superlocalmemory 3.7.8 → 3.8.1

package/src/superlocalmemory/server/unified_daemon.py

@@ -31,6 +31,7 @@ import json
 import logging
 import os
 import signal
+import sqlite3
 import sys
 import threading
 import time
@@ -65,12 +66,83 @@ from superlocalmemory.infra.data_root import (
     canonical_data_root,
     state_path,
 )
+from superlocalmemory.learning.source_quality import (
+    SourceQualityRepairUnavailable,
+    enumerate_source_quality_repair_profiles,
+    repair_historical_source_quality,
+)
 
 logger = logging.getLogger("superlocalmemory.unified_daemon")
 
 _DEFAULT_PORT = 8765
 _LEGACY_PORT = 8767
 _ACTIVE_DAEMON_DESCRIPTOR: DaemonDescriptor | None = None
+_SOURCE_QUALITY_MAX_BATCH_SIZE = 250
+_SOURCE_QUALITY_PROFILE_REFRESH_SECONDS = 60.0
+_FACT_ENTITY_REPAIR_MIN_RETRY_SECONDS = 0.05
+_FACT_ENTITY_REPAIR_MAX_RETRY_SECONDS = 30.0
+# ``wait=true`` is a compatibility affordance, never permission to hold the
+# ASGI event loop hostage to a local LLM.  Normal clients omit it and receive
+# an immediate durable/queryable receipt; explicit waiters get this small
+# completion window, then the M018 materializer continues in the background.
+_REMEMBER_ENRICHMENT_WAIT_SECONDS = 0.75
+_SENSITIVE_READ_PREFIXES = (
+    "/api/memories", "/api/facts", "/api/clusters", "/api/graph",
+    "/api/v3/associations", "/api/v3/core-memory",
+    "/api/v3/soft-prompts", "/api/v3/dashboard", "/api/v3/mode",
+    "/api/v3/embedding/config", "/api/v3/scope/config",
+    "/api/v3/storage/config", "/api/v3/daemon/config",
+    "/api/v3/mesh/config", "/api/v3/trust/config",
+    "/api/v3/forgetting/config", "/api/v3/mcp/profiles",
+    "/api/learning", "/api/behavioral",
+)
+_SENSITIVE_READ_EXACT_PATHS = (
+    "/api/search", "/api/v3/recall/trace", "/api/patterns",
+    "/api/feedback/stats", "/api/stats", "/api/timeline",
+)
+
+
+def _is_sensitive_dashboard_read(method: str, path: str) -> bool:
+    return (
+        method == "GET"
+        and (
+            path.startswith(_SENSITIVE_READ_PREFIXES)
+            or path in _SENSITIVE_READ_EXACT_PATHS
+            or path.startswith("/api/v3/recall")
+        )
+    )
+
+
+def _rbac_read_gate(request, app_state):
+    """RBAC gate for sensitive content reads. Returns a JSONResponse to reject,
+    or None to allow. No-op unless RBAC is active (>=1 user)."""
+    from fastapi.responses import JSONResponse
+    rbac = getattr(app_state, "rbac", None)
+    if rbac is None:
+        return None
+    try:
+        active = rbac.user_count() > 0
+    except Exception:
+        # Fail CLOSED: if we cannot determine RBAC state we must not silently
+        # allow reads (a DB error would otherwise open the whole read surface).
+        return JSONResponse(status_code=503,
+                            content={"error": "authorization temporarily unavailable"})
+    if not active:
+        return None  # single-operator install — reads are open
+    token = (request.headers.get("x-slm-user-session", "")
+             or (request.cookies.get("slm_session", "") if request.cookies else ""))
+    user = rbac.resolve_session(token) if token else None
+    if user is None:
+        if rbac.require_login():
+            return JSONResponse(status_code=401,
+                                content={"error": "Login required to read memory."})
+        return None  # owner/operator, personal mode
+    from superlocalmemory.access.rbac import Permission
+    from superlocalmemory.server.routes.helpers import get_active_profile
+    if rbac.has_permission(user["user_id"], get_active_profile(), Permission.READ):
+        return None
+    return JSONResponse(status_code=403,
+                        content={"error": "Your role cannot read this workspace."})
 
 
 def _configured_daemon_port() -> int:
@@ -210,7 +282,10 @@ class EngineRecallAdapter:
             if r.fact.memory_id
         })
         memory_map = (
-            self._engine._db.get_memory_content_batch(memory_ids)
+            self._engine._db.get_memory_content_batch(
+                memory_ids, self._engine.profile_id,
+                include_global=True, include_shared=True,
+            )
             if memory_ids else {}
         )
         # v3.6.6: same shared chokepoint as the HTTP route — identical output.
@@ -534,7 +609,7 @@ class ObserveBuffer:
                 "captured": False,
                 "durable": False,
                 "reason": "durable admission failed",
-                "error": str(exc),
+                "error": "internal error",
             }
 
     def _clear_seen(self) -> None:
@@ -643,6 +718,384 @@ async def _start_legacy_redirect(primary_port: int, legacy_port: int) -> None:
 # Lifespan
 # ---------------------------------------------------------------------------
 
