superlocalmemory 3.8.2 → 3.8.5

package/CHANGELOG.md

@@ -5,6 +5,63 @@ All notable changes to SuperLocalMemory V3 will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [3.8.5] - 2026-07-26 — Reliable, full-quality recall
+
+### Fixed
+- Recall now consistently uses full-quality relevance ranking. The ranking model
+  warms up in the background with automatic retries, so recall no longer quietly
+  falls back to basic scoring when the model is slow to load, is recycled, or is
+  restarted. Full ranking resumes on its own within seconds if it is ever interrupted.
+- The first recall after startup is now fast. The memory graph is fully warmed in
+  the background before queries arrive, instead of the first query paying a
+  multi-second load — and the graph no longer reloads on the query path during
+  normal use, so recall latency stays consistent.
+- Recall stays responsive under heavy concurrent load. A startup contention issue
+  that could make the first queries slow on busy multi-agent systems has been removed.
+- The internal recall cache is now cleaned up automatically. It could previously
+  grow without bound over months of use; on upgrade, stale entries are compacted away.
+
+### Added
+- Automatic scale-up for very large memory graphs. A database that grows past
+  millions of connections switches to a high-performance graph backend on its own;
+  smaller databases stay on the fast built-in engine, which is quicker for them. The
+  switch runs in the background, is verified for correctness before it takes effect,
+  and falls back safely to the built-in engine if it cannot complete.
+
+### Notes
+- Upgrades apply automatically on daemon start — no manual migration command needed.
+- Recommended upgrade for all 3.8.x users.
+
+## [3.8.4] - 2026-07-26
+
+### Fixed
+- Frequent "database is locked" errors under heavy or concurrent multi-agent use.
+- MCP connections dropping when idle; connections now stay stable and recover cleanly.
+- A just-saved memory is now instantly findable by meaning, not only by keyword (on a warm instance).
+- HTTP write endpoints (dashboard Save / API) were rejected on some networked/containerized setups (#90).
+- Background ingestion operations that failed no longer retry forever; failures move to a dead-letter queue (#77).
+- Stale agent locks are cleared on restart; daemon shutdown no longer logs spurious import errors; the dashboard UI serves reliably on restricted filesystems.
+### Added
+- A choice of connection transport (stdio or HTTP) when connecting IDEs.
+- Configurable graph-memory pruning (max edges per node, minimum edge weight) (#84).
+### Notes
+- Upgrades apply automatically on daemon start — no manual migration command needed.
+
+## [3.8.3] - 2026-07-24 — Recall stays responsive under heavy load
+
+### Fixed
+
+- **Recall no longer hangs when the system is busy.** Search and recall now
+  complete within a generous time budget even during background maintenance or
+  when many agents are querying at once. If a query can't finish in that window,
+  SLM returns keyword-matched results and marks them clearly instead of leaving
+  the request to time out. This applies everywhere recall runs — the dashboard
+  search, the CLI, and connected assistants — so results are consistent across
+  every surface.
+- **Dashboard search waits long enough for a real answer.** The dashboard now
+  allows recall the full server-side budget before giving up, so heavy-load
+  queries return results rather than an aborted-request error.
+
 ## [3.8.2] - 2026-07-24 — Self-healing upgrades & faster, consistent recall
 
 ### Added

package/README.md

@@ -5,14 +5,15 @@
   </picture>
 </p>
 
-<h1 align="center">SuperLocalMemory V3.8.2</h1>
+<h1 align="center">SuperLocalMemory V3.8.5</h1>
 <p align="center"><strong>Enterprise-grade, local-first memory for AI agents and teams.</strong><br/>
 <em>A persistent, auditable long-term brain for your agents that runs on your own infrastructure — with multi-workspace isolation, role-based access, and GDPR + EU AI Act governance controls built in.</em></p>
-<p align="center"><code>v3.8.2</code> — one control plane: auditable retrieval · multi-scope memory (personal / shared / global) · Cache · Compress · trusted-peer Mesh · bounded loops — across CLI, MCP, dashboard, the <strong>Claude plugin</strong>, the <strong>Codex add-on</strong>, and documented IDE integrations.<br/>
+<p align="center"><code>v3.8.5</code> — one control plane: auditable retrieval · multi-scope memory (personal / shared / global) · Cache · Compress · trusted-peer Mesh · bounded loops — across CLI, MCP, dashboard, the <strong>Claude plugin</strong>, the <strong>Codex add-on</strong>, and documented IDE integrations.<br/>
 Proxy: <code>slm wrap claude</code> &nbsp;·&nbsp; MCP: add <code>slm_compress</code> to your config &nbsp;·&nbsp; Skill: zero-config</p>
 <p align="center"><strong>3 public research preprints</strong> (arXiv + Zenodo archives) · <a href="https://arxiv.org/abs/2603.02240">arXiv:2603.02240</a> · <a href="https://arxiv.org/abs/2603.14588">arXiv:2603.14588</a> · <a href="https://arxiv.org/abs/2604.04514">arXiv:2604.04514</a></p>
 
