agent-relay-server 0.15.1 → 0.17.0

package/src/db.ts

@@ -76,6 +76,59 @@ import { STALE_TTL_MS, DAY_MS, CLAIM_LEASE_MS, POOL_CLAIM_LEASE_MS, WORKSPACE_ME
 let db: Database;
 const CONTEXT_SNAPSHOT_DEBOUNCE_MS = 60_000;
 
+// Connection-scoped pragmas. journal_mode and auto_vacuum persist in the file;
+// the rest reset per connection, so they must be re-applied on every open.
+function applyConnectionPragmas(conn: Database): void {
+  conn.run("PRAGMA journal_mode = WAL");
+  // Wait up to 5s for a held lock instead of failing instantly with SQLITE_BUSY.
+  // Matters with many agents polling/writing concurrently.
+  conn.run("PRAGMA busy_timeout = 5000");
+  // NORMAL is the recommended durability level under WAL: as safe as FULL except
+  // for a power loss mid-checkpoint, and meaningfully faster on writes.
+  conn.run("PRAGMA synchronous = NORMAL");
+  conn.run("PRAGMA foreign_keys = ON");
+  // ~8MB page cache (negative = KiB) and 256MB mmap window for the read-heavy
+  // poll workload. Both are best-effort; SQLite ignores them if unsupported.
+  conn.run("PRAGMA cache_size = -8000");
+  conn.run("PRAGMA mmap_size = 268435456");
+}
+
+// Slow-query log. Off unless AGENT_RELAY_DB_SLOW_MS is set (>0). Wraps the
+// execution of the heavy dynamic queries so the next slow query surfaces before
+// it wedges something (see issue #197 — the 8.6s reply-obligation query).
+const SLOW_QUERY_MS = Number(process.env.AGENT_RELAY_DB_SLOW_MS) || 0;
+function timedQuery<T>(label: string, run: () => T): T {
+  if (SLOW_QUERY_MS <= 0) return run();
+  const start = performance.now();
+  try {
+    return run();
+  } finally {
+    const ms = performance.now() - start;
+    if (ms >= SLOW_QUERY_MS) {
+      console.warn(`[db.slow] ${label} took ${ms.toFixed(1)}ms (threshold ${SLOW_QUERY_MS}ms)`);
+    }
+  }
+}
+
+// Periodic DB upkeep, invoked by the maintenance scheduler. ANALYZE refreshes
+// planner statistics, PRAGMA optimize applies them, wal_checkpoint(TRUNCATE)
+// bounds WAL growth, and VACUUM (opt-in) reclaims space since auto_vacuum is off.
+export function runDbMaintenance(options: { vacuum?: boolean } = {}): {
+  analyzed: boolean;
+  checkpointed: boolean;
+  vacuumed: boolean;
+} {
+  db.run("ANALYZE");
+  db.run("PRAGMA optimize");
+  db.run("PRAGMA wal_checkpoint(TRUNCATE)");
+  let vacuumed = false;
+  if (options.vacuum) {
+    db.run("VACUUM");
+    vacuumed = true;
+  }
+  return { analyzed: true, checkpointed: true, vacuumed };
+}
+
 const REACTION_EMOJI_ALIASES: Record<string, string> = {
   "+1": "👍",
   ":+1:": "👍",
@@ -110,7 +163,7 @@ export function normalizeReactionEmoji(value: string): string {
 }
 
 function normalizeExistingMessageReactions(): void {
-  const rows = db.prepare("SELECT message_id, actor_id, emoji, created_at, updated_at FROM message_reactions").all() as Array<{
+  const rows = db.query("SELECT message_id, actor_id, emoji, created_at, updated_at FROM message_reactions").all() as Array<{
     message_id: number;
     actor_id: string;
     emoji: string;
@@ -118,14 +171,14 @@ function normalizeExistingMessageReactions(): void {
     updated_at: number;
   }>;
   const migrate = db.transaction((items: typeof rows) => {
-    const upsert = db.prepare(`
+    const upsert = db.query(`
       INSERT INTO message_reactions (message_id, actor_id, emoji, created_at, updated_at)
       VALUES (?, ?, ?, ?, ?)
       ON CONFLICT(message_id, actor_id, emoji) DO UPDATE SET
         created_at = min(message_reactions.created_at, excluded.created_at),
         updated_at = max(message_reactions.updated_at, excluded.updated_at)
     `);
-    const remove = db.prepare("DELETE FROM message_reactions WHERE message_id = ? AND actor_id = ? AND emoji = ?");
+    const remove = db.query("DELETE FROM message_reactions WHERE message_id = ? AND actor_id = ? AND emoji = ?");
     for (const row of items) {
       const normalized = normalizeReactionEmoji(row.emoji);
       if (normalized === row.emoji) continue;
@@ -138,8 +191,7 @@ function normalizeExistingMessageReactions(): void {
 
 export function initDb(path: string = "agent-relay.db"): Database {
   db = new Database(path, { create: true });
-  db.run("PRAGMA journal_mode = WAL");
-  db.run("PRAGMA foreign_keys = ON");
+  applyConnectionPragmas(db);
 
   db.run(`
     CREATE TABLE IF NOT EXISTS agents (
@@ -187,7 +239,8 @@ export function initDb(path: string = "agent-relay.db"): Database {
       payload TEXT NOT NULL DEFAULT '{}',
       meta TEXT NOT NULL DEFAULT '{}',
       read_by TEXT NOT NULL DEFAULT '[]',
-      created_at INTEGER NOT NULL
+      created_at INTEGER NOT NULL,
+      occurred_at INTEGER
     );
 
     CREATE INDEX IF NOT EXISTS idx_msg_to ON messages(to_target);
@@ -794,7 +847,7 @@ export function initDb(path: string = "agent-relay.db"): Database {
   normalizeExistingMessageReactions();
 
   // Migrations
-  const cols = db.prepare("PRAGMA table_info(messages)").all() as any[];
+  const cols = db.query("PRAGMA table_info(messages)").all() as any[];
   const colNames = cols.map((c: any) => c.name);
   if (!colNames.includes("thread_id")) {
     db.run("ALTER TABLE messages ADD COLUMN thread_id INTEGER");
@@ -838,7 +891,12 @@ export function initDb(path: string = "agent-relay.db"): Database {
   if (!colNames.includes("resolved_to_agent")) {
     db.run("ALTER TABLE messages ADD COLUMN resolved_to_agent TEXT");
   }
-  db.prepare(
+  // Event time (#196): when a Runner queues a message in its durable outbox during an
+  // outage, occurred_at preserves when it really happened vs. the later receive time.
+  if (!colNames.includes("occurred_at")) {
+    db.run("ALTER TABLE messages ADD COLUMN occurred_at INTEGER");
+  }
+  db.query(
     "UPDATE messages SET claim_expires_at = coalesce(claimed_at, ?) + ? WHERE claimed_by IS NOT NULL AND claim_expires_at IS NULL",
   ).run(Date.now(), CLAIM_LEASE_MS);
   db.run("CREATE INDEX IF NOT EXISTS idx_msg_thread ON messages(thread_id)");
@@ -846,7 +904,7 @@ export function initDb(path: string = "agent-relay.db"): Database {
   db.run("CREATE INDEX IF NOT EXISTS idx_msg_delivery_status ON messages(delivery_status)");
   db.run("CREATE INDEX IF NOT EXISTS idx_msg_resolved_to_agent ON messages(resolved_to_agent)");
 
-  const tokenCols = db.prepare("PRAGMA table_info(tokens)").all() as any[];
+  const tokenCols = db.query("PRAGMA table_info(tokens)").all() as any[];
   const tokenColNames = tokenCols.map((c: any) => c.name);
   if (!tokenColNames.includes("constraints")) {
     db.run("ALTER TABLE tokens ADD COLUMN constraints TEXT");
@@ -870,7 +928,7 @@ export function initDb(path: string = "agent-relay.db"): Database {
   `);
   db.run("CREATE INDEX IF NOT EXISTS idx_mda_message ON message_delivery_attempts(message_id, created_at DESC)");
 
-  const channelBindingsSql = db.prepare("SELECT sql FROM sqlite_master WHERE type = 'table' AND name = 'channel_bindings'").get() as { sql?: string } | undefined;
+  const channelBindingsSql = db.query("SELECT sql FROM sqlite_master WHERE type = 'table' AND name = 'channel_bindings'").get() as { sql?: string } | undefined;
   if (channelBindingsSql?.sql?.includes("UNIQUE(channel_id, conversation_key)")) {
     db.transaction(() => {
       db.run("ALTER TABLE channel_bindings RENAME TO channel_bindings_old");
@@ -899,7 +957,7 @@ export function initDb(path: string = "agent-relay.db"): Database {
   db.run("CREATE INDEX IF NOT EXISTS idx_channel_bindings_channel ON channel_bindings(channel_id, priority)");
   db.run("CREATE UNIQUE INDEX IF NOT EXISTS idx_channel_bindings_target ON channel_bindings(channel_id, conversation_key, target_type, target_id)");
 
-  const bindingColNames = (db.prepare("PRAGMA table_info(channel_bindings)").all() as any[]).map((c: any) => c.name);
+  const bindingColNames = (db.query("PRAGMA table_info(channel_bindings)").all() as any[]).map((c: any) => c.name);
   if (!bindingColNames.includes("pool_selector")) {
     db.run("ALTER TABLE channel_bindings ADD COLUMN pool_selector TEXT");
     db.run("ALTER TABLE channel_bindings ADD COLUMN pool_agent_id TEXT");
@@ -918,23 +976,23 @@ export function initDb(path: string = "agent-relay.db"): Database {
   // Backfill thread_id for pre-migration rows (self-threaded).
   db.run("UPDATE messages SET thread_id = id WHERE thread_id IS NULL");
 
-  const taskCols = db.prepare("PRAGMA table_info(tasks)").all() as any[];
+  const taskCols = db.query("PRAGMA table_info(tasks)").all() as any[];
   const taskColNames = taskCols.map((c: any) => c.name);
   if (!taskColNames.includes("claim_expires_at")) {
     db.run("ALTER TABLE tasks ADD COLUMN claim_expires_at INTEGER");
   }
-  db.prepare(
+  db.query(
     "UPDATE tasks SET claim_expires_at = coalesce(claimed_at, ?) + ? WHERE claimed_by IS NOT NULL AND claim_expires_at IS NULL",
   ).run(Date.now(), CLAIM_LEASE_MS);
 
   // Migration: orchestrators.api_url
-  const orchCols = db.prepare("PRAGMA table_info(orchestrators)").all() as any[];
+  const orchCols = db.query("PRAGMA table_info(orchestrators)").all() as any[];
   const orchColNames = orchCols.map((c: any) => c.name);
   if (!orchColNames.includes("api_url")) {
     db.run("ALTER TABLE orchestrators ADD COLUMN api_url TEXT");
   }
 
-  const managedStateCols = db.prepare("PRAGMA table_info(managed_agent_state)").all() as any[];
+  const managedStateCols = db.query("PRAGMA table_info(managed_agent_state)").all() as any[];
   const managedStateColNames = managedStateCols.map((c: any) => c.name);
   if (!managedStateColNames.includes("workspace_id")) {
     db.run("ALTER TABLE managed_agent_state ADD COLUMN workspace_id TEXT");
@@ -954,7 +1012,7 @@ export function initDb(path: string = "agent-relay.db"): Database {
   `);
 
   // Migration: agents.label
-  const agentCols = db.prepare("PRAGMA table_info(agents)").all() as any[];
+  const agentCols = db.query("PRAGMA table_info(agents)").all() as any[];
   const agentColNames = agentCols.map((c: any) => c.name);
   if (!agentColNames.includes("label")) {
     db.run("ALTER TABLE agents ADD COLUMN label TEXT");
@@ -1076,7 +1134,7 @@ export function initDb(path: string = "agent-relay.db"): Database {
   // pass the sendMessage validation. The reaper exempts these by checking
   // meta.builtin (or by id for "user").
   const now = Date.now();
-  const builtinStmt = db.prepare(`
+  const builtinStmt = db.query(`
     INSERT INTO agents (id, name, kind, tags, machine, rig, capabilities, ready, status, meta, last_seen, created_at)
     VALUES (?, ?, ?, ?, NULL, NULL, '[]', 1, 'online', '{"builtin":true}', ?, ?)
     ON CONFLICT(id) DO UPDATE SET status = 'online', ready = 1, last_seen = excluded.last_seen
@@ -1095,6 +1153,15 @@ export function initDb(path: string = "agent-relay.db"): Database {
     `);
   }
 
+  // Bootstrap planner statistics on first run (sqlite_stat1 absent means ANALYZE
+  // has never run — the planner would otherwise rely on heuristics only), then
+  // let PRAGMA optimize apply/refresh them cheaply on every startup.
+  const hasStats = db
+    .query("SELECT 1 FROM sqlite_master WHERE type = 'table' AND name = 'sqlite_stat1'")
+    .get();
+  if (!hasStats) db.run("ANALYZE");
+  db.run("PRAGMA optimize");
+
   return db;
 }
 
@@ -1247,6 +1314,7 @@ function rowToMessage(row: any): Message {
     reactions: parseJson(row.reactions_json ?? "[]", []),
     readBy: parseJson(row.read_by_agents ?? "[]", []),
     createdAt: row.created_at,
+    occurredAt: row.occurred_at ?? undefined,
   };
 }
 
