superlocalmemory 4.1.17 → 4.1.19

package/.claude-plugin/marketplace.json

@@ -9,7 +9,7 @@
       "author": {
         "name": "Qualixar"
       },
-      "description": "Local-first agent memory + reversible context compression and KV cache, as an MCP server. 34-tool code profile with graph intelligence.",
+      "description": "Local-first agent memory + reversible context compression and KV cache, as an MCP server. 38-tool code profile with graph intelligence.",
       "homepage": "https://github.com/qualixar/superlocalmemory",
       "keywords": [
         "memory",
@@ -21,7 +21,7 @@
       "license": "AGPL-3.0-or-later",
       "name": "superlocalmemory",
       "source": "./plugin",
-      "version": "4.1.17"
+      "version": "4.1.19"
     },
     {
       "author": {
@@ -39,7 +39,7 @@
       "license": "AGPL-3.0-or-later",
       "name": "superlocalmemory-codex",
       "source": "./codex-plugin",
-      "version": "4.1.17"
+      "version": "4.1.19"
     }
   ]
 }

package/CHANGELOG.md

@@ -5,6 +5,208 @@ All notable changes to SuperLocalMemory will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [4.1.19] — Memories know what kind they are
+
+### Added
+
+- **Nine memory kinds.** A memory can be a fact, an event, a current status, an
+  opinion, a standing rule, a decision, a how-to, a plan or a correction. You
+  or your agent can say which when saving (`kind` on `remember`, `--kind` on
+  the CLI); otherwise SLM suggests one. A suggestion changes nothing until
+  someone confirms it.
+- **Standing rules at session start.** Rules and decisions you confirmed are
+  given to every new agent session, up to ten rules and five decisions.
+  Proposed, rejected, archived, quarantined and replaced items are never
+  included.
+- **Classify existing memories** in the background (`slm kinds backfill`, or
+  HTTP), with progress, pause, cancel and an exact undo. It never changes a
+  kind you confirmed. Classifying online with Jev needs its own consent and a
+  confirmation that memory text leaves this machine.
+- **Review and confirm kinds** from agents (four new tools in the default,
+  code, full and power tool sets), the CLI (`slm kinds set | review | confirm`)
+  and HTTP.
+- **Ask for a kind of memory.** Recall, search and list take a `kind` filter.
+  "What did we decide" favours decisions, "how do I" favours how-tos, and "what
+  is the current state" puts the newest confirmed status or decision first.
+  Questions that ask for no particular kind are ranked exactly as before.
+- **Narrow a recall** by project, by the agent that saved a memory, or by who
+  or what it is about (`project`, `saved_by`, `about`). The filter applies on
+  every recall path and before the answer check, so the check judges only what
+  you will see.
+- **Say which memory a new one replaces.** `remember(..., replaces=<id>)`
+  retires the old memory (kept, never deleted) and recall shows the new one.
+  Undoing it through correction review brings the old memory back exactly.
+  It works with a per-request `profile_id` too: a client routed to its own
+  profile can replace a memory and undo it there (`review_correction` and
+  `list_corrections` take the same `profile_id`), without switching the
+  daemon's active profile.
+- **Upgrades keep a verified copy you can go back to:** restore points, a
+  restore that also brings back memories saved since the copy, and a prepared
+  path back to the previous version (`slm db restore-points | restore |
+  prepare-downgrade`).
+- **Encrypted cloud backups** (see Security), with `slm backup recovery-key` and
+  `slm backup decrypt`.
+
+### Fixed
+
+- **Recall never writes.** Asking about an unknown name no longer creates
+  entities or calls a model, which also removes a multi-second delay on the
+  first question about a new name.
+- **Enrichment no longer gets stuck** on memories that hold credentials.
+- **Memories blanked by an earlier release are repaired once**, after a
+  verified safety copy: their text, the facts searched from it, and wrongly
+  set "replaced" marks.
+- **A restore never repeats a loss.** It deletes again only what you or a
+  privacy erasure deleted, works when the live store is damaged, refuses a copy
+  made by a newer version, keeps kinds you confirmed after the copy, keeps
+  erased profiles erased in learning data, and cannot be cancelled half-way
+  through. Its messages say what actually happened.
+- **A kind you confirmed is never overwritten** by background work, and a
+  machine suggestion never changes a memory's type.
+- **The same request gives the same answer on MCP, the CLI and HTTP**,
+  including refusals. Every `--json` command prints JSON on errors too.
+- **The Hermes plugin works with the release it ships with**, and asks for
+  confirmation before `remember --replaces`.
+- **Windows:** the test suite runs on Windows again, and a read timeout in the
+  embedding worker no longer freezes it.
+- **npm install on Linux finds `python3.12` and newer** next to an older
+  `python3`, and honours `SLM_PYTHON`.
+
+### Security
+
+- **Credentials leave this machine redacted on every path.** One outbound gate
+  covers model providers, cloud embedders, summaries, the reranker, the
+  answer check, a LAN Ollama and mesh peers; a model provider's key is sent only
+  to that provider. Context given to agent sessions is redacted the same way,
+  with no last-four-character tails. Requests to this machine never go through
+  an environment proxy.
+- **Cloud backups are encrypted on this machine before upload** to GitHub or
+  Google Drive. You get a recovery key; keep it to restore on another
+  machine. Backups made by earlier releases still restore.
+- **Every new read route checks permission.**
+- **Error responses no longer include file paths or internal messages.**
+
+### Changed
+
+- **Credentials you save are stored as written.** Up to 4.1.18, known key
+  formats were removed on save. SLM keeps them so your agents can recall them,
+  and redacts them on the way out.
+- **Python 3.12 or newer is required**, and every check now says so.
+- **Tool sets:** default and full 54 tools, code 38, power 66. The Antigravity
+  plugin uses the power set (within Antigravity's limit) and the Cursor
+  configuration uses the code set.
+- **Recall's ceiling is 3.0 seconds** including the answer check.
+
+### Known limits
+
+- **Macs shared by several user accounts:** the per-account check is still not
+  in this release. Turn on company mode (Team → Access policy) on a shared Mac.
+- **Classifying existing memories with a cloud model** uses on-device rules.
+- **Drive does not rotate old backups**: delete plain-text backups made before
+  this release yourself.
+
+## [4.1.18] — Recall can say "I don't have that"
+
+### Added
+
+- **Answer check.** Recall now says whether the memories it found actually
+  answer the question, instead of handing back the best of a bad set. Results
+  are never removed or hidden: each recall reports `abstained`, the reason,
+  a confidence, and `answer_check_status` (judged, off, skipped, busy,
+  warming or unavailable), and every connected agent is told not to present
+  memories that do not answer as the answer.
+- **Two ways to run it, one at a time.** "On this Mac" runs privately on Apple
+  Silicon and nothing leaves the machine. "Online with Jev" works anywhere with
+  your own TypeSafe or OpenRouter key; it is off until you choose it and tick a
+  consent box, and it sends only the question and its top three memories,
+  with credentials stripped out first. It never sends another profile's
+  memories, and recalls that only load context (session start, auto-loaded
+  context, the per-prompt hook) are never sent. Turning one on turns the
+  other off.
+- **Optional: let Jev reorder results.** Inside "Online with Jev" there is a
+  separate switch, off by default with its own notice, that also asks Jev
+  which of the top results answers the question most directly and returns
+  them in that order. Still one request per recall. On a public benchmark of
+  long conversations (LoCoMo, 1,531 questions) the memory that answers came
+  first 62% of the time instead of 49%; it adds about 0.4 seconds to a
+  recall. If the provider is slow or unreachable, results keep their usual
+  order.
+- **Set up from the dashboard.** Settings → Answer check: choose, set up with a
+  progress bar, use an existing install on networks that block downloads,
+  save and test a key (only its last four characters are ever shown), or turn
+  it off. The dashboard home shows what is actually running. Changing it
+  needs the manage permission, and withdrawing consent stops the online
+  check at once, in every mode.
+- **First-time setup installs it** on Apple Silicon (about 1.1 GB to
+  download, about 1.1 GB of memory while on). If the download is blocked or
+  interrupted, setup finishes and Set up again picks up where it left off.
+  Unattended setup skips it unless `SLM_INSTALL_LAYA=1` is set.
+- **Every recall response says what chose its order** and what became of
+  the answer check, from the MCP tools, the CLI and the HTTP API alike.
+
+### Fixed
+
+- **Archived memories stay archived after a restart.** A repair that should
+  have run once ran on every start and put archived memories back into
+  recall.
+- **Upgrades keep one safety copy instead of two**, and copies left by
+  earlier upgrades are cleaned up.
+- **Ranking no longer loses its second pass.** After a crash, a restart of its
+  helper, or an idle shutdown, the reranking step recovers on its own, and it
+  keeps ranking while its helper restarts. It also uses much less memory on
+  long, mixed-length requests.
+- **A configured remote reranker is now used**, and one that stops answering
+  no longer slows every recall: recall falls back to its usual ranking right
+  away and checks the endpoint again in the background.
+- **A newer memory is no longer pushed down by an older one** about the same
+  subject.
+- **Health checks** report the reranking step and no longer raise false alarms
+  when a working search simply has no match.
+- **No more project files at the root of the disk.** Background context sync
+  only writes into real project folders.
+- **Bounded loops** waiting on memory no longer finish on a recall that does
+  not answer their question.
+- **Restoring a backup** no longer loses or corrupts recent memories, takes
+  effect while the store is in use, and no longer leaves a large temporary
+  file next to the store.
+- **Stored memories keep their links and file paths.** Saving a memory no
+  longer blanks out long URLs and paths.
+- **`slm db compact` works while SLM is running.**
+- **Hooks work when the data folder has a long path.**
+- **Maintenance no longer reports a step that does not apply to your store
+  as a failure.**
+- **Windows:** safety copies are flushed to disk properly.
+
+### Security
+
+- **A web page on another site can no longer reach SLM through your
+  browser.** SLM now answers only requests addressed to this computer. To
+  reach a LAN install by a host name, list the name in `SLM_ALLOWED_HOSTS`;
+  reaching it by address, or by a name already allowed for network access,
+  is unchanged.
+- **The per-prompt hook only talks to your own SLM service.** Its fallback
+  path could send a prompt to any program listening on the service's port.
+- **Known API key formats, webhook links and private-key bodies are removed
+  when a memory is saved**, not only before anything is sent online.
+- Dependencies updated to versions that fix published security advisories.
+
+### Changed
+
+- **A background consistency check is off by default**, including on upgraded
+  installs. It changed no recall result in testing and ran on every save. It
+  can be turned back on, and turning it back on now sticks.
+- **Answer-check settings live in one file for every mode**, so switching
+  modes never changes them.
+- **Mode A says when it is not local-only:** with the online answer check on,
+  the mode description says so instead of "zero-cloud".
+
+### Known limits
+
+- **Macs shared by several user accounts:** another account on the same Mac
+  can reach the local SLM service. Turn on company mode (Team → Access
+  policy) on a shared Mac; a per-account check is planned for the next
+  release. See the "Shared Macs" section of the security notes.
+
 ## [4.1.17] — Vector history that actually gets pruned
 
