superlocalmemory 3.7.5 → 3.7.7

package/src/superlocalmemory/server/unified_daemon.py

@@ -182,10 +182,26 @@ class EngineRecallAdapter:
     loaded a SECOND MemoryEngine. This adapter eliminates that duplication.
     """
 
-    def __init__(self, engine) -> None:
+    def __init__(self, engine, profile_runtime=None) -> None:
+        self._engine = engine
+        self._profile_runtime = profile_runtime
+
+    def set_engine(self, engine) -> None:
+        """Replace the engine while the profile runtime is exclusive."""
         self._engine = engine
 
     def recall(self, query: str, limit: int = 10, session_id: str = "") -> dict:
+        from contextlib import nullcontext
+
+        lease = (
+            self._profile_runtime.operation()
+            if self._profile_runtime is not None
+            else nullcontext()
+        )
+        with lease:
+            return self._recall(query, limit=limit, session_id=session_id)
+
+    def _recall(self, query: str, limit: int = 10, session_id: str = "") -> dict:
         response = self._engine.recall(
             query, limit=limit, session_id=session_id or None,
         )
@@ -229,6 +245,84 @@ class EngineRecallAdapter:
         }
 
 
+def _configure_scale_backends(engine, config) -> None:
+    """Attach optional graph/vector backends to one initialized engine."""
+    try:
+        from superlocalmemory.core.backend_orchestrator import (
+            BackendOrchestrator,
+            set_orchestrator,
+        )
+
+        orchestrator = BackendOrchestrator(config=config, db=engine._db)
+        orchestrator.on_daemon_start()
+        set_orchestrator(orchestrator)
+        cozo_backend = orchestrator.get_graph_backend()
+        lancedb_backend = orchestrator.get_vector_backend()
+        retrieval = getattr(engine, "_retrieval_engine", None)
+        if retrieval is not None:
+            entity_graph = getattr(retrieval, "_entity", None)
+            if (
+                entity_graph is not None
+                and cozo_backend is not None
+                and orchestrator.graph_retrieval_ready()
+            ):
+                entity_graph._cozo = cozo_backend
+            semantic = getattr(retrieval, "_semantic", None)
+            if semantic is not None and lancedb_backend is not None:
+                semantic.set_scale_vector_backend(lancedb_backend)
+        logger.info(
+            "BackendOrchestrator: ready (cozo=%s, lancedb=%s)",
+            "active" if cozo_backend else "off",
+            "active" if lancedb_backend else "off",
+        )
+    except Exception as exc:
+        logger.warning("BackendOrchestrator init failed (non-fatal): %s", exc)
+
+
+def _hot_reconfigure_engine(application, new_config, *, mode_change: bool) -> None:
+    """Build and publish one coherent daemon engine for a saved config."""
+    from superlocalmemory.core.engine import MemoryEngine
+
+    old_engine = getattr(application.state, "engine", None)
+    new_engine = MemoryEngine(new_config)
+    try:
+        new_engine.initialize()
+        new_config.save(mode_change=mode_change)
+    except BaseException:
+        new_engine.close()
+        raise
+
+    # The profile transition barrier is exclusive here. Publish every
+    # long-lived reference before closing the former engine.
+    application.state.engine = new_engine
+    application.state.config = new_config
+    global _engine
+    _engine = new_engine
+    _observe_buffer.set_engine(new_engine)
+    adapter = getattr(application.state, "engine_recall_adapter", None)
+    if adapter is not None:
+        adapter.set_engine(new_engine)
+    _configure_scale_backends(new_engine, new_config)
+
+    old_health_stop = getattr(application.state, "recall_health_stop", None)
+    if old_health_stop is not None:
+        old_health_stop.set()
+    try:
+        from superlocalmemory.server.recall_health import start_recall_health_monitor
+
+        runtime = getattr(application.state, "profile_runtime", None)
+        _thread, health_stop, _state = start_recall_health_monitor(
+            new_engine, runtime=runtime,
+        )
+        application.state.recall_health_stop = health_stop
+    except Exception as exc:
+        application.state.recall_health_stop = None
+        logger.warning("recall-health restart failed (non-fatal): %s", exc)
+
+    if old_engine is not None and old_engine is not new_engine:
+        old_engine.close()
+
+
 # ---------------------------------------------------------------------------
 # v3.4.32: Recall-priority gate for the pending materializer.
 # All /remember writes go to pending.db and return fast; a background
@@ -248,6 +342,7 @@ from superlocalmemory.core.recall_gate import (
 # of pending memories — they accumulated forever, only being processed at
 # daemon startup via engine._process_pending_memories().
 _engine = None
+_profile_runtime = None
 