@@ -1687,7 +1755,7 @@ export function upsertAgent(input: RegisterAgentInput): AgentCard {
   const labelProvided = Object.prototype.hasOwnProperty.call(input, "label");
   const readyProvided = Object.prototype.hasOwnProperty.call(input, "ready");
   const instanceProvided = Boolean(input.instanceId);
-  const stmt = db.prepare(`
+  const stmt = db.query(`
     INSERT INTO agents (id, name, kind, label, tags, machine, rig, capabilities, ready, status, instance_id, epoch, provider_capabilities, context_state, meta, last_seen, created_at)
     VALUES ($id, $name, $kind, $label, $tags, $machine, $rig, $capabilities, $ready, $status, $instanceId, $initialEpoch, $providerCapabilities, $contextState, $meta, $now, $now)
     ON CONFLICT(id) DO UPDATE SET
@@ -1759,18 +1827,18 @@ export function validateAgentSession(id: string, guard?: AgentSessionGuard): { o
 export function setLabel(id: string, label: string | null): boolean {
   const normalized = label && label.trim() ? label.trim() : null;
   return (
-    db.prepare("UPDATE agents SET label = ? WHERE id = ?").run(normalized, id).changes > 0
+    db.query("UPDATE agents SET label = ? WHERE id = ?").run(normalized, id).changes > 0
   );
 }
 
 export function setTags(id: string, tags: string[]): AgentCard | null {
   const normalized = [...new Set(tags.map((tag) => tag.trim()).filter(Boolean))];
-  const result = db.prepare("UPDATE agents SET tags = ?, last_seen = ? WHERE id = ?").run(JSON.stringify(normalized), Date.now(), id);
+  const result = db.query("UPDATE agents SET tags = ?, last_seen = ? WHERE id = ?").run(JSON.stringify(normalized), Date.now(), id);
   return result.changes > 0 ? getAgent(id) : null;
 }
 
 export function getAgent(id: string): AgentCard | null {
-  const row = db.prepare("SELECT * FROM agents WHERE id = ?").get(id) as any;
+  const row = db.query("SELECT * FROM agents WHERE id = ?").get(id) as any;
   return row ? rowToAgent(row) : null;
 }
 
@@ -1796,7 +1864,7 @@ export function listAgents(filter?: {
   }
 
   sql += " ORDER BY last_seen DESC";
-  return (db.prepare(sql).all(...params) as any[]).map(rowToAgent);
+  return (db.query(sql).all(...params) as any[]).map(rowToAgent);
 }
 
 export function setStatus(id: string, status: AgentCard["status"], guard?: AgentSessionGuard): boolean {
@@ -1806,7 +1874,7 @@ export function setStatus(id: string, status: AgentCard["status"], guard?: Agent
   const sql = ready === 0
     ? "UPDATE agents SET status = ?, ready = 0, last_seen = ? WHERE id = ?"
     : "UPDATE agents SET status = ?, last_seen = ? WHERE id = ?";
-  const changed = db.prepare(sql).run(status, now, id).changes > 0;
+  const changed = db.query(sql).run(status, now, id).changes > 0;
   if (changed && status === "offline") closeOpenPairsForAgent(id, now);
   if (changed && status === "offline") electWorkspaceStewards();
   return changed;
@@ -1817,7 +1885,7 @@ export function markReady(id: string, ready: boolean, guard?: AgentSessionGuard)
   const now = Date.now();
   return (
     db
-      .prepare("UPDATE agents SET ready = ?, last_seen = ? WHERE id = ?")
+      .query("UPDATE agents SET ready = ?, last_seen = ? WHERE id = ?")
       .run(ready ? 1 : 0, now, id).changes > 0
   );
 }
@@ -1828,7 +1896,7 @@ export function mergeAgentMeta(id: string, meta: Record<string, unknown>, guard?
   if (!agent) return false;
   const merged = { ...(agent.meta ?? {}), ...meta };
   const result = db
-    .prepare("UPDATE agents SET meta = ?, last_seen = ? WHERE id = ?")
+    .query("UPDATE agents SET meta = ?, last_seen = ? WHERE id = ?")
     .run(JSON.stringify(merged), Date.now(), id);
   return result.changes > 0;
 }
@@ -1844,7 +1912,7 @@ export function recordAgentExitDiagnostics(id: string, diagnostics: ManagedSessi
     lastExitAt: diagnostics.detectedAt || now,
   };
   const result = db
-    .prepare("UPDATE agents SET status = 'offline', ready = 0, meta = ?, last_seen = ? WHERE id = ?")
+    .query("UPDATE agents SET status = 'offline', ready = 0, meta = ?, last_seen = ? WHERE id = ?")
     .run(JSON.stringify(merged), now, id);
   if (result.changes <= 0) return null;
   closeOpenPairsForAgent(id, now);
@@ -1860,7 +1928,7 @@ export function heartbeat(
   const now = Date.now();
   if (runtime?.providerCapabilities || runtime?.context) {
     const result = db
-      .prepare(`
+      .query(`
         UPDATE agents SET
           last_seen = ?,
           status = CASE WHEN status = 'offline' THEN 'idle' ELSE status END,
@@ -1878,7 +1946,7 @@ export function heartbeat(
     return result.changes > 0;
   }
   const result = db
-    .prepare("UPDATE agents SET last_seen = ?, status = CASE WHEN status = 'offline' THEN 'idle' ELSE status END WHERE id = ?")
+    .query("UPDATE agents SET last_seen = ?, status = CASE WHEN status = 'offline' THEN 'idle' ELSE status END WHERE id = ?")
     .run(now, id);
   return result.changes > 0;
 }
@@ -1893,23 +1961,23 @@ export function listContextSnapshots(agentId: string, options: { since?: number;
   }
   sql += " ORDER BY captured_at ASC LIMIT ?";
   params.push(limit);
-  return (db.prepare(sql).all(...params) as any[]).map(rowToContextSnapshot);
+  return (db.query(sql).all(...params) as any[]).map(rowToContextSnapshot);
 }
 
 function pruneContextSnapshots(agentId?: string, olderThan = Date.now() - DAY_MS): number {
   const result = agentId
-    ? db.prepare("DELETE FROM context_snapshots WHERE agent_id = ? AND captured_at < ?").run(agentId, olderThan)
-    : db.prepare("DELETE FROM context_snapshots WHERE captured_at < ?").run(olderThan);
+    ? db.query("DELETE FROM context_snapshots WHERE agent_id = ? AND captured_at < ?").run(agentId, olderThan)
+    : db.query("DELETE FROM context_snapshots WHERE captured_at < ?").run(olderThan);
   return result.changes;
 }
 
 function recordContextSnapshot(agentId: string, context: ContextState, now: number): void {
   const latest = db
-    .prepare("SELECT captured_at FROM context_snapshots WHERE agent_id = ? ORDER BY captured_at DESC LIMIT 1")
+    .query("SELECT captured_at FROM context_snapshots WHERE agent_id = ? ORDER BY captured_at DESC LIMIT 1")
     .get(agentId) as { captured_at: number } | undefined;
   if (latest && latest.captured_at > now - CONTEXT_SNAPSHOT_DEBOUNCE_MS) return;
 
-  db.prepare(`
+  db.query(`
     INSERT INTO context_snapshots (
       agent_id,
       utilization,
@@ -1999,7 +2067,7 @@ function upsertChannelForAgent(agent: AgentCard): void {
     ? (agent.meta.topicChannels as unknown[]).filter((item): item is string => typeof item === "string" && item.trim().length > 0)
     : [];
 
-  db.prepare(`
+  db.query(`
     INSERT INTO channels (id, provider, account_id, display_name, agent_id, transport, direction, topic_channels, capabilities, meta, created_at, updated_at)
     VALUES ($id, $provider, $accountId, $displayName, $agentId, $transport, $direction, $topicChannels, $capabilities, $meta, $now, $now)
     ON CONFLICT(provider, account_id) DO UPDATE SET
@@ -2039,7 +2107,7 @@ function upsertChannelForAgent(agent: AgentCard): void {
 }
 
 export function listChannels(): ChannelSummary[] {
-  const rows = db.prepare(`
+  const rows = db.query(`
     SELECT
       c.*,
       c.capabilities AS channel_capabilities,
@@ -2074,8 +2142,8 @@ export function getChannel(channelId: string): ChannelSummary | null {
 
 export function listChannelBindings(channelId?: string): ChannelBinding[] {
   const rows = channelId
-    ? db.prepare("SELECT * FROM channel_bindings WHERE channel_id = ? ORDER BY priority DESC, updated_at DESC").all(channelId) as any[]
-    : db.prepare("SELECT * FROM channel_bindings ORDER BY channel_id, priority DESC, updated_at DESC").all() as any[];
+    ? db.query("SELECT * FROM channel_bindings WHERE channel_id = ? ORDER BY priority DESC, updated_at DESC").all(channelId) as any[]
+    : db.query("SELECT * FROM channel_bindings ORDER BY channel_id, priority DESC, updated_at DESC").all() as any[];
   return rows.map(rowToChannelBinding);
 }
 
@@ -2097,9 +2165,9 @@ export function upsertChannelBinding(input: {
   const now = Date.now();
   db.transaction(() => {
     if (mode === "exclusive") {
-      db.prepare("DELETE FROM channel_bindings WHERE channel_id = ? AND conversation_key = ?").run(input.channelId, conversationKey);
+      db.query("DELETE FROM channel_bindings WHERE channel_id = ? AND conversation_key = ?").run(input.channelId, conversationKey);
     }
-    db.prepare(`
+    db.query(`
       INSERT INTO channel_bindings (id, channel_id, conversation_key, conversation_id, target_type, target_id, mode, priority, pool_selector, created_at, updated_at)
       VALUES ($id, $channelId, $conversationKey, $conversationId, $targetType, $targetId, $mode, $priority, $poolSelector, $now, $now)
       ON CONFLICT(channel_id, conversation_key, target_type, target_id) DO UPDATE SET
@@ -2122,7 +2190,7 @@ export function upsertChannelBinding(input: {
   })();
 
   evaluatePoolBindings(now);
-  const row = db.prepare("SELECT * FROM channel_bindings WHERE id = ?").get(id) as any;
+  const row = db.query("SELECT * FROM channel_bindings WHERE id = ?").get(id) as any;
   return rowToChannelBinding(row);
 }
 
@@ -2134,7 +2202,7 @@ interface PoolBindingChange {
 }
 
 export function evaluatePoolBindings(now: number = Date.now()): PoolBindingChange[] {
-  const rows = db.prepare("SELECT * FROM channel_bindings WHERE target_type = 'pool'").all() as any[];
+  const rows = db.query("SELECT * FROM channel_bindings WHERE target_type = 'pool'").all() as any[];
   const changes: PoolBindingChange[] = [];
 
   for (const row of rows) {
@@ -2149,7 +2217,7 @@ export function evaluatePoolBindings(now: number = Date.now()): PoolBindingChang
       const holder = getAgent(currentAgentId);
       if (holder && holder.status !== "offline" && holder.ready && holder.lastSeen > now - STALE_TTL_MS && agentCanServeChannel(holder, channelId)) {
         if (currentEpoch === null || holder.epoch === currentEpoch) {
-          db.prepare("UPDATE channel_bindings SET pool_claim_expires_at = ? WHERE id = ?")
+          db.query("UPDATE channel_bindings SET pool_claim_expires_at = ? WHERE id = ?")
             .run(now + POOL_CLAIM_LEASE_MS, bindingId);
           holderValid = true;
         }
@@ -2157,7 +2225,7 @@ export function evaluatePoolBindings(now: number = Date.now()): PoolBindingChang
     }
 
     if (!holderValid && currentAgentId) {
-      db.prepare("UPDATE channel_bindings SET pool_agent_id = NULL, pool_agent_epoch = NULL, pool_claim_expires_at = NULL WHERE id = ?")
+      db.query("UPDATE channel_bindings SET pool_agent_id = NULL, pool_agent_epoch = NULL, pool_claim_expires_at = NULL WHERE id = ?")
         .run(bindingId);
       changes.push({ bindingId, channelId, previousAgentId: currentAgentId, newAgentId: null });
     }
@@ -2173,7 +2241,7 @@ export function evaluatePoolBindings(now: number = Date.now()): PoolBindingChang
 
       if (eligible.length > 0) {
         const picked = eligible[0]!;
-        db.prepare("UPDATE channel_bindings SET pool_agent_id = ?, pool_agent_epoch = ?, pool_claim_expires_at = ? WHERE id = ?")
+        db.query("UPDATE channel_bindings SET pool_agent_id = ?, pool_agent_epoch = ?, pool_claim_expires_at = ? WHERE id = ?")
           .run(picked.id, picked.epoch, now + POOL_CLAIM_LEASE_MS, bindingId);
         const lastChange = changes[changes.length - 1];
         if (lastChange && lastChange.bindingId === bindingId && lastChange.newAgentId === null) {
@@ -2190,12 +2258,12 @@ export function evaluatePoolBindings(now: number = Date.now()): PoolBindingChang
 
 export function resolveChannelRoutes(channelId: string, conversationId?: string): ChannelBinding[] {
   const rows = conversationId
-    ? db.prepare(`
+    ? db.query(`
       SELECT * FROM channel_bindings
       WHERE channel_id = ? AND conversation_key IN (?, '')
       ORDER BY CASE WHEN conversation_key = ? THEN 1 ELSE 0 END DESC, priority DESC, updated_at DESC
     `).all(channelId, conversationId, conversationId) as any[]
-    : db.prepare(`
+    : db.query(`
       SELECT * FROM channel_bindings
       WHERE channel_id = ? AND conversation_key = ''
       ORDER BY priority DESC, updated_at DESC
@@ -2208,9 +2276,9 @@ export function resolveChannelRoutes(channelId: string, conversationId?: string)
 export function reapStaleAgents(ttlMs: number = STALE_TTL_MS): string[] {
   const now = Date.now();
   const cutoff = now - ttlMs;
-  db.prepare("UPDATE agents SET last_seen = ? WHERE id IN ('user', 'system')").run(now);
+  db.query("UPDATE agents SET last_seen = ? WHERE id IN ('user', 'system')").run(now);
   const rows = db
-    .prepare(
+    .query(
       "UPDATE agents SET status = 'offline', ready = 0 WHERE status NOT IN ('offline', 'stale') AND last_seen < ? AND id NOT IN ('user', 'system') RETURNING id"
     )
     .all(cutoff) as any[];
@@ -2232,9 +2300,9 @@ export function reapStaleAgents(ttlMs: number = STALE_TTL_MS): string[] {
 // re-open (gated on status IN claimed/in_progress/blocked/orphaned) then skips.
 function settleSingleTargetOnDemandTasks(condition: string, params: any[], now: number, reason: string): void {
   const selectSql = `${TASK_SELECT} WHERE (${condition}) AND json_extract(metadata, '$.targetMode') = 'on_demand_agent' AND status IN ('claimed', 'in_progress', 'blocked', 'orphaned')`;
-  const rows = db.prepare(selectSql).all(...params) as any[];
+  const rows = db.query(selectSql).all(...params) as any[];
   if (rows.length === 0) return;
-  db.prepare(
+  db.query(
     `UPDATE tasks SET status = 'done', claim_expires_at = NULL, updated_at = ?, last_seen_at = ? WHERE (${condition}) AND json_extract(metadata, '$.targetMode') = 'on_demand_agent' AND status IN ('claimed', 'in_progress', 'blocked', 'orphaned')`
   ).run(now, now, ...params);
   for (const row of rows) {
@@ -2253,7 +2321,7 @@ export function pruneOfflineAgents(maxOfflineMs: number = DAY_MS): string[] {
   const cutoff = Date.now() - maxOfflineMs;
   return db.transaction(() => {
     const rows = db
-      .prepare(
+      .query(
         "SELECT id FROM agents WHERE status = 'offline' AND last_seen < ? AND id NOT IN ('user', 'system')"
       )
       .all(cutoff) as any[];
@@ -2262,7 +2330,7 @@ export function pruneOfflineAgents(maxOfflineMs: number = DAY_MS): string[] {
 
