@vellumai/assistant 0.10.0-dev.202606200539.c052d10 → 0.10.0-dev.202606201539.0cebd50

package/src/memory/migrations/run-migrations.ts

@@ -1,41 +1,191 @@
 import { getLogger } from "../../util/logger.js";
-import type { DrizzleDb } from "../db-connection.js";
+import { getDbPath } from "../../util/platform.js";
+import { type DrizzleDb, getSqliteFrom } from "../db-connection.js";
 
 const log = getLogger("db-init");
 
-/** A single forward migration step, identified for logging by its `.name`. */
+/**
+ * A single forward migration step, identified for checkpointing and logging by
+ * its `.name`. Anonymous steps (empty `.name`) cannot be tracked and always run.
+ */
 export type MigrationStep = (database: DrizzleDb) => void;
 
 export interface MigrationRunResult {
   /** Steps whose body threw. */
   failed: string[];
+  /** Steps skipped because a prior run already applied them. */
+  skipped: string[];
+}
+
+/**
+ * Prefix under which forward-step completions are recorded in the shared
+ * `memory_checkpoints` ledger. A distinct namespace keeps step bookkeeping from
+ * colliding with registry checkpoint keys (`migration_*`, `backfill_*`,
+ * `drop_*`) and is deliberately chosen so `validateMigrationState` does not
+ * mistake a step record for an unknown registry migration.
+ */
+const STEP_CHECKPOINT_PREFIX = "step:";
+
+/**
+ * Create the migration bookkeeping table if it is missing.
+ *
+ * The runner records its own checkpoints, so it must not depend on an earlier
+ * step having created the ledger. This is the single place `memory_checkpoints`
+ * is created; `IF NOT EXISTS` makes it a no-op on an already-migrated database.
+ */
+function ensureCheckpointsTable(raw: ReturnType<typeof getSqliteFrom>): void {
+  raw.run(/*sql*/ `
+    CREATE TABLE IF NOT EXISTS memory_checkpoints (
+      key TEXT PRIMARY KEY,
+      value TEXT NOT NULL,
+      updated_at INTEGER NOT NULL
+    )
+  `);
 }
 
