superlocalmemory 3.6.13 → 3.6.15

package/src/superlocalmemory/mcp/tools_code_graph.py

@@ -4,9 +4,9 @@
 
 """22 MCP tools for CodeGraph: 17 graph + 5 bridge.
 
-Registered against `server` (NOT `_target`) so they are always visible
-when the code-graph extra is installed. Each tool self-guards (returns
-error if graph not built) — no risk of confusing users.
+Registered against `_target` (filtered like all other tools) — set
+SLM_MCP_ALL_TOOLS=1 or use a profile containing code-graph names to expose
+them. Each tool self-guards (returns error if graph not built).
 
 All tools return {"success": bool, ...} envelope. Never raise.
 """

package/src/superlocalmemory/mcp/tools_core.py

@@ -19,6 +19,8 @@ from typing import Callable
 
 from mcp.types import ToolAnnotations
 
+from superlocalmemory.core.config import CANONICAL_RECALL_LIMIT
+
 logger = logging.getLogger(__name__)
 
 _DB_PATH = str(Path.home() / ".superlocalmemory" / "memory.db")
@@ -104,11 +106,17 @@ def register_core_tools(server, get_engine: Callable) -> None:
         content: str, tags: str = "", project: str = "",
         importance: int = 5, session_id: str = "",
         agent_id: str = "mcp_client",
+        scope: str | None = None,
+        shared_with: str = "",
     ) -> dict:
         """Store content to memory with intelligent indexing.
 
         Extracts atomic facts, resolves entities, builds graph edges,
         and indexes for 4-channel retrieval.
+
+        Multi-scope: ``scope`` sets visibility (personal/shared/global).
+        ``shared_with`` is a comma-separated list of profile_ids for
+        shared scope.
         """
         # v3.6.10: resolve "mcp_client" sentinel → URL path (HTTP) or env var (stdio)
         if agent_id == "mcp_client":
@@ -120,6 +128,8 @@ def register_core_tools(server, get_engine: Callable) -> None:
             "agent_id": agent_id,
             "session_id": session_id,
         }
+        # Parse shared_with from comma-separated string
+        _shared_list = [s.strip() for s in shared_with.split(",") if s.strip()] if shared_with else None
         # v3.5.5 WRITE-THROUGH: route through the daemon's /remember, which does
         # a synchronous verbatim insert (memory is keyword/BM25-recallable the
         # instant this returns) and enqueues async enrichment. This closes the
@@ -134,6 +144,7 @@ def register_core_tools(server, get_engine: Callable) -> None:
             if await _asyncio.to_thread(is_daemon_running):
                 resp = await _asyncio.to_thread(daemon_request, "POST", "/remember", {
                     "content": content, "tags": tags, "metadata": meta,
+                    "scope": scope, "shared_with": _shared_list,
                 })
                 if resp and (resp.get("fact_ids") is not None or resp.get("ok")):
                     fids = resp.get("fact_ids") or []
@@ -149,6 +160,13 @@ def register_core_tools(server, get_engine: Callable) -> None:
 
         try:
             from superlocalmemory.cli.pending_store import store_pending
+            # v3.6.15: preserve a non-personal scope through the offline path so
+            # the materializer replays the right visibility (else --scope global
+            # would silently downgrade to personal when the daemon is offline).
+            if scope and scope != "personal":
+                meta = {**meta, "scope": scope}
+                if _shared_list:
+                    meta["shared_with"] = _shared_list
             pending_id = store_pending(content, tags=tags, metadata=meta)
             return {
                 "success": True,
@@ -164,8 +182,10 @@ def register_core_tools(server, get_engine: Callable) -> None:
 
     @server.tool(annotations=ToolAnnotations(readOnlyHint=True))
     async def recall(
-        query: str, limit: int = 10, agent_id: str = "mcp_client",
+        query: str, limit: int = CANONICAL_RECALL_LIMIT, agent_id: str = "mcp_client",
         session_id: str = "", fast: bool = False,
+        include_global: bool | None = None,
+        include_shared: bool | None = None,
     ) -> dict:
         """Search memories by semantic query with 4-channel retrieval, RRF fusion, and reranking.
 