     // Release claims held by pruned agents so work becomes claimable again.
     db
-      .prepare(
+      .query(
         "UPDATE messages SET claimed_by = NULL, claimed_at = NULL, claim_expires_at = NULL WHERE claimed_by IN (SELECT id FROM agents WHERE status = 'offline' AND last_seen < ? AND id NOT IN ('user', 'system'))"
       )
       .run(cutoff);
@@ -2271,7 +2339,7 @@ export function pruneOfflineAgents(maxOfflineMs: number = DAY_MS): string[] {
     settleSingleTargetOnDemandTasks(offlineClaimCondition, [cutoff], now, "agent-pruned");
 
     db
-      .prepare(
+      .query(
         `UPDATE tasks SET status = 'open', claimed_by = NULL, claimed_at = NULL, claim_expires_at = NULL, updated_at = ? WHERE ${offlineClaimCondition} AND status IN ('claimed', 'in_progress', 'blocked')`
       )
       .run(now, cutoff);
@@ -2282,7 +2350,7 @@ export function pruneOfflineAgents(maxOfflineMs: number = DAY_MS): string[] {
     }
 
     db
-      .prepare(
+      .query(
         "DELETE FROM agents WHERE status = 'offline' AND last_seen < ? AND id NOT IN ('user', 'system')"
       )
       .run(cutoff);
@@ -2299,7 +2367,7 @@ export function findAgentsByCapability(capability: string, onlineOnly = true): A
     params.push(Date.now() - STALE_TTL_MS);
   }
   sql += " ORDER BY last_seen DESC";
-  return (db.prepare(sql).all(...params) as any[]).map(rowToAgent);
+  return (db.query(sql).all(...params) as any[]).map(rowToAgent);
 }
 
 export function deleteAgent(id: string): { ok: boolean; error?: string } {
@@ -2310,23 +2378,23 @@ export function deleteAgent(id: string): { ok: boolean; error?: string } {
     // Release any claims held by this agent so the tasks become claimable again.
     // from_agent is left intact as historical record.
     const now = Date.now();
-    db.prepare("UPDATE messages SET claimed_by = NULL, claimed_at = NULL, claim_expires_at = NULL WHERE claimed_by = ?").run(id);
+    db.query("UPDATE messages SET claimed_by = NULL, claimed_at = NULL, claim_expires_at = NULL WHERE claimed_by = ?").run(id);
     settleSingleTargetOnDemandTasks("claimed_by = ?", [id], now, "agent-removed");
-    db.prepare("UPDATE tasks SET status = 'open', claimed_by = NULL, claimed_at = NULL, claim_expires_at = NULL, updated_at = ? WHERE claimed_by = ? AND status IN ('claimed', 'in_progress', 'blocked')").run(now, id);
+    db.query("UPDATE tasks SET status = 'open', claimed_by = NULL, claimed_at = NULL, claim_expires_at = NULL, updated_at = ? WHERE claimed_by = ? AND status IN ('claimed', 'in_progress', 'blocked')").run(now, id);
     revokeRuntimeTokensForAgent(id, now);
     closeOpenPairsForAgent(id, now);
-    return db.prepare("DELETE FROM agents WHERE id = ?").run(id).changes > 0;
+    return db.query("DELETE FROM agents WHERE id = ?").run(id).changes > 0;
   })();
   return deleted ? { ok: true } : { ok: false, error: "agent not found" };
 }
 
 export function revokeRuntimeTokensForAgent(agentId: string, now = Date.now()): string[] {
-  const row = db.prepare("SELECT meta FROM agents WHERE id = ?").get(agentId) as { meta?: string } | undefined;
+  const row = db.query("SELECT meta FROM agents WHERE id = ?").get(agentId) as { meta?: string } | undefined;
   const jtis = runtimeTokenJtisFromMeta(parseJson(row?.meta ?? "{}", {}));
   if (jtis.length === 0) return [];
   const revokedAt = Math.floor(now / 1000);
   const placeholders = jtis.map(() => "?").join(",");
-  const rows = db.prepare(`
+  const rows = db.query(`
     UPDATE tokens
     SET revoked_at = ?
     WHERE revoked_at IS NULL
@@ -2360,13 +2428,13 @@ const TASK_SELECT = "SELECT * FROM tasks";
 
 function findOpenTaskByDedupe(source: string, dedupeKey: string): Task | null {
   const row = db
-    .prepare(`${TASK_SELECT} WHERE source = ? AND dedupe_key = ? AND status NOT IN ('done', 'failed', 'canceled') ORDER BY id DESC LIMIT 1`)
+    .query(`${TASK_SELECT} WHERE source = ? AND dedupe_key = ? AND status NOT IN ('done', 'failed', 'canceled') ORDER BY id DESC LIMIT 1`)
     .get(source, dedupeKey) as any;
   return row ? rowToTask(row) : null;
 }
 
 function insertTaskEvent(taskId: number, event: Required<Omit<TaskEvent, "id" | "taskId" | "createdAt">>, now: number): TaskEvent {
-  const result = db.prepare(`
+  const result = db.query(`
     INSERT INTO task_events (task_id, source, type, severity, title, body, metadata, created_at)
     VALUES (?, ?, ?, ?, ?, ?, ?, ?)
   `).run(taskId, event.source, event.type, event.severity, event.title, event.body, JSON.stringify(event.metadata), now);
@@ -2374,7 +2442,7 @@ function insertTaskEvent(taskId: number, event: Required<Omit<TaskEvent, "id" |
 }
 
 function getTaskEvent(id: number): TaskEvent | null {
-  const row = db.prepare("SELECT * FROM task_events WHERE id = ?").get(id) as any;
+  const row = db.query("SELECT * FROM task_events WHERE id = ?").get(id) as any;
   return row ? rowToTaskEvent(row) : null;
 }
 
@@ -2406,7 +2474,7 @@ export function ingestIntegrationEvent(input: IntegrationEventInput, integration
     let created = false;
 
     if (existing) {
-      db.prepare(`
+      db.query(`
         UPDATE tasks
         SET title = ?, body = ?, severity = ?, target = ?, channel = ?, external_url = ?,
             occurrence_count = occurrence_count + 1, metadata = ?, updated_at = ?, last_seen_at = ?,
@@ -2431,7 +2499,7 @@ export function ingestIntegrationEvent(input: IntegrationEventInput, integration
       );
       taskId = existing.id;
     } else {
-      const result = db.prepare(`
+      const result = db.query(`
         INSERT INTO tasks (source, title, body, severity, status, target, channel, dedupe_key, external_url, metadata, created_at, updated_at, last_seen_at)
         VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
       `).run(
@@ -2485,7 +2553,7 @@ export function ingestIntegrationEvent(input: IntegrationEventInput, integration
           ...(attachmentRefs.length ? { attachments: attachmentRefs } : {}),
         },
       });
-      db.prepare("UPDATE tasks SET message_id = ?, updated_at = ? WHERE id = ?").run(message.id, now, task.id);
+      db.query("UPDATE tasks SET message_id = ?, updated_at = ? WHERE id = ?").run(message.id, now, task.id);
     }
 
     return { task: getTask(taskId)!, event, created, message };
@@ -2493,7 +2561,7 @@ export function ingestIntegrationEvent(input: IntegrationEventInput, integration
 }
 
 export function getTask(id: number): Task | null {
-  const row = db.prepare(`${TASK_SELECT} WHERE id = ?`).get(id) as any;
+  const row = db.query(`${TASK_SELECT} WHERE id = ?`).get(id) as any;
   return row ? rowToTask(row) : null;
 }
 
@@ -2514,11 +2582,11 @@ export function listTasks(filter?: { status?: string; source?: string; target?:
   }
   const where = conditions.length ? `WHERE ${conditions.join(" AND ")}` : "";
   params.push(filter?.limit ?? 100);
-  return (db.prepare(`${TASK_SELECT} ${where} ORDER BY updated_at DESC LIMIT ?`).all(...params) as any[]).map(rowToTask);
+  return (db.query(`${TASK_SELECT} ${where} ORDER BY updated_at DESC LIMIT ?`).all(...params) as any[]).map(rowToTask);
 }
 
 export function listIntegrationTaskStats(): IntegrationTaskStats[] {
-  const rows = db.prepare(`
+  const rows = db.query(`
     SELECT
       source,
       COUNT(*) AS tasks,
@@ -2597,7 +2665,7 @@ export function upsertIntegrationRegistry(input: IntegrationRegistryInput): Retu
   const name = stringValue(input.name);
   if (!name) throw new ValidationError("integration name required");
   const now = Date.now();
-  db.prepare(`
+  db.query(`
     INSERT INTO integration_registry (
       name, display_name, description, enabled, scopes, targets, channels, type, icon, accent_color,
       tags, homepage_url, repository_url, docs_url, manifest, source, created_at, updated_at
@@ -2644,17 +2712,17 @@ export function upsertIntegrationRegistry(input: IntegrationRegistryInput): Retu
 }
 
 function getIntegrationRegistry(name: string): ReturnType<typeof rowToIntegrationRegistry> | null {
-  const row = db.prepare("SELECT * FROM integration_registry WHERE name = ?").get(name) as any;
+  const row = db.query("SELECT * FROM integration_registry WHERE name = ?").get(name) as any;
   return row ? rowToIntegrationRegistry(row) : null;
 }
 
 export function listIntegrationRegistry(): ReturnType<typeof rowToIntegrationRegistry>[] {
-  return (db.prepare("SELECT * FROM integration_registry ORDER BY display_name COLLATE NOCASE, name COLLATE NOCASE").all() as any[]).map(rowToIntegrationRegistry);
+  return (db.query("SELECT * FROM integration_registry ORDER BY display_name COLLATE NOCASE, name COLLATE NOCASE").all() as any[]).map(rowToIntegrationRegistry);
 }
 
 function updateIntegrationObserved(name: string, eventAt: number): void {
   const now = Date.now();
-  db.prepare(`
+  db.query(`
     INSERT INTO integration_registry (name, enabled, scopes, targets, channels, tags, manifest, source, created_at, updated_at, last_event_at, last_task_at)
     VALUES (?, 1, '[]', '[]', '[]', '[]', '{}', 'observed', ?, ?, ?, ?)
     ON CONFLICT(name) DO UPDATE SET
@@ -2670,7 +2738,7 @@ export function isIntegrationRegistryEnabled(name: string): boolean {
 }
 
 export function listTaskEvents(taskId: number): TaskEvent[] {
-  return (db.prepare("SELECT * FROM task_events WHERE task_id = ? ORDER BY id ASC").all(taskId) as any[]).map(rowToTaskEvent);
+  return (db.query("SELECT * FROM task_events WHERE task_id = ? ORDER BY id ASC").all(taskId) as any[]).map(rowToTaskEvent);
 }
 
 export function recordTaskEvent(taskId: number, input: {
@@ -2698,21 +2766,21 @@ export function releaseExpiredClaims(now: number = Date.now()): { messageIds: nu
     settleSingleTargetOnDemandTasks("claimed_by IS NOT NULL AND (claim_expires_at IS NULL OR claim_expires_at <= ?)", [now], now, "claim-lease-expired");
     const releasableMessageClaim = "claimed_by IS NOT NULL AND (claim_expires_at IS NULL OR claim_expires_at <= ?) AND NOT EXISTS (SELECT 1 FROM tasks t WHERE t.message_id = messages.id AND t.status IN ('done', 'failed', 'canceled'))";
     const messageRows = db
-      .prepare(`SELECT id FROM messages WHERE ${releasableMessageClaim}`)
+      .query(`SELECT id FROM messages WHERE ${releasableMessageClaim}`)
       .all(now) as any[];
     const taskRows = db
-      .prepare(`${TASK_SELECT} WHERE claimed_by IS NOT NULL AND (claim_expires_at IS NULL OR claim_expires_at <= ?) AND status IN ('claimed', 'in_progress', 'blocked')`)
+      .query(`${TASK_SELECT} WHERE claimed_by IS NOT NULL AND (claim_expires_at IS NULL OR claim_expires_at <= ?) AND status IN ('claimed', 'in_progress', 'blocked')`)
       .all(now) as any[];
 
     if (messageRows.length > 0) {
       db
-        .prepare(`UPDATE messages SET claimed_by = NULL, claimed_at = NULL, claim_expires_at = NULL WHERE ${releasableMessageClaim}`)
+        .query(`UPDATE messages SET claimed_by = NULL, claimed_at = NULL, claim_expires_at = NULL WHERE ${releasableMessageClaim}`)
         .run(now);
     }
 
     if (taskRows.length > 0) {
       db
-        .prepare("UPDATE tasks SET status = 'open', claimed_by = NULL, claimed_at = NULL, claim_expires_at = NULL, updated_at = ? WHERE claimed_by IS NOT NULL AND (claim_expires_at IS NULL OR claim_expires_at <= ?) AND status IN ('claimed', 'in_progress', 'blocked')")
+        .query("UPDATE tasks SET status = 'open', claimed_by = NULL, claimed_at = NULL, claim_expires_at = NULL, updated_at = ? WHERE claimed_by IS NOT NULL AND (claim_expires_at IS NULL OR claim_expires_at <= ?) AND status IN ('claimed', 'in_progress', 'blocked')")
         .run(now, now);
 
       for (const row of taskRows) {
@@ -2737,11 +2805,11 @@ export function releaseExpiredClaims(now: number = Date.now()): { messageIds: nu
 export function orphanTasksForAgent(agentId: string, now: number = Date.now()): Task[] {
   return db.transaction(() => {
     const rows = db
-      .prepare(`${TASK_SELECT} WHERE claimed_by = ? AND status IN ('claimed', 'in_progress')`)
+      .query(`${TASK_SELECT} WHERE claimed_by = ? AND status IN ('claimed', 'in_progress')`)
       .all(agentId) as any[];
     if (rows.length === 0) return [];
 
