superlocalmemory 4.0.3 → 4.0.5

package/src/superlocalmemory/core/store_pipeline.py

@@ -14,6 +14,7 @@ from __future__ import annotations
 import hashlib
 import json
 import logging
+import sqlite3
 import uuid
 from typing import TYPE_CHECKING, Any
 
@@ -51,6 +52,72 @@ def _ingestion_effect_id(operation_id: str, *parts: object) -> str:
     return hashlib.sha256(payload.encode("utf-8")).hexdigest()[:32]
 
 
+def _record_correction_candidate(
+    db: DatabaseManager,
+    *,
+    operation_id: str,
+    profile_id: str,
+    scope: str,
+    predecessor_fact_id: str,
+    successor_fact_id: str,
+    reason_code: str,
+    trusted_actor_id: str,
+) -> None:
+    """Append a review candidate through the current canonical transaction.
+
+    This intentionally carries identifiers and a controlled reason code only.
+    It must not use detector prose because that can contain user memory text.
+    If the current path is bound to the canonical coordinator,
+    ``raw_connection`` yields its already-open transaction; otherwise the
+    database manager owns the short transaction. Either path is atomic.
+    """
+    if not trusted_actor_id or not predecessor_fact_id or not successor_fact_id:
+        return
+    if predecessor_fact_id == successor_fact_id:
+        return
+    from superlocalmemory.storage.correction_cases import (
+        CorrectionActor,
+        CorrectionCaseError,
+        propose_on_connection,
+    )
+
+    case_id = _ingestion_effect_id(
+        operation_id, "correction-case", profile_id, predecessor_fact_id,
+        successor_fact_id, reason_code,
+    )
+    idempotency_key = _ingestion_effect_id(
+        operation_id, "correction-proposal", profile_id, predecessor_fact_id,
+        successor_fact_id, reason_code,
+    )
+    actor = CorrectionActor(
+        actor_id=trusted_actor_id,
+        actor_kind="host_attested",
+        trust_tier="canonical_writer",
+    )
+    try:
+        with db.raw_connection() as conn:
+            propose_on_connection(
+                conn,
+                case_id=case_id,
+                profile_id=profile_id,
+                scope=scope,
+                predecessor_fact_id=predecessor_fact_id,
+                successor_fact_id=successor_fact_id,
+                reason_code=reason_code,
+                actor=actor,
+                idempotency_key=idempotency_key,
+                # Candidate detection observes a possible correction. It does
+                # not claim an event-time boundary from heuristic evidence.
+                is_profile_active=lambda candidate_profile: candidate_profile == profile_id,
+                is_actor_trusted=lambda candidate_actor: candidate_actor == actor,
+            )
+    except (CorrectionCaseError, sqlite3.Error, ValueError) as exc:
+        # A missing/hot-upgrading M042 ledger must not make memory ingestion
+        # unavailable. The candidate is advisory and has no retrieval effect;
+        # the warning is the operational signal that an operator must inspect.
+        logger.warning("Correction candidate not recorded for %s: %s", successor_fact_id, exc)
+
+
 def _record_fact_entity_association(
     db: DatabaseManager,
     *,
@@ -731,47 +798,30 @@ def run_store(
                         continue
                     fact = existing_fact
 
