superlocalmemory 4.0.4 → 4.0.5

package/src/superlocalmemory/mcp/tools_core.py

@@ -928,8 +928,11 @@ def register_core_tools(server, get_engine: Callable) -> None:
                 )
                 if isinstance(result, dict) and result.get("success"):
                     return {
-                        "success": True, "fact_id": fact_id,
-                        "content": content.strip(),
+                        "success": True,
+                        "predecessor_fact_id": result.get("predecessor_fact_id", fact_id),
+                        "successor_fact_id": result.get("successor_fact_id"),
+                        "correction_case": result.get("correction_case"),
+                        "review_required": bool(result.get("review_required", False)),
                     }
                 return {
                     "success": False,
@@ -947,12 +950,94 @@ def register_core_tools(server, get_engine: Callable) -> None:
             })
             if result.get("ok"):
                 logger.info("Memory updated: %s by agent: %s", fact_id[:16], agent_id)
-                return {"success": True, "fact_id": fact_id, "content": content.strip()}
+                return {
+                    "success": True,
+                    "predecessor_fact_id": result.get("predecessor_fact_id", fact_id),
+                    "successor_fact_id": result.get("successor_fact_id"),
+                    "correction_case": result.get("correction_case"),
+                    "review_required": bool(result.get("review_required", False)),
+                }
             return {"success": False, "error": result.get("error", "Update failed")}
         except Exception as exc:
             logger.exception("update_memory failed")
             return {"success": False, "error": str(exc)}
 
+    @server.tool(annotations=ToolAnnotations(idempotentHint=True))
+    @admits(OperationKind.CORRECT)
+    async def review_correction(
+        case_id: str,
+        action: str,
+        expected_version: int,
+        event_valid_until: str | None = None,
+    ) -> dict:
+        """Apply, reject, or roll back a review-gated correction case.
+
+        The active daemon derives reviewer identity and profile from its local
+        authenticated MCP boundary.  Clients provide only a case address, a
+        CAS version, and an optional reviewer-approved event-time boundary.
+        """
+        if action not in {"apply", "reject", "rollback"}:
+            return {"success": False, "error": "action must be apply, reject, or rollback"}
+        if not isinstance(expected_version, int) or isinstance(expected_version, bool):
+            return {"success": False, "error": "expected_version must be an integer"}
+        if expected_version < 0:
+            return {"success": False, "error": "expected_version must be non-negative"}
+        try:
+            import asyncio
+            import urllib.parse
+
+            from superlocalmemory.cli.daemon import daemon_request, is_daemon_running
+
+            if not await asyncio.to_thread(is_daemon_running):
+                return {
+                    "success": False,
+                    "retryable": True,
+                    "error": "correction review requires the resident canonical daemon",
+                }
+            payload: dict[str, object] = {"expected_version": expected_version}
+            if event_valid_until is not None:
+                payload["event_valid_until"] = event_valid_until
+            path = "/api/corrections/" + urllib.parse.quote(case_id, safe="") + "/" + action
+            result = await asyncio.to_thread(daemon_request, "POST", path, payload)
+            if isinstance(result, dict) and result.get("success"):
+                return result
+            return {
+                "success": False,
+                "retryable": True,
+                "error": "resident daemon rejected the correction review",
+            }
+        except Exception:
+            logger.exception("review_correction failed")
+            return {"success": False, "retryable": True, "error": "correction review unavailable"}
+
+    @server.tool(annotations=ToolAnnotations(readOnlyHint=True))
+    async def list_corrections(limit: int = 100) -> dict:
+        """List active-profile correction cases for a human or host reviewer."""
+        if not isinstance(limit, int) or isinstance(limit, bool) or not 1 <= limit <= 500:
+            return {"success": False, "error": "limit must be an integer from 1 to 500"}
+        try:
+            import asyncio
+
+            from superlocalmemory.cli.daemon import daemon_request, is_daemon_running
+
+            if not await asyncio.to_thread(is_daemon_running):
+                return {
+                    "success": False,
+                    "retryable": True,
+                    "error": "correction review requires the resident canonical daemon",
+                }
+            result = await asyncio.to_thread(daemon_request, "GET", f"/api/corrections?limit={limit}")
+            if isinstance(result, dict) and result.get("success"):
+                return result
+            return {
+                "success": False,
+                "retryable": True,
+                "error": "resident daemon rejected correction listing",
+            }
+        except Exception:
+            logger.exception("list_corrections failed")
+            return {"success": False, "retryable": True, "error": "correction listing unavailable"}
+
     @server.tool(annotations=ToolAnnotations(readOnlyHint=True))
     async def get_attribution() -> dict:
         """Get system attribution: author, version, license, and provenance metadata."""