-    db.prepare(`
+    db.query(`
       UPDATE tasks
       SET status = 'orphaned', updated_at = ?, last_seen_at = ?
       WHERE claimed_by = ? AND status IN ('claimed', 'in_progress')
@@ -2767,11 +2835,11 @@ export function releaseOrphanedTasks(graceMs = 120_000, now: number = Date.now()
     const cutoff = now - graceMs;
     settleSingleTargetOnDemandTasks("status = 'orphaned' AND claimed_by IS NOT NULL AND updated_at <= ?", [cutoff], now, "orphan-grace-elapsed");
     const rows = db
-      .prepare(`${TASK_SELECT} WHERE status = 'orphaned' AND claimed_by IS NOT NULL AND updated_at <= ?`)
+      .query(`${TASK_SELECT} WHERE status = 'orphaned' AND claimed_by IS NOT NULL AND updated_at <= ?`)
       .all(cutoff) as any[];
     if (rows.length === 0) return [];
 
-    db.prepare(`
+    db.query(`
       UPDATE tasks
       SET status = 'open', claimed_by = NULL, claimed_at = NULL, claim_expires_at = NULL, updated_at = ?
       WHERE status = 'orphaned' AND claimed_by IS NOT NULL AND updated_at <= ?
@@ -2807,7 +2875,7 @@ export function claimTask(taskId: number, agentId: string, guard?: AgentSessionG
     return db.transaction(() => {
       const now = Date.now();
       const expiresAt = now + CLAIM_LEASE_MS;
-      const result = db.prepare(`
+      const result = db.query(`
         UPDATE tasks SET status = 'claimed', claimed_by = ?, claimed_at = ?, claim_expires_at = ?, updated_at = ?
         WHERE id = ? AND status IN ('open', 'blocked')
       `).run(agentId, now, expiresAt, now, taskId);
@@ -2846,9 +2914,9 @@ export function renewTaskClaim(taskId: number, agentId: string, guard?: AgentSes
 
   const now = Date.now();
   const expiresAt = now + CLAIM_LEASE_MS;
-  db.prepare("UPDATE tasks SET claim_expires_at = ?, updated_at = ? WHERE id = ? AND claimed_by = ?").run(expiresAt, now, taskId, agentId);
+  db.query("UPDATE tasks SET claim_expires_at = ?, updated_at = ? WHERE id = ? AND claimed_by = ?").run(expiresAt, now, taskId, agentId);
   if (task.messageId) {
-    db.prepare("UPDATE messages SET claim_expires_at = ? WHERE id = ? AND claimed_by = ?").run(expiresAt, task.messageId, agentId);
+    db.query("UPDATE messages SET claim_expires_at = ? WHERE id = ? AND claimed_by = ?").run(expiresAt, task.messageId, agentId);
   }
   return { ok: true, task: getTask(taskId)! };
 }
@@ -2862,7 +2930,7 @@ export function updateTaskStatus(taskId: number, input: TaskStatusInput): { ok:
     const session = validateAgentSession(agentId, input);
     if (!session.ok) return { ok: false, error: session.error };
   }
-  const result = db.prepare(`
+  const result = db.query(`
     UPDATE tasks
     SET status = ?, result = COALESCE(?, result), claimed_by = COALESCE(?, claimed_by),
         claimed_at = CASE WHEN claimed_by IS NULL AND ? IS NOT NULL THEN ? ELSE claimed_at END,
@@ -2872,13 +2940,13 @@ export function updateTaskStatus(taskId: number, input: TaskStatusInput): { ok:
   `).run(input.status, input.result ?? null, agentId, agentId, now, input.status, now, now, taskId);
   if (result.changes === 0) return { ok: false, error: "task not found" };
   if (["done", "failed", "canceled"].includes(input.status) && task.messageId) {
-    db.prepare("UPDATE messages SET claim_expires_at = NULL WHERE id = ?").run(task.messageId);
+    db.query("UPDATE messages SET claim_expires_at = NULL WHERE id = ?").run(task.messageId);
   }
   if (agentId && ["claimed", "in_progress", "blocked"].includes(input.status)) {
     const expiresAt = now + CLAIM_LEASE_MS;
-    db.prepare("UPDATE tasks SET claim_expires_at = ? WHERE id = ? AND claimed_by = ?").run(expiresAt, taskId, agentId);
+    db.query("UPDATE tasks SET claim_expires_at = ? WHERE id = ? AND claimed_by = ?").run(expiresAt, taskId, agentId);
     if (task.messageId) {
-      db.prepare("UPDATE messages SET claim_expires_at = ? WHERE id = ? AND claimed_by = ?").run(expiresAt, task.messageId, agentId);
+      db.query("UPDATE messages SET claim_expires_at = ? WHERE id = ? AND claimed_by = ?").run(expiresAt, task.messageId, agentId);
     }
   }
   const event = insertTaskEvent(taskId, {
@@ -2894,7 +2962,7 @@ export function updateTaskStatus(taskId: number, input: TaskStatusInput): { ok:
 
 export function createCallbackDelivery(taskId: number, url: string, eventType: string, payload: unknown): number {
   const now = Date.now();
-  const result = db.prepare(`
+  const result = db.query(`
     INSERT INTO task_callback_deliveries (task_id, url, event_type, payload, status, attempts, created_at, updated_at)
     VALUES (?, ?, ?, ?, 'pending', 0, ?, ?)
   `).run(taskId, url, eventType, JSON.stringify(payload), now, now);
@@ -2902,7 +2970,7 @@ export function createCallbackDelivery(taskId: number, url: string, eventType: s
 }
 
 export function finishCallbackDelivery(id: number, ok: boolean, error?: string): void {
-  db.prepare(`
+  db.query(`
     UPDATE task_callback_deliveries
     SET status = ?, attempts = attempts + 1, last_error = ?, updated_at = ?
     WHERE id = ?
@@ -2918,7 +2986,7 @@ export function listCallbackDeliveries(taskId: number): Array<{
   attempts: number;
   lastError?: string;
 }> {
-  return (db.prepare("SELECT * FROM task_callback_deliveries WHERE task_id = ? ORDER BY id ASC").all(taskId) as any[])
+  return (db.query("SELECT * FROM task_callback_deliveries WHERE task_id = ? ORDER BY id ASC").all(taskId) as any[])
     .map((row) => ({
       id: row.id,
       taskId: row.task_id,
@@ -2937,12 +3005,12 @@ const DEFAULT_PAIR_TTL_MS = 5 * 60_000;
 const MAX_PAIR_TTL_MS = DAY_MS;
 
 function expirePendingPairs(now: number = Date.now()): void {
-  db.prepare("UPDATE pairs SET status = 'expired', updated_at = ?, ended_at = ? WHERE status = 'pending' AND expires_at <= ?")
+  db.query("UPDATE pairs SET status = 'expired', updated_at = ?, ended_at = ? WHERE status = 'pending' AND expires_at <= ?")
     .run(now, now, now);
 }
 
 function closeOpenPairsForAgent(agentId: string, now: number = Date.now()): void {
-  db.prepare(`
+  db.query(`
     UPDATE pairs
     SET status = 'ended', ended_at = ?, ended_by = ?, updated_at = ?
     WHERE status IN ('pending', 'active') AND (requester_id = ? OR target_id = ?)
@@ -2951,7 +3019,7 @@ function closeOpenPairsForAgent(agentId: string, now: number = Date.now()): void
 
 function getOpenPairForAgent(agentId: string): PairSession | null {
   expirePendingPairs();
-  const row = db.prepare(`
+  const row = db.query(`
     SELECT * FROM pairs
     WHERE status IN ('pending', 'active') AND (requester_id = ? OR target_id = ?)
     ORDER BY updated_at DESC
@@ -3038,7 +3106,7 @@ function pairSystemMessage(pair: PairSession, to: string, event: string, subject
 
 export function getPair(id: string): PairSession | null {
   expirePendingPairs();
-  const row = db.prepare("SELECT * FROM pairs WHERE id = ?").get(id) as any;
+  const row = db.query("SELECT * FROM pairs WHERE id = ?").get(id) as any;
   return row ? rowToPair(row) : null;
 }
 
@@ -3055,7 +3123,7 @@ export function listPairs(filter?: { agentId?: string; status?: PairStatus }): P
     params.push(filter.status);
   }
   const where = conditions.length ? `WHERE ${conditions.join(" AND ")}` : "";
-  return (db.prepare(`SELECT * FROM pairs ${where} ORDER BY updated_at DESC LIMIT 100`).all(...params) as any[]).map(rowToPair);
+  return (db.query(`SELECT * FROM pairs ${where} ORDER BY updated_at DESC LIMIT 100`).all(...params) as any[]).map(rowToPair);
 }
 
 export function createPair(input: CreatePairInput): {
@@ -3082,7 +3150,7 @@ export function createPair(input: CreatePairInput): {
   const now = Date.now();
   const ttlMs = Math.min(Math.max(input.ttlMs ?? DEFAULT_PAIR_TTL_MS, 10_000), MAX_PAIR_TTL_MS);
   const id = randomUUID();
-  db.prepare(`
+  db.query(`
     INSERT INTO pairs (id, requester_id, target_id, status, objective, meta, created_at, updated_at, expires_at)
     VALUES (?, ?, ?, 'pending', ?, ?, ?, ?, ?)
   `).run(id, input.from, resolved.agent.id, input.objective ?? null, JSON.stringify(input.meta ?? {}), now, now, now + ttlMs);
@@ -3122,7 +3190,7 @@ export function acceptPair(id: string, input: PairActionInput): { ok: true; pair
   }
 
   const now = Date.now();
-  db.prepare("UPDATE pairs SET status = 'active', accepted_at = ?, updated_at = ? WHERE id = ? AND status = 'pending'")
+  db.query("UPDATE pairs SET status = 'active', accepted_at = ?, updated_at = ? WHERE id = ? AND status = 'pending'")
     .run(now, now, id);
   const active = getPair(id)!;
   const notices = [
@@ -3139,7 +3207,7 @@ export function rejectPair(id: string, input: PairActionInput): { ok: true; pair
   if (pair.status !== "pending") return { ok: false, code: "invalid", error: `pair is ${pair.status}` };
   if (pair.targetId !== input.agentId) return { ok: false, code: "forbidden", error: "only the target agent can reject this pair" };
   const now = Date.now();
-  db.prepare("UPDATE pairs SET status = 'rejected', ended_at = ?, ended_by = ?, updated_at = ? WHERE id = ?")
+  db.query("UPDATE pairs SET status = 'rejected', ended_at = ?, ended_by = ?, updated_at = ? WHERE id = ?")
     .run(now, input.agentId, now, id);
   const rejected = getPair(id)!;
   const reason = input.reason ? `\n\nReason:\n${input.reason}` : "";
@@ -3154,7 +3222,7 @@ export function endPair(id: string, input: PairActionInput): { ok: true; pair: P
   if (!pairParticipant(pair, input.agentId)) return { ok: false, code: "forbidden", error: "only pair participants can hang up" };
   if (!OPEN_PAIR_STATUSES.includes(pair.status as any)) return { ok: false, code: "invalid", error: `pair is ${pair.status}` };
   const now = Date.now();
-  db.prepare("UPDATE pairs SET status = 'ended', ended_at = ?, ended_by = ?, updated_at = ? WHERE id = ?")
+  db.query("UPDATE pairs SET status = 'ended', ended_at = ?, ended_by = ?, updated_at = ? WHERE id = ?")
     .run(now, input.agentId, now, id);
   const ended = getPair(id)!;
   const reason = input.reason ? `\n\nReason:\n${input.reason}` : "";
@@ -3184,7 +3252,7 @@ export function sendPairMessage(id: string, input: PairMessageInput): { ok: true
       targetId: pair.targetId,
     },
   });
-  db.prepare("UPDATE pairs SET last_message_at = ?, updated_at = ? WHERE id = ?").run(now, now, id);
+  db.query("UPDATE pairs SET last_message_at = ?, updated_at = ? WHERE id = ?").run(now, now, id);
   return { ok: true, pair: getPair(id)!, message };
 }
 