@@ -174,6 +194,11 @@ def register_core_tools(server, get_engine: Callable) -> None:
         engagement signals to this recall. Claude Code should pass its
         ``CLAUDE_SESSION_ID``. Omitting it degrades to "no closed-loop
         learning for this recall" — the recall itself always works.
+
+        Multi-scope: ``include_global`` / ``include_shared`` control which
+        scopes participate in retrieval. Leave them unset (``None``) to use the
+        configured default — shared memory is OPT-IN, so by default recall
+        returns only this profile's own facts. Pass ``True`` to opt in per call.
         """
         # v3.6.10: resolve "mcp_client" sentinel → URL path (HTTP) or env var (stdio)
         if agent_id == "mcp_client":
@@ -228,6 +253,8 @@ def register_core_tools(server, get_engine: Callable) -> None:
             result = await asyncio.to_thread(
                 pool.recall, query, limit=limit, session_id=effective_sid,
                 fast=bool(fast),
+                include_global=include_global,
+                include_shared=include_shared,
             )
             if result.get("ok"):
                 # Record implicit feedback: every returned result is a recall_hit
@@ -331,6 +358,7 @@ def register_core_tools(server, get_engine: Callable) -> None:
     async def get_status() -> dict:
         """Get memory system status: fact count, entity count, mode, profile, db size."""
         try:
+            import os
             engine = get_engine()
             pid = engine.profile_id
             fact_count = engine._db.get_fact_count(pid)
@@ -345,20 +373,25 @@ def register_core_tools(server, get_engine: Callable) -> None:
             )
             edge_count = int(dict(edges[0])["c"]) if edges else 0
 
-            import os
             db_size_mb = 0.0
             db_path = engine._db.db_path
             if db_path.exists():
                 db_size_mb = round(os.path.getsize(db_path) / (1024 * 1024), 2)
 
+            # WP-02 D8: additive canonical key set — provider/base_dir/db_path added.
+            # All pre-existing keys are preserved (zero removals).
+            cfg = engine._config
             return {
                 "success": True,
-                "mode": engine._config.mode.value,
+                "mode": cfg.mode.value,
+                "provider": cfg.llm.provider or "none",
                 "profile": pid,
+                "base_dir": str(cfg.base_dir),
+                "db_path": str(db_path),
+                "db_size_mb": db_size_mb,
                 "fact_count": fact_count,
                 "entity_count": entity_count,
                 "edge_count": edge_count,
-                "db_size_mb": db_size_mb,
             }
         except Exception as exc:
             logger.exception("get_status failed")

package/src/superlocalmemory/mcp/tools_v3.py

@@ -289,8 +289,13 @@ def register_v3_tools(server, get_engine: Callable) -> None:
             limit: Maximum results (default 10).
         """
         try:
+            import asyncio
             from superlocalmemory.mcp._daemon_proxy import choose_pool
-            raw = choose_pool().recall(query=query, limit=limit)
+            # choose_pool().recall uses blocking urllib; run off the event loop
+            # so recall_trace doesn't stall the MCP server for other tools.
+            raw = await asyncio.to_thread(
+                lambda: choose_pool().recall(query=query, limit=limit)
+            )
             items = raw.get("results", []) if isinstance(raw, dict) else []
             results = []
             for item in items[:limit]:

