superlocalmemory 3.8.0 → 3.8.2

package/src/superlocalmemory/server/routes/brain.py

@@ -903,13 +903,47 @@ def _action_outcomes_count(lrn_db: LearningDatabase,
         return 0
 
 
+def _compute_action_outcomes_preview(profile_id: str) -> dict:
+    """Count profile-scoped action outcomes from their canonical database."""
+    empty = {
+        "action_outcomes_rows": 0,
+        "source": "memory.db:action_outcomes",
+        "is_real": True,
+    }
+    db_path = _memory_db_path()
+    if not db_path.exists():
+        return empty
+    try:
+        conn = sqlite3.connect(f"file:{db_path}?mode=ro", uri=True, timeout=1.0)
+        try:
+            row = conn.execute(
+                "SELECT COUNT(*) FROM action_outcomes WHERE profile_id = ?",
+                (profile_id,),
+            ).fetchone()
+        finally:
+            conn.close()
+    except sqlite3.Error:
+        return empty
+    return {**empty, "action_outcomes_rows": int(row[0] or 0) if row else 0}
+
+
 # ---------------------------------------------------------------------------
 # Routes
 # ---------------------------------------------------------------------------
 
 
+def _authorized_profile(request: Request, profile_id: str | None) -> str:
+    """Resolve and authorize the exact Brain profile requested by the caller."""
+    from superlocalmemory.access.rbac import Permission
+    from superlocalmemory.server.rbac_enforce import require_permission
+
+    effective_profile = profile_id or get_active_profile()
+    require_permission(request, Permission.READ, profile=effective_profile)
+    return effective_profile
+
+
 @router.get("/brain", dependencies=[Depends(require_install_token)])
-async def get_brain(profile_id: str | None = None) -> dict:
+async def get_brain(request: Request, profile_id: str | None = None) -> dict:
     """Unified Brain endpoint — LLD-04 §3.1.
 
     Fan-out: each section is a synchronous SQLite reader. Running them
@@ -926,12 +960,12 @@ async def get_brain(profile_id: str | None = None) -> dict:
 
     # Default to the ACTIVE profile (request runtime truth), never literal
     # "default" — the Brain must reflect whichever profile is active.
-    profile_id = profile_id or get_active_profile()
+    profile_id = _authorized_profile(request, profile_id)
     lrn_db = LearningDatabase(_learning_db_path())
 
     (
         preferences, learning, usage, bandit_snap, cache,
-        cross_platform, outcomes_rows, evolution,
+        cross_platform, outcomes_preview, evolution,
     ) = await asyncio.gather(
         asyncio.to_thread(_compute_preferences, profile_id),
         asyncio.to_thread(_compute_learning_status, profile_id, lrn_db),
@@ -939,7 +973,7 @@ async def get_brain(profile_id: str | None = None) -> dict:
         asyncio.to_thread(_compute_bandit_snapshot, profile_id, lrn_db),
         asyncio.to_thread(_compute_cache_stats),
         asyncio.to_thread(_compute_cross_platform),
-        asyncio.to_thread(_action_outcomes_count, lrn_db, profile_id),
+        asyncio.to_thread(_compute_action_outcomes_preview, profile_id),
         asyncio.to_thread(
             _compute_evolution_timeseries, profile_id, lrn_db,
             days=_EVOLUTION_DEFAULT_DAYS,
@@ -977,11 +1011,11 @@ async def get_brain(profile_id: str | None = None) -> dict:
             "is_real": True, "source": "learning_signals",
             "days": _EVOLUTION_DEFAULT_DAYS, "total_signals": 0, "points": [],
         }),
-        "outcomes_preview": {
-            "action_outcomes_rows":
-                0 if isinstance(outcomes_rows, Exception) else outcomes_rows,
-            "ships_in": "3.4.22",
-        },
+        "outcomes_preview": _ok(outcomes_preview, {
+            "action_outcomes_rows": 0,
+            "source": "memory.db:action_outcomes",
+            "is_real": True,
+        }),
         # S9-defer H-22: live tile data for the Reward / Shadow /
         # Evolution-Cost dashboard tiles. Each block is a honest-empty
         # default when the underlying table is missing (fresh install
@@ -1188,6 +1222,7 @@ def _compute_evolution_cost_preview(profile_id: str) -> dict:
 @router.get("/brain/evolution-timeseries",
             dependencies=[Depends(require_install_token)])
 async def get_brain_evolution_timeseries(
+    request: Request,
     profile_id: str | None = None,
     days: int = _EVOLUTION_DEFAULT_DAYS,
 ) -> dict:
@@ -1198,7 +1233,7 @@ async def get_brain_evolution_timeseries(
     """
     import asyncio
 