 ### Fixed

package/README.md

@@ -5,12 +5,35 @@
   </picture>
 </p>
 
-<h1 align="center">SuperLocalMemory V4.1.17</h1>
+<h1 align="center">SuperLocalMemory V4.1.19 — local-first memory for AI agents</h1>
 
 <h2 align="center">Rent the LLM. Own the memory.</h2>
 
 <p align="center"><em>Rent an LLM — but own the memory, for your company and for your industry.</em></p>
 
+Store context once and recall it across agent sessions through the CLI or MCP. Start with local memory, then choose the operating mode and integrations your workspace needs. SuperLocalMemory is part of Qualixar's AI Reliability Engineering work.
+
+**[Research and evidence](https://www.superlocalmemory.com/research)** · **[Qualixar product overview](https://qualixar.com/products/superlocalmemory)** · **[Author and research context](https://varunpratap.com/products/superlocalmemory)**
+
+**[Install](https://www.superlocalmemory.com/install)** · **[Product walkthrough](https://www.superlocalmemory.com/demo)** · **[CLI proof](docs/QUICK_PROOF.md)** · **[Release notes](CHANGELOG.md)**
+
+```bash
+npm install -g superlocalmemory  # Primary CLI install path
+slm setup  # Select mode A for local-only operation; review integration choices.
+slm doctor
+slm remember "Synthetic demo: the release checklist requires a human approval after tests pass." --tags demo --json --sync
+slm recall "release checklist human approval" --json
+```
+
+The synthetic CLI proof returned the stored sentence in mode A on version 4.1.17. It tests store-and-recall behavior; it is not a retrieval accuracy benchmark.
+[See the commands, scope and isolation settings](docs/QUICK_PROOF.md).
+
+If the proof is useful for your agent workflow, [star the repository](https://github.com/qualixar/superlocalmemory) to find the project again. Stars are optional; installation and documentation are open without one.
+
+**Release maintenance:** dependency updates are being reviewed separately in [PR #143](https://github.com/qualixar/superlocalmemory/pull/143). This documentation update does not change already published packages.
+
+## Governance, architecture and research
+
 <p align="center"><strong>The governed memory layer for AI agents: local-first, auditable, and built for the compliance obligations teams now actually carry.</strong><br/>
 Models are interchangeable and rented by the token. What your agents <em>remember</em> is
 yours — it is your customers' data, your retention obligations, and your audit trail. SLM
@@ -27,12 +50,12 @@ guarantee here is stated as a falsifiable invariant, tested under an adversarial
 negative control, and shipped with the harness that regenerates the evidence:
 <code>python benchmark/run_all.py --trials 200 --output-dir results/</code>. What each experiment
 does <em>not</em> exercise is stated too.</p>
-<p align="center"><code>v4.1.17</code> — one control plane: <strong>SLM-Mesh</strong> peer coordination · multi-scope memory (personal / shared / global) · profiles · Cache · Compress · 7-layer retrieval · code graph · Entity Explorer · skill evolution · Modes A/B/C · GDPR retention &amp; audit chain · bounded loops — across CLI, MCP, dashboard, the <strong>Claude plugin</strong>, the <strong>Codex add-on</strong>, and documented IDE integrations.<br/>
+<p align="center"><code>v4.1.19</code> — one control plane: <strong>SLM-Mesh</strong> peer coordination · multi-scope memory (personal / shared / global) · profiles · Cache · Compress · 7-layer retrieval · code graph · Entity Explorer · skill evolution · Modes A/B/C · GDPR retention &amp; audit chain · bounded loops — across CLI, MCP, dashboard, the <strong>Claude plugin</strong>, the <strong>Codex add-on</strong>, and documented IDE integrations.<br/>
 Proxy: <code>slm wrap claude</code> &nbsp;·&nbsp; MCP: add <code>slm_compress</code> to your config &nbsp;·&nbsp; Skill: zero-config</p>
 <p align="center"><strong>Four public arXiv preprints</strong> · V4: <a href="https://arxiv.org/abs/2608.08253">arXiv:2608.08253</a> · companion archive: <a href="https://zenodo.org/records/21853302">Zenodo 21853302</a> (<a href="https://doi.org/10.5281/zenodo.21853302">DOI 10.5281/zenodo.21853302</a>) · prior preprints: <a href="https://arxiv.org/abs/2603.02240">2603.02240</a> · <a href="https://arxiv.org/abs/2603.14588">2603.14588</a> · <a href="https://arxiv.org/abs/2604.04514">2604.04514</a>.</p>
 
 <p align="center">
-  <a href="CHANGELOG.md"><img src="https://img.shields.io/badge/v4.1.17-Current_Release-2ea44f?style=for-the-badge&logo=checkmarx&logoColor=white" alt="v4.1.17 — Current Release"/></a>
+  <a href="CHANGELOG.md"><img src="https://img.shields.io/badge/v4.1.19-Current_Release-2ea44f?style=for-the-badge&logo=checkmarx&logoColor=white" alt="v4.1.19 — Current Release"/></a>
   <a href="https://arxiv.org/abs/2608.08253"><img src="https://img.shields.io/badge/arXiv-2608.08253-b31b1b?style=for-the-badge&logo=arxiv&logoColor=white" alt="SuperLocalMemory 4.0 paper on arXiv:2608.08253"/></a>
   <a href="https://zenodo.org/records/21853302"><img src="https://img.shields.io/badge/Zenodo-10.5281%2Fzenodo.21853302-1682D4?style=for-the-badge&logo=zenodo&logoColor=white" alt="V4 paper on Zenodo: 10.5281/zenodo.21853302"/></a>
   <a href="https://arxiv.org/abs/2603.14588"><img src="https://img.shields.io/badge/arXiv-2603.14588-b31b1b?style=for-the-badge&logo=arxiv&logoColor=white" alt="arXiv Paper"/></a>
@@ -68,10 +91,10 @@ SuperLocalMemory V4 combines conventional dense and lexical retrieval with graph
 - **Multi-scope memory & profiles** — workspaces (profiles) plus `personal` / `shared` / `global` scopes; cross-profile recall is default-deny.
 - **Cache & compression (context optimization)** — exact-match cache with tagged invalidation, safe compression, and opt-in reversible/aggressive paths across proxy, MCP, and skill surfaces.
 - **Entity Explorer & skill evolution** — compiled entity summaries/timelines; opt-in skill lineage, budgets, and verification outcomes.
-- **Modes A / B / C** — local-only (A), on-device LLM enrichment (B), provider-assisted (C). An operating mode records technical locality facts; it does **not** determine EU AI Act legal compliance (that is deployment-context assessment — see [Privacy controls](#privacy-controls-and-operating-modes)).
+- **Modes A / B / C** — local-only by default (A), on-device LLM enrichment (B), provider-assisted (C). An operating mode records technical locality facts; it does **not** determine EU AI Act legal compliance (that is deployment-context assessment — see [Privacy controls](#privacy-controls-and-operating-modes)).
 - **GDPR posture, retention & audit chain** — export, fail-closed cross-store erasure, retention policies, and a hash-chained audit trail. Engineering controls for compliance programs, not a legal certification.
 - **7-layer retrieval/recall stack & code graph** — multi-channel candidates (semantic, BM25, temporal, Hopfield, spreading activation) plus optional code-graph tools for blast radius and review context.
-- **MCP profiles** — `code` exposes **31** tools for installed coding agents; `full` **49**; `power` **61**; `whole` **94** (all registered). Also `core` (16), `mesh` (8), and the unrestricted default surface (49 with mesh enabled).
+- **MCP profiles** — `code` (38 tools) for installed coding agents; `full` (54 tools); `power` (66 tools); `whole` (101 tools, all registered). Also `core` (18 tools), `mesh` (8 tools), and the unrestricted default surface — the same 54 tools as `full`.
 - **Governed write path & verifiable transactions** — admission + policy control, a per-owner obligation ledger, and a hash-sealed completion manifest with a reconciler that redrives unmet obligations.
 - **Self-healing lifecycle & admin remediation** — stale locks cleared on restart; list/resolve stuck operations from CLI, MCP, or the dashboard.
 