package/src/superlocalmemory/mcp/tools_v33.py

@@ -222,8 +222,10 @@ def register_v33_tools(server, get_engine: Callable) -> None:
             # v3.4.26: prefer the daemon's /consolidate/cognitive endpoint
             # so the heavy CognitiveConsolidator import stays out of the
             # MCP process. Fall back to local import only if no daemon.
-            daemon_result = _try_daemon_post(
-                "/consolidate/cognitive", {"profile_id": pid},
+            import asyncio
+            # blocking urllib (60s timeout) — keep it off the MCP event loop.
+            daemon_result = await asyncio.to_thread(
+                _try_daemon_post, "/consolidate/cognitive", {"profile_id": pid},
             )
             if daemon_result is not None:
                 _emit_event("ccq.consolidation_complete", {
@@ -434,8 +436,10 @@ def register_v33_tools(server, get_engine: Callable) -> None:
             # v3.4.26: prefer the daemon so ForgettingScheduler /
             # ConsolidationWorker / EbbinghausCurve don't load inside
             # the MCP process.
-            daemon_result = _try_daemon_post(
-                "/maintenance/run", {"profile_id": pid},
+            import asyncio
+            # blocking urllib — keep it off the MCP event loop.
+            daemon_result = await asyncio.to_thread(
+                _try_daemon_post, "/maintenance/run", {"profile_id": pid},
             )
             if daemon_result is not None:
                 daemon_result.setdefault("success", True)

package/src/superlocalmemory/optimize/cache/boundary_store.py

@@ -24,6 +24,7 @@ import logging
 import math
 import random
 import time
+from collections import OrderedDict
 from dataclasses import dataclass, field
 from typing import TYPE_CHECKING, Any
 
@@ -46,6 +47,12 @@ except ImportError:  # pragma: no cover
     _sp_minimize = None  # type: ignore[assignment]
 
 _BOUNCE_EPS: float = 1e-9
+
+# LRU cap for the in-memory write-through cache.  Records are durable in
+# SQLite (boundary_upsert), so eviction from _cache is lossless — a miss
+# simply falls back to DB.get().  50 000 covers the practical warm-cache
+# footprint without unbounded growth on long-running ingest.
+_BOUNDARY_CACHE_MAX: int = 50_000
 _OVERFLOW_GUARD: float = 500.0
 
 # z_{1 - ε/2} for common ε (avoids scipy.stats dependency)
@@ -341,9 +348,11 @@ class BoundaryStore:
         self._ceiling = ceiling
         self._step = step
         self._epsilon = epsilon
-        # In-memory write-through cache. Populated by load_all() at warm.
+        # In-memory write-through LRU cache.  Populated by load_all() at warm.
         # get() checks here first (O(1) hot path), then falls back to DB.
-        self._cache: dict[str, PerItemBoundaryRecord] = {}
+        # Capped at _BOUNDARY_CACHE_MAX entries; oldest is evicted on overflow.
+        # Records are always durable in SQLite so eviction is lossless.
+        self._cache: OrderedDict[str, PerItemBoundaryRecord] = OrderedDict()
 
     def get(self, entry_id: str) -> PerItemBoundaryRecord:
         """Return the MLE model record for an entry, or a cold-start default.
@@ -352,6 +361,8 @@ class BoundaryStore:
         Never raises.
         """
         if entry_id in self._cache:
+            # LRU promotion: move to end (most-recently used).
+            self._cache.move_to_end(entry_id)
             return self._cache[entry_id]
         try:
             row = self._db.boundary_get(entry_id)
@@ -406,8 +417,11 @@ class BoundaryStore:
                 updated_at=record.last_updated or time.time(),
             )
             self._db.boundary_upsert(record.entry_id, row)
-            # In-memory write-through (RA-15)
+            # LRU write-through (RA-15): insert / refresh position, then evict oldest.
             self._cache[record.entry_id] = record
+            self._cache.move_to_end(record.entry_id)
+            if len(self._cache) > _BOUNDARY_CACHE_MAX:
+                self._cache.popitem(last=False)  # evict LRU (oldest) entry
         except Exception as exc:
             logger.warning("BoundaryStore.save failed (fail-open): %s", exc)
 
@@ -432,7 +446,7 @@ class BoundaryStore:
         self.save(updated)
         return updated
 
-    def load_all(self) -> dict[str, PerItemBoundaryRecord]:
+    def load_all(self) -> OrderedDict[str, PerItemBoundaryRecord]:
         """Load all boundary records into memory (warm-start).
 
