superlocalmemory 4.0.0 → 4.0.2

package/CHANGELOG.md

@@ -5,6 +5,41 @@ All notable changes to SuperLocalMemory will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [4.0.2] - 2026-08-15 — Portable Living Brain evidence
+
+### Added
+- Profile-scoped Agent Experience and Cognitive Turn receipts live in the
+  separate `learning.db` plane, with contract validation, short bounded writes,
+  idempotency, migration verification, and profile-erasure cleanup.
+- A portable Brain evidence interface for MCP clients, a read-only
+  `slm brain --json` CLI view, and an honest Living Brain dashboard panel.
+- A bounded-loops 0.5.1 public-CLI observation adapter that preserves the
+  unverified boundary: imported loop output cannot teach SLM automatically.
+
+### Fixed
+- Current recall now excludes system-superseded facts, including candidates
+  reintroduced by bridge/scene expansion and stale session pins. Historical
+  `as_of` recall preserves the prior record where appropriate.
+- Dashboard model configuration preserves unspecified provider/mode fields and
+  does not overwrite redacted endpoint values on a reload/save cycle.
+
+### Safety
+- Receipt writes use a separate SQLite writer domain with a sub-second busy
+  deadline. Mixed foreground memory traffic under receipt load is regression
+  tested with a p95 budget below two seconds; receipt evidence remains
+  observation-only and never changes retrieval, ranking, or routing by itself.
+
+## [4.0.1] - 2026-08-09 — Dashboard and operations-status correctness
+
+### Fixed
+- The packaged dashboard identifies itself as SuperLocalMemory V4 and uses an
+  absolute packaged favicon path. Both unified and standalone dashboard servers
+  now provide the conventional `/favicon.ico` route by redirecting to the
+  packaged SVG icon.
+- The daemon's operations-status counters now receive their FastAPI application
+  explicitly, so persisted dead-letter, degraded-manifest, and exhausted-
+  obligation counts cannot be silently reported as zero.
+
 ## [4.0.0] - 2026-08-01 — Verifiable memory transactions
 
 Version 4.0 hardens the full lifecycle of a memory operation — admission,

package/README.md

@@ -5,7 +5,7 @@
   </picture>
 </p>
 
-<h1 align="center">SuperLocalMemory V4.0.0</h1>
+<h1 align="center">SuperLocalMemory V4.0.2</h1>
 
 <h2 align="center">Rent the LLM. Own the memory.</h2>
 
@@ -27,12 +27,14 @@ guarantee here is stated as a falsifiable invariant, tested under an adversarial
 negative control, and shipped with the harness that regenerates the evidence:
 <code>python benchmark/run_all.py --trials 200 --output-dir results/</code>. What each experiment
 does <em>not</em> exercise is stated too.</p>
-<p align="center"><code>v4.0.0</code> — one control plane: <strong>SLM-Mesh</strong> peer coordination · multi-scope memory (personal / shared / global) · profiles · Cache · Compress · 7-layer retrieval · code graph · Entity Explorer · skill evolution · Modes A/B/C · GDPR retention &amp; audit chain · bounded loops — across CLI, MCP, dashboard, the <strong>Claude plugin</strong>, the <strong>Codex add-on</strong>, and documented IDE integrations.<br/>
+<p align="center"><code>v4.0.2</code> — one control plane: <strong>SLM-Mesh</strong> peer coordination · multi-scope memory (personal / shared / global) · profiles · Cache · Compress · 7-layer retrieval · code graph · Entity Explorer · skill evolution · Modes A/B/C · GDPR retention &amp; audit chain · bounded loops — across CLI, MCP, dashboard, the <strong>Claude plugin</strong>, the <strong>Codex add-on</strong>, and documented IDE integrations.<br/>
 Proxy: <code>slm wrap claude</code> &nbsp;·&nbsp; MCP: add <code>slm_compress</code> to your config &nbsp;·&nbsp; Skill: zero-config</p>
-<p align="center"><strong>3 public research preprints</strong> (arXiv + Zenodo archives) · <a href="https://arxiv.org/abs/2603.02240">arXiv:2603.02240</a> · <a href="https://arxiv.org/abs/2603.14588">arXiv:2603.14588</a> · <a href="https://arxiv.org/abs/2604.04514">arXiv:2604.04514</a></p>
+<p align="center"><strong>Four public arXiv preprints</strong> · V4: <a href="https://arxiv.org/abs/2608.08253">arXiv:2608.08253</a> · companion archive: <a href="https://zenodo.org/records/21853302">Zenodo 21853302</a> (<a href="https://doi.org/10.5281/zenodo.21853302">DOI 10.5281/zenodo.21853302</a>) · prior preprints: <a href="https://arxiv.org/abs/2603.02240">2603.02240</a> · <a href="https://arxiv.org/abs/2603.14588">2603.14588</a> · <a href="https://arxiv.org/abs/2604.04514">2604.04514</a>.</p>
 