@@ -150,6 +173,7 @@ health surfaces expose the stages actually completed by the installed runtime.
 | **Memory boundaries** | Profile-isolated workspaces plus `personal`, `shared`, and `global` memory scopes | Personal is the default; shared/global recall requires explicit scope policy or per-call opt-in. |
 | **Ingestion** | Durable raw-to-complete operation state, fact extraction, entity resolution, graph/temporal/provenance derivations, and replay-safe identity | `--sync` waits for declared stages; dependencies and mode determine which enrichers are available. |
 | **Retrieval and recall** | Semantic, lexical, temporal, Hopfield and spreading-activation candidate channels; RRF fusion, optional reranking and graph score enhancement | Healthy channels participate; response provenance states the evidence used. |
+| **Answer check** | A check (on-device or hosted) that reports whether the top results actually answer the question, not just whether they're related | Until you choose, it runs only once an on-device install has passed its check; otherwise it is off. The hosted check runs only after you turn it on and agree. Results are never filtered or hidden because of it. See [docs/answer-check.md](docs/answer-check.md). |
 | **Brain and learning** | Behavioral patterns, feedback/outcome records, rewards, consolidation, LightGBM-related ranking components, soft prompts, and guarded skill-evolution workflows | Learning is evidence-driven; it does not claim autonomous correctness or guaranteed improvement. |
 | **Knowledge graph and entities** | Canonical entities, aliases, entity profiles, graph edges, scenes, timelines, explorer and graph APIs | Stored/derived graph data is evidence, not an instruction authority. |
 | **Scale Engine** | SQLite + sqlite-vec are canonical. CozoDB graph and LanceDB vector projections are managed with prepare → verify → promote → rollback; a structurally detected pre-v3.7 projection can be explicitly adopted. | Promotion is parity-gated and crash-recoverable. Legacy adoption preserves the prior projection as a rollback backup; repeated physical edge rows normalize to one logical edge with the strongest weight. |
@@ -379,10 +403,10 @@ Full docs: [docs/multi-machine.md](docs/multi-machine.md) · [docs/distributed-d
 | Path | Command | When |
 |:-----|:--------|:-----|
 | **npm global CLI** (primary) | `npm install -g superlocalmemory` | Node 18+; package-owned virtual environment; system Python is not modified; run `slm setup` explicitly afterward |
-| **Python CLI + SDK** (primary) | Activate a Python virtual environment, then `python -m pip install superlocalmemory` | Python 3.11+; the `slm` CLI and importable SDK stay inside that environment |
+| **Python CLI + SDK** (primary) | Activate a Python virtual environment, then `python -m pip install superlocalmemory` | Python 3.12+; the `slm` CLI and importable SDK stay inside that environment |
 | **Repository clone — macOS/Linux** | `./scripts/install.sh install` | Research/contributor path; delegates to an existing uv or pipx installation |
 | **Repository clone — Windows** | `.\scripts\install.ps1 -Action Install` | Research/contributor path; delegates to an existing uv or pipx installation |
-| **Claude Code Plugin** | `/plugin marketplace add qualixar/superlocalmemory` then `/plugin install superlocalmemory@qualixar` | Self-bootstraps venv, isolated SLM_DATA_DIR, additive — 34-tool code profile. Ships the skills/agents/hooks/commands |
+| **Claude Code Plugin** | `/plugin marketplace add qualixar/superlocalmemory` then `/plugin install superlocalmemory@qualixar` | Self-bootstraps venv, additive, no isolated data directory — reads the same store as every other install and sets no `SLM_MCP_PROFILE`, so it defaults to the same 54-tool `full` surface. Ships the skills/agents/hooks/commands |
 | **Portable / IDE connect** | `slm connect <ide> [--here]` | Wire any IDE without reinstalling; `slm connect claude-code` → plugin pointer |
 
 After any install path: `slm setup` → `slm doctor` → `slm warmup` (optional, pre-downloads ~500MB embedding model).
@@ -435,12 +459,12 @@ Control tool surface via `SLM_MCP_PROFILE`:
 
 | Profile | Tools | Use case |
 |:--------|:-----:|:---------|
-| `core` | 16 | Memory, session, optimize, and correction review |
-| `code` | 31 | Core + portable Brain evidence + code-graph tools + profile switching + bounded loops |
+| `core` | 18 | Memory, session, optimize, and correction review |
+| `code` | 38 | Core + portable Brain evidence + code-graph tools + profile switching + bounded loops + memory-kind management |
 | `mesh` | 8 | SLM-Mesh only — multi-session / multi-machine coordination |
-| `full` | 49 | Memory + portable Brain evidence + optimize + evolution + mesh + bounded loops |
-| `power` | 61 | Full + administration, lifecycle, and diagnostics |
-| `whole` | 94 | Every registered MCP tool |
+| `full` | 54 | Memory + portable Brain evidence + optimize + evolution + mesh + bounded loops + memory-kind management (also the no-profile default) |
+| `power` | 66 | Full + administration, lifecycle, and diagnostics |
+| `whole` | 101 | Every registered MCP tool |
 
 **Precedence:** `ALL` > `TOOLS` > `PROFILE` > `default`
 
@@ -491,7 +515,7 @@ Hermes users get the same SLM skills and advisor roles through a native
 `plugin.yaml` package, plus `/slm <command>` and generated `/slm-<command>`
 aliases for the public CLI surface. The plugin is intentionally separate from
 the PyPI/npm runtime: install the owning SLM runtime first, then install the
-reviewed pinned pack from the `v4.1.13` GitHub release. It is additive and does
+reviewed pinned pack from the `v4.1.19` GitHub release. It is additive and does
 not replace Hermes's selected memory provider or existing configuration. See
 [the Hermes integration guide](docs/hermes.md).
 
@@ -515,17 +539,17 @@ For the other three, replace the directory from the tag you are on.
 
 | Mode | What | Core memory path | Optional network behavior |
 |:----:|:-----|:-----------------|:--------------------------|
-| **A** | Local Guardian | Local processing | Model/dependency downloads, connectors, backup, and other enabled integrations may use the network |
+| **A** | Local Guardian | Local processing | Model/dependency downloads, connectors, backup, the online answer check, and other enabled integrations may use the network |
 | **B** | Smart Local | Local Ollama enrichment | Same optional integrations as Mode A |
 | **C** | Provider-assisted | Local storage with provider calls | Query or enrichment content is sent to the configured provider |
 
 ```bash
-slm mode a   # Zero-cloud (default)
+slm mode a   # Local only (default)
 slm mode b   # Local Ollama
 slm mode c   # Cloud LLM
 ```
 
-Mode A can run core memory operations without sending memory content to a cloud model provider. This does not disable optional connectors, cloud backup, proxy providers, dependency acquisition, or model downloads; review configuration and network policy for the deployment.
+Mode A can run core memory operations without sending memory content to a cloud model provider. This does not disable optional connectors, cloud backup, proxy providers, dependency acquisition, or model downloads; review configuration and network policy for the deployment. Memory content leaves the machine in two opt-in cases, not one. The online answer check: off unless you turn it on and agree, in any mode, and while it is on each recall sends its question and top memories to the provider you chose — the dashboard and the MCP `get_mode` tool say so. Jev memory-kind typing: off unless the answer check is already using Jev AND you separately consent to kind typing — both must be the literal boolean `true` — and while it is on, a memory's content (not just the recall question) is sent to Jev to suggest its kind.
 