 <p align="center">
+  <a href="CHANGELOG.md"><img src="https://img.shields.io/badge/v3.8.5-Most_Stable_Release-2ea44f?style=for-the-badge&logo=checkmarx&logoColor=white" alt="v3.8.5 — Most Stable Release"/></a>
   <a href="https://arxiv.org/abs/2603.14588"><img src="https://img.shields.io/badge/arXiv-2603.14588-b31b1b?style=for-the-badge&logo=arxiv&logoColor=white" alt="arXiv Paper"/></a>
   <a href="#three-surfaces-proxy--mcp-tools--skill"><img src="https://img.shields.io/badge/Proxy_|_MCP_|_Skill-22c55e?style=for-the-badge" alt="Three Surfaces: Proxy, MCP Tools, Skill"/></a>
   <a href="https://pypi.org/project/superlocalmemory/"><img src="https://img.shields.io/pypi/v/superlocalmemory?style=for-the-badge&logo=pypi&logoColor=white" alt="PyPI"/></a>

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "superlocalmemory",
-  "version": "3.8.2",
+  "version": "3.8.5",
   "description": "Local-first agent memory with MCP and an agent-native CLI. Documented clients include Claude Code, Cursor, and Windsurf.",
   "keywords": [
     "ai-memory",

package/plugin/.claude-plugin/plugin.json

@@ -15,5 +15,5 @@
   "mcpServers": "./.mcp.json",
   "name": "superlocalmemory",
   "repository": "https://github.com/qualixar/superlocalmemory",
-  "version": "3.8.2"
+  "version": "3.8.5"
 }

package/plugin/CLAUDE.md

@@ -1,4 +1,4 @@
-<!-- BEGIN SuperLocalMemory v3.8.2 -->
+<!-- BEGIN SuperLocalMemory v3.8.5 -->
 
 ## SuperLocalMemory (SLM) — Agent Rules
 
@@ -39,6 +39,6 @@ slm-recall · slm-remember · slm-session · slm-status · slm-cache · slm-comp
 ### Subagents
 slm-memory-advisor (memory decisions, session hygiene, scope/profile guidance) · slm-optimize-advisor (context compression + KV cache) · slm-governance-advisor (scope/roles/compliance/GDPR)
 
-<!-- END SuperLocalMemory v3.8.2 -->
+<!-- END SuperLocalMemory v3.8.5 -->
 
-SuperLocalMemory v3.8.2 · Qualixar · AGPL-3.0-or-later
+SuperLocalMemory v3.8.5 · Qualixar · AGPL-3.0-or-later

package/plugin/agents/slm-governance-advisor.md

@@ -77,4 +77,4 @@ slm-scope · slm-governance · slm-profile · slm-remember · slm-recall
 # What NOT to do
 Never session_init twice; never forget without dry-run preview; never store secrets; never bypass role checks; never claim an erasure succeeded without verifying via recall.
 
-SuperLocalMemory v3.8.2 · Qualixar · AGPL-3.0-or-later
+SuperLocalMemory v3.8.5 · Qualixar · AGPL-3.0-or-later

package/plugin/agents/slm-loop-runner.md

@@ -68,4 +68,4 @@ assessment. The gate is the authority.
 
 ---
 
-SuperLocalMemory v3.8.2 · Qualixar · AGPL-3.0-or-later
+SuperLocalMemory v3.8.5 · Qualixar · AGPL-3.0-or-later

package/plugin/agents/slm-memory-advisor.md

@@ -46,4 +46,4 @@ slm-recall · slm-remember · slm-session · slm-scope · slm-profile · slm-gov
 # What NOT to do
 Never session_init twice; never forget dry_run=False without reporting preview; never dump a whole file into remember; never invent a memory; never claim "saved" without success:true / clean CLI exit; never bypass scope or governance restrictions.
 
