@vellumai/assistant 0.10.12 → 0.11.0-staging.2

package/src/persistence/conversation-key-store.ts

@@ -12,11 +12,14 @@ import { v4 as uuid } from "uuid";
 
 import { cleanupBootstrapFiles } from "../prompts/bootstrap-cleanup.js";
 import { getCurrentSeq } from "../runtime/assistant-stream-state.js";
+import { getLogger } from "../util/logger.js";
 import { initConversationDir } from "./conversation-disk-view.js";
 import { GENERATING_TITLE } from "./conversation-title-service.js";
 import { getDb } from "./db-connection.js";
 import { conversationKeys, conversations } from "./schema/index.js";
 
+const log = getLogger("conversation-key-store");
+
 /** Set after the first conversation is created so BOOTSTRAP.md is deleted on the second. */
 let firstConversationSeen = false;
 
@@ -267,6 +270,23 @@ export function getOrCreateConversation(
 
   if (result.created) {
     initConversationDir({ ...result.conversation, originChannel: null });
+    // Attribution for every key-materialized conversation: this is the single
+    // choke point through which all unseen-key creations flow, and the key
+    // shape + caller frames identify the entry point from the log alone. The
+    // raw key is never logged — channel-backed keys embed external chat ids
+    // (phone numbers, Slack/Telegram ids), and assistant logs travel in
+    // support bundles. Emitted only on the creation branch, never on hot
+    // read/write paths.
+    log.info(
+      {
+        conversationKeyShape: classifyConversationKey(conversationKey),
+        conversationId: result.conversationId,
+        conversationType,
+        hasCustomTitle: Boolean(opts?.title?.trim()),
+        caller: captureCallerFrames(),
+      },
+      "Materialized conversation for unseen conversation key",
+    );
   }
 
   return {
@@ -275,3 +295,46 @@ export function getOrCreateConversation(
     created: result.created,
   };
 }
+
+const UUID_SHAPE_RE =
+  /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+
+/**
+ * PII-free shape label for a conversation key. Channel-backed keys embed
+ * external chat/user ids, so only the structural prefix is kept (e.g.
+ * `asst:<id>:slack:<chat>:thread:<ts>` → "asst-scoped:slack:threaded");
+ * free-form keys collapse to a coarse class.
+ */
+function classifyConversationKey(conversationKey: string): string {
+  if (conversationKey.startsWith("asst:")) {
+    const parts = conversationKey.split(":");
+    const channel = parts[2] ?? "unknown";
+    const threaded = parts.includes("thread") ? ":threaded" : "";
+    return `asst-scoped:${channel}${threaded}`;
+  }
+  const prefixed = conversationKey.match(/^([a-z-]+)[:-]/i);
+  if (prefixed) {
+    return `prefixed:${prefixed[1].toLowerCase()}`;
+  }
+  if (UUID_SHAPE_RE.test(conversationKey)) {
+    return "uuid";
+  }
+  return "opaque";
+}
+
+/**
+ * Compact caller summary for creation attribution: the first few stack
+ * frames above this module, joined into one log-friendly line.
+ */
+function captureCallerFrames(): string {
+  const stack = new Error().stack?.split("\n") ?? [];
+  return stack
+    .slice(1)
+    .map((line) => line.trim())
+    .filter(
+      (line) =>
+        line.startsWith("at ") && !line.includes("conversation-key-store"),
+    )
+    .slice(0, 4)
+    .join(" | ");
+}

package/src/persistence/conversation-parent.ts

@@ -0,0 +1,27 @@
+import { eq } from "drizzle-orm";
+
+import { getDb } from "./db-connection.js";
+import { conversations } from "./schema/index.js";
+
+/**
+ * The durable spawn parent of a conversation: the `parent_conversation_id`
+ * column stamped at subagent bootstrap. Returns `undefined` for a conversation
+ * with no recorded parent or no row at all.
+ *
+ * Unlike the in-memory conversation registry — which drops a subagent entry as
+ * soon as its run goes terminal and evicts idle top-level conversations — this
+ * survives for the life of the row, so an ancestry walk still resolves long
+ * after the run that created the chain has finished.
+ *
+ * A single-row primary-key lookup.
+ */
+export function getPersistedParentConversationId(
+  conversationId: string,
+): string | undefined {
+  const row = getDb()
+    .select({ parentConversationId: conversations.parentConversationId })
+    .from(conversations)
+    .where(eq(conversations.id, conversationId))
+    .get();
+  return row?.parentConversationId ?? undefined;
+}