 SuperLocalMemory provides local storage, export/erasure commands, provenance, policy, and audit features that can support a compliance program. The software is not a legal certification, and compliance depends on the use case, operator, configuration, and surrounding systems.
 

package/bin/slm-npm

@@ -28,7 +28,7 @@ if (!fs.existsSync(runtimePython)) {
   console.error(`Expected the package-owned interpreter at: ${runtimePython}`);
   console.error('Repair it without touching system Python by running:');
   console.error('  npm rebuild superlocalmemory');
-  console.error('If Python is missing, install Python 3.11-3.14 first.');
+  console.error('If Python is missing, install Python 3.12-3.14 first.');
   process.exit(1);
 }
 

package/ide/configs/cursor-mcp.json

@@ -6,7 +6,10 @@
         "mcp"
       ],
       "description": "SuperLocalMemory V3 - Local memory system with mathematical foundations and knowledge graphs",
-      "type": "stdio"
+      "type": "stdio",
+      "env": {
+        "SLM_MCP_PROFILE": "code"
+      }
     }
   }
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "superlocalmemory",
-  "version": "4.1.17",
+  "version": "4.1.19",
   "description": "Local-first agent memory with MCP and an agent-native CLI. Documented clients include Claude Code, Cursor, and Windsurf.",
   "keywords": [
     "ai-memory",

package/plugin/.claude-plugin/plugin.json

@@ -3,7 +3,7 @@
     "name": "Qualixar",
     "url": "https://github.com/qualixar/superlocalmemory"
   },
-  "description": "Local-first agent memory + reversible context compression and KV cache, as an MCP server. 34-tool code profile with graph intelligence.",
+  "description": "Local-first agent memory + reversible context compression and KV cache, as an MCP server. 38-tool code profile with graph intelligence.",
   "displayName": "SuperLocalMemory",
   "keywords": [
     "memory",
@@ -15,5 +15,5 @@
   "mcpServers": "./.mcp.json",
   "name": "superlocalmemory",
   "repository": "https://github.com/qualixar/superlocalmemory",
-  "version": "4.1.17"
+  "version": "4.1.19"
 }

package/plugin/CLAUDE.md

@@ -1,8 +1,8 @@
-<!-- BEGIN SuperLocalMemory v4.1.17 -->
+<!-- BEGIN SuperLocalMemory v4.1.19 -->
 
 ## SuperLocalMemory (SLM) — Agent Rules
 
-SLM is local-first memory for agents. All tools run on the user's machine; no cloud calls.
+SLM is local-first memory for agents. All tools run on the user's machine; nothing goes to the cloud unless the user chose Mode C, turned on the online answer check, or separately opted into Jev memory-kind typing (its own consent, on top of the answer check already using Jev).
 
 ### Session start
 Call `session_init(project_path, query)` ONCE per fresh session before any recall/remember. Never twice.
@@ -17,6 +17,7 @@ Call `session_init(project_path, query)` ONCE per fresh session before any recal
 ### Recall
 - `recall` for conceptual/semantic queries; `search` for exact keywords.
 - Phrase as concepts; pass session_id when available. Never fabricate.
+- If `abstained` is `true`, the returned memories do not answer the question — say so, or ask; never present them as the answer. `answer_confidence` is a measurement, not a guarantee.
 
 ### Optimize (fail-open)
 - Output >2000 chars → `slm_compress(mode="auto", reversible=True)`; keep ccr_id if lossy.
@@ -39,6 +40,6 @@ slm-recall · slm-remember · slm-session · slm-status · slm-cache · slm-comp
 ### Subagents
 slm-memory-advisor (memory decisions, session hygiene, scope/profile guidance) · slm-optimize-advisor (context compression + KV cache) · slm-governance-advisor (scope/roles/compliance/GDPR)
 
-<!-- END SuperLocalMemory v4.1.17 -->
+<!-- END SuperLocalMemory v4.1.19 -->
 
-SuperLocalMemory v4.1.17 · Qualixar · AGPL-3.0-or-later
+SuperLocalMemory v4.1.19 · Qualixar · AGPL-3.0-or-later

package/plugin/agents/slm-governance-advisor.md

@@ -77,4 +77,4 @@ slm-scope · slm-governance · slm-profile · slm-remember · slm-recall
 # What NOT to do
 Never session_init twice; never forget without dry-run preview; never store secrets; never bypass role checks; never claim an erasure succeeded without verifying via recall.
 
-SuperLocalMemory v4.1.17 · Qualixar · AGPL-3.0-or-later
+SuperLocalMemory v4.1.19 · Qualixar · AGPL-3.0-or-later

package/plugin/agents/slm-loop-runner.md

@@ -68,4 +68,4 @@ assessment. The gate is the authority.
 
 ---
 
-SuperLocalMemory v4.1.17 · Qualixar · AGPL-3.0-or-later
+SuperLocalMemory v4.1.19 · Qualixar · AGPL-3.0-or-later

package/plugin/agents/slm-memory-advisor.md

@@ -17,7 +17,7 @@ When the main agent: starts a session and hasn't loaded project context; is abou
 
 # Tools you may use (real SLM MCP tools, core profile)
 - `session_init(project_path, query, max_results, max_age_days)` — ONCE at session start; returns recent decisions + relevant memories.
-- `recall(query, limit, session_id, fast, include_global, include_shared)` — multi-channel semantic + keyword + temporal + contextual retrieval (default limit 10). Leave `include_global`/`include_shared` unset — recall is private-by-default (v3.6.15). Returns fast local results (~1–2s, no server-side LLM round) plus confidence signals: if `no_confident_match` is true or `answer_confidence` is low, advise the main agent to rewrite into 1–3 sharper sub-queries and recall again rather than treating the memory as absent.
+- `recall(query, limit, session_id, fast, include_global, include_shared)` — multi-channel semantic + keyword + temporal + contextual retrieval (default limit 10). Leave `include_global`/`include_shared` unset — recall is private-by-default (v3.6.15). Returns results from this machine in about 1–2 s (no server-side LLM round unless the user turned on the online answer check, which adds one request per recall) plus confidence signals: if `no_confident_match` is true or `answer_confidence` is low, advise the main agent to rewrite into 1–3 sharper sub-queries and recall again rather than treating the memory as absent.
 - `search(query, limit, profile_id)` — exact keyword / FTS5 BM25.
 - `remember(content, tags, project, importance, session_id, scope, shared_with)` — store atomic fact; importance 1-10. Leave `scope` unset (defaults to `personal`/private).
 - `update_memory(fact_id, content)` — correct by exact id.
@@ -32,10 +32,11 @@ When the main agent: starts a session and hasn't loaded project context; is abou
 4. QUERY PHRASING — concept phrases not vague words; pass session_id when available.
 5. recall vs search — recall for conceptual; search for literal keyword.
 6. EMPTY/LOW results → broaden, try search, or list_recent; never fabricate.
-7. SESSION END — close_session(session_id) when work meaningfully complete.
-8. SCOPE IS OPT-IN (v3.6.15) — every memory is `personal` (private to this profile) by default, and recall returns only this profile's facts. Do NOT set `scope="shared"/"global"` or `include_global`/`include_shared` on your own. Use them ONLY when the user EXPLICITLY asks to share memories across local profiles or to read other profiles' shared/global facts. Default behaviour is identical to single-profile SLM. See slm-scope for the complete sharing model.
-9. PROFILE CONTEXT (v3.8.0) — session_init and all memory ops use the active profile. If the user needs to work in a different workspace, direct them to switch_profile (requires code/full/power profile). See slm-profile.
-10. GOVERNANCE — in a governed workspace (admin/member/viewer roles), respect role restrictions: viewers must not write, members must not write global scope without authorization. See slm-governance.
+7. ABSTAINED MEANS DON'T ANSWER FROM THESE — if `abstained` is `true`, the memories `recall`/`session_init` returned do not answer the question; say you don't have it, or ask, never present them as the answer. `answer_confidence` is a measurement, not a guarantee.
+8. SESSION END — close_session(session_id) when work meaningfully complete.
+9. SCOPE IS OPT-IN (v3.6.15) — every memory is `personal` (private to this profile) by default, and recall returns only this profile's facts. Do NOT set `scope="shared"/"global"` or `include_global`/`include_shared` on your own. Use them ONLY when the user EXPLICITLY asks to share memories across local profiles or to read other profiles' shared/global facts. Default behaviour is identical to single-profile SLM. See slm-scope for the complete sharing model.
+10. PROFILE CONTEXT (v3.8.0) — session_init and all memory ops use the active profile. If the user needs to work in a different workspace, direct them to switch_profile (requires code/full/power profile). See slm-profile.
+11. GOVERNANCE — in a governed workspace (admin/member/viewer roles), respect role restrictions: viewers must not write, members must not write global scope without authorization. See slm-governance.
 
 # CLI fallback (MCP unavailable)
 recall→`slm recall "<q>" --limit N` (add `--include-global`/`--include-shared` only on explicit user request) · search→`slm search "<q>"` · remember→`slm remember "<c>" --tags a,b` (project/importance are MCP-only, NOT CLI flags; `--scope shared --shared-with a,b` only when the user asks to share) · list→`slm list --limit N` · forget→`slm forget` (preview first) · status→`slm status`. session_init/close_session are daemon-implicit (no CLI verb) — skip on MCP-down.
@@ -46,4 +47,4 @@ slm-recall · slm-remember · slm-session · slm-scope · slm-profile · slm-gov
 # What NOT to do
 Never session_init twice; never forget dry_run=False without reporting preview; never dump a whole file into remember; never invent a memory; never claim "saved" without success:true / clean CLI exit; never bypass scope or governance restrictions.
 