-    profile_id = profile_id or get_active_profile()
+    profile_id = _authorized_profile(request, profile_id)
     lrn_db = LearningDatabase(_learning_db_path())
     result = await asyncio.to_thread(
         _compute_evolution_timeseries, profile_id, lrn_db, days=days,
@@ -1214,8 +1249,10 @@ async def get_brain_evolution_timeseries(
 
 @router.get("/learning/stats",
             dependencies=[Depends(require_install_token)])
-async def learning_stats_deprecated(profile_id: str | None = None) -> dict:
-    profile_id = profile_id or get_active_profile()
+async def learning_stats_deprecated(
+    request: Request, profile_id: str | None = None,
+) -> dict:
+    profile_id = _authorized_profile(request, profile_id)
     lrn_db = LearningDatabase(_learning_db_path())
     return {
         "deprecated": True,
@@ -1226,8 +1263,10 @@ async def learning_stats_deprecated(profile_id: str | None = None) -> dict:
 
 @router.get("/patterns",
             dependencies=[Depends(require_install_token)])
-async def patterns_deprecated(profile_id: str | None = None) -> dict:
-    profile_id = profile_id or get_active_profile()
+async def patterns_deprecated(
+    request: Request, profile_id: str | None = None,
+) -> dict:
+    profile_id = _authorized_profile(request, profile_id)
     return {
         "deprecated": True,
         "use_instead": "/api/v3/brain",
@@ -1237,8 +1276,10 @@ async def patterns_deprecated(profile_id: str | None = None) -> dict:
 
 @router.get("/behavioral",
             dependencies=[Depends(require_install_token)])
-async def behavioral_deprecated(profile_id: str | None = None) -> dict:
-    profile_id = profile_id or get_active_profile()
+async def behavioral_deprecated(
+    request: Request, profile_id: str | None = None,
+) -> dict:
+    profile_id = _authorized_profile(request, profile_id)
     return {
         "deprecated": True,
         "use_instead": "/api/v3/brain",

package/src/superlocalmemory/server/routes/config_api.py

@@ -19,21 +19,21 @@ MEMORY_DIR to a tmp_path.
 Restart-required semantics:
   - graph_backend / vector_backend: changes take effect only on daemon restart.
   - daemon_port / daemon_legacy_port: changes take effect only on daemon restart.
-  - All other fields: hot-applied on next engine reconfigure cycle.
+  - mesh, trust, and forgetting are persisted safely but require restart
+    because no complete supported worker-rebind transaction exists for them.
 """
 
 from __future__ import annotations
 
-import json
 import logging
-import os
 from pathlib import Path
-from typing import Annotated, Literal, Optional
+from typing import Annotated, Optional
 
 from fastapi import APIRouter, Request
 from fastapi.responses import JSONResponse
 from pydantic import BaseModel, ConfigDict, Field, StrictBool
 
+from superlocalmemory.server.config_file import read_config, update_config
 from superlocalmemory.server.routes.helpers import MEMORY_DIR
 
 logger = logging.getLogger(__name__)
@@ -73,24 +73,18 @@ def _config_path() -> Path:
 
 
 def _read_config() -> dict:
-    """Read config.json as a raw dict.  Returns {} on missing/corrupt file."""
+    """Read one coherent config snapshot."""
     p = _config_path()
-    if not p.exists():
-        return {}
     try:
-        return json.loads(p.read_text())
-    except (json.JSONDecodeError, OSError) as exc:
+        return read_config(p)
+    except (ValueError, OSError) as exc:
         logger.warning("config_api: could not read config.json: %s", exc)
-        return {}
+        raise
 