-                # Opinion confidence tracking: reinforce or decay
-                if fact.fact_type == FactType.OPINION and action.action_type.value == "update":
-                    try:
-                        existing = db.get_fact(
-                            action.existing_fact_id or action.new_fact_id
-                        )
-                        if existing and existing.fact_type == FactType.OPINION:
-                            new_conf = min(1.0, existing.confidence + 0.1)
-                            db.update_fact(existing.fact_id, {"confidence": new_conf})
-                    except Exception:
-                        pass
-                elif fact.fact_type == FactType.OPINION and action.action_type.value == "supersede":
-                    try:
-                        old_id = getattr(action, "old_fact_id", None)
-                        if old_id:
-                            old_fact = db.get_fact(old_id)
-                            if old_fact:
-                                new_conf = max(0.0, old_fact.confidence - 0.2)
-                                db.update_fact(old_id, {"confidence": new_conf})
-                    except Exception:
-                        pass
-
                 if action.action_type.value in ("update", "supersede"):
-                    target_id = (
-                        (action.existing_fact_id or action.new_fact_id)
-                        if action.action_type.value == "update"
-                        else action.new_fact_id
-                    )
-                    if is_queryable_promotion and target_id != fact.fact_id:
-                        db.delete_fact(fact.fact_id)
-                    updated_fact = db.get_fact(target_id)
-                    if updated_fact is None:
+                    # A consolidator UPDATE/SUPERSEDE is a review-required
+                    # proposal.  It persists the incoming successor and does
+                    # not mutate, delete, archive, or change trust on the
+                    # matched predecessor.  Continue materializing the
+                    # incoming fact through the common projection pipeline.
+                    proposed_fact = db.get_fact(action.new_fact_id)
+                    if proposed_fact is None:
                         raise RuntimeError(
-                            f"consolidation {action.action_type.value} produced "
-                            f"missing fact {target_id}"
+                            f"consolidation {action.action_type.value} proposal produced "
+                            f"missing fact {action.new_fact_id}"
+                        )
+                    fact = proposed_fact
+                    if action.existing_fact_id:
+                        _record_correction_candidate(
+                            db,
+                            operation_id=ingestion_operation_id,
+                            profile_id=profile_id,
+                            scope=scope,
+                            predecessor_fact_id=action.existing_fact_id,
+                            successor_fact_id=action.new_fact_id,
+                            reason_code=f"consolidation_{action.action_type.value}",
+                            trusted_actor_id=trusted_actor_id,
                         )
-                    # Continue through the shared index/graph/temporal/
-                    # provenance stages.  The previous early continue made
-                    # UPDATE/SUPERSEDE facts look stored while skipping half of
-                    # canonical materialization.
-                    fact = updated_fact
                 # ADD case: consolidator already stored the fact (F8 fix)
                 # Fall through to post-processing below
             else:
@@ -860,6 +910,18 @@ def run_store(
                         "Temporal: %d facts invalidated by new fact %s",
                         len(invalidations), fact.fact_id,
                     )
+                    for candidate in invalidations:
+                        predecessor_fact_id = str(candidate.get("old_fact_id") or "")
+                        _record_correction_candidate(
+                            db,
+                            operation_id=ingestion_operation_id,
+                            profile_id=profile_id,
+                            scope=scope,
+                            predecessor_fact_id=predecessor_fact_id,
+                            successor_fact_id=fact.fact_id,
+                            reason_code="temporal_contradiction",
+                            trusted_actor_id=trusted_actor_id,
+                        )
             except Exception as exc:
                 temporal_complete = False
                 logger.debug(

package/src/superlocalmemory/encoding/consolidator.py

@@ -4,10 +4,13 @@
 
 """SuperLocalMemory V3 — Memory Consolidator.
 
-Mem0-style ADD/UPDATE/SUPERSEDE/NOOP logic for incoming facts.
-V1 was append-only (never updated, never deleted, never merged).
-This module gives a ~26% uplift by deduplicating, updating, and
-resolving contradictions at encoding time.
+Mem0-style ADD/UPDATE/SUPERSEDE/NOOP classification for incoming facts.
+
+UPDATE and SUPERSEDE are now *proposal classifications*: they persist the
+incoming fact but never rewrite, archive, lower trust for, or otherwise mutate
+the matched fact.  A reviewed correction owner may later apply a case through
+the correction ledger.  This keeps ingestion useful while preventing an
+automatic model judgement from changing the historical record.
 
 Mode A: keyword-based contradiction detection (zero LLM).
 Mode B/C: LLM-assisted contradiction detection when available.
@@ -20,7 +23,7 @@ from __future__ import annotations
 
 import logging
 import math
-from typing import Any, Protocol
+from typing import Protocol
 
 from superlocalmemory.core.config import EncodingConfig
 from superlocalmemory.storage.database import DatabaseManager
@@ -30,7 +33,6 @@ from superlocalmemory.storage.models import (
     ConsolidationActionType,
     EdgeType,
     GraphEdge,
-    MemoryLifecycle,
 )
 