package/src/persistence/db-async-query.ts

@@ -228,7 +228,7 @@ async function runViaCli(
   // corrupt) — the durability posture every daemon write already has, so
   // FULL here buys no end-to-end guarantee. Prepended to the piped SQL so
   // both take effect before the statement runs.
-  const sqlWithPragma = `PRAGMA busy_timeout=${SQLITE_BUSY_TIMEOUT_MS};\nPRAGMA synchronous=NORMAL;\n${sql}`;
+  const sqlWithPragma = `PRAGMA busy_timeout=${SQLITE_BUSY_TIMEOUT_MS};\nPRAGMA synchronous=NORMAL;\nPRAGMA journal_mode=WAL;\n${sql}`;
 
   // Write the SQL and close stdin so sqlite3 sees EOF and exits.
   proc.stdin.write(sqlWithPragma + "\n");

package/src/persistence/db-singleton.ts

@@ -17,10 +17,10 @@
  *
  * State is held on `globalThis.vellumAssistant.dbSingletons` so test
  * helpers in `__tests__/` can read/write it WITHOUT importing this
- * module — they declare the same slot shape locally and access the
- * globalThis namespace directly. See
- * `__tests__/db-test-helpers.ts` for the test-side mirror; the slot
- * shape MUST stay in sync between the two.
+ * module. Both sides reference the shared ambient `VellumDbSlots` type
+ * (declared in `src/vellum-assistant-namespace.d.ts`), which types the
+ * slot without adding a runtime import between them. See
+ * `__tests__/db-test-helpers.ts` for the test-side reader.
  *
  * The stored value is typed as `unknown` so this file never has to import
  * Drizzle types. Callers in `db-connection.ts` narrow via the type
@@ -33,32 +33,19 @@
  *   - `__tests__/db-test-helpers.ts` (per-test reset, via globalThis)
  */
 
-/** Which connection a slot holds. */
-export type DbSlotKey =
-  | "main"
-  | "main-readonly"
-  | "logs"
-  | "memory"
-  | "telemetry";
-
-type DbSlot = {
-  db: unknown;
-  closer: (() => void) | null;
-};
-
-type DbSlots = Record<DbSlotKey, DbSlot>;
-
-type VellumAssistantNamespace = {
-  dbSingletons?: DbSlots;
-};
+/**
+ * Which connection a slot holds. The canonical union is the ambient
+ * `VellumDbSlotKey` (see `src/vellum-assistant-namespace.d.ts`); this
+ * re-export is the DB layer's public name for it.
+ */
+export type DbSlotKey = VellumDbSlotKey;
 
-function emptySlot(): DbSlot {
+function emptySlot(): VellumDbSlot {
   return { db: null, closer: null };
 }
 
-function slots(): DbSlots {
-  const g = globalThis as { vellumAssistant?: VellumAssistantNamespace };
-  const ns = (g.vellumAssistant ??= {});
+function slots(): VellumDbSlots {
+  const ns = (globalThis.vellumAssistant ??= {});
   return (ns.dbSingletons ??= {
     main: emptySlot(),
     "main-readonly": emptySlot(),
@@ -68,7 +55,7 @@ function slots(): DbSlots {
   });
 }
 
-function slot(key: DbSlotKey): DbSlot {
+function slot(key: DbSlotKey): VellumDbSlot {
   return slots()[key];
 }
 

package/src/persistence/delivery-crud.ts

@@ -188,6 +188,51 @@ function resolveInboundConversation(
   return getOrCreateConversation(threadedKey);
 }
 