 <p align="center">
-  <a href="CHANGELOG.md"><img src="https://img.shields.io/badge/v4.0.0-Current_Release-2ea44f?style=for-the-badge&logo=checkmarx&logoColor=white" alt="v4.0.0 — Current Release"/></a>
+  <a href="CHANGELOG.md"><img src="https://img.shields.io/badge/v4.0.2-Current_Release-2ea44f?style=for-the-badge&logo=checkmarx&logoColor=white" alt="v4.0.2 — Current Release"/></a>
+  <a href="https://arxiv.org/abs/2608.08253"><img src="https://img.shields.io/badge/arXiv-2608.08253-b31b1b?style=for-the-badge&logo=arxiv&logoColor=white" alt="SuperLocalMemory 4.0 paper on arXiv:2608.08253"/></a>
+  <a href="https://zenodo.org/records/21853302"><img src="https://img.shields.io/badge/Zenodo-10.5281%2Fzenodo.21853302-1682D4?style=for-the-badge&logo=zenodo&logoColor=white" alt="V4 paper on Zenodo: 10.5281/zenodo.21853302"/></a>
   <a href="https://arxiv.org/abs/2603.14588"><img src="https://img.shields.io/badge/arXiv-2603.14588-b31b1b?style=for-the-badge&logo=arxiv&logoColor=white" alt="arXiv Paper"/></a>
   <a href="#three-surfaces-proxy--mcp-tools--skill"><img src="https://img.shields.io/badge/Proxy_|_MCP_|_Skill-22c55e?style=for-the-badge" alt="Three Surfaces: Proxy, MCP Tools, Skill"/></a>
   <a href="https://pypi.org/project/superlocalmemory/"><img src="https://img.shields.io/pypi/v/superlocalmemory?style=for-the-badge&logo=pypi&logoColor=white" alt="PyPI"/></a>
@@ -60,7 +62,7 @@ SuperLocalMemory V4 combines conventional dense and lexical retrieval with graph
 
 **Memory with a sense of time.** SLM does not only store *what* an agent learned — it records *when*. Every fact carries ingestion timing and provenance; recall runs a dedicated temporal candidate channel alongside semantic, lexical, and associative retrieval; scenes and entity timelines reconstruct sequence; and the lifecycle lets neglected memory decay and self-archive instead of growing without bound. Time is a first-class ranking and lifecycle signal rather than a timestamp column an agent never reads — which is what lets a long-lived agent reason about how its context changed, not only what it currently holds.
 
-**What V4.0.0 ships.** V4 is a *governed* local-first control plane — every canonical write is admitted, policy-authorized, tracked as durable per-store obligations (lexical, temporal, vector), and sealed by a completion manifest, so it is either fully applied or explicitly marked degraded, never silently half-done. Flagship surfaces in this release:
+**What V4.0.2 ships.** V4 is a *governed* local-first control plane — every canonical write is admitted, policy-authorized, tracked as durable per-store obligations (lexical, temporal, vector), and sealed by a completion manifest, so it is either fully applied or explicitly marked degraded, never silently half-done. Flagship surfaces in this release:
 
