ltcai 11.0.1 → 11.2.0

package/lattice_brain/self_model.py

@@ -37,7 +37,7 @@ import hashlib
 import json
 import logging
 import re
-from typing import Any, Callable, Dict, List, Optional, Sequence, Tuple
+from typing import Any, Callable, Dict, Iterable, List, Optional, Sequence, Tuple
 
 from .context import approx_tokens
 from .synthesis import ProposalDesk
@@ -127,7 +127,7 @@ _PATTERNS: Tuple[Tuple[str, "re.Pattern[str]", int, float, str], ...] = (
     (
         "preference",
         re.compile(
-            r"(?:나는|저는|내가|제가)\s*(?P<v>[^\n.。]+?)"
+            r"(?:나는|저는|내가|제가)\s*(?P<v>[^\n.。]+?)\s*(?:을|를|이|가)?"
             r"\s*(?:좋아|선호|싫어)(?:합니다|한다|해요|해|하고)"
         ),
         1,
@@ -145,11 +145,10 @@ _PATTERNS: Tuple[Tuple[str, "re.Pattern[str]", int, float, str], ...] = (
         "en_first_person_preference",
     ),
     (
+        # The frequency word stays inside the capture: "회고를 씁니다" is a
+        # sentence, "매일 회고를 씁니다" is a habit.
         "habit",
-        re.compile(
-            r"(?:매일|매주|매달|아침마다|항상|늘)\s*(?P<v>[^\n.。]+?)"
-            r"\s*(?:합니다|한다|해요|해)(?:\b|[\s.。!?]|$)"
-        ),
+        re.compile(r"(?P<v>(?:매일|매주|매달|아침마다|항상|늘)\s*[^\n.。!?]+)"),
         1,
         0.65,
         "ko_routine",
@@ -157,7 +156,8 @@ _PATTERNS: Tuple[Tuple[str, "re.Pattern[str]", int, float, str], ...] = (
     (
         "habit",
         re.compile(
-            r"\bI\s+(?:always|usually|every\s+(?:morning|day|week))\s+(?P<v>[^\n.!?]+)",
+            r"\bI\s+(?P<v>(?:always|usually|every\s+(?:morning|day|week))"
+            r"\s+[^\n.!?]+)",
             re.IGNORECASE,
         ),
         1,
@@ -205,7 +205,17 @@ _PATTERNS: Tuple[Tuple[str, "re.Pattern[str]", int, float, str], ...] = (
 
 
 class SelfModelError(ValueError):
-    """Raised when a Self-Model operation cannot be carried out as asked."""
+    """Raised when a Self-Model operation cannot be carried out as asked.
+
+    Carries a machine-readable ``code`` alongside the developer message: Brain
+    Core cannot reach the server's message catalog (isolation), so the API
+    layer translates the code instead of forwarding an English sentence to a
+    Korean user.
+    """
+
+    def __init__(self, message: str, *, code: str = "invalid") -> None:
+        self.code = code
+        super().__init__(message)
 
