superlocalmemory 4.1.0 → 4.1.2

package/.claude-plugin/marketplace.json

@@ -10,8 +10,18 @@
         "name": "Qualixar"
       },
       "description": "Local-first agent memory + reversible context compression and KV cache, as an MCP server. 34-tool code profile with graph intelligence.",
+      "homepage": "https://github.com/qualixar/superlocalmemory",
+      "keywords": [
+        "memory",
+        "mcp",
+        "agents",
+        "local-first",
+        "context-compression"
+      ],
+      "license": "AGPL-3.0-or-later",
       "name": "superlocalmemory",
-      "source": "./plugin"
+      "source": "./plugin",
+      "version": "4.1.2"
     }
   ]
 }

package/CHANGELOG.md

@@ -5,6 +5,80 @@ All notable changes to SuperLocalMemory will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [4.1.2] — The monitor that was watching nothing
+
+### Fixed
+- **A killed embedding worker was never brought back, and nothing said so.** The
+  worker is stopped on an idle timeout roughly every hour, by design, and a
+  background monitor exists to revive it. That monitor decided whether anything
+  was wrong by looking at a probe search: results with no meaning-score meant a
+  broken embedder. But it explicitly did not count *no results at all* — and no
+  results is what a dead embedder produces, because the meaning channel returns
+  nothing and the probe phrase appears in nobody's memories. So the one symptom
+  that should have started a repair was read as proof that none was needed, and
+  because a clean verdict is silent, it left no trace. Observed on a machine that
+  sat for over an hour, across two restarts, with searching by meaning switched
+  off, no explanation in the log, and a manual restart the only cure. The monitor
+  now asks the embedder directly, which is a question a search cannot answer.
+- **There was no way to tell a quiet monitor from a dead one.** A check that
+  finds nothing wrong writes nothing, which is right — a monitor that narrates
+  every success is one whose warnings get skimmed past. But it left "is it even
+  running?" unanswerable except by waiting for something to break. The time of
+  the last check is now reported, so it can be looked at instead of inferred.
+- **A failing repair would not say what it was failing.** When a completed
+  upgrade step stops holding, the report named the step and not the condition —
+  and that step checks five separate things. Anyone who hit it had to come back
+  and ask which. It now says which.
+- **One drifted row could make the whole store unreachable.** Any failed upgrade
+  step made every request return "service unavailable". That is right when a
+  table is missing. It is wrong for the checks that guard *data* rather than
+  structure — ordinary use can undo those, a single background pass being
+  enough — and it left people restarting a daemon to fix something a restart
+  could not fix. Structural failures still refuse; a data check that drifted now
+  reports itself and keeps serving while it is repaired. Anything that does not
+  say which kind it is still refuses, so nothing became more permissive by
+  accident.
+
+### Changed
+- **The plugin now installs and lists everywhere it should.** It is the main way
+  to get SLM, and it was only half-delivered:
+  - **Codex could not see it at all.** Codex reads `.codex-plugin/plugin.json` to
+    register a plugin and that file did not exist, so twelve skills, the hooks,
+    the launcher and the server config were all installed and none of it appeared
+    under Plugins. There was nothing to enable.
+  - **Codex was also missing two thirds of the product.** It shipped skills and
+    neither the four sub-agents nor the slash command. Both come from the same
+    single source as the Claude Code copies now, so they cannot drift.
+  - **Antigravity had no plugin at all.** It has one now, with the same skills,
+    agents, commands and hooks as every other surface.
+  - **VS Code was missing the slash command.**
+  - **Every release looked like no release.** The marketplace entry carried no
+    version, so a client had nothing to compare and an installed plugin never
+    appeared out of date. This reverses a rule of our own making; the version is
+    now stated, and one script owns every place that states it.
+- **`slm doctor` now says whether your skills are as new as your install.** The
+  skills, agents and commands are delivered by your editor, not by `pip`, so
+  upgrading the package leaves them untouched — and nothing had ever mentioned
+  that. This release changed 76 files across them. Doctor now reports the plugin
+  version beside the package version and names the command that updates it.
+
+## [4.1.1] — A store older than its own indexes
+
+### Fixed
+- **A store from an early version could not be opened at all, and there was no
+  way out of it.** Starting up creates the indexes, one of which is on a column
+  that arrives with a migration scheduled to run *after* the engine is up. On a
+  store old enough to predate that column, the index could not be created, so
+  startup failed — and the migration that would have added the column could not
+  run, because it runs after a startup that never finished. `slm db migrate` did
+  not help either: it reports nothing failed and skips that class of migration by
+  design. Any store in that state was stuck on the version it was already on.
+  The column is now added before the index that needs it, so those stores open
+  and finish upgrading on their own. Measured on a real 637 MB store: it went
+  from refusing to start to a complete upgrade in 19 seconds, with all 7,707
+  memories, 2,590 records and 848,945 connections unchanged and the integrity
+  check clean.
+
 ## [4.1.0] — Every door asks the same question
 
 ### Fixed

package/README.md

@@ -5,7 +5,7 @@
   </picture>
 </p>
 
-<h1 align="center">SuperLocalMemory V4.1.0</h1>
+<h1 align="center">SuperLocalMemory V4.1.2</h1>
 
 <h2 align="center">Rent the LLM. Own the memory.</h2>
 
@@ -27,12 +27,12 @@ guarantee here is stated as a falsifiable invariant, tested under an adversarial
 negative control, and shipped with the harness that regenerates the evidence:
 <code>python benchmark/run_all.py --trials 200 --output-dir results/</code>. What each experiment
 does <em>not</em> exercise is stated too.</p>
-<p align="center"><code>v4.1.0</code> — one control plane: <strong>SLM-Mesh</strong> peer coordination · multi-scope memory (personal / shared / global) · profiles · Cache · Compress · 7-layer retrieval · code graph · Entity Explorer · skill evolution · Modes A/B/C · GDPR retention &amp; audit chain · bounded loops — across CLI, MCP, dashboard, the <strong>Claude plugin</strong>, the <strong>Codex add-on</strong>, and documented IDE integrations.<br/>
+<p align="center"><code>v4.1.2</code> — one control plane: <strong>SLM-Mesh</strong> peer coordination · multi-scope memory (personal / shared / global) · profiles · Cache · Compress · 7-layer retrieval · code graph · Entity Explorer · skill evolution · Modes A/B/C · GDPR retention &amp; audit chain · bounded loops — across CLI, MCP, dashboard, the <strong>Claude plugin</strong>, the <strong>Codex add-on</strong>, and documented IDE integrations.<br/>
 Proxy: <code>slm wrap claude</code> &nbsp;·&nbsp; MCP: add <code>slm_compress</code> to your config &nbsp;·&nbsp; Skill: zero-config</p>
 <p align="center"><strong>Four public arXiv preprints</strong> · V4: <a href="https://arxiv.org/abs/2608.08253">arXiv:2608.08253</a> · companion archive: <a href="https://zenodo.org/records/21853302">Zenodo 21853302</a> (<a href="https://doi.org/10.5281/zenodo.21853302">DOI 10.5281/zenodo.21853302</a>) · prior preprints: <a href="https://arxiv.org/abs/2603.02240">2603.02240</a> · <a href="https://arxiv.org/abs/2603.14588">2603.14588</a> · <a href="https://arxiv.org/abs/2604.04514">2604.04514</a>.</p>
 