 - **[SLM-Mesh](#slm-mesh-cross-session--cross-machine-coordination)** — authenticated cross-session and cross-machine peer coordination (messages, locks, shared state, inbox/outbox, optional discovery). Coordination only — not automatic replicated memory.
 - **Multi-scope memory & profiles** — workspaces (profiles) plus `personal` / `shared` / `global` scopes; cross-profile recall is default-deny.
@@ -693,11 +695,11 @@ configuration for that framework.
 Open the web dashboard with `slm dashboard`; workspaces appear only when their
 runtime capability is enabled and healthy. See [CHANGELOG.md](CHANGELOG.md) for
 the complete release history.
-
 ## Research Papers
 
-SuperLocalMemory is backed by three preprints by Varun Pratap Bhardwaj (2026):
+SuperLocalMemory has a V4 arXiv preprint with a companion Zenodo archive, plus three earlier arXiv preprints (2026):
 
+- **SuperLocalMemory 4.0: The Governed Memory Operating System for AI Agents:** [arXiv:2608.08253](https://arxiv.org/abs/2608.08253) · [Zenodo 21853302](https://zenodo.org/records/21853302) · [DOI 10.5281/zenodo.21853302](https://doi.org/10.5281/zenodo.21853302).
 - **The Living Brain (V3.3):** [arXiv:2604.04514](https://arxiv.org/abs/2604.04514) · [Zenodo 19435120](https://zenodo.org/records/19435120)
 - **Information-Geometric Foundations (V3):** [arXiv:2603.14588](https://arxiv.org/abs/2603.14588) · [Zenodo 19038659](https://zenodo.org/records/19038659)
 - **Trust & Behavioral Foundations (V2):** [arXiv:2603.02240](https://arxiv.org/abs/2603.02240) · [Zenodo 18709670](https://zenodo.org/records/18709670)
@@ -705,11 +707,9 @@ SuperLocalMemory is backed by three preprints by Varun Pratap Bhardwaj (2026):
 Use the citation metadata on the linked arXiv or Zenodo records.
 
 ## Support / License / Qualixar
-See [CONTRIBUTING.md](CONTRIBUTING.md) for guidelines. [Wiki](https://github.com/qualixar/superlocalmemory/wiki) for detailed documentation.
-GNU Affero General Public License v3.0 (AGPL-3.0). See [LICENSE](LICENSE).
+See [CONTRIBUTING.md](CONTRIBUTING.md) for guidelines, the [Wiki](https://github.com/qualixar/superlocalmemory/wiki) for detailed documentation, and [LICENSE](LICENSE) for the GNU Affero General Public License v3.0 (AGPL-3.0).
 For commercial licensing (closed-source, proprietary, or hosted use), see [COMMERCIAL-LICENSE.md](COMMERCIAL-LICENSE.md) or contact varun.pratap.bhardwaj@gmail.com.
-Copyright (c) 2026 Varun Pratap Bhardwaj / Qualixar.
-Part of [Qualixar](https://qualixar.com) · Author: [Varun Pratap Bhardwaj](https://varunpratap.com)
+Copyright (c) 2026 Varun Pratap Bhardwaj / Qualixar · Part of [Qualixar](https://qualixar.com) · Author: [Varun Pratap Bhardwaj](https://varunpratap.com)
 Acknowledgments: [Everything Claude Code](https://github.com/affaan-m/everything-claude-code) informed skill observation; [HKUDS/OpenSpace](https://github.com/HKUDS/OpenSpace) informed skill-evolution verification.
 Qualixar builds open-source infrastructure for AI reliability engineering. Start at [qualixar.com](https://qualixar.com) or browse the [research archive](https://huggingface.co/Qualixar).
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "superlocalmemory",
-  "version": "4.0.0",
+  "version": "4.0.2",
   "description": "Local-first agent memory with MCP and an agent-native CLI. Documented clients include Claude Code, Cursor, and Windsurf.",
   "keywords": [
     "ai-memory",

package/plugin/.claude-plugin/plugin.json

@@ -15,5 +15,5 @@
   "mcpServers": "./.mcp.json",
   "name": "superlocalmemory",
   "repository": "https://github.com/qualixar/superlocalmemory",
-  "version": "4.0.0"
+  "version": "4.0.2"
 }

package/plugin/CLAUDE.md

@@ -1,4 +1,4 @@
-<!-- BEGIN SuperLocalMemory v4.0.0 -->
+<!-- BEGIN SuperLocalMemory v4.0.2 -->
 