@@ -3224,7 +3292,7 @@ export function upsertArtifactBlob(input: {
   createdAt?: number;
 }): ArtifactBlob {
   const now = input.createdAt ?? Date.now();
-  db.prepare(`
+  db.query(`
     INSERT INTO artifact_blobs (digest, storage_uri, media_type, size, created_at)
     VALUES (?, ?, ?, ?, ?)
     ON CONFLICT(digest) DO UPDATE SET
@@ -3236,12 +3304,12 @@ export function upsertArtifactBlob(input: {
 }
 
 export function getArtifactBlob(digest: string): ArtifactBlob | null {
-  const row = db.prepare("SELECT * FROM artifact_blobs WHERE digest = ?").get(digest) as any;
+  const row = db.query("SELECT * FROM artifact_blobs WHERE digest = ?").get(digest) as any;
   return row ? rowToArtifactBlob(row) : null;
 }
 
 export function deleteArtifactBlob(digest: string): boolean {
-  return db.prepare("DELETE FROM artifact_blobs WHERE digest = ?").run(digest).changes > 0;
+  return db.query("DELETE FROM artifact_blobs WHERE digest = ?").run(digest).changes > 0;
 }
 
 export function createArtifact(input: {
@@ -3260,7 +3328,7 @@ export function createArtifact(input: {
   if (!getArtifactBlob(input.blobDigest)) throw new ValidationError("artifact blob not found");
   const id = input.id ?? artifactId();
   const now = Date.now();
-  db.prepare(`
+  db.query(`
     INSERT INTO artifacts (
       id, blob_digest, media_type, kind, filename, size, visibility, sensitivity,
       created_by, created_at, expires_at, metadata
@@ -3284,7 +3352,7 @@ export function createArtifact(input: {
 }
 
 export function getArtifact(id: string): Artifact | null {
-  const row = db.prepare("SELECT * FROM artifacts WHERE id = ?").get(id) as any;
+  const row = db.query("SELECT * FROM artifacts WHERE id = ?").get(id) as any;
   if (!row) return null;
   return rowToArtifact(row, listArtifactLinks(id));
 }
@@ -3311,22 +3379,22 @@ export function listArtifacts(query: {
   }
   const where = conditions.length ? `WHERE ${conditions.join(" AND ")}` : "";
   const limit = Math.min(Math.max(query.limit ?? 100, 1), 500);
-  const rows = db.prepare(`SELECT a.* FROM artifacts a ${where} ORDER BY a.created_at DESC LIMIT ?`).all(...params, limit) as any[];
+  const rows = db.query(`SELECT a.* FROM artifacts a ${where} ORDER BY a.created_at DESC LIMIT ?`).all(...params, limit) as any[];
   return rows.map((row) => rowToArtifact(row, listArtifactLinks(row.id)));
 }
 
 export function deleteArtifact(id: string): boolean {
   return db.transaction(() => {
-    return db.prepare("DELETE FROM artifacts WHERE id = ?").run(id).changes > 0;
+    return db.query("DELETE FROM artifacts WHERE id = ?").run(id).changes > 0;
   })();
 }
 
 function listArtifactLinks(artifactId: string): ArtifactLink[] {
-  return (db.prepare("SELECT * FROM artifact_links WHERE artifact_id = ? ORDER BY created_at ASC").all(artifactId) as any[]).map(rowToArtifactLink);
+  return (db.query("SELECT * FROM artifact_links WHERE artifact_id = ? ORDER BY created_at ASC").all(artifactId) as any[]).map(rowToArtifactLink);
 }
 
 export function listArtifactsForEntity(entityType: ArtifactLink["entityType"], entityId: string | number): Artifact[] {
-  const rows = db.prepare(`
+  const rows = db.query(`
     SELECT a.*
     FROM artifacts a
     JOIN artifact_links l ON l.artifact_id = a.id
@@ -3349,7 +3417,7 @@ export function linkArtifact(input: {
   if (!getArtifact(input.artifactId)) throw new ValidationError(`artifact ${input.artifactId} not found`);
   const now = Date.now();
   const id = artifactLinkId();
-  db.prepare(`
+  db.query(`
     INSERT OR IGNORE INTO artifact_links (id, artifact_id, entity_type, entity_id, role, title, created_by, created_at)
     VALUES (?, ?, ?, ?, ?, ?, ?, ?)
   `).run(
@@ -3362,7 +3430,7 @@ export function linkArtifact(input: {
     input.createdBy,
     now,
   );
-  const row = db.prepare(`
+  const row = db.query(`
     SELECT * FROM artifact_links
     WHERE artifact_id = ? AND entity_type = ? AND entity_id = ? AND ((role IS NULL AND ? IS NULL) OR role = ?)
     ORDER BY created_at DESC
@@ -3372,16 +3440,16 @@ export function linkArtifact(input: {
 }
 
 function deleteArtifactLinksForEntity(entityType: ArtifactLink["entityType"], entityId: string | number): number {
-  return db.prepare("DELETE FROM artifact_links WHERE entity_type = ? AND entity_id = ?").run(entityType, String(entityId)).changes;
+  return db.query("DELETE FROM artifact_links WHERE entity_type = ? AND entity_id = ?").run(entityType, String(entityId)).changes;
 }
 
 export function artifactBlobReferenceCount(digest: string): number {
-  const row = db.prepare("SELECT COUNT(*) AS count FROM artifacts WHERE blob_digest = ?").get(digest) as { count?: number };
+  const row = db.query("SELECT COUNT(*) AS count FROM artifacts WHERE blob_digest = ?").get(digest) as { count?: number };
   return row.count ?? 0;
 }
 
 function unreferencedArtifactBlobs(): ArtifactBlob[] {
-  return (db.prepare(`
+  return (db.query(`
     SELECT b.*
     FROM artifact_blobs b
     WHERE NOT EXISTS (SELECT 1 FROM artifacts a WHERE a.blob_digest = b.digest)
@@ -3392,12 +3460,12 @@ export function sweepArtifacts(input: { now?: number; unlinkedGraceMs?: number }
   const now = input.now ?? Date.now();
   const unlinkedCutoff = now - (input.unlinkedGraceMs ?? 60 * 60 * 1000);
   return db.transaction(() => {
-    const rows = db.prepare(`
+    const rows = db.query(`
       SELECT id FROM artifacts a
       WHERE (expires_at IS NOT NULL AND expires_at <= ?)
          OR (created_at <= ? AND NOT EXISTS (SELECT 1 FROM artifact_links l WHERE l.artifact_id = a.id))
     `).all(now, unlinkedCutoff) as Array<{ id: string }>;
-    for (const row of rows) db.prepare("DELETE FROM artifacts WHERE id = ?").run(row.id);
+    for (const row of rows) db.query("DELETE FROM artifacts WHERE id = ?").run(row.id);
     const blobs = unreferencedArtifactBlobs();
     for (const blob of blobs) deleteArtifactBlob(blob.digest);
     return { artifactIds: rows.map((row) => row.id), blobs };
@@ -3451,7 +3519,7 @@ function linkAttachmentRefs(entityType: ArtifactLink["entityType"], entityId: st
 
 function findMessageByIdempotencyKey(from: string, key: string): Message | null {
   const row = db
-    .prepare(`${MSG_SELECT} WHERE m.from_agent = ? AND m.idempotency_key = ? LIMIT 1`)
+    .query(`${MSG_SELECT} WHERE m.from_agent = ? AND m.idempotency_key = ? LIMIT 1`)
     .get(from, key) as any;
   return row ? rowToMessage(row) : null;
 }
@@ -3463,12 +3531,12 @@ function policyNameFromTarget(target: string): string | null {
 }
 
 function spawnPolicyExists(policyName: string): boolean {
-  const row = db.prepare("SELECT 1 FROM config WHERE namespace = 'spawn-policy' AND key = ?").get(policyName);
+  const row = db.query("SELECT 1 FROM config WHERE namespace = 'spawn-policy' AND key = ?").get(policyName);
   return Boolean(row);
 }
 
 function runningAgentForPolicy(policyName: string): string | null {
-  const row = db.prepare(`
+  const row = db.query(`
     SELECT agent_id
     FROM managed_agent_state
     WHERE policy_name = ? AND status = 'running' AND agent_id IS NOT NULL
@@ -3480,7 +3548,7 @@ function runningAgentForPolicy(policyName: string): string | null {
 }
 
 function queueDepthLimit(target: string): number {
-  const row = db.prepare("SELECT value FROM config WHERE namespace = 'system' AND key = 'message-queue'").get() as { value?: string } | undefined;
+  const row = db.query("SELECT value FROM config WHERE namespace = 'system' AND key = 'message-queue'").get() as { value?: string } | undefined;
   const parsed = row?.value ? parseJson<Record<string, unknown>>(row.value, {}) : {};
   const perTarget = parsed?.maxDepthPerTarget;
   if (typeof perTarget === "number" && Number.isSafeInteger(perTarget) && perTarget > 0) return perTarget;
@@ -3494,7 +3562,7 @@ function queueDepthLimit(target: string): number {
 
 function enforceQueueLimit(target: string): void {
   const limit = queueDepthLimit(target);
-  const rows = db.prepare(`
+  const rows = db.query(`
       SELECT id FROM messages
       WHERE to_target = ? AND delivery_status = 'queued'
       ORDER BY queued_at DESC, id DESC
@@ -3596,7 +3664,7 @@ const REPLY_DUPLICATE_WINDOW_MS = 2 * 60 * 1000;
 
 function findRecentDuplicateReply(input: SendMessageInput, threadId: number | null, now: number, hasAttachments: boolean): Message | null {
   if (!input.replyTo || threadId === null || hasAttachments) return null;
-  const row = db.prepare(`
+  const row = db.query(`
     ${MSG_SELECT}
     WHERE m.from_agent = ?
       AND m.to_target = ?
@@ -3619,6 +3687,16 @@ function findRecentDuplicateReply(input: SendMessageInput, threadId: number | nu
   return row ? rowToMessage(row) : null;
 }
 
+// Event time may be queued-then-backfilled, so it can legitimately be older than the
+// receive time — but it must be a sane epoch-ms value. Returns null (column stays NULL, so
+// readers fall back to created_at) for absent/invalid values or anything more than a minute
+// in the future (clock-skew guard). Only a real backfilled time is stored.
+function sanitizeOccurredAt(occurredAt: number | undefined, receivedAt: number): number | null {
+  if (typeof occurredAt !== "number" || !Number.isFinite(occurredAt)) return null;
+  if (occurredAt <= 0 || occurredAt > receivedAt + 60_000) return null;
+  return Math.floor(occurredAt);
+}
+
 export function sendMessageWithResult(input: SendMessageInput): { message: Message; created: boolean } {
   const now = Date.now();
   const payload = input.payload ?? {};
@@ -3645,19 +3723,19 @@ export function sendMessageWithResult(input: SendMessageInput): { message: Messa
   const duplicateReply = findRecentDuplicateReply(input, threadId, now, attachmentRefs.length > 0);
   if (duplicateReply) return { message: duplicateReply, created: false };
 
-  const insert = db.prepare(`
+  const insert = db.query(`
     INSERT INTO messages (
       from_agent, to_target, kind, channel, subject, body, thread_id, reply_to, claimable,
       idempotency_key, delivery_status, queued_at, max_age_seconds, resolved_to_agent,
-      payload, meta, created_at
+      payload, meta, created_at, occurred_at
     )
     VALUES (
       $from, $to, $kind, $channel, $subject, $body, $threadId, $replyTo, $claimable,
       $idempotencyKey, $deliveryStatus, $queuedAt, $maxAgeSeconds, $resolvedToAgent,
-      $payload, $meta, $now
+      $payload, $meta, $now, $occurredAt
     )
   `);
-  const setSelfThread = db.prepare("UPDATE messages SET thread_id = ? WHERE id = ?");
+  const setSelfThread = db.query("UPDATE messages SET thread_id = ? WHERE id = ?");
   const claimable = shouldStoreClaimable(input);
   const kind = inferMessageKind(input);
   const policyName = policyNameFromTarget(input.to);
@@ -3695,6 +3773,8 @@ export function sendMessageWithResult(input: SendMessageInput): { message: Messa
       $payload: JSON.stringify(payload),
       $meta: JSON.stringify(input.meta ?? {}),
       $now: now,
+      // Sanitize: only accept a plausible epoch-ms event time, else fall back to receive time.
+      $occurredAt: sanitizeOccurredAt(input.occurredAt, now),
     });
     const newId = Number(result.lastInsertRowid);
     if (threadId === null) setSelfThread.run(newId, newId);
@@ -3716,7 +3796,7 @@ export function getThread(messageId: number): Message[] {
   const threadId = msg.threadId ?? msg.id;
   return (
     db
-      .prepare(`${MSG_SELECT} WHERE m.thread_id = ? ORDER BY m.created_at ASC`)
+      .query(`${MSG_SELECT} WHERE m.thread_id = ? ORDER BY m.created_at ASC`)
       .all(threadId) as any[]
   ).map(rowToMessage);
 }
@@ -3735,10 +3815,10 @@ export function setMessageReaction(input: {
 
   const now = Date.now();
   if (input.action === "remove") {
-    db.prepare("DELETE FROM message_reactions WHERE message_id = ? AND actor_id = ? AND emoji = ?")
+    db.query("DELETE FROM message_reactions WHERE message_id = ? AND actor_id = ? AND emoji = ?")
       .run(input.messageId, actorId, emoji);
   } else {
-    db.prepare(`
+    db.query(`
       INSERT INTO message_reactions (message_id, actor_id, emoji, created_at, updated_at)
       VALUES (?, ?, ?, ?, ?)
       ON CONFLICT(message_id, actor_id, emoji) DO UPDATE SET updated_at = excluded.updated_at
@@ -3753,7 +3833,7 @@ export function findMessageByTelegramSource(input: {
   chatId: string;
   messageId: string;
 }): Message | null {
-  const rows = db.prepare(`
+  const rows = db.query(`
     ${MSG_SELECT}
     WHERE json_extract(m.payload, '$.source.telegram.chatId') = ?
       AND json_extract(m.payload, '$.source.telegram.messageId') = ?
@@ -3767,7 +3847,7 @@ export function findMessageByTelegramSource(input: {
 
 function claimMessageRow(messageId: number, agentId: string, now: number): { ok: false; error: string } | { ok: true } {
   const expiresAt = now + CLAIM_LEASE_MS;
-  const result = db.prepare(
+  const result = db.query(
     "UPDATE messages SET claimed_by = ?, claimed_at = ?, claim_expires_at = ? WHERE id = ? AND claimed_by IS NULL"
   ).run(agentId, now, expiresAt, messageId);
 
@@ -3807,7 +3887,7 @@ export function claimMessage(messageId: number, agentId: string, guard?: AgentSe
         throw new ClaimError(`linked task is ${task.status}`);
       }
 