 
 # ── extraction (deterministic) ───────────────────────────────────────────────
@@ -347,12 +357,18 @@ def apply_self_model_proposal(
     """
     item = review_queue.get(item_id, workspace_id=workspace_id)
     if str(item.get("kind")) != SELF_MODEL_KIND:
-        raise SelfModelError(f"review item {item_id} is not a Self-Model proposal")
+        raise SelfModelError(
+            f"review item {item_id} is not a Self-Model proposal",
+            code="not_a_proposal",
+        )
     fact = dict((item.get("payload") or {}).get("fact") or {})
     kind = str(fact.get("kind") or "")
     text = _normalize(str(fact.get("text") or ""))
     if kind not in FACT_NODE_TYPES or not text:
-        raise SelfModelError(f"review item {item_id} carries no Self-Model fact")
+        raise SelfModelError(
+            f"review item {item_id} carries no Self-Model fact",
+            code="empty_proposal",
+        )
     approved = review_queue.approve(item_id, workspace_id=workspace_id)
     node = _write_fact(
         store,
@@ -386,9 +402,11 @@ def upsert_self_model_fact(
     kind = str(kind or "").strip().lower()
     value = _normalize(text)
     if kind not in FACT_NODE_TYPES:
-        raise SelfModelError(f"kind must be one of {sorted(FACT_NODE_TYPES)}")
+        raise SelfModelError(
+            f"kind must be one of {sorted(FACT_NODE_TYPES)}", code="invalid_kind"
+        )
     if not value:
-        raise SelfModelError("a Self-Model fact needs text")
+        raise SelfModelError("a Self-Model fact needs text", code="text_required")
     return _write_fact(
         store,
         kind=kind,
@@ -405,14 +423,14 @@ def delete_self_model_fact(store: Any, node_id: str) -> Dict[str, Any]:
     """Remove one fact (or the whole root) from the subgraph, permanently."""
     identifier = str(node_id or "").strip()
     if not identifier.startswith(SELF_ID_PREFIX):
-        raise SelfModelError(f"not a Self-Model node: {identifier}")
+        raise SelfModelError(f"not a Self-Model node: {identifier}", code="not_self_model")
     with store._connect() as conn:
         deleted = conn.execute(
             "DELETE FROM nodes WHERE id=?", (identifier,)
         ).rowcount
         conn.execute("DELETE FROM nodes_v2 WHERE id=?", (identifier,))
     if not deleted:
-        raise SelfModelError(f"Self-Model node not found: {identifier}")
+        raise SelfModelError(f"Self-Model node not found: {identifier}", code="not_found")
     return {"status": "ok", "id": identifier, "deleted_at": now_iso()}
 
 
@@ -420,13 +438,18 @@ def delete_self_model_fact(store: Any, node_id: str) -> Dict[str, Any]:
 
 
 def list_self_model(
-    store: Any, *, workspace_id: Optional[str] = None
+    store: Any,
+    *,
+    workspace_id: Optional[str] = None,
+    allowed_workspaces: Optional[Iterable[str]] = None,
 ) -> Dict[str, Any]:
     """Every fact the Brain holds about its owner, grouped for display."""
-    facts = _read_facts(store, workspace_id=workspace_id)
+    facts = _read_facts(
+        store, workspace_id=workspace_id, allowed_workspaces=allowed_workspaces
+    )
     counts: Dict[str, int] = {kind: 0 for kind in KIND_ORDER}
     for fact in facts:
-        counts[fact["kind"]] = counts.get(fact["kind"], 0) + 1
+        counts[fact["kind"]] += 1
     return {
         "available": True,
         "facts": facts,
@@ -442,6 +465,7 @@ def self_model_summary(
     *,
     limit_tokens: int = DEFAULT_SUMMARY_TOKENS,
     workspace_id: Optional[str] = None,
+    allowed_workspaces: Optional[Iterable[str]] = None,
 ) -> str:
     """Plain-text Self-Model summary for injection into a model's context.
 
@@ -450,7 +474,9 @@ def self_model_summary(
     An empty subgraph returns ``""`` — the caller injects nothing rather than a
     header with nothing under it.
     """
-    facts = _read_facts(store, workspace_id=workspace_id)
+    facts = _read_facts(
+        store, workspace_id=workspace_id, allowed_workspaces=allowed_workspaces
+    )
     if not facts or limit_tokens <= 0:
         return ""
     header = "사용자에 대해 확인된 사실:"
@@ -523,8 +549,28 @@ def _write_fact(
     }
 