 <p align="center">
-  <a href="CHANGELOG.md"><img src="https://img.shields.io/badge/v4.1.0-Current_Release-2ea44f?style=for-the-badge&logo=checkmarx&logoColor=white" alt="v4.1.0 — Current Release"/></a>
+  <a href="CHANGELOG.md"><img src="https://img.shields.io/badge/v4.1.2-Current_Release-2ea44f?style=for-the-badge&logo=checkmarx&logoColor=white" alt="v4.1.2 — Current Release"/></a>
   <a href="https://arxiv.org/abs/2608.08253"><img src="https://img.shields.io/badge/arXiv-2608.08253-b31b1b?style=for-the-badge&logo=arxiv&logoColor=white" alt="SuperLocalMemory 4.0 paper on arXiv:2608.08253"/></a>
   <a href="https://zenodo.org/records/21853302"><img src="https://img.shields.io/badge/Zenodo-10.5281%2Fzenodo.21853302-1682D4?style=for-the-badge&logo=zenodo&logoColor=white" alt="V4 paper on Zenodo: 10.5281/zenodo.21853302"/></a>
   <a href="https://arxiv.org/abs/2603.14588"><img src="https://img.shields.io/badge/arXiv-2603.14588-b31b1b?style=for-the-badge&logo=arxiv&logoColor=white" alt="arXiv Paper"/></a>
@@ -62,11 +62,7 @@ SuperLocalMemory V4 combines conventional dense and lexical retrieval with graph
 
 **Memory with a sense of time.** SLM does not only store *what* an agent learned — it records *when*. Every fact carries ingestion timing and provenance; recall runs a dedicated temporal candidate channel alongside semantic, lexical, and associative retrieval; scenes and entity timelines reconstruct sequence; and the lifecycle lets neglected memory decay and self-archive instead of growing without bound. Time is a first-class ranking and lifecycle signal rather than a timestamp column an agent never reads — which is what lets a long-lived agent reason about how its context changed, not only what it currently holds.
 
-**What V4.0.7 ships.** Three things that existed but could not be used. `slm summary` gives you a readable layer over your own memories — `day` for what you recorded today, `project` for a directory, `session` for one session — each stating how much of the underlying data it could actually see, with `--json` listing the exact memories it came from. Memories that mention a function, method or file are now linked to that code, with a short description of what they point at and a marker once the code has changed; expanding a memory in the dashboard shows it. Both need no language model, so they work in the fully local mode. The code↔memory bridge behind the second one had never run at all: the setup flag was written and never read, the build discarded it, its settings had no loader, and the method it was written against was an unimplemented placeholder. Linking runs during background maintenance, never when a memory is saved. See [reviewed corrections](docs/reviewed-corrections.md) for the correction lifecycle and [MCP tools](docs/mcp-tools.md) for host-facing commands.
-
-**Fixed in V4.0.7.** Version numbers disagreed across the project — the pip requirement pins, npm lockfile, editor plugin manifest, citation metadata and lockfile all still named the previous release, so installing from `requirements.txt` fetched the wrong version; one script now sets all fifteen. Stale-memory checks reported "nothing is stale" when code linking was simply switched off, and pointed at a setting that did not exist. `slm gdpr` was missing from `slm help`. Consolidation, handed something that was neither a database handle nor a path, created a file named after the object instead of refusing it.
-
-**Carried forward from V4.0.5 and V4.0.6.** A correction is a review-gated lifecycle, not an in-place edit: SLM creates an immutable successor, keeps it out of current recall until an authenticated reviewer applies it, and preserves the predecessor for time-aware history. Every candidate path — cached context, pins, bridge and scene expansion — uses hard current-truth admission and abstains if that truth cannot be read. `slm brain`, MCP, HTTP and the Living Brain share one observation-only BrainTruth snapshot; feedback, external Bounded Loops evidence and receipt claims are shown honestly but never silently alter recall, ranking or model routing. The Living Brain leads with how many questions your memory has answered rather than a raw event count, and says so plainly where nothing has been measured yet. The knowledge graph opens reliably, with a default of 50 nodes and its details panel reachable on narrow screens. The optional adaptive ranker stays off unless an operator sets `SLM_RANKING` (`v1`, `v2`, or `v2-ensemble`) — that gate prevents feedback and observation data from changing ranking without an explicit decision, and does not disable the normal retrieval channels.
+**What changed in this release.** See the [CHANGELOG](CHANGELOG.md) — every release is written up there, in plain language, newest first.
 
 - **[SLM-Mesh](#slm-mesh-cross-session--cross-machine-coordination)** — authenticated cross-session and cross-machine peer coordination (messages, locks, shared state, inbox/outbox, optional discovery). Coordination only — not automatic replicated memory.
 - **Multi-scope memory & profiles** — workspaces (profiles) plus `personal` / `shared` / `global` scopes; cross-profile recall is default-deny.
@@ -300,7 +296,7 @@ retrieved at runtime rather than copied into those files.
 **Score Contract v2:** `relevance_score` is query-relative relevance;
 `ranking_score` is internal ranking utility; `memory_confidence` belongs to the
 stored assertion; and `trust_score` is an evidence-policy signal. Legacy
-`score` and `confidence` remain aliases for one compatibility release. V3.8.0 is
+`score` and `confidence` remain aliases for one compatibility release. It is
 explicitly uncalibrated: `calibration_status` is `uncalibrated` and
 `answer_confidence` is `null`. See
 [the retrieval score contract](docs/retrieval-score-contract.md).
@@ -314,9 +310,9 @@ can run without a cloud LLM:
 
 Auto-capture hooks are installed explicitly with `slm hooks install` (Claude
 Code) or `slm hooks install --agent codex` (Codex). Hook latency and capture
-quality must be evaluated for the target client and workload; V3.8.0 publishes no universal p99 claim.
+quality must be evaluated for the target client and workload; SLM publishes no universal p99 claim.
 
-**Multi-scope memory (v3.6.15, opt-in):** keep memories `personal` (default), `shared` with named profiles, or `global` across the machine. Off by default — recall only ever returns your own facts until you turn sharing on, per call or in config. See **[docs/shared-memory.md](docs/shared-memory.md)**.
+**Multi-scope memory (opt-in):** keep memories `personal` (default), `shared` with named profiles, or `global` across the machine. Off by default — recall only ever returns your own facts until you turn sharing on, per call or in config. See **[docs/shared-memory.md](docs/shared-memory.md)**.
 
 <a id="multilingual-embedding-support"></a>
 
@@ -422,7 +418,7 @@ and the Claude Code plugin update path.
 