-SuperLocalMemory v3.8.2 · Qualixar · AGPL-3.0-or-later
+SuperLocalMemory v3.8.5 · Qualixar · AGPL-3.0-or-later

package/plugin/agents/slm-optimize-advisor.md

@@ -41,4 +41,4 @@ slm-compress · slm-cache · slm-status · slm-profile
 # What NOT to do
 Never compress code-for-edit/JSON-to-parse/<500 chars; never store secrets/ccr_ids; never let optimize failure block/alter the task; never claim a specific savings %; never carry ccr_ids across profile switches.
 
-SuperLocalMemory v3.8.2 · Qualixar · AGPL-3.0-or-later
+SuperLocalMemory v3.8.5 · Qualixar · AGPL-3.0-or-later

package/plugin/requirements.txt

@@ -1 +1 @@
-superlocalmemory==3.8.2
+superlocalmemory==3.8.5

package/plugin/skills/slm-cache/SKILL.md

@@ -145,4 +145,4 @@ These subcommands control daemon-level cache settings. They do not read or write
 
 ---
 
-SuperLocalMemory v3.8.2 · Qualixar · AGPL-3.0-or-later
+SuperLocalMemory v3.8.5 · Qualixar · AGPL-3.0-or-later

package/plugin/skills/slm-compress/SKILL.md

@@ -147,4 +147,4 @@ Content over 1 MB (1 000 000 bytes UTF-8) is processed but `reversible` is force
 
 ---
 
-SuperLocalMemory v3.8.2 · Qualixar · AGPL-3.0-or-later
+SuperLocalMemory v3.8.5 · Qualixar · AGPL-3.0-or-later

package/plugin/skills/slm-governance/SKILL.md

@@ -245,4 +245,4 @@ Before running any destructive operation (`forget`, `compact_memories`):
 
 ---
 
-*SuperLocalMemory v3.8.2 · Qualixar · AGPL-3.0-or-later*
+*SuperLocalMemory v3.8.5 · Qualixar · AGPL-3.0-or-later*

package/plugin/skills/slm-graph/SKILL.md

@@ -311,4 +311,4 @@ profile. See `slm-profile` for the full profile switching workflow.
 
 ---
 
-SuperLocalMemory v3.8.2 · Qualixar · AGPL-3.0-or-later
+SuperLocalMemory v3.8.5 · Qualixar · AGPL-3.0-or-later

package/plugin/skills/slm-loop/SKILL.md

@@ -96,4 +96,4 @@ paused, name the approval needed; when errored, quote the short detail.
 
 ---
 
-SuperLocalMemory v3.8.2 · Qualixar · AGPL-3.0-or-later
+SuperLocalMemory v3.8.5 · Qualixar · AGPL-3.0-or-later

package/plugin/skills/slm-mesh/SKILL.md

@@ -279,4 +279,4 @@ mesh availability.
 
 ---
 
-*SuperLocalMemory v3.8.2 · Qualixar · AGPL-3.0-or-later*
+*SuperLocalMemory v3.8.5 · Qualixar · AGPL-3.0-or-later*

package/plugin/skills/slm-profile/SKILL.md

@@ -145,4 +145,4 @@ Name them differently in your MCP config (e.g. `superlocalmemory-personal` and
 
 ---
 
-*SuperLocalMemory v3.8.2 · Qualixar · AGPL-3.0-or-later*
+*SuperLocalMemory v3.8.5 · Qualixar · AGPL-3.0-or-later*

package/plugin/skills/slm-recall/SKILL.md

@@ -236,4 +236,4 @@ before recalling, then switch back. See `slm-profile` for workspace switching.
 
 ---
 
-*SuperLocalMemory v3.8.2 · Qualixar · AGPL-3.0-or-later*
+*SuperLocalMemory v3.8.5 · Qualixar · AGPL-3.0-or-later*

package/plugin/skills/slm-remember/SKILL.md

@@ -238,4 +238,4 @@ different workspace, use `switch_profile` first. See `slm-profile`.
 