 
-def _atomic_write(data: dict) -> None:
-    """Atomic config.json write: .tmp → os.replace."""
-    p = _config_path()
-    p.parent.mkdir(parents=True, exist_ok=True)
-    tmp = p.with_suffix(".json.tmp")
-    tmp.write_text(json.dumps(data, indent=2), encoding="utf-8")
-    os.replace(tmp, p)
+def _update_config(mutator) -> dict:
+    """Run one interprocess-locked read/modify/replace transaction."""
+    return update_config(_config_path(), mutator)
 
 
 # ---------------------------------------------------------------------------
@@ -175,7 +169,7 @@ _FORGETTING_DEFAULTS: dict = {
 
 
 @router.get("/storage/config")
-async def get_storage_config():
+def get_storage_config():
     """Return current storage backend configuration.
 
     base_dir is read-only — it is derived from the process namespace and
@@ -188,7 +182,7 @@ async def get_storage_config():
             "vector_backend": data.get("vector_backend", "auto"),
             "base_dir": data.get("base_dir", str(MEMORY_DIR)),
         }
-    except Exception as exc:
+    except Exception:
         logger.exception("get_storage_config failed")
         return JSONResponse({"error": "Internal server error"}, status_code=500)
 
@@ -199,7 +193,7 @@ async def get_storage_config():
 
 
 @router.put("/storage/config")
-async def put_storage_config(request: Request, body: StorageConfigUpdate):
+def put_storage_config(request: Request, body: StorageConfigUpdate):
     """Update graph_backend and/or vector_backend.
 
     Both fields require a daemon restart to take effect.
@@ -207,19 +201,20 @@ async def put_storage_config(request: Request, body: StorageConfigUpdate):
     """
     _require_admin(request)
     try:
-        data = _read_config()
-        if body.graph_backend is not None:
-            data["graph_backend"] = body.graph_backend
-        if body.vector_backend is not None:
-            data["vector_backend"] = body.vector_backend
-        _atomic_write(data)
+        def mutate(data: dict) -> None:
+            if body.graph_backend is not None:
+                data["graph_backend"] = body.graph_backend
+            if body.vector_backend is not None:
+                data["vector_backend"] = body.vector_backend
+
+        data = _update_config(mutate)
         return {
             "graph_backend": data.get("graph_backend", "auto"),
             "vector_backend": data.get("vector_backend", "auto"),
             "base_dir": data.get("base_dir", str(MEMORY_DIR)),
             "restart_required": True,
         }
-    except Exception as exc:
+    except Exception:
         logger.exception("put_storage_config failed")
         return JSONResponse({"error": "Internal server error"}, status_code=500)
 
@@ -230,7 +225,7 @@ async def put_storage_config(request: Request, body: StorageConfigUpdate):
 
 
 @router.get("/daemon/config")
-async def get_daemon_config():
+def get_daemon_config():
     """Return current daemon configuration."""
     try:
         data = _read_config()
@@ -240,7 +235,7 @@ async def get_daemon_config():
             "legacy_port": data.get("daemon_legacy_port", 8767),
             "enable_legacy_port": data.get("daemon_enable_legacy_port", True),
         }
-    except Exception as exc:
+    except Exception:
         logger.exception("get_daemon_config failed")
         return JSONResponse({"error": "Internal server error"}, status_code=500)
 
@@ -251,7 +246,7 @@ async def get_daemon_config():
 
 
 @router.put("/daemon/config")
-async def put_daemon_config(request: Request, body: DaemonConfigUpdate):
+def put_daemon_config(request: Request, body: DaemonConfigUpdate):
     """Update daemon configuration.
 
