superlocalmemory 3.8.2 → 3.8.5

package/src/superlocalmemory/retrieval/vector_store.py

@@ -23,6 +23,8 @@ from typing import Any
 
 import numpy as np
 
+from superlocalmemory.storage.write_lock import get_write_lock
+
 logger = logging.getLogger(__name__)
 
 
@@ -182,51 +184,62 @@ class VectorStore:
             )
             return False
 
+        # Embedding bytes computed OUTSIDE the lock — serialisation must not
+        # cover slow computation, only the sqlite3 write transaction itself.
         vec_bytes = self._serialize_f32(embedding)
 
-        with self._lock:
-            try:
-                conn = self._connect()
-                # Check if fact_id already exists in metadata
-                row = conn.execute(
-                    "SELECT vec_rowid FROM embedding_metadata "
-                    "WHERE fact_id = ?",
-                    (fact_id,),
-                ).fetchone()
-
-                if row is not None:
-                    # UPDATE existing
-                    rowid = row["vec_rowid"]
-                    conn.execute(
-                        "UPDATE fact_embeddings SET embedding = ? "
-                        "WHERE rowid = ?",
-                        (vec_bytes, rowid),
-                    )
-                else:
-                    # INSERT new
-                    conn.execute(
-                        "INSERT INTO fact_embeddings(profile_id, embedding) "
-                        "VALUES (?, ?)",
-                        (profile_id, vec_bytes),
-                    )
-                    rowid = conn.execute(
-                        "SELECT last_insert_rowid()"
-                    ).fetchone()[0]
-                    conn.execute(
-                        "INSERT INTO embedding_metadata "
-                        "(vec_rowid, fact_id, profile_id, model_name, dimension) "
-                        "VALUES (?, ?, ?, ?, ?)",
-                        (rowid, fact_id, profile_id,
-                         model_name or self._config.model_name,
-                         self._config.dimension),
-                    )
-
-                conn.commit()
-                conn.close()
-                return True
-            except Exception as exc:
-                logger.debug("upsert failed for fact_id=%s: %s", fact_id, exc)
-                return False
+        # Acquire the process-level write lock for this db file BEFORE opening
+        # the sqlite3 connection.  This is the OUTERMOST lock (see write_lock.py
+        # ordering rule).  self._lock is INNER and acquired inside.  The write
+        # lock is the same RLock that DatabaseManager._lock references for this
+        # db_path, so the self-heal backfill pattern
+        #   with db._lock: vs.upsert()
+        # simply re-enters the RLock (same thread — always safe).
+        _wl = get_write_lock(self._db_path)
+        with _wl:            # OUTER: serialises all memory.db writers
+            with self._lock:  # INNER: VectorStore per-instance state
+                try:
+                    conn = self._connect()
+                    # Check if fact_id already exists in metadata
+                    row = conn.execute(
+                        "SELECT vec_rowid FROM embedding_metadata "
+                        "WHERE fact_id = ?",
+                        (fact_id,),
+                    ).fetchone()
+
+                    if row is not None:
+                        # UPDATE existing
+                        rowid = row["vec_rowid"]
+                        conn.execute(
+                            "UPDATE fact_embeddings SET embedding = ? "
+                            "WHERE rowid = ?",
+                            (vec_bytes, rowid),
+                        )
+                    else:
+                        # INSERT new
+                        conn.execute(
+                            "INSERT INTO fact_embeddings(profile_id, embedding) "
+                            "VALUES (?, ?)",
+                            (profile_id, vec_bytes),
+                        )
+                        rowid = conn.execute(
+                            "SELECT last_insert_rowid()"
+                        ).fetchone()[0]
+                        conn.execute(
+                            "INSERT INTO embedding_metadata "
+                            "(vec_rowid, fact_id, profile_id, model_name, dimension) "
+                            "VALUES (?, ?, ?, ?, ?)",
+                            (rowid, fact_id, profile_id,
+                             model_name or self._config.model_name,
+                             self._config.dimension),
+                        )
+
+                    conn.commit()
+                    conn.close()
+                    return True
+                except Exception as exc:
+                    logger.debug("upsert failed for fact_id=%s: %s", fact_id, exc)
+                    return False
 
     def search(
         self,
@@ -302,41 +315,43 @@ class VectorStore:
     def delete(self, fact_id: str) -> bool:
         """Remove a vector from vec0 and metadata.
 