         Returns:
@@ -443,7 +457,9 @@ class BoundaryStore:
         """
         try:
             rows = self._db.get_all_boundaries()
-            result: dict[str, PerItemBoundaryRecord] = {}
+            # Return an OrderedDict so the caller assignment
+            # (self._boundary_store._cache = load_all()) preserves LRU semantics.
+            result: OrderedDict[str, PerItemBoundaryRecord] = OrderedDict()
             for r in rows:
                 eid = r.get("entry_id")
                 if not eid:
@@ -455,10 +471,13 @@ class BoundaryStore:
                     samples=[],
                     last_updated=float(r.get("updated_at", 0.0)),
                 )
+            # Cap at _BOUNDARY_CACHE_MAX — trim oldest if DB has more.
+            while len(result) > _BOUNDARY_CACHE_MAX:
+                result.popitem(last=False)
             return result
         except Exception as exc:
             logger.warning("BoundaryStore.load_all failed (fail-open): %s", exc)
-            return {}
+            return OrderedDict()
 
     def delete(self, entry_id: str) -> None:
         """Remove boundary record for a deleted cache entry. Fail-open."""

package/src/superlocalmemory/optimize/cache/centroid_store.py

@@ -21,6 +21,7 @@ from __future__ import annotations
 
 import logging
 import threading
+from collections import OrderedDict
 from typing import TYPE_CHECKING
 
 import numpy as np
@@ -33,6 +34,13 @@ logger = logging.getLogger(__name__)
 _VARIANCE_FLOOR: float = 1e-6
 _EMBED_DIM: int = 768
 
+# Stage-9 fix: cap the NUMBER of tenants held in memory.  The per-tenant entry
+# caps (WP-A/B) bound depth, but _centroids/_counts grew once per distinct
+# tenant forever (~3 KB/centroid → ~292 MB at 100k tenants on a shared proxy).
+# Evicted tenants rebuild lazily from the DB via rebuild_from_db(), so eviction
+# is lossless.  Irrelevant to single-tenant local installs.
+_MAX_TENANTS: int = 10_000
+
 
 def _cosine_similarity(a: np.ndarray, b: np.ndarray) -> float:
     """Cosine similarity in [-1, 1]. Returns 0.0 on zero vectors."""
@@ -51,11 +59,19 @@ class CentroidStore:
     Centroid update rule (Welford running mean — exact, O(1) per update):
         new_centroid = old_centroid * (n / (n+1)) + new_vec * (1 / (n+1))
     """
-    def __init__(self) -> None:
-        self._centroids: dict[str, np.ndarray] = {}  # tenant_id → float32 vec
-        self._counts: dict[str, int] = {}            # tenant_id → count
+    def __init__(self, max_tenants: int = _MAX_TENANTS) -> None:
+        # OrderedDict for O(1) LRU eviction by tenant count.
+        self._centroids: "OrderedDict[str, np.ndarray]" = OrderedDict()  # tenant → vec
+        self._counts: "OrderedDict[str, int]" = OrderedDict()            # tenant → count
+        self._max_tenants = max_tenants
         self._lock = threading.RLock()
 
+    def _evict_tenants_if_needed(self) -> None:
+        """Evict least-recently-updated tenants beyond the cap. Caller holds _lock."""
+        while len(self._centroids) > self._max_tenants:
+            old_tenant, _ = self._centroids.popitem(last=False)
+            self._counts.pop(old_tenant, None)
+
     def rebuild_from_db(self, db: "CacheDB", tenant_id: str) -> None:
         """Rebuild centroid for a tenant from all stored vectors.
 