-SuperLocalMemory v4.1.17 · Qualixar · AGPL-3.0-or-later
+SuperLocalMemory v4.1.19 · Qualixar · AGPL-3.0-or-later

package/plugin/agents/slm-optimize-advisor.md

@@ -41,4 +41,4 @@ slm-compress · slm-cache · slm-status · slm-profile
 # What NOT to do
 Never compress code-for-edit/JSON-to-parse/<500 chars; never store secrets/ccr_ids; never let optimize failure block/alter the task; never claim a specific savings %; never carry ccr_ids across profile switches.
 
-SuperLocalMemory v4.1.17 · Qualixar · AGPL-3.0-or-later
+SuperLocalMemory v4.1.19 · Qualixar · AGPL-3.0-or-later

package/plugin/requirements.txt

@@ -1 +1 @@
-superlocalmemory==4.1.17
+superlocalmemory==4.1.19

package/plugin/scripts/ensure-venv.bat

@@ -12,7 +12,7 @@
 :: Exit codes: 0 = venv ready   non-0 = failure (logged to stderr)
 :: All informational output goes to stderr (stdout reserved for MCP stdio protocol).
 ::
-:: Requires: Python 3.11+ on PATH, pip, standard Windows cmd.exe
+:: Requires: Python 3.12+ on PATH, pip, standard Windows cmd.exe
 
 setlocal EnableDelayedExpansion
 
@@ -29,13 +29,13 @@ if not defined CLAUDE_PLUGIN_DATA (
 )
 
 :: ---------------------------------------------------------------------------
-:: Python >= 3.11 guard
+:: Python >= 3.12 guard
 :: ---------------------------------------------------------------------------
-python -c "import sys; sys.exit(0 if sys.version_info >= (3, 11) else 1)" 2>nul
+python -c "import sys; sys.exit(0 if sys.version_info >= (3, 12) else 1)" 2>nul
 if errorlevel 1 (
     for /f "tokens=*" %%v in ('python --version 2^>^&1') do set PY_VER=%%v
-    echo ERROR: SuperLocalMemory plugin requires Python ^>= 3.11, found: !PY_VER! >&2
-    echo Install Python 3.11+ and ensure it is first on PATH. >&2
+    echo ERROR: SuperLocalMemory plugin requires Python ^>= 3.12, found: !PY_VER! >&2
+    echo Install Python 3.12+ and ensure it is first on PATH. >&2
     exit /b 1
 )
 

package/plugin/scripts/ensure-venv.sh

@@ -25,12 +25,12 @@ set -euo pipefail
 exec 1>&2
 
 # ---------------------------------------------------------------------------
-# Python >= 3.11 guard
+# Python >= 3.12 guard
 # ---------------------------------------------------------------------------
-if ! python3 -c "import sys; sys.exit(0 if sys.version_info >= (3, 11) else 1)" 2>/dev/null; then
+if ! python3 -c "import sys; sys.exit(0 if sys.version_info >= (3, 12) else 1)" 2>/dev/null; then
     PY_VER=$(python3 --version 2>&1 || echo "unknown")
-    echo "ERROR: SuperLocalMemory plugin requires Python >= 3.11, found: ${PY_VER}" >&2
-    echo "Install Python 3.11+ and ensure it is first on PATH." >&2
+    echo "ERROR: SuperLocalMemory plugin requires Python >= 3.12, found: ${PY_VER}" >&2
+    echo "Install Python 3.12+ and ensure it is first on PATH." >&2
     exit 1
 fi
 

package/plugin/skills/slm-cache/SKILL.md

@@ -145,4 +145,4 @@ These subcommands control daemon-level cache settings. They do not read or write
 
 ---
 
-SuperLocalMemory v4.1.17 · Qualixar · AGPL-3.0-or-later
+SuperLocalMemory v4.1.19 · Qualixar · AGPL-3.0-or-later

package/plugin/skills/slm-compress/SKILL.md

@@ -147,4 +147,4 @@ Content over 1 MB (1 000 000 bytes UTF-8) is processed but `reversible` is force
 
 ---
 
-SuperLocalMemory v4.1.17 · Qualixar · AGPL-3.0-or-later
+SuperLocalMemory v4.1.19 · Qualixar · AGPL-3.0-or-later

package/plugin/skills/slm-governance/SKILL.md

@@ -245,4 +245,4 @@ Before running any destructive operation (`forget`, `compact_memories`):
 
 ---
 
-*SuperLocalMemory v4.1.17 · Qualixar · AGPL-3.0-or-later*
+*SuperLocalMemory v4.1.19 · Qualixar · AGPL-3.0-or-later*

package/plugin/skills/slm-graph/SKILL.md

@@ -312,4 +312,4 @@ profile. See `slm-profile` for the full profile switching workflow.
 
 ---
 
-SuperLocalMemory v4.1.17 · Qualixar · AGPL-3.0-or-later
+SuperLocalMemory v4.1.19 · Qualixar · AGPL-3.0-or-later

package/plugin/skills/slm-loop/SKILL.md

@@ -96,4 +96,4 @@ paused, name the approval needed; when errored, quote the short detail.
 
 ---
 
-SuperLocalMemory v4.1.17 · Qualixar · AGPL-3.0-or-later
+SuperLocalMemory v4.1.19 · Qualixar · AGPL-3.0-or-later

package/plugin/skills/slm-mesh/SKILL.md

@@ -279,4 +279,4 @@ mesh availability.
 
 ---
 
-*SuperLocalMemory v4.1.17 · Qualixar · AGPL-3.0-or-later*
+*SuperLocalMemory v4.1.19 · Qualixar · AGPL-3.0-or-later*

package/plugin/skills/slm-profile/SKILL.md

@@ -31,9 +31,9 @@ project, a client engagement, a production vs staging environment.
 | Profile | Tools | When to use |
 |---------|-------|-------------|
 | `core` | 18 tools — remember, recall, search, session, optimize | Minimal footprint, no code tools |
-| `code` | 34 tools — core + portable Brain evidence + code graph + profile switching + bounded loops | Default for IDE/coding agents |
-| `full` | 50 tools — code + all memory ops + mesh + bounded loops | Multi-session, team workflows |
-| `power` | 62 tools — full + governance + behavioral tools | Enterprise, admin, audit use cases |
+| `code` | 38 tools — core + portable Brain evidence + code graph + profile switching + bounded loops + memory-kind management | Default for IDE/coding agents |
+| `full` | 54 tools — code + all memory ops + mesh + bounded loops | Multi-session, team workflows |
+| `power` | 66 tools — full + governance + behavioral tools | Enterprise, admin, audit use cases |
 | `mesh` | 8 tools — mesh coordination only | Lightweight cross-session signalling |
 
 The profile is set at MCP server startup via `SLM_MCP_PROFILE` in the MCP config.
@@ -146,4 +146,4 @@ Name them differently in your MCP config (e.g. `superlocalmemory-personal` and
 
 ---
 
-*SuperLocalMemory v4.1.17 · Qualixar · AGPL-3.0-or-later*
+*SuperLocalMemory v4.1.19 · Qualixar · AGPL-3.0-or-later*