-        Thread-safe: acquires self._lock.
+        Thread-safe: acquires the process-level write lock then self._lock.
         Returns True if deleted, False if not found or error.
         """
         if not self._available:
             return False
 
-        with self._lock:
-            try:
-                conn = self._connect()
-                row = conn.execute(
-                    "SELECT vec_rowid FROM embedding_metadata "
-                    "WHERE fact_id = ?",
-                    (fact_id,),
-                ).fetchone()
+        _wl = get_write_lock(self._db_path)
+        with _wl:            # OUTER: process-level write serialisation
+            with self._lock:  # INNER: VectorStore per-instance state
+                try:
+                    conn = self._connect()
+                    row = conn.execute(
+                        "SELECT vec_rowid FROM embedding_metadata "
+                        "WHERE fact_id = ?",
+                        (fact_id,),
+                    ).fetchone()
+
+                    if row is None:
+                        conn.close()
+                        return False
 
-                if row is None:
+                    rowid = row["vec_rowid"]
+                    conn.execute(
+                        "DELETE FROM fact_embeddings WHERE rowid = ?",
+                        (rowid,),
+                    )
+                    conn.execute(
+                        "DELETE FROM embedding_metadata WHERE vec_rowid = ?",
+                        (rowid,),
+                    )
+                    conn.commit()
                     conn.close()
+                    return True
+                except Exception as exc:
+                    logger.debug("delete failed for fact_id=%s: %s", fact_id, exc)
                     return False
 
-                rowid = row["vec_rowid"]
-                conn.execute(
-                    "DELETE FROM fact_embeddings WHERE rowid = ?",
-                    (rowid,),
-                )
-                conn.execute(
-                    "DELETE FROM embedding_metadata WHERE vec_rowid = ?",
-                    (rowid,),
-                )
-                conn.commit()
-                conn.close()
-                return True
-            except Exception as exc:
-                logger.debug("delete failed for fact_id=%s: %s", fact_id, exc)
-                return False
-
     def count(self, profile_id: str | None = None) -> int:
         """Count vectors in the store.
 

package/src/superlocalmemory/server/loopback.py

@@ -0,0 +1,91 @@
+# Copyright (c) 2026 Varun Pratap Bhardwaj / Qualixar
+# Licensed under AGPL-3.0-or-later
+
+"""Centralized loopback-address predicate for the SLM server.
+
+Replaces every ``frozenset({"127.0.0.1", "::1", "localhost"})`` auth check
+with a semantic helper that correctly handles IPv4-mapped IPv6 addresses
+(``::ffff:127.0.0.1``) — the root cause of issue #90.
+
+Issue #90 root cause
+--------------------
+When the daemon is started with ``SLM_DAEMON_HOST=0.0.0.0`` on a dual-stack
+Linux host (common in LXC/Docker containers), the OS creates an IPv6 socket
+that accepts IPv4 connections via the IPv4-mapped IPv6 address mechanism
+(RFC 4291 §2.5.5.2). A client connecting to ``localhost`` on such a host
+may have its peer address reported as ``::ffff:127.0.0.1`` by
+uvicorn/Starlette. The literal set ``("127.0.0.1", "::1", "localhost")``
+does not include this form, causing a spurious 403 for install-token and
+uncredentialed-loopback callers.
+
+``ipaddress.ip_address("::ffff:127.0.0.1").is_loopback`` already returns
+``True`` in CPython. This module uses that fact.
+
+SECURITY INVARIANTS (non-negotiable):
+  - Empty/None host → False. SEC-L-02: a missing peer is never trusted.
+  - No proxy header trust. Callers MUST pass ``request.client.host`` only,
+    never X-Forwarded-For or any other spoofable header.
+  - All 127.0.0.0/8 is loopback per RFC 5735 (includes 127.0.0.2, etc.).
+  - ``"localhost"`` is accepted as a hostname alias. Callers that need the
+    stricter no-hostname check (``prewarm_auth``) keep their own predicate.
+  - ``"testclient"`` is NOT in the loopback set — that bypass must be wired
+    explicitly alongside ``_TEST_ISOLATION_ALLOWED`` so it cannot appear in
+    production paths.
+  - ``"0.0.0.0"`` is NOT loopback — it is a bind address, not a peer address.
+"""
+
+from __future__ import annotations
+
+import ipaddress as _ipa
+
+
+# CRIT-2 guard: detect a future CPython regression where IPv4-mapped loopback
+# is no longer reported as .is_loopback. Fails at daemon startup (import time),
+# not silently at request time.
+assert _ipa.ip_address("::ffff:127.0.0.1").is_loopback, (
+    "Python ipaddress regression: ::ffff:127.0.0.1 no longer reports as "
+    "loopback. Update superlocalmemory/server/loopback.py. (Issue #90)"
+)
+
+
+def is_loopback(host: str) -> bool:
+    """Return ``True`` iff ``host`` is a loopback address in any standard form.
+
+    Handles:
+    * ``"127.0.0.1"`` and the full 127.0.0.0/8 range (RFC 5735).
+    * ``"::1"`` (IPv6 loopback).
+    * ``"::ffff:127.0.0.1"`` and all ``::ffff:127.x.x.x`` (IPv4-mapped IPv6,
+      fixes issue #90).
+    * ``"localhost"`` (hostname alias, case-insensitive).
+
+    Returns ``False`` for:
+    * Empty string or ``None`` (SEC-L-02: missing peer is never trusted).
+    * Any non-loopback IP (192.168.x.x, 10.x.x.x, public IPs, etc.).
+    * ``"::ffff:192.168.x.x"`` and other IPv4-mapped non-loopback addresses.
+    * ``"testclient"`` — callers that need the test-client exemption must
+      wire it explicitly alongside ``_TEST_ISOLATION_ALLOWED``.
+    * ``"0.0.0.0"`` — bind address, not a peer address.
+
+    Args:
+        host: The ``request.client.host`` string from an incoming HTTP
+            request. Must be the TCP-observed peer address only.
+
+    Returns:
+        ``True`` if the host is any recognised loopback form; ``False``
+        otherwise.
+    """
+    if not isinstance(host, str) or not host:
+        return False  # SEC-L-02
+    if host.lower() == "localhost":
+        return True
+    try:
+        ip = _ipa.ip_address(host)
+    except ValueError:
+        return False
+    # Python's .is_loopback already handles 127.0.0.0/8, ::1, and
+    # IPv4-mapped loopback (::ffff:127.x.x.x). No manual ipv4_mapped
+    # normalization needed — the stdlib does the right thing.
+    return ip.is_loopback
+
+
+__all__ = ("is_loopback",)