 /**
- * Run the ordered list of forward migration steps against the database.
+ * Recover from crashed migrations before the migration runner executes its steps.
+ *
+ * Scans memory_checkpoints for entries with value 'started' or 'rolling_back' —
+ * these represent migrations that began but never completed (e.g., due to a
+ * process crash). Deletes the stalled checkpoint so the migration can re-run
+ * from scratch on this startup. Each migration's own idempotency guards (DDL
+ * IF NOT EXISTS, transactional rollback) ensure re-running is safe.
+ *
+ * Runs on every boot — it must observe the state left by *this* boot's prior
+ * crash — so it is invoked directly by {@link runMigrationSteps} before the
+ * checkpointed step loop rather than being a checkpointed step itself.
+ */
+export function recoverCrashedMigrations(database: DrizzleDb): string[] {
+  const raw = getSqliteFrom(database);
+
+  let rows: Array<{ key: string; value: string }>;
+  try {
+    rows = raw
+      .query(`SELECT key, value FROM memory_checkpoints`)
+      .all() as Array<{ key: string; value: string }>;
+  } catch {
+    return [];
+  }
+
+  const crashed = rows
+    .filter((r) => r.value === "started" || r.value === "rolling_back")
+    .map((r) => r.key);
+  if (crashed.length === 0) return [];
+
+  log.error(
+    { crashed },
+    [
+      "╔══════════════════════════════════════════════════════════════╗",
+      "║  CRASHED MIGRATIONS DETECTED — AUTO-RECOVERING             ║",
+      "╚══════════════════════════════════════════════════════════════╝",
+      "",
+      `The following migrations started but never completed: ${crashed.join(", ")}`,
+      "",
+      "Clearing stalled checkpoints so they can be retried on this startup.",
+      "If retries continue to fail, manually inspect the database:",
+      `  sqlite3 ${getDbPath()} "SELECT * FROM memory_checkpoints"`,
+    ].join("\n"),
+  );
+
+  for (const key of crashed) {
+    raw.query(`DELETE FROM memory_checkpoints WHERE key = ?`).run(key);
+    log.info(
+      { key },
+      `Cleared stalled checkpoint "${key}" — migration will re-run`,
+    );
+  }
+
+  return crashed;
+}
+
+/**
+ * Run the ordered list of forward migration steps against the database, each at
+ * most once across boots.
+ *
+ * A step's name is recorded in `memory_checkpoints` after its body completes; on
+ * later boots an applied step is skipped instead of re-executed. This turns the
+ * unconditional ~200-step re-probe — which floors daemon startup at tens of
+ * seconds on a fully-migrated database — into a single bookkeeping read.
+ *
+ * Step bookkeeping shares the same `memory_checkpoints` ledger that the
+ * registry's `withCrashRecovery` uses, under the {@link STEP_CHECKPOINT_PREFIX}
+ * namespace, so applied-state for every migration — DDL guard or registry-backed
+ * — lives in one place.
+ *
+ * Before the step loop runs, the ledger is created if missing and
+ * {@link recoverCrashedMigrations} clears any stalled checkpoints left by a
+ * prior crash, so a migration interrupted mid-flight re-runs this boot.
  *
  * Individual step failures are caught and logged so one broken migration does
- * not prevent independent later ones from succeeding.
+ * not prevent independent later ones from succeeding; a failed step is not
+ * checkpointed and is retried on the next boot.
  */
 export function runMigrationSteps(
   database: DrizzleDb,
   steps: MigrationStep[],
 ): MigrationRunResult {
+  const raw = getSqliteFrom(database);
+
+  ensureCheckpointsTable(raw);
+  recoverCrashedMigrations(database);
+
+  const applied = new Set(
+    (
+      raw
+        .query(
+          `SELECT key FROM memory_checkpoints WHERE key LIKE '${STEP_CHECKPOINT_PREFIX}%'`,
+        )
+        .all() as Array<{ key: string }>
+    ).map((row) => row.key.slice(STEP_CHECKPOINT_PREFIX.length)),
+  );
+  const markApplied = raw.query(
+    `INSERT OR REPLACE INTO memory_checkpoints (key, value, updated_at) VALUES (?, '1', ?)`,
+  );
+
   const failed: string[] = [];
+  const skipped: string[] = [];
 
   for (const step of steps) {
+    const name = step.name;
+    const checkpointable = name !== "";
+
+    if (checkpointable && applied.has(name)) {
+      skipped.push(name);
+      log.debug({ migration: name }, `Skipping applied migration: ${name}`);
+      continue;
+    }
+
     try {
-      log.debug({ migration: step.name }, `Starting migration: ${step.name}`);
+      log.debug({ migration: name }, `Starting migration: ${name}`);
       step(database);
-      log.debug({ migration: step.name }, `Migration succeeded: ${step.name}`);
+      log.debug({ migration: name }, `Migration succeeded: ${name}`);
+      if (checkpointable) {
+        markApplied.run(`${STEP_CHECKPOINT_PREFIX}${name}`, Date.now());
+      }
     } catch (err) {
-      failed.push(step.name);
-      log.error(
-        { err, migration: step.name },
-        `Migration failed: ${step.name}`,
-      );
+      failed.push(name);
+      log.error({ err, migration: name }, `Migration failed: ${name}`);
     }
   }
 
-  return { failed };
+  return { failed, skipped };
+}
+
+/**
+ * Discard every forward-step checkpoint so the next {@link runMigrationSteps}
+ * call re-runs and re-records all steps.
+ *
+ * Migration rollback calls this. A rolled-back step whose body is registry-backed
+ * (guarded by `withCrashRecovery`) clears its own `memory_checkpoints` registry
+ * entry when its `down()` runs; the `step:` checkpoint recorded here must be
+ * discarded in the same operation, otherwise the runner skips the step on the
+ * next upgrade and the rolled-back schema is never restored. Only the `step:`
+ * namespace is cleared, leaving registry checkpoints and other ledger entries
+ * untouched.
+ */
+export function clearMigrationStepCheckpoints(database: DrizzleDb): void {
+  getSqliteFrom(database).run(
+    `DELETE FROM memory_checkpoints WHERE key LIKE '${STEP_CHECKPOINT_PREFIX}%'`,
+  );
 }

package/src/memory/migrations/validate-migration-state.ts

@@ -6,64 +6,10 @@ import {
   MIGRATION_REGISTRY,
   type MigrationValidationResult,
 } from "./registry.js";
+import { clearMigrationStepCheckpoints } from "./run-migrations.js";
 
 const log = getLogger("memory-db");
 
-/**
- * Recover from crashed migrations before the migration runner executes.
- *
- * Scans memory_checkpoints for entries with value 'started' — these represent
- * migrations that began but never completed (e.g., due to a process crash).
- * Deletes the stalled checkpoint so the migration can re-run from scratch on
- * this startup. Each migration's own idempotency guards (DDL IF NOT EXISTS,
- * transactional rollback) ensure re-running is safe.
- *
- * Call this BEFORE running migrations so that stalled checkpoints don't block
- * re-execution.
- */
-export function recoverCrashedMigrations(database: DrizzleDb): string[] {
-  const raw = getSqliteFrom(database);
-
-  let rows: Array<{ key: string; value: string }>;
-  try {
-    rows = raw
-      .query(`SELECT key, value FROM memory_checkpoints`)
-      .all() as Array<{ key: string; value: string }>;
-  } catch {
-    return [];
-  }
-
-  const crashed = rows
-    .filter((r) => r.value === "started" || r.value === "rolling_back")
-    .map((r) => r.key);
-  if (crashed.length === 0) return [];
-
-  log.error(
-    { crashed },
-    [
-      "╔══════════════════════════════════════════════════════════════╗",
-      "║  CRASHED MIGRATIONS DETECTED — AUTO-RECOVERING             ║",
-      "╚══════════════════════════════════════════════════════════════╝",
-      "",
-      `The following migrations started but never completed: ${crashed.join(", ")}`,
-      "",
-      "Clearing stalled checkpoints so they can be retried on this startup.",
-      "If retries continue to fail, manually inspect the database:",
-      `  sqlite3 ${getDbPath()} "SELECT * FROM memory_checkpoints"`,
-    ].join("\n"),
-  );
-
-  for (const key of crashed) {
-    raw.query(`DELETE FROM memory_checkpoints WHERE key = ?`).run(key);
-    log.info(
-      { key },
-      `Cleared stalled checkpoint "${key}" — migration will re-run`,
-    );
-  }
-
-  return crashed;
-}
-
 /**
  * Wrap a migration function with crash-recovery bookkeeping.
  *
@@ -260,7 +206,9 @@ export function validateMigrationState(
  * **Checkpoint state**: Each rolled-back migration's checkpoint is deleted
  * from `memory_checkpoints`. If the process crashes mid-rollback, the
  * `"rolling_back"` marker is detected and cleared by
- * `recoverCrashedMigrations` on the next startup.
+ * `recoverCrashedMigrations` on the next startup. The forward-step checkpoints
+ * recorded by the migration runner (the `step:` namespace) are also discarded
+ * so a later upgrade re-applies (and re-validates) every step.
  *
  * **Warning — data loss**: Some down() migrations may not fully restore the
  * original state (e.g., DROP TABLE migrations recreate the table but cannot
@@ -303,6 +251,16 @@ export function rollbackMemoryMigration(
     (entry) => entry.version > targetVersion && completedKeys.has(entry.key),
   ).sort((a, b) => b.version - a.version); // reverse version order
 
+  // Forward-step checkpoints recorded by the migration runner gate whether each
+  // step re-runs on the next upgrade. A rolled-back registry-backed step clears
+  // its own memory_checkpoints entry via down(), so its step checkpoint must be
+  // discarded too — otherwise the runner skips the step on re-upgrade and the
+  // rolled-back schema is never restored. Clearing before the loop keeps this
+  // correct even if the process crashes partway through the rollback.
+  if (toRollback.length > 0) {
+    clearMigrationStepCheckpoints(database);
+  }
+
   const rolledBack: string[] = [];
 
   for (const entry of toRollback) {

package/src/plugin-api/index.ts

@@ -132,6 +132,13 @@ export type {
 export { assistantEventHub } from "../runtime/assistant-event-hub.js";
 export { getSecureKeyAsync } from "../security/secure-keys.js";
 export { getModelProfiles } from "./model-profiles.js";
+// Check whether a profile's resolved model can process image input. Resolves
+// the effective (provider, model) by merging over the workspace default and
+// inferring the provider for model-only profiles, then looks up the model
+// catalog's `supportsVision` flag. Handles mix profiles (true if any arm
+// supports vision). Fail-open for unknown models. Pair with
+// `getModelProfiles()` to inspect the active or candidate profiles.
+export { doesSupportVision } from "./vision-support.js";
 // Resolve a provider for a call site (optionally overriding the profile) so a
 // plugin can run inference through the workspace's configured profiles and
 // credentials — managed-proxy or BYOK — without supplying its own API key.

package/src/plugin-api/vision-support.ts

@@ -0,0 +1,75 @@
+/**
+ * Vision-support resolution for plugin consumption.
+ *
+ * A plugin that gates image processing on vision capability (e.g. an
+ * image-to-text fallback for text-only models) calls {@link doesSupportVision}
+ * instead of hardcoding model names. The function resolves the effective
+ * (provider, model) for a profile — merging with `llm.default` to fill gaps,
+ * inferring the provider for model-only profiles via the catalog — and then
+ * looks up `supportsVision` in the model catalog.
+ */
+
+import { getConfig } from "../config/loader.js";
+import {
+  getCatalogProviderForModel,
+  PROVIDER_CATALOG,
+} from "../providers/model-catalog.js";
+import type { ModelProfileInfo } from "./types.js";
+
+/**
+ * Whether a profile's resolved model can process image input.
+ *
+ * Resolution mirrors the host's call-site resolver:
+ * - The profile's `(provider, model)` fields are merged over `llm.default` so
+ *   a profile that only sets `model` (or only `provider`) inherits the other
+ *   from the workspace default.
+ * - When `provider` is still missing but `model` is a known catalog model,
+ *   the provider is inferred via `getCatalogProviderForModel` (same logic as
+ *   the resolver's `withImpliedProviderForKnownModel`).
+ * - For a mix profile, returns `true` if any constituent arm supports vision
+ *   (the mix can route to it) and `false` only if every arm is text-only.
+ * - Unknown `(provider, model)` pairs default to `true` (fail-open), matching
+ *   the config GET route's `enrichProfilesWithVisionFlag`.
+ */
+export function doesSupportVision(profile: ModelProfileInfo): boolean {
+  const { llm } = getConfig();
+  const entry = llm.profiles[profile.key];
+  if (entry == null) return true;
+
+  // Mix: fail-open if any arm supports vision.
+  if (entry.mix != null) {
+    return entry.mix.some((arm) => {
+      const armEntry = llm.profiles[arm.profile];
+      if (armEntry == null) return true;
+      return resolveEntrySupportsVision(armEntry, llm);
+    });
+  }
+
+  return resolveEntrySupportsVision(entry, llm);
+}
+
+/**
+ * Resolve whether a concrete (non-mix) profile entry supports vision by
+ * merging its fields over `llm.default` and inferring the provider when
+ * only the model is set.
+ */
+function resolveEntrySupportsVision(
+  entry: { provider?: string; model?: string },
+  llm: { default?: { provider?: string; model?: string } },
+): boolean {
+  const provider = entry.provider ?? llm.default?.provider;
+  const model = entry.model ?? llm.default?.model;
+
+  // Infer provider from model when missing (mirrors the resolver's
+  // withImpliedProviderForKnownModel).
+  const effectiveProvider =
+    provider ?? (typeof model === "string" ? getCatalogProviderForModel(model) : undefined);
+
+  if (typeof effectiveProvider !== "string" || typeof model !== "string") {
+    return true; // fail-open
+  }
+
+  const catalogProvider = PROVIDER_CATALOG.find((p) => p.id === effectiveProvider);
+  const catalogModel = catalogProvider?.models.find((m) => m.id === model);
+  return catalogModel?.supportsVision ?? true;
+}

package/src/prompts/system-prompt.ts

@@ -274,7 +274,7 @@ export function maybeReseedBootstrap(templateFileName: string): boolean {
  * Marking happens here — at the single point where the bootstrap selection is
  * known — so it lands BEFORE the agent loop resolves tools and BEFORE the model
  * can call the emit tool on the first activation-rail turn. (`resolveTools`
- * runs before `resolveSystemPrompt` in the loop, so the system-prompt build is
+ * runs before the system-prompt build in the loop, so the system-prompt build is
  * too late to be the *only* marking site.) The marker write is best-effort and
  * idempotent (`markActivationSession` swallows errors and dedups on the PK), so
  * calling this from both `setOnboardingContext` and `buildSystemPrompt` is safe.

package/src/runtime/__tests__/agent-wake.test.ts

@@ -52,8 +52,8 @@ interface WakeConversationProbe {
     allowedTools?: string[];
     /**
      * `conversation.wakePersonaOverride` as observed at run start — the
-     * field the conversation's resolveSystemPrompt callback reads when
-     * building the wake's system prompt.
+     * field `buildCurrentSystemPrompt` reads when building the wake's
+     * system prompt before `agentLoop.run()`.
      */
     personaOverride?: unknown;
     order: number;
@@ -503,6 +503,8 @@ function makeWakeConversation(options: {
     getTurnChannelContext: () => null,
     getTurnInterfaceContext: () => null,
     trustContext: undefined,
+    buildCurrentSystemPrompt: () => "mock-system-prompt",
+    modelOverride: undefined,
     ...(drainQueue ? { drainQueue } : {}),
   };
 
@@ -693,8 +695,8 @@ describe("wakeAgentForOpportunity", () => {
     );
 
     expect(result.invoked).toBe(true);
-    // The override was live on the conversation when the loop ran — the
-    // resolveSystemPrompt callback reads this field at prompt-build time.
+    // The override was live on the conversation when the loop ran —
+    // `buildCurrentSystemPrompt` reads this field before `agentLoop.run()`.
     expect(conversation.runCalls[0]!.personaOverride).toEqual(override);
     // Applied exactly once and cleared before the wake released the
     // conversation, so a queued user turn can't build under it.

package/src/runtime/agent-wake.ts

@@ -597,13 +597,14 @@ export async function wakeAgentForOpportunity(
     });
 
     // Apply the caller's persona override for the duration of the run. The
-    // wake's agent loop builds the system prompt through the conversation's
-    // resolveSystemPrompt callback, which reads this field; cleared (below,
-    // before drainQueue) so a queued user turn never builds its prompt under
-    // the wake's override. Assigned only AFTER the profile/config reads above
-    // — those can throw, and they run before the try/finally that clears the
-    // override, so an earlier assignment would strand the override on the
-    // cached Conversation and corrupt every later prompt build on it.
+    // prompt is built once before `agentLoop.run()` (via
+    // `conversation.buildCurrentSystemPrompt()`), which reads this field;
+    // cleared (below, before drainQueue) so a queued user turn never builds
+    // its prompt under the wake's override. Assigned only AFTER the
+    // profile/config reads above — those can throw, and they run before the
+    // try/finally that clears the override, so an earlier assignment would
+    // strand the override on the cached Conversation and corrupt every later
+    // prompt build on it.
     if (opts.personaOverride) {
       conversation.wakePersonaOverride = opts.personaOverride;
     }
@@ -1146,6 +1147,13 @@ export async function wakeAgentForOpportunity(
             maxInputTokens: effectiveContextWindow.maxInputTokens,
             overflowRecovery: { enabled: false, safetyMarginRatio: 0 },
           }),
+          // Resolve the system prompt once before the run — the loop does
+          // not re-resolve mid-loop. `wakePersonaOverride` (if set above)
+          // is baked into the prompt at this point.
+          systemPrompt: conversation.buildCurrentSystemPrompt(),
+          ...(conversation.modelOverride
+            ? { model: conversation.modelOverride }
+            : {}),
         }));
       } catch (err) {
         // An over-window throw on a compaction-suppressed wake is the

package/src/runtime/routes/conversation-routes.ts

@@ -10,7 +10,10 @@ import {
   createAssistantMessage,
   createUserMessage,
 } from "../../agent/message-types.js";
-import { ConversationMessageSchema } from "../../api/responses/conversation-message.js";
+import {
+  type ConversationContentBlock,
+  ConversationMessageSchema,
+} from "../../api/responses/conversation-message.js";
 import {
   CHANNEL_IDS,
   INTERFACE_IDS,
@@ -943,7 +946,25 @@ export function handleListMessages({
         .filter((block) => block.type !== "text" || block.text.length > 0);
     }
 
-    const alignedContentOrder = aligned.rewriteContentOrder(contentOrder);
+  // Ensure every hydrated attachment has a corresponding content block.
+  // renderHistoryContent inlines attachment blocks only when it has
+  // file-block refs with matching DB rows; directives (assistant-authored
+  // <vellum-attachment/> tags) don't leave a file block after stripping,
+  // so their attachments end up in the flat `attachments` array but not in
+  // `contentBlocks`. Append any that are missing so the canonical
+  // projection is complete.
+  const existingAttachmentIds = new Set(
+    contentBlocks
+      .filter((b): b is Extract<ConversationContentBlock, { type: "attachment" }> => b.type === "attachment")
+      .map((b) => b.attachment.id),
+  );
+  for (const att of msgAttachments) {
+    if (!existingAttachmentIds.has(att.id)) {
+      contentBlocks.push({ type: "attachment", attachment: att });
+    }
+  }
+
+  const alignedContentOrder = aligned.rewriteContentOrder(contentOrder);
 
     // Use sentAt (actual event time) for the display timestamp when available,
     // falling back to createdAt (persistence time). Clients use this display
@@ -971,7 +992,7 @@ export function handleListMessages({
       ...(alignedContentOrder.length > 0
         ? { contentOrder: alignedContentOrder }
         : {}),
-      ...(contentBlocks.length > 0 ? { contentBlocks } : {}),
+      contentBlocks,
       ...(m.subagentNotification
         ? { subagentNotification: m.subagentNotification }
         : {}),

package/src/runtime/routes/migration-routes.ts

@@ -38,6 +38,7 @@ import {
   upsertCredentialMetadata,
 } from "../../tools/credentials/metadata-store.js";
 import { getLogger } from "../../util/logger.js";
+import { getLogsDbPath } from "../../util/logs-db-path.js";
 import { getWorkspaceDir, getWorkspaceHooksDir } from "../../util/platform.js";
 import { APP_VERSION } from "../../version.js";
 import { DAEMON_INTERNAL_ASSISTANT_ID } from "../assistant-scope.js";
@@ -151,6 +152,38 @@ export async function reconcileVellumMetadataFromCes(warningSink: {
 
 const log = getLogger("migration-routes");
 