     Port / legacy_port changes require a daemon restart.
@@ -259,19 +254,22 @@ async def put_daemon_config(request: Request, body: DaemonConfigUpdate):
     """
     _require_admin(request)
     try:
-        data = _read_config()
         port_changed = False
-        if body.idle_timeout is not None:
-            data["daemon_idle_timeout"] = body.idle_timeout
-        if body.port is not None:
-            data["daemon_port"] = body.port
-            port_changed = True
-        if body.legacy_port is not None:
-            data["daemon_legacy_port"] = body.legacy_port
-            port_changed = True
-        if body.enable_legacy_port is not None:
-            data["daemon_enable_legacy_port"] = body.enable_legacy_port
-        _atomic_write(data)
+
+        def mutate(data: dict) -> None:
+            nonlocal port_changed
+            if body.idle_timeout is not None:
+                data["daemon_idle_timeout"] = body.idle_timeout
+            if body.port is not None:
+                data["daemon_port"] = body.port
+                port_changed = True
+            if body.legacy_port is not None:
+                data["daemon_legacy_port"] = body.legacy_port
+                port_changed = True
+            if body.enable_legacy_port is not None:
+                data["daemon_enable_legacy_port"] = body.enable_legacy_port
+
+        data = _update_config(mutate)
         return {
             "idle_timeout": data.get("daemon_idle_timeout", 0),
             "port": data.get("daemon_port", 8765),
@@ -279,7 +277,7 @@ async def put_daemon_config(request: Request, body: DaemonConfigUpdate):
             "enable_legacy_port": data.get("daemon_enable_legacy_port", True),
             "restart_required": port_changed,
         }
-    except Exception as exc:
+    except Exception:
         logger.exception("put_daemon_config failed")
         return JSONResponse({"error": "Internal server error"}, status_code=500)
 
@@ -290,12 +288,12 @@ async def put_daemon_config(request: Request, body: DaemonConfigUpdate):
 
 
 @router.get("/mesh/config")
-async def get_mesh_config():
+def get_mesh_config():
     """Return current mesh configuration."""
     try:
         data = _read_config()
         return {"enabled": data.get("mesh_enabled", True)}
-    except Exception as exc:
+    except Exception:
         logger.exception("get_mesh_config failed")
         return JSONResponse({"error": "Internal server error"}, status_code=500)
 
@@ -306,15 +304,15 @@ async def get_mesh_config():
 
 
 @router.put("/mesh/config")
-async def put_mesh_config(request: Request, body: MeshConfigUpdate):
-    """Enable or disable the mesh sync layer."""
+def put_mesh_config(request: Request, body: MeshConfigUpdate):
+    """Persist mesh state; restart is required to rebuild the mesh worker."""
     _require_admin(request)
     try:
-        data = _read_config()
-        data["mesh_enabled"] = body.enabled
-        _atomic_write(data)
-        return {"enabled": body.enabled}
-    except Exception as exc:
+        _update_config(
+            lambda data: data.update({"mesh_enabled": body.enabled}),
+        )
+        return {"enabled": body.enabled, "restart_required": True}
+    except Exception:
         logger.exception("put_mesh_config failed")
         return JSONResponse({"error": "Internal server error"}, status_code=500)
 
@@ -325,7 +323,7 @@ async def put_mesh_config(request: Request, body: MeshConfigUpdate):
 
 
 @router.get("/trust/config")
-async def get_trust_config():
+def get_trust_config():
     """Return current trust configuration.
 
     Fields are spread across three config sections:
@@ -343,7 +341,7 @@ async def get_trust_config():
             "trust_first_party": injection.get("trust_first_party", False),
             "promotion_min_trust": consolidation.get("promotion_min_trust", 0.5),
         }
-    except Exception as exc:
+    except Exception:
         logger.exception("get_trust_config failed")
         return JSONResponse({"error": "Internal server error"}, status_code=500)
 
@@ -354,7 +352,7 @@ async def get_trust_config():
 
 
 @router.put("/trust/config")
-async def put_trust_config(request: Request, body: TrustConfigUpdate):
+def put_trust_config(request: Request, body: TrustConfigUpdate):
     """Update trust configuration.
 