 ## SuperLocalMemory (SLM) — Agent Rules
 
@@ -39,6 +39,6 @@ slm-recall · slm-remember · slm-session · slm-status · slm-cache · slm-comp
 ### Subagents
 slm-memory-advisor (memory decisions, session hygiene, scope/profile guidance) · slm-optimize-advisor (context compression + KV cache) · slm-governance-advisor (scope/roles/compliance/GDPR)
 
-<!-- END SuperLocalMemory v4.0.0 -->
+<!-- END SuperLocalMemory v4.0.2 -->
 
-SuperLocalMemory v4.0.0 · Qualixar · AGPL-3.0-or-later
+SuperLocalMemory v4.0.2 · Qualixar · AGPL-3.0-or-later

package/plugin/agents/slm-governance-advisor.md

@@ -77,4 +77,4 @@ slm-scope · slm-governance · slm-profile · slm-remember · slm-recall
 # What NOT to do
 Never session_init twice; never forget without dry-run preview; never store secrets; never bypass role checks; never claim an erasure succeeded without verifying via recall.
 
-SuperLocalMemory v4.0.0 · Qualixar · AGPL-3.0-or-later
+SuperLocalMemory v4.0.2 · Qualixar · AGPL-3.0-or-later

package/plugin/agents/slm-loop-runner.md

@@ -68,4 +68,4 @@ assessment. The gate is the authority.
 
 ---
 
-SuperLocalMemory v4.0.0 · Qualixar · AGPL-3.0-or-later
+SuperLocalMemory v4.0.2 · Qualixar · AGPL-3.0-or-later

package/plugin/agents/slm-memory-advisor.md

@@ -46,4 +46,4 @@ slm-recall · slm-remember · slm-session · slm-scope · slm-profile · slm-gov
 # What NOT to do
 Never session_init twice; never forget dry_run=False without reporting preview; never dump a whole file into remember; never invent a memory; never claim "saved" without success:true / clean CLI exit; never bypass scope or governance restrictions.
 
-SuperLocalMemory v4.0.0 · Qualixar · AGPL-3.0-or-later
+SuperLocalMemory v4.0.2 · Qualixar · AGPL-3.0-or-later

package/plugin/agents/slm-optimize-advisor.md

@@ -41,4 +41,4 @@ slm-compress · slm-cache · slm-status · slm-profile
 # What NOT to do
 Never compress code-for-edit/JSON-to-parse/<500 chars; never store secrets/ccr_ids; never let optimize failure block/alter the task; never claim a specific savings %; never carry ccr_ids across profile switches.
 
-SuperLocalMemory v4.0.0 · Qualixar · AGPL-3.0-or-later
+SuperLocalMemory v4.0.2 · Qualixar · AGPL-3.0-or-later

package/plugin/requirements.txt

@@ -1 +1 @@
-superlocalmemory==4.0.0
+superlocalmemory==4.0.2

package/plugin/skills/slm-cache/SKILL.md

@@ -145,4 +145,4 @@ These subcommands control daemon-level cache settings. They do not read or write
 
 ---
 
-SuperLocalMemory v4.0.0 · Qualixar · AGPL-3.0-or-later
+SuperLocalMemory v4.0.2 · Qualixar · AGPL-3.0-or-later

package/plugin/skills/slm-compress/SKILL.md

@@ -147,4 +147,4 @@ Content over 1 MB (1 000 000 bytes UTF-8) is processed but `reversible` is force
 
 ---
 
-SuperLocalMemory v4.0.0 · Qualixar · AGPL-3.0-or-later
+SuperLocalMemory v4.0.2 · Qualixar · AGPL-3.0-or-later

package/plugin/skills/slm-governance/SKILL.md

@@ -245,4 +245,4 @@ Before running any destructive operation (`forget`, `compact_memories`):
 
 ---
 
-*SuperLocalMemory v4.0.0 · Qualixar · AGPL-3.0-or-later*
+*SuperLocalMemory v4.0.2 · Qualixar · AGPL-3.0-or-later*

package/plugin/skills/slm-graph/SKILL.md

@@ -311,4 +311,4 @@ profile. See `slm-profile` for the full profile switching workflow.
 
