createdUser = null;
   const adminCfg = { ...cfg, user: admin.user, password: admin.password };
   const q = (sql, opts) => ch(adminCfg, sql, opts);
 
@@ -660,7 +710,24 @@ async function adminBootstrap(cfg, admin) {
   // 2. the user. An EXISTING user is refused: adopting one silently hands the second
   // human the first's identity and rooms, and user_id MATERIALIZED currentUser() would
   // stamp them identically, so nothing downstream would ever notice.
-  const exists = (await chRows(adminCfg, `SELECT name FROM system.users WHERE name = '${admin.member}'`, { database: '' })).length > 0;
+  // A member who passes --admin-user gets ACCESS_DENIED here, because no member holds
+  // SELECT ON system.users. That is the isolation working — but the raw 497 names neither
+  // side, while INSTALL.md promises install "refuses, names both sides, and creates
+  // nothing". Say who you are not, and what the owner has to run instead.
+  let exists;
+  try {
+    exists = (await chRows(adminCfg, `SELECT name FROM system.users WHERE name = '${admin.member}'`, { database: '' })).length > 0;
+  } catch (e) {
+    if (/Not enough privileges|ACCESS_DENIED|system\.users/i.test(e.message || '')) {
+      console.log(bad(`'${admin.user}' is not an admin of this house — it cannot read system.users, so it cannot provision a member`));
+      console.log('  Adding a member is the house owner\'s job. Ask them for:');
+      console.log(`     node ${path.join(REPO_ROOT, 'memhouse', 'per-member', 'provision.js')} --member ${admin.member} --merge`);
+      console.log('  If you already HAVE a member credential on this house, you do not need admin:');
+      console.log(`     memhouse install --url ${adminCfg.url} --user ${admin.member} --password …`);
+      return null;
+    }
+    throw e;
+  }
   let password = flags['member-password'] || null;
   if (exists) {
     if (flags['adopt-user'] !== true) {
@@ -681,23 +748,49 @@ async function adminBootstrap(cfg, admin) {
       password = generatePassword();
       console.log('');
       console.log(`  password for '${admin.member}':  ${password}`);
-      console.log('  Shown once. It goes into ~/.memhouse/env; to change it later:');
+      console.log(`  Shown once. It goes into ${ENV_FILE}; to change it later:`);
       console.log(`     ALTER USER ${admin.member} IDENTIFIED BY '…'   then: memhouse setup --password …`);
       console.log('');
     }
     try { await q(`CREATE USER ${admin.member} IDENTIFIED BY '${password.replace(/'/g, "\\'")}'`, { database: '' }); }
     catch (e) { console.log(bad(`could not create user '${admin.member}': ${e.message}`)); return null; }
     console.log(ok(`created ClickHouse user '${admin.member}'`));
+    createdUser = admin.member;
   }
 
   // 3. rooms, 4. grants, 5. Merge rooms + their grant — provision.js owns all of it, so
   // there is one implementation of the grant set rather than two that drift.
-  const provision = path.join(REPO_ROOT, 'mem-house', 'per-member', 'provision.js');
-  const rc = spawnSync(process.execPath, [provision, '--member', admin.member, '--merge'], {
+  const provision = path.join(REPO_ROOT, 'memhouse', 'per-member', 'provision.js');
+  // Tell it who made the user. Without this the child finds a user that exists — because
+  // THIS command created it two lines ago — and says so, producing two consecutive lines
+  // of one command's output that contradict each other:
+  //     ✓ created ClickHouse user 'henry'
+  //     [mem] ClickHouse user 'henry' already exists — provisioning rooms only
+  // and "already exists" is the exact phrase memhouse uses for the identity-takeover
+  // REFUSAL, so a first-time installer reads a success as a warning about someone else.
+  const provisionArgs = [provision, '--member', admin.member, '--merge'];
+  if (createdUser) provisionArgs.push('--user-just-created');
+  const rc = spawnSync(process.execPath, provisionArgs, {
     stdio: 'inherit',
     env: { ...process.env, MEM_URL: cfg.url, MEM_USER: admin.user, MEM_PASSWORD: admin.password, MEM_DB: cfg.db },
   });
-  if (rc.status !== 0) { console.log(bad('provisioning failed — nothing was written')); return null; }
+  if (rc.status !== 0) {
+    // "nothing was written" was a lie whenever the CREATE USER above had already run —
+    // and it runs before this. Observed: provision.js died on a missing dependency, this
+    // printed the all-clear, and the next install refused with the identity-takeover
+    // message because the user it said it had not created was there. Say what exists, and
+    // name the two ways forward.
+    console.log(bad('provisioning failed'));
+    if (createdUser) {
+      console.log(`  ClickHouse user '${createdUser}' WAS created before this failed; its rooms were not.`);
+      console.log('  Nothing was written to disk. To continue once the cause is fixed:');
+      console.log(`     memhouse install --adopt-user --member ${createdUser} --member-password '<the password above>' …`);
+      console.log(`  Or undo it as the admin:  DROP USER ${createdUser}`);
+    } else {
+      console.log('  nothing was written');
+    }
+    return null;
+  }
 
   // The step that makes this trustworthy: stop being admin, and prove the credential we
   // are about to persist actually reaches the rooms.
@@ -719,10 +812,45 @@ function resolveMemberHandle() {
     console.log(bad(`'${member}' cannot name a room — expected [A-Za-z][A-Za-z0-9_]*`));
     return null;
   }
+  // Reserved names are refused however they arrive. The check used to live only in
+  // suggestMember(), i.e. only on the handle DERIVED from $HOME — so `HOME=/root` was
+  // refused while an explicit `--member root` sailed through and created a ClickHouse
+  // user named root with ALL on its rooms. A guard that a flag walks around is not a
+  // guard; the reason it exists does not change with how the name was typed.
+  //
+  // `default` is deliberately NOT on this list. It is ClickHouse's own catch-all user and
+  // a poor choice of member, but it is a real one that existing houses are built on —
+  // refusing it would lock those pilots out of their own install.
+  if (member.toLowerCase() === 'root') {
+    console.log(bad(`'${member}' cannot be a member — it is a container artefact, not a person.`));
+    console.log('  Pick a name that identifies a person or a machine: memhouse install --member <name>');
+    return null;
+  }
   if (!flags.member && s.changed) console.log(warn(`member handle '${s.changed}' sanitized to '${member}' — pass --member to choose another`));
   return member;
 }
 
+// Do the rooms' sorting keys match what the shipper will accept? Returns a description of
+// what is wrong, or null. `origin` belongs in the transcript rooms' keys (so an imported
+// row and a shipped one at the same seq stay two rows) and must NOT be in the sessions key
+// (so a session has exactly one metadata row).
+async function sortingKeyProblem(cfg) {
+  try {
+    const rooms = await roomsFor(cfg);
+    const wrong = [];
+    for (const t of ROOM_TYPES) {
+      const r = await chRows(cfg, `SELECT sorting_key AS k FROM system.tables WHERE database = '${cfg.db}' AND name = '${rooms[t]}'`, { database: '' });
+      const key = r[0]?.k;
+      if (!key) continue;
+      const want = t !== 'sessions';
+      if (/\borigin\b/.test(key) !== want) {
+        wrong.push(`${rooms[t]} (${key}) — origin ${want ? 'missing from' : 'must not be in'} the key`);
+      }
+    }
+    return wrong.length ? wrong.join('; ') : null;
+  } catch { return null; }  // unreachable house is a different check's problem
+}
+
 async function cmdInstall({ interactive }) {
   let cfg = resolveConfig();
   const adminUser = flags['admin-user'];
@@ -736,7 +864,14 @@ async function cmdInstall({ interactive }) {
     const password = flags['member-password'] || generatePassword();
     console.log(memberSql(cfg.db, member, password));
     console.log(`-- Then, once that has run:`);
-    console.log(`--   memhouse install --url ${cfg.url} --db ${cfg.db} --user ${member} --password '${password}'`);
+    // Only echo a URL that was actually STATED. --print-sql is the path where the house is
+    // typically someone else's, run by someone else, and cfg.url falls back to
+    // http://localhost:8123 — the one address the rest of the product refuses to guess.
+    // Handing it back as a copy-paste command carrying a live credential is worse than
+    // leaving a placeholder.
+    console.log(cfg.stated
+      ? `--   memhouse install --url ${cfg.url} --db ${cfg.db} --user ${member} --password '${password}'`
+      : `--   memhouse install --url <the house this SQL was run on> --db ${cfg.db} --user ${member} --password '${password}'`);
     return 0;
   }
 
@@ -749,21 +884,76 @@ async function cmdInstall({ interactive }) {
     });
     if (!built) return 1;
     cfg = built;
+  // BEFORE the env file and BEFORE the ship. INSTALL.md's contract is that the config is
+  // written last, "after everything above has proved out", because a config left by a
+  // failed install is read as truth by the next command. Placed after the write, a
+  // wrong-key house got four green ticks and a persisted config, and `status` then added
+  // five more on a house that can never be shipped to.
+  const keyProblem = await sortingKeyProblem(cfg);
+  if (keyProblem) {
+    console.log(bad(`the rooms are here, but their sorting keys are wrong: ${keyProblem}`));
+    console.log('  a ship pass would corrupt them, so `memhouse ship` will refuse.');
+    console.log(`  rebuild them from ${path.join(REPO_ROOT, 'memhouse', 'per-member', 'schema-member.sql.tpl')}, then: memhouse ship --full`);
+    console.log('  no config was written — nothing here reads as installed.');
+    return 1;
+  }
     writeEnvFile(cfg);
     console.log(ok(`config written: ${ENV_FILE}`));
+    // Same as the member path below: the identity is minted where the machine joins.
+    {
+      const me = require(path.join(REPO_ROOT, 'memhouse', 'host.js')).identity(HOME_DIR);
+      console.log(ok(`host identity: ${me.id}`));
+      console.log(`  every machine you install as '${cfg.user}' writes into the same rooms; this is what tells them apart`);
+    }
     if (flags['no-ship'] !== true && run(SHIP_JS, [], cfg) !== 0) return 1;
     console.log(ok('installed — next: memhouse start   (dashboard + shipper loop)'));
     console.log('  admin is needed again only for: a second member, or an ADD COLUMN rollout.');
-    console.log('     node mem-house/per-member/provision.js --member <name> --merge');
+    console.log(`     node ${path.join(REPO_ROOT, 'memhouse', 'per-member', 'provision.js')} --member <name> --merge`);
     return 0;
   }
 