-      const taskClaim = db.prepare(`
+      const taskClaim = db.query(`
         UPDATE tasks SET status = 'claimed', claimed_by = ?, claimed_at = ?, claim_expires_at = ?, updated_at = ?
         WHERE id = ? AND message_id = ? AND status IN ('open', 'blocked')
       `).run(agentId, now, expiresAt, now, taskId, messageId);
@@ -3846,12 +3926,12 @@ export function renewMessageClaim(messageId: number, agentId: string, guard?: Ag
   const expiresAt = now + CLAIM_LEASE_MS;
   let task: Task | undefined;
   db.transaction(() => {
-    db.prepare("UPDATE messages SET claim_expires_at = ? WHERE id = ? AND claimed_by = ?").run(expiresAt, messageId, agentId);
+    db.query("UPDATE messages SET claim_expires_at = ? WHERE id = ? AND claimed_by = ?").run(expiresAt, messageId, agentId);
     const taskId = typeof msg.payload?.taskId === "number" && Number.isSafeInteger(msg.payload.taskId)
       ? msg.payload.taskId
       : null;
     if (taskId) {
-      db.prepare("UPDATE tasks SET claim_expires_at = ?, updated_at = ? WHERE id = ? AND claimed_by = ?").run(expiresAt, now, taskId, agentId);
+      db.query("UPDATE tasks SET claim_expires_at = ?, updated_at = ? WHERE id = ? AND claimed_by = ?").run(expiresAt, now, taskId, agentId);
       task = getTask(taskId) ?? undefined;
     }
   })();
@@ -3859,13 +3939,13 @@ export function renewMessageClaim(messageId: number, agentId: string, guard?: Ag
 }
 
 export function getMessage(id: number): Message | null {
-  const row = db.prepare(`${MSG_SELECT} WHERE m.id = ?`).get(id) as any;
+  const row = db.query(`${MSG_SELECT} WHERE m.id = ?`).get(id) as any;
   return row ? rowToMessage(row) : null;
 }
 
 export function getMessageDeliveryAttempts(messageId: number, limit = 50): MessageDeliveryAttempt[] {
   const safeLimit = Math.min(Math.max(limit, 1), 200);
-  return (db.prepare(`
+  return (db.query(`
     SELECT * FROM message_delivery_attempts
     WHERE message_id = ?
     ORDER BY created_at DESC, id DESC
@@ -3885,7 +3965,7 @@ function insertMessageDeliveryAttempt(
   },
   now: number,
 ): void {
-  db.prepare(`
+  db.query(`
     INSERT INTO message_delivery_attempts (message_id, agent_id, action, status, error, next_retry_at, poison_reason, created_at)
     VALUES (?, ?, ?, ?, ?, ?, ?, ?)
   `).run(
@@ -3911,7 +3991,7 @@ function setMessageDeliveryState(
   },
   now: number,
 ): boolean {
-  return db.prepare(`
+  return db.query(`
     UPDATE messages
     SET delivery_status = ?,
         delivery_attempts = delivery_attempts + ?,
@@ -4005,7 +4085,7 @@ export function getMessageDeliveryStatus(id: number): Pick<Message, "id" | "to"
 
 export function listQueuedMessages(target: string, limit = 100): Message[] {
   const safeLimit = Math.min(Math.max(limit, 1), 500);
-  return (db.prepare(`
+  return (db.query(`
     ${MSG_SELECT}
     WHERE m.to_target = ? AND m.delivery_status = 'queued'
     ORDER BY m.queued_at ASC, m.id ASC
@@ -4015,7 +4095,7 @@ export function listQueuedMessages(target: string, limit = 100): Message[] {
 
 export function resolveQueuedPolicyMessages(policyName: string, agentId: string): Message[] {
   const target = `policy:${policyName}`;
-  const rows = db.prepare(`
+  const rows = db.query(`
     SELECT m.id
     FROM messages m
     WHERE m.to_target = ?
@@ -4031,7 +4111,7 @@ export function resolveQueuedPolicyMessages(policyName: string, agentId: string)
   if (rows.length === 0) return [];
   const ids = rows.map((row) => row.id);
   const placeholders = ids.map(() => "?").join(",");
-  db.prepare(`
+  db.query(`
     UPDATE messages
     SET delivery_status = 'pending',
         resolved_to_agent = ?,
@@ -4050,7 +4130,7 @@ export function resolveQueuedPolicyMessages(policyName: string, agentId: string)
 }
 
 export function expireQueuedMessages(now: number = Date.now()): Message[] {
-  const rows = db.prepare(`
+  const rows = db.query(`
     SELECT id FROM messages
     WHERE delivery_status = 'queued'
       AND queued_at IS NOT NULL
@@ -4095,7 +4175,8 @@ export function listRecentMessages(limit: number = 100, since?: number, channel?
   const sql = `${MSG_SELECT} ${where} ORDER BY m.created_at DESC LIMIT ?`;
   params.push(limit);
 
-  return (db.prepare(sql).all(...params) as any[]).map(rowToMessage).reverse();
+  const rows = timedQuery("listMessages", () => db.query(sql).all(...params) as any[]);
+  return rows.map(rowToMessage).reverse();
 }
 
 export function pollMessages(query: PollQuery): Message[] {
@@ -4163,7 +4244,8 @@ export function pollMessages(query: PollQuery): Message[] {
   const sql = `${MSG_SELECT} WHERE ${conditions.join(" AND ")} ORDER BY m.created_at ASC LIMIT ?`;
   params.push(limit);
 
-  return (db.prepare(sql).all(...params) as any[]).map(rowToMessage);
+  const rows = timedQuery("pollMessages", () => db.query(sql).all(...params) as any[]);
+  return rows.map(rowToMessage);
 }
 
 function messageRequiresReply(message: Message): boolean {
@@ -4191,7 +4273,7 @@ function isCoveredByLaterAgentResponse(message: Message, agentId: string): boole
   // Order by id, not created_at: ids are monotonic insertion order, so this is
   // robust when a reply lands in the same millisecond as the message it covers
   // (created_at > … strictly would miss it, leaving the message wrongly pending).
-  const replies = (db.prepare(`
+  const replies = (db.query(`
     ${MSG_SELECT}
     WHERE m.from_agent = ?
       AND m.id > ?
@@ -4224,7 +4306,7 @@ function replyObligationFromMessage(message: Message, agentId: string): ReplyObl
 
 export function listPendingReplyObligations(agentId: string, limit = 20): ReplyObligation[] {
   const scanLimit = Math.max(limit * 5, 50);
-  const rows = db.prepare(`
+  const rows = timedQuery("listPendingReplyObligations", () => db.query(`
     ${MSG_SELECT}
     WHERE EXISTS (
       SELECT 1 FROM message_reads mr
@@ -4238,7 +4320,7 @@ export function listPendingReplyObligations(agentId: string, limit = 20): ReplyO
       )
     ORDER BY m.created_at ASC
     LIMIT ?
-  `).all(agentId, agentId, agentId, scanLimit) as any[];
+  `).all(agentId, agentId, agentId, scanLimit) as any[]);
   return rows
     .map(rowToMessage)
     .filter(messageRequiresReply)
@@ -4248,12 +4330,12 @@ export function listPendingReplyObligations(agentId: string, limit = 20): ReplyO
 }
 
 export function markRead(messageId: number, agentId: string): boolean {
-  const exists = db.prepare("SELECT 1 FROM messages WHERE id = ?").get(messageId);
+  const exists = db.query("SELECT 1 FROM messages WHERE id = ?").get(messageId);
   if (!exists) return false;
-  db.prepare(
+  db.query(
     "INSERT OR IGNORE INTO message_reads (message_id, agent_id, read_at) VALUES (?, ?, ?)"
   ).run(messageId, agentId, Date.now());
-  db.prepare(`
+  db.query(`
     UPDATE messages
     SET delivery_status = 'delivered',
         delivery_last_error = NULL,
@@ -4266,10 +4348,10 @@ export function markRead(messageId: number, agentId: string): boolean {
 }
 
 export function getInboxState(operatorId: string): InboxState {
-  const threads = (db.prepare(
+  const threads = (db.query(
     "SELECT * FROM inbox_thread_state WHERE operator_id = ? ORDER BY updated_at DESC",
   ).all(operatorId) as any[]).map(rowToInboxThreadState);
-  const drafts = (db.prepare(
+  const drafts = (db.query(
     "SELECT * FROM inbox_drafts WHERE operator_id = ? ORDER BY updated_at DESC",
   ).all(operatorId) as any[]).map(rowToInboxDraft);
   return { operatorId, threads, drafts };
@@ -4282,7 +4364,7 @@ export function setInboxThreadState(input: {
   archivedAtMessageId?: number | null;
 }): InboxThreadState {
   const now = Date.now();
-  const current = db.prepare(
+  const current = db.query(
     "SELECT * FROM inbox_thread_state WHERE operator_id = ? AND peer_id = ?",
   ).get(input.operatorId, input.peerId) as any | undefined;
 
@@ -4293,7 +4375,7 @@ export function setInboxThreadState(input: {
     ? input.archivedAtMessageId ?? null
     : current?.archived_at_message_id ?? null;
 
-  db.prepare(`
+  db.query(`
     INSERT INTO inbox_thread_state (operator_id, peer_id, read_cursor_message_id, archived_at_message_id, updated_at)
     VALUES (?, ?, ?, ?, ?)
     ON CONFLICT(operator_id, peer_id) DO UPDATE SET
@@ -4302,7 +4384,7 @@ export function setInboxThreadState(input: {
       updated_at = excluded.updated_at
   `).run(input.operatorId, input.peerId, readCursorMessageId, archivedAtMessageId, now);
 
-  return rowToInboxThreadState(db.prepare(
+  return rowToInboxThreadState(db.query(
     "SELECT * FROM inbox_thread_state WHERE operator_id = ? AND peer_id = ?",
   ).get(input.operatorId, input.peerId));
 }
@@ -4315,7 +4397,7 @@ export function setInboxDraft(input: {
   channel?: string | null;
 }): InboxDraft {
   const now = Date.now();
-  db.prepare(`
+  db.query(`
     INSERT INTO inbox_drafts (operator_id, peer_id, body, subject, channel, updated_at)
     VALUES (?, ?, ?, ?, ?, ?)
     ON CONFLICT(operator_id, peer_id) DO UPDATE SET
@@ -4325,13 +4407,13 @@ export function setInboxDraft(input: {
       updated_at = excluded.updated_at
   `).run(input.operatorId, input.peerId, input.body, input.subject ?? null, input.channel ?? null, now);
 
-  return rowToInboxDraft(db.prepare(
+  return rowToInboxDraft(db.query(
     "SELECT * FROM inbox_drafts WHERE operator_id = ? AND peer_id = ?",
   ).get(input.operatorId, input.peerId));
 }
 
 export function deleteInboxDraft(operatorId: string, peerId: string): boolean {
-  return db.prepare("DELETE FROM inbox_drafts WHERE operator_id = ? AND peer_id = ?").run(operatorId, peerId).changes > 0;
+  return db.query("DELETE FROM inbox_drafts WHERE operator_id = ? AND peer_id = ?").run(operatorId, peerId).changes > 0;
 }
 
 export function createChatHistoryImport(input: {
@@ -4359,7 +4441,7 @@ export function createChatHistoryImport(input: {
   const id = randomUUID();
   const now = Date.now();
   db.transaction(() => {
-    db.prepare(`
+    db.query(`
       INSERT INTO chat_history_imports (
         id, target_agent_id, target_spawn_request_id, source_peer_id, source_agent_id,
         source_thread_id, source_agent_label, imported_by, imported_at
@@ -4376,7 +4458,7 @@ export function createChatHistoryImport(input: {
       now,
     );
 
-    const insertEntry = db.prepare(`
+    const insertEntry = db.query(`
       INSERT INTO chat_history_import_entries (
         import_id, position, original_message_id, original_from, original_to, original_created_at, message_snapshot
       ) VALUES (?, ?, ?, ?, ?, ?, ?)
@@ -4398,9 +4480,9 @@ export function createChatHistoryImport(input: {
 }
 
 function getChatHistoryImport(id: string): ChatHistoryImport | null {
-  const row = db.prepare("SELECT * FROM chat_history_imports WHERE id = ?").get(id) as any | undefined;
+  const row = db.query("SELECT * FROM chat_history_imports WHERE id = ?").get(id) as any | undefined;
   if (!row) return null;
-  const entries = (db.prepare(
+  const entries = (db.query(
     "SELECT * FROM chat_history_import_entries WHERE import_id = ? ORDER BY position ASC",
   ).all(id) as any[]).map(rowToChatHistoryImportEntry);
   return rowToChatHistoryImport(row, entries);
@@ -4423,9 +4505,9 @@ export function listChatHistoryImports(input: {
   }
   const limit = Math.max(1, Math.min(input.limit ?? 100, 500));
   const where = conditions.length ? `WHERE ${conditions.join(" OR ")}` : "";
-  const rows = db.prepare(`SELECT * FROM chat_history_imports ${where} ORDER BY imported_at ASC LIMIT ?`).all(...params, limit) as any[];
+  const rows = db.query(`SELECT * FROM chat_history_imports ${where} ORDER BY imported_at ASC LIMIT ?`).all(...params, limit) as any[];
   return rows.map((row) => {
-    const entries = (db.prepare(
+    const entries = (db.query(
       "SELECT * FROM chat_history_import_entries WHERE import_id = ? ORDER BY position ASC",
     ).all(row.id) as any[]).map(rowToChatHistoryImportEntry);
     return rowToChatHistoryImport(row, entries);
@@ -4454,7 +4536,7 @@ export function listActivityEvents(input: {
   }
   const where = conditions.length ? `WHERE ${conditions.join(" AND ")}` : "";
   params.push(input.limit ?? 200);
-  return (db.prepare(
+  return (db.query(
     `SELECT * FROM activity_events ${where} ORDER BY created_at DESC, id DESC LIMIT ?`,
   ).all(...params) as any[]).map(rowToActivityEvent);
 }
@@ -4483,11 +4565,11 @@ export function getAgentTimeline(agentId: string, opts: { limit?: number; since?
 
   // Managed agents: include policy-scoped lifecycle transitions recorded before
   // the agent registered (agent_id null), correlated via metadata.policyName.
-  const managed = db.prepare("SELECT policy_name FROM managed_agent_state WHERE agent_id = ? LIMIT 1").get(agentId) as { policy_name?: string } | undefined;
+  const managed = db.query("SELECT policy_name FROM managed_agent_state WHERE agent_id = ? LIMIT 1").get(agentId) as { policy_name?: string } | undefined;
   if (managed?.policy_name) {
     const rows = (since !== undefined
-      ? db.prepare("SELECT * FROM activity_events WHERE agent_id IS NULL AND json_extract(metadata, '$.policyName') = ? AND created_at >= ? ORDER BY created_at DESC LIMIT ?").all(managed.policy_name, since, limit)
-      : db.prepare("SELECT * FROM activity_events WHERE agent_id IS NULL AND json_extract(metadata, '$.policyName') = ? ORDER BY created_at DESC LIMIT ?").all(managed.policy_name, limit)) as any[];
+      ? db.query("SELECT * FROM activity_events WHERE agent_id IS NULL AND json_extract(metadata, '$.policyName') = ? AND created_at >= ? ORDER BY created_at DESC LIMIT ?").all(managed.policy_name, since, limit)
+      : db.query("SELECT * FROM activity_events WHERE agent_id IS NULL AND json_extract(metadata, '$.policyName') = ? ORDER BY created_at DESC LIMIT ?").all(managed.policy_name, limit)) as any[];
     for (const ev of rows.map(rowToActivityEvent)) {
       entries.push({ ts: ev.createdAt, source: "activity", kind: ev.kind, title: ev.title, detail: ev.body, metadata: ev.metadata });
     }
@@ -4495,16 +4577,16 @@ export function getAgentTimeline(agentId: string, opts: { limit?: number; since?
 