package/src/superlocalmemory/retrieval/engine.py

@@ -29,6 +29,7 @@ from superlocalmemory.core.config import ChannelWeights, RetrievalConfig
 from superlocalmemory.retrieval.fusion import FusionResult, weighted_rrf
 from superlocalmemory.retrieval.strategy import QueryStrategy, QueryStrategyClassifier
 from superlocalmemory.retrieval.temporal_validity_filter import (
+    CorrectionAdmissionCache,
     admit_correction_candidates,
     admit_correction_fusion_results,
 )
@@ -232,6 +233,10 @@ class RetrievalEngine:
             include_unknown=include_unknown,
         )
         _em("run_channels")
+        # One request may need admission before fusion and again after optional
+        # bridge/scene expansion.  Cache only the IDs checked during this one
+        # request; every newly expanded candidate remains a hard DB lookup.
+        correction_admission = CorrectionAdmissionCache()
         if profile_hits:
             ch_results["profile"] = profile_hits
         # The profile shortcut bypasses _run_channels(), so it needs the same
@@ -241,6 +246,7 @@ class RetrievalEngine:
             known_as_of=known_as_of, valid_at=valid_at,
             include_unknown=include_unknown,
             include_global=include_global, include_shared=include_shared,
+            lifecycle_cache=correction_admission,
         )
         total = sum(len(v) for v in ch_results.values())
 
@@ -357,6 +363,7 @@ class RetrievalEngine:
             known_as_of=known_as_of, valid_at=valid_at,
             include_unknown=include_unknown,
             include_global=include_global, include_shared=include_shared,
+            lifecycle_cache=correction_admission,
         )
 
         _em("expand+entity_enh")
@@ -949,16 +956,6 @@ class RetrievalEngine:
                 except Exception as exc:
                     logger.warning("Post-retrieval filter failed: %s", exc)
 
-        # The legacy temporal filter preserves its score-demotion semantics for
-        # compatibility. Admission is separate and hard: no current
-        # system-superseded fact may seed fusion, bridge discovery, or rerank.
-        out = admit_correction_candidates(
-            out, profile_id, self._db, as_of=as_of,
-            known_as_of=known_as_of, valid_at=valid_at,
-            include_unknown=include_unknown,
-            include_global=include_global, include_shared=include_shared,
-        )
-
         return out
 
     def close(self, *, wait: bool = False) -> None:

package/src/superlocalmemory/retrieval/temporal_validity_filter.py

@@ -49,8 +49,12 @@ All demotions are non-destructive (P5-INT-01): facts stay in the candidate
 list but rank below valid facts. A factor of 0.0 restores the legacy hide
 behaviour (a score of zero is gated out by the evidence floor).
 
-Both lookups are bounded (candidate ids only), chunked, indexed, and
-fail-open: a DB error returns results unchanged.
+All correction-admission lookups are bounded (candidate ids only), chunked,
+and indexed.  Admission is deliberately **fail-closed**: if SLM cannot prove
+which candidates are invalidated, it returns no candidates rather than let an
+approved stale fact re-enter recall.  The legacy score-demotion filter follows
+the same rule for its system-invalidated lookup.  Event-time demotion remains a
+best-effort ranking signal; it is not the correction authority.
 