+def _warm_spreading_activation(engine, runtime) -> bool:
+    """Pre-warm the spreading-activation channel for the active profile.
+
+    The ``--fast`` warmup recalls deliberately skip spreading activation (and the
+    Mode-C remote agentic verification), which left the first FULL user recall
+    paying the cold graph-load cost: the ``graph_edges`` + ``association_edges``
+    page cache and the ``fact_importance`` PageRank/community cache. This warms
+    that channel directly — pure local graph work, never a remote/LLM call — so
+    the first full recall is warm. Fail-soft; returns True only when it ran.
+    """
+    try:
+        retr = getattr(engine, "_retrieval_engine", None)
+        sa = getattr(retr, "_spreading_activation", None) if retr else None
+        embedder = getattr(retr, "_embedder", None) if retr else None
+        if sa is None or embedder is None or not hasattr(embedder, "embed"):
+            return False
+        query_embedding = embedder.embed("memory recall performance")
+        if query_embedding is None:
+            return False
+        active_pid = getattr(engine, "profile_id", "default") or "default"
+        lease = runtime.operation_nowait() if runtime is not None else None
+        if lease is not None:
+            with lease as snap:
+                if snap is None:
+                    return False
+                sa.search(query_embedding, profile_id=active_pid, top_k=7)
+        else:
+            sa.search(query_embedding, profile_id=active_pid, top_k=7)
+        logger.info(
+            "Spreading-activation graph pre-warmed for profile %s", active_pid,
+        )
+        return True
+    except Exception as exc:
+        logger.warning("Spreading-activation warmup failed (non-fatal): %s", exc)
+        return False
+
+
+def _set_source_quality_repair_status(application, **updates) -> dict:
+    current = getattr(
+        application.state, "source_quality_repair_status", {},
+    )
+    status = {**current, **updates}
+    application.state.source_quality_repair_status = status
+    return status
+
+
+def _schedule_fact_entity_association_repair(
+    application,
+    memory_db_path: Path,
+    *,
+    batch_size: int = 250,
+    tick_seconds: float = 1.0,
+) -> asyncio.Task:
+    """Schedule bounded M028 backfill only after readiness is published."""
+    from superlocalmemory.storage.migrations.M028_fact_entity_associations import (
+        get_repair_status,
+    )
+
+    durable = get_repair_status(Path(memory_db_path))
+    application.state.fact_entity_association_repair_status = {
+        **durable,
+        "source": "startup_background_repair",
+        "batch_size": batch_size,
+    }
+    task = asyncio.create_task(
+        _fact_entity_association_repair_loop(
+            application,
+            Path(memory_db_path),
+            batch_size=batch_size,
+            tick_seconds=tick_seconds,
+        ),
+        name="fact-entity-association-upgrade-repair",
+    )
+    application.state.fact_entity_association_repair_task = task
+    return task
+
+
+async def _fact_entity_association_repair_loop(
+    application,
+    memory_db_path: Path,
+    *,
+    batch_size: int,
+    tick_seconds: float,
+) -> None:
+    from superlocalmemory.storage.migrations.M028_fact_entity_associations import (
+        get_repair_status,
+        repair_fact_entity_associations,
+    )
+
+    consecutive_failures = 0
+    try:
+        while True:
+            try:
+                await asyncio.to_thread(
+                    repair_fact_entity_associations,
+                    memory_db_path,
+                    batch_size=batch_size,
+                    max_batches=1,
+                )
+                durable = await asyncio.to_thread(
+                    get_repair_status, memory_db_path,
+                )
+            except sqlite3.Error as exc:
+                consecutive_failures += 1
+                retry_delay = min(
+                    _FACT_ENTITY_REPAIR_MAX_RETRY_SECONDS,
+                    max(
+                        _FACT_ENTITY_REPAIR_MIN_RETRY_SECONDS,
+                        float(tick_seconds),
+                    ) * (2 ** min(consecutive_failures - 1, 10)),
+                )
+                try:
+                    durable = await asyncio.to_thread(
+                        get_repair_status, memory_db_path,
+                    )
+                except sqlite3.Error:
+                    durable = getattr(
+                        application.state,
+                        "fact_entity_association_repair_status",
+                        {},
+                    )
+                application.state.fact_entity_association_repair_status = {
+                    **durable,
+                    "state": "retrying",
+                    "source": "startup_background_repair",
+                    "batch_size": batch_size,
+                    "last_error": (
+                        durable.get("last_error") or type(exc).__name__
+                    ),
+                    "retry_attempt": consecutive_failures,
+                    "retry_delay_seconds": retry_delay,
+                }
+                await asyncio.sleep(retry_delay)
+                continue
+
+            consecutive_failures = 0
+            application.state.fact_entity_association_repair_status = {
+                **durable,
+                "source": "startup_background_repair",
+                "batch_size": batch_size,
+                "retry_attempt": 0,
+                "retry_delay_seconds": 0.0,
+            }
+            if durable["state"] == "complete":
+                return
+            await asyncio.sleep(max(0.0, float(tick_seconds)))
+    except asyncio.CancelledError:
+        raise
+    except Exception as exc:
+        durable = await asyncio.to_thread(get_repair_status, memory_db_path)
+        application.state.fact_entity_association_repair_status = {
+            **durable,
+            "source": "startup_background_repair",
+            "batch_size": batch_size,
+            "last_error": durable.get("last_error") or type(exc).__name__,
+        }
+
+
+async def _cancel_fact_entity_association_repair(application) -> None:
+    task = getattr(
+        application.state, "fact_entity_association_repair_task", None,
+    )
+    if task is None:
+        return
+    if not task.done():
+        task.cancel()
+    try:
+        await task
+    except asyncio.CancelledError:
+        pass
+
+
+def _schedule_source_quality_repair(
+    application,
+    memory_db_path: Path,
+    learning_db_path: Path,
+    *,
+    batch_size: int = 25,
+    tick_seconds: float = 1.0,