 ---
 
-*SuperLocalMemory v3.8.2 · Qualixar · AGPL-3.0-or-later*
+*SuperLocalMemory v3.8.5 · Qualixar · AGPL-3.0-or-later*

package/plugin/skills/slm-scope/SKILL.md

@@ -173,4 +173,4 @@ to review the impact. See `slm-remember` for the full deletion discipline.
 
 ---
 
-*SuperLocalMemory v3.8.2 · Qualixar · AGPL-3.0-or-later*
+*SuperLocalMemory v3.8.5 · Qualixar · AGPL-3.0-or-later*

package/plugin/skills/slm-session/SKILL.md

@@ -227,4 +227,4 @@ explicitly and call `recall` with `include_global`/`include_shared` after
 
 ---
 
-*SuperLocalMemory v3.8.2 · Qualixar · AGPL-3.0-or-later*
+*SuperLocalMemory v3.8.5 · Qualixar · AGPL-3.0-or-later*

package/plugin/skills/slm-status/SKILL.md

@@ -163,4 +163,4 @@ multi-profile setup. To switch the active profile, see `slm-profile`.
 
 ---
 
-SuperLocalMemory v3.8.2 · Qualixar · AGPL-3.0-or-later
+SuperLocalMemory v3.8.5 · Qualixar · AGPL-3.0-or-later

package/plugin-src/rules/AGENTS.md

@@ -128,4 +128,4 @@ When the SLM MCP server is unavailable, use these CLI equivalents:
 - **slm-optimize-advisor** — context compression and KV cache
 - **slm-governance-advisor** — scope/role compliance, retention policies, GDPR
 
-SuperLocalMemory v3.8.2 · Qualixar · AGPL-3.0-or-later
+SuperLocalMemory v3.8.4 · Qualixar · AGPL-3.0-or-later

package/plugin-src/skills/slm-cache/SKILL.md

@@ -145,4 +145,4 @@ These subcommands control daemon-level cache settings. They do not read or write
 
 ---
 
-SuperLocalMemory v3.8.2 · Qualixar · AGPL-3.0-or-later
+SuperLocalMemory v3.8.4 · Qualixar · AGPL-3.0-or-later

package/plugin-src/skills/slm-compress/SKILL.md

@@ -147,4 +147,4 @@ Content over 1 MB (1 000 000 bytes UTF-8) is processed but `reversible` is force
 
 ---
 
-SuperLocalMemory v3.8.2 · Qualixar · AGPL-3.0-or-later
+SuperLocalMemory v3.8.4 · Qualixar · AGPL-3.0-or-later

package/plugin-src/skills/slm-graph/SKILL.md

@@ -311,4 +311,4 @@ profile. See `slm-profile` for the full profile switching workflow.
 
 ---
 
-SuperLocalMemory v3.8.2 · Qualixar · AGPL-3.0-or-later
+SuperLocalMemory v3.8.4 · Qualixar · AGPL-3.0-or-later

package/plugin-src/skills/slm-recall/SKILL.md

@@ -236,4 +236,4 @@ before recalling, then switch back. See `slm-profile` for workspace switching.
 
 ---
 
-*SuperLocalMemory v3.8.2 · Qualixar · AGPL-3.0-or-later*
+*SuperLocalMemory v3.8.4 · Qualixar · AGPL-3.0-or-later*

package/plugin-src/skills/slm-remember/SKILL.md

@@ -238,4 +238,4 @@ different workspace, use `switch_profile` first. See `slm-profile`.
 
 ---
 
-*SuperLocalMemory v3.8.2 · Qualixar · AGPL-3.0-or-later*
+*SuperLocalMemory v3.8.4 · Qualixar · AGPL-3.0-or-later*

package/plugin-src/skills/slm-session/SKILL.md

@@ -227,4 +227,4 @@ explicitly and call `recall` with `include_global`/`include_shared` after
 
 ---
 
-*SuperLocalMemory v3.8.2 · Qualixar · AGPL-3.0-or-later*
+*SuperLocalMemory v3.8.4 · Qualixar · AGPL-3.0-or-later*

package/plugin-src/skills/slm-status/SKILL.md

@@ -163,4 +163,4 @@ multi-profile setup. To switch the active profile, see `slm-profile`.
 