package/src/superlocalmemory/server/origin.py

@@ -4,12 +4,17 @@ from __future__ import annotations
 
 from urllib.parse import urlsplit
 
-
-_LOOPBACK_HOSTS = frozenset({"127.0.0.1", "::1", "localhost"})
+from superlocalmemory.server.loopback import is_loopback as _is_loopback_host
 
 
 def origin_is_loopback(origin: str) -> bool:
-    """Return whether an Origin is absent or an exact HTTP(S) loopback URL."""
+    """Return whether an Origin is absent or an exact HTTP(S) loopback URL.
+
+    Uses the centralized is_loopback helper so that IPv4-mapped loopback
+    addresses (::ffff:127.x.x.x) are accepted correctly (issue #90).
+    Note: browsers normalize Origin hostnames; the ::ffff: form would only
+    appear in synthetic requests. The helper is used for defense-in-depth.
+    """
     if not origin:
         return True
     try:
@@ -21,7 +26,7 @@ def origin_is_loopback(origin: str) -> bool:
     return (
         parsed.scheme in {"http", "https"}
         and parsed.hostname is not None
-        and parsed.hostname.lower() in _LOOPBACK_HOSTS
+        and _is_loopback_host(parsed.hostname.lower())
         and parsed.username is None
         and parsed.password is None
         and parsed.path in {"", "/"}

package/src/superlocalmemory/server/routes/backup.py

@@ -87,9 +87,13 @@ def _require_oauth_start(request: Request) -> None:
             detail="OAuth initiation requires the local dashboard origin.",
         )
 