 ---
 
-SuperLocalMemory v4.0.0 · Qualixar · AGPL-3.0-or-later
+SuperLocalMemory v4.0.2 · Qualixar · AGPL-3.0-or-later

package/plugin/skills/slm-loop/SKILL.md

@@ -96,4 +96,4 @@ paused, name the approval needed; when errored, quote the short detail.
 
 ---
 
-SuperLocalMemory v4.0.0 · Qualixar · AGPL-3.0-or-later
+SuperLocalMemory v4.0.2 · Qualixar · AGPL-3.0-or-later

package/plugin/skills/slm-mesh/SKILL.md

@@ -279,4 +279,4 @@ mesh availability.
 
 ---
 
-*SuperLocalMemory v4.0.0 · Qualixar · AGPL-3.0-or-later*
+*SuperLocalMemory v4.0.2 · Qualixar · AGPL-3.0-or-later*

package/plugin/skills/slm-profile/SKILL.md

@@ -145,4 +145,4 @@ Name them differently in your MCP config (e.g. `superlocalmemory-personal` and
 
 ---
 
-*SuperLocalMemory v4.0.0 · Qualixar · AGPL-3.0-or-later*
+*SuperLocalMemory v4.0.2 · Qualixar · AGPL-3.0-or-later*

package/plugin/skills/slm-recall/SKILL.md

@@ -236,4 +236,4 @@ before recalling, then switch back. See `slm-profile` for workspace switching.
 
 ---
 
-*SuperLocalMemory v4.0.0 · Qualixar · AGPL-3.0-or-later*
+*SuperLocalMemory v4.0.2 · Qualixar · AGPL-3.0-or-later*

package/plugin/skills/slm-remember/SKILL.md

@@ -238,4 +238,4 @@ different workspace, use `switch_profile` first. See `slm-profile`.
 
 ---
 
-*SuperLocalMemory v4.0.0 · Qualixar · AGPL-3.0-or-later*
+*SuperLocalMemory v4.0.2 · Qualixar · AGPL-3.0-or-later*

package/plugin/skills/slm-scope/SKILL.md

@@ -173,4 +173,4 @@ to review the impact. See `slm-remember` for the full deletion discipline.
 
 ---
 
-*SuperLocalMemory v4.0.0 · Qualixar · AGPL-3.0-or-later*
+*SuperLocalMemory v4.0.2 · Qualixar · AGPL-3.0-or-later*

package/plugin/skills/slm-session/SKILL.md

@@ -227,4 +227,4 @@ explicitly and call `recall` with `include_global`/`include_shared` after
 
 ---
 
-*SuperLocalMemory v4.0.0 · Qualixar · AGPL-3.0-or-later*
+*SuperLocalMemory v4.0.2 · Qualixar · AGPL-3.0-or-later*

package/plugin/skills/slm-status/SKILL.md

@@ -163,4 +163,4 @@ multi-profile setup. To switch the active profile, see `slm-profile`.
 
 ---
 
-SuperLocalMemory v4.0.0 · Qualixar · AGPL-3.0-or-later
+SuperLocalMemory v4.0.2 · Qualixar · AGPL-3.0-or-later

package/plugin-src/rules/AGENTS.md

@@ -128,4 +128,4 @@ When the SLM MCP server is unavailable, use these CLI equivalents:
 - **slm-optimize-advisor** — context compression and KV cache
 - **slm-governance-advisor** — scope/role compliance, retention policies, GDPR
 
-SuperLocalMemory v4.0.0 · Qualixar · AGPL-3.0-or-later
+SuperLocalMemory v4.0.2 · Qualixar · AGPL-3.0-or-later

package/plugin-src/skills/slm-cache/SKILL.md

@@ -145,4 +145,4 @@ These subcommands control daemon-level cache settings. They do not read or write
 
 ---
 
-SuperLocalMemory v4.0.0 · Qualixar · AGPL-3.0-or-later
+SuperLocalMemory v4.0.2 · Qualixar · AGPL-3.0-or-later

package/plugin-src/skills/slm-compress/SKILL.md

@@ -147,4 +147,4 @@ Content over 1 MB (1 000 000 bytes UTF-8) is processed but `reversible` is force
 