 SLM supports two MCP transports:
 
-**HTTP (recommended, v3.6.7+):**
+**HTTP (recommended):**
 ```json
 { "mcpServers": { "superlocalmemory": { "type": "http", "url": "http://127.0.0.1:8765/mcp/" } } }
 ```
@@ -461,77 +457,46 @@ Per-IDE configs available for Claude Code, Cursor, Windsurf, VS Code Copilot, Co
 
 ---
 
-## Claude Code Plugin
+## Editor plugins
 
-Install directly in Claude Code — no system-level npm/pip needed. This is how you
-get the **skills, agents, hooks, commands, and rules** (the MCP server is
-bootstrapped automatically). It is a two-step flow — add the marketplace once,
-then install:
+The plugin is how most people should install SLM. It brings the MCP server, the
+skills, the sub-agents, the slash commands and the hooks in one step, and keeps
+them at the same version as the package.
 
-```bash
-# 1. Add the Qualixar marketplace (one-time — the repo IS the marketplace)
-/plugin marketplace add qualixar/superlocalmemory
-
-# 2. Install the plugin
-/plugin install superlocalmemory@qualixar
-```
+**Four surfaces, one source.** Everything below is generated from `plugin-src/`,
+so no surface can quietly fall behind another:
 
-- Self-bootstraps a Python venv, installs all deps in an isolated `SLM_DATA_DIR`
-- Registers the 34-tool `code` MCP surface — the 18-tool `core` memory surface plus code-graph, portable-evidence, bounded-loop and usefulness-report tools
-- Ships the SLM skills / agents / hooks / commands / rules
-- Additive — does not replace an existing SLM install
-- `slm connect claude-code` detects an existing plugin install and links them
+| Editor | Install | Skills | Agents | Commands | Hooks |
+|---|---|---:|---:|---:|---:|
+| **Claude Code** | `claude plugin marketplace add qualixar/superlocalmemory` then `claude plugin install superlocalmemory@qualixar` | 12 | 4 | 1 | yes |
+| **Codex** | copy `codex-plugin/` into your Codex plugins directory | 12 | 4 | 1 | yes |
+| **VS Code / Copilot** | copy `copilot-plugin/.github/` into your repository | 12 | 4 | as prompts | yes |
+| **Antigravity** | copy `antigravity-plugin/` into your plugins directory | 12 | 4 | 1 | yes |
 
-> **Plugin vs Python/npm:** `python -m pip install superlocalmemory` inside an
-> activated virtual environment, or `npm i -g superlocalmemory`,
-> give you the `slm` CLI + the MCP server (the *tools*). The **skills/agents/hooks/
-> commands** come only through the plugin above. Use the plugin for Claude Code; use
-> pip/npm for the CLI or other IDEs.
+### What you get
 
-To update later: `/plugin marketplace update qualixar` then `/plugin install superlocalmemory@qualixar`.
+- **Skills** — `slm-remember`, `slm-recall`, `slm-session`, `slm-graph`,
+  `slm-mesh`, `slm-scope`, `slm-profile`, `slm-governance`, `slm-cache`,
+  `slm-compress`, `slm-status`, `slm-loop`.
+- **Sub-agents** — a memory advisor, a governance advisor, a context-optimization
+  advisor, and a loop runner, each scoped to the tools it actually needs.
+- **Commands** — `/slm-loop`, to run a task as a gate-verified bounded loop.
+- **Hooks** — session start and end, so context loads and commits without being
+  asked.
 
-## Codex add-on
-
-For Codex, install the SLM-owned skills, two focused subagents, and four
-lifecycle hooks explicitly:
-
-```bash
-slm codex install
-```
+### Keeping it current
 
-This adds only SLM-owned files under `~/.agents/skills`, `~/.codex/agents`, and
-`~/.codex/hooks.json`; it does not replace another agent's hooks or rewrite
-`~/.codex/config.toml`. Codex requires review and trust for new command hooks:
-open `/hooks` after installation. MCP wiring remains a separate explicit step:
+`pipx upgrade superlocalmemory` upgrades the **package**. It does not
+upgrade the plugin — those are separate channels, and the plugin is delivered by
+your editor. `slm doctor` reports both versions side by side and names the
+command that updates the one that is behind.
 
 ```bash
-slm connect codex
+claude plugin marketplace update qualixar
+claude plugin update superlocalmemory@qualixar
 ```
 
-`slm connect codex` semantically merges the `superlocalmemory` MCP server into
-`~/.codex/config.toml`, preserving unrelated configuration keys and writing
-atomically. TOML serializers can normalize whitespace and comments, so it is
-not a byte-preserving operation; use it only when you want the MCP server
-configured. Check the result with `slm codex status`; undo SLM-owned add-ons
-with `slm codex remove`.
-
-## GitHub Copilot integration
-
-The shipped installer configures the SuperLocalMemory MCP server and additive
-agent instructions for VS Code with GitHub Copilot:
-
-```bash
-slm connect vscode-copilot --here
-```
-
-Run it from the project root. It semantically merges the SLM server into
-`.vscode/mcp.json` and adds SLM-owned guidance inside
-`.github/copilot-instructions.md`, preserving unrelated servers and existing
-instructions. The generated `copilot-plugin/` source bundle is maintained for
-parity checks, but v3.8.1 does not claim that `slm connect` installs its prompt,
-agent, or hook files.
-
----
+For the other three, replace the directory from the tag you are on.
 
 ## Privacy controls and operating modes
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "superlocalmemory",
-  "version": "4.1.0",
+  "version": "4.1.2",
   "description": "Local-first agent memory with MCP and an agent-native CLI. Documented clients include Claude Code, Cursor, and Windsurf.",
   "keywords": [
     "ai-memory",
@@ -52,10 +52,11 @@
     "check:copilot-plugin": "node scripts/build-copilot-plugin.mjs --check",
     "build:codex-plugin": "node scripts/build-codex-plugin.mjs",
     "check:codex-plugin": "node scripts/build-codex-plugin.mjs --check",
-    "prepack": "node scripts/build-plugin.mjs && node scripts/build-copilot-plugin.mjs && node scripts/build-codex-plugin.mjs && node scripts/prepack.js",
+    "prepack": "node scripts/build-plugin.mjs && node scripts/build-copilot-plugin.mjs && node scripts/build-codex-plugin.mjs && node scripts/build-antigravity-plugin.mjs && node scripts/prepack.js",
     "postinstall": "node scripts/postinstall.js",
     "preuninstall": "node scripts/preuninstall.js",
-    "test": "node scripts/run-ui-tests.mjs"
+    "test": "node scripts/run-ui-tests.mjs",
+    "build:antigravity-plugin": "node scripts/build-antigravity-plugin.mjs"
   },
   "engines": {
     "node": ">=18.0.0",

package/plugin/.claude-plugin/plugin.json

@@ -15,5 +15,5 @@
   "mcpServers": "./.mcp.json",
   "name": "superlocalmemory",
   "repository": "https://github.com/qualixar/superlocalmemory",
-  "version": "4.1.0"
+  "version": "4.1.2"
 }

package/plugin/CLAUDE.md

@@ -1,4 +1,4 @@
-<!-- BEGIN SuperLocalMemory v4.1.0 -->
+<!-- BEGIN SuperLocalMemory v4.1.2 -->
 
 ## SuperLocalMemory (SLM) — Agent Rules
 
@@ -39,6 +39,6 @@ slm-recall · slm-remember · slm-session · slm-status · slm-cache · slm-comp
 ### Subagents
 slm-memory-advisor (memory decisions, session hygiene, scope/profile guidance) · slm-optimize-advisor (context compression + KV cache) · slm-governance-advisor (scope/roles/compliance/GDPR)
 
-<!-- END SuperLocalMemory v4.1.0 -->
+<!-- END SuperLocalMemory v4.1.2 -->
 
-SuperLocalMemory v4.1.0 · Qualixar · AGPL-3.0-or-later
+SuperLocalMemory v4.1.2 · Qualixar · AGPL-3.0-or-later

package/plugin/agents/slm-governance-advisor.md

@@ -77,4 +77,4 @@ slm-scope · slm-governance · slm-profile · slm-remember · slm-recall
 # What NOT to do
 Never session_init twice; never forget without dry-run preview; never store secrets; never bypass role checks; never claim an erasure succeeded without verifying via recall.
 