 Integrates with ChannelRegistry.register_filter() using the FilterFn signature:
     (all_channel_results, profile_id, context) -> filtered_results
@@ -62,6 +66,7 @@ License: AGPL-3.0-or-later
 from __future__ import annotations
 
 import logging
+from dataclasses import dataclass, field
 from typing import TYPE_CHECKING, Any
 
 if TYPE_CHECKING:
@@ -79,6 +84,21 @@ logger = logging.getLogger(__name__)
 _EVENT_TIME_DEMOTION_FACTOR: float = 0.5
 
 
+@dataclass
+class CorrectionAdmissionCache:
+    """Per-recall lifecycle admission cache.
+
+    The retrieval engine performs a mandatory second admission after bridge or
+    scene expansion.  Facts already checked before fusion do not need a second
+    database read in the *same* recall, while any newly expanded id is checked
+    immediately.  The cache never crosses requests, profiles, or DB writes.
+    """
+
+    checked_fact_ids: set[str] = field(default_factory=set)
+    inadmissible_fact_ids: set[str] = field(default_factory=set)
+    unavailable: bool = False
+
+
 def _normalized_as_of(as_of: str | None) -> str | None:
     """Normalize an optional transaction-time boundary at one boundary.
 
@@ -100,26 +120,69 @@ def _invalidated_candidate_ids(
     as_of: str | None = None,
     include_global: bool = False,
     include_shared: bool = False,
+    lifecycle_cache: CorrectionAdmissionCache | None = None,
 ) -> set[str] | None:
-    """Return admissibility failures, or ``None`` when the lookup is unhealthy.
+    """Return correction failures, or ``None`` when admission is unprovable.
 
-    ``None`` deliberately preserves the established fail-open availability
-    contract.  It is distinct from an empty set: a bad/mocked return value must
-    not accidentally exclude arbitrary candidates.
+    ``None`` is intentionally distinct from an empty set.  Callers MUST turn
+    it into an abstention (an empty candidate path), never treat it as "nothing
+    invalidated".  Treating an unavailable lifecycle read as an empty set is a
+    fail-open path through which an approved stale fact can be re-admitted.
     """
     if not fact_ids:
         return set()
+    if lifecycle_cache is not None and lifecycle_cache.unavailable:
+        return None
+    unchecked = (
+        fact_ids - lifecycle_cache.checked_fact_ids
+        if lifecycle_cache is not None
+        else fact_ids
+    )
+    if not unchecked:
+        return (
+            lifecycle_cache.inadmissible_fact_ids & fact_ids
+            if lifecycle_cache is not None
+            else set()
+        )
     try:
         kwargs: dict[str, Any] = {"as_of": _normalized_as_of(as_of)}
         if include_global:
             kwargs["include_global"] = True
         if include_shared:
             kwargs["include_shared"] = True
-        invalid = db.get_invalidated_fact_ids(list(fact_ids), profile_id, **kwargs)
+        # Do not infer support from a permissive mock's dynamic attributes.
+        # The concrete storage manager owns this optimized contract; older
+        # adapters continue through the two focused public queries below.
+        combined = getattr(type(db), "get_correction_inadmissible_fact_ids", None)
+        if callable(combined):
+            invalid = db.get_correction_inadmissible_fact_ids(
+                list(unchecked), profile_id, **kwargs,
+            )
+        else:
+            invalid = db.get_invalidated_fact_ids(list(unchecked), profile_id, **kwargs)
+            pending_successors = db.get_nonapplied_correction_successor_ids(
+                list(unchecked),
+                profile_id,
+                include_global=include_global,
+                include_shared=include_shared,
+            )
+            if not isinstance(pending_successors, set):
+                return None
+            invalid |= pending_successors
     except Exception as exc:
         logger.warning("Correction admission lookup failed: %s", exc)
+        if lifecycle_cache is not None:
+            lifecycle_cache.unavailable = True
         return None
-    return invalid if isinstance(invalid, set) else None
+    if not isinstance(invalid, set):
+        if lifecycle_cache is not None:
+            lifecycle_cache.unavailable = True
+        return None
+    if lifecycle_cache is not None:
+        lifecycle_cache.checked_fact_ids.update(unchecked)
+        lifecycle_cache.inadmissible_fact_ids.update(invalid)
+        return lifecycle_cache.inadmissible_fact_ids & fact_ids
+    return invalid
 