 
+def _allowed_set(
+    workspace_id: Optional[str], allowed_workspaces: Optional[Iterable[str]]
+) -> Optional[set]:
+    """Normalize the two scoping spellings into one allow-set (``None`` = all).
+
+    ``allowed_workspaces`` is the scoping vocabulary the graph reads already
+    use (``filter_scoped_nodes``); ``workspace_id`` is the single-scope sugar
+    the API surfaces speak. A fact with no workspace is personal-global and
+    stays visible in both.
+    """
+    if allowed_workspaces is not None:
+        return {str(item) for item in allowed_workspaces if item}
+    if workspace_id is None:
+        return None
+    return {str(workspace_id)}
+
+
 def _read_facts(
-    store: Any, *, workspace_id: Optional[str] = None
+    store: Any,
+    *,
+    workspace_id: Optional[str] = None,
+    allowed_workspaces: Optional[Iterable[str]] = None,
 ) -> List[Dict[str, Any]]:
     """Fact rows for a workspace, ordered deterministically (kind, then text).
 
@@ -533,6 +579,10 @@ def _read_facts(
     both read modes. A store that cannot be read yields no facts rather than
     raising into a prompt-assembly path.
     """
+    if not hasattr(store, "_connect"):
+        # Not a Brain store (a doc-generation seam may be handed a stand-in).
+        # There is no profile to read, and that is not an error worth logging.
+        return []
     try:
         with store._connect() as conn:
             rows = conn.execute(
@@ -544,11 +594,12 @@ def _read_facts(
         logger.exception("self-model read failed")
         return []
     facts = [fact for fact in (_row_to_fact(row) for row in rows) if fact]
-    if workspace_id is not None:
+    allowed = _allowed_set(workspace_id, allowed_workspaces)
+    if allowed is not None:
         facts = [
             fact
             for fact in facts
-            if fact["workspace_id"] in (None, "", str(workspace_id))
+            if not fact["workspace_id"] or str(fact["workspace_id"]) in allowed
         ]
     return sorted(facts, key=lambda fact: (KIND_ORDER.index(fact["kind"]), fact["text"]))
 
@@ -584,6 +635,7 @@ def summary_for_prompt(
     *,
     limit_tokens: int = DEFAULT_SUMMARY_TOKENS,
     workspace_id: Optional[str] = None,
+    allowed_workspaces: Optional[Iterable[str]] = None,
 ) -> str:
     """:func:`self_model_summary` that never raises — the injection seam.
 
@@ -592,7 +644,10 @@ def summary_for_prompt(
     """
     try:
         return self_model_summary(
-            store, limit_tokens=limit_tokens, workspace_id=workspace_id
+            store,
+            limit_tokens=limit_tokens,
+            workspace_id=workspace_id,
+            allowed_workspaces=allowed_workspaces,
         )
     except Exception:  # noqa: BLE001 — see docstring
         logger.exception("self-model summary failed")

package/lattice_brain/synthesis.py

@@ -35,6 +35,7 @@ import os
 from datetime import datetime, timezone
 from typing import Any, Callable, Dict, List, Optional, Sequence, Set, Tuple
 
+from .gates import FeatureGate
 from .graph.proactive import ProactiveBrain
 from .graph.schema import KGStoreV2
 from .quality import content_signature
@@ -60,6 +61,19 @@ CONTRADICTION_RESOLUTIONS = ("keep_old", "replace", "keep_both_temporal")
 SYNTHESIS_THRESHOLD_ENV = "LATTICEAI_SYNTHESIS_THRESHOLD"
 DEFAULT_SYNTHESIS_THRESHOLD = 25
 