package/plugin/skills/slm-recall/SKILL.md

@@ -93,7 +93,12 @@ Real response shape (`--json` equivalent):
   },
   "incomplete_channels": [],
   "retrieval_time_ms": 134,
-  "no_confident_match": false
+  "no_confident_match": false,
+  "calibration_status": "uncalibrated",
+  "calibration_id": null,
+  "answer_confidence": null,
+  "abstained": false,
+  "abstention_reason": null
 }
 ```
 
@@ -124,7 +129,9 @@ rest come back empty.
 say so to the user rather than reporting "no memories found". `incomplete_channels`
 carries the same warning as a plain list.
 
-**Refine on low confidence.** `recall` returns confidence signals with every result. If `no_confident_match` is `true` (or `answer_confidence` is low / `abstained` is `true`), do NOT invent a memory — rewrite the query into 1–3 more specific sub-queries (split multi-hop questions; try entity names, synonyms, or broader phrasing) and call `recall` again before concluding nothing was found. A confident match → use it directly. SLM returns fast local results (~1–2s, no server-side LLM round on the hot path) and lets you, the calling model, drive this refinement.
+**Refine on low confidence.** `recall` returns confidence signals with every result. If `no_confident_match` is `true` (or `answer_confidence` is low / `abstained` is `true`), do NOT invent a memory — rewrite the query into 1–3 more specific sub-queries (split multi-hop questions; try entity names, synonyms, or broader phrasing) and call `recall` again before concluding nothing was found. A confident match → use it directly. SLM answers from this machine in about 1–2 s, with no server-side LLM round — unless the user turned on the online answer check, which adds one request to that service per recall — and lets you, the calling model, drive this refinement.
+
+**`abstained` means the results shown do not answer the question.** If `abstained` is `true`, say you don't have it, or ask — never present the returned memories as the answer anyway. `abstention_reason` distinguishes why: `"judged_insufficient"` means candidates were found and scored, but none of them actually answers this question; `"evidence_floor"` / `"no_candidates"` means nothing was found at all. `answer_confidence` is a measurement, not a guarantee — treat a low number the same way you'd treat `abstained: true`. `calibration_status: "uncalibrated"` means no judge is configured for this recall; in that case `abstained` only ever reflects the older "nothing found" signal.
 
 ### 2. Passing session_id
 
@@ -323,4 +330,4 @@ before recalling, then switch back. See `slm-profile` for workspace switching.
 
 ---
 
-*SuperLocalMemory v4.1.17 · Qualixar · AGPL-3.0-or-later*
+*SuperLocalMemory v4.1.19 · Qualixar · AGPL-3.0-or-later*

package/plugin/skills/slm-remember/SKILL.md

@@ -270,4 +270,4 @@ different workspace, use `switch_profile` first. See `slm-profile`.
 
 ---
 
-*SuperLocalMemory v4.1.17 · Qualixar · AGPL-3.0-or-later*
+*SuperLocalMemory v4.1.19 · Qualixar · AGPL-3.0-or-later*

package/plugin/skills/slm-scope/SKILL.md

@@ -173,4 +173,4 @@ to review the impact. See `slm-remember` for the full deletion discipline.
 
 ---
 
-*SuperLocalMemory v4.1.17 · Qualixar · AGPL-3.0-or-later*
+*SuperLocalMemory v4.1.19 · Qualixar · AGPL-3.0-or-later*

package/plugin/skills/slm-session/SKILL.md

@@ -92,6 +92,11 @@ session_init(
   "core_memory": [],
   "degraded_mode": false,
   "retrieval_mode": "full_6_channel",
+  "calibration_status": "uncalibrated",
+  "calibration_id": null,
+  "answer_confidence": null,
+  "abstained": false,
+  "abstention_reason": null,
   "learning": {
     "feedback_signals": 37,
     "phase": 1,
@@ -104,6 +109,16 @@ session_init(
 FTS5 BM25 was used — semantic, graph, temporal, and structural channels were
 unavailable. The context is still usable; note the degradation if relevant.
 
+**Check `abstained`.** If `true`, the memories returned in `context` and
+`memories` do not answer the query that seeded this session — say so, or
+ask, rather than presenting them as settled fact. This is most relevant
+when you passed an explicit `query`; the default project-context query
+rarely has a single "right answer" for a judge to evaluate.
+`answer_confidence` is a measurement, not a guarantee. `calibration_status:
+"uncalibrated"` means no judge is configured, and `abstained` then only
+reflects the older "nothing found" signal. See `slm-recall` for the full
+rule, which applies identically here.
+
 **Check `learning.phase`:**
 - Phase 1 (< 50 signals): collecting baseline feedback
 - Phase 2 (50–199 signals): active learning
@@ -253,4 +268,4 @@ explicitly and call `recall` with `include_global`/`include_shared` after
 
 ---
 
-*SuperLocalMemory v4.1.17 · Qualixar · AGPL-3.0-or-later*
+*SuperLocalMemory v4.1.19 · Qualixar · AGPL-3.0-or-later*

package/plugin/skills/slm-status/SKILL.md

@@ -163,4 +163,4 @@ multi-profile setup. To switch the active profile, see `slm-profile`.
 
 ---
 
-SuperLocalMemory v4.1.17 · Qualixar · AGPL-3.0-or-later
+SuperLocalMemory v4.1.19 · Qualixar · AGPL-3.0-or-later

package/plugin-src/agents/slm-memory-advisor.md

@@ -17,7 +17,7 @@ When the main agent: starts a session and hasn't loaded project context; is abou
 
 # Tools you may use (real SLM MCP tools, core profile)
 - `session_init(project_path, query, max_results, max_age_days)` — ONCE at session start; returns recent decisions + relevant memories.
-- `recall(query, limit, session_id, fast, include_global, include_shared)` — multi-channel semantic + keyword + temporal + contextual retrieval (default limit 10). Leave `include_global`/`include_shared` unset — recall is private-by-default (v3.6.15). Returns fast local results (~1–2s, no server-side LLM round) plus confidence signals: if `no_confident_match` is true or `answer_confidence` is low, advise the main agent to rewrite into 1–3 sharper sub-queries and recall again rather than treating the memory as absent.
+- `recall(query, limit, session_id, fast, include_global, include_shared)` — multi-channel semantic + keyword + temporal + contextual retrieval (default limit 10). Leave `include_global`/`include_shared` unset — recall is private-by-default (v3.6.15). Returns results from this machine in about 1–2 s (no server-side LLM round unless the user turned on the online answer check, which adds one request per recall) plus confidence signals: if `no_confident_match` is true or `answer_confidence` is low, advise the main agent to rewrite into 1–3 sharper sub-queries and recall again rather than treating the memory as absent.
 - `search(query, limit, profile_id)` — exact keyword / FTS5 BM25.
 - `remember(content, tags, project, importance, session_id, scope, shared_with)` — store atomic fact; importance 1-10. Leave `scope` unset (defaults to `personal`/private).
 - `update_memory(fact_id, content)` — correct by exact id.
@@ -32,10 +32,11 @@ When the main agent: starts a session and hasn't loaded project context; is abou
 4. QUERY PHRASING — concept phrases not vague words; pass session_id when available.
 5. recall vs search — recall for conceptual; search for literal keyword.
 6. EMPTY/LOW results → broaden, try search, or list_recent; never fabricate.
-7. SESSION END — close_session(session_id) when work meaningfully complete.
-8. SCOPE IS OPT-IN (v3.6.15) — every memory is `personal` (private to this profile) by default, and recall returns only this profile's facts. Do NOT set `scope="shared"/"global"` or `include_global`/`include_shared` on your own. Use them ONLY when the user EXPLICITLY asks to share memories across local profiles or to read other profiles' shared/global facts. Default behaviour is identical to single-profile SLM. See slm-scope for the complete sharing model.
-9. PROFILE CONTEXT (v3.8.0) — session_init and all memory ops use the active profile. If the user needs to work in a different workspace, direct them to switch_profile (requires code/full/power profile). See slm-profile.
-10. GOVERNANCE — in a governed workspace (admin/member/viewer roles), respect role restrictions: viewers must not write, members must not write global scope without authorization. See slm-governance.
+7. ABSTAINED MEANS DON'T ANSWER FROM THESE — if `abstained` is `true`, the memories `recall`/`session_init` returned do not answer the question; say you don't have it, or ask, never present them as the answer. `answer_confidence` is a measurement, not a guarantee.
+8. SESSION END — close_session(session_id) when work meaningfully complete.
+9. SCOPE IS OPT-IN (v3.6.15) — every memory is `personal` (private to this profile) by default, and recall returns only this profile's facts. Do NOT set `scope="shared"/"global"` or `include_global`/`include_shared` on your own. Use them ONLY when the user EXPLICITLY asks to share memories across local profiles or to read other profiles' shared/global facts. Default behaviour is identical to single-profile SLM. See slm-scope for the complete sharing model.
+10. PROFILE CONTEXT (v3.8.0) — session_init and all memory ops use the active profile. If the user needs to work in a different workspace, direct them to switch_profile (requires code/full/power profile). See slm-profile.
+11. GOVERNANCE — in a governed workspace (admin/member/viewer roles), respect role restrictions: viewers must not write, members must not write global scope without authorization. See slm-governance.
 