 logger = logging.getLogger(__name__)
@@ -310,29 +312,17 @@ class MemoryConsolidator:
         *,
         reason: str,
     ) -> ConsolidationAction:
-        """Update existing fact: bump evidence, optionally merge content."""
-        new_evidence = existing.evidence_count + 1
-        new_confidence = min(1.0, existing.confidence + 0.05)
-        updates: dict[str, Any] = {
-            "evidence_count": new_evidence,
-            "confidence": new_confidence,
-        }
-
-        # If LLM available, merge content for a richer fact
-        if self._llm is not None and self._llm.is_available():
-            merged = self._merge_facts(existing.content, new_fact.content)
-            if merged:
-                updates["content"] = merged
-
-        self._db.update_fact(existing.fact_id, updates)
+        """Persist a proposed refinement without rewriting the predecessor."""
+        self._db.store_fact(new_fact)
+        self._create_semantic_edges(new_fact, profile_id)
         action = self._log_action(
             ConsolidationActionType.UPDATE,
             new_fact.fact_id, existing.fact_id,
             profile_id, reason,
         )
         logger.debug(
-            "UPDATE fact %s (evidence=%d): %s",
-            existing.fact_id, new_evidence, reason,
+            "UPDATE proposal %s -> %s: %s",
+            existing.fact_id, new_fact.fact_id, reason,
         )
         return action
 
@@ -344,37 +334,17 @@ class MemoryConsolidator:
         *,
         reason: str,
     ) -> ConsolidationAction:
-        """Archive old fact, store new, create contradiction edge."""
-        # Archive old fact (keep for history but deprioritize in retrieval)
-        self._db.update_fact(
-            existing.fact_id,
-            {"lifecycle": MemoryLifecycle.ARCHIVED},
-        )
-        # Store new fact
+        """Persist a proposed successor without changing the predecessor."""
         self._db.store_fact(new_fact)
-        # Create contradiction + supersedes edges
-        self._db.store_edge(GraphEdge(
-            profile_id=profile_id,
-            source_id=new_fact.fact_id,
-            target_id=existing.fact_id,
-            edge_type=EdgeType.CONTRADICTION,
-            weight=1.0,
-        ))
-        self._db.store_edge(GraphEdge(
-            profile_id=profile_id,
-            source_id=new_fact.fact_id,
-            target_id=existing.fact_id,
-            edge_type=EdgeType.SUPERSEDES,
-            weight=1.0,
-        ))
+        self._create_semantic_edges(new_fact, profile_id)
         action = self._log_action(
             ConsolidationActionType.SUPERSEDE,
             new_fact.fact_id, existing.fact_id,
             profile_id, reason,
         )
         logger.debug(
-            "SUPERSEDE %s → %s: %s",
-            new_fact.fact_id, existing.fact_id, reason,
+            "SUPERSEDE proposal %s -> %s: %s",
+            existing.fact_id, new_fact.fact_id, reason,
         )
         return action
 

package/src/superlocalmemory/encoding/temporal_validator.py

@@ -2,7 +2,7 @@
 # Licensed under AGPL-3.0-or-later - see LICENSE file
 # Part of SuperLocalMemory V3
 
-"""Temporal Intelligence -- contradiction detection and fact invalidation.
+"""Temporal Intelligence -- contradiction detection and reviewable proposals.
 
 Implements full bi-temporal validity tracking with 4 timestamps (L8 fix).
 Contradiction detection via sheaf cohomology (Mode A: pure math) or
@@ -36,7 +36,7 @@ logger = logging.getLogger(__name__)
 
 
 class TemporalValidator:
-    """Validates temporal consistency and manages fact invalidation.
+    """Validates temporal consistency and proposes fact corrections.
 
     Components received via __init__ (NOT the engine -- Rule 06):
     - db: DatabaseManager
@@ -75,15 +75,20 @@ class TemporalValidator:
         new_fact: AtomicFact,
         profile_id: str,
     ) -> list[dict]:
-        """Check new fact for contradictions and invalidate old facts.
+        """Check new fact for contradictions without mutating old facts.
 
         Algorithm:
         1. Detect contradictions (sheaf or LLM).
-        2. For each contradiction: invalidate old fact (set valid_until + system_expired_at).
-        3. Apply trust penalty to invalidated facts.
-        4. Return list of invalidation actions.
+        2. Exclude valid historical progressions using explicit event anchors.
+        3. Return review-required correction candidates.
 