+  // Flags that only mean something on the admin branch. Silently ignoring them is how a
+  // run with --adopt-user --member bob --member-password … and no --admin-user ended up
+  // authenticating as memhouse_root instead: the three flags did nothing, --yes satisfied
+  // haveAll so no prompt asked who you were, and resolveConfig's default was used AS A
+  // CREDENTIAL. Refuse rather than do something else silently.
+  const adminOnly = ['adopt-user', 'member', 'member-password'].filter((k) => flags[k] !== undefined);
+  if (!adminUser && adminOnly.length) {
+    console.log(bad(`--${adminOnly.join(', --')} ${adminOnly.length > 1 ? 'are' : 'is'} only read with --admin-user`));
+    console.log('  Those flags provision a member, which needs house admin. Without them this');
+    console.log('  command connects as an EXISTING member instead:');
+    console.log('     memhouse install --url … --user <member> --password …');
+    console.log('  That is also the "same person on a new machine" path — no admin needed.');
+    return 1;
+  }
+
   const haveAll = flags.yes === true || (flags.url && flags.user !== undefined);
+  // --yes must not turn "unanswered" into "the default". Everywhere else in the product a
+  // missing house is refused; here it was authenticated with.
+  if (haveAll && !cfg.stated) {
+    console.log(bad('no house given: --url and --user are required with --yes'));
+    console.log('  memhouse will not fall back to http://localhost:8123 as memhouse_root —');
+    console.log('  on many machines that is a real house belonging to someone else.');
+    console.log('  No ClickHouse yet?  memhouse deploy --local --house-port <port>');
+    return 2;  // same code as every other no-config refusal
+  }
   if (interactive || !haveAll) {
-    console.log('mem-house connection (Enter keeps the default):');
-    cfg.url = await ask('  ClickHouse URL', cfg.url);
-    cfg.user = await ask('  user', cfg.user);
-    cfg.password = await ask('  password', cfg.password);
+    // Offer a default only where one was actually STATED. Otherwise this prompt said
+    // "Enter keeps the default" over `http://localhost:8123` / `memhouse_root` — the pair
+    // the no-config refusal three commands away declines to guess, while naming this very
+    // command as the fix. Pressing Enter is not a decision the user made about which house
+    // to use; requiring the answer is.
+    console.log(cfg.stated
+      ? 'memhouse connection (Enter keeps the default):'
+      : 'memhouse connection (no house is configured yet — these have no defaults):');
+    cfg.url = await ask('  ClickHouse URL', cfg.stated ? cfg.url : '');
+    cfg.user = await ask('  user', cfg.stated ? cfg.user : '');
+    if (!cfg.url || !cfg.user) {
+      console.log(bad('a URL and a user are required — memhouse will not pick a house for you'));
+      console.log('  no ClickHouse yet?  memhouse deploy --local --house-port <port>');
+      return 1;
+    }
+    cfg.password = await askSecret('  password', cfg.password);
     cfg.db = await ask('  database (the house)', cfg.db);
     cfg.port = await ask('  dashboard port', cfg.port);
   }
@@ -816,13 +1006,10 @@ async function cmdInstall({ interactive }) {
   let have = [];
   try { have = await present(); } catch (e) { console.log(bad(`could not list rooms: ${e.message}`)); return 1; }
   if (have.length !== want.length) {
-    // Check for a pre-0.4 house BEFORE trying to mint anything. `--ensure-schema` on one
-    // of those dies with an UNKNOWN_TABLE stack trace, and a stack trace printed above a
-    // clean explanation is how a clear message gets missed.
-    const legacy = await looksLikePre040(cfg);
-    if (legacy.length) { reportPre040(cfg, r.member, legacy); return 1; }
-    // Try to mint them as ourselves before asking anyone for anything.
-    run(SHIP_JS, ['--ensure-schema'], cfg);
+    // Try to mint them as ourselves before asking anyone for anything. This is the ONE
+    // call site where a permission refusal is expected and already explained below, so
+    // the child is told to stay quiet about it rather than print above our message.
+    run(SHIP_JS, ['--ensure-schema'], { ...cfg, _quietDenied: true });
     try { have = await present(); } catch { /* reported below */ }
   }
   const missing = want.filter((n) => !have.includes(n));
@@ -834,10 +1021,32 @@ async function cmdInstall({ interactive }) {
     return 1;
   }
   console.log(ok(`rooms for '${r.member}': ${want.join(', ')}`));
+  // BEFORE the env file and BEFORE the ship. INSTALL.md's contract is that the config is
+  // written last, "after everything above has proved out", because a config left by a
+  // failed install is read as truth by the next command. Placed after the write, a
+  // wrong-key house got four green ticks and a persisted config, and `status` then added
+  // five more on a house that can never be shipped to.
+  const keyProblem = await sortingKeyProblem(cfg);
+  if (keyProblem) {
+    console.log(bad(`the rooms are here, but their sorting keys are wrong: ${keyProblem}`));
+    console.log('  a ship pass would corrupt them, so `memhouse ship` will refuse.');
+    console.log(`  rebuild them from ${path.join(REPO_ROOT, 'memhouse', 'per-member', 'schema-member.sql.tpl')}, then: memhouse ship --full`);
+    console.log('  no config was written — nothing here reads as installed.');
+    return 1;
+  }
   // Written LAST, and only once everything above proved out. Writing it first leaves a
   // config file behind every failed attempt, and the next command reads it as truth.
   writeEnvFile(cfg);
   console.log(ok(`config written: ${ENV_FILE}`));
+  // Mint this machine's identity here rather than leaving it to whatever runs first.
+  // Installing is the moment a machine joins the member's rooms, and the id is what every
+  // later `WHERE host = …` depends on — so it is worth naming once, out loud, at the point
+  // the pilot can still see it.
+  {
+    const me = require(path.join(REPO_ROOT, 'memhouse', 'host.js')).identity(HOME_DIR);
+    console.log(ok(`host identity: ${me.id}`));
+    console.log(`  every machine you install as '${cfg.user}' writes into the same rooms; this is what tells them apart`);
+  }
   if (flags['no-ship'] !== true) {
     if (run(SHIP_JS, [], cfg) !== 0) return 1;
   }
@@ -846,6 +1055,8 @@ async function cmdInstall({ interactive }) {
 }
 
 async function cmdOnboard() {
+  ONBOARDING = true;
+  let deployed = false;
   console.log(`memhouse ${PKG.version} — onboarding\n`);
   const found = await cmdDiscover();
   console.log('');
@@ -865,7 +1076,14 @@ async function cmdOnboard() {
         // process reading its own flags. Reaching into it with a synthesised flag object
         // is how one of them silently stops applying.
         const rc = spawnSync(process.execPath, [__filename, 'deploy', '--local'], { stdio: 'inherit' });
-        return rc.status === 0 ? 0 : (rc.status || 1);
+        if (rc.status !== 0) return rc.status || 1;
+        // Fall through to the daemon prompt below rather than returning. This branch —
+        // "no ClickHouse yet", the README's headline scenario — used to return here, so
+        // `onboard` skipped its own last step: HELP says onboard is
+        // discover → configure → ship → START, the README says it "ships, and starts the
+        // dashboard", and doctor then exited 1 on a fresh, entirely successful install
+        // because neither daemon was running. Measured on a clean machine.
+        deployed = true;
       }
     } else {
       console.log(warn('No reachable ClickHouse found, and neither docker nor podman is on PATH.'));
@@ -873,16 +1091,39 @@ async function cmdOnboard() {
     }
     console.log('');
   }
-  const code = await cmdInstall({ interactive: true });
-  if (code !== 0) return code;
+  // `deploy --local` already installed and shipped, so asking the install questions again
+  // would prompt for a house it just built.
+  if (!deployed) {
+    const code = await cmdInstall({ interactive: true });
+    if (code !== 0) return code;
+  }
   const yn = (await ask('Start the daemons now? (Y/n)', 'Y')).toLowerCase();
   if (yn !== 'n' && yn !== 'no') await cmdStart();
+
+  // The skills were the one delivered thing onboarding never mentioned. They shipped,
+  // they were packaged as a plugin, and the only way to find them was to already know
+  // `memhouse plugins install claude` — so a pilot completed the whole wizard and ended up
+  // with a house their agent could not query. Offer them here, across every Claude instance
+  // found, all selected.
+  const targets = claudeTargets();
+  if (targets.length) {
+    console.log('');
+    console.log(`Claude Code skills: ${fs.readdirSync(path.join(DELIVERY, 'plugin', 'skills')).map((n) => `/memhouse:${n}`).join(', ')}`);
+    const chosen = await chooseTargets(targets, 'Install into');
+    for (const t of chosen) console.log(ok(`installed skills into ${short(installPluginInto(t.dir))}`));
+    if (chosen.length) console.log('  they load next time that Claude Code starts');
+    else console.log(warn('skipped — install later with: memhouse plugins install claude'));
+  }
   return 0;
 }
 
 async function cmdStart() {
-  const cfg = resolveConfig();
+  const cfg = requireConfig(resolveConfig(), 'start');
   fs.mkdirSync(RUN_DIR, { recursive: true });
+  // Record the port this run actually used. `start --port 4673` did not persist it, so
+  // `status` fell back to the env file and printed `dashboard → http://localhost:4640` —
+  // a live process on 4673 named alongside a link to someone else's dashboard on 4640.
+  try { fs.writeFileSync(path.join(RUN_DIR, 'dashboard.port'), String(cfg.port)); } catch { /* best effort */ }
   fs.mkdirSync(LOG_DIR, { recursive: true });
   ensureUiBuilt();
   const daemons = [
@@ -899,7 +1140,7 @@ async function cmdStart() {
   // Reachable in the obvious way: after a reboot the user wants the dashboard back, which
   // is not service-managed, and types `memhouse start`.
   let svcStatus = { installed: false, running: false };
-  try { svcStatus = require(path.join(REPO_ROOT, 'mem-house', 'service.js')).status(); } catch { /* unsupported platform */ }
+  try { svcStatus = require(path.join(REPO_ROOT, 'memhouse', 'service.js')).status(); } catch { /* unsupported platform */ }
   const owned = [
     ...(svcStatus.installed ? [['shipper', svcStatus.running, 'memhouse-shipper']] : []),
   ];
@@ -913,6 +1154,7 @@ async function cmdStart() {
         : `  start it with: launchctl kickstart gui/$(id -u)/com.${unit.replace('memhouse-', 'memhouse.')}`);
     }
   }
+  const started = [];
   for (const d of daemons) {
     if (pidOf(d.name)) { console.log(warn(`${d.name} already running (pid ${pidOf(d.name)})`)); continue; }
     const log = fs.openSync(path.join(LOG_DIR, d.name + '.log'), 'a');
@@ -921,20 +1163,50 @@ async function cmdStart() {
     });
     fs.writeFileSync(path.join(RUN_DIR, d.name + '.pid'), String(child.pid));
     child.unref();
-    console.log(ok(`${d.name} started (pid ${child.pid})`));
+    started.push({ ...d, pid: child.pid });
   }
-  console.log(`  dashboard → http://localhost:${cfg.port}`);
-}
 