 
 def _emit_event(
@@ -277,7 +372,7 @@ def _emit_event(
 
 
 # v3.4.53: Limit concurrent full (non-fast) recalls. Without this, N parallel
-# /recall calls spawn N × 6-channel threads → Ollama serialises, reranker
+# /recall calls spawn N × full-recall threads → Ollama serialises, reranker
 # lock queues, and total wall time is N × single-recall-time. 3 concurrent
 # full recalls gives parallelism benefit without resource oversaturation.
 import asyncio as _asyncio
@@ -679,54 +774,24 @@ async def lifespan(application: FastAPI):
             except Exception:
                 pass
 
-        application.state.engine = engine
-        application.state.config = config
+        from superlocalmemory.server.profile_runtime import bind_profile_runtime
+
+        profile_runtime = bind_profile_runtime(application.state, engine, config)
+        application.state.reconfigure_engine = (
+            lambda new_config, mode_change=False: _hot_reconfigure_engine(
+                application, new_config, mode_change=mode_change,
+            )
+        )
         # v3.4.38: Wire module-level _engine for the pending materializer.
-        global _engine
+        global _engine, _profile_runtime
+        _profile_runtime = profile_runtime
         _engine = engine
         logger.info("Unified daemon: MemoryEngine initialized (mode=%s)", config.mode.value)
 
         # v3.5.0: Backend Orchestrator — CozoDB (graph) + LanceDB (vector) backends.
         # Initialise AFTER engine so the retrieval channels exist to receive backends.
         # Migrates edges/embeddings automatically; fail-soft (non-blocking).
-        _cozo_backend = None
-        _lancedb_backend = None
-        try:
-            from superlocalmemory.core.backend_orchestrator import (
-                BackendOrchestrator, set_orchestrator,
-            )
-            orch = BackendOrchestrator(config=config, db=engine._db)
-            orch.on_daemon_start()
-            set_orchestrator(orch)
-            _cozo_backend = orch.get_graph_backend()
-            _lancedb_backend = orch.get_vector_backend()
-            # Cozo storage may be active before its canonical-entity retrieval
-            # projection is parity-proven. Never route mismatched ID spaces.
-            re = getattr(engine, '_retrieval_engine', None)
-            if re is not None:
-                eg = getattr(re, '_entity', None)
-                if (
-                    eg is not None
-                    and _cozo_backend is not None
-                    and orch.graph_retrieval_ready()
-                ):
-                    try:
-                        eg._cozo = _cozo_backend
-                        logger.info("CozoDB backend wired into entity_graph channel")
-                    except Exception as exc:
-                        logger.warning("CozoDB channel injection failed: %s", exc)
-                semantic = getattr(re, '_semantic', None)
-                if semantic is not None and _lancedb_backend is not None:
-                    try:
-                        semantic.set_scale_vector_backend(_lancedb_backend)
-                        logger.info("LanceDB backend wired into semantic channel with SQLite shadow")
-                    except Exception as exc:
-                        logger.warning("LanceDB channel injection failed: %s", exc)
-            logger.info("BackendOrchestrator: ready (cozo=%s, lancedb=%s)",
-                         "active" if _cozo_backend else "off",
-                         "active" if _lancedb_backend else "off")
-        except Exception as exc:
-            logger.warning("BackendOrchestrator init failed (non-fatal): %s", exc)
+        _configure_scale_backends(engine, config)
 