+) -> asyncio.Task:
+    """Schedule post-readiness repair without awaiting historical DB work."""
+    _set_source_quality_repair_status(
+        application,
+        state="scheduled",
+        source="startup_background_repair",
+        batch_size=batch_size,
+        profiles=[],
+        completed_profiles=[],
+        profile_results={},
+        batches_completed=0,
+        scanned=0,
+        observations=0,
+        last_error=None,
+    )
+    task = asyncio.create_task(
+        _source_quality_repair_loop(
+            application,
+            Path(memory_db_path),
+            Path(learning_db_path),
+            batch_size=batch_size,
+            tick_seconds=tick_seconds,
+        ),
+        name="source-quality-upgrade-repair",
+    )
+    application.state.source_quality_repair_task = task
+    return task
+
+
+async def _repair_one_source_quality_profile(
+    memory_db_path: Path,
+    learning_db_path: Path,
+    profile_id: str,
+    batch_size: int,
+) -> dict[str, int | bool]:
+    worker = asyncio.create_task(
+        asyncio.to_thread(
+            repair_historical_source_quality,
+            memory_db_path,
+            learning_db_path,
+            profile_id,
+            batch_size=batch_size,
+            max_batches=1,
+        ),
+        name=f"source-quality-repair-batch-{profile_id}",
+    )
+    try:
+        return await asyncio.shield(worker)
+    except asyncio.CancelledError:
+        # Cancellation cannot stop a running worker thread. Await the bounded
+        # batch so SQLite writes finish before daemon teardown closes storage.
+        await worker
+        raise
+
+
+def _record_source_quality_repair_result(
+    application,
+    profile_id: str,
+    result: dict[str, int | bool],
+) -> bool:
+    current = getattr(
+        application.state, "source_quality_repair_status", {},
+    )
+    completed = set(current.get("completed_profiles", []))
+    if result["complete"]:
+        completed.add(profile_id)
+    results = {
+        **current.get("profile_results", {}),
+        profile_id: result,
+    }
+    _set_source_quality_repair_status(
+        application,
+        profile_results=results,
+        completed_profiles=sorted(completed),
+        batches_completed=int(current.get("batches_completed", 0)) + 1,
+        scanned=int(current.get("scanned", 0)) + int(result["scanned"]),
+        observations=int(current.get("observations", 0))
+        + int(result["observations"]),
+    )
+    return not bool(result["complete"])
+
+
+async def _source_quality_repair_tick(
+    application,
+    memory_db_path: Path,
+    learning_db_path: Path,
+    profiles: list[str],
+    *,
+    batch_size: int,
+) -> list[str]:
+    _set_source_quality_repair_status(
+        application,
+        state="running",
+        profiles=profiles,
+        current_batch_size=batch_size,
+        last_error=None,
+    )
+    pending = []
+    for profile_id in profiles:
+        result = await _repair_one_source_quality_profile(
+            memory_db_path, learning_db_path, profile_id, batch_size,
+        )
+        if _record_source_quality_repair_result(
+            application, profile_id, result,
+        ):
+            pending.append(profile_id)
+        await asyncio.sleep(0)
+    return pending
+
+
+async def _discover_source_quality_profiles(
+    memory_db_path: Path,
+    pending: list[str] | None,
+    completed: list[str],
+) -> list[str]:
+    discovered = await asyncio.to_thread(
+        enumerate_source_quality_repair_profiles,
+        memory_db_path,
+    )
+    return sorted(
+        (set(pending or []) | set(discovered)) - set(completed),
+    )
+
+
+async def _source_quality_repair_loop(
+    application,
+    memory_db_path: Path,
+    learning_db_path: Path,
+    *,
+    batch_size: int,
+    tick_seconds: float,
+) -> None:
+    """Run one resumable repair batch per discovered profile and tick."""
+    pending: list[str] | None = None
+    next_refresh = 0.0
+    successful_ticks = 0
+    try:
+        while True:
+            try:
+                now = time.monotonic()
+                if pending is None or now >= next_refresh:
+                    status = getattr(
+                        application.state,
+                        "source_quality_repair_status",
+                        {},
+                    )
+                    pending = await _discover_source_quality_profiles(
+                        memory_db_path,
+                        pending,
+                        status.get("completed_profiles", []),
+                    )
+                    next_refresh = (
+                        now + _SOURCE_QUALITY_PROFILE_REFRESH_SECONDS
+                    )
+                adaptive_batch = min(
+                    _SOURCE_QUALITY_MAX_BATCH_SIZE,
+                    batch_size * (2 ** min(successful_ticks, 4)),
+                )
+                pending = await _source_quality_repair_tick(
+                    application,
+                    memory_db_path,
+                    learning_db_path,
+                    pending,
+                    batch_size=adaptive_batch,
+                )
+            except (SourceQualityRepairUnavailable, sqlite3.Error):
+                _set_source_quality_repair_status(
+                    application,
+                    state="retrying",
+                    last_error="storage_temporarily_unavailable",
+                )
+            else:
+                successful_ticks += 1
+            if pending == []:
+                _set_source_quality_repair_status(application, state="complete")
+                return
+            await asyncio.sleep(max(0.0, float(tick_seconds)))
+    except asyncio.CancelledError:
+        _set_source_quality_repair_status(application, state="cancelled")
+        raise
+    except Exception as exc:
+        logger.warning("source-quality startup repair failed: %s", exc)
+        _set_source_quality_repair_status(
+            application, state="failed", last_error=type(exc).__name__,
+        )
+
+
+async def _cancel_source_quality_repair(application) -> None:
+    task = getattr(application.state, "source_quality_repair_task", None)
+    if task is None:
+        return
+    if not task.done():
+        task.cancel()
+    try:
+        await task
+    except asyncio.CancelledError:
+        pass
+
+
 @asynccontextmanager
 async def lifespan(application: FastAPI):
     """Initialize engine, workers, and optional services on startup."""
@@ -765,14 +1218,10 @@ async def lifespan(application: FastAPI):
         engine = MemoryEngine(config)
         engine.initialize()
 