 
 def _strict_temporal_candidate_ids(
@@ -133,7 +196,7 @@ def _strict_temporal_candidate_ids(
     include_global: bool = False,
     include_shared: bool = False,
 ) -> set[str] | None:
-    """Return strict two-clock admission failures, fail-open on lookup error."""
+    """Return strict two-clock failures, or ``None`` when admission is unprovable."""
     if not fact_ids or (known_as_of is None and valid_at is None):
         return set()
     try:
@@ -151,6 +214,26 @@ def _strict_temporal_candidate_ids(
     return invalid if isinstance(invalid, set) else None
 
 
+def _abstain_candidates(
+    all_results: dict[str, list[tuple[str, float]]],
+    *,
+    stage: str,
+) -> dict[str, list[tuple[str, float]]]:
+    """Fail closed without changing the retrieval filter public contract.
+
+    ``ChannelRegistry`` and the retrieval engine both expect the original
+    channel-result shape.  Returning the same channel names with empty lists
+    is an explicit candidate-level abstention: downstream fusion naturally
+    produces no materializable facts, while callers keep their stable response
+    schema and can report ``no_confident_match``.
+    """
+    logger.error(
+        "Temporal correction admission unavailable at %s; abstaining from recall candidates",
+        stage,
+    )
+    return {channel_name: [] for channel_name in all_results}
+
+
 def admit_correction_candidates(
     all_results: dict[str, list[tuple[str, float]]],
     profile_id: str,
@@ -162,6 +245,7 @@ def admit_correction_candidates(
     include_unknown: bool = False,
     include_global: bool = False,
     include_shared: bool = False,
+    lifecycle_cache: CorrectionAdmissionCache | None = None,
 ) -> dict[str, list[tuple[str, float]]]:
     """Hard-exclude system-superseded facts before candidate fusion.
 