-SuperLocalMemory v4.1.0 · Qualixar · AGPL-3.0-or-later
+SuperLocalMemory v4.1.2 · Qualixar · AGPL-3.0-or-later

package/plugin/agents/slm-loop-runner.md

@@ -68,4 +68,4 @@ assessment. The gate is the authority.
 
 ---
 
-SuperLocalMemory v4.1.0 · Qualixar · AGPL-3.0-or-later
+SuperLocalMemory v4.1.2 · Qualixar · AGPL-3.0-or-later

package/plugin/agents/slm-memory-advisor.md

@@ -46,4 +46,4 @@ slm-recall · slm-remember · slm-session · slm-scope · slm-profile · slm-gov
 # What NOT to do
 Never session_init twice; never forget dry_run=False without reporting preview; never dump a whole file into remember; never invent a memory; never claim "saved" without success:true / clean CLI exit; never bypass scope or governance restrictions.
 
-SuperLocalMemory v4.1.0 · Qualixar · AGPL-3.0-or-later
+SuperLocalMemory v4.1.2 · Qualixar · AGPL-3.0-or-later

package/plugin/agents/slm-optimize-advisor.md

@@ -41,4 +41,4 @@ slm-compress · slm-cache · slm-status · slm-profile
 # What NOT to do
 Never compress code-for-edit/JSON-to-parse/<500 chars; never store secrets/ccr_ids; never let optimize failure block/alter the task; never claim a specific savings %; never carry ccr_ids across profile switches.
 
-SuperLocalMemory v4.1.0 · Qualixar · AGPL-3.0-or-later
+SuperLocalMemory v4.1.2 · Qualixar · AGPL-3.0-or-later

package/plugin/requirements.txt

@@ -1 +1 @@
-superlocalmemory==4.1.0
+superlocalmemory==4.1.2

package/plugin/skills/slm-cache/SKILL.md

@@ -145,4 +145,4 @@ These subcommands control daemon-level cache settings. They do not read or write
 
 ---
 
-SuperLocalMemory v4.1.0 · Qualixar · AGPL-3.0-or-later
+SuperLocalMemory v4.1.2 · Qualixar · AGPL-3.0-or-later

package/plugin/skills/slm-compress/SKILL.md

@@ -147,4 +147,4 @@ Content over 1 MB (1 000 000 bytes UTF-8) is processed but `reversible` is force
 
 ---
 
-SuperLocalMemory v4.1.0 · Qualixar · AGPL-3.0-or-later
+SuperLocalMemory v4.1.2 · Qualixar · AGPL-3.0-or-later

package/plugin/skills/slm-governance/SKILL.md

@@ -245,4 +245,4 @@ Before running any destructive operation (`forget`, `compact_memories`):
 
 ---
 
-*SuperLocalMemory v4.1.0 · Qualixar · AGPL-3.0-or-later*
+*SuperLocalMemory v4.1.2 · Qualixar · AGPL-3.0-or-later*

package/plugin/skills/slm-graph/SKILL.md

@@ -312,4 +312,4 @@ profile. See `slm-profile` for the full profile switching workflow.
 
 ---
 
-SuperLocalMemory v4.1.0 · Qualixar · AGPL-3.0-or-later
+SuperLocalMemory v4.1.2 · Qualixar · AGPL-3.0-or-later

package/plugin/skills/slm-loop/SKILL.md

@@ -96,4 +96,4 @@ paused, name the approval needed; when errored, quote the short detail.
 
 ---
 
-SuperLocalMemory v4.1.0 · Qualixar · AGPL-3.0-or-later
+SuperLocalMemory v4.1.2 · Qualixar · AGPL-3.0-or-later

package/plugin/skills/slm-mesh/SKILL.md

@@ -279,4 +279,4 @@ mesh availability.
 
 ---
 
-*SuperLocalMemory v4.1.0 · Qualixar · AGPL-3.0-or-later*
+*SuperLocalMemory v4.1.2 · Qualixar · AGPL-3.0-or-later*

package/plugin/skills/slm-profile/SKILL.md

@@ -146,4 +146,4 @@ Name them differently in your MCP config (e.g. `superlocalmemory-personal` and
 
 ---
 
-*SuperLocalMemory v4.1.0 · Qualixar · AGPL-3.0-or-later*
+*SuperLocalMemory v4.1.2 · Qualixar · AGPL-3.0-or-later*

package/plugin/skills/slm-recall/SKILL.md

@@ -323,4 +323,4 @@ before recalling, then switch back. See `slm-profile` for workspace switching.
 
 ---
 
-*SuperLocalMemory v4.1.0 · Qualixar · AGPL-3.0-or-later*
+*SuperLocalMemory v4.1.2 · Qualixar · AGPL-3.0-or-later*

package/plugin/skills/slm-remember/SKILL.md

@@ -270,4 +270,4 @@ different workspace, use `switch_profile` first. See `slm-profile`.
 
 ---
 
-*SuperLocalMemory v4.1.0 · Qualixar · AGPL-3.0-or-later*
+*SuperLocalMemory v4.1.2 · Qualixar · AGPL-3.0-or-later*

package/plugin/skills/slm-scope/SKILL.md

@@ -173,4 +173,4 @@ to review the impact. See `slm-remember` for the full deletion discipline.
 
 ---
 
-*SuperLocalMemory v4.1.0 · Qualixar · AGPL-3.0-or-later*
+*SuperLocalMemory v4.1.2 · Qualixar · AGPL-3.0-or-later*

package/plugin/skills/slm-session/SKILL.md

@@ -253,4 +253,4 @@ explicitly and call `recall` with `include_global`/`include_shared` after
 
 ---
 
-*SuperLocalMemory v4.1.0 · Qualixar · AGPL-3.0-or-later*
+*SuperLocalMemory v4.1.2 · Qualixar · AGPL-3.0-or-later*

package/plugin/skills/slm-status/SKILL.md

@@ -163,4 +163,4 @@ multi-profile setup. To switch the active profile, see `slm-profile`.
 