-        Returns list of dicts: {old_fact_id, new_fact_id, reason, severity}
+        This legacy method name is intentionally retained for API compatibility.
+        It no longer expires facts, changes trust, or changes retrieval state.
+        The reviewed-correction owner is the only layer permitted to apply a
+        candidate to bi-temporal validity.
+
+        Returns list of dicts: {old_fact_id, new_fact_id, reason, severity,
+        status="proposed"}.
         """
         contradictions = self.detect_contradiction(new_fact, profile_id)
 
@@ -108,25 +113,16 @@ class TemporalValidator:
                 )
                 continue
 
-            # Step 1: Invalidate the old fact (bi-temporal)
-            self.invalidate_fact(
-                fact_id=old_fact_id,
-                invalidated_by=new_fact.fact_id,
-                reason=reason,
-            )
-
-            # Step 2: Apply trust penalty
-            self._apply_trust_penalty(old_fact_id, profile_id)
-
             actions.append({
                 "old_fact_id": old_fact_id,
                 "new_fact_id": new_fact.fact_id,
                 "reason": reason,
                 "severity": severity,
+                "status": "proposed",
             })
 
         logger.info(
-            "Temporal: invalidated %d facts due to new fact %s",
+            "Temporal: proposed %d correction(s) due to new fact %s",
             len(actions), new_fact.fact_id,
         )
         return actions

package/src/superlocalmemory/hooks/user_prompt_hook.py

@@ -98,7 +98,7 @@ def main() -> int:
 
     try:
         topic_sig = compute_topic_signature(prompt, entity_hits=entity_hits)
-        entry = read_entry_fast(session_id, topic_sig)
+        entry = read_entry_fast(session_id, topic_sig, require_current_admission=True)
     except Exception:
         sys.stdout.write("{}")
         return 0