-        # Enforce WAL mode for concurrent reads
-        db = getattr(engine, '_db', None) or getattr(engine, '_storage', None)
-        if db and hasattr(db, 'execute'):
-            try:
-                db.execute("PRAGMA journal_mode=WAL")
-                db.execute("PRAGMA synchronous=NORMAL")
-            except Exception:
-                pass
+        # WAL is already established at DB creation (DatabaseManager._enable_wal
+        # / schema init). Re-asserting PRAGMA journal_mode=WAL here is a
+        # schema-level write on the shared connection that raced in-flight
+        # startup requests for the writer lock — removed (H-CONC-3).
 
         from superlocalmemory.server.profile_runtime import bind_profile_runtime
 
@@ -846,24 +1295,28 @@ async def lifespan(application: FastAPI):
         try:
             import sqlite3 as _sqlite3
             _idx_conn = _sqlite3.connect(str(_memory_db))
-            _idx_conn.execute("PRAGMA journal_mode=WAL")
-            _idx_conn.execute(
-                "CREATE INDEX IF NOT EXISTS idx_edges_source_weight "
-                "ON graph_edges(profile_id, source_id, weight DESC)"
-            )
-            _idx_conn.execute(
-                "CREATE INDEX IF NOT EXISTS idx_edges_target_weight "
-                "ON graph_edges(profile_id, target_id, weight DESC)"
-            )
-            _idx_conn.execute(
-                "CREATE INDEX IF NOT EXISTS idx_assoc_source_weight "
-                "ON association_edges(profile_id, source_fact_id, weight DESC)"
-            )
-            _idx_conn.execute(
-                "CREATE INDEX IF NOT EXISTS idx_assoc_target_weight "
-                "ON association_edges(profile_id, target_fact_id, weight DESC)"
-            )
-            _idx_conn.close()
+            try:
+                _idx_conn.execute("PRAGMA journal_mode=WAL")
+                _idx_conn.execute(
+                    "CREATE INDEX IF NOT EXISTS idx_edges_source_weight "
+                    "ON graph_edges(profile_id, source_id, weight DESC)"
+                )
+                _idx_conn.execute(
+                    "CREATE INDEX IF NOT EXISTS idx_edges_target_weight "
+                    "ON graph_edges(profile_id, target_id, weight DESC)"
+                )
+                _idx_conn.execute(
+                    "CREATE INDEX IF NOT EXISTS idx_assoc_source_weight "
+                    "ON association_edges(profile_id, source_fact_id, weight DESC)"
+                )
+                _idx_conn.execute(
+                    "CREATE INDEX IF NOT EXISTS idx_assoc_target_weight "
+                    "ON association_edges(profile_id, target_fact_id, weight DESC)"
+                )
+            finally:
+                # CP-09: close even if an execute() raises, so the connection
+                # (and its file handle / shared DB lock) never leaks.
+                _idx_conn.close()
         except Exception as _idx_exc:
             logger.debug("SpreadingActivation covering indexes skipped: %s", _idx_exc)
 
@@ -909,6 +1362,11 @@ async def lifespan(application: FastAPI):
 
             Runs after embedding warm (embed first so recall can use it).
             Named 'recall-warmup' so it appears clearly in thread dumps.
+
+            v3.x: each warmup query holds its own operation_nowait() lease
+            (previously one lease across both queries held for up to 20s,
+            blocking any profile switch issued at daemon start).  A pending
+            transition preempts remaining queries; they complete on next boot.
             """
             import time as _t
             for _ in range(60):
@@ -920,9 +1378,20 @@ async def lifespan(application: FastAPI):
                 # Fire 2 warmup queries: one to load the graph page cache,
                 # second to warm the reranker subprocess + all producers.
                 # Without this, dashboard POST /api/search hits 11s cold.
-                with profile_runtime.operation():
-                    for wq in ("memory recall performance", "context injection retrieval"):
-                        engine.recall(wq, limit=5)
+                # Each query holds its own brief operation_nowait() lease so a
+                # concurrent profile switch is not blocked by both recalls.
+                for wq in ("memory recall performance", "context injection retrieval"):
+                    with profile_runtime.operation_nowait() as _snap:
+                        if _snap is None:
+                            logger.debug(
+                                "Recall warmup preempted by profile transition "
+                                "— skipping remaining warmup queries"
+                            )
+                            break
+                        engine.recall(wq, limit=5, fast=True)  # short lease so a profile switch can drain within 5s
+                # v3.8: the --fast recalls above skip spreading activation; warm
+                # that channel directly so the first FULL recall is not cold.
+                _warm_spreading_activation(engine, profile_runtime)
                 elapsed = round((_t.monotonic() - t0) * 1000)
                 logger.info(
                     "Recall engine pre-warmed in %dms", elapsed,
@@ -1079,9 +1548,50 @@ async def lifespan(application: FastAPI):
         else:
             application.state.mesh_broker = None
     except Exception as exc:
-        logger.debug("Mesh broker init: %s", exc)
+        logger.warning("Mesh broker init failed: %s", exc)
         application.state.mesh_broker = None
 
+    # RBAC / teams (C3): user identity + role enforcement over memory.db.
+    # Additive — with zero users the daemon stays single-operator (owner).
+    try:
+        from superlocalmemory.access.rbac import RbacEngine
+        rbac_db = config.db_path if config else state_path("memory.db")
+        rbac_engine = RbacEngine(str(rbac_db))
+        rbac_engine.purge_expired_sessions()
+        application.state.rbac = rbac_engine
+        logger.info("RBAC engine ready (users=%d)", rbac_engine.user_count())
+    except Exception as exc:
+        logger.warning("RBAC engine init failed: %s", exc)
+        application.state.rbac = None
+
+    # Deployment config (v3.8.0) — read [deployment] from config.toml and wire.
+    # Additive / fail-open: personal defaults are a no-op so existing installs
+    # with no [deployment] section behave EXACTLY as before.
+    # ENFORCE rule: only UPGRADE a setting, NEVER downgrade an already-stronger
+    # runtime setting (e.g. RBAC require_login already True → leave it alone).
+    try:
+        from superlocalmemory.core.config import load_deployment_config
+        deployment = load_deployment_config()
+        application.state.deployment = deployment
+        if deployment.require_login:
+            _dep_rbac = getattr(application.state, "rbac", None)
+            if _dep_rbac is not None and not _dep_rbac.require_login():
+                _dep_rbac.set_require_login(True)
+                logger.info(
+                    "Deployment: require_login enforced via enterprise deployment config"
+                )
+        # TODO: Wire deployment.pii_redaction → PII redaction subsystem (WP-10)
+        # TODO: Wire deployment.retention_enabled → retention scheduler (WP-11)
+        logger.info(
+            "Deployment config loaded: mode=%s require_login=%s "
+            "pii=%s retention=%s audit=%s",
+            deployment.mode, deployment.require_login,
+            deployment.pii_redaction, deployment.retention_enabled, deployment.audit,
+        )
+    except Exception as _dep_exc:
+        logger.warning("Deployment config wire failed (non-fatal): %s", _dep_exc)
+        application.state.deployment = None
+
     # Start idle watchdog if configured
     idle_timeout = int(os.environ.get("SLM_DAEMON_IDLE_TIMEOUT", "0"))
     if config and hasattr(config, 'daemon_idle_timeout'):
@@ -1114,7 +1624,9 @@ async def lifespan(application: FastAPI):
         try:
             from superlocalmemory.cli.context_commands import build_default_adapters
             from superlocalmemory.hooks.sync_loop import schedule as _schedule_sync
-            _schedule_sync(build_default_adapters())
+            # Keep the task handle so it can be cancelled at shutdown (H-CONC-2)
+            # — otherwise adapter file I/O outlives the daemon.
+            application.state._sync_task = _schedule_sync(build_default_adapters())
         except Exception as exc:  # pragma: no cover — defensive
             logger.warning("cross-platform sync loop failed to start: %s", exc)
 