 ---
 
-SuperLocalMemory v4.1.0 · Qualixar · AGPL-3.0-or-later
+SuperLocalMemory v4.1.2 · Qualixar · AGPL-3.0-or-later

package/plugin-src/rules/AGENTS.md

@@ -137,4 +137,4 @@ When the SLM MCP server is unavailable, use these CLI equivalents:
 - **slm-optimize-advisor** — context compression and KV cache
 - **slm-governance-advisor** — scope/role compliance, retention policies, GDPR
 
-SuperLocalMemory v4.1.0 · Qualixar · AGPL-3.0-or-later
+SuperLocalMemory v4.1.2 · Qualixar · AGPL-3.0-or-later

package/plugin-src/skills/slm-cache/SKILL.md

@@ -145,4 +145,4 @@ These subcommands control daemon-level cache settings. They do not read or write
 
 ---
 
-SuperLocalMemory v4.1.0 · Qualixar · AGPL-3.0-or-later
+SuperLocalMemory v4.1.2 · Qualixar · AGPL-3.0-or-later

package/plugin-src/skills/slm-compress/SKILL.md

@@ -147,4 +147,4 @@ Content over 1 MB (1 000 000 bytes UTF-8) is processed but `reversible` is force
 
 ---
 
-SuperLocalMemory v4.1.0 · Qualixar · AGPL-3.0-or-later
+SuperLocalMemory v4.1.2 · Qualixar · AGPL-3.0-or-later

package/plugin-src/skills/slm-governance/SKILL.md

@@ -245,4 +245,4 @@ Before running any destructive operation (`forget`, `compact_memories`):
 
 ---
 
-*SuperLocalMemory v4.1.0 · Qualixar · AGPL-3.0-or-later*
+*SuperLocalMemory v4.1.2 · Qualixar · AGPL-3.0-or-later*

package/plugin-src/skills/slm-graph/SKILL.md

@@ -312,4 +312,4 @@ profile. See `slm-profile` for the full profile switching workflow.
 
 ---
 
-SuperLocalMemory v4.1.0 · Qualixar · AGPL-3.0-or-later
+SuperLocalMemory v4.1.2 · Qualixar · AGPL-3.0-or-later

package/plugin-src/skills/slm-loop/SKILL.md

@@ -96,4 +96,4 @@ paused, name the approval needed; when errored, quote the short detail.
 
 ---
 
-SuperLocalMemory v4.1.0 · Qualixar · AGPL-3.0-or-later
+SuperLocalMemory v4.1.2 · Qualixar · AGPL-3.0-or-later

package/plugin-src/skills/slm-mesh/SKILL.md

@@ -279,4 +279,4 @@ mesh availability.
 
 ---
 
-*SuperLocalMemory v4.1.0 · Qualixar · AGPL-3.0-or-later*
+*SuperLocalMemory v4.1.2 · Qualixar · AGPL-3.0-or-later*

package/plugin-src/skills/slm-profile/SKILL.md

@@ -146,4 +146,4 @@ Name them differently in your MCP config (e.g. `superlocalmemory-personal` and
 
 ---
 
-*SuperLocalMemory v4.1.0 · Qualixar · AGPL-3.0-or-later*
+*SuperLocalMemory v4.1.2 · Qualixar · AGPL-3.0-or-later*

package/plugin-src/skills/slm-recall/SKILL.md

@@ -323,4 +323,4 @@ before recalling, then switch back. See `slm-profile` for workspace switching.
 
 ---
 
-*SuperLocalMemory v4.1.0 · Qualixar · AGPL-3.0-or-later*
+*SuperLocalMemory v4.1.2 · Qualixar · AGPL-3.0-or-later*

package/plugin-src/skills/slm-remember/SKILL.md

@@ -270,4 +270,4 @@ different workspace, use `switch_profile` first. See `slm-profile`.
 
 ---
 
-*SuperLocalMemory v4.1.0 · Qualixar · AGPL-3.0-or-later*
+*SuperLocalMemory v4.1.2 · Qualixar · AGPL-3.0-or-later*

package/plugin-src/skills/slm-scope/SKILL.md

@@ -173,4 +173,4 @@ to review the impact. See `slm-remember` for the full deletion discipline.
 
 ---
 
-*SuperLocalMemory v4.1.0 · Qualixar · AGPL-3.0-or-later*
+*SuperLocalMemory v4.1.2 · Qualixar · AGPL-3.0-or-later*

package/plugin-src/skills/slm-session/SKILL.md

@@ -253,4 +253,4 @@ explicitly and call `recall` with `include_global`/`include_shared` after
 
 ---
 
-*SuperLocalMemory v4.1.0 · Qualixar · AGPL-3.0-or-later*
+*SuperLocalMemory v4.1.2 · Qualixar · AGPL-3.0-or-later*

package/plugin-src/skills/slm-status/SKILL.md

@@ -163,4 +163,4 @@ multi-profile setup. To switch the active profile, see `slm-profile`.
 
 ---
 
-SuperLocalMemory v4.1.0 · Qualixar · AGPL-3.0-or-later
+SuperLocalMemory v4.1.2 · Qualixar · AGPL-3.0-or-later

package/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "superlocalmemory"
-version = "4.1.0"
+version = "4.1.2"
 description = "Local-first agent memory with auditable hybrid retrieval"
 readme = "README.md"
 license = "AGPL-3.0-or-later"

package/src/superlocalmemory/__init__.py

@@ -32,7 +32,7 @@ if "OMP_NUM_THREADS" not in os.environ:
     os.environ["OMP_NUM_THREADS"] = "2"
 # ---------------------------------------------------------------------------
 
-__version__ = "4.1.0"
+__version__ = "4.1.2"
 
 _REQUIRED_VERSIONS = {
     "sentence_transformers": "5.3.0",

package/src/superlocalmemory/cli/commands.py

@@ -2577,6 +2577,56 @@ def _migration_error_logs() -> list:
         return []
 
 
+def _slm_version() -> str:
+    """The installed package version, or "unknown"."""
+    try:
+        from importlib.metadata import version
+        return version("superlocalmemory")
+    except Exception:  # noqa: BLE001
+        return "unknown"
+
+
+def _installed_plugin_versions() -> dict:
+    """Version of each editor plugin found on this machine, by install name.
+
+    The skills, agents and commands live in the editor's plugin channel rather
+    than in the Python package, so upgrading with pip leaves them exactly where
+    they were. This looks for them where each editor puts them, and returns an
+    empty mapping when none is installed -- which is itself the answer worth
+    reporting, because it means pip is the only thing being upgraded.
+
+    Best effort by design: an editor this does not know about should produce
+    "not detected", never an error.
+    """
+    import json
+    from pathlib import Path
+
+    found: dict[str, str] = {}
+    roots = (
+        # Claude Code: marketplace installs and directly-added plugins.
+        Path.home() / ".claude" / "plugins",
+        # Codex and VS Code copies, when placed by hand.
+        Path.home() / ".codex" / "plugins",
+        Path.home() / ".vscode" / "extensions",
+    )
+    for root in roots:
+        if not root.is_dir():
+            continue
+        for manifest in list(root.glob("*/.claude-plugin/plugin.json")) + \
+                list(root.glob("*/plugin.json")) + \
+                list(root.glob("*/*/.claude-plugin/plugin.json")):
+            try:
+                data = json.loads(manifest.read_text(encoding="utf-8"))
+            except Exception:  # noqa: BLE001 — a sibling plugin's bad json is not ours
+                continue
+            if str(data.get("name", "")) != "superlocalmemory":
+                continue
+            found[str(manifest.parent.parent.name)] = str(
+                data.get("version", "unknown")
+            )
+    return found
+
+
 def _detect_all_installs() -> list:
     """Thin shim so cmd_doctor can be tested without importing install_detector."""
     try:
@@ -3093,6 +3143,50 @@ def cmd_doctor(args: Namespace) -> None:
     except Exception as _inst_exc:  # noqa: BLE001 — never break doctor
         _check("install_versions", "WARN", f"could not probe installs: {_inst_exc}")
 