package/src/superlocalmemory/integrations/bounded_loops_mcp.py

@@ -0,0 +1,185 @@
+"""Versioned, read-only contract boundary for Bounded Loops MCP evidence."""
+
+from __future__ import annotations
+
+import asyncio
+import json
+import os
+import shutil
+import stat
+from collections.abc import Awaitable, Callable
+from copy import deepcopy
+from pathlib import Path
+from typing import Any
+
+CONTRACT_ID = "bounded-loops.dev/slm-bridge/v1"
+_OBSERVATION_TIMEOUT_SECONDS = 5.0
+_MAX_MCP_TEXT_BYTES = 2 * 1024 * 1024
+_ADVERTISEMENT = {
+    "id": CONTRACT_ID,
+    "tool": "bl_graph_evidence",
+    "operation": "observe_terminal_run",
+}
+
+
+class BridgeUnavailable(ValueError):
+    """The installed producer does not advertise a compatible bridge contract."""
+
+
+def supports_bridge(capabilities: dict[str, Any]) -> bool:
+    """Negotiate on the declared public contract, never producer semver."""
+    advertised = capabilities.get("evidence_contracts")
+    return isinstance(advertised, list) and any(
+        isinstance(item, dict)
+        and all(item.get(key) == value for key, value in _ADVERTISEMENT.items())
+        for item in advertised
+    )
+
+
+def bridge_payload(evidence: dict[str, Any], *, profile_id: str) -> dict[str, Any]:
+    """Attach active-profile identity after refusing incompatible evidence."""
+    if evidence.get("contract") != CONTRACT_ID:
+        raise BridgeUnavailable("unsupported bounded-loops evidence contract")
+    if evidence.get("eligible_for_learning") is not False:
+        raise BridgeUnavailable("bounded-loops evidence is not observation-only")
+    # The producer has organisation/project metadata for its own control plane.
+    # SLM stores only the v1 observation receipt needed by its profile-scoped
+    # learning database; retaining arbitrary producer extensions would turn a
+    # versioned contract into an unbounded schema sink.
+    fields = (
+        "contract",
+        "workspace_id",
+        "run_ref",
+        "run_id",
+        "outcome",
+        "run_state",
+        "demonstration",
+        "eligible_for_learning",
+        "terminal_at",
+        "graph_digest",
+        "plan_digest",
+        "policy_digest",
+        "receipt",
+        "nodes",
+    )
+    if any(field not in evidence for field in fields):
+        raise BridgeUnavailable("bounded-loops evidence is missing required v1 fields")
+    return {field: deepcopy(evidence[field]) for field in fields} | {"profile_id": profile_id}
+
+
+async def observe_terminal_runs(
+    call_tool: Callable[[str, dict[str, Any]], Awaitable[dict[str, Any]]], *, profile_id: str
+) -> list[dict[str, Any]]:
+    """Collect only producer-advertised terminal evidence over an injected MCP transport."""
+    discovery = await call_tool("bl_capabilities", {})
+    if discovery.get("status") != "ok" or not supports_bridge(discovery.get("capabilities", {})):
+        raise BridgeUnavailable("bounded-loops does not advertise slm-bridge/v1")
+    listing = await call_tool("bl_graph_terminal_runs", {"limit": 100})
+    if listing.get("status") != "ok" or listing.get("contract") != CONTRACT_ID:
+        raise BridgeUnavailable("bounded-loops terminal listing is unavailable")
+    runs = listing.get("runs")
+    if not isinstance(runs, list):
+        raise BridgeUnavailable("bounded-loops terminal listing is malformed")
+    # The producer's limit is advisory.  Keep this explicit operation bounded
+    # even against a compatible but faulty/malicious producer.
+    runs = runs[:100]
+    observed: list[dict[str, Any]] = []
+    for run in runs:
+        if not isinstance(run, dict) or not isinstance(run.get("run_ref"), str):
+            raise BridgeUnavailable("bounded-loops terminal listing is malformed")
+        response = await call_tool("bl_graph_evidence", {"run_ref": run["run_ref"]})
+        if response.get("status") == "unavailable":
+            continue
+        if response.get("status") != "ok" or not isinstance(response.get("evidence"), dict):
+            raise BridgeUnavailable("bounded-loops evidence response is malformed")
+        observed.append(bridge_payload(response["evidence"], profile_id=profile_id))
+    return observed
+
+
+async def observe_from_stdio(*, command: str, cwd: str, profile_id: str) -> list[dict[str, Any]]:
+    """Run one bounded, explicit MCP 2 observation; never call from recall or remember."""
+    executable, workspace = Path(command), Path(cwd)
+    if (
+        not executable.is_absolute()
+        or not executable.is_file()
+        or not workspace.is_absolute()
+        or not workspace.is_dir()
+        or workspace.is_symlink()
+    ):
+        raise BridgeUnavailable(
+            "bounded-loops bridge requires an approved executable and workspace"
+        )
+    try:
+        executable = executable.resolve(strict=True)
+        workspace = workspace.resolve(strict=True)
+        mode = executable.stat().st_mode
+    except OSError as exc:
+        raise BridgeUnavailable("bounded-loops bridge path is unavailable") from exc
+    if not stat.S_ISREG(mode) or (
+        os.name != "nt" and mode & (stat.S_IWGRP | stat.S_IWOTH)
+    ):
+        raise BridgeUnavailable("bounded-loops executable is not a trusted regular file")
+    if executable.stat().st_uid not in {0, os.geteuid()}:
+        raise BridgeUnavailable("bounded-loops executable owner is not trusted")
+
+    from mcp import ClientSession, StdioServerParameters
+    from mcp.client.stdio import stdio_client
+
+    try:
+        parameters = StdioServerParameters(
+            command=str(executable), args=[], cwd=str(workspace)
+        )
+        async with stdio_client(parameters) as (read, write):
+            async with ClientSession(
+                read,
+                write,
+                # MCP 2.x passes this directly to AnyIO's timeout machinery,
+                # which accepts a numeric duration rather than timedelta.
+                read_timeout_seconds=_OBSERVATION_TIMEOUT_SECONDS,
+            ) as session:
+                async def observe() -> list[dict[str, Any]]:
+                    await session.initialize()
+
+                    async def call(name: str, arguments: dict[str, Any]) -> dict[str, Any]:
+                        result = await session.call_tool(name, arguments)
+                        if result.is_error:
+                            raise BridgeUnavailable(
+                                "bounded-loops rejected the observation request"
+                            )
+                        texts = [item.text for item in result.content if hasattr(item, "text")]
+                        if len(texts) != 1 or len(texts[0].encode("utf-8")) > _MAX_MCP_TEXT_BYTES:
+                            raise BridgeUnavailable("bounded-loops returned an invalid MCP payload")
+                        try:
+                            payload = json.loads(texts[0])
+                        except json.JSONDecodeError as exc:
+                            raise BridgeUnavailable("bounded-loops returned invalid JSON") from exc
+                        if not isinstance(payload, dict):
+                            raise BridgeUnavailable("bounded-loops returned an invalid MCP payload")
+                        return payload
+
+                    return await observe_terminal_runs(call, profile_id=profile_id)
+                return await asyncio.wait_for(observe(), timeout=_OBSERVATION_TIMEOUT_SECONDS)
+    except BridgeUnavailable:
+        raise
+    except Exception as exc:
+        raise BridgeUnavailable("bounded-loops observation timed out or could not start") from exc
+
+
+async def observe_installed(*, workspace: str, profile_id: str) -> list[dict[str, Any]]:
+    """Observe a user-installed producer without accepting an agent command.
+
+    Discovery deliberately resolves exactly the public ``bounded-loops-mcp``
+    executable.  It does not accept a command, shell fragment, or arguments
+    from an MCP caller; the only caller-supplied value is the existing project
+    workspace whose Bounded Loops state is to be read.
+    """
+    command = shutil.which("bounded-loops-mcp")
+    if command is None:
+        raise BridgeUnavailable("bounded-loops-mcp is not installed")
+    if not Path(command).is_absolute():
+        raise BridgeUnavailable("bounded-loops-mcp discovery returned an unsafe path")
+    if Path(command).resolve().name not in {"bounded-loops-mcp", "bounded-loops-mcp.exe"}:
+        raise BridgeUnavailable("bounded-loops-mcp discovery returned an unsafe executable")
+    return await observe_from_stdio(
+        command=str(Path(command).resolve()), cwd=workspace, profile_id=profile_id
+    )