@@ -1219,7 +1731,33 @@ async def lifespan(application: FastAPI):
         application.state.daemon_descriptor = _publish_process_descriptor(
             _configured_daemon_port(), SLM_VERSION, "ready",
         )
-        yield
+        _schedule_source_quality_repair(
+            application,
+            state_path("memory.db"),
+            state_path("learning.db"),
+        )
+        _schedule_fact_entity_association_repair(
+            application,
+            state_path("memory.db"),
+        )
+        try:
+            yield
+        finally:
+            await _cancel_fact_entity_association_repair(application)
+            await _cancel_source_quality_repair(application)
+
+    # Cancel the cross-platform sync loop (H-CONC-2) so adapter file I/O does
+    # not outlive the daemon.
+    try:
+        _sync_task = getattr(application.state, "_sync_task", None)
+        if _sync_task is not None and not _sync_task.done():
+            _sync_task.cancel()
+            try:
+                await _sync_task
+            except asyncio.CancelledError:
+                pass
+    except Exception:  # pragma: no cover — defensive
+        pass
 
     # Cancel optimize metrics flush loop + run final flush before shutdown
     try:
@@ -1463,7 +2001,9 @@ def create_app() -> FastAPI:
         allow_origins=[
             "http://localhost:8765", "http://127.0.0.1:8765",
             "http://localhost:8767", "http://127.0.0.1:8767",  # legacy compat
-            "http://localhost:8417", "http://127.0.0.1:8417",
+            # M-04 (3.7.9): removed the undocumented port 8417 origin — it had
+            # no known consumer and let any local service on 8417 make
+            # credentialed cross-origin requests to the API.
         ],
         allow_credentials=True,
         allow_methods=["GET", "POST", "PUT", "DELETE", "PATCH", "OPTIONS"],
@@ -1568,13 +2108,19 @@ def create_app() -> FastAPI:
             # toggled INDEPENDENTLY from the UI with no restart. UI save fires the
             # callback immediately; external edits are caught by the 2s watchdog.
             _opt_store.register_change_callback(_proxy.reload_from_config)
-            _opt_store.start_watchdog()
             logger.info(
                 "optimize.proxy mounted on /v1/*, /v1beta/*  port=8765 "
                 "(runtime cache/compress hot-reload enabled)"
             )
         else:
             application.state.optimize_proxy = None
+        # H1 fix: the config watchdog must run REGARDLESS of proxy state so
+        # optimize.json edits (cache/compress toggles, and a future
+        # proxy_enabled flip) are picked up at runtime. Previously it only
+        # started when the proxy was already on, so a daemon that booted with
+        # the proxy off never saw any optimize.json change. start_watchdog()
+        # is idempotent.
+        _opt_store.start_watchdog()
     except ImportError:
         application.state.optimize_proxy = None
         logger.debug("optimize.proxy not installed — skipping")
@@ -1610,6 +2156,14 @@ def create_app() -> FastAPI:
         if _mcp_allowed:
             from mcp.server.transport_security import TransportSecuritySettings
             if _mcp_allowed == "*":
+                # M-05 (3.7.9): "*" fully disables DNS-rebinding protection.
+                # Never silent — a convenience setting in a CI/Docker env must
+                # not quietly expose the instance.
+                logger.warning(
+                    "SLM_MCP_ALLOWED_HOSTS=* disables MCP DNS-rebinding "
+                    "protection entirely. Prefer an explicit host list; only "
+                    "use '*' on a trusted private network."
+                )
                 _mcp_fastmcp.settings.transport_security = TransportSecuritySettings(
                     enable_dns_rebinding_protection=False,
                 )
@@ -1688,22 +2242,47 @@ def _register_dashboard_routes(application: FastAPI) -> None:
         _write_limiter = RateLimiter(max_requests=_rl_write, window_seconds=_rl_window)
         _read_limiter = RateLimiter(max_requests=_rl_read, window_seconds=_rl_window)
 
-        # S9-DASH-09: loopback (127.0.0.1 / ::1) is always the dashboard
-        # itself — it legitimately makes many rapid reads (Brain + tabs +
-        # polling). Rate-limiting our own UI produces 429s that cascade
-        # into blank panels. CORS already restricts origins to localhost,
-        # so we don't lose the anti-abuse posture for external callers.
-        # v3.6.12 (issue #40): in SLM_REMOTE mode an allowlisted LAN browser is
-        # the user's own dashboard doing the same rapid polling, so it is exempt
-        # too (is_rate_limit_exempt) — otherwise normal polling trips 429.
+        # S9-DASH-09: loopback (127.0.0.1 / ::1) is the local dashboard and
+        # makes many rapid reads (Brain + tabs + polling). L-03 (3.7.9): rather
+        # than exempt loopback entirely, give it a *generous* limit — far above
+        # normal UI polling — so a runaway local agent's write flood is still
+        # eventually throttled. A LAN browser allowlisted in SLM_REMOTE mode
+        # (is_rate_limit_exempt, non-loopback) stays fully exempt.
+        _lb_write = max(300, _rl_write * 10)
+        _lb_read = max(2000, _rl_read * 20)
+        _lb_write_limiter = RateLimiter(max_requests=_lb_write, window_seconds=_rl_window)
+        _lb_read_limiter = RateLimiter(max_requests=_lb_read, window_seconds=_rl_window)
+
+        # Task #47: register the live limiters so the dashboard PUT
+        # /api/v3/ratelimit reconfigures them at runtime (no restart), then
+        # apply any persisted override from config.json.
+        try:
+            from superlocalmemory.infra.rate_limiter import (
+                register_managed as _reg_rl, reset_managed as _reset_rl,
+            )
+            _reset_rl()
+            _reg_rl("write", _write_limiter)
+            _reg_rl("read", _read_limiter)
+            _reg_rl("lb_write", _lb_write_limiter)
+            _reg_rl("lb_read", _lb_read_limiter)
+            from superlocalmemory.server.routes.ratelimit import (
+                load_persisted_limits as _load_rl,
+            )
+            _load_rl()
+        except Exception as _reg_exc:  # pragma: no cover - defensive
+            logger.debug("rate-limit runtime registration skipped: %s", _reg_exc)
 