 ---
 
-SuperLocalMemory v4.0.0 · Qualixar · AGPL-3.0-or-later
+SuperLocalMemory v4.0.2 · Qualixar · AGPL-3.0-or-later

package/plugin-src/skills/slm-governance/SKILL.md

@@ -245,4 +245,4 @@ Before running any destructive operation (`forget`, `compact_memories`):
 
 ---
 
-*SuperLocalMemory v4.0.0 · Qualixar · AGPL-3.0-or-later*
+*SuperLocalMemory v4.0.2 · Qualixar · AGPL-3.0-or-later*

package/plugin-src/skills/slm-graph/SKILL.md

@@ -311,4 +311,4 @@ profile. See `slm-profile` for the full profile switching workflow.
 
 ---
 
-SuperLocalMemory v4.0.0 · Qualixar · AGPL-3.0-or-later
+SuperLocalMemory v4.0.2 · Qualixar · AGPL-3.0-or-later

package/plugin-src/skills/slm-loop/SKILL.md

@@ -96,4 +96,4 @@ paused, name the approval needed; when errored, quote the short detail.
 
 ---
 
-SuperLocalMemory v4.0.0 · Qualixar · AGPL-3.0-or-later
+SuperLocalMemory v4.0.2 · Qualixar · AGPL-3.0-or-later

package/plugin-src/skills/slm-mesh/SKILL.md

@@ -279,4 +279,4 @@ mesh availability.
 
 ---
 
-*SuperLocalMemory v4.0.0 · Qualixar · AGPL-3.0-or-later*
+*SuperLocalMemory v4.0.2 · Qualixar · AGPL-3.0-or-later*

package/plugin-src/skills/slm-profile/SKILL.md

@@ -145,4 +145,4 @@ Name them differently in your MCP config (e.g. `superlocalmemory-personal` and
 
 ---
 
-*SuperLocalMemory v4.0.0 · Qualixar · AGPL-3.0-or-later*
+*SuperLocalMemory v4.0.2 · Qualixar · AGPL-3.0-or-later*

package/plugin-src/skills/slm-recall/SKILL.md

@@ -236,4 +236,4 @@ before recalling, then switch back. See `slm-profile` for workspace switching.
 
 ---
 
-*SuperLocalMemory v4.0.0 · Qualixar · AGPL-3.0-or-later*
+*SuperLocalMemory v4.0.2 · Qualixar · AGPL-3.0-or-later*

package/plugin-src/skills/slm-remember/SKILL.md

@@ -238,4 +238,4 @@ different workspace, use `switch_profile` first. See `slm-profile`.
 
 ---
 
-*SuperLocalMemory v4.0.0 · Qualixar · AGPL-3.0-or-later*
+*SuperLocalMemory v4.0.2 · Qualixar · AGPL-3.0-or-later*

package/plugin-src/skills/slm-scope/SKILL.md

@@ -173,4 +173,4 @@ to review the impact. See `slm-remember` for the full deletion discipline.
 
 ---
 
-*SuperLocalMemory v4.0.0 · Qualixar · AGPL-3.0-or-later*
+*SuperLocalMemory v4.0.2 · Qualixar · AGPL-3.0-or-later*

package/plugin-src/skills/slm-session/SKILL.md

@@ -227,4 +227,4 @@ explicitly and call `recall` with `include_global`/`include_shared` after
 
 ---
 
-*SuperLocalMemory v4.0.0 · Qualixar · AGPL-3.0-or-later*
+*SuperLocalMemory v4.0.2 · Qualixar · AGPL-3.0-or-later*

package/plugin-src/skills/slm-status/SKILL.md

@@ -163,4 +163,4 @@ multi-profile setup. To switch the active profile, see `slm-profile`.
 