package/src/superlocalmemory/learning/database.py

@@ -613,7 +613,8 @@ class LearningDatabase:
                     row[0]
                     for row in conn.execute(
                         "SELECT name FROM sqlite_master WHERE type='table' "
-                        "AND name IN ('agent_experiences', 'cognitive_turn_receipts')"
+                        "AND name IN ('agent_experiences', 'cognitive_turn_receipts', "
+                        "'external_evidence_receipts')"
                     )
                 }
                 if profile_id is None:

package/src/superlocalmemory/mcp/profiles.py

@@ -17,10 +17,13 @@ from __future__ import annotations
 # v3.6.14 WP-01: Named profile definitions
 # ---------------------------------------------------------------------------
 
-_PROFILE_CORE: frozenset[str] = frozenset({  # 14
+_PROFILE_CORE: frozenset[str] = frozenset({  # 16
     "remember", "recall", "search", "fetch", "list_recent", "update_memory", "forget",
     "session_init", "close_session",
     "slm_compress", "slm_retrieve", "slm_cache_set", "slm_cache_get", "slm_optimize_stats",
+    # A client that can propose a correction must be able to inspect and
+    # authenticate its review; otherwise the core lifecycle is incomplete.
+    "review_correction", "list_corrections",
 })
 
 # Portable Brain evidence must reach the coding-host profile shipped by the
@@ -28,9 +31,10 @@ _PROFILE_CORE: frozenset[str] = frozenset({  # 14
 _PROFILE_BRAIN: frozenset[str] = frozenset({
     "get_brain_evidence_status", "record_agent_experience",
     "record_cognitive_turn", "finalize_cognitive_turn",
+    "observe_bounded_loop_evidence",
 })
 
-_PROFILE_CODE: frozenset[str] = _PROFILE_CORE | _PROFILE_BRAIN | frozenset({  # 28
+_PROFILE_CODE: frozenset[str] = _PROFILE_CORE | _PROFILE_BRAIN | frozenset({  # 31
     "build_code_graph", "get_blast_radius", "query_graph",
     "semantic_search_code", "get_review_context", "detect_changes",
     # switch_profile lets a plugin/IDE session change the active workspace over
@@ -47,21 +51,23 @@ _PROFILE_FULL_MESH: frozenset[str] = frozenset({  # 8
     "mesh_state", "mesh_lock", "mesh_events", "mesh_status",
 })
 