 ---
 
-SuperLocalMemory v3.8.2 · Qualixar · AGPL-3.0-or-later
+SuperLocalMemory v3.8.4 · Qualixar · AGPL-3.0-or-later

package/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "superlocalmemory"
-version = "3.8.2"
+version = "3.8.5"
 description = "Local-first agent memory with auditable hybrid retrieval"
 readme = "README.md"
 license = "AGPL-3.0-or-later"

package/src/superlocalmemory/__init__.py

@@ -32,7 +32,7 @@ if "OMP_NUM_THREADS" not in os.environ:
     os.environ["OMP_NUM_THREADS"] = "2"
 # ---------------------------------------------------------------------------
 
-__version__ = "3.8.2"
+__version__ = "3.8.5"
 
 _REQUIRED_VERSIONS = {
     "sentence_transformers": "5.3.0",

package/src/superlocalmemory/access/rbac.py

@@ -32,6 +32,7 @@ from __future__ import annotations
 import hashlib
 import hmac
 import logging
+import os
 import secrets
 import sqlite3
 import uuid
@@ -39,9 +40,14 @@ from datetime import datetime, timedelta, timezone
 from enum import Enum
 from pathlib import Path
 
+from superlocalmemory.storage.memory_write import memory_write
+
 logger = logging.getLogger("superlocalmemory.access.rbac")
 
-_BUSY_TIMEOUT_MS = 4000
+# Match the daemon's default (SLM_DB_BUSY_TIMEOUT_MS, default 10 000 ms).
+# Reads use this via _conn(); writes go through memory_write() which reads the
+# same env var internally, so in-process writers never see SQLITE_BUSY.
+_BUSY_TIMEOUT_MS: int = max(0, int(os.environ.get("SLM_DB_BUSY_TIMEOUT_MS", "10000")))
 _SESSION_TTL_HOURS = 12
 
 # scrypt cost parameters (OWASP-recommended interactive-login range).
@@ -155,16 +161,15 @@ class RbacEngine:
             raise RbacError("Username is required.")
         pw_hash = _hash_password(password)
         user_id = _uid()
-        conn = self._conn()
-        try:
+        # memory_write: process write lock + busy_timeout.
+        with memory_write(self._db_path) as conn:
             # The UNIQUE(username) constraint is the source of truth; the SELECT
             # is a fast path. Two concurrent creates can both pass the SELECT, so
             # the loser's INSERT hits the constraint — convert that to RbacError
             # (409) instead of leaking a raw IntegrityError as a 500.
-            exists = conn.execute(
+            if conn.execute(
                 "SELECT 1 FROM rbac_users WHERE username=?", (username,)
-            ).fetchone()
-            if exists:
+            ).fetchone():
                 raise RbacError(f"User '{username}' already exists.")
             try:
                 conn.execute(
@@ -174,19 +179,15 @@ class RbacEngine:
                     (user_id, username, display_name or username, pw_hash,
                      _now(), created_by),
                 )
-                conn.commit()
             except sqlite3.IntegrityError:
                 raise RbacError(f"User '{username}' already exists.")
-        finally:
-            conn.close()
         logger.info("RBAC: created user '%s' (%s)", username, user_id)
         return {"user_id": user_id, "username": username,
                 "display_name": display_name or username, "status": "active"}
 
     def set_password(self, user_id: str, password: str) -> None:
         pw_hash = _hash_password(password)
-        conn = self._conn()
-        try:
+        with memory_write(self._db_path) as conn:
             cur = conn.execute(
                 "UPDATE rbac_users SET password_hash=? WHERE user_id=?",
                 (pw_hash, user_id),
@@ -195,15 +196,11 @@ class RbacEngine:
                 raise RbacError("User not found.")
             # A password change invalidates every existing session.
             conn.execute("DELETE FROM rbac_sessions WHERE user_id=?", (user_id,))
-            conn.commit()
-        finally:
-            conn.close()
 
     def set_status(self, user_id: str, status: str) -> None:
         if status not in ("active", "disabled"):
             raise RbacError("status must be 'active' or 'disabled'.")
-        conn = self._conn()
-        try:
+        with memory_write(self._db_path) as conn:
             cur = conn.execute(
                 "UPDATE rbac_users SET status=? WHERE user_id=?", (status, user_id)
             )
@@ -211,21 +208,14 @@ class RbacEngine:
                 raise RbacError("User not found.")
             if status == "disabled":
                 conn.execute("DELETE FROM rbac_sessions WHERE user_id=?", (user_id,))
-            conn.commit()
-        finally:
-            conn.close()
 