         @application.middleware("http")
         async def rate_limit_middleware(request, call_next):
             client_ip = request.client.host if request.client else "unknown"
-            if is_rate_limit_exempt(client_ip):
-                return await call_next(request)
             is_write = request.method in ("POST", "PUT", "DELETE", "PATCH")
-            limiter = _write_limiter if is_write else _read_limiter
+            loopback = client_ip in ("127.0.0.1", "::1")
+            if not loopback and is_rate_limit_exempt(client_ip):
+                return await call_next(request)
+            if loopback:
+                limiter = _lb_write_limiter if is_write else _lb_read_limiter
+            else:
+                limiter = _write_limiter if is_write else _read_limiter
             allowed, remaining = limiter.is_allowed(client_ip)
             if not allowed:
                 from fastapi.responses import JSONResponse
@@ -1760,19 +2339,35 @@ def _register_dashboard_routes(application: FastAPI) -> None:
                         "error": "Remote HTTP MCP requires a configured SLM API key."
                     },
                 )
-            # v3.6.12 (csrf-1): defense-in-depth CSRF/DNS-rebinding guard on
-            # state-changing requests. A cross-origin browser Origin is rejected;
-            # loopback origins (the local dashboard) always pass, and LAN origins
-            # pass only when explicitly allowlisted in SLM_REMOTE mode. Non-browser
-            # clients (CLI/MCP/curl) send no Origin and are unaffected.
+            # Defense-in-depth CSRF/DNS-rebinding guard. A loopback hostname is
+            # not, by itself, a trusted web origin: a different local process can
+            # serve a page on another port. Credentialless browser writes must
+            # therefore originate from this daemon's exact port. A local
+            # integration on another port may still write when it presents a
+            # valid credential; require_http_mutation_actor below validates it.
+            # LAN origins remain opt-in through remote mode. Non-browser clients
+            # (CLI/MCP/curl) send no Origin and are unaffected.
             if requires_mutation_actor:
                 _origin = headers.get("origin", "") or headers.get("Origin", "")
                 if _origin:
-                    _ok_origin = any(_origin.startswith(p) for p in (
-                        "http://127.0.0.1", "https://127.0.0.1",
-                        "http://localhost", "https://localhost",
-                        "http://[::1]", "https://[::1]",
-                    ))
+                    from superlocalmemory.server.origin import (
+                        origin_is_daemon,
+                        origin_is_loopback,
+                    )
+
+                    _daemon = getattr(application.state, "daemon_descriptor", None)
+                    _daemon_port = getattr(_daemon, "port", None) or _configured_daemon_port()
+                    _ok_origin = origin_is_daemon(_origin, port=int(_daemon_port))
+                    _has_browser_credential = any(
+                        headers.get(_header)
+                        for _header in (
+                            "x-slm-daemon-capability",
+                            "x-install-token",
+                            "x-slm-api-key",
+                        )
+                    )
+                    if not _ok_origin and origin_is_loopback(_origin) and _has_browser_credential:
+                        _ok_origin = True
                     if not _ok_origin:
                         from superlocalmemory.core.remote_mode import is_remote_origin_allowed
                         _ok_origin = is_remote_origin_allowed(_origin)
@@ -1848,6 +2443,19 @@ def _register_dashboard_routes(application: FastAPI) -> None:
                                 )
                             },
                         )
+            # RBAC read gate (C3/audit SEC-C-01): sensitive content reads must
+            # also respect roles. Engages ONLY when RBAC is active (>=1 user) —
+            # single-operator installs are unaffected. Owner (no session) reads
+            # freely unless company mode (require_login) is on; a logged-in user
+            # must hold READ on the active workspace.
+            # Config, learning, and behavioral reads expose installation,
+            # preference, workflow, source-reputation, or outcome data.
+            if _is_sensitive_dashboard_read(
+                request.method, request.url.path,
+            ):
+                _resp = _rbac_read_gate(request, application.state)
+                if _resp is not None:
+                    return _resp
             return await call_next(request)
     except Exception as _auth_exc:
         # v3.6.12 (failopen-1): security middleware must NEVER fail open silently.
@@ -1920,6 +2528,21 @@ def _register_dashboard_routes(application: FastAPI) -> None:
     application.include_router(v3_router)
     application.include_router(adapters_router)
 
+    # RBAC / teams (C3) — user & role administration + login.
+    try:
+        from superlocalmemory.server.routes.rbac import router as rbac_router
+        application.include_router(rbac_router)
+    except ImportError:
+        logger.debug("rbac_router not available")
+
+    # Config endpoints (storage, daemon, mesh, trust, forgetting)
+    from superlocalmemory.server.routes.config_api import router as config_api_router
+    application.include_router(config_api_router)
+
+    # Task #47: dashboard-editable rate limits (GET/PUT /api/v3/ratelimit)
+    from superlocalmemory.server.routes.ratelimit import router as ratelimit_router
+    application.include_router(ratelimit_router)
+
     # v3.4.1 chat SSE
     for _mod_name in ("chat",):
         try:
@@ -1931,7 +2554,7 @@ def _register_dashboard_routes(application: FastAPI) -> None:
             pass
 
     # Optional routers
-    for _mod_name in ("learning", "lifecycle", "behavioral", "compliance", "insights", "timeline"):
+    for _mod_name in ("learning", "lifecycle", "behavioral", "compliance", "insights", "timeline", "abstraction"):
         try:
             _mod = __import__(
                 f"superlocalmemory.server.routes.{_mod_name}", fromlist=["router"],
@@ -2056,7 +2679,7 @@ def _register_daemon_routes(application: FastAPI) -> None:
         )
 