-_PROFILE_FULL: frozenset[str] = frozenset({  # 38 base — EXPLICIT literal, NOT runtime _ESSENTIAL_TOOLS (OQ-2)
+# 41 base — explicit literal, not runtime _ESSENTIAL_TOOLS (OQ-2).
+_PROFILE_FULL: frozenset[str] = frozenset({
     "remember", "recall", "search", "fetch", "list_recent", "delete_memory", "update_memory",
     "get_status", "session_init", "observe", "close_session", "report_feedback", "forget",
     "run_maintenance", "consolidate_cognitive", "get_soft_prompts", "set_mode", "report_outcome",
     "log_tool_event", "get_assertions", "reinforce_assertion", "contradict_assertion",
     "get_brain_evidence_status", "record_agent_experience",
     "record_cognitive_turn", "finalize_cognitive_turn",
+    "observe_bounded_loop_evidence", "review_correction", "list_corrections",
     "evolve_skill", "skill_health", "skill_lineage", "switch_profile",
     "slm_compress", "slm_retrieve", "slm_cache_set", "slm_cache_get", "slm_optimize_stats",
     # v3.8.0: bounded-loop tools (CLI + /slm-loop command + MCP).
     "slm_loop_run", "slm_loop_history", "slm_loop_show",
     # prestage_context remains registered but deliberately raw-server-only.
-}) | _PROFILE_FULL_MESH  # 46
+}) | _PROFILE_FULL_MESH  # 49
 
-_PROFILE_POWER: frozenset[str] = _PROFILE_FULL | frozenset({  # 58
+_PROFILE_POWER: frozenset[str] = _PROFILE_FULL | frozenset({  # 61
     "get_version", "get_mode", "health", "consistency_check", "recall_trace",
     "get_lifecycle_status", "set_retention_policy", "compact_memories",
     "get_behavioral_patterns", "audit_trail", "quantize", "get_retention_stats",
@@ -84,25 +90,34 @@ _PROFILE_DEFINITIONS: dict[str, frozenset[str]] = {
 # at server startup.  Any other value is a configuration error (fail closed).
 _PROFILE_ALIASES: dict[str, str] = {
     "core14": "core",
-    # 3.8.0: switch_profile (+1) then bounded-loop tools (+3) grew code/full/
+    "core16": "core",
+    # 3.8.0 and later additions grew code/full/power; every historical count
     # power. Every historical count-suffixed name is kept so a v3.6/3.7/early-
     # 3.8 config still resolves (back-compat); new 3.8.0 counts added alongside.
     "code20": "code",
     "code21": "code",
     "code24": "code",
     "code28": "code",
+    "code29": "code",
+    "code31": "code",
     "full38": "full",
     "full39": "full",
     "full42": "full",
     "full46": "full",
+    "full47": "full",
+    "full49": "full",
     "power50": "power",
     "power51": "power",
     "power54": "power",
     "power58": "power",
+    "power59": "power",
+    "power61": "power",
     "mesh8": "mesh",
     "whole81": "whole",
     "whole84": "whole",
     "whole91": "whole",
+    "whole92": "whole",
+    "whole94": "whole",
 }
 
 # Plain-English descriptions for UI display.
@@ -110,7 +125,10 @@ _PROFILE_ALIASES: dict[str, str] = {
 # one sentence, user-facing language only.
 PROFILE_DESCRIPTIONS: dict[str, str] = {
     "core": "Essential memory: store, recall, search, sessions",
-    "code": "Core + code graph, portable Brain evidence, and profile switching (default for IDE coding agents)",
+    "code": (
+        "Core + code graph, portable Brain evidence, and profile switching "
+        "(default for IDE coding agents)"
+    ),
     "full": "All everyday memory, portable Brain evidence, optimization, and mesh tools",
     "power": "Everything in full plus advanced governance and behavioral tools",
     "mesh": "Cross-device mesh coordination only",