-// `solo` is here and NOT in the start list on purpose. The tier is gone, but a machine
-// that ran it before this upgrade can still have a detached shim alive with its pid in
-// run/solo.pid — and `uninstall` deletes MEMHOUSE_HOME, which is where its data directory
-// lives. Reaping has to outlive the feature; starting must not.
-const LEGACY_DAEMONS = ['solo'];
+  // spawn() succeeding means the PROCESS started, not that it is still alive or that it
+  // got the port. `start` used to print "✓ dashboard started (pid …)" and a URL for a
+  // process that had already died of EADDRINUSE — and the URL then pointed at whatever
+  // else owned the port, which on this machine was a different house's dashboard. Give
+  // each a moment, then confirm, and dig the reason out of the log rather than making the
+  // user find it.
+  if (started.length) await new Promise((r) => setTimeout(r, 900));
+  let dashboardAlive = false;
+  for (const d of started) {
+    if (alive(d.pid)) {
+      console.log(ok(`${d.name} started (pid ${d.pid})`));
+      if (d.name === 'dashboard') dashboardAlive = true;
+      continue;
+    }
+    try { fs.unlinkSync(path.join(RUN_DIR, d.name + '.pid')); } catch { /* already gone */ }
+    const logPath = path.join(LOG_DIR, d.name + '.log');
+    let why = '';
+    try {
+      const tail = fs.readFileSync(logPath, 'utf-8').split('\n').filter(Boolean).slice(-40);
+      const err = tail.reverse().find((l) => /EADDRINUSE|Error|error:/i.test(l));
+      if (/EADDRINUSE/.test(err || '')) why = `port ${cfg.port} is already in use — free it, or set MEMHOUSE_PORT`;
+      else if (err) why = err.trim().slice(0, 200);
+    } catch { /* no log to read */ }
+    console.log(bad(`${d.name} exited immediately${why ? ` — ${why}` : ''}`));
+    if (!why) console.log(`  see ${logPath}`);
+    process.exitCode = 1;
+    // Partial success is the confusing case: exit 1 reads as "nothing started", and the
+    // daemon that DID start keeps running unmentioned.
+    const others = started.filter((o) => o.name !== d.name && alive(o.pid));
+    if (others.length) {
+      console.log(`  ${others.map((o) => o.name).join(' and ')} ${others.length > 1 ? 'are' : 'is'} still running — memhouse stop, if you did not want that`);
+    }
+  }
+  if (dashboardAlive || (pidOf('dashboard') && !started.some((d) => d.name === 'dashboard'))) {
+    console.log(`  dashboard → http://localhost:${cfg.port}`);
+  }
+}
 
 function cmdStop() {
   let stopped = 0;
-  for (const name of ['shipper', 'dashboard', ...LEGACY_DAEMONS]) {
+  for (const name of ['shipper', 'dashboard']) {
     const pid = pidOf(name);
     if (pid) { try { process.kill(pid, 'SIGTERM'); console.log(ok(`${name} stopped (pid ${pid})`)); stopped++; } catch { /* raced */ } }
     try { fs.unlinkSync(path.join(RUN_DIR, name + '.pid')); } catch { /* absent */ }
@@ -943,12 +1215,21 @@ function cmdStop() {
 }
 
 async function cmdStatus() {
-  const cfg = resolveConfig();
+  // requireConfig, not resolveConfig. `status` reads a house and reports its counts as
+  // YOURS, which is exactly the answer that must not come from a guessed URL: with no
+  // config it connected to localhost:8123 as memhouse_root and, wherever that credential
+  // works, printed a stranger's session and message counts as the pilot's own.
+  const cfg = requireConfig(resolveConfig(), 'status');
   const out = {
     config: fs.existsSync(ENV_FILE) ? ENV_FILE : null,
     url: cfg.url, db: cfg.db, user: cfg.user,
     daemons: { shipper: pidOf('shipper'), dashboard: pidOf('dashboard') },
+    dashboard_url: pidOf('dashboard') ? `http://localhost:${runningPort(cfg)}` : null,
     shipper: shipperHealth(),
+    // Which machine this is, in the rooms' own terms. All of a member's machines write
+    // into one set of rooms, so `WHERE host = ...` is how the pilot separates this laptop
+    // from the other one — and they cannot type it if nothing ever prints it.
+    host: require(path.join(REPO_ROOT, 'memhouse', 'host.js')).identity(HOME_DIR),
     connected: false,
   };
   try {
@@ -960,16 +1241,26 @@ async function cmdStatus() {
     out.sessions = Number(s[0]?.sessions || 0);
     out.messages = Number(m[0]?.msgs || 0);
     out.freshest = m[0]?.freshest || null;
-  } catch (e) { out.connected = false; out.error = e.message; }
+  } catch (e) { out.connected = false; out.error = netReason(e); }
 
-  if (JSON_OUT) return console.log(JSON.stringify(out, null, 2));
+  if (JSON_OUT) { console.log(JSON.stringify(out, null, 2)); return out.connected ? 0 : 1; }
   console.log(out.config ? ok(`config: ${out.config}`) : warn('no config (memhouse install)'));
-  console.log(out.connected ? ok(`connected: ${cfg.url} / ${cfg.db} as ${cfg.user}`) : bad(`not connected: ${out.error || cfg.url}`));
+  console.log(out.connected
+    ? ok(`connected: ${cfg.url} / ${cfg.db} as ${cfg.user}`)
+    : bad(`not connected: ${cfg.url} — ${out.error || 'no reason given'}`));
+  if (!out.connected) console.log('  diagnose it with: memhouse doctor');
   if (out.member) console.log(ok(`rooms for '${out.member}'`));
-  if (out.connected) console.log(ok(`house: ${out.sessions} sessions, ${out.messages} messages (freshest ingest ${out.freshest} UTC)`));
+  // The member owns the rooms; the host says which of their machines wrote a row.
+  console.log(ok(`host: ${out.host.id}${out.host.renamed ? ` (this machine now answers to '${out.host.current_hostname}' — the id is kept so its history stays one machine)` : ''}`));
+  if (out.connected && !out.messages) console.log(ok(`house: empty — ${out.sessions} sessions, 0 messages (nothing shipped yet)`));
+  else if (out.connected) console.log(ok(`house: ${out.sessions} sessions, ${out.messages} messages (freshest ingest ${out.freshest} UTC)`));
   console.log(out.shipper.running ? ok(`shipper: running — ${out.shipper.via}`) : warn('shipper: not running'));
   console.log(out.daemons.dashboard ? ok(`dashboard: running (pid ${out.daemons.dashboard})`) : warn('dashboard: not running'));
-  if (out.daemons.dashboard) console.log(`  dashboard → http://localhost:${cfg.port}`);
+  if (out.daemons.dashboard) console.log(`  dashboard → http://localhost:${runningPort(cfg)}`);
+  // Exit non-zero when the house is unreachable. `status` is what a health check, a
+  // cron, or an agent gates on; printing '✗ not connected' and exiting 0 tells every
+  // one of them the house is fine.
+  return out.connected ? 0 : 1;
 }
 