@@ -70,7 +86,7 @@ class CentroidStore:
                     self._counts.pop(tenant_id, None)
                 return
             vectors: list[np.ndarray] = []
-            for _entry_id, blob in rows:
+            for _entry_id, blob, _ctx_fp in rows:
                 try:
                     vec = np.frombuffer(blob, dtype=np.float32).copy()
                     if vec.shape[0] == _EMBED_DIM:
@@ -83,6 +99,9 @@ class CentroidStore:
             with self._lock:
                 self._centroids[tenant_id] = centroid
                 self._counts[tenant_id] = len(vectors)
+                self._centroids.move_to_end(tenant_id)
+                self._counts.move_to_end(tenant_id)
+                self._evict_tenants_if_needed()
             logger.debug(
                 "CentroidStore: rebuilt tenant=%s centroid from %d vectors",
                 tenant_id, len(vectors),
@@ -101,6 +120,7 @@ class CentroidStore:
                 if tenant_id not in self._centroids:
                     self._centroids[tenant_id] = vec.copy()
                     self._counts[tenant_id] = 1
+                    self._evict_tenants_if_needed()
                 else:
                     n = self._counts[tenant_id]
                     old = self._centroids[tenant_id]
@@ -108,6 +128,9 @@ class CentroidStore:
                         old * (n / (n + 1)) + vec * (1.0 / (n + 1))
                     ).astype(np.float32)
                     self._counts[tenant_id] = n + 1
+                    # LRU: mark this tenant most-recently used.
+                    self._centroids.move_to_end(tenant_id)
+                    self._counts.move_to_end(tenant_id)
         except Exception as exc:
             logger.warning("CentroidStore.update failed (fail-open): %s", exc)
 

package/src/superlocalmemory/optimize/cache/manager.py

@@ -178,7 +178,34 @@ class CacheManager:
         if not _HEX64.fullmatch(tenant_id or ""):
             tenant_id = _hashlib.sha256(tenant_id.encode()).hexdigest()
 
-        if isinstance(req, ProxyRequest):
+        if isinstance(req, ProxyRequest) and req.provider == "vertex":
+            # CRIT-2 (WP-11, LOCKED): Vertex bodies have NO model/messages/system.
+            # Model is in the PATH; prompts are under 'contents'; system under
+            # 'systemInstruction'. Without this branch ALL Vertex requests hash to
+            # ONE key → first response poisons every subsequent prompt.
+            body = req.body or {}
+            model_id = _vertex_model_from_path(req.path)
+            # SECURITY (Stage-8 audit): fold project + region into the model
+            # identity so two GCP projects (or regions) issuing the same prompt
+            # never collide to one cache entry → no cross-tenant response leakage.
+            # Model name alone is insufficient (the same model exists in every
+            # project). key_builder whitelist-filters raw_params, so extra param
+            # keys would be dropped — model_id IS hashed. _KEY_SCHEMA_VERSION
+            # unchanged (vertex is a new provider; no live vertex cache; the
+            # non-vertex branches are untouched).
+            _vproj, _vloc = _vertex_project_location_from_path(req.path)
+            if _vproj or _vloc:
+                model_id = f"vertex:{_vproj}:{_vloc}:{model_id}"
+            messages = body.get("contents", []) or []
+            system_raw = body.get("systemInstruction", "") or ""
+            if isinstance(system_raw, (dict, list)):
+                system = _json.dumps(system_raw, sort_keys=True, separators=(",", ":"))
+            else:
+                system = str(system_raw)
+            # params: everything except the fields extracted above and stream flag.
+            _SKIP_VERTEX = frozenset({"contents", "systemInstruction", "stream"})
+            params = {k: v for k, v in body.items() if k not in _SKIP_VERTEX}
+        elif isinstance(req, ProxyRequest):
             # Extract semantic fields from the parsed JSON body.
             body = req.body or {}
             model_id = body.get("model", "") or ""
@@ -292,16 +319,28 @@ class CacheManager:
 
     # ---- CacheHook protocol implementation (INTERFACE-CONTRACT §3) ----
 
-    def check(self, req: ProxyRequest) -> "CachedResponse | None":
+    def check(
+        self, req: ProxyRequest, tenant_id: "str | None" = _DEFAULT_TENANT_HASH
+    ) -> "CachedResponse | None":
         """CacheHook.check() — look up by ProxyRequest; fail-open on error.
 