     @application.get("/health")
-    async def health():
+    async def health(request: Request = None):
         _update_activity()
         # Non-blocking peek: report status without forcing a re-init.
         engine = getattr(application.state, "engine", None)
@@ -2090,6 +2713,27 @@ def _register_daemon_routes(application: FastAPI) -> None:
         from superlocalmemory.server.profile_runtime import get_profile_runtime
 
         profile_snapshot = get_profile_runtime(application.state).snapshot
+        # H-05 (3.7.9): operational metadata (pid, daemon identity including
+        # capability_fingerprint/instance_id, active profile, readiness detail)
+        # is returned only to loopback callers. A remote or unauthenticated
+        # probe receives liveness fields only, so it cannot harvest targeting
+        # intel (version stays, since clients legitimately gate on it).
+        public = {
+            "status": "ok",
+            "ready": fully_ready,
+            # Runtime readiness is more precise than descriptor lifecycle.
+            # A process can be alive and identity-valid while retrieval warms.
+            "state": runtime_state,
+            "version": getattr(application, 'version', 'unknown'),
+        }
+        # request is None only for direct internal/test calls (no HTTP client),
+        # which are trusted; over HTTP FastAPI always injects the real Request.
+        client_host = request.client.host if (request and request.client) else ""
+        _trusted = request is None or client_host in (
+            "127.0.0.1", "::1", "localhost", "testclient",
+        )
+        if not _trusted:
+            return public
         return {
             "status": "ok",
             "ready": fully_ready,
@@ -2104,8 +2748,9 @@ def _register_daemon_routes(application: FastAPI) -> None:
             # health probe; includes self-heal counters.
             "recall_health": _recall_health,
             **(identity.public_health_fields() if identity is not None else {}),
-            # Runtime readiness is more precise than descriptor lifecycle.
-            # A process can be alive and identity-valid while retrieval warms.
+            # runtime_state must come AFTER the identity spread so the live
+            # readiness state wins over the descriptor's last-known lifecycle
+            # value (which can be "starting").
             "state": runtime_state,
             "active_profile": profile_snapshot.profile_id,
             "profile_generation": profile_snapshot.generation,
@@ -2116,11 +2761,12 @@ def _register_daemon_routes(application: FastAPI) -> None:
         request: Request,
         q: str = "", query: str = "", limit: int = CANONICAL_RECALL_LIMIT,
         session_id: str = "",
-        fast: bool = False,
+        fast: bool = True,
         full: bool = False,
         include_source: bool = False,
         include_global: bool | None = None,
         include_shared: bool | None = None,
+        window: str = "",
     ):
         _update_activity()
         search_query = q or query  # Accept both ?q= and ?query= for compatibility
@@ -2154,7 +2800,7 @@ def _register_daemon_routes(application: FastAPI) -> None:
         # recall (reranker timeout, cold embedder) blocks ALL endpoints.
         import asyncio
         _begin_recall()
-        # v3.4.53: Full (non-fast) recalls are gated by a semaphore to
+        # v3.4.53: Opt-in deep recalls are gated by a semaphore to
         # prevent resource oversaturation. Ollama serialises concurrent
         # embedding calls and the reranker subprocess has a single lock —
         # queuing more than ~3 concurrent full recalls just adds latency.
@@ -2170,6 +2816,7 @@ def _register_daemon_routes(application: FastAPI) -> None:
                 fast=fast,
                 include_global=include_global,
                 include_shared=include_shared,
+                window=window or None,
             )
             # v3.4.26: return the same field shape as recall_worker so
             # MCP processes proxying through the daemon get recall_trace-
@@ -2179,7 +2826,10 @@ def _register_daemon_routes(application: FastAPI) -> None:
                 if r.fact.memory_id
             })
             memory_map = (
-                engine._db.get_memory_content_batch(memory_ids)
+                engine._db.get_memory_content_batch(
+                    memory_ids, engine.profile_id,
+                    include_global=True, include_shared=True,
+                )
                 if memory_ids else {}
             )
             # v3.6.6: single shared serialization chokepoint — budget + source
@@ -2267,7 +2917,7 @@ def _register_daemon_routes(application: FastAPI) -> None:
             if isinstance(extra, dict):
                 meta.update(extra)
             command = build_engine_ingestion_command(engine)
-            receipt = command.submit(IngestionRequest(
+            ingestion_request = IngestionRequest(
                 content=req.content,
                 profile_id=engine._profile_id,
                 source_type="http",
@@ -2277,9 +2927,42 @@ def _register_daemon_routes(application: FastAPI) -> None:
                 shared_with=tuple(shared_with or ()),
                 trusted_actor_id=trusted_actor_id,
                 session_id=req.session_id,
-            ))
+            )
+            # SQLite admission is usually milliseconds, but it can wait on a
+            # concurrent migration or writer.  Keep that wait out of ASGI so
+            # dashboard navigation and recall stay responsive.
+            receipt = await asyncio.to_thread(command.submit, ingestion_request)
+            result = receipt
+            wait_budget_exhausted = False
+            if wait:
+                materialization_task = asyncio.create_task(
+                    asyncio.to_thread(command.materialize, receipt.operation_id)
+                )
+                try:
+                    result = await asyncio.wait_for(
+                        asyncio.shield(materialization_task),
+                        timeout=_REMEMBER_ENRICHMENT_WAIT_SECONDS,
+                    )
+                except TimeoutError:
+                    # The task retains the M018 lease and continues outside
+                    # this request.  Return the durable receipt honestly;
+                    # the normal materializer can also reclaim it after a
+                    # lease expiry if the request-owned worker dies.
+                    wait_budget_exhausted = True
+
+                    def _log_background_materialization(task):
+                        try:
+                            task.result()
+                        except Exception as exc:
+                            logger.warning(
+                                "bounded remember enrichment failed for %s: %s",
+                                receipt.operation_id,
+                                exc,
+                            )
 