 async function cmdDoctor() {
@@ -980,28 +1271,172 @@ async function cmdDoctor() {
   const [major, minor] = process.versions.node.split('.').map(Number);
   add(major > 20 || (major === 20 && minor >= 19), `node ${process.versions.node}`, 'need >= 20.19');
   add(fs.existsSync(ENV_FILE), `config ${ENV_FILE}`, 'run: memhouse install');
+  // doctor is exempt from requireConfig — diagnosing an unconfigured machine is its job —
+  // but "exempt from refusing" is not "licensed to log in somewhere". With no config it
+  // used to print `✗ config … run: memhouse install` and then attempt an AUTHENTICATED
+  // connection to http://localhost:8123 as memhouse_root, the address every other command
+  // explicitly declines to guess. The server answers AUTHENTICATION_FAILED, which on a
+  // hardened house is a failed-login entry per run — and doctor is the first thing a
+  // confused user types. `discover` still probes 8123, and should: it reports what is
+  // reachable as a DISCOVERY. A check that reports someone else's server as a failure of
+  // your config is a different thing.
+  if (!cfg.stated) {
+    add(false, 'house', 'no config, so there is nothing to connect to — run: memhouse install');
+    for (const label of ['rooms', 'schema', 'sorting keys', 'identity stamping']) {
+      add(false, label, 'skipped — no house configured');
+    }
+    return renderDoctor(checks);
+  }
   try { await ch(cfg, 'SELECT 1', { database: '' }); add(true, `clickhouse reachable (${cfg.url})`); }
-  catch (e) { add(false, `clickhouse reachable (${cfg.url})`, e.message); }
+  catch (e) { add(false, `clickhouse reachable (${cfg.url})`, netReason(e)); }
   let rooms = null;
-  try { rooms = await roomsFor(cfg); } catch (e) { add(false, 'room resolution', e.message); }
-  if (rooms) add(true, `rooms for '${rooms.member}'`);
-  try {
-    // Three rooms. The session rollup every read path goes through is a saved query over
-    // exactly these, so if they are here it is too — there is no fourth object to lose.
-    const objects = ROOM_TYPES.map((t) => rooms[t]);
-    const want = objects.map((n) => `'${n}'`).join(',');
-    const t = (await chRows(cfg, `SELECT name FROM system.tables WHERE database = '${cfg.db}' AND name IN (${want})`, { database: '' })).length;
-    const legacy = t === objects.length ? [] : await looksLikePre040(cfg);
-    add(t === objects.length, `schema: ${t}/${objects.length} rooms in '${cfg.db}' (${objects.join(', ')})`,
-      legacy.length
-        ? `pre-0.4 house (${legacy.join(', ')}) — 0.4 cannot read it; see: memhouse install --help, then ship --full`
-        : `run: memhouse install, or as the owner: node mem-house/per-member/provision.js --member ${rooms.member}`);
-  } catch (e) { add(false, 'schema check', e.message); }
-  try {
-    const u = await chRows(cfg, `SELECT any(user_id) AS u FROM ${rooms.sessions}`);
-    add((u[0]?.u ?? '') !== '' || (await chRows(cfg, `SELECT count() AS c FROM ${rooms.sessions}`))[0].c === 0,
-      `identity stamping (user_id='${u[0]?.u ?? ''}')`, 'writers must use async_insert=0');
-  } catch { add(false, 'identity stamping', 'schema missing?'); }
+  // Room resolution asks the server who you are (SELECT currentUser()). It fails when
+  // the house is unreachable or the credential is rejected — both already reported by
+  // the check above, so name that as the fix rather than repeating the driver's error.
+  try { rooms = await roomsFor(cfg); } catch (e) {
+    add(false, 'room resolution', `${e.message} — fix the connection above first (memhouse install --url … --user … --password …)`);
+  }
+  // "rooms for X" means the NAMES resolved, not that the rooms exist — and it printed a
+  // green tick immediately above `✗ schema: 0/3 rooms`, contradicting the next line.
+  if (rooms) add(true, `member is '${rooms.member}' — rooms would be ${ROOM_TYPES.map((ty) => rooms[ty]).join(', ')}`);
+  // Every check below reads a room NAME, so none of them can run without `rooms`.
+  // Reaching into a null here is how doctor used to print a raw
+  // "Cannot read properties of null (reading 'sessions')" as its hint — a stack-trace
+  // fragment where the fix should be. Skip them, and say why they were skipped.
+  if (!rooms) {
+    add(false, 'schema', 'skipped — room names are unknown until the house answers');
+    add(false, 'identity stamping', 'skipped — same reason');
+  } else {
+    try {
+      // Three rooms. The session rollup every read path goes through is a saved query over
+      // exactly these, so if they are here it is too — there is no fourth object to lose.
+      const objects = ROOM_TYPES.map((t) => rooms[t]);
+      const want = objects.map((n) => `'${n}'`).join(',');
+      const t = (await chRows(cfg, `SELECT name FROM system.tables WHERE database = '${cfg.db}' AND name IN (${want})`, { database: '' })).length;
+      // Name what is MISSING. The parenthesised list used to be what should exist, so
+      // "2/3" was the only signal and you could not tell which room to worry about.
+      const present = new Set((await chRows(cfg, `SELECT name FROM system.tables WHERE database = '${cfg.db}' AND name IN (${want})`, { database: '' })).map((r) => r.name));
+      const absent = objects.filter((n) => !present.has(n));
+      add(t === objects.length, t === objects.length
+        ? `schema: 3/3 rooms in '${cfg.db}' (${objects.join(', ')})`
+        : `schema: ${t}/${objects.length} rooms in '${cfg.db}' — missing ${absent.join(', ')}`,
+        `run: memhouse install, or as the owner: node ${path.join(REPO_ROOT, 'memhouse', 'per-member', 'provision.js')} --member ${rooms.member}`);
+    } catch (e) { add(false, 'schema check', `${e.message} — run: memhouse install`); }
+    // Columns, not just rooms. A room with a column missing accepts every insert and
+    // discards that field — measured, 85 rows shipped with the value thrown away while
+    // ship, install, --ensure-schema and doctor all reported success, because this check
+    // counted rooms.
+    try {
+      const { templateColumns } = require(path.join(REPO_ROOT, 'memhouse', 'shipper', 'ship.js'));
+      const tpl = fs.readFileSync(path.join(REPO_ROOT, 'memhouse', 'per-member', 'schema-member.sql.tpl'), 'utf-8');
+      const want = templateColumns(tpl);
+      // Names AND types AND the MATERIALIZED kind. Comparing names alone left every other
+      // kind of drift invisible, with measured consequences: a `UInt64` column narrowed to
+      // `Int8` stored 200 as **-56**, silently, so token counts and every cost derived
+      // from them were wrong; and `text_ngram` without its MATERIALIZED clause was empty
+      // on all 33 rows, so the FTS column the search skill queries had simply stopped
+      // being populated. Both read `✓ columns: every room matches the schema template`.
+      const missing = [];
+      const wrong = [];
+      let roomsSeen = 0;
+      for (const ty of ROOM_TYPES) {
+        const cols = await chRows(cfg, `SELECT name, type, default_kind FROM system.columns WHERE database = '${cfg.db}' AND table = '${rooms[ty]}'`, { database: '' });
+        if (!cols.length) continue;
+        roomsSeen++;
+        const byName = new Map(cols.map((r) => [r.name, r]));
+        for (const c of (want[ty] || [])) {
+          const got = byName.get(c.name);
+          if (!got) { missing.push(`${rooms[ty]}.${c.name}`); continue; }
+          // The template's declaration is `<type> [DEFAULT x | MATERIALIZED x]`; compare
+          // the type word and, when the template says MATERIALIZED, that the column still is.
+          const wantType = c.type.replace(/\s+(DEFAULT|MATERIALIZED|ALIAS|EPHEMERAL)\b[\s\S]*$/i, '').trim();
+          const wantKind = /\bMATERIALIZED\b/i.test(c.type) ? 'MATERIALIZED' : null;
+          if (wantType && got.type !== wantType) wrong.push(`${rooms[ty]}.${c.name} is ${got.type}, template says ${wantType}`);
+          else if (wantKind && got.default_kind !== 'MATERIALIZED') wrong.push(`${rooms[ty]}.${c.name} lost its MATERIALIZED clause`);
+        }
+      }
+      const bad2 = missing.length + wrong.length;
+      add(bad2 === 0 && roomsSeen === ROOM_TYPES.length,
+        roomsSeen !== ROOM_TYPES.length ? `columns: only ${roomsSeen}/${ROOM_TYPES.length} rooms exist, so the template comparison is incomplete`
+          : bad2 === 0 ? 'columns: every room matches the schema template (name, type and kind)'
+            : `columns: ${missing.length} missing, ${wrong.length} wrong — ${[...missing, ...wrong].slice(0, 4).join('; ')}${bad2 > 4 ? ' …' : ''}`,
+        missing.length && !wrong.length
+          ? 'those fields are being discarded on every ship; heal with: memhouse ship --ensure-schema'
+          : 'a changed type silently corrupts values and a lost MATERIALIZED clause stops a column being computed; the room has to be rebuilt by its owner');
+    } catch (e) { add(false, 'columns', `could not compare against the template: ${e.message}`); }
+
+    // The sorting keys the shipper refuses to write into. doctor is where a house should
+    // learn it needs rebuilding, not the middle of a ship pass.
+    try {
+      const wrongKeys = [];
+      let checked = 0;
+      for (const t of ROOM_TYPES) {
+        const r = await chRows(cfg, `SELECT sorting_key AS k FROM system.tables WHERE database = '${cfg.db}' AND name = '${rooms[t]}'`, { database: '' });
+        const key = r[0]?.k;
+        if (!key) continue;
+        checked++;
+        const want = t !== 'sessions';
+        if (/\borigin\b/.test(key) !== want) wrongKeys.push(`${rooms[t]} (${key})`);
+      }
+      // `checked` matters: every room name that resolved to nothing was skipped by the
+      // `continue` above, so on an empty house this printed a green "sorting keys carry
+      // origin correctly" having examined zero tables — a reassuring tick on the exact
+      // check that a broken house needs to fail.
+      // A room whose sorting_key is empty was SKIPPED by the loop — that is a Merge, a
+      // View, a Log engine, anything that is not the MergeTree this expects. Skipping is
+      // right; calling the result a pass is not. It printed
+      // "✓ sorting keys carry origin correctly (2/3 rooms)" on a house where `ship` then
+      // failed with "DELETE query is not supported for table …". The number was right
+      // there in the green line.
+      if (!checked) add(false, 'sorting keys: no rooms to check', 'create them first: memhouse install');
+      else if (checked < ROOM_TYPES.length) {
+        add(false, `sorting keys: only ${checked}/${ROOM_TYPES.length} rooms are MergeTree — the rest have no sorting key at all`,
+          'a room was replaced by a Merge/View/Log engine; rebuild it from the schema template as the house owner');
+      } else add(wrongKeys.length === 0, `sorting keys${wrongKeys.length ? `: wrong on ${wrongKeys.join(', ')}` : ` carry origin correctly (${checked}/${ROOM_TYPES.length} rooms)`}`,
+        `rebuild those rooms from the schema template, then: memhouse ship --full\n     template: ${path.join(REPO_ROOT, 'memhouse', 'per-member', 'schema-member.sql.tpl')}`);
+    } catch (e) { add(false, 'sorting keys', e.message); }
+    try {
+      // countIf, not any(). `any()` returns an arbitrary row's value, so on a house with
+      // four correctly-stamped rows and one blank it reported a pass five times out of
+      // six — the one check whose whole purpose is to catch unattributed rows. Count them
+      // instead, and say how many: a row with an empty user_id is invisible to every
+      // identity-bound path at once (loadExisting's WHERE, the shipper's clear, reset's
+      // DELETE), so its owner cannot even remove it.
+      // All three rooms. This read only `sessions`, and the two it skipped are where the
+      // shipper writes almost everything — measured, a messages row with an empty user_id
+      // sat there while this printed "all attributed". An unattributed row is invisible to
+      // every identity-bound path at once, including its owner's own reset.
+      let total = 0; let blank = 0;
+      for (const ty of ROOM_TYPES) {
+        const r = (await chRows(cfg, `SELECT count() AS c, countIf(user_id = '') AS blank FROM ${rooms[ty]} FINAL`))[0] || {};
+        total += Number(r.c || 0); blank += Number(r.blank || 0);
+      }
+      add(blank === 0,
+        total === 0 ? 'identity stamping (no rows yet)'
+          : blank === 0 ? `identity stamping (${total} rows across all three rooms, all attributed)`
+            : `identity stamping: ${blank} of ${total} rows have an empty user_id`,
+        'a writer used async_insert=1 — the MATERIALIZED currentUser() stamp does not run during an async flush');
+    } catch { add(false, 'identity stamping', 'schema missing? run: memhouse install'); }
+
+    // Which machines this member's rooms already hold, and whether THIS one is among
+    // them. All of a member's machines write into one set of rooms, so a host id that
+    // has quietly changed shows up here as a second machine that never existed — and
+    // nothing else in the pipeline would ever mention it.
+    try {
+      const me = require(path.join(REPO_ROOT, 'memhouse', 'host.js')).identity(HOME_DIR);
+      const hosts = await chRows(cfg, `SELECT host, count() AS c FROM ${rooms.sessions} FINAL GROUP BY host ORDER BY c DESC`);
+      const mine = hosts.find((h) => h.host === me.id);
+      const others = hosts.filter((h) => h.host !== me.id);
+      add(true,
+        hosts.length === 0
+          ? `host identity ${me.id} (nothing shipped from here yet)`
+          : `host identity ${me.id} — ${mine ? `${mine.c} sessions from this machine` : 'no sessions from this machine yet'}`
+            + (others.length ? `, ${others.length} other host${others.length > 1 ? 's' : ''} in these rooms: ${others.map((h) => `${h.host} (${h.c})`).join(', ')}` : ''));
+      if (me.renamed) {
+        add(true, `host renamed since install — id stays ${me.id}, machine now answers to '${me.current_hostname}'`);
+      }
+    } catch { /* the room read above already reported anything that would break this */ }
+  }
   let adapterErrors = [];
   try {
     const { getAllChats, getAdapterErrors, getMessages } = require(path.join(REPO_ROOT, 'editors'));
@@ -1056,8 +1491,13 @@ async function cmdDoctor() {
     const blocked = adapterErrors.filter((e) => e.missingBinding).map((e) => e.source);
     const failed = adapterErrors.map((e) => e.source);
     add(adapterErrors.length === 0,
-      `adapters: ${seen} sessions visible locally${failed.length ? ` (${failed.length} skipped: ${failed.join(', ')})` : ''}`,
-      blocked.length ? 'npm install -g memhouse --allow-scripts=better-sqlite3'
+      // "visible locally" is what the ADAPTERS see; `stats` reports what the house HOLDS,
+      // and the two differ legitimately — a session that parses to zero messages is
+      // visible and not worth a row. Saying "visible locally" and leaving the reader to
+      // find the other number elsewhere (161 here, 156 there, on a real machine) gives
+      // them no way to tell "correctly skipped" from "silently dropped".
+      `adapters: ${seen} sessions visible locally${failed.length ? ` (${failed.length} skipped: ${failed.join(', ')})` : ''} — compare with what the house holds: memhouse stats`,
+      blocked.length ? installCommand()
         : adapterErrors.length ? adapterErrors.map((e) => `${e.source}: ${e.message}`).join('; ')
           : undefined);
   } catch (e) { add(false, 'adapters', e.message); }
@@ -1082,19 +1522,43 @@ async function cmdDoctor() {
         ? `pricing: every model in this house has a price (${rows.length} models)`
         : `pricing: ${unpriced.length} model${unpriced.length > 1 ? 's' : ''} unpriced — ${share} cost nothing in the dashboard (${unpriced.map((r) => r.model).join(', ')})`,
       'node sync-pricing.js --write   (then re-run doctor)');
+
+    // A source whose rows carry NO tokens costs nothing in the dashboard, which reads as
+    // "this editor is free" rather than "this editor's usage was never parsed". That is
+    // the same shape as the unpriced-model gap above, which once hid $6,919 — except no
+    // price list can fix it, because the numbers were never extracted. zed is the current
+    // case: editors/zed.js contains no usage handling at all.
+    // origin='ship' only. Imported history came from another product that may never have
+    // recorded usage — on this machine four of the five zero-token sources are imports
+    // from memory-house, which is a fact about the past, not an adapter that needs fixing.
+    // Naming them alongside a live adapter gap makes the real one easy to dismiss.
+    const zero = await chRows(cfg,
+      `SELECT source, count() AS n FROM ${rooms.messages} FINAL WHERE role = 'assistant' AND origin = 'ship' GROUP BY source HAVING sum(input_tokens) + sum(output_tokens) = 0 ORDER BY source`);
+    const zeroImported = await chRows(cfg,
+      `SELECT count() AS n FROM ${rooms.messages} FINAL WHERE role = 'assistant' AND origin != 'ship' AND input_tokens = 0 AND output_tokens = 0`);
+    const impN = Number(zeroImported[0]?.n || 0);
+    add(zero.length === 0,
+      zero.length === 0
+        ? `token capture: every editor shipping into this house reports usage${impN ? ` (${impN} imported messages carry none — historical, not fixable here)` : ''}`
+        : `token capture: ${zero.map((r) => `${r.source} (${r.n} messages)`).join(', ')} ship ZERO tokens — their cost shows as $0, not as unknown`,
+      'that adapter does not extract usage; the messages are stored, the numbers are not');
   } catch { /* a house that cannot be read is already reported above */ }
   const sh = shipperHealth();
   add(sh.running, `shipper${sh.via ? ` — ${sh.via}` : ''}`, 'memhouse start (or: memhouse service install)');
   add(!!pidOf('dashboard'), 'dashboard daemon', 'memhouse start');
   add(fs.existsSync(path.join(REPO_ROOT, 'public', 'index.html')), 'dashboard UI built', 'built automatically by memhouse start');
 
+  return renderDoctor(checks);
+}
+
+function renderDoctor(checks) {
   for (const c of checks) console.log(c.ok ? ok(c.label) : bad(`${c.label}${c.hint ? ` — ${c.hint}` : ''}`));
   return checks.every((c) => c.ok) ? 0 : 1;
 }
 
 async function cmdSearch() {
   if (!positional.length) { console.log('usage: memhouse search <terms…>'); return 2; }
-  const cfg = resolveConfig();
+  const cfg = requireConfig(resolveConfig(), 'search');
   const needle = positional.join(' ').toLowerCase().replace(/[%_\\]/g, '\\$&').replace(/'/g, "\\'");
   const r = await roomsFor(cfg);
   const rows = await chRows(cfg, `
@@ -1107,47 +1571,376 @@ async function cmdSearch() {
   if (JSON_OUT) return console.log(JSON.stringify(rows, null, 2));
   if (!rows.length) return console.log(warn('no matches'));
   for (const r of rows) {
-    console.log(`\x1b[1m${r.session_id.slice(0, 8)}\x1b[0m  ${r.source}  ${r.project || '-'}  ${r.at}  (${r.hits} hits)`);
+    // The full id. It was sliced to 8 characters, which for claude-code renders every hit
+    // as the literal string "claude-c" — while the shipped prompt tells agents to cite the
+    // session_id and to replay with `WHERE session_id = '<id>'`. Neither is possible from
+    // a prefix, and the prefix is not even distinguishing.
+    console.log(`\x1b[1m${r.session_id}\x1b[0m  ${r.source}  ${r.project || '-'}  ${r.at}  (${r.hits} hit${r.hits === 1 ? '' : 's'})`);
     console.log(`  ${r.snippet.replace(/\s+/g, ' ')}`);
   }
 }
 
-function cmdPlugins() {
-  const sub = positional[0] || 'list';
-  const target = flags.target || process.env.CLAUDE_CONFIG_DIR || path.join(os.homedir(), '.claude');
-  const skillsSrc = path.join(DELIVERY, 'skills');
-  const names = fs.readdirSync(skillsSrc);
-  const dstSkills = path.join(target, 'skills');
-  if (sub === 'list') {
-    console.log(`skills available: ${names.join(', ')}`);
-    for (const n of names) {
-      console.log(fs.existsSync(path.join(dstSkills, n)) ? ok(`${n} installed in ${dstSkills}`) : warn(`${n} not installed (memhouse plugins install claude)`));
+// `search` finds the session; this hands the pilot back into it. memhouse has been a
+// read-only archive — you could find the conversation that solved this before and not
+// return to it.
+//
+// It PRINTS the command and does not run it, and that is the whole design. Running it would
+// have to guess a terminal, inherit this process's cwd, and hope the id is still live; when
+// any of that is wrong the CLI does not fail, it opens a NEW session — the pilot loses the
+// transcript they asked for while the tool reports success. Printed, the pilot reads it,
+// pastes it, and owns the result.
+async function cmdResume() {
+  if (!positional.length) {
+    console.log('usage: memhouse resume <session-id>    (the id search and the dashboard print)');
+    return 2;
+  }
+  const cfg = requireConfig(resolveConfig(), 'resume');
+  const { resumeFor } = require(path.join(REPO_ROOT, 'memhouse', 'resume'));
+  // Same escaping as search: this value is interpolated into SQL, and a session id is not
+  // guaranteed to be tame — it comes from whatever the editor wrote on disk.
+  const want = positional[0].replace(/[\\']/g, '\\$&');
+  const r = await roomsFor(cfg);
+  // Two ways to name a session, because there are two ways it gets in front of the pilot:
+  // the canonical `<source>:<id>` that search and the prompt print, and the bare native id
+  // that the editor's own UI shows. FINAL because sessions is a ReplacingMergeTree and a
+  // re-shipped session has an older row underneath — without it a moved project resolves to
+  // the folder it used to live in.
+  const rows = await chRows(cfg, `
+    SELECT session_id, source, folder, name, origin,
+           formatDateTime(last_updated_at, '%Y-%m-%d %H:%i') AS at
+    FROM ${r.sessions} FINAL
+    WHERE session_id = '${want}' OR session_id LIKE '%:${want}'
+    ORDER BY last_updated_at DESC LIMIT 5`);
+
+  if (!rows.length) {
+    if (JSON_OUT) return console.log(JSON.stringify({ error: 'no such session', session_id: positional[0] }, null, 2));
+    console.log(bad(`no session '${positional[0]}' in ${r.sessions}`));
+    console.log('  find one with: memhouse search <terms>');
+    return 1;
+  }
+  // A bare native id can match more than one source. Say so instead of picking — resuming
+  // the wrong editor's session of the same name is exactly the silent-wrong-answer this
+  // command exists to avoid.
+  if (rows.length > 1) {
+    if (JSON_OUT) return console.log(JSON.stringify({ error: 'ambiguous', matches: rows }, null, 2));
+    console.log(warn(`'${positional[0]}' matches ${rows.length} sessions — name one exactly:`));
+    for (const s of rows) console.log(`  ${s.session_id}  ${s.at}  ${s.name || '-'}`);
+    return 1;
+  }
+
+  const row = rows[0];
+  const res = resumeFor(row);
+  if (JSON_OUT) return console.log(JSON.stringify({ ...row, ...res }, null, 2));
+  // `last_updated_at` is Nullable and some imported rows carry no timestamp, which
+  // formatDateTime returns as JSON null — printed raw it reads as the literal word 'null'
+  // sitting where a date belongs.
+  console.log(`\x1b[1m${row.session_id}\x1b[0m  ${row.at || '-'}  ${row.name || '-'}`);
+  if (!res.ok) {
+    console.log(bad(res.reason));
+    // The folder is still worth printing: for a GUI editor it is the one actionable thing
+    // memhouse knows, and opening it is what the pilot would do next anyway.
+    if (res.folder) console.log(`  the session ran in: ${res.folder}`);
+    return 1;
+  }
+  console.log('');
+  console.log(`  ${res.command}`);
+  console.log('');
+  if (!res.folder) console.log(warn('no folder was recorded for this session — run it from the right directory yourself'));
+  return 0;
+}
+
+// Which kind of installation is this process running out of? Every upgrade path below
+// depends on the answer, and getting it wrong is not a no-op: running `git pull` in a
+// global install does nothing visible, and `npm i -g` from a checkout installs the
+// PUBLISHED version over the branch the pilot was testing.
+function installKind() {
+  const root = fs.realpathSync(REPO_ROOT);
+  // npx unpacks into a cache directory keyed by a hash. Nothing there is upgradable — the
+  // next `npx memhouse` resolves the registry again — and re-execing daemons out of a cache
+  // entry that npm may evict is how a daemon ends up running from a directory that no
+  // longer exists.
+  if (/[/\\]_npx[/\\]/.test(root)) return { kind: 'npx', root };
+  if (fs.existsSync(path.join(root, '.git'))) return { kind: 'checkout', root };
+  if (/[/\\]node_modules[/\\]memhouse$/.test(root)) {
+    // Global vs a project dependency. `npm prefix -g` is the only thing that tells them
+    // apart, and it is worth the spawn: `npm i -g` from inside someone's project
+    // dependency upgrades a different copy than the one they just ran.
+    try {
+      const p = spawnSync('npm', ['prefix', '-g'], { encoding: 'utf-8' });
+      const prefix = (p.stdout || '').trim();
+      if (prefix && root.startsWith(fs.realpathSync(prefix))) return { kind: 'global', root };
+    } catch { /* fall through */ }
+    return { kind: 'local-dep', root };
+  }
+  return { kind: 'unknown', root };
+}
+
+// `npm i -g memhouse@latest` upgrades the files and nothing else: the flag that keeps five
+// adapters alive has to be repeated, the daemons keep executing the version they booted
+// with, and a house provisioned by an older shipper can be missing a room this one needs.
+// Each of those has cost a real machine real sessions. This command owns all three.
+async function cmdUpdate() {
+  const { kind, root } = installKind();
+  const latest = await (async () => {
+    try {
+      const res = await fetch('https://registry.npmjs.org/memhouse/latest', { signal: AbortSignal.timeout(8000) });
+      return res.ok ? (await res.json()).version : null;
+    } catch { return null; }
+  })();
+
+  if (JSON_OUT && flags.check) return console.log(JSON.stringify({ kind, root, current: PKG.version, latest }, null, 2));
+  console.log(`  installed  ${PKG.version}  (${kind}: ${root})`);
+  console.log(`  latest     ${latest || 'unknown — the registry did not answer'}`);
+  if (latest && latest === PKG.version && kind !== 'checkout') console.log(ok('already current'));
+  if (flags.check) return 0;
+
+  if (kind === 'npx') {
+    console.log(warn('nothing to update — npx resolves the registry on every run'));
+    console.log('  to keep a version around: npm install -g memhouse --allow-scripts=better-sqlite3');
+    return 1;
+  }
+  if (kind === 'local-dep') {
+    console.log(warn('this is a project dependency, not a global install'));
+    console.log(`  upgrade it where it lives: npm install memhouse@latest --allow-scripts=better-sqlite3`);
+    return 1;
+  }
+
+  // Whether the daemons were OURS matters after the upgrade, not before: a service-managed
+  // shipper must be restarted through its supervisor, and pidfile daemons only come back if
+  // something restarts them. Read it first — `stop` erases the evidence.
+  let svc = { installed: false, running: false };
+  try { svc = require(path.join(REPO_ROOT, 'memhouse', 'service.js')).status(); } catch { /* unsupported platform */ }
+  const wasRunning = { shipper: !!pidOf('shipper'), dashboard: !!pidOf('dashboard') };
+
+  if (kind === 'checkout') {
+    // The stale-UI case, and it is checkout-only: a published tarball ships public/ built by
+    // prepack, but `git pull` updates ui/src and leaves the old bundle in public/ — so the
+    // dashboard serves the previous release however many times it is restarted.
+    const steps = [
+      ['git', ['pull', '--ff-only']],
+      ['npm', ['install', '--no-audit', '--no-fund']],
+      ['npm', ['run', 'build']],
+    ];
+    for (const [bin, args] of steps) {
+      const r = spawnSync(bin, args, { cwd: root, stdio: 'inherit' });
+      if (r.status !== 0) {
+        console.log(bad(`${bin} ${args.join(' ')} failed — stopping here, nothing was restarted`));
+        return 1;
+      }
     }
-  } else if (sub === 'install' && positional[1] === 'claude') {
-    fs.mkdirSync(dstSkills, { recursive: true });
-    for (const n of names) fs.cpSync(path.join(skillsSrc, n), path.join(dstSkills, n), { recursive: true });
-    console.log(ok(`installed ${names.length} skills into ${dstSkills} (${names.join(', ')})`));
-  } else if (sub === 'remove' && positional[1] === 'claude') {
-    let removed = 0;
-    for (const n of names) { const p = path.join(dstSkills, n); if (fs.existsSync(p)) { fs.rmSync(p, { recursive: true }); removed++; } }
-    console.log(ok(`removed ${removed} skills from ${dstSkills}`));
   } else {
-    console.log('usage: memhouse plugins [list | install claude | remove claude] [--target DIR]');
-    return 2;
+    // --allow-scripts is not optional and not remembered: npm >= 12 blocks install scripts
+    // by default, so an upgrade without it leaves better-sqlite3 with no binding and the
+    // five SQLite-backed adapters read zero sessions on every pass afterwards.
+    const r = spawnSync('npm', ['install', '-g', 'memhouse@latest', '--allow-scripts=better-sqlite3'], { stdio: 'inherit' });
+    if (r.status !== 0) {
+      console.log(bad('npm install failed — nothing was restarted, the running version is unchanged'));
+      console.log('  if it was EACCES: ls -ld "$(npm prefix -g)" — root-owned needs sudo, yours needs a chown');
+      return 1;
+    }
+  }
+  console.log(ok('files updated'));
+
+  // Restarting is the half a bare `npm i -g` leaves undone. The daemons notice on their own
+  // within a loop interval (memhouse/self-update.js), but a pilot who typed `update` should
+  // not have to wait for it, and the dashboard's stale bundle is visible immediately.
+  if (svc.installed) {
+    console.log(warn(`the shipper is service-managed (${svc.kind}) — restart it to pick this up:`));
+    console.log(svc.kind === 'systemd'
+      ? '  systemctl --user restart memhouse-shipper'
+      : '  launchctl kickstart -k gui/$(id -u)/com.memhouse.shipper');
+  }
+  if (wasRunning.shipper || wasRunning.dashboard) {
+    cmdStop();
+    await cmdStart();
+  } else if (!svc.installed) {
+    console.log(warn('no daemons were running — start them with: memhouse start'));
+  }
+
+  // A shipper from a newer release can need a column an older house does not have. The
+  // shipper reports the drift and prints the rebuild; running it here means the pilot
+  // learns at upgrade time rather than from a warning in a log nobody reads.
+  const cfg = resolveConfig();
+  if (cfg.url && cfg.user) {
+    const code = run(SHIP_JS, ['--ensure-schema'], cfg);
+    if (code !== 0) { console.log(warn('the house schema needs attention — memhouse doctor')); return code; }
   }
   return 0;
 }
 