     def delete_user(self, user_id: str) -> None:
-        conn = self._conn()
-        try:
+        with memory_write(self._db_path) as conn:
             conn.execute("DELETE FROM rbac_sessions WHERE user_id=?", (user_id,))
             conn.execute("DELETE FROM rbac_memberships WHERE user_id=?", (user_id,))
             cur = conn.execute("DELETE FROM rbac_users WHERE user_id=?", (user_id,))
             if cur.rowcount == 0:
                 raise RbacError("User not found.")
-            conn.commit()
-        finally:
-            conn.close()
 
     def get_user(self, user_id: str) -> dict | None:
         conn = self._conn()
@@ -277,25 +267,35 @@ class RbacEngine:
         raw = secrets.token_urlsafe(32)
         now = datetime.now(timezone.utc)
         expires = (now + timedelta(hours=ttl_hours)).isoformat()
-        conn = self._conn()
-        try:
+        with memory_write(self._db_path) as conn:
             conn.execute(
                 "INSERT INTO rbac_sessions (token_hash, user_id, created_at, "
                 "expires_at, last_seen) VALUES (?, ?, ?, ?, ?)",
                 (_hash_token(raw), user_id, now.isoformat(), expires, now.isoformat()),
             )
-            conn.commit()
-        finally:
-            conn.close()
         return raw
 
     def resolve_session(self, raw_token: str) -> dict | None:
         """Return the active user for a session token, or None if invalid /
-        expired / disabled. Updates last_seen. Constant-time by hash lookup."""
+        expired / disabled. Updates last_seen. Constant-time by hash lookup.
+
+        Concurrency design
+        ------------------
+        Phase 1 (read): WAL allows concurrent readers without blocking the
+        writer — ``_conn()`` with ``busy_timeout`` only.  The write lock is
+        NOT taken here so a burst of concurrent requests doesn't serialise
+        through the single writer on every call.
+
+        Phase 2 (conditional write): only if the session is expired/stale.
+        ``memory_write()`` is opened AFTER the read connection is closed
+        (lock-ordering invariant: get_write_lock is outermost).
+        """
         if not raw_token:
             return None
         token_hash = _hash_token(raw_token)
         now = datetime.now(timezone.utc)
+
+        # -- Phase 1: read-only lookup ----------------------------------------
         conn = self._conn()
         try:
             row = conn.execute(
@@ -310,48 +310,52 @@ class RbacEngine:
                 expired = datetime.fromisoformat(row["expires_at"]) <= now
             except ValueError:
                 expired = True
-            if expired or row["status"] != "active":
-                conn.execute("DELETE FROM rbac_sessions WHERE token_hash=?", (token_hash,))
-                conn.commit()
-                return None
-            # Debounce last_seen: only write when it is stale (>60s), so a burst
-            # of authenticated requests does not serialize through the single
-            # SQLite writer on every call.
+            row_status = row["status"]
+            row_last_seen = row["last_seen"]
+            user_dict = {
+                "user_id": row["user_id"],
+                "username": row["username"],
+                "display_name": row["display_name"],
+            }
+        finally:
+            conn.close()
+
+        # -- Phase 2: write if needed (read conn closed above) ----------------
+        if expired or row_status != "active":
+            with memory_write(self._db_path) as wconn:
+                wconn.execute(
+                    "DELETE FROM rbac_sessions WHERE token_hash=?", (token_hash,)
+                )
+            return None
+
+        # Debounce last_seen: only write when stale (>60 s), so a burst of
+        # authenticated requests does not serialise through the writer every call.
+        stale = True
+        try:
+            stale = (now - datetime.fromisoformat(row_last_seen)).total_seconds() > 60
+        except (ValueError, TypeError, KeyError):
             stale = True
-            try:
-                stale = (now - datetime.fromisoformat(row["last_seen"])).total_seconds() > 60
-            except (ValueError, TypeError, KeyError):
-                stale = True
-            if stale:
-                conn.execute(
+        if stale:
+            with memory_write(self._db_path) as wconn:
+                wconn.execute(
                     "UPDATE rbac_sessions SET last_seen=? WHERE token_hash=?",
                     (now.isoformat(), token_hash),
                 )
-                conn.commit()
-            return {"user_id": row["user_id"], "username": row["username"],
-                    "display_name": row["display_name"]}
-        finally:
-            conn.close()
+        return user_dict
 