+/**
+ * Resolve the internal conversation already bound to an inbound
+ * (channel, chat, thread) address, or `null` when none exists. Mirrors
+ * {@link resolveInboundConversation}'s lookup order — threaded key first,
+ * then the Slack flat-key alias when thread evidence exists — but is
+ * strictly read-only: deny lanes use it to attach the in-app
+ * access-request card to the originating conversation, and a denied
+ * inbound must never mint a conversation as a side effect.
+ */
+export function findInboundConversationId(
+  sourceChannel: string,
+  externalChatId: string,
+  sourceThreadId?: string | null,
+): string | null {
+  const threadedKey = buildScopedConversationKey(
+    sourceChannel,
+    externalChatId,
+    sourceThreadId,
+  );
+  const threadedMapping = getConversationByKey(threadedKey);
+  if (threadedMapping) {
+    return threadedMapping.conversationId;
+  }
+
+  const threadId = sourceThreadId?.trim();
+  if (sourceChannel !== "slack" || !threadId) {
+    return null;
+  }
+
+  const legacyKey = buildScopedConversationKey(sourceChannel, externalChatId);
+  const legacyMapping = getConversationByKey(legacyKey);
+  if (
+    legacyMapping &&
+    legacySlackConversationHasThreadEvidence(
+      legacyMapping.conversationId,
+      externalChatId,
+      threadId,
+    )
+  ) {
+    return legacyMapping.conversationId;
+  }
+
+  return null;
+}
+
 /**
  * Record an inbound channel event. Returns `duplicate: true` if this
  * exact (channel, chat, message) combination was already seen.

package/src/persistence/embeddings/embedding-backend.ts

@@ -2,6 +2,7 @@ import { createHash } from "node:crypto";
 
 import { getOllamaBaseUrlEnv } from "../../config/env.js";
 import { resolveCallSiteConfig } from "../../config/llm-resolver.js";
+import { isMemoryEnabled } from "../../config/memory-v3-gate.js";
 import type { AssistantConfig } from "../../config/types.js";
 import { PLATFORM_PROVIDER_META } from "../../providers/platform-proxy/constants.js";
 import { resolveManagedProxyContext } from "../../providers/platform-proxy/context.js";
@@ -507,7 +508,7 @@ export async function getMemoryBackendStatus(config: AssistantConfig): Promise<{
   model: string | null;
   reason: string | null;
 }> {
-  if (config.memory.enabled === false) {
+  if (!isMemoryEnabled(config)) {
     return {
       enabled: false,
       degraded: false,

package/src/persistence/embeddings/embedding-identity.ts

@@ -12,9 +12,13 @@ import { resolveQdrantUrl } from "./qdrant-client.js";
 
 const log = getLogger("embedding-identity");
 
-// Inlined rather than imported from `memory/v2/qdrant.ts`: the persistence
-// layer must not import from the memory feature layer (enforced by
-// persistence-layering-guard). The dependency direction is memory → persistence.
+// FROZEN: `memory_v2_concept_pages` is a Qdrant collection name on disk, and it
+// belongs to the concept-page SUBSTRATE (which outlives the v2 engine) despite
+// the `v2` spelling — see `plugins/defaults/memory/AGENTS.md`. Inlined rather
+// than imported from `memory/substrate/qdrant.ts`'s `MEMORY_V2_COLLECTION`: the
+// persistence layer must not import from the memory feature layer (enforced by
+// persistence-layering-guard). The dependency direction is memory →
+// persistence. This copy and the substrate's must change together or never.
 const MEMORY_V2_COLLECTION = "memory_v2_concept_pages";
 
 export interface BackendDimensionProbe {

package/src/persistence/job-utils.ts

@@ -230,8 +230,39 @@ export async function embedAndUpsert(
       ? generateSparseEmbedding(normalized.text)
       : undefined;
 