@@ -178,15 +262,20 @@ def admit_correction_candidates(
     invalid = _invalidated_candidate_ids(
         db, fact_ids, profile_id, as_of=as_of,
         include_global=include_global, include_shared=include_shared,
+        lifecycle_cache=lifecycle_cache,
     )
+    if invalid is None:
+        return _abstain_candidates(all_results, stage="pre_fusion.lifecycle")
     strict = _strict_temporal_candidate_ids(
         db, fact_ids, profile_id,
         known_as_of=known_as_of, valid_at=valid_at,
         include_unknown=include_unknown,
         include_global=include_global, include_shared=include_shared,
     )
+    if strict is None:
+        return _abstain_candidates(all_results, stage="pre_fusion.strict_temporal")
     if strict:
-        invalid = (invalid or set()) | strict
+        invalid |= strict
     if not invalid:
         return all_results
     return {
@@ -210,21 +299,35 @@ def admit_correction_fusion_results(
     include_unknown: bool = False,
     include_global: bool = False,
     include_shared: bool = False,
+    lifecycle_cache: CorrectionAdmissionCache | None = None,
 ) -> list[Any]:
     """Re-apply correction admission after graph/scene candidate expansion."""
     fact_ids = {result.fact_id for result in fused_results}
     invalid = _invalidated_candidate_ids(
         db, fact_ids, profile_id, as_of=as_of,
         include_global=include_global, include_shared=include_shared,
+        lifecycle_cache=lifecycle_cache,
     )
+    if invalid is None:
+        logger.error(
+            "Temporal correction admission unavailable at post_fusion.lifecycle; "
+            "abstaining from recall candidates",
+        )
+        return []
     strict = _strict_temporal_candidate_ids(
         db, fact_ids, profile_id,
         known_as_of=known_as_of, valid_at=valid_at,
         include_unknown=include_unknown,
         include_global=include_global, include_shared=include_shared,
     )
+    if strict is None:
+        logger.error(
+            "Temporal correction admission unavailable at post_fusion.strict_temporal; "
+            "abstaining from recall candidates",
+        )
+        return []
     if strict:
-        invalid = (invalid or set()) | strict
+        invalid |= strict
     if not invalid:
         return fused_results
     return [result for result in fused_results if result.fact_id not in invalid]
@@ -311,14 +414,11 @@ class TemporalValidityFilter:
         # When as_of is set: only supersessions that occurred AT OR BEFORE
         # as_of contribute (Phase 4b bi-temporal fix). Supersessions after
         # as_of are invisible — the fact was still valid at the query point.
-        try:
-            invalid = self._db.get_invalidated_fact_ids(
-                list(all_fact_ids), profile_id, as_of=as_of,
-            )
-        except Exception as exc:
-            # Fail-open: a validity-lookup error must never break retrieval.
-            logger.warning("Temporal validity lookup failed: %s", exc)
-            return all_results
+        invalid = _invalidated_candidate_ids(
+            self._db, all_fact_ids, profile_id, as_of=as_of,
+        )
+        if invalid is None:
+            return _abstain_candidates(all_results, stage="legacy_filter.lifecycle")
 
         # --- Axis 2: Event-time expiry (Phase 4 T1b) ---
         # Guard: skip event-time demotion when the caller signals it wants

package/src/superlocalmemory/server/routes/brain.py

@@ -52,6 +52,7 @@ from typing import Any
 
 from fastapi import APIRouter, Depends, HTTPException, Request
 from superlocalmemory import __version__
+from superlocalmemory.brain import BrainTruthService
 
 from superlocalmemory.core.security_primitives import (
     redact_secrets,
@@ -1130,11 +1131,16 @@ async def get_brain(request: Request, profile_id: str | None = None) -> dict:
     # "default" — the Brain must reflect whichever profile is active.
     profile_id = _authorized_profile(request, profile_id)
     lrn_db = LearningDatabase(_learning_db_path())
+    truth_service = BrainTruthService(
+        memory_db_path=_memory_dir() / "memory.db",
+        learning_db_path=_learning_db_path(),
+    )
 
     (
         preferences, learning, usage, bandit_snap, cache,
         cross_platform, outcomes_preview, evolution, active_clients,
         feedback_loop, source_quality, graph_summary, agent_experience,
+        brain_truth,
     ) = await asyncio.gather(
         asyncio.to_thread(_compute_preferences, profile_id),
         asyncio.to_thread(_compute_learning_status, profile_id, lrn_db),
@@ -1152,6 +1158,7 @@ async def get_brain(request: Request, profile_id: str | None = None) -> dict:
         asyncio.to_thread(_compute_source_quality, profile_id),
         asyncio.to_thread(_compute_graph_summary, profile_id),
         asyncio.to_thread(_compute_agent_experience, profile_id),
+        asyncio.to_thread(truth_service.snapshot, profile_id),
         return_exceptions=True,
     )
 
@@ -1213,6 +1220,14 @@ async def get_brain(request: Request, profile_id: str | None = None) -> dict:
             "source_quality": source_quality,
             "graph": graph_summary,
             "agent_experience": agent_experience,
+            # Additive v4.0.5 contract.  Keep the preceding legacy keys for
+            # existing dashboard/API clients; new clients should render this
+            # one shared, unavailable-aware snapshot.
+            "brain_truth": _ok(brain_truth, {
+                "availability": "unavailable",
+                "source": "BrainTruth service unavailable",
+                "control_plane": "observation_only",
+            }),
             "source": "local durable stores + ephemeral session registry",
         },
         "evolution_preview": _ok(evolution, {

package/src/superlocalmemory/server/routes/memories.py

@@ -1182,9 +1182,9 @@ async def merge_memory(request: Request, fact_id: str):
         raise _canonical_mutation_error(exc, "Merge error")
 