+    from superlocalmemory.server.loopback import is_loopback as _is_loopback_host
+
     host = request.client.host if request.client else ""
-    is_loopback = host in {"127.0.0.1", "::1", "localhost", "testclient"}
-    if not is_loopback and principal.get("kind") != "user":
+    # "testclient" is included for in-process test compatibility (preserved
+    # from original behaviour; was in the original frozenset).
+    _from_loopback = _is_loopback_host(host) or host == "testclient"
+    if not _from_loopback and principal.get("kind") != "user":
         raise HTTPException(
             status_code=403,
             detail=(

package/src/superlocalmemory/server/routes/behavioral.py

@@ -17,6 +17,7 @@ from fastapi import APIRouter, Depends, HTTPException, Query, Request
 from pydantic import BaseModel, ConfigDict, Field, StrictStr, field_validator
 
 from .helpers import MEMORY_DIR, get_active_profile
+from superlocalmemory.storage.memory_write import memory_write
 
 logger = logging.getLogger("superlocalmemory.routes.behavioral")
 router = APIRouter()
@@ -385,10 +386,9 @@ def report_outcome(request: Request, data: ReportOutcomeRequest):
             "action_type": action_type,
             "source": "dashboard_report_outcome",
         }
-        conn = sqlite3.connect(str(memory_db_path), timeout=5.0)
-        try:
-            conn.execute("PRAGMA busy_timeout=5000")
-            conn.execute("BEGIN IMMEDIATE")
+        # memory_write acquires the process write lock (serialises in-process)
+        # and sets PRAGMA busy_timeout (cross-process writers wait, not error).
+        with memory_write(memory_db_path) as conn:
             _validate_profile_fact_ids(
                 conn,
                 profile_id=profile,
@@ -407,9 +407,6 @@ def report_outcome(request: Request, data: ReportOutcomeRequest):
                     now_iso, reward, now_iso,
                 ),
             )
-            conn.commit()
-        finally:
-            conn.close()
 
         try:
             from superlocalmemory.learning.source_quality import (
@@ -589,8 +586,8 @@ def log_tool_event_api(request: Request, data: dict):
         input_summary = str(input_summary)[:500] if input_summary else ""
         output_summary = str(output_summary)[:500] if output_summary else ""
 
-        conn = _sqlite3.connect(str(MEMORY_DIR / "memory.db"))
-        try:
+        # memory_write: process write lock + busy_timeout for SQLITE_BUSY safety.
+        with memory_write(MEMORY_DIR / "memory.db") as conn:
             conn.execute(
                 "INSERT INTO tool_events "
                 "(session_id, profile_id, project_path, tool_name, event_type, "
@@ -599,9 +596,6 @@ def log_tool_event_api(request: Request, data: dict):
                 (session_id, profile, project_path, tool_name, event_type,
                  input_summary, output_summary, now),
             )
-            conn.commit()
-        finally:
-            conn.close()
         return {"ok": True}
     except Exception:
         logger.exception("behavioral route error")

package/src/superlocalmemory/server/routes/compliance.py

@@ -10,7 +10,6 @@ Uses V3 compliance modules: ABACEngine, AuditChain, RetentionEngine.
 """
 import json
 import logging
-import sqlite3
 from typing import Optional
 
 from fastapi import APIRouter, Query, Request
@@ -18,6 +17,7 @@ from fastapi.responses import JSONResponse
 
 from .helpers import get_active_profile, get_engine_lazy, MEMORY_DIR, DB_PATH
 from superlocalmemory.server.route_mutations import authorize_route_mutation
+from superlocalmemory.storage.memory_write import memory_write
 
 logger = logging.getLogger("superlocalmemory.routes.compliance")
 router = APIRouter()
@@ -61,13 +61,14 @@ async def compliance_status():
         except Exception as exc:
             logger.debug("audit chain: %s", exc)
 
-        # Retention policies (scoped to the active profile)
+        # Retention policies (scoped to the active profile).
+        # RetentionEngine.__init__ runs DDL (CREATE TABLE IF NOT EXISTS) so even
+        # list_rules() is a write at the constructor level — use memory_write().
         retention_policies = []
         try:
-            conn = sqlite3.connect(str(DB_PATH))
-            engine = RetentionEngine(conn)
-            retention_policies = engine.list_rules(profile)
-            conn.close()
+            with memory_write(DB_PATH) as conn:
+                engine = RetentionEngine(conn)
+                retention_policies = engine.list_rules(profile)
         except Exception as exc:
             logger.debug("retention engine: %s", exc)
 