         # LLD-07 §4 — deferred migrations (e.g. M006 reward column) need to
         # run AFTER MemoryEngine.initialize() has bootstrapped runtime tables
@@ -775,7 +840,7 @@ async def lifespan(application: FastAPI):
         # v3.4.52: Ensure covering indexes for SpreadingActivation queries.
         # SQLite 3.45+ streaming merge (UNION ALL + ORDER BY + LIMIT) uses
         # these to seek directly to top-K rows per subquery, avoiding a
-        # full sort.  Without them full 6-channel recall takes 7-10s on
+        # full sort.  Without them full recall takes 7-10s on
         # >1M edges (the SpreadingActivation 4-UNION query disk-sorts every
         # node's neighbor list on each call).  With them: sub-second.
         try:
@@ -835,7 +900,7 @@ async def lifespan(application: FastAPI):
                 logger.warning("Embedding warmup failed: %s", exc)
 
         def _warmup_recall():
-            """v3.4.62: Fire a full 6-channel recall after embedding warms up.
+            """v3.4.62: Fire a full recall after embedding warms up.
 
             Loads the graph_edges table (347K rows, ~100 MB) into the SQLite
             page cache. Without this, the first user query takes 15-24s because
@@ -853,10 +918,11 @@ async def lifespan(application: FastAPI):
             try:
                 t0 = _t.monotonic()
                 # Fire 2 warmup queries: one to load the graph page cache,
-                # second to warm the reranker subprocess + all 6 channels.
+                # second to warm the reranker subprocess + all producers.
                 # Without this, dashboard POST /api/search hits 11s cold.
-                for wq in ("memory recall performance", "context injection retrieval"):
-                    engine.recall(wq, limit=5)
+                with profile_runtime.operation():
+                    for wq in ("memory recall performance", "context injection retrieval"):
+                        engine.recall(wq, limit=5)
                 elapsed = round((_t.monotonic() - t0) * 1000)
                 logger.info(
                     "Recall engine pre-warmed in %dms", elapsed,
@@ -928,7 +994,9 @@ async def lifespan(application: FastAPI):
             from superlocalmemory.server.recall_health import (
                 start_recall_health_monitor,
             )
-            _rh_thread, _rh_stop, _ = start_recall_health_monitor(engine)
+            _rh_thread, _rh_stop, _ = start_recall_health_monitor(
+                engine, runtime=profile_runtime,
+            )
             application.state.recall_health_stop = _rh_stop
         except Exception as _rh_exc:
             logger.warning(
@@ -944,12 +1012,14 @@ async def lifespan(application: FastAPI):
             from superlocalmemory.core.recall_queue import RecallQueue
             _queue_db = state_path("recall_queue.db")
             _recall_queue = RecallQueue(_queue_db)
+            _engine_recall_adapter = EngineRecallAdapter(engine, profile_runtime)
             _queue_consumer = QueueConsumer(
                 queue=_recall_queue,
-                pool=EngineRecallAdapter(engine),
+                pool=_engine_recall_adapter,
             )
             _queue_consumer.start()
             application.state.queue_consumer = _queue_consumer
+            application.state.engine_recall_adapter = _engine_recall_adapter
             application.state.recall_queue = _recall_queue
             logger.info("QueueConsumer started (recall_queue.db)")
 
@@ -966,6 +1036,7 @@ async def lifespan(application: FastAPI):
         except Exception as _qc_exc:
             logger.warning("QueueConsumer start failed (non-fatal): %s", _qc_exc)
             application.state.queue_consumer = None
+            application.state.engine_recall_adapter = None
             application.state.recall_queue = None
 
     except Exception:
@@ -1315,11 +1386,21 @@ async def lifespan(application: FastAPI):
     except Exception as exc:  # pragma: no cover — defensive
         logger.warning("perf_log flush failed: %s", exc)
 
-    if engine is not None:
+    materializer_stopped = _stop_pending_materializer()
+    _profile_runtime = None
+    _engine = None
+    if engine is not None and materializer_stopped:
         try:
             engine.close()
         except Exception:
             pass
+    elif engine is not None:
+        # The process is already shutting down. Do not close a database/model
+        # object still owned by an admitted background operation; OS process
+        # teardown is safer than racing that writer with engine.close().
+        logger.warning(
+            "Engine close deferred because pending materializer is still active"
+        )
     _cleanup_process_descriptor(
         getattr(application.state, "daemon_descriptor", None),
     )
@@ -1362,9 +1443,19 @@ def create_app() -> FastAPI:
     application.state.daemon_descriptor = _process_descriptor(
         identity_port, SLM_VERSION, "starting",
     )
+    application.state.reconfigure_engine = (
+        lambda new_config, mode_change=False: _hot_reconfigure_engine(
+            application, new_config, mode_change=mode_change,
+        )
+    )
 