+    # 14. The skills, agents and commands are NOT in the Python package.
+    #     They ship through the editor's own plugin channel -- `plugin/` in the
+    #     repository -- so `pip install --upgrade` cannot move them, and until now
+    #     nothing said so. 4.1 changed 76 files across those trees; a user who
+    #     upgraded the package and read a clean `slm doctor` had every reason to
+    #     believe they had all of it, and no way to find out otherwise.
+    try:
+        _pkg_version = _slm_version()
+        _pl = _installed_plugin_versions()
+        if not _pl:
+            _check(
+                "plugin_skills",
+                "WARN",
+                f"package is {_pkg_version}; no editor plugin detected, so the "
+                f"skills, agents and commands are not installed or updated by "
+                f"pip",
+                fix="Claude Code:  claude plugin marketplace add "
+                    "qualixar/superlocalmemory  &&  claude plugin install "
+                    "superlocalmemory@qualixar     "
+                    "Codex / VS Code: copy codex-plugin/ or copilot-plugin/ "
+                    "from the tag you are on",
+            )
+        else:
+            _stale = {n: v for n, v in _pl.items() if v != _pkg_version}
+            if _stale:
+                _check(
+                    "plugin_skills",
+                    "WARN",
+                    "package is %s; plugin content still at %s" % (
+                        _pkg_version,
+                        ", ".join(f"{n}={v}" for n, v in sorted(_stale.items())),
+                    ),
+                    fix="claude plugin marketplace update qualixar && "
+                        "claude plugin update superlocalmemory@qualixar",
+                )
+            else:
+                _check(
+                    "plugin_skills",
+                    "PASS",
+                    f"plugin content matches the package ({_pkg_version})",
+                )
+    except Exception as _pl_exc:  # noqa: BLE001 — never break doctor
+        _check("plugin_skills", "WARN", f"could not probe plugins: {_pl_exc}")
+
     # 14. Migration error logs — surface any unresolved failure from a previous
     #     upgrade attempt. The daemon writes these and they persist until the
     #     user takes action; doctor is the right place to surface them.

package/src/superlocalmemory/server/recall_health.py

@@ -39,6 +39,7 @@ from __future__ import annotations
 
 import logging
 import threading
+import time
 from contextlib import nullcontext
 from dataclasses import dataclass
 
@@ -67,6 +68,17 @@ class RecallHealth:
     checks: int = 0
     last_semantic_score: float = 0.0
     last_error: str = ""
+    #: When the last tick finished, as a unix timestamp. A tick that finds
+    #: nothing wrong logs nothing, which is correct -- a monitor that narrates
+    #: every success is a monitor whose real warnings get skimmed past. But it
+    #: left no way to tell a monitor that is ticking quietly from a thread that
+    #: died or never started, and that ambiguity cost someone an hour of looking
+    #: for log lines that were never going to appear. So the fact of the tick is
+    #: recorded here and surfaced on /health, where it can be checked instead of
+    #: inferred.
+    last_tick_at: float = 0.0
+    #: Whether the embedder could produce a vector at the last tick.
+    embedder_alive: bool = True
 
 
 def _max_semantic(results) -> float:
@@ -91,6 +103,38 @@ def _get_embedder(engine):
     return emb
 
 
+def _embedder_is_dead(engine) -> bool:
+    """Can the embedder produce a vector right now?
+
+    Asked directly, because it cannot be inferred from a recall. The monitor
+    used to decide the embedder was fine whenever the probe recall came back
+    with no results at all -- and a dead embedder is one of the reasons a recall
+    comes back with no results, so the one symptom that should have triggered a
+    heal was read as proof that none was needed.
+
+    That is not hypothetical. An idle-timeout kill leaves no worker; the next
+    probe finds nothing by meaning, finds nothing by keyword either because the
+    probe phrase appears in nobody's memories, and returns zero results. The
+    monitor then recorded "healthy", logged nothing, and never respawned the
+    worker -- so ``readiness.embedding`` stayed false and the daemon sat in
+    ``warming`` until someone restarted it by hand, with not one line in the log
+    to say why.
+
+    Fails safe in the opposite direction from before: an embedder this cannot
+    reach is reported dead, so the worst case is one unnecessary re-warm rather
+    than a silent outage.
+    """
+    emb = _get_embedder(engine)
+    if emb is None:
+        return False  # BM25-only by configuration; nothing to heal.
+    warm = getattr(emb, "is_warm", None)
+    if warm is not None and not warm:
+        return True
+    if getattr(emb, "_available", True) is False:
+        return True
+    return False
+
+
 def _heal_embedder(engine, *, log) -> bool:
     """Tier 3: reset the cached availability flag and re-exercise the embedder.
 
@@ -169,10 +213,27 @@ def run_health_tick(engine, state: RecallHealth, *, probe: str = DEFAULT_PROBE,
     results = list(getattr(resp, "results", []) or [])
     sem = _max_semantic(results)
     state.last_semantic_score = sem
-
-    # Tier 2: readiness. Rows present but semantic never fired == warm-but-broken.
-    # Zero results is NOT this signature (could be an empty/filtered corpus).
-    broken = bool(results) and sem <= 0.0
+    state.last_tick_at = time.time()
+
+    # Tier 2: readiness. Two independent signatures, and the second one is why
+    # this monitor exists.
+    #
+    #   * rows present but semantic never fired  -> warm-but-broken
+    #   * the embedder cannot produce a vector   -> dead, whatever the recall said
+    #
+    # The second used to be missing, and its absence was load-bearing: zero
+    # results was treated as "not this signature", so the case where the embedder
+    # is dead AND the probe matches nothing by keyword -- which is the normal
+    # shape of an idle-timeout kill -- came out as healthy, silently.
+    dead = _embedder_is_dead(engine)
+    state.embedder_alive = not dead
+    broken = dead or (bool(results) and sem <= 0.0)
+    if dead:
+        log.critical(
+            "recall-health: embedder cannot produce a vector (%d probe results) "
+            "— attempting self-heal",
+            len(results),
+        )
     if not broken:
         if not state.healthy:
             log.warning(
@@ -184,12 +245,16 @@ def run_health_tick(engine, state: RecallHealth, *, probe: str = DEFAULT_PROBE,
         state.last_error = ""
         return state
 