@@ -163,15 +164,13 @@ async def create_retention_policy(data: dict):
 
     try:
         profile = get_active_profile()
-        conn = sqlite3.connect(str(DB_PATH))
-        engine = RetentionEngine(conn)
-
-        rule_id = engine.create_rule(
-            name=name, framework=framework,
-            retention_days=retention_days, action=action,
-            applies_to=applies_to, profile_id=profile,
-        )
-        conn.close()
+        with memory_write(DB_PATH) as conn:
+            engine = RetentionEngine(conn)
+            rule_id = engine.create_rule(
+                name=name, framework=framework,
+                retention_days=retention_days, action=action,
+                applies_to=applies_to, profile_id=profile,
+            )
 
         return {
             "success": True, "rule_id": rule_id,
@@ -190,10 +189,9 @@ async def delete_retention_policy(name: str = Query(...)):
         return {"success": False, "error": "Compliance engine not available"}
     try:
         profile = get_active_profile()
-        conn = sqlite3.connect(str(DB_PATH))
-        engine = RetentionEngine(conn)
-        removed = engine.delete_rule(profile, name)
-        conn.close()
+        with memory_write(DB_PATH) as conn:
+            engine = RetentionEngine(conn)
+            removed = engine.delete_rule(profile, name)
         if not removed:
             return {"success": False, "error": f"Policy '{name}' not found"}
         return {"success": True, "active_profile": profile,
@@ -214,10 +212,9 @@ async def enforce_retention():
         return {"success": False, "error": "Compliance engine not available"}
     try:
         profile = get_active_profile()
-        conn = sqlite3.connect(str(DB_PATH))
-        engine = RetentionEngine(conn)
-        result = engine.enforce(profile)
-        conn.close()
+        with memory_write(DB_PATH) as conn:
+            engine = RetentionEngine(conn)
+            result = engine.enforce(profile)
         return {"success": True, **result}
     except Exception:
         logger.exception("enforce_retention error")

package/src/superlocalmemory/server/routes/config_api.py

@@ -436,3 +436,86 @@ def put_forgetting_config(request: Request, body: ForgettingConfigUpdate):
     except Exception:
         logger.exception("put_forgetting_config failed")
         return JSONResponse({"error": "Internal server error"}, status_code=500)
+
+
+# ---------------------------------------------------------------------------
+# Graph Pruning config (v3.8.4-G — GitHub #84)
+# Dedicated endpoint so the forgetting config partial-update contract stays
+# clean.  Callers that only want graph knobs do not need to know about the
+# Ebbinghaus curve, and vice-versa.
+# ---------------------------------------------------------------------------
+
+_GRAPH_PRUNING_DEFAULTS: dict = {
+    "max_degree_per_node": 100,
+    "min_edge_weight": 0.0,
+    "enabled": True,
+}
+
+
+class GraphPruningConfigUpdate(BaseModel):
+    """Partial update model for graph pruning configuration.
+
+    All fields are optional so a PUT with only ``max_degree_per_node`` does
+    NOT reset ``min_edge_weight`` back to the default.  Existing values are
+    preserved; only the supplied fields are overwritten.
+    """
+
+    model_config = ConfigDict(extra="forbid")
+
+    max_degree_per_node: Optional[int] = Field(None, ge=1)
+    min_edge_weight: Optional[float] = Field(None, ge=0.0, le=1.0)
+    enabled: Optional[StrictBool] = None
+
+
+# ---------------------------------------------------------------------------
+# GET /api/v3/graph/config
+# ---------------------------------------------------------------------------
+
+
+@router.get("/graph/config")
+def get_graph_config():
+    """Return current graph thinning configuration.
+
+    Returns all three fields with their defaults when config.json has no
+    ``graph_pruning`` section (old installations).
+    """
+    try:
+        data = _read_config()
+        stored = data.get("graph_pruning", {})
+        result = {**_GRAPH_PRUNING_DEFAULTS, **stored}
+        # Return only known fields
+        return {k: result[k] for k in _GRAPH_PRUNING_DEFAULTS}
+    except Exception:
+        logger.exception("get_graph_config failed")
+        return JSONResponse({"error": "Internal server error"}, status_code=500)
+
+
+# ---------------------------------------------------------------------------
+# PUT /api/v3/graph/config
+# ---------------------------------------------------------------------------
+
+
+@router.put("/graph/config")
+def put_graph_config(request: Request, body: GraphPruningConfigUpdate):
+    """Update graph thinning configuration.
+
+    Only supplied fields are written; all other graph pruning fields are
+    preserved.  Changes take effect at the next maintenance cycle without
+    requiring a daemon restart (the scheduler reads graph_pruning live from
+    the config object, which the daemon reloads from disk on each cycle).
+    """
+    _require_admin(request)
+    try:
+        updates = body.model_dump(exclude_none=True)
+
+        def mutate(data: dict) -> None:
+            stored = data.get("graph_pruning", {})
+            merged = {**_GRAPH_PRUNING_DEFAULTS, **stored, **updates}
+            data["graph_pruning"] = merged
+
+        data = _update_config(mutate)
+        merged = data["graph_pruning"]
+        return {k: merged[k] for k in _GRAPH_PRUNING_DEFAULTS}
+    except Exception:
+        logger.exception("put_graph_config failed")
+        return JSONResponse({"error": "Internal server error"}, status_code=500)