     # -- Middleware --
+    from superlocalmemory.server.profile_runtime import ProfileRuntimeMiddleware
     from superlocalmemory.server.security_middleware import SecurityHeadersMiddleware
+    application.add_middleware(
+        ProfileRuntimeMiddleware,
+        app_state=application.state,
+    )
     application.add_middleware(SecurityHeadersMiddleware)
     application.add_middleware(GZipMiddleware, minimum_size=1000)
     application.add_middleware(
@@ -1710,7 +1801,20 @@ def _register_dashboard_routes(application: FastAPI) -> None:
                             content={"error": str(_identity_exc.detail)},
                         )
                     raise
-            if not check_api_key(headers, is_write=is_write):
+            # v3.7.6 (#71/#73/#74): require_http_mutation_actor above is the
+            # authoritative write-auth boundary — it accepts the daemon
+            # capability, the dashboard install token, a matching X-SLM-API-Key,
+            # or an uncredentialed loopback caller, and fails closed for everyone
+            # else. The legacy check_api_key gate only understands X-SLM-API-Key,
+            # so running it as a second gate 401'd write paths that stage 1 had
+            # already authorized: capability-authenticated daemon write-throughs
+            # (MCP `remember`, #71) and install-token dashboard writes / config
+            # tests (#73/#74) whenever an api_key file exists. Only fall back to
+            # check_api_key when the mutation-actor gate did not run — i.e. for
+            # non-write, non-recall requests, where it is a no-op for reads.
+            if not requires_mutation_actor and not check_api_key(
+                headers, is_write=is_write
+            ):
                 from fastapi.responses import JSONResponse
                 return JSONResponse(
                     status_code=401,
@@ -1955,6 +2059,9 @@ def _register_daemon_routes(application: FastAPI) -> None:
         except Exception:
             _recall_health = {"recall_healthy": None}
         identity = getattr(application.state, "daemon_descriptor", None)
+        from superlocalmemory.server.profile_runtime import get_profile_runtime
+
+        profile_snapshot = get_profile_runtime(application.state).snapshot
         return {
             "status": "ok",
             "ready": fully_ready,
@@ -1972,6 +2079,8 @@ def _register_daemon_routes(application: FastAPI) -> None:
             # Runtime readiness is more precise than descriptor lifecycle.
             # A process can be alive and identity-valid while retrieval warms.
             "state": runtime_state,
+            "active_profile": profile_snapshot.profile_id,
+            "profile_generation": profile_snapshot.generation,
         }
 