-    # Tier 3: self-heal.
-    log.critical(
-        "recall-health: semantic channel DEAD (%d results, max semantic=0.0) "
-        "— embedder returning None; attempting self-heal",
-        len(results),
-    )
+    # Tier 3: self-heal. The dead-embedder case already said so above; saying
+    # "semantic channel DEAD (max semantic=0.0)" as well would be a second,
+    # differently-worded CRITICAL about the same tick, and one of the two would
+    # be describing a symptom the reader does not have.
+    if not dead:
+        log.critical(
+            "recall-health: semantic channel DEAD (%d results, max semantic=0.0) "
+            "— embedder returning None; attempting self-heal",
+            len(results),
+        )
     if _heal_embedder(engine, log=log):
         state.total_heals += 1
         state.healthy = True
@@ -256,6 +321,7 @@ def start_recall_health_monitor(engine, *, interval_s: int = DEFAULT_INTERVAL_S,
 def get_recall_health() -> dict:
     """Snapshot for /health surfacing (visibility — never silent degradation)."""
     s = _GLOBAL_STATE
+    now = time.time()
     return {
         "recall_healthy": s.healthy,
         "consecutive_failures": s.consecutive_failures,
@@ -263,4 +329,15 @@ def get_recall_health() -> dict:
         "checks": s.checks,
         "last_semantic_score": round(s.last_semantic_score, 4),
         "last_error": s.last_error,
+        # Proof of life. A tick that finds nothing wrong logs nothing, so there
+        # was no way to tell this monitor apart from a thread that never started
+        # -- someone spent an hour reading logs for lines that were never going
+        # to be written. These two answer that without needing the log at all:
+        # if seconds_since_last_tick keeps climbing past the interval, the thread
+        # is gone.
+        "last_tick_at": round(s.last_tick_at, 3) if s.last_tick_at else None,
+        "seconds_since_last_tick": (
+            round(now - s.last_tick_at, 1) if s.last_tick_at else None
+        ),
+        "embedder_alive": s.embedder_alive,
     }

package/src/superlocalmemory/server/unified_daemon.py

@@ -511,6 +511,49 @@ _MIGRATION_EXEMPT_PATH_PREFIXES: tuple[str, ...] = (
 )
 
 
+def _serving_blocked_by(migration_result: dict) -> list[str]:
+    """Failed migrations that should stop this daemon serving. Fail-closed.
+
+    A failed migration used to 503 every route without asking what had failed.
+    For a missing table that is right. For a data invariant that ordinary use can
+    re-violate it is not: one drifted row made the whole store unreachable until
+    somebody restarted it by hand, and the restart fixed nothing that a
+    background repair would not have fixed on its own.
+
+    A migration may answer for itself by exposing ``blocks_serving(conn)``.
+    Anything that does not is treated as blocking, so this cannot quietly open a
+    door for a migration nobody has thought about.
+    """
+    failed = list(migration_result.get("failed") or [])
+    if not failed:
+        return []
+    try:
+        import sqlite3
+
+        from superlocalmemory.infra.data_root import state_path
+        from superlocalmemory.storage._migration_internals import _MODULES
+    except Exception:  # noqa: BLE001 — never let this decide by crashing
+        return failed
+
+    blocking: list[str] = []
+    for name in failed:
+        decide = getattr(_MODULES.get(name), "blocks_serving", None)
+        if not callable(decide):
+            blocking.append(name)
+            continue
+        try:
+            db = state_path("memory.db")
+            conn = sqlite3.connect(f"file:{db}?mode=ro", uri=True)
+            try:
+                if decide(conn):
+                    blocking.append(name)
+            finally:
+                conn.close()
+        except Exception:  # noqa: BLE001 — unknown means blocking
+            blocking.append(name)
+    return blocking
+
+
 def _is_migration_exempt_path(path: str) -> bool:
     """Return True for health, status, and repair paths that must stay reachable
     even when the daemon reports a schema migration failure.
@@ -4009,7 +4052,7 @@ def _register_dashboard_routes(application: FastAPI) -> None:
     @application.middleware("http")
     async def _migration_readiness_gate(request, call_next):
         migration_result = getattr(application.state, "migration_result", None)
-        if migration_result and migration_result.get("failed"):
+        if migration_result and _serving_blocked_by(migration_result):
             if not _is_migration_exempt_path(request.url.path):
                 from fastapi.responses import JSONResponse
                 return JSONResponse(
@@ -4278,7 +4321,14 @@ def _register_daemon_routes(application: FastAPI) -> None:
             (migration_result or {}).get("failed", []) or []
         )
         migration_details = (migration_result or {}).get("details", {}) or {}
-        migrations_ready = bool(migration_result) and not migration_failures
+        # Ready means "can serve", so it keys off the failures that actually
+        # stop this daemon serving -- not off every failure. A data invariant
+        # that ordinary use re-violated leaves every route working; reporting
+        # not-ready for it told operators to restart, which fixed nothing a
+        # background repair would not have fixed. Everything still shows up in
+        # migration_failures and migration_failure_reasons below, named.
+        migration_blocking = _serving_blocked_by(migration_result or {})
+        migrations_ready = bool(migration_result) and not migration_blocking
         if migration_details.get("_crash"):
             migrations_ready = False
         writer_runtime = getattr(
@@ -4296,6 +4346,9 @@ def _register_daemon_routes(application: FastAPI) -> None:
             "embedding": embedding_ready,
             "recall_health": recall_health.get("recall_healthy") is True,
             "migration_failures": migration_failures,
+            # Which of those are the reason this daemon will not serve, as
+            # opposed to the ones it is reporting while serving normally.
+            "migration_blocking": migration_blocking,
             # WHY each one failed, not just which. The runner already produces
             # a precise sentence per migration -- "safe repair did not restore
             # M043_...", "schema verification failed ... : <sqlite error>" --

package/src/superlocalmemory/storage/_migration_internals.py

@@ -332,6 +332,22 @@ def _delete_log(conn: sqlite3.Connection, name: str) -> None:
     conn.execute("DELETE FROM migration_log WHERE name = ?", (name,))
 
 
+def _why_unmet(mod, conn) -> str:
+    """The migration's own account of which check does not hold.
+
+    A migration may expose ``unmet(conn)`` returning a sentence. Most do not,
+    and for those the caller keeps its generic wording. Never raises: this runs
+    while reporting a failure and must not become a second one.
+    """
+    fn = getattr(mod, "unmet", None)
+    if not callable(fn):
+        return ""
+    try:
+        return str(fn(conn) or "")
+    except Exception:  # noqa: BLE001 - a detail string is not worth a crash
+        return ""
+
+
 def _apply_single(
     conn: sqlite3.Connection,
     migration: Migration,
@@ -414,9 +430,12 @@ def _apply_single(
                         try:
                             repair_fn(conn)
                             if not bool(verify_fn(conn)):
+                                _why = _why_unmet(mod, conn)
                                 return (
                                     "failed",
-                                    f"safe repair did not restore {migration.name}",
+                                    f"safe repair did not restore "
+                                    f"{migration.name}"
+                                    + (f": {_why}" if _why else ""),
                                 )
                             _upsert_log(conn, migration.name, ddl_hash, "complete")
                             return (
@@ -482,9 +501,11 @@ def _apply_single(
                 )
             try:
                 if not bool(verify_fn(conn)):
+                    _why = _why_unmet(mod, conn)
                     return (
                         "failed",
-                        f"safe repair did not restore {migration.name}",
+                        f"safe repair did not restore {migration.name}"
+                        + (f": {_why}" if _why else ""),
                     )
             except sqlite3.Error as exc:
                 return (

package/src/superlocalmemory/storage/migrations/M043_quarantine_display_summaries.py