     Each field is stored in its canonical config.json sub-section.
@@ -362,17 +360,18 @@ async def put_trust_config(request: Request, body: TrustConfigUpdate):
     """
     _require_admin(request)
     try:
-        data = _read_config()
-        if body.use_trust_weighting is not None:
-            retrieval = data.setdefault("retrieval", {})
-            retrieval["use_trust_weighting"] = body.use_trust_weighting
-        if body.trust_first_party is not None:
-            injection = data.setdefault("injection", {})
-            injection["trust_first_party"] = body.trust_first_party
-        if body.promotion_min_trust is not None:
-            consolidation = data.setdefault("consolidation", {})
-            consolidation["promotion_min_trust"] = body.promotion_min_trust
-        _atomic_write(data)
+        def mutate(data: dict) -> None:
+            if body.use_trust_weighting is not None:
+                retrieval = data.setdefault("retrieval", {})
+                retrieval["use_trust_weighting"] = body.use_trust_weighting
+            if body.trust_first_party is not None:
+                injection = data.setdefault("injection", {})
+                injection["trust_first_party"] = body.trust_first_party
+            if body.promotion_min_trust is not None:
+                consolidation = data.setdefault("consolidation", {})
+                consolidation["promotion_min_trust"] = body.promotion_min_trust
+
+        data = _update_config(mutate)
         retrieval = data.get("retrieval", {})
         injection = data.get("injection", {})
         consolidation = data.get("consolidation", {})
@@ -380,8 +379,9 @@ async def put_trust_config(request: Request, body: TrustConfigUpdate):
             "use_trust_weighting": retrieval.get("use_trust_weighting", True),
             "trust_first_party": injection.get("trust_first_party", False),
             "promotion_min_trust": consolidation.get("promotion_min_trust", 0.5),
+            "restart_required": True,
         }
-    except Exception as exc:
+    except Exception:
         logger.exception("put_trust_config failed")
         return JSONResponse({"error": "Internal server error"}, status_code=500)
 
@@ -392,7 +392,7 @@ async def put_trust_config(request: Request, body: TrustConfigUpdate):
 
 
 @router.get("/forgetting/config")
-async def get_forgetting_config():
+def get_forgetting_config():
     """Return all Ebbinghaus forgetting configuration fields."""
     try:
         data = _read_config()
@@ -401,7 +401,7 @@ async def get_forgetting_config():
         result = {**_FORGETTING_DEFAULTS, **stored}
         # Keep only known fields
         return {k: result[k] for k in _FORGETTING_DEFAULTS}
-    except Exception as exc:
+    except Exception:
         logger.exception("get_forgetting_config failed")
         return JSONResponse({"error": "Internal server error"}, status_code=500)
 
@@ -412,25 +412,27 @@ async def get_forgetting_config():
 
 
 @router.put("/forgetting/config")
-async def put_forgetting_config(request: Request, body: ForgettingConfigUpdate):
+def put_forgetting_config(request: Request, body: ForgettingConfigUpdate):
     """Update Ebbinghaus forgetting configuration.
 
     Only provided fields are changed; all other forgetting fields are
-    preserved.  Changes take effect on the next daemon startup (or after
-    the scheduler fires its next cycle).
+    preserved. Changes take effect after the daemon restarts.
     """
     _require_admin(request)
     try:
-        data = _read_config()
-        stored = data.get("forgetting", {})
-        # Apply defaults for missing fields, then overlay the stored values,
-        # then overlay the requested updates.
-        merged = {**_FORGETTING_DEFAULTS, **stored}
         updates = body.model_dump(exclude_none=True)
-        merged.update(updates)
-        data["forgetting"] = merged
-        _atomic_write(data)
-        return {k: merged[k] for k in _FORGETTING_DEFAULTS}
-    except Exception as exc:
+
+        def mutate(data: dict) -> None:
+            stored = data.get("forgetting", {})
+            merged = {**_FORGETTING_DEFAULTS, **stored, **updates}
+            data["forgetting"] = merged
+
+        data = _update_config(mutate)
+        merged = data["forgetting"]
+        return {
+            **{k: merged[k] for k in _FORGETTING_DEFAULTS},
+            "restart_required": True,
+        }
+    except Exception:
         logger.exception("put_forgetting_config failed")
         return JSONResponse({"error": "Internal server error"}, status_code=500)