     @application.get("/recall")
@@ -2063,8 +2172,13 @@ def _register_daemon_routes(application: FastAPI) -> None:
             )
             for _r in results:
                 _r["content"] = _sanitize_json_text(_r.get("content", ""))
+            from superlocalmemory.server.profile_runtime import get_profile_runtime
+
+            profile_snapshot = get_profile_runtime(application.state).snapshot
             return {
                 "ok": True,
+                "profile": profile_snapshot.profile_id,
+                "profile_generation": profile_snapshot.generation,
                 "query": search_query,
                 "query_type": response.query_type,
                 "result_count": len(results),
@@ -2299,17 +2413,54 @@ def _register_daemon_routes(application: FastAPI) -> None:
         _update_activity()
         # Non-blocking peek — status must never force a re-init.
         engine = getattr(application.state, "engine", None)
-        fact_count = engine.fact_count if engine else 0
-        mode = engine._config.mode.value if engine and hasattr(engine, '_config') else "unknown"
+        from superlocalmemory.server.profile_runtime import get_profile_runtime
+
+        profile_snapshot = get_profile_runtime(application.state).snapshot
+        config = getattr(application.state, "config", None)
+        fact_count = 0
+        entity_count = 0
+        edge_count = 0
+        if engine is not None:
+            try:
+                fact_count = engine._db.get_fact_count(profile_snapshot.profile_id)
+                entities = engine._db.execute(
+                    "SELECT COUNT(*) AS c FROM canonical_entities "
+                    "WHERE profile_id = ?",
+                    (profile_snapshot.profile_id,),
+                )
+                entity_count = int(dict(entities[0])["c"]) if entities else 0
+                edges = engine._db.execute(
+                    "SELECT COUNT(*) AS c FROM graph_edges WHERE profile_id = ?",
+                    (profile_snapshot.profile_id,),
+                )
+                edge_count = int(dict(edges[0])["c"]) if edges else 0
+            except Exception:
+                logger.debug("daemon status count query failed", exc_info=True)
+        db_path = getattr(config, "db_path", None)
+        db_size_mb = (
+            round(db_path.stat().st_size / 1024 / 1024, 2)
+            if db_path is not None and db_path.exists()
+            else 0.0
+        )
+        mode = getattr(getattr(config, "mode", None), "value", "unknown")
+        provider = getattr(getattr(config, "llm", None), "provider", "") or "none"
         return {
             "status": "running",
             "pid": os.getpid(),
             "uptime_s": round(time.monotonic() - (_start_time or time.monotonic())),
             "mode": mode,
+            "provider": provider,
             "fact_count": fact_count,
+            "entity_count": entity_count,
+            "edge_count": edge_count,
+            "base_dir": str(getattr(config, "base_dir", "")),
+            "db_path": str(db_path or ""),
+            "db_size_mb": db_size_mb,
             "idle_s": round(time.monotonic() - _last_activity),
             "port": application.state.daemon_descriptor.port,
             "legacy_port": _LEGACY_PORT,
+            "profile": profile_snapshot.profile_id,
+            "profile_generation": profile_snapshot.generation,
         }
 
     @application.get("/list")
@@ -2495,6 +2646,18 @@ def _materializer_actor_id() -> str:
     return f"daemon-capability:{descriptor.capability_fingerprint}"
 
 
+def _run_materializer_operation(runtime, engine_supplier, operation):
+    """Run one bounded background unit against an admitted engine snapshot."""
+    with runtime.operation():
+        # Resolve the engine only after admission. A concurrent mode/provider
+        # reconfiguration may have replaced the module-level engine while this
+        # worker was waiting at the transition barrier.
+        engine = engine_supplier()
+        if engine is None:
+            return None
+        return operation(engine)
+
+
 def _materialize_ingestion_one_pass(
     engine,
     *,
@@ -2596,6 +2759,10 @@ def _start_pending_materializer() -> None:
     """Drain M018 operations and backfill the legacy pending.db queue."""
     global _materializer_thread
 
+    if _materializer_thread is not None and _materializer_thread.is_alive():
+        return
+    _materializer_stop.clear()
+
     def _loop():
         from superlocalmemory.cli.pending_store import (
             get_pending, mark_done, mark_failed,
@@ -2611,9 +2778,12 @@ def _start_pending_materializer() -> None:
                 # not a stale local reference.
                 import superlocalmemory.server.unified_daemon as _ud
                 engine = _ud._engine
-                if engine is None:
+                runtime = _ud._profile_runtime
+                if engine is None or runtime is None:
                     if not _waiting_logged:
-                        logger.info("Materializer: waiting for engine to init...")
+                        logger.info(
+                            "Materializer: waiting for engine/runtime to init..."
+                        )
                         _waiting_logged = True
                     time.sleep(0.5)
                     continue
@@ -2621,10 +2791,18 @@ def _start_pending_materializer() -> None:
                     logger.info("Materializer: engine acquired, starting drain loop")
                     _engine_logged = True
 