 
-@router.patch("/api/memories/{fact_id}")
+@router.patch("/api/memories/{fact_id}", status_code=202)
 async def edit_memory(request: Request, fact_id: str):
-    """Edit the content of a specific memory (atomic fact)."""
+    """Propose an immutable, review-required correction for one memory."""
     try:
         body = await request.json()
         new_content = (body.get("content") or "").strip()
@@ -1210,13 +1210,139 @@ async def edit_memory(request: Request, fact_id: str):
         )
         if not result.get("ok"):
             raise HTTPException(status_code=404, detail="Memory not found")
-        return {"success": True, "fact_id": fact_id, "content": new_content}
+        if result.get("unchanged"):
+            return {"success": True, "fact_id": fact_id, "content": new_content, "unchanged": True}
+        correction = result["correction_case"]
+        return {
+            "success": True,
+            "fact_id": fact_id,
+            "predecessor_fact_id": result["predecessor_fact_id"],
+            "successor_fact_id": result["successor_fact_id"],
+            "correction_case": correction,
+            "review_required": True,
+            "status": "proposed",
+        }
     except HTTPException:
         raise
     except Exception as exc:
         raise _canonical_mutation_error(exc, "Edit error")
 
 
+@router.post("/api/corrections/{case_id}/{action}")
+async def review_correction(request: Request, case_id: str, action: str):
+    """Apply, reject, or roll back an active-profile correction case.
+
+    The caller authenticates through the daemon boundary.  It cannot select a
+    profile, fact scope, or trust tier; the canonical writer rechecks all of
+    those fields in its one SQLite transaction.
+    """
+    try:
+        body = await request.json()
+        if action not in {"apply", "reject", "rollback"}:
+            raise HTTPException(422, detail="action must be apply, reject, or rollback")
+        expected_version = body.get("expected_version") if isinstance(body, dict) else None
+        if not isinstance(expected_version, int) or isinstance(expected_version, bool):
+            raise HTTPException(422, detail="expected_version must be a non-negative integer")
+        if expected_version < 0:
+            raise HTTPException(422, detail="expected_version must be a non-negative integer")
+        event_valid_until = body.get("event_valid_until") if isinstance(body, dict) else None
+        if event_valid_until is not None and not isinstance(event_valid_until, str):
+            raise HTTPException(422, detail="event_valid_until must be an RFC3339 timestamp")
+        if event_valid_until is not None and action != "apply":
+            raise HTTPException(422, detail="event_valid_until is permitted only for apply")
+        engine, active_profile, hook_context = _authorize_memory_mutation(
+            request, "update", case_id, run_pre_hook=False
+        )
+        result = _canonical_mutation_runtime(request).transition_correction(
+            active_profile,
+            case_id,
+            action=action,
+            expected_version=expected_version,
+            actor_id=hook_context["agent_id"],
+            event_valid_until=event_valid_until,
+            idempotency_key=_mutation_idempotency_key(request),
+        )
+        if not result.get("ok"):
+            raise HTTPException(404, detail="Correction case not found")
+        if action in {"apply", "rollback"}:
+            from superlocalmemory.core.mutations import purge_profile_context_cache
+
+            purge_profile_context_cache(engine, active_profile)
+        engine._hooks.run_post("update", hook_context)
+        return {"success": True, "correction_case": result}
+    except HTTPException:
+        raise
+    except Exception as exc:
+        raise _canonical_mutation_error(exc, "Correction review error")
+
+
+def _correction_case_response(case) -> dict[str, object]:
+    """Return review metadata only; correction ledgers never contain fact text."""