@@ -409,45 +409,31 @@ def _sync_lifecycle_mirror(conn: sqlite3.Connection) -> None:
     """)
 
 
-def verify(conn: sqlite3.Connection) -> bool:
-    """Whether the repair's end-state holds.
-
-    Called on every start for an already-complete migration. Returning False
-    routes to ``repair()``, which makes this a standing guard: if pollution ever
-    reappears, the next daemon start withholds it without anyone asking.
+def unmet(conn: sqlite3.Connection) -> str:
+    """Which check does not hold, named. Empty string when all of them do.
+
+    ``verify()`` returns a bare boolean, so when a completed migration stops
+    verifying the runner can only say "safe repair did not restore M043". This
+    checks five separate things, and that sentence names none of them -- a user
+    hitting it had to come back and ask which, and so did we. This is the same
+    gap that ``migration_failure_reasons`` closed one level up, left open one
+    level down.
     """
     if not _table_exists(conn, "atomic_facts"):
-        return True
+        return ""
     if not _has_column(conn, "atomic_facts", "quarantined"):
-        return False
+        return "atomic_facts has no 'quarantined' column"
     if not _table_exists(conn, "consolidated_summaries"):
-        return False
-
+        return "the consolidated_summaries display table is missing"
     if _table_exists(conn, "fact_consolidations"):
-        unwithheld = _count(
+        n = _count(
             conn,
             "SELECT COUNT(*) FROM atomic_facts WHERE COALESCE(quarantined, 0) = 0 "
             "  AND fact_id IN (" + _CONSOLIDATOR_ROWS + ")",
         )
-        if unwithheld:
-            return False
-
-        # Every withheld row must still be visible somewhere, or the repair has
-        # deleted the owner's view of it rather than moved it.
-        #
-        # BY IDENTITY *OR* CONTENT, and the "or" is what makes this an invariant
-        # rather than a trap. Matching on content alone could never become true
-        # once a row's content changed after being preserved: the display copy
-        # keeps the old text, verify stays false, repair() runs apply() again,
-        # apply() cannot change the past, and the migration is reported failed
-        # on every start for the rest of the store's life. Matching on identity
-        # alone fails the other way, because two withheld rows with identical
-        # text collapse into one display row under the unique triple, leaving the
-        # second with no row of its own id.
-        #
-        # Either match satisfies the guarantee that actually matters: nothing
-        # the owner could see has stopped being visible.
-        unpreserved = _count(conn, """
+        if n:
+            return f"{n} model-written summaries are not withheld from recall"
+        n = _count(conn, """
             SELECT COUNT(*) FROM atomic_facts af
              WHERE af.fact_id IN (""" + _CONSOLIDATOR_ROWS + """)
                AND NOT EXISTS (
@@ -457,13 +443,51 @@ def verify(conn: sqlite3.Connection) -> bool:
                              OR cs.content = af.content)
                    )
         """)
-        if unpreserved:
-            return False
-
+        if n:
+            return f"{n} withheld summaries have no display copy"
     if _table_exists(conn, "fact_retention"):
-        if _count(conn, "SELECT COUNT(*) FROM (" + _wrongly_hidden(conn) + ")"):
-            return False
-    return True
+        n = _count(conn, "SELECT COUNT(*) FROM (" + _wrongly_hidden(conn) + ")")
+        if n:
+            return f"{n} real memories are hidden from recall and should not be"
+    return ""
+
+
+def blocks_serving(conn: sqlite3.Connection) -> bool:
+    """Should a daemon refuse to serve while this check does not hold?
+
+    Only when the SCHEMA is missing. The two schema conditions here -- the
+    column and the display table -- mean queries would hit something that is not
+    there, so refusing is right. The other three are about DATA: a summary that
+    should be withheld is not withheld, or a real memory is hidden. Those make
+    some answers worse; they do not stop the store working.
+
+    The distinction matters because this ``verify()`` is a standing guard over
+    data that ordinary use can re-violate -- a consolidation pass hiding one more
+    memory is enough. Treating that like a missing table meant one drifted row
+    could return 503 on every route indefinitely, with a manual restart the only
+    way out. That is an outage caused by a quality check, which is worse than the
+    thing the check is for.
+
+    Reported as #125, where a user's daemon sat unusable on exactly this.
+    """
+    if not _table_exists(conn, "atomic_facts"):
+        return False
+    if not _has_column(conn, "atomic_facts", "quarantined"):
+        return True
+    return not _table_exists(conn, "consolidated_summaries")
+
+
+def verify(conn: sqlite3.Connection) -> bool:
+    """Whether the repair's end-state holds.
+
+    Called on every start for an already-complete migration. Returning False
+    routes to ``repair()``, which makes this a standing guard: if pollution ever
+    reappears, the next daemon start withholds it without anyone asking.
+
+    Thin wrapper over ``unmet()`` so the two can never disagree about what
+    "verified" means.
+    """
+    return not unmet(conn)
 
 
 def repair(conn: sqlite3.Connection) -> None:

package/src/superlocalmemory/storage/schema.py

@@ -972,6 +972,18 @@ _DDL_ORDERED: Final[tuple[str, ...]] = (
 #: which SQLite offers no IF NOT EXISTS form of, so presence is checked first.
 _ADDITIVE_COLUMNS: Final[tuple[tuple[str, str, str], ...]] = (
     ("atomic_facts", "quarantined", "INTEGER NOT NULL DEFAULT 0"),
+    # ``pinned`` arrives with M015, which is a DEFERRED migration -- it runs
+    # after the engine is up. But the DDL below indexes it
+    # (``idx_facts_pinned``), and that DDL runs during engine start. On a store
+    # old enough to predate M015 the index therefore raised "no such column:
+    # pinned" before anything could add it, and every start failed the same way:
+    # the deferred pass could not run because the engine could not start, and
+    # the engine could not start because the deferred pass had not run.
+    # ``slm db migrate`` did not break the loop either -- it reports Failed=0
+    # and skips deferred migrations by definition.
+    # The column has to exist before its own index either way, so it belongs
+    # here, where a store gets it at start regardless of migration state.
+    ("atomic_facts", "pinned", "INTEGER NOT NULL DEFAULT 0"),
 )
 
 
@@ -1011,6 +1023,17 @@ def create_all_tables(conn: sqlite3.Connection) -> None:
     """
     _set_pragmas(conn)
 
+    # Before the DDL, not only after it. The DDL below indexes columns that an
+    # upgraded store may not have yet, and an index on a column that does not
+    # exist is a hard error, not a skipped statement -- so the whole of
+    # create_all_tables would raise and the engine would never start.
+    #
+    # On a fresh database this pass does nothing: the tables do not exist yet,
+    # which the helper treats as "nothing to alter". On an upgraded one the
+    # tables are already there and this is exactly where the columns are owed.
+    # It runs again at the end for tables created during this call.
+    _add_missing_columns(conn)
+
     for ddl in _DDL_ORDERED:
         conn.executescript(ddl)