-                durable_complete, durable_failed = _materialize_ingestion_one_pass(
-                    engine,
-                    limit=50,
+                cycle_result = _run_materializer_operation(
+                    runtime,
+                    lambda: _ud._engine,
+                    lambda admitted_engine: _materialize_ingestion_one_pass(
+                        admitted_engine,
+                        # One operation per lease bounds profile-switch wait
+                        # time without allowing engine components to rebind
+                        # halfway through an enrichment pipeline.
+                        limit=1,
+                    ),
                 )
+                durable_complete, durable_failed = cycle_result or (0, 0)
                 pending = get_pending(limit=50)
                 if not pending and not durable_complete and not durable_failed:
                     time.sleep(1.0)
@@ -2642,7 +2820,15 @@ def _start_pending_materializer() -> None:
                         time.sleep(0.5)
                         waits += 1
                     try:
-                        operation_id = _materialize_legacy_pending_item(engine, item)
+                        operation_id = _run_materializer_operation(
+                            runtime,
+                            lambda: _ud._engine,
+                            lambda admitted_engine: _materialize_legacy_pending_item(
+                                admitted_engine, item,
+                            ),
+                        )
+                        if operation_id is None:
+                            raise RuntimeError("resident engine became unavailable")
                         mark_done(item["id"])
                         _emit_event(
                             "memory.stored",
@@ -2670,6 +2856,21 @@ def _start_pending_materializer() -> None:
     logger.info("Pending materializer started (recall-priority)")
 
 
+def _stop_pending_materializer(timeout: float = 5.0) -> bool:
+    """Stop and join the background writer before closing its engine."""
+    global _materializer_thread
+
+    _materializer_stop.set()
+    thread = _materializer_thread
+    if thread is not None and thread.is_alive():
+        thread.join(timeout=timeout)
+        if thread.is_alive():
+            logger.warning("Pending materializer did not stop within %.1fs", timeout)
+            return False
+    _materializer_thread = None
+    return True
+
+
 def start_server(port: int = _DEFAULT_PORT) -> None:
     """Start the unified daemon. Blocks until stopped."""
     global _start_time

package/src/superlocalmemory/storage/migration_runner.py

@@ -120,6 +120,17 @@ _MODULES = {
 
 logger = logging.getLogger(__name__)
 
+# Exact historical DDL fingerprints whose resulting schema is intentionally
+# accepted by the current migration. Unknown hashes are never reconciled.
+_KNOWN_EQUIVALENT_DDL_HASHES: dict[str, frozenset[str]] = {
+    _M002.NAME: frozenset({
+        # v3.4.21 hardened copy-forward variant.
+        "347eeb2ec8aac89f7cbf373da49ac9446be9ed150e6105c382c656cd22426d4b",
+        # v3.4.22 model_version-default variant shipped through 3.6.x.
+        "d28666fa1dfa66e6514efd288e6748363513da2255a4cee95d80f233e6728ae7",
+    }),
+}
+
 
 @dataclass(frozen=True, slots=True)
 class Migration:
@@ -298,6 +309,39 @@ def _apply_single(
         _, _, logged_hash, _, status = existing
         if status == "complete":
             if logged_hash != ddl_hash:
+                # v3.7.6 (#70): a complete migration whose logged DDL hash no
+                # longer matches the current text is only a real failure if the
+                # schema it guarantees is actually absent. Historically-benign
+                # DDL edits (e.g. M002's V3.4.21 <-> S9-W1 variants that build the
+                # identical end-state) would otherwise brick readiness forever on
+                # upgrade. Consult the migration's own verify(); if the schema is
+                # in place, reconcile the log to the current hash and treat as
+                # already-applied instead of failing the daemon into permanent
+                # not_ready. Absent/failing verify keeps the hard failure.
+                allowed_hashes = _KNOWN_EQUIVALENT_DDL_HASHES.get(
+                    migration.name, frozenset(),
+                )
+                mod = _MODULES.get(migration.name)
+                verify_fn = (
+                    getattr(mod, "verify", None) if mod is not None else None
+                )
+                if logged_hash in allowed_hashes and verify_fn is not None:
+                    try:
+                        if verify_fn(conn):
+                            if not dry_run:
+                                try:
+                                    _upsert_log(
+                                        conn, migration.name, ddl_hash, "complete"
+                                    )
+                                except sqlite3.Error:  # pragma: no cover
+                                    pass
+                            return (
+                                "skipped",
+                                "allowlisted historical DDL reconciled after "
+                                "full schema verification",
+                            )
+                    except sqlite3.Error:  # pragma: no cover
+                        pass
                 detail = (
                     f"DDL drift detected for {migration.name}: "
                     f"logged={logged_hash[:8]}... current={ddl_hash[:8]}..."