package/src/superlocalmemory/server/routes/helpers.py

@@ -22,6 +22,7 @@ from fastapi import HTTPException, Request
 from pydantic import BaseModel, Field
 
 from superlocalmemory.infra.data_root import DynamicStatePath, canonical_data_root
+from superlocalmemory.storage.memory_write import memory_write
 
 
 _engine_logger = logging.getLogger("superlocalmemory.engine")
@@ -217,13 +218,23 @@ def log_mode_change(
 
 
 def get_db_connection() -> sqlite3.Connection:
-    """Get database connection."""
+    """Get database connection with busy_timeout set.
+
+    Used for READ-heavy callers. Writers should use ``memory_write(DB_PATH)``
+    instead to also acquire the process write lock.  This connection still gets
+    ``PRAGMA busy_timeout`` so a cross-process writer (hook / CLI) doing a short
+    write does not cause an immediate SQLITE_BUSY here.
+    """
     if not DB_PATH.exists():
         raise HTTPException(
             status_code=500,
             detail="Memory database not found. Run 'slm init' to initialize."
         )
-    return sqlite3.connect(str(DB_PATH))
+    import os as _os
+    _ms = max(0, int(_os.environ.get("SLM_DB_BUSY_TIMEOUT_MS", "10000")))
+    conn = sqlite3.connect(str(DB_PATH), timeout=_ms / 1000.0)
+    conn.execute(f"PRAGMA busy_timeout={_ms}")
+    return conn
 
 
 def dict_factory(cursor: sqlite3.Cursor, row: tuple) -> dict:
@@ -261,20 +272,22 @@ def validate_profile_name(name: str) -> bool:
 
 
 def ensure_profile_in_db(name: str, description: str = "") -> None:
-    """Ensure a profile row exists in SQLite (idempotent)."""
+    """Ensure a profile row exists in SQLite (idempotent).
+
+    Hot path: called on every authenticated request.  Uses ``memory_write()``
+    so in-process writers serialise through the write lock and cross-process
+    writers (hooks / CLI) wait via PRAGMA busy_timeout instead of getting
+    SQLITE_BUSY.
+    """
     if not DB_PATH.exists():
         return
-    conn = sqlite3.connect(str(DB_PATH))
-    try:
+    with memory_write(DB_PATH) as conn:
         conn.execute("PRAGMA foreign_keys=ON")
         conn.execute(
             "INSERT OR IGNORE INTO profiles (profile_id, name, description) "
             "VALUES (?, ?, ?)",
             (name, name, description or f"Memory profile: {name}"),
         )
-        conn.commit()
-    finally:
-        conn.close()
 
 
 def ensure_profile_in_json(name: str, description: str = "") -> None:
@@ -347,11 +360,12 @@ def delete_profile_from_db(name: str) -> None:
     rbac_memberships has no FK to profiles, so CASCADE does not remove role
     grants — they would otherwise survive deletion and silently re-activate if
     a profile of the same name is later recreated. Remove them explicitly.
+    Uses ``memory_write()`` so the multi-statement DELETE is atomic and
+    serialised against other in-process writers.
     """
     if not DB_PATH.exists():
         return
-    conn = sqlite3.connect(str(DB_PATH))
-    try:
+    with memory_write(DB_PATH) as conn:
         conn.execute("PRAGMA foreign_keys=ON")
         # Purge role grants for this workspace (no FK CASCADE covers these).
         for tbl in ("rbac_memberships",):
@@ -360,9 +374,6 @@ def delete_profile_from_db(name: str) -> None:
             except sqlite3.OperationalError:
                 pass  # table may not exist on older installs
         conn.execute("DELETE FROM profiles WHERE profile_id = ?", (name,))
-        conn.commit()
-    finally:
-        conn.close()
 
 
 def _get_db_profiles() -> list[dict]: