rotate Supermemory POC client key

servers/unraid/supermemory-poc/README.md

@@ -48,7 +48,7 @@ image build is required.
 
 The server creates its client bearer token at:
 
-`/mnt/user/appdata/supermemory-poc/data-gemini-embedding-2-768/api-key`
+`/mnt/user/appdata/supermemory-poc/data-gemini-embedding-2-768-r2/api-key`
 
 Read it through an authorized unRaid/Arcane console without printing it into
 logs. Save it only as `SUPERMEMORY_API_KEY` in the `supermemory-lab` Hermes
@@ -85,7 +85,9 @@ used by Hermes.
 The earlier local `Xenova/bge-m3` and LiteLLM-backed embedding experiments are
 preserved under their old data directories because embedding plans cannot be
 changed in place. This deployment uses the fresh
-`data-gemini-embedding-2-768` directory. The one-shot `supermemory-smoke`
+`data-gemini-embedding-2-768-r2` directory. The `r2` store rotates the
+auto-generated Supermemory client key after the first native-provider
+diagnostic exposed the original key in its startup log. The one-shot `supermemory-smoke`
 service verifies the locked embedding plan, tracks the exact document ID to a
 terminal state, observes legacy v3 search, gates on v4 document and Chinese
 hybrid search, checks provenance metadata, and exercises the profile and
@@ -100,6 +102,16 @@ document, but both v4 and v3 searches returned no hit. The old smoke mixed
 list-wide status checks and did not track the newly created document, so this
 native Gemini run uses a new store and a stricter document-specific gate.
 
+On 2026-09-09, native Gemini direct checks succeeded for both
+`gemini-embedding-2` at 768 dimensions and Supermemory's native LLM default.
+The v4 `documents` and `hybrid` searches returned the expected Chinese marker
+and provenance metadata, while legacy `/v3/search` returned no results. The
+self-hosted server-v0.0.8 binary returned 404 for `/v4/conversations`, even
+though the self-hosting overview describes that route as part of the full API.
+Keep conversation ingest as a failing smoke gate: document RAG can proceed in
+isolation, but Hermes auto-capture/session ingest is not validated on this
+binary.
+
 ## Evaluation guardrails
 
 - Score raw Supermemory API retrieval separately from the Hermes answer. In

servers/unraid/supermemory-poc/compose.yaml

@@ -81,7 +81,7 @@ services:
     volumes:
       - /mnt/user/appdata/supermemory-poc/bin:/opt/supermemory/bin:ro
       - /mnt/user/appdata/supermemory-poc/bin/ca-certificates.crt:/etc/ssl/certs/ca-certificates.crt:ro
-      - /mnt/user/appdata/supermemory-poc/data-gemini-embedding-2-768:/var/lib/supermemory
+      - /mnt/user/appdata/supermemory-poc/data-gemini-embedding-2-768-r2:/var/lib/supermemory
     networks:
       br0:
         ipv4_address: ${SUPERMEMORY_IPV4_ADDRESS:?set an unused LAN address in Arcane environment}
@@ -112,7 +112,7 @@ services:
       - /opt/supermemory-poc/smoke.sh
     volumes:
       - ./smoke.sh:/opt/supermemory-poc/smoke.sh:ro
-      - /mnt/user/appdata/supermemory-poc/data-gemini-embedding-2-768:/var/lib/supermemory
+      - /mnt/user/appdata/supermemory-poc/data-gemini-embedding-2-768-r2:/var/lib/supermemory
     security_opt:
       - no-new-privileges:true
     cap_drop: