[sixvolts]

Stacked on ci/fix-17-research-web (PR 13 of 16 precedes it). Merge with "Create a merge commit" (squash or rebase would re-mint untested commits), one PR at a time, bottom-up. GitHub retargets this PR when the one below it merges and its branch is deleted.

fix(db): a page keeps every link, DSN errors are sanitized, the scrub probe stays in its schema

• links_to relationships are keyed by their object, and a page's links
  are replaced as a set on save; other predicates keep one object per
  subject.
• db.Open errors go through SanitizeDSN, which also handles passwords
  containing @ and quoted key-value passwords.
• The working_context scrub migration's probe is confined to the
  current schema.
• A misleading migration comment is corrected.

Migration: relationships_links_multi replaces the relationships unique
index with two partial ones (runs once at startup).

Tests cover each change.

fix(config): report what's wrong at boot, honor FAMILIAR_HOME, document expansion, drop the vault

• $$ is a literal $ in expanded fields; a $ naming no set variable is
  warned about (by field). The example documents which fields expand.
• Validate rejects unknown providers and llama-completion formatters;
  role = "embedder" becomes the embedder role's primary.
• Memory thresholds are validated using their effective values.
• The API key resolver no longer calls the unsupported engine vault.
• Unknown config keys are reported at boot; README and the example are
  corrected; the example test fails on unknown keys.
• FAMILIAR_HOME locates the config (/gateway.toml first)
  and the default skills, media, prompt and history paths. The systemd
  unit templates set it: before restarting, make sure it points where
  the config and data are, or unset it.
• Load warns when the config file is readable by other users.
• The example's rp_origins point at the workspace.

Breaking: a model with a missing or unknown provider, or thresholds out
of order, now stops the boot.

Tests cover each change.

fix(shutdown): drain in-flight requests and post-turn work before the database closes

• The HTTP adapter returns only after its shutdown drain (5s).
• Post-turn extraction and summaries are tracked, and shutdown waits for
  them (15s) before closing the pool.
• All adapters are awaited; the root context is cancelled first on every
  exit path.

Tests cover the drain.

fix(scripts): setup writes a working config, run.sh's CLI mode stays up, deploy builds its own checkout

• setup.sh writes a minimal working config (HTTP and admin on loopback,
  the database, the tiered prompts, a local OpenAI-compatible model)
  under umask 077.
• ./run.sh without --http or --slack runs the CLI in the foreground.
• familiar-deploy.sh deploys the checkout it is run from (FAMILIAR_REPO
  overrides); unit templates and docs use one path.
• init-db.sql only enables pgvector; the gateway creates its schema.
• run.sh exports FAMILIAR_HOME.

Testing

The icecube tiers passed on this PR's tree before a migration-lock commit was added under the stack, as the first commit of #21: Go tests without and with Postgres, Playwright without a model, and Playwright against a local model. That commit changes only internal/db/migrate.go and its test, and the db package's tests pass with Postgres at every commit of the stack. The CI run on this PR tests the head as pushed.

🤖 Generated with Claude Code

https://claude.ai/code/session_01UwpkZbULrgj6JLeSra78AT