 ---
 
-SuperLocalMemory v4.0.0 · Qualixar · AGPL-3.0-or-later
+SuperLocalMemory v4.0.2 · Qualixar · AGPL-3.0-or-later

package/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "superlocalmemory"
-version = "4.0.0"
+version = "4.0.2"
 description = "Local-first agent memory with auditable hybrid retrieval"
 readme = "README.md"
 license = "AGPL-3.0-or-later"
@@ -37,6 +37,7 @@ dependencies = [
     "scipy==1.17.1",
     "networkx==3.6.1",
     "mcp==2.0.0",
+    "jsonschema==4.26.0",
     "python-dateutil==2.9.0.post0",
     "rank-bm25==0.2.2",
     "vadersentiment==3.3.2",
@@ -90,8 +91,8 @@ dependencies = [
     # the ~560MB model downloads on first setup/warmup (fail-open). Verified the
     # pin does NOT disturb the transformers/torch/numpy pins above.
     "llmlingua==0.2.2",
-    # LLMLingua pulls NLTK transitively. Pin the patched release so clean
-    # installs cannot resolve to the vulnerable 3.9.x line.
+    # LLMLingua pulls NLTK transitively. Pin above the disclosed traversal
+    # advisories so clean installs cannot resolve to the vulnerable 3.9.x line.
     "nltk==3.10.0",
 ]
 
@@ -170,7 +171,7 @@ build-backend = "setuptools.build_meta"
 where = ["src"]
 
 [tool.setuptools.package-data]
-superlocalmemory = ["ui/**/*", "optimize/NOTICE"]
+superlocalmemory = ["ui/**/*", "optimize/NOTICE", "contracts/schemas/*.json"]
 
 [tool.setuptools.data-files]
 "share/superlocalmemory/codex/skills/slm-cache" = ["plugin-src/skills/slm-cache/SKILL.md"]

package/src/superlocalmemory/__init__.py

@@ -32,7 +32,7 @@ if "OMP_NUM_THREADS" not in os.environ:
     os.environ["OMP_NUM_THREADS"] = "2"
 # ---------------------------------------------------------------------------
 
-__version__ = "4.0.0"
+__version__ = "4.0.2"
 
 _REQUIRED_VERSIONS = {
     "sentence_transformers": "5.3.0",

package/src/superlocalmemory/cli/commands.py

@@ -349,6 +349,7 @@ def dispatch(args: Namespace) -> None:
         "delete": cmd_delete,
         "update": cmd_update,
         "status": cmd_status,
+        "brain": cmd_brain,
         "health": cmd_health,
         "doctor": cmd_doctor,
         "trace": cmd_trace,
@@ -1486,10 +1487,27 @@ def cmd_recall(args: Namespace) -> None:
                     _sys.exit(1)
                 _as_of = _as_of_norm
             as_of_qs = f"&as_of={quote(_as_of)}" if _as_of else ""
+            def _strict_time_qs(attr: str, parameter: str) -> str:
+                raw = getattr(args, attr, "") or ""
+                if not raw:
+                    return ""
+                from superlocalmemory.retrieval.temporal_utils import normalize_as_of
+                normalized = normalize_as_of(raw)
+                if normalized is None:
+                    import sys as _sys
+                    _sys.stderr.write(
+                        f"Error: invalid --{attr.replace('_', '-')} value: {raw!r}\n"
+                    )
+                    _sys.exit(1)
+                return f"&{parameter}={quote(normalized)}"
+            known_as_of_qs = _strict_time_qs("known_as_of", "known_as_of")
+            valid_at_qs = _strict_time_qs("valid_at", "valid_at")
+            unknown_qs = "&include_unknown=true" if getattr(args, "include_unknown", False) else ""
             result = daemon_request(
                 "GET",
                 f"/recall?q={quote(args.query)}&limit={args.limit}"
-                f"&session_id={quote(session_id)}{fast_qs}{scope_qs}{window_qs}{as_of_qs}",
+                f"&session_id={quote(session_id)}{fast_qs}{scope_qs}{window_qs}{as_of_qs}"
+                f"{known_as_of_qs}{valid_at_qs}{unknown_qs}",
             )
             if result and "results" in result:
                 # Format daemon response same as engine response
@@ -3680,6 +3698,47 @@ def cmd_session_context(args: Namespace) -> None:
         logger.debug("session-context (fast) failed: %s", exc)
 