         BUG-FIX (v3.6.3): on_miss() was never called from the proxy path,
         so MetricsCollector.misses stayed at 0 and the dashboard always showed
         0 misses.  Fixed by calling on_miss() here whenever get() returns a
         cache-miss result.
+
+        SECURITY (WP-D): tenant_id is now optional.  Surface handlers pass the
+        credential-derived tenant so that different API keys never share a cache
+        entry.  When tenant_id is None (unauthenticated / no credential) the
+        cache is SKIPPED entirely — returns None without reading the store.
+        The default preserves backward compatibility for callers that do not
+        pass a tenant_id.
         """
+        if tenant_id is None:
+            # No credential → refuse to serve or populate the cache.
+            return None
         try:
-            result = self.get(req, tenant_id=_DEFAULT_TENANT_HASH)
+            result = self.get(req, tenant_id=tenant_id)
             if result is not None and not result.hit:
                 MetricsCollector.get_instance().on_miss()
             return result
@@ -309,10 +348,20 @@ class CacheManager:
             logger.warning("CacheManager.check raised (fail-open): %s", exc)
             return None
 
-    def store(self, req: ProxyRequest, resp: ProviderResponse) -> None:
-        """CacheHook.store() — persist response; fail-open on error."""
+    def store(
+        self, req: ProxyRequest, resp: ProviderResponse,
+        tenant_id: "str | None" = _DEFAULT_TENANT_HASH,
+    ) -> None:
+        """CacheHook.store() — persist response; fail-open on error.
+
+        SECURITY (WP-D): tenant_id is now optional.  When None (unauthenticated)
+        the store is silently skipped to prevent anonymous requests from
+        populating the cache and leaking responses to other tenants.
+        """
+        if tenant_id is None:
+            return
         try:
-            self.set(req, resp, tenant_id=_DEFAULT_TENANT_HASH)
+            self.set(req, resp, tenant_id=tenant_id)
         except Exception as exc:
             logger.warning("CacheManager.store raised (fail-open): %s", exc)
 
@@ -566,3 +615,40 @@ class _TenantScopedManager:
 def json_dumps_bytes(d: dict) -> bytes:
     import json as _json
     return _json.dumps(d, separators=(",", ":"), default=str).encode("utf-8")
+
+
+# ---------------------------------------------------------------------------
+# Vertex helpers (WP-11 / CRIT-2)
+# ---------------------------------------------------------------------------
+
+def _vertex_project_location_from_path(path: str) -> tuple[str, str]:
+    """Extract (project, location) from a Vertex proxy path for cache isolation.
+
+    Without project+region in the cache key, two GCP projects (or regions)
+    issuing an identical prompt collide to one entry → cross-tenant response
+    leakage (Stage-8 security finding). Returns ("", "") on parse failure.
+    """
+    import re as _re
+    m = _re.search(
+        r"projects/([a-zA-Z0-9._\-]{1,63})/locations/([a-z0-9\-]{1,40})/",
+        path or "",
+    )
+    return (m.group(1), m.group(2)) if m else ("", "")
+
+
+def _vertex_model_from_path(path: str) -> str:
+    """Extract the model name from a Vertex proxy path.
+
+    Handles both the FastAPI path parameter form:
+      /v1/projects/{project}/locations/{loc}/publishers/google/models/{model}:{method}
+    and the raw vertex_path parameter:
+      {project}/locations/{loc}/publishers/google/models/{model}:{method}
+
+    Returns empty string on parse failure (key_builder treats it as uncacheable-neutral).
+    """
+    import re as _re
+    _MODEL_RE = _re.compile(r"/models/([a-zA-Z0-9._\-]{1,128}):")
+    m = _MODEL_RE.search(path)
+    if m:
+        return m.group(1)
+    return ""

package/src/superlocalmemory/optimize/cache/semantic.py

@@ -444,13 +444,32 @@ class VCacheSemantic(SemanticTier):
             # Persist the cold-start record only if it isn't already in DB
             self._boundary_store.save(existing)
 