   // Commands targeting this agent (spawn/shutdown/restart/compact) with outcome.
   const cmds = (since !== undefined
-    ? db.prepare("SELECT id, type, status, result, correlation_id, created_at, updated_at FROM commands WHERE target = ? AND updated_at >= ? ORDER BY updated_at DESC LIMIT ?").all(agentId, since, limit)
-    : db.prepare("SELECT id, type, status, result, correlation_id, created_at, updated_at FROM commands WHERE target = ? ORDER BY updated_at DESC LIMIT ?").all(agentId, limit)) as any[];
+    ? db.query("SELECT id, type, status, result, correlation_id, created_at, updated_at FROM commands WHERE target = ? AND updated_at >= ? ORDER BY updated_at DESC LIMIT ?").all(agentId, since, limit)
+    : db.query("SELECT id, type, status, result, correlation_id, created_at, updated_at FROM commands WHERE target = ? ORDER BY updated_at DESC LIMIT ?").all(agentId, limit)) as any[];
   for (const c of cmds) {
     entries.push({ ts: c.updated_at ?? c.created_at, source: "command", kind: c.type, title: `${c.type} · ${c.status}`, detail: c.result ?? undefined, metadata: { id: c.id, status: c.status, correlationId: c.correlation_id ?? undefined } });
   }
 
   // Delivery attempts involving this agent (failures, retries, poison).
   const attempts = (since !== undefined
-    ? db.prepare("SELECT * FROM message_delivery_attempts WHERE agent_id = ? AND created_at >= ? ORDER BY created_at DESC LIMIT ?").all(agentId, since, limit)
-    : db.prepare("SELECT * FROM message_delivery_attempts WHERE agent_id = ? ORDER BY created_at DESC LIMIT ?").all(agentId, limit)) as any[];
+    ? db.query("SELECT * FROM message_delivery_attempts WHERE agent_id = ? AND created_at >= ? ORDER BY created_at DESC LIMIT ?").all(agentId, since, limit)
+    : db.query("SELECT * FROM message_delivery_attempts WHERE agent_id = ? ORDER BY created_at DESC LIMIT ?").all(agentId, limit)) as any[];
   for (const row of attempts) {
     entries.push({ ts: row.created_at, source: "delivery", kind: `delivery.${row.action}`, title: `delivery ${row.status}`, detail: row.error ?? undefined, metadata: { messageId: row.message_id, status: row.status, poisonReason: row.poison_reason ?? undefined } });
   }
@@ -4515,11 +4597,11 @@ export function getAgentTimeline(agentId: string, opts: { limit?: number; since?
 
 export function createActivityEvent(input: ActivityEventInput): ActivityEvent {
   if (input.clientId) {
-    const existing = db.prepare("SELECT * FROM activity_events WHERE client_id = ?").get(input.clientId) as any | undefined;
+    const existing = db.query("SELECT * FROM activity_events WHERE client_id = ?").get(input.clientId) as any | undefined;
     if (existing) return rowToActivityEvent(existing);
   }
   const now = Date.now();
-  const result = db.prepare(`
+  const result = db.query(`
     INSERT INTO activity_events (
       operator_id, client_id, kind, title, body, meta_text, icon, view, peer_id,
       message_id, pair_id, task_id, agent_id, metadata, created_at
@@ -4542,21 +4624,21 @@ export function createActivityEvent(input: ActivityEventInput): ActivityEvent {
     JSON.stringify(input.metadata ?? {}),
     now,
   );
-  return rowToActivityEvent(db.prepare("SELECT * FROM activity_events WHERE id = ?").get(Number(result.lastInsertRowid)));
+  return rowToActivityEvent(db.query("SELECT * FROM activity_events WHERE id = ?").get(Number(result.lastInsertRowid)));
 }
 
 export function deleteMessage(id: number): boolean {
   return db.transaction(() => {
     // Break reply_to references from children so the FK doesn't block delete.
     // Children keep their thread_id — the thread shows up minus this message.
-    db.prepare("UPDATE messages SET reply_to = NULL WHERE reply_to = ?").run(id);
+    db.query("UPDATE messages SET reply_to = NULL WHERE reply_to = ?").run(id);
     deleteArtifactLinksForEntity("message", id);
-    return db.prepare("DELETE FROM messages WHERE id = ?").run(id).changes > 0;
+    return db.query("DELETE FROM messages WHERE id = ?").run(id).changes > 0;
   })();
 }
 
 export function getLatestMessageId(): number {
-  const row = db.prepare("SELECT MAX(id) as id FROM messages").get() as any;
+  const row = db.query("SELECT MAX(id) as id FROM messages").get() as any;
   return row?.id ?? 0;
 }
 
@@ -4564,10 +4646,10 @@ export function pruneOldMessages(maxAgeMs: number): number {
   const cutoff = Date.now() - maxAgeMs;
   return db.transaction(() => {
     db
-      .prepare("UPDATE messages SET reply_to = NULL WHERE reply_to IN (SELECT id FROM messages WHERE created_at < ?)")
+      .query("UPDATE messages SET reply_to = NULL WHERE reply_to IN (SELECT id FROM messages WHERE created_at < ?)")
       .run(cutoff);
     return db
-      .prepare("DELETE FROM messages WHERE created_at < ?")
+      .query("DELETE FROM messages WHERE created_at < ?")
       .run(cutoff).changes;
   })();
 }
@@ -4582,28 +4664,28 @@ export function getStats(): {
   openTasks: number;
 } {
   const agents = (
-    db.prepare("SELECT COUNT(*) as c FROM agents").get() as any
+    db.query("SELECT COUNT(*) as c FROM agents").get() as any
   ).c;
   const online = (
     db
-      .prepare(
+      .query(
         "SELECT COUNT(*) as c FROM agents WHERE status != 'offline' AND last_seen > ?"
       )
       .get(Date.now() - STALE_TTL_MS) as any
   ).c;
   const messages = (
-    db.prepare("SELECT COUNT(*) as c FROM messages").get() as any
+    db.query("SELECT COUNT(*) as c FROM messages").get() as any
   ).c;
   const messagesLast24h = (
     db
-      .prepare("SELECT COUNT(*) as c FROM messages WHERE created_at > ?")
+      .query("SELECT COUNT(*) as c FROM messages WHERE created_at > ?")
       .get(Date.now() - DAY_MS) as any
   ).c;
   const tasks = (
-    db.prepare("SELECT COUNT(*) as c FROM tasks").get() as any
+    db.query("SELECT COUNT(*) as c FROM tasks").get() as any
   ).c;
   const openTasks = (
-    db.prepare("SELECT COUNT(*) as c FROM tasks WHERE status NOT IN ('done', 'failed', 'canceled')").get() as any
+    db.query("SELECT COUNT(*) as c FROM tasks WHERE status NOT IN ('done', 'failed', 'canceled')").get() as any
   ).c;
 
   return { version: VERSION, agents, online, messages, messagesLast24h, tasks, openTasks };
@@ -4613,14 +4695,14 @@ export function getHealth(now: number = Date.now()): HealthReport {
   const checks: HealthCheck[] = [];
 
   try {
-    db.prepare("SELECT 1").get();
+    db.query("SELECT 1").get();
     checks.push({ name: "database", status: "ok" });
   } catch (e) {
     checks.push({ name: "database", status: "error", detail: e instanceof Error ? e.message : "database check failed" });
   }
 
   const staleLiveAgents = (db
-    .prepare("SELECT COUNT(*) as c FROM agents WHERE status != 'offline' AND last_seen <= ? AND id NOT IN ('user', 'system')")
+    .query("SELECT COUNT(*) as c FROM agents WHERE status != 'offline' AND last_seen <= ? AND id NOT IN ('user', 'system')")
     .get(now - STALE_TTL_MS) as any).c as number;
   checks.push({
     name: "stale-live-agents",
@@ -4630,7 +4712,7 @@ export function getHealth(now: number = Date.now()): HealthReport {
   });
 
   const expiredMessageClaims = (db
-    .prepare("SELECT COUNT(*) as c FROM messages WHERE claimed_by IS NOT NULL AND (claim_expires_at IS NULL OR claim_expires_at <= ?) AND NOT EXISTS (SELECT 1 FROM tasks t WHERE t.message_id = messages.id AND t.status IN ('done', 'failed', 'canceled'))")
+    .query("SELECT COUNT(*) as c FROM messages WHERE claimed_by IS NOT NULL AND (claim_expires_at IS NULL OR claim_expires_at <= ?) AND NOT EXISTS (SELECT 1 FROM tasks t WHERE t.message_id = messages.id AND t.status IN ('done', 'failed', 'canceled'))")
     .get(now) as any).c as number;
   checks.push({
     name: "expired-message-claims",
@@ -4640,7 +4722,7 @@ export function getHealth(now: number = Date.now()): HealthReport {
   });
 
   const expiredTaskClaims = (db
-    .prepare("SELECT COUNT(*) as c FROM tasks WHERE claimed_by IS NOT NULL AND (claim_expires_at IS NULL OR claim_expires_at <= ?) AND status IN ('claimed', 'in_progress', 'blocked')")
+    .query("SELECT COUNT(*) as c FROM tasks WHERE claimed_by IS NOT NULL AND (claim_expires_at IS NULL OR claim_expires_at <= ?) AND status IN ('claimed', 'in_progress', 'blocked')")
     .get(now) as any).c as number;
   checks.push({
     name: "expired-task-claims",
@@ -4650,7 +4732,7 @@ export function getHealth(now: number = Date.now()): HealthReport {
   });
 
   const offlineClaimedTasks = (db
-    .prepare(`
+    .query(`
       SELECT COUNT(*) as c
       FROM tasks t
       JOIN agents a ON a.id = t.claimed_by
@@ -4797,12 +4879,12 @@ function parseOrchestratorUpgrade(value: unknown): OrchestratorUpgradeState | un
  * meta blob (no schema change). Pass null to clear.
  */
 export function setOrchestratorUpgradeState(id: string, state: OrchestratorUpgradeState | null): Orchestrator | null {
-  const row = db.prepare("SELECT meta FROM orchestrators WHERE id = ?").get(id) as { meta?: string } | undefined;
+  const row = db.query("SELECT meta FROM orchestrators WHERE id = ?").get(id) as { meta?: string } | undefined;
   if (!row) return null;
   const meta = parseJson<Record<string, unknown>>(row.meta ?? "{}", {});
   if (state) meta.upgrade = state;
   else delete meta.upgrade;
-  db.prepare("UPDATE orchestrators SET meta = ? WHERE id = ?").run(JSON.stringify(meta), id);
+  db.query("UPDATE orchestrators SET meta = ? WHERE id = ?").run(JSON.stringify(meta), id);
   return getOrchestrator(id);
 }
 
@@ -4890,11 +4972,11 @@ export function upsertOrchestrator(input: RegisterOrchestratorInput): Orchestrat
   // Carry forward server-managed meta the orchestrator never reports (upgrade
   // state) — registration meta would otherwise drop it on the very re-register
   // that follows a self-upgrade restart, breaking version reconciliation.
-  const existingRow = db.prepare("SELECT meta FROM orchestrators WHERE id = ?").get(input.id) as { meta?: string } | undefined;
+  const existingRow = db.query("SELECT meta FROM orchestrators WHERE id = ?").get(input.id) as { meta?: string } | undefined;
   const existingMeta = existingRow ? parseJson<Record<string, unknown>>(existingRow.meta ?? "{}", {}) : {};
   const mergedMeta = mergeOrchestratorRuntimeMeta(input.meta ?? {}, input);
   if (existingMeta.upgrade !== undefined && mergedMeta.upgrade === undefined) mergedMeta.upgrade = existingMeta.upgrade;
-  const stmt = db.prepare(`
+  const stmt = db.query(`
     INSERT INTO orchestrators (id, hostname, status, agent_id, providers, base_dir, api_url, env_keys, meta, last_seen, created_at)
     VALUES ($id, $hostname, 'online', $agentId, $providers, $baseDir, $apiUrl, $envKeys, $meta, $now, $now)
     ON CONFLICT(id) DO UPDATE SET
@@ -4944,24 +5026,24 @@ export function upsertOrchestrator(input: RegisterOrchestratorInput): Orchestrat
 }
 
 export function getOrchestrator(id: string): Orchestrator | null {
-  const row = db.prepare("SELECT * FROM orchestrators WHERE id = ?").get(id) as any;
+  const row = db.query("SELECT * FROM orchestrators WHERE id = ?").get(id) as any;
   return row ? rowToOrchestrator(row) : null;
 }
 
 export function listOrchestrators(): Orchestrator[] {
-  return (db.prepare("SELECT * FROM orchestrators ORDER BY hostname").all() as any[]).map(rowToOrchestrator);
+  return (db.query("SELECT * FROM orchestrators ORDER BY hostname").all() as any[]).map(rowToOrchestrator);
 }
 