+// Every Claude Code instance on this machine, not just the default one.
+//
+// A pilot rarely has one. `~/.claude` is the stock install, `CLAUDE_CONFIG_DIR` points at
+// whichever they are running right now, and Kommander-style playbooks live under
+// `~/.claude-playbooks/<name>[/playbook]`, each a complete config directory with its own
+// skills/. Installing into one and calling it done leaves /memhouse:search missing from
+// every other instance the pilot uses — silently, because a missing skill does not announce
+// itself, it just never appears.
+//
+// The discovery is the ADAPTER's (editors/claude.js discoverClaudeRoots), reused rather
+// than reimplemented: it already ports memory-house's discover_roots and runs on every
+// ship. A second copy here would drift the first time a playbook layout changes — which is
+// the same defect this repo just retired in install.sh.
+function claudeTargets() {
+  const seen = new Map(); // realpath -> { dir, why }
+  const add = (dir, why) => {
+    if (!dir) return;
+    let isDir = false;
+    try { isDir = fs.statSync(dir).isDirectory(); } catch { /* missing */ }
+    if (!isDir) return;
+    let rp; try { rp = fs.realpathSync(dir); } catch { rp = dir; }
+    if (!seen.has(rp)) seen.set(rp, { dir, why });
+  };
+  // The instance the caller is running under comes first, and is NOT subject to the
+  // adapter's "has this been used?" test — a fresh config dir has no projects/ yet, and it
+  // is exactly where the pilot wants the skills.
+  add(process.env.CLAUDE_CONFIG_DIR, 'CLAUDE_CONFIG_DIR');
+  add(path.join(os.homedir(), '.claude'), 'default');
+  try {
+    const { discoverClaudeRoots } = require(path.join(REPO_ROOT, 'editors', 'claude'));
+    for (const r of discoverClaudeRoots()) add(r, 'playbook');
+  } catch { /* adapter unavailable — the two above still stand */ }
+  return [...seen.values()];
+}
+
+const short = (p) => p.replace(os.homedir(), '~');
+const PLUGIN_MARK = path.join('skills', 'memhouse', '.claude-plugin', 'plugin.json');
+const isPluginInstalled = (dir) => fs.existsSync(path.join(dir, PLUGIN_MARK));
+
+function installPluginInto(dir) {
+  const dst = path.join(dir, 'skills', 'memhouse');
+  fs.mkdirSync(dst, { recursive: true });
+  fs.cpSync(path.join(DELIVERY, 'plugin'), dst, { recursive: true });
+  return dst;
+}
+
+// Which instances to act on. EVERYTHING IS SELECTED BY DEFAULT: with several Claude
+// installs the answer is almost always "all of them", and a pilot who wanted one would have
+// passed --target. Numbers narrow it, 'n' skips.
+//
+// No prompt at all when there is nothing to choose (one target), when an agent is driving
+// (--yes / --json), or when there is no terminal to answer with — a blocked prompt in a
+// script is a hang, not a question.
+async function chooseTargets(targets, verb) {
+  if (targets.length === 1 || flags.yes === true || JSON_OUT || !process.stdin.isTTY) return targets;
+  console.log('');
+  targets.forEach((t, i) => {
+    const state = isPluginInstalled(t.dir) ? 'already installed — will be refreshed' : t.why;
+    console.log(`  ${i + 1}) ${short(t.dir)}  (${state})`);
+  });
+  const a = (await ask(`${verb} all ${targets.length}? (Y/n, or numbers like "1 3")`, 'Y')).trim().toLowerCase();
+  if (a === 'n' || a === 'no') return [];
+  if (a === 'y' || a === 'yes' || a === '') return targets;
+  const picked = [...new Set(a.split(/[\s,]+/).map(Number).filter((n) => Number.isInteger(n) && n >= 1 && n <= targets.length))];
+  // An unparseable answer must not quietly mean "all" — that would install into places the
+  // pilot was in the middle of narrowing down. Say so and take none.
+  if (!picked.length) { console.log(warn(`did not understand '${a}' — nothing selected`)); return []; }
+  return picked.map((n) => targets[n - 1]);
+}
+
+// Install the skills as a PLUGIN, not as three loose skill directories.
+//
+// Claude Code gives a skill a namespace only when it arrives inside a plugin: a directory
+// under <config>/skills/ containing .claude-plugin/plugin.json loads as
+// `memhouse@skills-dir` and its skills become /memhouse:search, /memhouse:sessions,
+// /memhouse:sql. Copied in flat, the same three files register as unrelated top-level
+// skills named after their folders — which is what this used to do, while plugin.json sat
+// unread one directory away claiming the colon form. Driving a real Claude Code is what
+// caught it: `/memhouse:search` answered `Unknown command. Did you mean /memhouse-search?`
+async function cmdPlugins() {
+  const sub = positional[0] || 'list';
+  const pluginSrc = path.join(DELIVERY, 'plugin');
+  const names = fs.readdirSync(path.join(pluginSrc, 'skills'));
+  const invocations = names.map((n) => `/memhouse:${n}`).join(', ');
+  // --target overrides the discovery rather than joining it: given one, that is the only
+  // directory touched.
+  const targets = flags.target ? [{ dir: flags.target, why: '--target' }] : claudeTargets();
+  // Whatever --target was given has to reappear in the advice, or pasting it installs
+  // somewhere else than the directory just inspected.
+  const self = `memhouse plugins install claude${flags.target ? ` --target ${flags.target}` : ''}`;
+
+  if (sub === 'list') {
+    console.log(`skills available: ${invocations}`);
+    if (!targets.length) { console.log(warn('no Claude Code config directory found')); return 0; }
+    for (const t of targets) {
+      console.log(isPluginInstalled(t.dir)
+        ? ok(`installed in ${short(t.dir)} (${t.why})`)
+        : warn(`not installed in ${short(t.dir)} (${t.why})`));
+    }
+    if (!targets.some((t) => isPluginInstalled(t.dir))) console.log(`  install with: ${self}`);
+    return 0;
+  }
+
+  if (sub === 'install' && positional[1] === 'claude') {
+    if (!targets.length) {
+      console.log(warn('no Claude Code config directory found — nothing to install into'));
+      console.log('  name one explicitly with --target DIR');
+      return 1;
+    }
+    const chosen = await chooseTargets(targets, 'Install');
+    if (!chosen.length) { console.log(warn('nothing installed')); return 0; }
+    for (const t of chosen) console.log(ok(`installed ${names.length} skills into ${short(installPluginInto(t.dir))}`));
+    console.log(`  loads as memhouse@skills-dir next session — invoke ${invocations}`);
+    return 0;
+  }
+
+  if (sub === 'remove' && positional[1] === 'claude') {
+    const installed = targets.filter((t) => isPluginInstalled(t.dir));
+    if (!installed.length) { console.log(warn('nothing installed in any Claude config directory')); return 0; }
+    const chosen = await chooseTargets(installed, 'Remove from');
+    if (!chosen.length) { console.log(warn('nothing removed')); return 0; }
+    for (const t of chosen) {
+      fs.rmSync(path.join(t.dir, 'skills', 'memhouse'), { recursive: true });
+      // Remove the now-empty skills/ we created, but never a skills/ holding someone
+      // else's work.
+      try { fs.rmdirSync(path.join(t.dir, 'skills')); } catch { /* not empty: leave it */ }
+      console.log(ok(`removed ${short(path.join(t.dir, 'skills', 'memhouse'))}`));
+    }
+    return 0;
+  }
+
+  console.log('usage: memhouse plugins [list | install claude | remove claude] [--target DIR] [--yes]');
+  return 2;
+}
+
 async function cmdReset() {
-  const cfg = resolveConfig();
+  const cfg = requireConfig(resolveConfig(), 'reset');
   const r = await roomsFor(cfg);
   const targets = ROOM_TYPES.map((t) => r[t]);
+
+  // Imported rows are NOT the shipper's to remove, and reset is a re-ship: whatever it
+  // deletes has to be something re-shipping puts back. An import cannot be — it came from
+  // an older house, another product, or a machine that no longer exists. Scoped to
+  // origin='ship' by default, therefore, exactly like the shipper's per-session clear.
+  //
+  // This path was missed when that clear was fixed, and it is the one place the 0.4.4 data
+  // loss survived: `reset --yes` took a house from 2 imported rows to 0 while the prompt
+  // said only "truncates … and re-ships". --all-origins still allows it, but nobody
+  // reaches it by accident, and the count is named before it happens.
+  const allOrigins = flags['all-origins'] === true;
+  let imported = 0;
+  try {
+    // Same predicate the DELETE uses. Counted without an owner filter, this warned
+    // "removing 2 imported row(s)" and then removed none of them — rows imported by an
+    // ADMIN during a migration carry the admin's user_id, so a member's DELETE cannot
+    // reach them. The prompt was wrong in the alarming direction.
+    const esc0 = (await chRows(cfg, 'SELECT currentUser() AS u'))[0]?.u?.replace(/\\/g, '\\\\').replace(/'/g, "\\'") || '';
+    const counts = await Promise.all(targets.map(async (t) =>
+      Number((await chRows(cfg, `SELECT count() AS c FROM ${t} FINAL WHERE origin != 'ship' AND (user_id = '${esc0}' OR user_id = '')`))[0]?.c || 0)));
+    imported = counts.reduce((a, b) => a + b, 0);
+  } catch { /* pre-origin house: nothing to protect, ensureSchema will add the column */ }
+
   if (flags.yes !== true) {
     // Name the rooms. Under the per-member layout this only ever empties the caller's own,
     // and "ALL rows in 'mem'" would misdescribe that in the alarming direction.
-    const a = (await ask(`This truncates ${targets.join(', ')} in '${cfg.db}' and re-ships. Continue? (yes/no)`, 'no')).toLowerCase();
+    const scope = allOrigins
+      ? `EVERY row, including ${imported} imported one(s) that re-shipping CANNOT restore,`
+      : 'the rows the shipper wrote';
+    const a = (await ask(`This clears ${scope} from ${targets.join(', ')} in '${cfg.db}' and re-ships. Continue? (yes/no)`, 'no')).toLowerCase();
     if (a !== 'yes' && a !== 'y') return console.log('aborted'), 1;
   }
+  if (allOrigins && imported) console.log(warn(`removing ${imported} imported row(s) — re-shipping will not bring them back`));
+  else if (imported) console.log(`  keeping ${imported} imported row(s) (--all-origins removes them too)`);
   // DELETE, not TRUNCATE. Historically for two reasons:
   //   * TRUNCATE is its own privilege, and a member provisioned under the pre-0.4 grant
   //     set (SELECT, INSERT and the two ALTER grants) did not hold it — so `reset` failed
@@ -1163,21 +1956,28 @@ async function cmdReset() {
   const uid = (await chRows(cfg, 'SELECT currentUser() AS u'))[0]?.u;
   if (!uid) return console.log(bad('could not determine currentUser() — refusing to reset')), 1;
   const esc = uid.replace(/\\/g, '\\\\').replace(/'/g, "\\'");
-  for (const t of targets) await ch(cfg, `DELETE FROM ${t} WHERE user_id = '${esc}'`);
-  console.log(ok(`cleared ${uid}'s rows from ${targets.join(', ')}`));
+  const originScope = allOrigins ? '' : " AND origin = 'ship'";
+  // `OR user_id = ''` because rows written under async_insert=1 never got the
+  // MATERIALIZED currentUser() stamp, and a DELETE bound to the caller's name cannot
+  // reach them — so `reset --all-origins`, whose prompt says "EVERY row", left them
+  // behind and only an admin could clear them. Safe to include here and nowhere else:
+  // these rooms are named for one member, so an unattributed row IN THIS ROOM is theirs
+  // by construction. The shipper's per-session clear deliberately does NOT do this — it
+  // only ever removes what it wrote, and it always writes with async_insert=0.
+  const owner = `(user_id = '${esc}' OR user_id = '')`;
+  for (const t of targets) await ch(cfg, `DELETE FROM ${t} WHERE ${owner}${originScope}`);
+  console.log(ok(`cleared ${uid}'s ${allOrigins ? '' : 'shipped '}rows from ${targets.join(', ')}`));
   return run(SHIP_JS, ['--full'], cfg);
 }
 