-  // Persist embedding in SQLite for cross-restart cache
   const now = Date.now();
+  const qdrant = requireQdrantClient();
+
+  try {
+    const modality = normalized.type;
+    await withQdrantBreaker(() =>
+      qdrant.upsert(
+        targetType,
+        targetId,
+        vector,
+        {
+          text: payloadText,
+          modality,
+          created_at: (extraPayload?.created_at as number) ?? now,
+          ...(extraPayload as Record<string, unknown> | undefined),
+        },
+        sparseVector,
+      ),
+    );
+  } catch (err) {
+    log.warn(
+      { err, targetType, targetId },
+      "Failed to upsert embedding to Qdrant",
+    );
+    throw err;
+  }
+
+  // Persist the embedding in SQLite for the cross-restart cache, after the
+  // point is live in Qdrant. Consumers read a row as "this target is indexed"
+  // — the graph-node orphan sweep does — so a row written ahead of the upsert
+  // would mark a missing point as embedded and suppress the re-embed that
+  // would restore it. Best-effort in the other direction: a write failure logs
+  // and leaves the point in place, and the next run re-embeds.
   try {
     const blobValue = vectorToBlob(vector);
     db.insert(memoryEmbeddings)
@@ -267,30 +298,4 @@ export async function embedAndUpsert(
   } catch (err) {
     log.warn({ err, targetType, targetId }, "Failed to write embedding cache");
   }
-
-  const qdrant = requireQdrantClient();
-
-  try {
-    const modality = normalized.type;
-    await withQdrantBreaker(() =>
-      qdrant.upsert(
-        targetType,
-        targetId,
-        vector,
-        {
-          text: payloadText,
-          modality,
-          created_at: (extraPayload?.created_at as number) ?? now,
-          ...(extraPayload as Record<string, unknown> | undefined),
-        },
-        sparseVector,
-      ),
-    );
-  } catch (err) {
-    log.warn(
-      { err, targetType, targetId },
-      "Failed to upsert embedding to Qdrant",
-    );
-    throw err;
-  }
 }

package/src/persistence/jobs-store.ts

@@ -2,6 +2,7 @@ import { and, asc, eq, inArray, lte, notInArray, sql } from "drizzle-orm";
 import { v4 as uuid } from "uuid";
 
 import { getConfig } from "../config/loader.js";
+import { isMemoryEnabled as isMemoryEnabledForConfig } from "../config/memory-v3-gate.js";
 import { getLogger } from "../util/logger.js";
 import { truncate } from "../util/truncate.js";
 import { type DrizzleDb, getMemoryDb } from "./db-connection.js";
@@ -13,6 +14,7 @@ import {
   isQdrantBreakerOpen,
   shouldAllowQdrantProbe,
 } from "./embeddings/qdrant-circuit-breaker.js";
+import { isLifecycleQuiesced } from "./lifecycle-quiesce.js";
 import { rawMemoryAll, rawMemoryChanges } from "./raw-query.js";
 import { memoryJobs } from "./schema/index.js";
 
@@ -55,6 +57,8 @@ export type MemoryJobType =
   | "graph_trigger_embed"
   | "graph_bootstrap"
   | "embed_concept_page"
+  // FROZEN: `memory_v2_*` job type values are persisted in job rows — never
+  // rename them.
   | "memory_v2_sweep"
   | "memory_v2_consolidate"
   | "memory_v2_migrate"
@@ -68,12 +72,12 @@ export type MemoryJobType =
   | "delete_message_lexical"
   | "backfill_lexical_index"
   | "skill_card_insert"
+  | "memory_retrospective"
   | "memory_retrospective_sweep"
   // Retired/legacy — no live handler; persisted rows drop via LEGACY_JOB_TYPES.
   | "memory_v3_consolidate"
   | "memory_v3_index_maintenance"
   | "memory_v3_edge_learning"
-  | "memory_retrospective"
   | "conversation_analyze";
 
 export const EMBED_JOB_TYPES: MemoryJobType[] = [
@@ -127,10 +131,11 @@ export const MEMORY_V2_CONSOLIDATION_JOB_TRIGGERS = {
   remember: "remember",
 } as const;
 
-/** Returns `false` only when `config.memory.enabled` is explicitly `false`; defaults to `true` on missing config or load errors. */
+/** Config-singleton wrapper over the canonical gate predicate in
+ * `config/memory-v3-gate.ts`; defaults to `true` on config load errors. */
 export function isMemoryEnabled(): boolean {
   try {
-    return getConfig().memory?.enabled !== false;
+    return isMemoryEnabledForConfig(getConfig());
   } catch {
     return true;
   }
@@ -374,6 +379,33 @@ function mergeSkillCardEntries(
   return merged;
 }
 
+/**
+ * Source-conversation ids of every PENDING `memory_retrospective` job. The
+ * retrospective sweep skips these up front: a pending row already covers the
+ * source's unprocessed span, and a coalescing upsert against it must not
+ * consume the sweep's per-pass enqueue cap. Deliberately excludes `running`
+ * rows — a running job's fork and cursor are pre-run snapshots, so messages
+ * arriving mid-run need a follow-up row behind it, and the sweep must be able
+ * to create that follow-up. Mirrors `upsertMemoryRetrospectiveJob`'s
+ * pending-only coalescing.
+ */
+export function listPendingMemoryRetrospectiveSourceConversationIds(): string[] {
+  return memoryDb()
+    .select({
+      conversationId: sql<string>`json_extract(${memoryJobs.payload}, '$.conversationId')`,
+    })
+    .from(memoryJobs)
+    .where(
+      and(
+        eq(memoryJobs.type, "memory_retrospective"),
+        eq(memoryJobs.status, "pending"),
+      ),
+    )
+    .all()
+    .map((row) => row.conversationId)
+    .filter((id): id is string => typeof id === "string" && id.length > 0);
+}
+
 /**
  * Check whether a pending or running job of the given type already exists.
  * Used to prevent duplicate enqueues for long-running maintenance jobs.
@@ -453,6 +485,36 @@ export function upsertEmbedConceptPageJob(payload: { slug: string }): string {
   return enqueueMemoryJob("embed_concept_page", { slug: payload.slug });
 }
 
+/**
+ * Enqueue an `embed_graph_node` job, coalescing with an existing pending row
+ * for the same node id. The payload carries only the node id — the handler
+ * reads the node's content at execution time — so a pending row is exactly
+ * equivalent to a fresh enqueue and a duplicate would only redo identical
+ * embedding work and Qdrant upserts. A running row never matches: it may have
+ * embedded a pre-write snapshot of the node, so the new enqueue must survive
+ * it. Same synchronous check-then-insert rationale as
+ * {@link upsertEmbedConceptPageJob}. Returns the id of the pending row,
+ * existing or newly inserted.
+ */
+export function upsertEmbedGraphNodeJob(payload: { nodeId: string }): string {
+  const db = memoryDb();
+  const existing = db
+    .select({ id: memoryJobs.id })
+    .from(memoryJobs)
+    .where(
+      and(
+        eq(memoryJobs.type, "embed_graph_node"),
+        eq(memoryJobs.status, "pending"),
+        sql`json_extract(${memoryJobs.payload}, '$.nodeId') = ${payload.nodeId}`,
+      ),
+    )
+    .get();
+  if (existing) {
+    return existing.id;
+  }
+  return enqueueMemoryJob("embed_graph_node", { nodeId: payload.nodeId });
+}
+
 export function enqueuePruneOldLlmRequestLogsJob(retentionMs?: number): string {
   const db = memoryDb();
   const existing = db
@@ -618,6 +680,13 @@ export function claimMemoryJobs(
     return [];
   }
 
+  // Drain gate: while a quiesce lease is active, claim nothing so in-flight
+  // jobs finish and the queue drains to a stop. Enqueues are unaffected;
+  // claims resume when the lease expires. Fail-open via the lease read.
+  if (isLifecycleQuiesced()) {
+    return [];
+  }
+
   const db = memoryDb();
   const now = Date.now();
   const restrictFilter = restrictToTypes
@@ -868,6 +937,26 @@ export function resetRunningJobsToPending(): number {
   return rawMemoryChanges();
 }
 
+/** Currently-running memory jobs, oldest first — the drain-status view. */
+export function listRunningMemoryJobs(): Array<{
+  id: string;
+  type: string;
+  startedAt: number | null;
+}> {
+  const db = memoryDb();
+  return db
+    .select({
+      id: memoryJobs.id,
+      type: memoryJobs.type,
+      startedAt: memoryJobs.startedAt,
+    })
+    .from(memoryJobs)
+    .where(eq(memoryJobs.status, "running"))
+    .orderBy(asc(memoryJobs.startedAt))
+    .limit(20)
+    .all();
+}
+
 /**
  * Fail running jobs whose `startedAt` is older than `timeoutMs` ago.
  * Returns the number of jobs that were timed out.

package/src/persistence/lifecycle-quiesce.ts

@@ -0,0 +1,80 @@
+/**
+ * Cross-process quiesce lease for graceful drains.
+ *
+ * `vellum sleep --wait` sets a short-TTL lease before stopping the assistant;
+ * every background-work claim/fire site (heartbeat, the daemon's
+ * watcher/sequence tick, the schedule worker's claim tick, the memory jobs
+ * worker) checks it and stops STARTING new work while it is active. Enqueue
+ * paths are unaffected — queued work runs after the restart.
+ *
+ * The lease is a single `memory_checkpoints` row on the main database so the
+ * daemon and both worker processes read the same value. The value is an
+ * epoch-ms deadline, refreshed by the waiting client, so a dead client can
+ * never silence background work for longer than one TTL. Readers fail OPEN —
+ * a missing, malformed, or unreadable lease means "not quiesced".
+ */
+
+import {
+  deleteMemoryCheckpoint,
+  getMemoryCheckpoint,
+  setMemoryCheckpoint,
+} from "./checkpoints.js";
+
+const QUIESCE_UNTIL_KEY = "lifecycle:quiesce_until";
+
+export const MIN_QUIESCE_TTL_MS = 5_000;
+export const MAX_QUIESCE_TTL_MS = 10 * 60_000;
+export const DEFAULT_QUIESCE_TTL_MS = 60_000;
+
+/**
+ * Arm (or refresh) the quiesce lease. Returns the lease deadline (epoch ms).
+ *
+ * Throws when the lease cannot be persisted — callers that promise a drain
+ * must surface the failure rather than pretend background work is paused.
+ */
+export function setLifecycleQuiesce(
+  ttlMs: number = DEFAULT_QUIESCE_TTL_MS,
+): number {
+  const clamped = Math.min(
+    Math.max(Math.floor(ttlMs), MIN_QUIESCE_TTL_MS),
+    MAX_QUIESCE_TTL_MS,
+  );
+  const quiescedUntil = Date.now() + clamped;
+  setMemoryCheckpoint(QUIESCE_UNTIL_KEY, String(quiescedUntil));
+  return quiescedUntil;
+}
+
+/**
+ * The active lease deadline, or null when no unexpired lease exists.
+ * Fail-open: any read or parse failure reads as "no lease".
+ */
+export function getLifecycleQuiesceUntil(): number | null {
+  let raw: string | null;
+  try {
+    raw = getMemoryCheckpoint(QUIESCE_UNTIL_KEY);
+  } catch {
+    return null;
+  }
+  if (raw == null) {
+    return null;
+  }
+  const until = Number.parseInt(raw, 10);
+  if (!Number.isFinite(until) || until <= Date.now()) {
+    return null;
+  }
+  return until;
+}
+
+/** True while an unexpired quiesce lease is active. Fail-open. */
+export function isLifecycleQuiesced(): boolean {
+  return getLifecycleQuiesceUntil() != null;
+}
+
+/** Drop the lease. Best-effort — a failure leaves the TTL to expire it. */
+export function clearLifecycleQuiesce(): void {
+  try {
+    deleteMemoryCheckpoint(QUIESCE_UNTIL_KEY);
+  } catch {
+    // Fail-soft: the lease self-expires.
+  }
+}

package/src/persistence/llm-usage-store.ts

@@ -42,6 +42,30 @@ import {
 // Write
 // ---------------------------------------------------------------------------
 