 # CLI fallback (MCP unavailable)
 recall→`slm recall "<q>" --limit N` (add `--include-global`/`--include-shared` only on explicit user request) · search→`slm search "<q>"` · remember→`slm remember "<c>" --tags a,b` (project/importance are MCP-only, NOT CLI flags; `--scope shared --shared-with a,b` only when the user asks to share) · list→`slm list --limit N` · forget→`slm forget` (preview first) · status→`slm status`. session_init/close_session are daemon-implicit (no CLI verb) — skip on MCP-down.
@@ -46,4 +47,4 @@ slm-recall · slm-remember · slm-session · slm-scope · slm-profile · slm-gov
 # What NOT to do
 Never session_init twice; never forget dry_run=False without reporting preview; never dump a whole file into remember; never invent a memory; never claim "saved" without success:true / clean CLI exit; never bypass scope or governance restrictions.
 
-SuperLocalMemory v4.1.17 · Qualixar · AGPL-3.0-or-later
+SuperLocalMemory v4.1.19 · Qualixar · AGPL-3.0-or-later

package/plugin-src/agents/slm-optimize-advisor.md

@@ -41,4 +41,4 @@ slm-compress · slm-cache · slm-status · slm-profile
 # What NOT to do
 Never compress code-for-edit/JSON-to-parse/<500 chars; never store secrets/ccr_ids; never let optimize failure block/alter the task; never claim a specific savings %; never carry ccr_ids across profile switches.
 
-SuperLocalMemory v4.1.17 · Qualixar · AGPL-3.0-or-later
+SuperLocalMemory v4.1.19 · Qualixar · AGPL-3.0-or-later

package/plugin-src/rules/AGENTS.md

@@ -28,7 +28,8 @@ Call `session_init(project_path, query, max_results, max_age_days)` **once** at
 - **Concept phrasing** — phrase queries as concepts, not vague words ("database migration strategy" not "database").
 - **Pass session_id** when available to narrow results to the current session.
 - **Empty / low results** — broaden the query, try `search`, or fall back to `list_recent`. Never fabricate a memory.
-- **Refine on low confidence** — if `no_confident_match` is `true` (or `answer_confidence` is low / `abstained` is `true`), rewrite the query into 1–3 more specific sub-queries (split multi-hop questions; try entity names, synonyms, or broader phrasing) and call `recall` again before concluding nothing was found. SLM returns fast local results (~1–2s, no server-side LLM round on the hot path) — you, the calling model, drive refinement.
+- **Refine on low confidence** — if `no_confident_match` is `true` (or `answer_confidence` is low / `abstained` is `true`), rewrite the query into 1–3 more specific sub-queries (split multi-hop questions; try entity names, synonyms, or broader phrasing) and call `recall` again before concluding nothing was found. SLM answers from this machine in about 1–2 s, with no server-side LLM round — unless the user turned on the online answer check, which adds one request to that service per recall. You, the calling model, drive refinement.
+- **Abstained means do not answer from these** — if `abstained` is `true`, the returned memories do not answer the question: say you don't have it, or ask. Never present them as the answer. `answer_confidence` is a measurement, not a guarantee. `abstention_reason: "judged_insufficient"` means candidates were found but none answers; `"evidence_floor"`/`"no_candidates"` means nothing was found.
 
 ---
 
@@ -82,16 +83,27 @@ When the SLM MCP server is unavailable, use these CLI equivalents:
 
 ## Tool reference (core profile — 18 tools)
 
-> The MCP config ships `SLM_MCP_PROFILE=code` and `SLM_AGENT_ID=claude_code` (34 tools):
-> the 18 core tools below **plus** 6 code-graph tools (`build_code_graph`,
-> `get_blast_radius`, `query_graph`, `semantic_search_code`, `get_review_context`,
-> `detect_changes`), 5 portable-evidence tools (`get_brain_evidence_status`,
-> `record_agent_experience`, `record_cognitive_turn`, `finalize_cognitive_turn`,
-> `observe_bounded_loop_evidence`), 3 bounded-loop tools (`slm_loop_run`,
-> `slm_loop_history`, `slm_loop_show`) and 2 usefulness reports (`report_outcome`,
-> `report_feedback`).
-> Use `full` (50 tools) to add mesh coordination. Use `power` (62 tools) for governance
-> and audit tools. See slm-profile for profile switching.
+> The MCP config ships only `SLM_AGENT_ID=claude_code` — no `SLM_MCP_PROFILE` —
+> so it falls back to the same no-profile default every install gets: the
+> 54-tool `full` surface. That is the 18 core tools below **plus** mesh
+> coordination (8: `mesh_summary`, `mesh_peers`, `mesh_send`, `mesh_inbox`,
+> `mesh_state`, `mesh_lock`, `mesh_events`, `mesh_status`), portable-evidence
+> tools (5: `get_brain_evidence_status`, `record_agent_experience`,
+> `record_cognitive_turn`, `finalize_cognitive_turn`,
+> `observe_bounded_loop_evidence`), memory-kind tools (4: `set_memory_kind`,
+> `memory_kinds_status`, `review_memory_kinds`, `confirm_memory_kinds`),
+> bounded-loop tools (3: `slm_loop_run`, `slm_loop_history`, `slm_loop_show`),
+> usefulness reports (2: `report_outcome`, `report_feedback`) and 14 more
+> administration/learning tools (`delete_memory`, `get_status`, `observe`,
+> `run_maintenance`, `consolidate_cognitive`, `get_soft_prompts`, `set_mode`,
+> `log_tool_event`, `get_assertions`, `reinforce_assertion`,
+> `contradict_assertion`, `evolve_skill`, `skill_health`, `skill_lineage`).
+> Set `SLM_MCP_PROFILE=code` yourself for the narrower 38-tool `code` surface,
+> which trades mesh and administration tools for 6 code-graph tools
+> (`build_code_graph`, `get_blast_radius`, `query_graph`,
+> `semantic_search_code`, `get_review_context`, `detect_changes`). Use
+> `power` (66 tools) for governance and audit tools. See slm-profile for
+> profile switching.
 
 | Tool               | Signature (key params)                                                                       | Notes                                  |
 |--------------------|----------------------------------------------------------------------------------------------|----------------------------------------|
@@ -137,4 +149,4 @@ When the SLM MCP server is unavailable, use these CLI equivalents:
 - **slm-optimize-advisor** — context compression and KV cache
 - **slm-governance-advisor** — scope/role compliance, retention policies, GDPR
 
-SuperLocalMemory v4.1.17 · Qualixar · AGPL-3.0-or-later
+SuperLocalMemory v4.1.19 · Qualixar · AGPL-3.0-or-later

package/plugin-src/skills/slm-cache/SKILL.md

@@ -145,4 +145,4 @@ These subcommands control daemon-level cache settings. They do not read or write
 
 ---
 
-SuperLocalMemory v4.1.17 · Qualixar · AGPL-3.0-or-later
+SuperLocalMemory v4.1.19 · Qualixar · AGPL-3.0-or-later

package/plugin-src/skills/slm-compress/SKILL.md

@@ -147,4 +147,4 @@ Content over 1 MB (1 000 000 bytes UTF-8) is processed but `reversible` is force
 
 ---
 
-SuperLocalMemory v4.1.17 · Qualixar · AGPL-3.0-or-later
+SuperLocalMemory v4.1.19 · Qualixar · AGPL-3.0-or-later

package/plugin-src/skills/slm-governance/SKILL.md

@@ -245,4 +245,4 @@ Before running any destructive operation (`forget`, `compact_memories`):
 
 ---
 
-*SuperLocalMemory v4.1.17 · Qualixar · AGPL-3.0-or-later*
+*SuperLocalMemory v4.1.19 · Qualixar · AGPL-3.0-or-later*

package/plugin-src/skills/slm-graph/SKILL.md

@@ -312,4 +312,4 @@ profile. See `slm-profile` for the full profile switching workflow.
 
 ---
 
-SuperLocalMemory v4.1.17 · Qualixar · AGPL-3.0-or-later
+SuperLocalMemory v4.1.19 · Qualixar · AGPL-3.0-or-later

package/plugin-src/skills/slm-loop/SKILL.md

@@ -96,4 +96,4 @@ paused, name the approval needed; when errored, quote the short detail.
 
 ---
 
-SuperLocalMemory v4.1.17 · Qualixar · AGPL-3.0-or-later
+SuperLocalMemory v4.1.19 · Qualixar · AGPL-3.0-or-later

package/plugin-src/skills/slm-mesh/SKILL.md

@@ -279,4 +279,4 @@ mesh availability.
 
 ---
 
-*SuperLocalMemory v4.1.17 · Qualixar · AGPL-3.0-or-later*
+*SuperLocalMemory v4.1.19 · Qualixar · AGPL-3.0-or-later*

package/plugin-src/skills/slm-profile/SKILL.md

@@ -31,9 +31,9 @@ project, a client engagement, a production vs staging environment.
 | Profile | Tools | When to use |
 |---------|-------|-------------|
 | `core` | 18 tools — remember, recall, search, session, optimize | Minimal footprint, no code tools |
-| `code` | 34 tools — core + portable Brain evidence + code graph + profile switching + bounded loops | Default for IDE/coding agents |
-| `full` | 50 tools — code + all memory ops + mesh + bounded loops | Multi-session, team workflows |
-| `power` | 62 tools — full + governance + behavioral tools | Enterprise, admin, audit use cases |
+| `code` | 38 tools — core + portable Brain evidence + code graph + profile switching + bounded loops + memory-kind management | Default for IDE/coding agents |
+| `full` | 54 tools — code + all memory ops + mesh + bounded loops | Multi-session, team workflows |
+| `power` | 66 tools — full + governance + behavioral tools | Enterprise, admin, audit use cases |
 | `mesh` | 8 tools — mesh coordination only | Lightweight cross-session signalling |
 
 The profile is set at MCP server startup via `SLM_MCP_PROFILE` in the MCP config.
@@ -146,4 +146,4 @@ Name them differently in your MCP config (e.g. `superlocalmemory-personal` and
 
 ---
 
-*SuperLocalMemory v4.1.17 · Qualixar · AGPL-3.0-or-later*
+*SuperLocalMemory v4.1.19 · Qualixar · AGPL-3.0-or-later*

package/plugin-src/skills/slm-recall/SKILL.md

@@ -93,7 +93,12 @@ Real response shape (`--json` equivalent):
   },
   "incomplete_channels": [],
   "retrieval_time_ms": 134,
-  "no_confident_match": false
+  "no_confident_match": false,
+  "calibration_status": "uncalibrated",
+  "calibration_id": null,
+  "answer_confidence": null,
+  "abstained": false,
+  "abstention_reason": null
 }
 ```
 