 
+def cmd_brain(args: Namespace) -> None:
+    """Read the portable, profile-scoped Agent Experience evidence summary.
+
+    This command deliberately opens no memory engine and starts no daemon. It
+    is an indexed ``learning.db`` read, so support scripts and non-technical
+    users can inspect the Living Brain without affecting recall latency.
+    """
+    from superlocalmemory.core.config import SLMConfig
+    from superlocalmemory.infra.data_root import state_path
+    from superlocalmemory.storage.agent_experience import get_profile_receipt_summary
+
+    config = SLMConfig.load()
+    profile_id = config.active_profile
+    data = {
+        "profile_id": profile_id,
+        "agent_experience": get_profile_receipt_summary(
+            state_path("learning.db"), profile_id
+        ),
+        "control_plane": "observation_only",
+    }
+    if getattr(args, "json", False):
+        from superlocalmemory.cli.json_output import json_print
+
+        json_print("brain", data=data, next_actions=[
+            {"command": "slm dashboard", "description": "Open the Living Brain dashboard"},
+        ])
+        return
+    evidence = data["agent_experience"]
+    print("SuperLocalMemory Living Brain")
+    print(f"  Profile: {profile_id}")
+    print(f"  Agent experiences: {evidence['experiences_total']}")
+    print(f"  Claimed evidence authority: {evidence['claimed_evidence_experiences']}")
+    print(f"  Cognitive turns: {evidence['turns_total']}")
+    if evidence["turns_by_state"]:
+        states = ", ".join(
+            f"{state}: {count}" for state, count in sorted(evidence["turns_by_state"].items())
+        )
+        print(f"  Turn states: {states}")
+    print("  Retrieval control: observation only")
+
+
 def cmd_observe(args: Namespace) -> None:
     """Evaluate and auto-capture content from stdin or argument.
 

package/src/superlocalmemory/cli/main.py

@@ -64,7 +64,7 @@ examples:
 documentation:
   Website:    https://superlocalmemory.com
   GitHub:     https://github.com/qualixar/superlocalmemory
-  Paper:      https://arxiv.org/abs/2603.14588
+  Paper:      https://arxiv.org/abs/2608.08253
 """
 
 
@@ -75,6 +75,8 @@ _NO_DAEMON_COMMANDS = {
     "disable", "enable", "clear-cache", "reconfigure", "benchmark",
     "rotate-token",
     "evidence",
+    # v4.0.2 receipt summary is a direct read-only learning.db query.
+    "brain",
     "diagnostics",
     # LLD-06 — agents launched through wrap start the daemon on demand.
     "wrap",
@@ -394,6 +396,18 @@ def main() -> None:
              "(2026-01-01T00:00:00+00:00) that pins retrieval to a temporal "
              "snapshot. Default: current-state recall.",
     )
+    recall_p.add_argument(
+        "--known-as-of", dest="known_as_of", default="",
+        help="Strict transaction-time boundary: return only facts SLM knew by this ISO-8601 time.",
+    )
+    recall_p.add_argument(
+        "--valid-at", dest="valid_at", default="",
+        help="Strict event-time boundary: return only facts valid at this ISO-8601 time.",
+    )
+    recall_p.add_argument(
+        "--include-unknown", action="store_true",
+        help="Include pre-4.0.2 facts with unknown temporal provenance in strict time-travel.",
+    )
     recall_p.add_argument(
         "--fast", action="store_true",
         help="Force-skip the internal agentic verification round (all six retrieval "
@@ -606,6 +620,15 @@ def main() -> None:
     obs_p = sub.add_parser("observe", help="Auto-capture content (pipe or argument)")
     obs_p.add_argument("content", nargs="?", default="", help="Content to evaluate")
 
+    brain_p = sub.add_parser(
+        "brain", help="Show the local, profile-scoped Living Brain evidence summary"
+    )
+    brain_p.add_argument(
+        "action", nargs="?", default="status", choices=["status"],
+        help="Read-only Brain action (default: status)",
+    )
+    brain_p.add_argument("--json", action="store_true", help="Output structured JSON")
+
     # -- V3.3 Commands -------------------------------------------------
     decay_p = sub.add_parser("decay", help="Run Ebbinghaus forgetting decay cycle")
     decay_p.add_argument(