 export function orchestratorHeartbeat(id: string, runtime: OrchestratorRuntimeInput = {}): Orchestrator | null {
   const now = Date.now();
-  const row = db.prepare("SELECT meta FROM orchestrators WHERE id = ?").get(id) as { meta?: string } | undefined;
+  const row = db.query("SELECT meta FROM orchestrators WHERE id = ?").get(id) as { meta?: string } | undefined;
   if (!row) return null;
   const meta = mergeOrchestratorRuntimeMeta(parseJson<Record<string, unknown>>(row.meta ?? "{}", {}), runtime);
   if (runtime.providers) {
-    db.prepare("UPDATE orchestrators SET last_seen = ?, status = 'online', providers = ?, meta = ? WHERE id = ?")
+    db.query("UPDATE orchestrators SET last_seen = ?, status = 'online', providers = ?, meta = ? WHERE id = ?")
       .run(now, JSON.stringify(runtime.providers), JSON.stringify(meta), id);
   } else {
-    db.prepare("UPDATE orchestrators SET last_seen = ?, status = 'online', meta = ? WHERE id = ?").run(now, JSON.stringify(meta), id);
+    db.query("UPDATE orchestrators SET last_seen = ?, status = 'online', meta = ? WHERE id = ?").run(now, JSON.stringify(meta), id);
   }
   // Also heartbeat the agent
   const orch = getOrchestrator(id);
@@ -4993,7 +5075,7 @@ export function updateManagedAgents(id: string, agents: ManagedAgent[]): Orchest
       },
     } : agent;
   });
-  db.prepare("UPDATE orchestrators SET managed_agents = ?, last_seen = ? WHERE id = ?")
+  db.query("UPDATE orchestrators SET managed_agents = ?, last_seen = ? WHERE id = ?")
     .run(JSON.stringify(enriched), Date.now(), id);
   return getOrchestrator(id);
 }
@@ -5051,7 +5133,7 @@ function upsertWorkspaceFromManagedAgent(agent: ManagedAgent): WorkspaceRecord |
 
 export function upsertWorkspace(input: Omit<WorkspaceRecord, "createdAt" | "updatedAt"> & Partial<Pick<WorkspaceRecord, "createdAt" | "updatedAt">>): WorkspaceRecord {
   const now = Date.now();
-  db.prepare(`
+  db.query(`
     INSERT INTO workspaces (id, repo_root, source_cwd, worktree_path, branch, base_ref, base_sha, mode, requested_mode, status, owner_agent_id, owner_policy_name, owner_automation_run_id, steward_agent_id, metadata, created_at, updated_at, ready_at, cleaned_at)
     VALUES ($id, $repoRoot, $sourceCwd, $worktreePath, $branch, $baseRef, $baseSha, $mode, $requestedMode, $status, $ownerAgentId, $ownerPolicyName, $ownerAutomationRunId, $stewardAgentId, $metadata, $createdAt, $updatedAt, $readyAt, $cleanedAt)
     ON CONFLICT(id) DO UPDATE SET
@@ -5098,7 +5180,7 @@ export function upsertWorkspace(input: Omit<WorkspaceRecord, "createdAt" | "upda
 }
 
 export function getWorkspace(id: string): WorkspaceRecord | null {
-  const row = db.prepare("SELECT * FROM workspaces WHERE id = ?").get(id) as any;
+  const row = db.query("SELECT * FROM workspaces WHERE id = ?").get(id) as any;
   return row ? rowToWorkspace(row) : null;
 }
 
@@ -5109,11 +5191,11 @@ export function listWorkspaces(filter: { repoRoot?: string; ownerAgentId?: strin
   if (filter.ownerAgentId) { where.push("owner_agent_id = ?"); params.push(filter.ownerAgentId); }
   if (filter.status) { where.push("status = ?"); params.push(filter.status); }
   const sql = `SELECT * FROM workspaces${where.length ? " WHERE " + where.join(" AND ") : ""} ORDER BY updated_at DESC`;
-  return (db.prepare(sql).all(...params) as any[]).map(rowToWorkspace);
+  return (db.query(sql).all(...params) as any[]).map(rowToWorkspace);
 }
 
 export function deleteWorkspace(id: string): boolean {
-  return db.prepare("DELETE FROM workspaces WHERE id = ?").run(id).changes > 0;
+  return db.query("DELETE FROM workspaces WHERE id = ?").run(id).changes > 0;
 }
 
 // Shared-mode rows are pure occupancy markers (no worktree on disk) that only
@@ -5131,9 +5213,9 @@ export function pruneOrphanedSharedWorkspaces(): string[] {
         OR owner_agent_id NOT IN (SELECT id FROM agents)
         OR owner_agent_id IN (SELECT id FROM agents WHERE status = 'offline')
       )`;
-    const rows = db.prepare(`SELECT id FROM workspaces WHERE ${orphanCondition}`).all() as Array<{ id: string }>;
+    const rows = db.query(`SELECT id FROM workspaces WHERE ${orphanCondition}`).all() as Array<{ id: string }>;
     if (!rows.length) return [];
-    db.prepare(`DELETE FROM workspaces WHERE ${orphanCondition}`).run();
+    db.query(`DELETE FROM workspaces WHERE ${orphanCondition}`).run();
     return rows.map((r) => r.id);
   })();
 }
@@ -5143,7 +5225,7 @@ export function updateWorkspaceStatus(id: string, status: WorkspaceStatus, metad
   if (!existing) return null;
   const nextMeta = { ...existing.metadata, ...metadata };
   const now = Date.now();
-  db.prepare(`
+  db.query(`
     UPDATE workspaces
     SET status = ?, metadata = ?, updated_at = ?, ready_at = coalesce(ready_at, ?), cleaned_at = coalesce(cleaned_at, ?)
     WHERE id = ?
@@ -5182,19 +5264,19 @@ function rowToRepoSteward(row: any): RepoStewardRecord {
 }
 
 export function getRepoSteward(repoRoot: string): RepoStewardRecord | null {
-  const row = db.prepare("SELECT * FROM repo_stewards WHERE repo_root = ?").get(repoRoot) as any;
+  const row = db.query("SELECT * FROM repo_stewards WHERE repo_root = ?").get(repoRoot) as any;
   return row ? rowToRepoSteward(row) : null;
 }
 
 export function listRepoStewards(): RepoStewardRecord[] {
-  return (db.prepare("SELECT * FROM repo_stewards ORDER BY updated_at DESC").all() as any[]).map(rowToRepoSteward);
+  return (db.query("SELECT * FROM repo_stewards ORDER BY updated_at DESC").all() as any[]).map(rowToRepoSteward);
 }
 
 // Persist the elected steward for a repo. The row is never deleted, so a repo's
 // stewardship survives a full all-agents-offline gap (steward goes NULL/dormant,
 // last_steward_agent_id keeps continuity) and resumes on the next agent join.
 function upsertRepoSteward(repoRoot: string, steward: string | null, now: number): void {
-  db.prepare(`
+  db.query(`
     INSERT INTO repo_stewards (repo_root, steward_agent_id, last_steward_agent_id, elected_at, updated_at)
     VALUES ($repoRoot, $steward, $steward, $electedAt, $now)
     ON CONFLICT(repo_root) DO UPDATE SET
@@ -5210,7 +5292,7 @@ function upsertRepoSteward(repoRoot: string, steward: string | null, now: number
 
 function electWorkspaceStewards(repoRoot?: string): void {
   const params: string[] = repoRoot ? [repoRoot] : [];
-  const repoRows = db.prepare(`
+  const repoRows = db.query(`
     SELECT DISTINCT repo_root FROM workspaces
     WHERE status IN (${STEWARD_LIVE_STATUSES})
     ${repoRoot ? "AND repo_root = ?" : ""}
@@ -5220,7 +5302,7 @@ function electWorkspaceStewards(repoRoot?: string): void {
     // Candidate pool: owners of live workspaces in this repo who are online,
     // oldest first. A steward must be an online agent actively in the repo — an
     // offline agent can't coordinate, so it is never elected (the old bug).
-    const pool = (db.prepare(`
+    const pool = (db.query(`
       SELECT w.owner_agent_id AS id, MIN(w.created_at) AS created_at
       FROM workspaces w JOIN agents a ON a.id = w.owner_agent_id
       WHERE w.repo_root = ? AND w.owner_agent_id IS NOT NULL
@@ -5239,7 +5321,7 @@ function electWorkspaceStewards(repoRoot?: string): void {
     // re-elections don't churn updated_at and reset the auto-abandon clock for a
     // dormant repo (a stranded review_requested must still age out).
     if (steward !== current) {
-      db.prepare(`UPDATE workspaces SET steward_agent_id = ?, updated_at = ? WHERE repo_root = ? AND status IN (${STEWARD_LIVE_STATUSES})`)
+      db.query(`UPDATE workspaces SET steward_agent_id = ?, updated_at = ? WHERE repo_root = ? AND status IN (${STEWARD_LIVE_STATUSES})`)
         .run(steward, now, row.repo_root);
     }
   }
@@ -5263,7 +5345,7 @@ export function patchWorkspaceMetadata(id: string, patch: Record<string, unknown
     if (v === undefined) delete next[k];
     else next[k] = v;
   }
-  db.prepare("UPDATE workspaces SET metadata = ? WHERE id = ?").run(JSON.stringify(next), id);
+  db.query("UPDATE workspaces SET metadata = ? WHERE id = ?").run(JSON.stringify(next), id);
   return getWorkspace(id);
 }
 
@@ -5271,7 +5353,7 @@ export function patchWorkspaceMetadata(id: string, patch: Record<string, unknown
 // when an agent (re)registers so a dormant repo regains a steward on rejoin
 // without a full unscoped sweep.
 function electWorkspaceStewardsForAgent(agentId: string): void {
-  const repos = db.prepare(`
+  const repos = db.query(`
     SELECT DISTINCT repo_root FROM workspaces
     WHERE owner_agent_id = ? AND status IN (${STEWARD_LIVE_STATUSES})
   `).all(agentId) as Array<{ repo_root: string }>;
@@ -5301,18 +5383,18 @@ function rowToMergeLease(row: any): MergeLeaseRecord {
 }
 
 export function getMergeLease(repoRoot: string): MergeLeaseRecord | null {
-  const row = db.prepare("SELECT * FROM workspace_merge_leases WHERE repo_root = ?").get(repoRoot) as any;
+  const row = db.query("SELECT * FROM workspace_merge_leases WHERE repo_root = ?").get(repoRoot) as any;
   return row ? rowToMergeLease(row) : null;
 }
 
 export function listMergeLeases(): MergeLeaseRecord[] {
-  return (db.prepare("SELECT * FROM workspace_merge_leases ORDER BY acquired_at DESC").all() as any[]).map(rowToMergeLease);
+  return (db.query("SELECT * FROM workspace_merge_leases ORDER BY acquired_at DESC").all() as any[]).map(rowToMergeLease);
 }
 
 export function releaseExpiredMergeLeases(now: number = Date.now()): string[] {
-  const expired = db.prepare("SELECT repo_root FROM workspace_merge_leases WHERE expires_at <= ?").all(now) as Array<{ repo_root: string }>;
+  const expired = db.query("SELECT repo_root FROM workspace_merge_leases WHERE expires_at <= ?").all(now) as Array<{ repo_root: string }>;
   if (!expired.length) return [];
-  db.prepare("DELETE FROM workspace_merge_leases WHERE expires_at <= ?").run(now);
+  db.query("DELETE FROM workspace_merge_leases WHERE expires_at <= ?").run(now);
   return expired.map((r) => r.repo_root);
 }
 
@@ -5329,7 +5411,7 @@ export function acquireMergeLease(
     const existing = getMergeLease(repoRoot);
     if (existing && existing.expiresAt > now) return { ok: false as const, lease: existing };
     const expiresAt = now + WORKSPACE_MERGE_LEASE_MS;
-    db.prepare(`
+    db.query(`
       INSERT INTO workspace_merge_leases (repo_root, workspace_id, command_id, holder, acquired_at, expires_at)
       VALUES (?, ?, NULL, ?, ?, ?)
       ON CONFLICT(repo_root) DO UPDATE SET
@@ -5343,7 +5425,7 @@ export function acquireMergeLease(
 // Attach the dispatched command id to a held lease so it can be released by
 // command id when the merge settles.
 export function setMergeLeaseCommand(repoRoot: string, commandId: string): void {
-  db.prepare("UPDATE workspace_merge_leases SET command_id = ? WHERE repo_root = ?").run(commandId, repoRoot);
+  db.query("UPDATE workspace_merge_leases SET command_id = ? WHERE repo_root = ?").run(commandId, repoRoot);
 }
 
 // Release a merge lease. Guard by commandId/workspaceId when known so a stale
@@ -5355,26 +5437,26 @@ export function releaseMergeLease(opts: { repoRoot?: string; commandId?: string;
   if (opts.commandId) { where.push("command_id = ?"); params.push(opts.commandId); }
   if (opts.workspaceId) { where.push("workspace_id = ?"); params.push(opts.workspaceId); }
   if (!where.length) return false;
-  return db.prepare(`DELETE FROM workspace_merge_leases WHERE ${where.join(" AND ")}`).run(...params).changes > 0;
+  return db.query(`DELETE FROM workspace_merge_leases WHERE ${where.join(" AND ")}`).run(...params).changes > 0;
 }
 
 export function deleteOrchestrator(id: string): boolean {
   const orch = getOrchestrator(id);
   if (!orch) return false;
-  db.prepare("DELETE FROM orchestrators WHERE id = ?").run(id);
+  db.query("DELETE FROM orchestrators WHERE id = ?").run(id);
   deleteAgent(orch.agentId);
   return true;
 }
 
 export function reapStaleOrchestrators(): string[] {
   const cutoff = Date.now() - STALE_TTL_MS;
-  const stale = db.prepare("SELECT id, agent_id FROM orchestrators WHERE last_seen < ? AND status = 'online'").all(cutoff) as any[];
+  const stale = db.query("SELECT id, agent_id FROM orchestrators WHERE last_seen < ? AND status = 'online'").all(cutoff) as any[];
   for (const row of stale) {
-    db.prepare("UPDATE orchestrators SET status = 'offline' WHERE id = ?").run(row.id);
+    db.query("UPDATE orchestrators SET status = 'offline' WHERE id = ?").run(row.id);
     // An orchestrator agent holds no workspaces, so use a direct status update
     // instead of setStatus() (which triggers an unscoped electWorkspaceStewards
     // sweep across all repos on every offline transition).
-    db.prepare("UPDATE agents SET status = 'offline', ready = 0 WHERE id = ?").run(row.agent_id);
+    db.query("UPDATE agents SET status = 'offline', ready = 0 WHERE id = ?").run(row.agent_id);
   }
   return stale.map((row: any) => row.id);
 }