package/src/superlocalmemory/storage/migrations/M002_model_state_history.py

@@ -29,14 +29,43 @@ _REQUIRED_COLS = frozenset({
 
 
 def verify(conn: sqlite3.Connection) -> bool:
-    """Return True if the rebuilt model_state schema is in place."""
+    """Verify columns plus both indexes promised by this migration."""
     try:
-        cols = {r[1] for r in conn.execute(
+        cols = {r[1]: r for r in conn.execute(
             "PRAGMA table_info(learning_model_state)"
         ).fetchall()}
+        index_rows = conn.execute(
+            "PRAGMA index_list(learning_model_state)"
+        ).fetchall()
     except sqlite3.Error:
         return False
-    return _REQUIRED_COLS <= cols
+    if not _REQUIRED_COLS <= set(cols):
+        return False
+
+    indexes = {row[1]: row for row in index_rows}
+    active = indexes.get("idx_model_active")
+    profile_time = indexes.get("idx_model_profile_time")
+    if active is None or profile_time is None:
+        return False
+    # idx_model_active must remain a UNIQUE partial index.
+    if int(active[2]) != 1 or int(active[4]) != 1:
+        return False
+    active_cols = [row[2] for row in conn.execute(
+        "PRAGMA index_info(idx_model_active)"
+    ).fetchall()]
+    time_cols = [row[2] for row in conn.execute(
+        "PRAGMA index_info(idx_model_profile_time)"
+    ).fetchall()]
+    if active_cols != ["profile_id"]:
+        return False
+    if time_cols != ["profile_id", "trained_at"]:
+        return False
+    sql_row = conn.execute(
+        "SELECT sql FROM sqlite_master WHERE type='index' AND name=?",
+        ("idx_model_active",),
+    ).fetchone()
+    normalized = " ".join(str(sql_row[0] if sql_row else "").lower().split())
+    return "where is_active = 1" in normalized
 
 
 # IMPORTANT: this DDL shipped in V3.4.21.  Migration hashes are immutable

package/src/superlocalmemory/ui/index.html

@@ -1058,11 +1058,42 @@
                                 </button>
                                 <span id="settings-emb-test-result" class="ms-2 small"></span>
                             </div>
-                            <div id="settings-emb-info" class="small text-muted mt-1">
+                        <div id="settings-emb-info" class="small text-muted mt-1">
                                 Using local <strong>nomic-embed-text-v1.5</strong> (768d)
                             </div>
                         </div>
 
+                        <!-- Step 4: Scope defaults (shared/global remain opt-in) -->
+                        <div class="mt-3 pt-3 border-top" id="settings-scope-panel">
+                            <h6 class="text-muted"><i class="bi bi-shield-lock"></i> Step 4: Memory Visibility</h6>
+                            <p class="small text-muted mb-2">
+                                Personal-only is the privacy-safe default. Enable broader visibility deliberately.
+                            </p>
+                            <div class="row g-2 align-items-end">
+                                <div class="col-md-4">
+                                    <label class="form-label small" for="settings-default-scope">Default write scope</label>
+                                    <select class="form-select form-select-sm" id="settings-default-scope">
+                                        <option value="personal">Personal (recommended)</option>
+                                        <option value="shared">Shared</option>
+                                        <option value="global">Global</option>
+                                    </select>
+                                </div>
+                                <div class="col-md-4">
+                                    <div class="form-check form-switch">
+                                        <input class="form-check-input" type="checkbox" id="settings-recall-shared">
+                                        <label class="form-check-label small" for="settings-recall-shared">Include shared memories by default</label>
+                                    </div>
+                                </div>
+                                <div class="col-md-4">
+                                    <div class="form-check form-switch">
+                                        <input class="form-check-input" type="checkbox" id="settings-recall-global">
+                                        <label class="form-check-label small" for="settings-recall-global">Include global memories by default</label>
+                                    </div>
+                                </div>
+                            </div>
+                            <div id="settings-scope-status" class="small text-muted mt-2"></div>
+                        </div>
+
                         <!-- Save button -->
                         <div class="mt-3">
                             <button class="btn btn-primary" id="settings-save-all">