+#: Whether the Brain is allowed to start a pass *by itself*. Default on — this
+#: is the behaviour 11.1.0 shipped — and it governs only the automatic path
+#: (:meth:`BrainSynthesizer.run_if_due`). An explicit run a person asked for is
+#: never gated: turning "tidy up on its own" off means the Brain stops deciding
+#: when, not that the button stops working.
+SYNTHESIS_ENV = "LATTICEAI_SYNTHESIS"
+SYNTHESIS_GATE = FeatureGate(
+    SYNTHESIS_ENV,
+    default=True,
+    name="synthesis",
+    detail="The Brain reviews accumulated material on its own and proposes tidy-ups.",
+)
+
 _MIN_SHARED_TOKENS = 3
 _MIN_CLUSTER_MEMBERS = 3
 _EDGE_SIMILARITY = 0.35
@@ -516,7 +530,14 @@ class BrainSynthesizer:
         self, result: Any, *, workspace_id: Optional[str] = None,
         user_email: Optional[str] = None,
     ) -> Optional[Dict[str, Any]]:
-        """Run synthesis only when this ingest pushed the counter over."""
+        """Run synthesis only when this ingest pushed the counter over.
+
+        The gate is checked *before* the counter moves, so "off" means off: a
+        long import while the switch is down does not bank a pass that fires the
+        instant someone turns it back on.
+        """
+        if not SYNTHESIS_GATE.enabled():
+            return None
         if not self.observe_ingest(result):
             return None
         return self.run(workspace_id=workspace_id, user_email=user_email)
@@ -792,6 +813,8 @@ __all__ = [
     "ContradictionResolutionError",
     "EDGE_KIND",
     "ProposalDesk",
+    "SYNTHESIS_ENV",
+    "SYNTHESIS_GATE",
     "SYNTHESIS_REVIEW_SOURCE",
     "SYNTHESIS_THRESHOLD_ENV",
     "SynthesisTrigger",

package/latticeai/__init__.py

@@ -1,3 +1,3 @@
 """Lattice AI - modular server package."""
 
-__version__ = "11.0.1"
+__version__ = "11.2.0"

package/latticeai/api/brain_intelligence.py

@@ -85,6 +85,10 @@ def create_brain_intelligence_router(
         Fixed contract consumed by the frontend:
         ``{"status": "ready"|"pending"|"unavailable", "pending_items": int,
         "total_items": int, "detail": str}``.
+
+        Additive since v11.2.0: ``breakdown`` splits the backlog into
+        ``embedded``/``missing``/``stale``/``queued`` when the store can. The
+        four keys above are unchanged, so existing readers see no difference.
         """
         user = require_user(request)
         scope = gate_read(request)

package/latticeai/api/chat.py

@@ -111,6 +111,16 @@ def create_chat_router(context: AppContext) -> APIRouter:
         get_history_user=context.require("get_history_user"),
     )
 
+    def review_sink() -> object:
+        """The Review Center queue, resolved per request (may be absent).
+
+        Cloud-derived knowledge is staged here rather than written, so the
+        hybrid turn needs the live queue — which is wired after this router's
+        context is built, hence a provider rather than a captured value.
+        """
+        provider = context.review_queue
+        return None if provider is None else provider()
+
     def notify_chat_message(role: str, text: str, source: Optional[str]) -> None:
         """Mirror persisted web exchanges to an injected bridge, never echoing it."""
         if context.on_chat_message is None or source == "telegram":
@@ -445,6 +455,7 @@ def create_chat_router(context: AppContext) -> APIRouter:
             chat_service=chat_service,
             notify=notify_chat_message,
             model_id=selected_model_id,
+            review_queue=review_sink(),
         )
         if hybrid_response is not None:
             return hybrid_response

package/latticeai/api/chat_helpers.py

@@ -212,8 +212,17 @@ def build_context_quality(
     lexical-only, or when retrieval failed entirely — so the frontend can
     tell the user the answer is weakly grounded instead of implying rich
     graph context. Never raises.
+
+    A fifth key, ``multimodal``, appears only when the matches really include
+    picture nodes (v11.2.0). "6 nodes" reads differently when two of them are
+    screenshots whose text came out of OCR, and until this call site passed
+    ``multimodal=`` the shipped chat surface could not tell the difference the
+    signal was built to report.
     """
-    from lattice_brain.graph.retrieval import context_quality_signal
+    from lattice_brain.graph.retrieval import (
+        context_quality_signal,
+        multimodal_signal,
+    )
 