+    return {
+        "case_id": case.case_id,
+        "profile_id": case.profile_id,
+        "scope": case.scope,
+        "predecessor_fact_id": case.predecessor_fact_id,
+        "successor_fact_id": case.successor_fact_id,
+        "reason_code": case.reason_code,
+        "status": case.status,
+        "version": case.version,
+        "created_at": case.created_at,
+        "updated_at": case.updated_at,
+        "reviewed_at": case.reviewed_at,
+        "applied_at": case.applied_at,
+        "system_effective_at": case.system_effective_at,
+        "event_valid_from": case.event_valid_from,
+        "event_valid_until": case.event_valid_until,
+    }
+
+
+def _correction_store_for(engine, active_profile: str):
+    from superlocalmemory.storage.correction_cases import CorrectionCaseStore
+
+    return CorrectionCaseStore(
+        engine._db.db_path,
+        is_profile_active=lambda candidate: candidate == active_profile,
+        # Read operations never invoke this callback; writes use the daemon's
+        # canonical runtime, which derives the authenticated actor separately.
+        is_actor_trusted=lambda _actor: False,
+    )
+
+
+@router.get("/api/corrections")
+async def list_corrections(request: Request, limit: int = 100):
+    """List bounded review metadata for the active owning profile."""
+    try:
+        engine, active_profile, _context = _authorize_memory_mutation(
+            request, "update", "correction-list", run_pre_hook=False
+        )
+        cases = _correction_store_for(engine, active_profile).list_cases(active_profile, limit=limit)
+        return {"success": True, "corrections": [_correction_case_response(case) for case in cases]}
+    except HTTPException:
+        raise
+    except Exception as exc:
+        raise _canonical_mutation_error(exc, "Correction list error")
+
+
+@router.get("/api/corrections/{case_id}")
+async def get_correction(request: Request, case_id: str):
+    """Get one active-profile correction case without exposing raw memory text."""
+    try:
+        engine, active_profile, _context = _authorize_memory_mutation(
+            request, "update", case_id, run_pre_hook=False
+        )
+        case = _correction_store_for(engine, active_profile).get_case(case_id)
+        return {"success": True, "correction": _correction_case_response(case)}
+    except HTTPException:
+        raise
+    except Exception as exc:
+        from superlocalmemory.storage.correction_cases import CorrectionNotFoundError
+
+        if isinstance(exc, CorrectionNotFoundError):
+            raise HTTPException(404, detail="Correction case not found") from exc
+        raise _canonical_mutation_error(exc, "Correction lookup error")
+
+
 _VALID_SCOPES = ("personal", "shared", "global")
 
 

package/src/superlocalmemory/storage/_migration_internals.py

@@ -150,6 +150,9 @@ from superlocalmemory.storage.migrations import (
 from superlocalmemory.storage.migrations import (
     M041_external_evidence_receipts as _M041,
 )
+from superlocalmemory.storage.migrations import (
+    M042_correction_case_ledger as _M042,
+)
 
 # Emit under the runner's logger name so operational log filters that key on
 # "superlocalmemory.storage.migration_runner" keep matching after this split.
@@ -199,6 +202,7 @@ _MODULES = {
     _M039.NAME: _M039,
     _M040.NAME: _M040,
     _M041.NAME: _M041,
+    _M042.NAME: _M042,
 }
 
 # Exact historical DDL fingerprints whose resulting schema is intentionally

package/src/superlocalmemory/storage/_schema_version.py

@@ -21,9 +21,9 @@ import sqlite3
 from pathlib import Path
 
 #: Highest schema_version this runner can write.  Matches the trailing serial
-#: of the latest migration (M041).  Increment when adding new migrations or
+#: of the latest migration (M042).  Increment when adding new migrations or
 #: table-level breaking changes.
-SUPPORTED_SCHEMA_VERSION: int = 41
+SUPPORTED_SCHEMA_VERSION: int = 42
 
 
 class SchemaVersionError(RuntimeError):