+/**
+ * Resolve the parent conversation's `conversation_type` at record time.
+ * Usage rows outlive conversation rows (retrospective forks are GC'd,
+ * users delete conversations), so the type must be captured while the
+ * conversation still exists — the telemetry flush can run after the
+ * parent row is gone. Best-effort: a lookup failure degrades to null
+ * (same as the pre-column behavior) rather than dropping the usage row.
+ */
+function lookupConversationType(conversationId: string | null): string | null {
+  if (conversationId === null) {
+    return null;
+  }
+  try {
+    const row = getDb()
+      .select({ conversationType: conversations.conversationType })
+      .from(conversations)
+      .where(eq(conversations.id, conversationId))
+      .get();
+    return row?.conversationType ?? null;
+  } catch {
+    return null;
+  }
+}
+
 export function recordUsageEvent(
   input: UsageEventInput,
   pricing: PricingResult,
@@ -88,6 +112,10 @@ export function recordUsageEvent(
       // the assistant happens to be running on at upload time. See
       // migration 267 + `TelemetryEventBase.assistant_version` (wire).
       assistantVersion: event.assistantVersion,
+      // Capture the parent conversation's type at RECORD time for the
+      // same reason: the conversation row may be deleted before the
+      // telemetry flush joins against it. See migration 353.
+      conversationType: lookupConversationType(event.conversationId),
     })
     .run();
   return event;
@@ -192,9 +220,11 @@ export function listUsageEvents(options?: { limit?: number }): UsageEvent[] {
 export interface UnreportedUsageEvent extends UsageEvent {
   /**
    * Type of the parent conversation (`"standard"` / `"background"` /
-   * `"scheduled"`). Null when the LLM call has no `conversationId`
-   * (memory consolidation, background embedding work, etc.) and so no
-   * `conversations` row to join against.
+   * `"scheduled"`). Sourced from the value captured at record time
+   * (survives deletion of the parent conversation before flush), with a
+   * JOIN to `conversations` as the fallback for rows persisted before
+   * migration 353. Null when the LLM call has no `conversationId`
+   * (memory consolidation, background embedding work, etc.).
    */
   conversationType: string | null;
   /**
@@ -263,10 +293,13 @@ export function queryUnreportedUsageEvents(
       ${conversations.createdAt}
     )
   END`;
-  // JOIN to `conversations` to attach `conversationType`. LEFT JOIN
-  // because `llm_usage_events.conversationId` is nullable — calls that
-  // aren't tied to a conversation (memory consolidation, etc.) still
-  // need to flush through telemetry.
+  // `conversationType` prefers the value stamped on the row at record
+  // time (migration 353) — the parent conversation may have been deleted
+  // before this flush (retrospective fork GC, user deletion) — and falls
+  // back to a LEFT JOIN against `conversations` for pre-353 rows. LEFT
+  // JOIN because `llm_usage_events.conversationId` is nullable — calls
+  // that aren't tied to a conversation (memory consolidation, etc.)
+  // still need to flush through telemetry.
   //
   // `turnIndex` is a correlated subquery counting real user turns in
   // the same conversation up to and including this LLM call's
@@ -297,7 +330,11 @@ export function queryUnreportedUsageEvents(
       pricingStatus: llmUsageEvents.pricingStatus,
       assistantVersion: llmUsageEvents.assistantVersion,
       llmCallCount: llmUsageEvents.llmCallCount,
-      conversationType: conversations.conversationType,
+      conversationType: sql<
+        string | null
+      >`COALESCE(${llmUsageEvents.conversationType}, ${conversations.conversationType})`.as(
+        "resolved_conversation_type",
+      ),
       // Null when conversationId is null (no parent conversation).
       // Otherwise the count of eligible user turns up to and including
       // this LLM call's createdAt. The COALESCE guard returns null