     query = str(query or "").strip()
     if knowledge_graph is None or not query:
@@ -233,7 +242,9 @@ def build_context_quality(
             return context_quality_signal("none", 0, reason="그래프 검색에 실패했습니다")
         matches = result.get("matches") or []
         return context_quality_signal(
-            str(result.get("mode") or "hybrid"), len(matches)
+            str(result.get("mode") or "hybrid"),
+            len(matches),
+            multimodal=multimodal_signal(matches),
         )
     # Lexical-only stores without the hybrid mixin.
     try:
@@ -242,7 +253,9 @@ def build_context_quality(
         ).get("matches") or []
     except Exception:  # noqa: BLE001 — signal building must never fail chat
         return context_quality_signal("none", 0, reason="그래프 검색에 실패했습니다")
-    return context_quality_signal("lexical_only", len(matches))
+    return context_quality_signal(
+        "lexical_only", len(matches), multimodal=multimodal_signal(matches)
+    )
 
 
 # ── answer-citation binding (backlog #11, review §7.2 E #4) ──────────────────

package/latticeai/api/chat_hybrid.py

@@ -14,7 +14,10 @@ from latticeai.core.network_boundary import (
     NetworkBoundaryMode,
     normalize_network_mode,
 )
-from latticeai.runtime.network_boundary_wiring import resolve_active_network_mode
+from latticeai.runtime.network_boundary_wiring import (
+    get_hybrid_policy_service,
+    resolve_active_network_mode,
+)
 from latticeai.services.hybrid_chat import stream_hybrid_cloud_turn
 
 
@@ -32,6 +35,28 @@ def resolve_request_network_mode(
     )
 
 
+def resolve_hybrid_auto_commit(
+    *,
+    user_email: Optional[str],
+    workspace_id: Optional[str],
+) -> bool:
+    """The scoped hybrid policy's ``auto_commit`` decision for this turn.
+
+    Sibling of :func:`resolve_request_network_mode`: the dial says whether the
+    turn may reach the cloud, this says what may happen to what comes back.
+    Default is ``False`` — cloud-derived knowledge waits in the Review Center
+    — and a policy that cannot be read is treated as the default rather than
+    as permission.
+    """
+    try:
+        policy = get_hybrid_policy_service().resolve(
+            user_email=user_email, workspace_id=workspace_id
+        )
+    except Exception:  # noqa: BLE001 — an unreadable policy never grants a write
+        return False
+    return bool(policy.get("auto_commit", False))
+
+
 def maybe_hybrid_stream_response(
     *,
     req: Any,
@@ -45,6 +70,7 @@ def maybe_hybrid_stream_response(
     chat_service: Any,
     notify: Any,
     model_id: Optional[str],
+    review_queue: Any = None,
 ) -> Optional[StreamingResponse]:
     """Return a StreamingResponse when cloud path should run; else None."""
     if mode != NetworkBoundaryMode.CLOUD_ALLOWED:
@@ -66,6 +92,10 @@ def maybe_hybrid_stream_response(
             history_user=history_user,
             notify=notify,
             source=req.source,
+            review_queue=review_queue,
+            auto_commit=resolve_hybrid_auto_commit(
+                user_email=effective_email, workspace_id=workspace_id
+            ),
         ),
         media_type="text/event-stream",
         headers={
@@ -78,5 +108,6 @@ def maybe_hybrid_stream_response(
 