-        # Update in-memory index (dedupe)
+        # Update in-memory index (dedupe + size cap)
+        max_entries: int = int(
+            getattr(self._config, "semantic_max_index_entries", 10000)
+        )
+        max_tenants: int = int(
+            getattr(self._config, "semantic_max_tenants", 10000)
+        )
         with self._index_lock:
             tenant_index = self._index.setdefault(tenant_id, [])
             self._index[tenant_id] = [
                 e for e in tenant_index if e[0] != entry_id
             ]
             self._index[tenant_id].append((entry_id, context_fp, vec))
+            # Cap entries per tenant: evict oldest first (lossless — DB is truth).
+            if len(self._index[tenant_id]) > max_entries:
+                self._index[tenant_id] = self._index[tenant_id][-max_entries:]
+            # Stage-9: cap the NUMBER of tenant shards too. Without this, _index
+            # grew once per distinct tenant forever on a shared proxy. Evict the
+            # oldest-inserted shard (dict preserves insertion order); the evicted
+            # tenant rebuilds lazily from the DB on next access. Never evict the
+            # shard we just wrote.
+            if len(self._index) > max_tenants:
+                for _old in list(self._index):
+                    if _old != tenant_id:
+                        del self._index[_old]
+                        break
 
         # Update centroid
         self._centroid_store.update(tenant_id, vec)

package/src/superlocalmemory/optimize/compress/ccr.py

@@ -93,6 +93,18 @@ class CCRStore:
             logger.warning("CCRStore.retrieve failed (ccr_id=%s): %s", ccr_id, exc)
             return None
 
+    def delete(self, ccr_id: str) -> None:
+        """Delete a CCR row by ccr_id. Idempotent — never raises.
+
+        WP-10 D6: defensive infra. Deleting a non-existent ccr_id is a no-op.
+        """
+        try:
+            db = self._get_db()
+            db.ccr_delete(ccr_id)
+            logger.debug("CCR deleted ccr_id=%s", ccr_id)
+        except Exception as exc:
+            logger.warning("CCRStore.delete failed (non-fatal): %s", exc)
+
     def get_mcp_tool_definition(self) -> dict:
         return {
             "name": "headroom_retrieve",

package/src/superlocalmemory/optimize/compress/router.py

@@ -98,6 +98,7 @@ class CompressRouter:
                 request_id=req.request_id,
                 model=body.get("model", ""),
                 tenant_id="default",
+                is_proxy=True,  # D5-B: proxy path — Layer 2 lossy disabled
             )
 
             # S-01/Stage-9 fix: build new_bytes BEFORE the improvement guard.
@@ -156,6 +157,7 @@ class CompressRouter:
         request_id: str,
         model: str,
         tenant_id: str,
+        is_proxy: bool = False,
     ) -> tuple[list[dict[str, Any]], int, int, str]:
         total_before = 0
         total_after = 0
@@ -188,6 +190,7 @@ class CompressRouter:
                 request_id=request_id,
                 model=model,
                 tenant_id=tenant_id,
+                is_proxy=is_proxy,
             )
             total_before += before
             total_after += after
@@ -207,9 +210,12 @@ class CompressRouter:
         request_id: str,
         model: str,
         tenant_id: str,
+        is_proxy: bool = False,
     ) -> tuple[Any, int, int, str]:
         if isinstance(content, str):
-            return self._compress_text(content, aggressive, request_id, model, tenant_id)
+            return self._compress_text(
+                content, aggressive, request_id, model, tenant_id, is_proxy=is_proxy
+            )
 
         if isinstance(content, list):
             new_blocks: list[Any] = []
@@ -227,7 +233,8 @@ class CompressRouter:
                         new_blocks.append(block)
                         continue
                     new_text, before, after, strat = self._compress_text(
-                        text, aggressive, request_id, model, tenant_id
+                        text, aggressive, request_id, model, tenant_id,
+                        is_proxy=is_proxy,
                     )
                     total_before += before
                     total_after += after
@@ -252,6 +259,7 @@ class CompressRouter:
         request_id: str,
         model: str,
         tenant_id: str,
+        is_proxy: bool = False,
     ) -> tuple[str, int, int, str]:
         tokens_before = _token_estimate(text)
 