-            result = command.materialize(receipt.operation_id) if wait else receipt
+                    materialization_task.add_done_callback(
+                        _log_background_materialization
+                    )
             fact_ids = list(result.fact_ids)
             # The queryable write is a separate durable transaction.  A cold
             # optional enrichment dependency (most often the local embedding
@@ -2322,10 +3005,13 @@ def _register_daemon_routes(application: FastAPI) -> None:
                 "note": (
                     "canonical ingestion complete"
                     if completed
+                    else "queryable now; enrichment continues after the wait budget"
+                    if wait_budget_exhausted
                     else "queryable now; canonical enrichment will retry"
                     if enrichment_deferred
                     else "queryable now; canonical enrichment pending"
                 ),
+                "wait_budget_exhausted": wait_budget_exhausted,
             }
         except Exception as exc:
             raise HTTPException(500, detail=str(exc))
@@ -2404,7 +3090,8 @@ def _register_daemon_routes(application: FastAPI) -> None:
                 maint_result = _run_maint(engine._db, engine._config, pid)
                 results["langevin"] = {"updated": maint_result.get("updated", 0)}
             except Exception as exc:
-                results["langevin"] = {"error": str(exc)}
+                logger.exception("maintenance langevin step failed")
+                results["langevin"] = {"error": "internal error"}
             try:
                 from superlocalmemory.math.ebbinghaus import EbbinghausCurve
                 from superlocalmemory.learning.forgetting_scheduler import (
@@ -2416,7 +3103,8 @@ def _register_daemon_routes(application: FastAPI) -> None:
                 )
                 results["forgetting"] = sched.run_decay_cycle(pid, force=False)
             except Exception as exc:
-                results["forgetting"] = {"error": str(exc)}
+                logger.exception("maintenance forgetting step failed")
+                results["forgetting"] = {"error": "internal error"}
             try:
                 from superlocalmemory.learning.consolidation_worker import (
                     ConsolidationWorker,
@@ -2428,7 +3116,8 @@ def _register_daemon_routes(application: FastAPI) -> None:
                 count = cw._generate_patterns(pid, False)
                 results["behavioral"] = {"patterns_mined": count}
             except Exception as exc:
-                results["behavioral"] = {"error": str(exc)}
+                logger.exception("maintenance behavioral step failed")
+                results["behavioral"] = {"error": "internal error"}
             authorization.complete()
             return {"ok": True, "profile": pid, **results}
         except HTTPException:
@@ -2520,6 +3209,46 @@ def _register_daemon_routes(application: FastAPI) -> None:
         os.kill(os.getpid(), signal.SIGTERM)
         return {"status": "stopping"}
 
+    @application.post("/api/daemon/restart")
+    async def restart_daemon(request: Request):
+        """Restart the daemon from the dashboard (non-technical end users).
+
+        Spawns a DETACHED ``slm restart`` process (its own session) so it
+        survives this daemon being stopped, then returns immediately. The child
+        stops this daemon and starts a fresh one via the standard 5-step
+        pipeline (namespace lock → stop → start → warmup → verify).
+        """
+        # Dashboard-callable: accept the install-token principal (same auth as
+        # /remember and other dashboard mutations), not just the private CLI
+        # capability — a non-technical user restarts from their own dashboard.
+        _require_write_actor(request)
+        import subprocess
+        import sys as _sys
+        from superlocalmemory.core.platform_utils import popen_platform_kwargs
+
+        logger.info("Daemon restart requested via API")
+        _observe_buffer.flush_sync()
+        try:
+            subprocess.Popen(
+                [_sys.executable, "-m", "superlocalmemory.cli.main", "restart",
+                 "--json"],
+                stdout=subprocess.DEVNULL,
+                stderr=subprocess.DEVNULL,
+                # CP-04: use the shared platform kwargs (CREATE_NO_WINDOW on
+                # Windows, start_new_session on POSIX) like every other Popen so
+                # a GUI-triggered restart never flashes a console window.
+                # close_fds defaults to True on all platforms.
+                **popen_platform_kwargs(),
+            )
+        except Exception:
+            logger.exception("Failed to spawn restart process")
+            return {"success": False, "error": "Could not initiate restart"}
+        return {
+            "success": True,
+            "status": "restarting",
+            "message": "Daemon restart initiated — it will be back in a few seconds.",
+        }
+
     @application.post("/session/open")
     async def session_open(req: SessionOpenRequest, request: Request):
         """#49: Open a session locally — warm recall context with no model
@@ -2675,7 +3404,17 @@ def _materializer_actor_id() -> str:
 
 
 def _run_materializer_operation(runtime, engine_supplier, operation):
-    """Run one bounded background unit against an admitted engine snapshot."""
+    """Run one bounded background unit against an admitted engine snapshot.
+
+    Cooperative preemption: if a profile transition is already in progress,
+    skip this materialization cycle entirely and return None.  The caller's
+    loop retries on the next iteration, by which time the switch has committed
+    and a clean admission is available.  This prevents the materializer from
+    holding the operation lease during the transition drain window.
+    """
+    # Writer-priority: don't acquire a new lease when a transition is draining.
+    if runtime is not None and runtime.transitioning:
+        return None
     with runtime.operation():
         # Resolve the engine only after admission. A concurrent mode/provider
         # reconfiguration may have replaced the module-level engine while this
@@ -2831,7 +3570,11 @@ def _start_pending_materializer() -> None:
                     ),
                 )
                 durable_complete, durable_failed = cycle_result or (0, 0)
-                pending = get_pending(limit=50)
+                # Only backfill legacy pending items enqueued under the active
+                # profile — never materialize another profile's queued memory
+                # under whichever profile happens to be active now.
+                _active_profile = runtime.snapshot.profile_id
+                pending = get_pending(limit=50, profile_id=_active_profile)
                 if not pending and not durable_complete and not durable_failed:
                     time.sleep(1.0)
                     continue
@@ -2915,6 +3658,18 @@ def start_server(port: int = _DEFAULT_PORT) -> None:
         or os.environ.get("SLM_HOST")
         or "127.0.0.1"
     )
+    # M-01 / L-02 (3.7.9): binding beyond loopback exposes the write API to the
+    # network, where the loopback trusted-actor bypass no longer protects it.
+    # Warn loudly unless the operator has opted into credential enforcement.
+    if bind_host not in ("127.0.0.1", "::1", "localhost") and \
+            os.environ.get("SLM_REQUIRE_CREDENTIALS") != "1":
+        logger.warning(
+            "SLM daemon binding to %s (non-loopback): the write API is "
+            "reachable from the network but SLM_REQUIRE_CREDENTIALS is not set "
+            "and API-key auth may be off. A remote caller could write without "
+            "credentials. Set SLM_REQUIRE_CREDENTIALS=1 and configure an API "
+            "key before exposing this instance.", bind_host,
+        )
     listener = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
     # This handles a just-closed connection in TIME_WAIT.  It is safe only
     # with the active-listener probe immediately below; without that guard,