 __all__ = [
     "resolve_request_network_mode",
+    "resolve_hybrid_auto_commit",
     "maybe_hybrid_stream_response",
 ]

package/latticeai/api/features.py

@@ -0,0 +1,70 @@
+"""Feature switchboard API — read the catalog, move one switch (v11.2.0).
+
+Two routes and no more. The catalog is rendered by the service (labels,
+explanations, defaults, which options are even installable), so this router
+carries no product knowledge at all: adding a feature is a line in
+``latticeai/services/feature_toggles.CATALOG``, not a change here or in the
+client.
+"""
+
+from __future__ import annotations
+
+from typing import Any, Callable, Union
+
+from fastapi import APIRouter, HTTPException, Request
+from pydantic import BaseModel, Field
+
+from latticeai.core.messages import http_error, resolve_language
+from latticeai.services.feature_toggles import (
+    FeatureToggleService,
+    InvalidFeatureValue,
+    UnknownFeature,
+)
+
+
+class SetFeatureRequest(BaseModel):
+    """One switch move. ``value`` is a bool for a toggle, a string for a choice."""
+
+    value: Union[bool, str] = Field(
+        ..., description="true/false for a toggle, or the option id for a choice"
+    )
+
+
+def create_features_router(
+    *,
+    service: FeatureToggleService,
+    require_user: Callable[..., str],
+) -> APIRouter:
+    router = APIRouter(tags=["features"])
+
+    @router.get("/api/features")
+    async def list_features(request: Request) -> Any:
+        """Every opt-in feature, its live value, and where that value came from."""
+        require_user(request)
+        return service.catalog(resolve_language(request))
+
+    @router.post("/api/features/{feature_id}")
+    async def set_feature(
+        feature_id: str, body: SetFeatureRequest, request: Request
+    ) -> Any:
+        """Persist one person's choice; the answer is the feature as it now reads."""
+        user = require_user(request)
+        language = resolve_language(request)
+        try:
+            return service.set(
+                feature_id, body.value, language=language, user_email=user
+            )
+        except UnknownFeature as exc:
+            raise http_error(
+                400, "features.unknown", language, feature=feature_id
+            ) from exc
+        except InvalidFeatureValue as exc:
+            # Pass-through: the service already localized the reason through the
+            # same catalog (wrong type, or an option whose optional dependency
+            # is not installed), and re-wording it here would only lose it.
+            raise HTTPException(status_code=400, detail=str(exc)) from exc
+
+    return router
+
+
+__all__ = ["SetFeatureRequest", "create_features_router"]

package/latticeai/api/local_files.py

@@ -60,12 +60,36 @@ class FolderWatchEnableRequest(BaseModel):
     path: str
     recursive: bool = True
     workspace_id: Optional[str] = None
+    #: ``folder`` (default, unchanged) or ``vault`` — a watched external
+    #: Obsidian vault, which re-runs the whole bridge sync when it changes and
+    #: carries its own opt-in gate on top of this approval.
+    kind: str = "folder"
     # Watching continuously reads local disk → same approval dance as
     # /api/ingestion/folder. This is the explicit opt-in the review requires.
     approved: bool = False
     approval_token: Optional[str] = None
 
 
+class InteropIngestRequest(BaseModel):
+    """Read one local interop source through the one ingestion gate (v11.2.0).
+
+    ``source`` picks the bridge — ``notion`` (an export directory or ``.zip``),
+    ``git`` (a local repository), ``mail`` (``.eml``/``.ics`` files or a folder
+    of them). Every one of them reads a path the user approves through the same
+    local-read dance as ``/api/ingestion/folder``, and ``dry_run`` reports what
+    a real run would touch without writing anything.
+    """
+
+    source: str
+    path: str
+    workspace_id: Optional[str] = None
+    dry_run: bool = False
+    #: Git only: how far back to read. Ignored by the other bridges.
+    max_commits: Optional[int] = None
+    approved: bool = False
+    approval_token: Optional[str] = None
+
+
 class ObsidianSyncRequest(BaseModel):
     """One-shot sync of an *external* Obsidian vault (v11.1.0).
 