-function cmdUninstall() {
+async function cmdUninstall() {
   // The OS service first, and this is not tidiness: it outlives the pidfile daemons by
   // design, it holds the credential inlined in its unit file, and it restarts itself. An
   // uninstall that stopped only the daemons would report success while a service kept
   // shipping transcripts — with a credential in a file the user now believes is gone.
-  const svc = require(path.join(REPO_ROOT, 'mem-house', 'service.js'));
+  const svc = require(path.join(REPO_ROOT, 'memhouse', 'service.js'));
   const st = svc.status();
-  // `legacy` too: a machine that ran the solo tier can have a stale unit and no current
-  // one, and skipping the service step there leaves it enabled over a deleted home.
-  if (st.kind && (st.installed || (st.legacy || []).length)) {
+  if (st.kind && st.installed) {
     const r = svc.uninstall();
     if (!r.ok) {
       // Removing the home now would delete the env file while a service keeps shipping
@@ -1190,17 +1990,90 @@ function cmdUninstall() {
     console.log(ok(`service removed (${r.kind})`));
   }
   cmdStop();
-  if (fs.existsSync(HOME_DIR)) fs.rmSync(HOME_DIR, { recursive: true });
-  console.log(ok(`removed ${HOME_DIR} (the house data in ClickHouse is untouched)`));
+
+  // Three tiers, and the default is the conservative one.
+  //
+  // This used to delete MEMHOUSE_HOME outright, which made "stop the daemons" and "forget
+  // the house I connect to, and who this machine is" the same command. They are not the
+  // same intent. Stopping the shipper is routine — before an upgrade, while debugging,
+  // when a laptop should go quiet for a week. Discarding the credential is a decision, and
+  // dropping the host fingerprint silently re-labels every row this machine ships after.
+  //
+  //   (default)         daemons, service, runtime state. Config and identity KEPT.
+  //   --credentials     also forget the house: the env file, with its password.
+  //   --full-removal    all of MEMHOUSE_HOME, fingerprint included. The next install is a
+  //                     NEW host whose rows do not join this machine's history.
+  //
+  // No tier touches the house: transcripts live in ClickHouse and re-ship from the local
+  // session stores regardless.
+  const hostjs = require(path.join(REPO_ROOT, 'memhouse', 'host.js'));
+  const full = flags['full-removal'] === true;
+  const creds = full || flags.credentials === true;
+  const hostFile = hostjs.filePath(HOME_DIR);
+
+  if (!fs.existsSync(HOME_DIR)) {
+    console.log(ok('daemons stopped — no state directory to remove'));
+    return;
+  }
+
+  if (full) {
+    // The only tier that discards the machine's identity, so the only one that asks.
+    // Re-installing afterwards starts a second host inside the same rooms, and nothing
+    // later can stitch the two halves together.
+    if (flags.yes !== true && process.stdin.isTTY) {
+      const id = hostjs.read(HOME_DIR);
+      console.log(warn(`--full-removal also discards this machine's host identity${id ? ` (${id.id})` : ''}.`));
+      console.log('  Rows already shipped keep that name, a future install gets a new one, and');
+      console.log("  this machine then reads as two. Your transcripts themselves are safe.");
+      const a = (await ask('Remove everything, including the host identity? (yes/no)', 'no')).toLowerCase();
+      if (a !== 'yes' && a !== 'y') { console.log('aborted — daemons are stopped, nothing was removed'); return; }
+    }
+    fs.rmSync(HOME_DIR, { recursive: true });
+    console.log(ok(`removed ${short(HOME_DIR)} entirely — config, credential and host identity`));
+    console.log('  the house data in ClickHouse is untouched');
+    return;
+  }
+
+  // Runtime state only: pidfiles and logs. The next `start` rebuilds both, and neither is
+  // worth keeping once nothing is running.
+  for (const d of ['run', 'logs']) {
+    const p = path.join(HOME_DIR, d);
+    if (fs.existsSync(p)) fs.rmSync(p, { recursive: true });
+  }
+  console.log(ok('removed runtime state (pidfiles, logs)'));
+
+  if (creds) {
+    if (fs.existsSync(ENV_FILE)) {
+      fs.rmSync(ENV_FILE);
+      console.log(ok(`removed ${short(ENV_FILE)} — the house connection and its credential`));
+    } else {
+      console.log(warn('no config file to remove'));
+    }
+  } else if (fs.existsSync(ENV_FILE)) {
+    console.log(ok(`kept ${short(ENV_FILE)} — the house connection and its credential`));
+    console.log('  forget it too with: memhouse uninstall --credentials');
+  }
+
+  if (fs.existsSync(hostFile)) {
+    console.log(ok(`kept ${short(hostFile)} — this machine's identity, so a reinstall continues its history`));
+    console.log('  remove everything with: memhouse uninstall --full-removal');
+  }
+  console.log('  the house data in ClickHouse is untouched');
 }
 
 // ── dispatch ────────────────────────────────────────────────────────────────────
 (async () => {
+  // Single-dash flags are not parsed (only `--x`), so `-v` arrives as a positional. Both
+  // spellings are what people type for a version.
+  if (flags.version === true || process.argv.slice(2).some((a) => a === '-v' || a === '-V')) {
+    console.log(PKG.version); return;
+  }
   const cfg = resolveConfig();
-  if (legacySoloGuard()) { process.exitCode = 2; return; }
 