     def revoke_session(self, raw_token: str) -> None:
-        conn = self._conn()
-        try:
-            conn.execute("DELETE FROM rbac_sessions WHERE token_hash=?",
-                         (_hash_token(raw_token),))
-            conn.commit()
-        finally:
-            conn.close()
+        with memory_write(self._db_path) as conn:
+            conn.execute(
+                "DELETE FROM rbac_sessions WHERE token_hash=?",
+                (_hash_token(raw_token),),
+            )
 
     def purge_expired_sessions(self) -> int:
-        conn = self._conn()
-        try:
+        with memory_write(self._db_path) as conn:
             cur = conn.execute(
                 "DELETE FROM rbac_sessions WHERE expires_at <= ?", (_now(),)
             )
-            conn.commit()
-            return cur.rowcount or 0
-        finally:
-            conn.close()
+        return cur.rowcount or 0
 
     # -- memberships ------------------------------------------------------
 
@@ -361,8 +365,7 @@ class RbacEngine:
             role_enum = Role(role)
         except ValueError:
             raise RbacError(f"Invalid role '{role}'. Use admin/member/viewer.")
-        conn = self._conn()
-        try:
+        with memory_write(self._db_path) as conn:
             if not conn.execute(
                 "SELECT 1 FROM rbac_users WHERE user_id=?", (user_id,)
             ).fetchone():
@@ -374,21 +377,14 @@ class RbacEngine:
                 "added_at=excluded.added_at, added_by=excluded.added_by",
                 (profile_id, user_id, role_enum.value, _now(), added_by),
             )
-            conn.commit()
-        finally:
-            conn.close()
         return {"profile_id": profile_id, "user_id": user_id, "role": role_enum.value}
 
     def remove_membership(self, profile_id: str, user_id: str) -> None:
-        conn = self._conn()
-        try:
+        with memory_write(self._db_path) as conn:
             conn.execute(
                 "DELETE FROM rbac_memberships WHERE profile_id=? AND user_id=?",
                 (profile_id, user_id),
             )
-            conn.commit()
-        finally:
-            conn.close()
 
     def get_role(self, user_id: str, profile_id: str) -> Role | None:
         conn = self._conn()
@@ -442,16 +438,12 @@ class RbacEngine:
             conn.close()
 
     def set_policy(self, key: str, value: str) -> None:
-        conn = self._conn()
-        try:
+        with memory_write(self._db_path) as conn:
             conn.execute(
                 "INSERT INTO rbac_settings (key, value) VALUES (?, ?) "
                 "ON CONFLICT(key) DO UPDATE SET value=excluded.value",
                 (key, value),
             )
-            conn.commit()
-        finally:
-            conn.close()
 
     def require_login(self) -> bool:
         """Company mode: mutations require a valid user session (no owner

package/src/superlocalmemory/cli/commands.py

@@ -1135,6 +1135,9 @@ def cmd_connect(args: Namespace) -> None:
         if ide_arg in IDE_MATRIX:
             here = getattr(args, "here", False)
             profile = getattr(args, "profile", None)
+            transport = getattr(args, "transport", "stdio")
+            daemon_port = getattr(args, "daemon_port", 8765)
+            verify = getattr(args, "verify", False)
             project = None
             if here:
                 import pathlib
@@ -1148,8 +1151,24 @@ def cmd_connect(args: Namespace) -> None:
                 profile=profile,
                 agents_md_source=_agents_md_source_factory(),
                 dry_run=getattr(args, "dry_run", False),
+                transport=transport,
+                daemon_port=daemon_port,
             )
 
+            # --verify: probe daemon health after writing
+            if verify and transport in ("http", "http-mcp-remote") and not result.get("error"):
+                from superlocalmemory.hooks.portable_kit import _check_daemon_health
+                reachable = _check_daemon_health(daemon_port)
+                if reachable:
+                    print(f"[verify] Daemon reachable at http://127.0.0.1:{daemon_port}/api/v3/health")
+                else:
+                    print(
+                        f"[verify] Warning: daemon NOT reachable at "
+                        f"http://127.0.0.1:{daemon_port}/api/v3/health. "
+                        f"Run `slm serve start` to start it.",
+                        file=sys.stderr,
+                    )
+
             if not result.get("error") and not getattr(args, "dry_run", False):
                 from superlocalmemory.infra.local_diagnostics import record_operation