package/src/superlocalmemory/server/routes/entity.py

@@ -6,48 +6,117 @@
 
 from __future__ import annotations
 
-from fastapi import APIRouter, HTTPException, Request, Query
+from fastapi import APIRouter, HTTPException, Query, Request
 
-from .helpers import require_engine, get_active_profile
+from .helpers import get_active_profile, require_engine
 
 router = APIRouter(prefix="/api/entity", tags=["entity"])
 
 
+def _list_entities_sql(where_sql: str) -> str:
+    """Build the page-first entity query after ``where_sql`` is parameterized."""
+    return f"""
+        WITH page_entities AS MATERIALIZED (
+            SELECT ce.entity_id, ce.profile_id, ce.canonical_name,
+                   ce.entity_type, ce.fact_count, ce.first_seen, ce.last_seen
+            FROM canonical_entities ce
+            WHERE {where_sql}
+            ORDER BY ce.fact_count DESC, ce.entity_id ASC
+            LIMIT ? OFFSET ?
+        ),
+        ranked_profiles AS MATERIALIZED (
+            SELECT ep.*,
+                   ROW_NUMBER() OVER (
+                       PARTITION BY ep.entity_id, ep.profile_id
+                       ORDER BY COALESCE(ep.last_compiled_at, '') DESC,
+                                ep.project_name COLLATE NOCASE ASC,
+                                ep.rowid ASC
+                   ) AS summary_rank
+            FROM entity_profiles ep
+            JOIN page_entities page
+              ON page.entity_id = ep.entity_id
+             AND page.profile_id = ep.profile_id
+            WHERE ep.profile_id = ?
+        )
+        SELECT ce.entity_id, ce.canonical_name, ce.entity_type,
+               ce.fact_count, ce.first_seen, ce.last_seen,
+               ep.knowledge_summary, ep.compiled_truth,
+               ep.compilation_confidence, ep.last_compiled_at
+        FROM page_entities ce
+        LEFT JOIN ranked_profiles ep
+          ON ce.entity_id = ep.entity_id
+         AND ep.profile_id = ce.profile_id
+         AND ep.summary_rank = 1
+        ORDER BY ce.fact_count DESC, ce.entity_id ASC
+    """
+
+
+def _require_read(request: Request, profile: str) -> None:
+    """Authorize entity metadata access for the explicitly requested profile."""
+    from superlocalmemory.access.rbac import Permission
+    from superlocalmemory.server.rbac_enforce import require_permission
+
+    require_permission(request, Permission.READ, profile=profile)
+
+
+def _require_manage(request: Request, profile: str) -> None:
+    """Authorize entity recompilation for the explicitly requested profile."""
+    from superlocalmemory.server.rbac_enforce import require_manage
+
+    require_manage(request, profile=profile)
+
+
 @router.get("/list")
-async def list_entities(
+def list_entities(
     request: Request,
     profile: str | None = Query(default=None),
+    entity_type: str | None = Query(default=None, alias="type", max_length=80),
+    search: str | None = Query(default=None, max_length=200),
     limit: int = Query(default=100, ge=1, le=1000),
     offset: int = Query(default=0, ge=0),
 ):
-    """List all entities with basic info (canonical name, type, fact count)."""
+    """List a profile's entities, filtering before count and pagination."""
     engine = require_engine(request)
     # Default to the ACTIVE profile (request runtime truth), never the literal
     # "default" — otherwise every profile sees the default profile's entities.
     profile = profile or get_active_profile()
+    _require_read(request, profile)
 