   switch (cmd) {
     case null: case 'help': console.log(HELP); break;
+    // `--version` and `-v` land here as flags, not as the `version` verb, so they used to
+    // fall through to HELP: forty lines of help and exit 0 is not what --version means.
     case 'version': console.log(PKG.version); break;
     case 'discover': await cmdDiscover(); break;
     case 'onboard': process.exitCode = await cmdOnboard(); break;
@@ -1210,10 +2083,27 @@ function cmdUninstall() {
       // --port overrides, already resolved into cfg) skips every prompt so
       // agents/CI can rewrite the config non-interactively.
       const c = { ...cfg };
+      // `install` refuses to guess http://localhost:8123 as memhouse_root, with a comment
+      // explaining why; `setup --yes` wrote precisely that config in one command, exit 0,
+      // and five Enters through the interactive form did the same. A guard at one command
+      // is not a guard.
+      if (!cfg.stated && flags.yes === true) {
+        console.log(bad('no house given: --url and --user are required with --yes'));
+        console.log('  setup will not write http://localhost:8123 as memhouse_root into your config.');
+        // 2, like every other no-config refusal. A script gating on the exit code got a
+        // different answer from these two commands than from the other eight.
+        process.exitCode = 2;
+        break;
+      }
       if (flags.yes !== true) {
-        c.url = await ask('  ClickHouse URL', c.url);
-        c.user = await ask('  user', c.user);
-        c.password = await ask('  password', c.password);
+        c.url = await ask('  ClickHouse URL', cfg.stated ? c.url : '');
+        c.user = await ask('  user', cfg.stated ? c.user : '');
+        if (!c.url || !c.user) {
+          console.log(bad('a URL and a user are required — memhouse will not pick a house for you'));
+          process.exitCode = 1;
+          break;
+        }
+        c.password = await askSecret('  password', c.password);
         c.db = await ask('  database (the house)', c.db);
         c.port = await ask('  dashboard port', c.port);
       }
@@ -1227,41 +2117,57 @@ function cmdUninstall() {
       break;
     }
     case 'ship': {
+      requireConfig(cfg, 'ship');
       const args = [];
+      // --ensure-schema was accepted by the parser and never forwarded, so asking for a
+      // schema-only rollout shipped 398 sessions instead and exited 0.
+      if (flags['ensure-schema'] === true) args.push('--ensure-schema');
       if (flags.full === true) args.push('--full');
       if (flags.loop !== undefined) { args.push('--loop'); if (flags.loop !== true) args.push(String(flags.loop)); }
       process.exitCode = run(SHIP_JS, args, cfg);
       break;
     }
-    case 'stats': process.exitCode = run(SHIP_JS, ['--stats'], cfg); break;
+    case 'stats': requireConfig(cfg, 'stats'); process.exitCode = run(SHIP_JS, ['--stats'], cfg); break;
     case 'start': await cmdStart(); break;
     case 'stop': cmdStop(); break;
-    case 'status': await cmdStatus(); break;
+    case 'status': process.exitCode = await cmdStatus(); break;
     case 'doctor': process.exitCode = await cmdDoctor(); break;
     case 'search': process.exitCode = await cmdSearch(); break;
+    case 'resume': process.exitCode = await cmdResume(); break;
+    case 'update': process.exitCode = await cmdUpdate(); break;
     // The session rollup is a saved query, not an object, so there is no name an agent
     // or a skill can put in a FROM clause. This prints it, resolved for whoever the
     // configured credential is — the substitute for that name.
     case 'sessions-query': {
-      const cfg = resolveConfig();
+      const cfg = requireConfig(resolveConfig(), 'sessions-query');
       const r = await roomsFor(cfg);
+      // On STDOUT and inside the SQL. This used to go to stderr, so `sessions-query >
+      // q.sql` kept the query and dropped the instruction it depended on. The rollup now
+      // carries FINAL and join_use_nulls itself, so the note is provenance, not a warning.
+      if (!JSON_OUT) console.log(`-- memhouse rollup for '${r.member}' — self-contained (FINAL + join_use_nulls).`);
       console.log(r.sessions_v);
-      if (!JSON_OUT) {
-        console.error(`-- rollup for '${r.member}'. Read with final=1 and join_use_nulls=1.`);
-      }
       break;
     }
-    case 'plugins': process.exitCode = cmdPlugins(); break;
+    case 'plugins': process.exitCode = await cmdPlugins(); break;
     case 'prompt':
       // Two audiences, two prompts. Bare `prompt` is the memory-USAGE snippet that goes
       // into a running agent's system prompt; `--install` is the one you hand an agent
       // that has not installed memhouse yet.
       if (flags.install === true) process.exitCode = await renderInstallPrompt();
-      else process.stdout.write(fs.readFileSync(path.join(DELIVERY, 'PROMPT.md'), 'utf-8'));
+      else {
+        // Render THIS machine's state. The snippet used to be a straight file dump that
+        // told the agent the database was 'mem' and the config was at ~/.memhouse/env —
+        // wrong for anyone whose house or MEMHOUSE_HOME differs, which is the whole point
+        // of having those knobs. `--install` already renders; bare `prompt` did not.
+        const pcfg = resolveConfig();
+        process.stdout.write(fs.readFileSync(path.join(DELIVERY, 'PROMPT.md'), 'utf-8')
+          .replaceAll('{{DB}}', pcfg.db)
+          .replaceAll('{{ENV_FILE}}', ENV_FILE));
+      }
       break;
     case 'reset': process.exitCode = await cmdReset(); break;
     case 'deploy': {
-      const dep = require(path.join(REPO_ROOT, 'mem-house', 'deploy.js'));
+      const dep = require(path.join(REPO_ROOT, 'memhouse', 'deploy.js'));
       if (flags.down) {
         // A shipper service outlives the house it points at. Tearing down the container
         // and volume beneath it leaves the service retrying an endpoint that is gone —
@@ -1273,7 +2179,7 @@ function cmdUninstall() {
         // container. Compare the unit's own inlined URL against the port this container
         // publishes; if that cannot be determined, fail closed.
         let svcCfg = { installed: false, url: null };
-        try { svcCfg = require(path.join(REPO_ROOT, 'mem-house', 'service.js')).installedConfig(); } catch { /* unsupported */ }
+        try { svcCfg = require(path.join(REPO_ROOT, 'memhouse', 'service.js')).installedConfig(); } catch { /* unsupported */ }
         if (svcCfg.installed) {
           const pub = dep.publishedPort();
           // Host AND port. Port alone classified a service pointing at
@@ -1287,6 +2193,23 @@ function cmdUninstall() {
           }
           console.log(warn(`a shipper service is installed but points at ${svcCfg.url} — leaving it alone`));
         }
+        // Ask. This removes the data VOLUME as well as the container — measured, 810 MB of
+        // a real house — and it was the only destructive command in the product that did
+        // not confirm, while `reset`, which merely re-ships, does. `prompt --install` had
+        // to tell agents in prose not to run it.
+        if (flags.yes !== true) {
+          const held = await (async () => {
+            try {
+              const c = resolveConfig();
+              const n = await chRows(c, `SELECT count() AS n FROM ${(await roomsFor(c)).messages} FINAL`);
+              return Number(n[0]?.n || 0);
+            } catch { return null; }
+          })();
+          console.log(warn('this removes the container AND its data volume — the house and everything in it.'));
+          if (held) console.log(`  ${held.toLocaleString()} messages are stored there. Re-shipping recovers only what the adapters can still see.`);
+          const a = (await ask('Remove it? (yes/no)', 'no')).toLowerCase();
+          if (a !== 'yes' && a !== 'y') { console.log('aborted'); process.exitCode = 1; break; }
+        }
         const r = dep.down();
         console.log(r.ok ? ok(`local ClickHouse removed (${r.engine}${r.volumeRemoved ? ', volume included' : ''})`) : bad(r.msg));
         process.exitCode = r.ok ? 0 : 1;
@@ -1387,7 +2310,7 @@ function cmdUninstall() {
         // was skipped, and `status` would then report a running shipper beside counts
         // from a different house.
         let svcCfg = { installed: false, url: null };
-        try { svcCfg = require(path.join(REPO_ROOT, 'mem-house', 'service.js')).installedConfig(); } catch { /* unsupported */ }
+        try { svcCfg = require(path.join(REPO_ROOT, 'memhouse', 'service.js')).installedConfig(); } catch { /* unsupported */ }
         // Endpoint AND database. Same URL with a different database is still somewhere
         // else: `deploy --local --db memories` over a service holding `mem` would pass a
         // URL-only check and split reads from service writes.
@@ -1457,12 +2380,18 @@ function cmdUninstall() {
         process.exitCode = 1; break;
       }
       console.log(ok('ClickHouse ready'));
-      // A ROOTLESS container lives in the user's systemd slice, and that slice is torn
-      // down at logout unless lingering is enabled — the container takes a SIGTERM and
-      // the house goes down with it. Measured on a testbed VM: `deploy --local` over ssh
-      // shipped 211 sessions, the ssh session ended, and the container was
-      // `Exited (143)` twenty seconds later with `Linger=no`. The volume survives, so
-      // nothing is lost, but the house is gone with no explanation anywhere.
+      // A ROOTLESS container lives in the user's systemd slice, which MAY be torn down at
+      // logout — if so the container takes a SIGTERM and the house goes with it. The
+      // volume survives, so nothing is lost, but the house is gone with no explanation.
+      //
+      // Whether it happens depends on logind's KillUserProcesses. Measured once on a
+      // testbed VM as `Exited (143)` twenty seconds after the ssh session ended; measured
+      // again later on Ubuntu 24.04, which ships KillUserProcesses=no, and the container
+      // and the user manager both survived 44 seconds with zero sessions and Linger=no.
+      // So the warning is conditional, and it is worded as a possibility rather than a
+      // certainty: enabling lingering is harmless and makes it moot either way, but
+      // telling a user to fix a problem their distro does not have costs credibility on
+      // every other thing this command says.
       //
       // `service install` already detects exactly this for its own unit. The container
       // needs the same check, and podman is the case that matters: it is rootless by
@@ -1470,13 +2399,27 @@ function cmdUninstall() {
       // (rootless docker has the same exposure, but is the deliberate minority).
       if (process.platform === 'linux' && r.engine === 'podman') {
         let lingering = true;
-        try { lingering = require(path.join(REPO_ROOT, 'mem-house', 'service.js')).lingerEnabled(); } catch { /* assume fine */ }
+        try { lingering = require(path.join(REPO_ROOT, 'memhouse', 'service.js')).lingerEnabled(); } catch { /* assume fine */ }
         if (!lingering) {
-          console.log(warn('rootless podman: this container stops when you log out (lingering is off).'));
-          console.log(`     loginctl enable-linger ${os.userInfo().username}`);
-          console.log('  Until then, after a logout: memhouse deploy --local   (the data volume persists)');
+          console.log(warn('rootless podman: this container MAY stop when you log out (lingering is off).'));
+          console.log('  Whether it does depends on your distro — Ubuntu 24.04 keeps it, others kill it.');
+          console.log(`  To make it moot:  loginctl enable-linger ${os.userInfo().username}`);
+          // Repeat the port that was actually used. cmdPlugins already knows to echo back
+          // the --target it was given; this line dropped --house-port, so following it
+          // would stand the house up somewhere else.
+          console.log(`  If it does stop: memhouse deploy --local${flags['house-port'] ? ` --house-port ${flags['house-port']}` : ''}   (the data volume persists)`);
         }
       }
+      // Say what this credential is. `deploy --local` stands up a house you own, so the
+      // member IS the superuser — SHOW GRANTS for it includes CREATE USER, FILE, URL,
+      // REMOTE and S3, all WITH GRANT OPTION, and `service install` inlines it into a
+      // systemd unit. That is a defensible position for a single-owner house (DESIGN.md
+      // anticipates it) and it is NOT the narrow set INSTALL.md's grant-set argument
+      // describes. A user who later adds a second member should know which house they
+      // have.
+      console.log(warn(`this house is yours alone: '${'memhouse_root'}' is its superuser, and that is the credential being saved`));
+      console.log('  Adding a second person later? Give them their own member instead:');
+      console.log(`     node ${path.join(REPO_ROOT, 'memhouse', 'per-member', 'provision.js')} --member <name> --merge`);
       flags.url = r.url; flags.user = 'memhouse_root'; flags.password = pw;
       flags.db = targetDb;
       flags.yes = true;
@@ -1484,7 +2427,7 @@ function cmdUninstall() {
       break;
     }
     case 'service': {
-      const svc = require(path.join(REPO_ROOT, 'mem-house', 'service.js'));
+      const svc = require(path.join(REPO_ROOT, 'memhouse', 'service.js'));
       const sub = positional[0] || 'status';
       if (sub === 'install') {
         // Ask what can be asked before killing the daemon this is taking over from. A
@@ -1507,6 +2450,10 @@ function cmdUninstall() {
           // Where this install lives. The env file records the connection, not the home
           // that contains it, and an adapter override may hang off the home.
           home: HOME_DIR,
+          // Replacing a service that belongs to a DIFFERENT MEMHOUSE_HOME is refused
+          // unless asked for; there is one service name per user, so the replacement is
+          // otherwise silent and the other house is left with no shipper.
+          force: flags.force === true,
         });
         if (!r.ok) { console.log(bad(r.msg)); process.exitCode = 1; break; }
         console.log(ok(`service installed (${r.kind}): ${r.path}`));
@@ -1524,11 +2471,10 @@ function cmdUninstall() {
         if (!st.kind) { console.log(warn(`no service integration for '${process.platform}'`)); break; }
         console.log(st.installed ? ok(`service installed (${st.kind}): ${st.path}`) : warn('service not installed'));
         console.log(st.running ? ok('service running') : warn('service not running'));
-        for (const f of st.legacy || []) console.log(warn(`stale unit from an older version: ${f} — remove with: memhouse service uninstall`));
       }
       break;
     }
-    case 'uninstall': cmdUninstall(); break;
+    case 'uninstall': await cmdUninstall(); break;
     default:
       console.error(`unknown command: ${cmd}\n${HELP}`);
       process.exitCode = 2;