@@ -107,10 +131,18 @@ def create_local_files_router(
     if folder_watch is None and ingestion_pipeline is not None and data_dir is not None:
         try:
             from latticeai.services.folder_watch import FolderWatchService
+            from latticeai.services.obsidian_bridge import ObsidianVaultBridge
 
             folder_watch = FolderWatchService(
                 pipeline=ingestion_pipeline,
                 config_path=Path(data_dir) / "folder_watch.json",
+                # A watched vault re-runs the *whole* bridge sync, which is what
+                # makes its link edges real; the bridge is handed in rather than
+                # imported inside the poller so the watch service keeps knowing
+                # nothing about how a vault is parsed.
+                vault_bridge=ObsidianVaultBridge(
+                    pipeline=ingestion_pipeline, knowledge_graph=knowledge_graph,
+                ),
             )
             folder_watch.restore()
         except Exception:  # noqa: BLE001 — watch mode is optional, never blocks routes
@@ -405,6 +437,66 @@ def create_local_files_router(
             dry_run=req.dry_run,
         )
 
+    # ── interop bridges: Notion export / git history / mail + calendar ───────
+    @router.get("/api/ingestion/interop")
+    async def interop_status(request: Request):
+        """Which interop bridges this machine can actually run, and why not."""
+        require_user(request)
+        from latticeai.services.interop_bridges import bridge_status
+
+        return bridge_status()
+
+    @router.post("/api/ingestion/interop")
+    async def interop_ingest(req: InteropIngestRequest, request: Request):
+        """Read an approved local interop source through the one gate.
+
+        Same approval dance and the same ``IngestionPipeline`` door as the
+        vault bridge: no vendor API, no credentials, nothing leaves the
+        machine. ``dry_run`` writes nothing and reports what a real run would.
+        """
+        current_user = permission_gateway.require_local_user(request)
+        _require_pipeline()
+        workspace_id = _ingestion_write_workspace(request, req.workspace_id, current_user)
+        path = (req.path or "").strip()
+        if not path:
+            raise http_error(400, "ingestion.interop_path_required", resolve_language(request))
+        from latticeai.services.interop_bridges import build_bridge
+
+        try:
+            bridge = build_bridge(
+                req.source, pipeline=ingestion_pipeline, knowledge_graph=knowledge_graph,
+            )
+        except ValueError:
+            raise http_error(
+                400,
+                "ingestion.interop_unknown_source",
+                resolve_language(request),
+                source=req.source,
+            )
+        if not req.approved:
+            return permission_gateway.local_permission_response(path, "read", current_user)
+        permission_gateway.require_local_approval(
+            token=req.approval_token,
+            path=path,
+            action="read",
+            user_email=current_user,
+        )
+        options: Dict[str, Any] = {}
+        if req.max_commits is not None:
+            options["max_commits"] = req.max_commits
+        # Walking an export and embedding its pages is blocking work; the server
+        # owns one event loop and it may not sit here (10.9.0 ASYNC gate).
+        return await asyncio.to_thread(
+            lambda: bridge.sync(
+                path,
+                owner=current_user or None,
+                workspace_id=workspace_id,
+                user_email=current_user or None,
+                dry_run=req.dry_run,
+                **options,
+            )
+        )
+
     # ── folder watch mode: opt-in, off by default (backlog #8) ────────────────
     def _require_folder_watch(request: Request):
         _require_pipeline()
@@ -446,7 +538,16 @@ def create_local_files_router(
             owner=current_user or None,
             workspace_id=workspace_id,
             recursive=req.recursive,
+            kind=req.kind,
         )
+        if result.get("status") == "disabled":
+            # Turned off rather than broken: 403 with the reason, the same shape
+            # every other opt-in gate in this product answers with.
+            raise HTTPException(
+                status_code=403,
+                detail=result.get("detail")
+                or translate("ingestion.vault_watch_disabled", resolve_language(request)),
+            )
         if result.get("status") != "ok":
             raise HTTPException(
                 status_code=400,
@@ -518,6 +619,7 @@ def create_local_files_router(
 __all__ = [
     "FolderIngestRequest",
     "FolderWatchEnableRequest",
+    "InteropIngestRequest",
     "LocalAccessRequest",
     "LocalWriteRequest",
     "ObsidianSyncRequest",