     import sqlite3
-    import json
     conn = sqlite3.connect(str(engine._config.db_path))
     conn.row_factory = sqlite3.Row
     try:
+        where = ["ce.profile_id = ?"]
+        params: list[object] = [profile]
+        if entity_type and entity_type.lower() != "all":
+            where.append("ce.entity_type = ? COLLATE NOCASE")
+            params.append(entity_type.strip().lower())
+        if search and search.strip():
+            escaped = (search.strip().lower().replace("\\", "\\\\")
+                       .replace("%", "\\%").replace("_", "\\_"))
+            where.append(
+                "(LOWER(ce.canonical_name) LIKE ? ESCAPE '\\' "
+                "OR LOWER(COALESCE(ce.entity_type, 'unknown')) LIKE ? ESCAPE '\\' "
+                "OR EXISTS ("
+                "SELECT 1 FROM entity_profiles eps "
+                "WHERE eps.entity_id = ce.entity_id "
+                "AND eps.profile_id = ce.profile_id "
+                "AND LOWER(COALESCE(eps.knowledge_summary, '')) "
+                "LIKE ? ESCAPE '\\'))"
+            )
+            params.extend([f"%{escaped}%"] * 3)
+        where_sql = " AND ".join(where)
+
         total = conn.execute(
-            "SELECT COUNT(*) FROM canonical_entities WHERE profile_id = ?",
-            (profile,),
+            "SELECT COUNT(*) FROM canonical_entities ce "
+            f"WHERE {where_sql}",
+            params,
         ).fetchone()[0]
 
-        rows = conn.execute("""
-            SELECT ce.entity_id, ce.canonical_name, ce.entity_type,
-                   ce.fact_count, ce.first_seen, ce.last_seen,
-                   ep.knowledge_summary, ep.compiled_truth,
-                   ep.compilation_confidence, ep.last_compiled_at
-            FROM canonical_entities ce
-            LEFT JOIN entity_profiles ep
-              ON ce.entity_id = ep.entity_id AND ep.profile_id = ce.profile_id
-            WHERE ce.profile_id = ?
-            ORDER BY ce.fact_count DESC
-            LIMIT ? OFFSET ?
-        """, (profile, limit, offset)).fetchall()
+        rows = conn.execute(
+            _list_entities_sql(where_sql),
+            [*params, limit, offset, profile],
+        ).fetchall()
 
         entities = []
         for r in rows:
@@ -65,13 +134,19 @@ async def list_entities(
                 "last_compiled_at": r["last_compiled_at"],
             })
 
-        return {"entities": entities, "total": total, "limit": limit, "offset": offset}
+        return {
+            "entities": entities,
+            "total": total,
+            "limit": limit,
+            "offset": offset,
+            "has_more": offset + limit < total,
+        }
     finally:
         conn.close()
 
 
 @router.get("/{entity_name}")
-async def get_entity(
+def get_entity(
     entity_name: str,
     request: Request,
     profile: str | None = Query(default=None),
@@ -80,9 +155,10 @@ async def get_entity(
     """Get compiled truth + timeline for an entity."""
     engine = require_engine(request)
     profile = profile or get_active_profile()
+    _require_read(request, profile)
 
-    import sqlite3
     import json
+    import sqlite3
     conn = sqlite3.connect(str(engine._config.db_path))
     conn.row_factory = sqlite3.Row
     try:
@@ -116,7 +192,7 @@ async def get_entity(
 
 
 @router.post("/{entity_name}/recompile")
-async def recompile_entity(
+def recompile_entity(
     entity_name: str,
     request: Request,
     profile: str | None = Query(default=None),
@@ -125,6 +201,7 @@ async def recompile_entity(
     """Force immediate recompilation of an entity."""
     engine = require_engine(request)
     profile = profile or get_active_profile()
+    _require_manage(request, profile)
 
     import sqlite3
     conn = sqlite3.connect(str(engine._config.db_path))