@@ -286,25 +294,37 @@ class CompressRouter:
         tokens_after_l1 = _token_estimate(normalized)
 
         # Layer 2 — LLMLingua-2 prose compression (aggressive + opt-in only)
+        # D5-B: proxy path SKIPS Layer 2 entirely — only Layer 1 lossless normalize
+        # runs on proxy (ProxyRequest has no response/rehydration hook for CCR markers).
         cfg = self._get_config()
         prose_enabled = bool(getattr(cfg, "compress_prose", False))
-        if aggressive and prose_enabled:  # pragma: no cover — LLMLingua optional dep
+        if aggressive and prose_enabled and not is_proxy:  # pragma: no cover — LLMLingua optional dep
             compressor = self._get_llmlingua_compressor()
             if compressor is not None:
-                # B-03: store original BEFORE lossy compression
-                ccr_id = self._ccr_store_original(text.encode(), model, tenant_id)
+                # D6: compress FIRST, store ONLY inside the reduction branch.
+                # Old code stored before compress → orphan row when no reduction occurred.
                 compressed = compressor.compress(normalized)
-                if ccr_id:
-                    self._ccr_update_compressed(ccr_id, compressed.encode())
                 tokens_after_l2 = _token_estimate(compressed)
                 if tokens_after_l2 < tokens_before:
-                    logger.info(
-                        "[%s] LLMLingua-2 prose compressed rate=%.2f ccr_id=%s (LOSSY)",
-                        request_id,
-                        tokens_after_l2 / tokens_before if tokens_before else 1.0,
-                        ccr_id,
+                    # Reduction confirmed — now safe to store (no orphan possible)
+                    ccr_id = self._ccr_store_original(text.encode(), model, tenant_id)
+                    if ccr_id:
+                        self._ccr_update_compressed(ccr_id, compressed.encode())
+                        logger.info(
+                            "[%s] LLMLingua-2 prose compressed rate=%.2f ccr_id=%s (LOSSY)",
+                            request_id,
+                            tokens_after_l2 / tokens_before if tokens_before else 1.0,
+                            ccr_id,
+                        )
+                        return compressed, tokens_before, tokens_after_l2, "llmlingua2_prose"
+                    # CCR store FAILED → no recoverable id. Returning the lossy form
+                    # now would destroy the original irreversibly. Refuse it and fall
+                    # through to lossless Layer 1 (data-safety over compression ratio).
+                    logger.warning(
+                        "[%s] CCR store failed — refusing irreversible lossy "
+                        "compression, falling back to lossless Layer 1", request_id,
                     )
-                    return compressed, tokens_before, tokens_after_l2, "llmlingua2_prose"
+                # No reduction (or store-failed) — fall through to lossless Layer 1.
 
         # S-01 fix: compare character length, not word count.
         # _token_estimate() is word-count — whitespace normalization saves characters/bytes
@@ -376,6 +396,19 @@ class CompressRouter:
         except Exception as exc:
             logger.debug("CCR update_compressed failed (non-fatal): %s", exc)
 
+    def _ccr_delete(self, ccr_id: str) -> None:
+        """WP-10 D6: Defensive delete — idempotent, never raises.
+
+        Used to clean up a CCR row if post-store processing fails. In the
+        store-after-success D6 path this should never be needed (no orphans
+        by construction), but kept as defensive infra + sweep parity.
+        """
+        try:
+            store = self._get_ccr_store()
+            store.delete(ccr_id)
+        except Exception as exc:
+            logger.debug("CCR delete failed (non-fatal): %s", exc)
+
     # ── Public convenience method (M-06) ──────────────────────────────────
 
     def compress_text(self, text: str, strategy: str = "auto") -> "CompressTextResult":