@@ -124,7 +129,9 @@ rest come back empty.
 say so to the user rather than reporting "no memories found". `incomplete_channels`
 carries the same warning as a plain list.
 
-**Refine on low confidence.** `recall` returns confidence signals with every result. If `no_confident_match` is `true` (or `answer_confidence` is low / `abstained` is `true`), do NOT invent a memory — rewrite the query into 1–3 more specific sub-queries (split multi-hop questions; try entity names, synonyms, or broader phrasing) and call `recall` again before concluding nothing was found. A confident match → use it directly. SLM returns fast local results (~1–2s, no server-side LLM round on the hot path) and lets you, the calling model, drive this refinement.
+**Refine on low confidence.** `recall` returns confidence signals with every result. If `no_confident_match` is `true` (or `answer_confidence` is low / `abstained` is `true`), do NOT invent a memory — rewrite the query into 1–3 more specific sub-queries (split multi-hop questions; try entity names, synonyms, or broader phrasing) and call `recall` again before concluding nothing was found. A confident match → use it directly. SLM answers from this machine in about 1–2 s, with no server-side LLM round — unless the user turned on the online answer check, which adds one request to that service per recall — and lets you, the calling model, drive this refinement.
+
+**`abstained` means the results shown do not answer the question.** If `abstained` is `true`, say you don't have it, or ask — never present the returned memories as the answer anyway. `abstention_reason` distinguishes why: `"judged_insufficient"` means candidates were found and scored, but none of them actually answers this question; `"evidence_floor"` / `"no_candidates"` means nothing was found at all. `answer_confidence` is a measurement, not a guarantee — treat a low number the same way you'd treat `abstained: true`. `calibration_status: "uncalibrated"` means no judge is configured for this recall; in that case `abstained` only ever reflects the older "nothing found" signal.
 
 ### 2. Passing session_id
 
@@ -323,4 +330,4 @@ before recalling, then switch back. See `slm-profile` for workspace switching.
 
 ---
 
-*SuperLocalMemory v4.1.17 · Qualixar · AGPL-3.0-or-later*
+*SuperLocalMemory v4.1.19 · Qualixar · AGPL-3.0-or-later*

package/plugin-src/skills/slm-remember/SKILL.md

@@ -270,4 +270,4 @@ different workspace, use `switch_profile` first. See `slm-profile`.
 
 ---
 
-*SuperLocalMemory v4.1.17 · Qualixar · AGPL-3.0-or-later*
+*SuperLocalMemory v4.1.19 · Qualixar · AGPL-3.0-or-later*

package/plugin-src/skills/slm-scope/SKILL.md

@@ -173,4 +173,4 @@ to review the impact. See `slm-remember` for the full deletion discipline.
 
 ---
 
-*SuperLocalMemory v4.1.17 · Qualixar · AGPL-3.0-or-later*
+*SuperLocalMemory v4.1.19 · Qualixar · AGPL-3.0-or-later*

package/plugin-src/skills/slm-session/SKILL.md

@@ -92,6 +92,11 @@ session_init(
   "core_memory": [],
   "degraded_mode": false,
   "retrieval_mode": "full_6_channel",
+  "calibration_status": "uncalibrated",
+  "calibration_id": null,
+  "answer_confidence": null,
+  "abstained": false,
+  "abstention_reason": null,
   "learning": {
     "feedback_signals": 37,
     "phase": 1,
@@ -104,6 +109,16 @@ session_init(
 FTS5 BM25 was used — semantic, graph, temporal, and structural channels were
 unavailable. The context is still usable; note the degradation if relevant.
 
+**Check `abstained`.** If `true`, the memories returned in `context` and
+`memories` do not answer the query that seeded this session — say so, or
+ask, rather than presenting them as settled fact. This is most relevant
+when you passed an explicit `query`; the default project-context query
+rarely has a single "right answer" for a judge to evaluate.
+`answer_confidence` is a measurement, not a guarantee. `calibration_status:
+"uncalibrated"` means no judge is configured, and `abstained` then only
+reflects the older "nothing found" signal. See `slm-recall` for the full
+rule, which applies identically here.
+
 **Check `learning.phase`:**
 - Phase 1 (< 50 signals): collecting baseline feedback
 - Phase 2 (50–199 signals): active learning
@@ -253,4 +268,4 @@ explicitly and call `recall` with `include_global`/`include_shared` after
 
 ---
 
-*SuperLocalMemory v4.1.17 · Qualixar · AGPL-3.0-or-later*
+*SuperLocalMemory v4.1.19 · Qualixar · AGPL-3.0-or-later*

package/plugin-src/skills/slm-status/SKILL.md

@@ -163,4 +163,4 @@ multi-profile setup. To switch the active profile, see `slm-profile`.
 
 ---
 
-SuperLocalMemory v4.1.17 · Qualixar · AGPL-3.0-or-later
+SuperLocalMemory v4.1.19 · Qualixar · AGPL-3.0-or-later

package/scripts/postinstall.js

@@ -17,7 +17,7 @@ const fs = require('fs');
 const path = require('path');
 const os = require('os');
 
-const MIN_PYTHON = Object.freeze([3, 11]);
+const MIN_PYTHON = Object.freeze([3, 12]);
 const MAX_PYTHON_EXCLUSIVE = Object.freeze([3, 15]);
 const INSTALL_TIMEOUT_MS = 15 * 60 * 1000;
 
@@ -43,12 +43,19 @@ function pythonCandidates(platform = os.platform()) {
       ['py', '-3.14'],
       ['py', '-3.13'],
       ['py', '-3.12'],
-      ['py', '-3.11'],
       ['python3'],
       ['python'],
     ];
   }
+  // Debian 12, Ubuntu 22.04 (with deadsnakes) and RHEL 9 all ship a system
+  // `python3` older than 3.12, with the supported versioned interpreter
+  // installed alongside it, unused. Try the versioned names first so that
+  // interpreter is found before falling back to the bare names and the
+  // fixed absolute paths below.
   return [
+    ['python3.14'],
+    ['python3.13'],
+    ['python3.12'],
     ['python3'],
     ['python'],
     ['/opt/homebrew/bin/python3'],
@@ -57,21 +64,44 @@ function pythonCandidates(platform = os.platform()) {
   ];
 }
 
+function probePython(command, prefixArgs) {
+  try {
+    const result = spawnSync(command, [...prefixArgs, '--version'], {
+      stdio: 'pipe',
+      timeout: 5000,
+      env: process.env,
+    });
+    const output = `${(result.stdout || '').toString()} ${(result.stderr || '').toString()}`;
+    return { status: result.status, version: parsePythonVersion(output) };
+  } catch (error) {
+    return { status: null, version: null, error };
+  }
+}
+
 function findSupportedPython() {
+  const override = String(process.env.SLM_PYTHON || '').trim();
+  if (override) {
+    // The user named this interpreter explicitly (docs/getting-started.md's
+    // escape hatch for a system where no supported `python3` is on PATH, for
+    // example a deadsnakes or pyenv install at a custom path). Honour it,
+    // but still version-check it — and if it fails, say so plainly instead
+    // of silently trying a different interpreter the user did not choose.
+    const probe = probePython(override, []);
+    if (probe.status === 0 && isSupportedPython(probe.version)) {
+      return { command: override, prefixArgs: [], version: probe.version };
+    }
+    const detail = probe.status === 0 && probe.version
+      ? `found Python ${probe.version.join('.')}, which is not supported (need 3.12-3.14)`
+      : 'could not be run (check the path and that it is executable)';
+    console.error(`SuperLocalMemory: SLM_PYTHON=${override} ${detail}.`);
+    console.error('Point SLM_PYTHON at a Python 3.12-3.14 interpreter, or unset it to let the installer search automatically.');
+    return null;
+  }
+
   for (const candidate of pythonCandidates()) {
-    try {
-      const result = spawnSync(candidate[0], [...candidate.slice(1), '--version'], {
-        stdio: 'pipe',
-        timeout: 5000,
-        env: process.env,
-      });
-      const output = `${(result.stdout || '').toString()} ${(result.stderr || '').toString()}`;
-      const version = parsePythonVersion(output);
-      if (result.status === 0 && isSupportedPython(version)) {
-        return { command: candidate[0], prefixArgs: candidate.slice(1), version };
-      }
-    } catch (_error) {
-      // Try the next interpreter without mutating PATH or the machine.
+    const probe = probePython(candidate[0], candidate.slice(1));
+    if (probe.status === 0 && isSupportedPython(probe.version)) {
+      return { command: candidate[0], prefixArgs: candidate.slice(1), version: probe.version };
     }
   }
   return null;
@@ -142,7 +172,7 @@ function validateRuntimeLocation(venvRoot) {
 
 function printPythonGuidance() {
   console.error('');
-  console.error('SuperLocalMemory requires Python 3.11, 3.12, 3.13, or 3.14.');
+  console.error('SuperLocalMemory requires Python 3.12, 3.13, or 3.14.');
   console.error('Install Python from https://www.python.org/downloads/ and rerun:');
   console.error('  npm rebuild superlocalmemory');
   console.error('The npm installer will create a private virtual environment;');
@@ -296,6 +326,7 @@ module.exports = {
   isSupportedPython,
   main,
   parsePythonVersion,
+  probePython,
   pypiSpecifier,
   pythonCandidates,
   runtimePythonPath,