+/**
+ * Flush both database files' WALs before an export copies them. The bundle
+ * walker includes `*.db` but skips `*.db-wal`, so committed frames still sitting
+ * in a WAL would be missing from the bundle.
+ *
+ * Dispatched through `runAsyncSqlite` so the flush runs in a sqlite3 subprocess
+ * where available — a multi-GB WAL flush would otherwise stall the event loop.
+ * The in-process fallback runs on the daemon connection, where one unqualified
+ * checkpoint already covers every attached database; the subprocess opens a
+ * single file, so we issue a second checkpoint targeting the logs file. FULL
+ * (not TRUNCATE) writes committed frames back to the main file, which is all the
+ * copy needs.
+ */
+async function checkpointDbsForExport(): Promise<void> {
+  const targets: Array<{ label: string; dbPath?: string }> = [
+    { label: "main" },
+    { label: "logs", dbPath: getLogsDbPath() },
+  ];
+  for (const { label, dbPath } of targets) {
+    const result = await runAsyncSqlite(
+      "PRAGMA wal_checkpoint(FULL)",
+      dbPath ? { dbPath } : undefined,
+    );
+    if (!result.ok) {
+      log.warn(
+        { error: result.error, backend: result.backend, db: label },
+        "WAL checkpoint failed — exporting without checkpoint",
+      );
+    }
+  }
+}
+
 /**
  * Fields the export pipeline must populate on the v1 manifest.
  *
@@ -353,28 +386,7 @@ export async function handleMigrationExport(
       ...manifestInputs,
       secretsRedacted,
       credentials,
-      checkpoint: async () => {
-        // Dispatch through `runAsyncSqlite` so the WAL checkpoint runs
-        // in a sqlite3 subprocess on hosts where it's available. A WAL
-        // flush on a multi-GB WAL file can otherwise stall the daemon's
-        // event loop for the full duration of the flush.
-        //
-        // FULL (not TRUNCATE): FULL blocks until every committed frame is
-        // written back to the main `.db` file, which is all the export
-        // needs since it copies that file. TRUNCATE additionally restarts
-        // the WAL and truncates it to zero bytes — extra work and blocking
-        // this path does not need.
-        const result = await runAsyncSqlite("PRAGMA wal_checkpoint(FULL)");
-        if (!result.ok) {
-          // Best-effort: if the DB can't be checkpointed (e.g. not a valid
-          // SQLite file, missing WAL, etc.) we still proceed with the export
-          // using whatever is on disk.
-          log.warn(
-            { error: result.error, backend: result.backend },
-            "WAL checkpoint failed — exporting without checkpoint",
-          );
-        }
-      },
+      checkpoint: checkpointDbsForExport,
     });
 
     cleanup = result.cleanup;
@@ -582,23 +594,7 @@ export async function handleMigrationExportToGcs({ body }: RouteHandlerArgs) {
           ...manifestInputs,
           secretsRedacted,
           credentials: collected.credentials,
-          checkpoint: async () => {
-            // Dispatch through `runAsyncSqlite` so the WAL checkpoint runs
-            // in a sqlite3 subprocess on hosts where it's available. A
-            // WAL flush on a multi-GB WAL file can otherwise stall the
-            // daemon's event loop for the full duration of the flush.
-            //
-            // FULL (not TRUNCATE): see the disk-export checkpoint above
-            // for rationale. assistant/AGENTS.md "SQLite WAL
-            // checkpointing".
-            const result = await runAsyncSqlite("PRAGMA wal_checkpoint(FULL)");
-            if (!result.ok) {
-              log.warn(
-                { error: result.error, backend: result.backend },
-                "WAL checkpoint failed — exporting without checkpoint",
-              );
-            }
-          },
+          checkpoint: checkpointDbsForExport,
         });
 
         cleanup = result.cleanup;

package/src/schedule/scheduler.ts

@@ -1,3 +1,4 @@
+import { getConfig } from "../config/loader.js";
 import {
   checkDiskPressureBackgroundGate,
   diskPressureBackgroundSkipLogFields,
@@ -85,14 +86,6 @@ const TICK_INTERVAL_MS = 15_000;
  */
 const WAKE_MAX_RETRIES = 20;
 
-/**
- * Hard timeout for `talk`-mode scheduled jobs. Schedules can do
- * non-trivial work (research, summarize the day, etc.), so the cap is
- * generous; it exists primarily so a wedged turn cannot block the next
- * scheduler tick indefinitely. Mirrors the heartbeat/filing budgets.
- */
-const SCHEDULE_TALK_TIMEOUT_MS = 30 * 60 * 1000;
-
 /**
  * Apply retry policy on schedule-execution failure. Retries are scheduled by
  * `applyRetryDecision`; once retries are exhausted, the `emitAlert` callback
@@ -718,7 +711,10 @@ export async function runScheduleDueWorkOnce(
         ...(job.inferenceProfile
           ? { overrideProfile: job.inferenceProfile }
           : {}),
-        timeoutMs: SCHEDULE_TALK_TIMEOUT_MS,
+        // Hard timeout for talk-mode scheduled turns: bounds a wedged turn so
+        // it cannot block the next scheduler tick. Configurable via
+        // timeouts.scheduleTurnTimeoutSec (default 1800s).
+        timeoutMs: getConfig().timeouts.scheduleTurnTimeoutSec * 1000,
         origin: "schedule",
         groupId: "system:scheduled",
         conversationType: "scheduled",