create-walle 0.9.21 → 0.9.23

package/template/wall-e/llm/provider-error.js

@@ -105,7 +105,7 @@ function buildRawMessage(err) {
 }
 
 function classifyType(status, lower) {
-  if (/insufficient[_ -]?quota|quota exceeded|quota_exceeded|resource[_ -]?exhausted|billing|credit|prepayment credits are depleted/i.test(lower)) return 'quota_exceeded';
+  if (/insufficient[_ -]?(quota|balance|funds)|quota exceeded|quota_exceeded|resource[_ -]?exhausted|billing|credit|prepayment credits are depleted/i.test(lower)) return 'quota_exceeded';
   if (status === 429 || /rate[_ -]?limit|too many requests|too_many_requests|rate_limit/i.test(lower)) return 'rate_limited';
   if (
     status === 401
@@ -186,6 +186,10 @@ function classifyProviderError(err, context = {}) {
   const copy = messageForType(type);
   const provider = context.provider || err?.provider || err?.providerType || null;
   const model = context.model || err?.model || null;
+  const providerId = context.providerId || err?.providerId || err?.provider_id || null;
+  const registryId = context.registryId || err?.registryId || err?.registry_id || null;
+  const routeLabel = context.routeLabel || err?.routeLabel || err?.route_label || null;
+  const connectionKind = context.connectionKind || err?.connectionKind || err?.connection_kind || null;
   const providerName = providerLabel(provider);
   const modelSuffix = model ? ` (${model})` : '';
   const retryAfter = extractRetryAfter(err);
@@ -200,6 +204,10 @@ function classifyProviderError(err, context = {}) {
     rawMessage,
     status,
     provider,
+    providerId,
+    registryId,
+    routeLabel,
+    connectionKind,
     model,
     retryAfter,
     actionLabel: 'Open Setup',
@@ -251,6 +259,9 @@ function recordProviderFailureAlert(providerError, brain) {
   if (!providerError) return { alerted: false };
   try {
     const planner = require('../skills/skill-planner');
+    const actionUrl = providerError.type === 'request_invariant'
+      ? null
+      : (providerError.actionUrl || '/setup.html');
     planner.addServiceAlert({
       service: 'ai_provider',
       type: `ai_provider:${providerError.provider || 'default'}:${providerError.type}`,
@@ -259,7 +270,7 @@ function recordProviderFailureAlert(providerError, brain) {
       provider: providerError.provider || null,
       model: providerError.model || null,
       message: `${providerError.title}: ${providerError.userMessage}`,
-      action_url: providerError.actionUrl || '/setup.html',
+      action_url: actionUrl,
       provider_error: providerError,
     });
     return { alerted: true };
@@ -268,9 +279,26 @@ function recordProviderFailureAlert(providerError, brain) {
   }
 }
 
+// One-line, secret-redacted human detail of a failed-provider error — for the
+// routing-notice banner, so a degraded default surfaces WHY ("HTTP 404: anthropic
+// error: model deepseek-v4-flash") instead of a bare "unreachable". Never throws.
+function fallbackErrorDetail(err) {
+  if (!err) return '';
+  let raw = '';
+  try { raw = buildRawMessage(err); }
+  catch { try { raw = redactSecrets(String((err && err.message) || err || '')); } catch { raw = ''; } }
+  raw = String(raw || '').replace(/\s+/g, ' ').trim();
+  if (!raw) return '';
+  let status = 0;
+  try { status = extractStatus(err); } catch { status = 0; }
+  if (status && !new RegExp('\\b' + status + '\\b').test(raw)) raw = `HTTP ${status}: ${raw}`;
+  return raw.slice(0, 200);
+}
+
 module.exports = {
   classifyProviderError,
   decorateProviderError,
+  fallbackErrorDetail,
   providerLabel,
   recordProviderFailureAlert,
   redactSecrets,

package/template/wall-e/llm/registry.js

@@ -132,7 +132,11 @@ function modelMatchesProvider(model, providerId) {
   if (!model || !providerId) return true;
   const detected = detectProviderForModel(model);
   if (!detected) return true; // No claim — accept.
-  return detected === providerId;
+  const provider = String(providerId || '').toLowerCase();
+  if (provider === 'openai-compatible' || provider.startsWith('openai-compatible-')) {
+    return detected === 'openai';
+  }
+  return detected === provider;
 }
 
 /** Test helper. */

package/template/wall-e/llm/request-compat.js

@@ -0,0 +1,67 @@
+'use strict';
+
+const ANTHROPIC_SAMPLING_PARAMS = Object.freeze([
+  'temperature',
+  'top_p',
+  'topP',
+  'top_k',
+  'topK',
+]);
+
+function normalizeModelId(model) {
+  if (!model) return '';
+  let id = typeof model === 'string' ? model : String(model.id || model.model || model.name || '');
+  id = id.trim();
+  id = id.replace(/^@anthropic\//i, '');
+  id = id.replace(/^anthropic[.:/]/i, '');
+  id = id.replace(/@(default|[a-z0-9_.-]+)$/i, '');
+  return id.toLowerCase();
+}
+
+function anthropicModelRejectsSamplingParams(model) {
+  const id = normalizeModelId(model);
+  const match = id.match(/^claude-(?:opus|sonnet|haiku)-4-(\d+)(?:-|$)/);
+  return Boolean(match && Number(match[1]) >= 7);
+}
+
+function stripParams(request, keys, reason) {
+  const stripped = [];
+  for (const key of keys) {
+    if (Object.prototype.hasOwnProperty.call(request, key) && request[key] !== undefined) {
+      delete request[key];
+      stripped.push(key);
+    }
+  }
+  return stripped.length > 0 ? [{ reason, keys: stripped }] : [];
+}
+
+function stripAnthropicUnsupportedParams(request = {}, { model = request.model, force = false } = {}) {
+  const next = { ...request };
+  const shouldStrip = force || anthropicModelRejectsSamplingParams(model);
+  if (!shouldStrip) return { request: next, warnings: [] };
+  const warnings = stripParams(
+    next,
+    ANTHROPIC_SAMPLING_PARAMS,
+    `Removed Anthropic sampling parameter(s) unsupported by ${normalizeModelId(model) || 'selected model'}.`
+  );
+  return { request: next, warnings };
+}
+
+function isAnthropicSamplingParamError(error) {
+  const text = [
+    error?.message,
+    error?.responseBody,
+    error?.body,
+    JSON.stringify(error?.error || ''),
+  ].filter(Boolean).join('\n').toLowerCase();
+  return /(?:temperature|top[_ ]?p|top[_ ]?k).*(?:deprecated|not supported|unsupported|invalid)/i.test(text)
+    || /(?:deprecated|not supported|unsupported|invalid).*(?:temperature|top[_ ]?p|top[_ ]?k)/i.test(text);
+}
+
+module.exports = {
+  ANTHROPIC_SAMPLING_PARAMS,
+  anthropicModelRejectsSamplingParams,
+  isAnthropicSamplingParamError,
+  normalizeModelId,
+  stripAnthropicUnsupportedParams,
+};

package/template/wall-e/loops/backfill.js

@@ -38,6 +38,32 @@ const KV_BACKFILL_DONE = 'backfill:done';
 
 const VALID_DOMAINS = ['work', 'personal', 'social', 'technical', 'admin'];
 
+// ── Cheap "work remaining" signals ──────────────────────────────────────────
+// This loop runs every 30s ON THE MAIN THREAD, and better-sqlite3 is synchronous,
+// so any unbounded query here blocks Wall-E's entire event loop — HTTP included —
+// for the full duration of the scan. On a multi-GB brain that means the daemon
+// stops answering /api/* (e.g. the setup page's provider list) for tens of seconds
+// at a time. So every per-tick "is there work left?" check MUST stay bounded — no
+// full-table content scans.
+//
+// `length(content) > 10` forces reading each candidate row's (often overflow-paged)
+// content, so counting embeddable memories is the one unavoidable full scan. It
+// only moves as memories are ingested, so cache it briefly instead of paying it
+// every tick.
+let _embeddableCache = { value: null, at: 0 };
+const EMBEDDABLE_TTL_MS = 10 * 60 * 1000;
+function embeddableMemoryTotal() {
+  const now = Date.now();
+  if (_embeddableCache.value != null && now - _embeddableCache.at < EMBEDDABLE_TTL_MS) {
+    return _embeddableCache.value;
+  }
+  const c = brain.getDb().prepare(
+    "SELECT count(*) AS c FROM memories WHERE content IS NOT NULL AND length(content) > 10"
+  ).get().c;
+  _embeddableCache = { value: c, at: now };
+  return c;
+}
+
 /**
  * Run one backfill iteration. Call periodically from the daemon.
  * Returns { classified, embedded, done } counts.
@@ -79,7 +105,10 @@ async function runOnce(opts = {}) {
   // Phase 2: Embed memories missing embeddings — run multiple batches per tick
   // Quick Ollama readiness check — after laptop sleep, Ollama needs a few seconds
   // to reload. Skip this tick rather than wasting it on failed/slow batches.
-  if (embeddings && embeddings.isAvailable() && await _isEmbeddingProviderReady()) {
+  // Gate on the cheap remaining-count BEFORE the readiness probe: when embedding is
+  // already complete, embedBatch's anti-join would otherwise SCAN the whole memories
+  // table just to return 0 every tick. countUnembedded() is bounded (indexed counts).
+  if (embeddings && embeddings.isAvailable() && countUnembedded() > 0 && await _isEmbeddingProviderReady()) {
     const MAX_BATCHES_PER_TICK = 5; // Up to 5 x EMBED_BATCH per tick for faster backfill
     for (let b = 0; b < MAX_BATCHES_PER_TICK; b++) {
       try {
@@ -147,12 +176,19 @@ async function runOnce(opts = {}) {
 async function classifyBatch(opts = {}) {
   const db = brain.getDb();
 
-  const cursor = brain.getKv(KV_CLASSIFY_CURSOR) || '0';
+  // Self-draining: select straight from the unclassified set (domain IS NULL) with a
+  // plain LIMIT — no `id > cursor` / `ORDER BY id ASC`. The old cursor+ORDER BY form
+  // made SQLite drive off idx_memories_domain and build a TEMP B-TREE over EVERY
+  // unclassified row (reading each one's content via a table seek) before applying
+  // LIMIT — so a single call read 80k+ rows' content and blocked the event loop for
+  // tens of seconds. classifyMemory always assigns a non-null domain, so classified
+  // rows leave the set and the next LIMIT picks up where this one left off. This is
+  // bounded to CLASSIFY_BATCH content reads per call and can't strand rows.
   const batch = db.prepare(`
     SELECT id, content, source, source_channel FROM memories
-    WHERE domain IS NULL AND content IS NOT NULL AND length(content) > 10 AND id > ?
-    ORDER BY id ASC LIMIT ?
-  `).all(cursor, CLASSIFY_BATCH);
+    WHERE domain IS NULL AND content IS NOT NULL AND length(content) > 10
+    LIMIT ?
+  `).all(CLASSIFY_BATCH);
 
   if (batch.length === 0) return 0;
 
@@ -165,7 +201,6 @@ async function classifyBatch(opts = {}) {
   });
   classify();
 
-  brain.setKv(KV_CLASSIFY_CURSOR, batch[batch.length - 1].id);
   return batch.length;
 }
 
@@ -358,24 +393,33 @@ async function indexBatch() {
 }
 
 const NOISE_BATCH = 500;
+const KV_NOISE_DONE = 'backfill:noise:done';
 
 async function noiseStripBatch() {
+  // One-time legacy sweep: new content is stripped at ingest, so once we've swept the
+  // whole table there's nothing left to do — skip entirely instead of re-scanning.
+  if (brain.getKv(KV_NOISE_DONE) === '1') return 0;
+
   const db = brain.getDb();
   const cursor = brain.getKv(KV_NOISE_CURSOR) || '0';
-  // Only process memories that have system-reminder tags in content (legacy noisy content)
-  const batch = db.prepare(`
-    SELECT id, content FROM memories
-    WHERE content IS NOT NULL AND length(content) > 50
-    AND content LIKE '%<system-reminder>%'
-    AND id > ?
-    ORDER BY id ASC LIMIT ?
-  `).all(cursor, NOISE_BATCH);
-  if (batch.length === 0) return 0;
+  // Scan a bounded id-window (LIMIT applies to SCANNED rows) and match the legacy
+  // <system-reminder> tag in JS. The old query put `content LIKE '%…%'` in SQL, so with
+  // only a handful of tagged rows it never filled the LIMIT and the cursor — advanced to
+  // the last MATCHED id — barely moved, making every 30s tick re-scan the rest of the
+  // table reading content. Advancing past the last SCANNED row guarantees forward
+  // progress and lets the sweep terminate.
+  const batch = db.prepare(
+    'SELECT id, content FROM memories WHERE id > ? ORDER BY id ASC LIMIT ?'
+  ).all(cursor, NOISE_BATCH);
+  if (batch.length === 0) { brain.setKv(KV_NOISE_DONE, '1'); return 0; }
+
   let stripped = 0;
   const update = db.transaction(() => {
     for (const mem of batch) {
-      const cleaned = stripNoise(mem.content);
-      if (cleaned !== mem.content) {
+      const content = mem.content;
+      if (!content || content.length <= 50 || !content.includes('<system-reminder>')) continue;
+      const cleaned = stripNoise(content);
+      if (cleaned !== content) {
         db.prepare('UPDATE memories SET content_raw = content, content = ? WHERE id = ?').run(cleaned, mem.id);
         stripped++;
       }
@@ -383,26 +427,37 @@ async function noiseStripBatch() {
   });
   update();
   brain.setKv(KV_NOISE_CURSOR, batch[batch.length - 1].id);
+  // Short batch ⇒ reached the end of the table ⇒ sweep complete.
+  if (batch.length < NOISE_BATCH) brain.setKv(KV_NOISE_DONE, '1');
   return stripped;
 }
 
+// Capped at 21: the only consumers are the done-gate (`<= 20`) and a diagnostic log
+// line. The exact count would read content for every one of 80k+ unclassified rows
+// each tick (full scan); the LIMIT lets SQLite stop after the first 21 matches.
 function countUnclassified() {
   try {
     return brain.getDb().prepare(
-      "SELECT count(*) as c FROM memories WHERE domain IS NULL AND content IS NOT NULL AND length(content) > 10"
+      "SELECT count(*) AS c FROM (SELECT 1 FROM memories WHERE domain IS NULL AND content IS NOT NULL AND length(content) > 10 LIMIT 21)"
     ).get().c;
   } catch { return 0; }
 }
 
+// Cheap: the accurate anti-join (memories LEFT JOIN embedding_map ... rowid IS NULL)
+// is a full SCAN of memories reading content — tens of seconds cold, every tick.
+// Instead derive remaining work from two bounded counts: the (cached) embeddable
+// total minus the indexed count of memory-type embeddings for the active model.
+// Stale embeddings can make this slightly under-count, which is acceptable: it only
+// gates "is embedding done?" and mirrors the existing `unclassified <= 20` tolerance
+// — a handful of unembedded rows won't meaningfully hurt semantic search.
 function countUnembedded() {
   try {
     const activeModel = embeddings && embeddings.getEmbeddingModel();
     if (!activeModel) return 0;
-    return brain.getDb().prepare(`
-      SELECT count(*) as c FROM memories m
-      LEFT JOIN embedding_map em ON em.entity_id = m.id AND em.model = ?
-      WHERE em.rowid IS NULL AND m.content IS NOT NULL AND length(m.content) > 10
-    `).get(activeModel).c;
+    const embedded = brain.getDb().prepare(
+      "SELECT count(*) AS c FROM embedding_map WHERE model = ? AND entity_type = 'memory'"
+    ).get(activeModel).c;
+    return Math.max(0, embeddableMemoryTotal() - embedded);
   } catch { return 0; }
 }
 
@@ -417,6 +472,7 @@ function reset() {
   brain.setKv(KV_ENTITY_CURSOR, null);
   brain.setKv(KV_INDEX_CURSOR, null);
   brain.setKv(KV_NOISE_CURSOR, null);
+  brain.setKv(KV_NOISE_DONE, null);
 }
 
 /**

package/template/wall-e/loops/brain-optimize.js

@@ -0,0 +1,67 @@
+'use strict';
+// Deferred, one-shot brain-DB space optimization for users upgrading from a pre-int8 build.
+// Runs OFF the boot path (registered with a multi-minute startDelay) so it never adds to the
+// boot storm, and self-gates to run at most once via a kv flag.
+//
+// Safety model:
+//   - SIZE-GATED: the int8 rebuild + FTS rebuild + VACUUM block the (single) event loop for
+//     their duration. Tiny for a few-thousand-vector store, ~tens of seconds for hundreds of
+//     thousands. So only auto-run when the embedding store is small; otherwise log a one-time
+//     notice pointing at the supervised CLI (`scripts/db-optimize/migrate.js`, run with Wall-E
+//     stopped) and never nag again.
+//   - NEVER drops lost_and_found automatically: that is a per-install SQLite .recover artifact
+//     and dropping a recovery table needs explicit human confirmation.
+//   - Idempotent + crash-safe: each phase checks if already applied and is transactional, so a
+//     restart mid-run simply retries; float32 vectors are never lost (rolled back on crash).
+
+const brain = require('../brain');
+
+const KV_STATE = 'brain:optimize:v1';            // unset | 'done' | 'notified'
+const AUTO_MAX = parseInt(process.env.BRAIN_OPTIMIZE_AUTO_MAX || '20000', 10);
+
+async function runOnce() {
+  const state = brain.getKv(KV_STATE);
+  if (state === 'done' || state === 'notified') return { done: true, _done: true, skipped: state };
+
+  let db;
+  try { db = brain.getDb(); } catch { return { done: false, reason: 'no-db' }; }
+
+  // sqlite-vec must be loaded on this connection for the int8 quantization functions.
+  try { require('../embeddings').ensureVecLoaded(); } catch {}
+
+  let mig;
+  try { mig = require('../scripts/db-optimize/migrate'); } catch (e) {
+    console.error('[brain-optimize] migration module unavailable:', e.message);
+    brain.setKv(KV_STATE, 'notified');
+    return { done: true, _done: true, skipped: 'module-missing' };
+  }
+
+  if (!mig.needsOptimization(db)) {
+    brain.setKv(KV_STATE, 'done');
+    return { done: true, _done: true, alreadyOptimal: true };
+  }
+
+  const n = mig.embeddingCount(db);
+  if (n > AUTO_MAX) {
+    console.warn(
+      `[brain-optimize] Brain has ${n} float32 embeddings (> ${AUTO_MAX} auto cap). ` +
+      `To reclaim disk, stop Wall-E and run: node wall-e/scripts/db-optimize/migrate.js "${brain.getDbPath()}". ` +
+      `Set BRAIN_OPTIMIZE_AUTO_MAX higher to auto-migrate anyway (briefly blocks the event loop).`
+    );
+    brain.setKv(KV_STATE, 'notified');
+    return { done: true, _done: true, skipped: 'large', embeddingCount: n };
+  }
+
+  const t0 = Date.now();
+  mig.optimizeBrain(db, {
+    vacuum: true,
+    dropLostAndFound: false, // recovery artifact — never auto-drop
+    log: (...a) => console.log('[brain-optimize]', ...a),
+  });
+  brain.setKv(KV_STATE, 'done');
+  const ms = Date.now() - t0;
+  console.log(`[brain-optimize] upgrade migration complete in ${(ms / 1000).toFixed(1)}s (${n} vectors → int8)`);
+  return { done: true, _done: true, migrated: true, embeddingCount: n, ms };
+}
+
+module.exports = { runOnce, KV_STATE, AUTO_MAX };

package/template/wall-e/loops/ingest.js

@@ -27,17 +27,32 @@ async function runOnce(adapters) {
 
     try {
       const memories = await adapter.poll(since);
-      for (const mem of memories) {
-        adapterLatestTimestamp = newerTimestamp(adapterLatestTimestamp, mem.timestamp);
-        latestTimestamp = newerTimestamp(latestTimestamp, mem.timestamp);
-        const result = brain.insertMemory(mem);
-        if (result) {
-          memoriesIngested++;
-          adapterIngested++;
-          if (mem.importance >= 0.8 || mem.memory_type === 'message_received') {
-            eventBus.emitHighImportance(result?.id, (mem.content || '').slice(0, 200));
+      // Insert in chunked transactions instead of N individually-locked INSERTs. One
+      // INSERT per message means N cross-process write-lock acquisitions per poll;
+      // wrapping ALL of them in a single transaction would swing the other way and hold
+      // the lock for the whole batch (the harvest lock-hold class). Chunking bounds the
+      // hold while still collapsing N lock acquisitions into N/CHUNK. High-importance
+      // events are emitted AFTER each chunk commits, never from inside the transaction.
+      const INSERT_CHUNK = 200;
+      for (let i = 0; i < memories.length; i += INSERT_CHUNK) {
+        const slice = memories.slice(i, i + INSERT_CHUNK);
+        const highImportance = [];
+        const insertChunk = brain.getDb().transaction(() => {
+          for (const mem of slice) {
+            adapterLatestTimestamp = newerTimestamp(adapterLatestTimestamp, mem.timestamp);
+            latestTimestamp = newerTimestamp(latestTimestamp, mem.timestamp);
+            const result = brain.insertMemory(mem);
+            if (result) {
+              memoriesIngested++;
+              adapterIngested++;
+              if (mem.importance >= 0.8 || mem.memory_type === 'message_received') {
+                highImportance.push({ id: result?.id, content: (mem.content || '').slice(0, 200) });
+              }
+            }
           }
-        }
+        });
+        insertChunk();
+        for (const h of highImportance) eventBus.emitHighImportance(h.id, h.content);
       }
       // After inserting individual memories, create exchange pairs for conversational sources
       if (memories.length >= 2) {

package/template/wall-e/loops/question-digest.js

@@ -0,0 +1,160 @@
+'use strict';
+
+// Daily question digest: select the few questions worth the owner's input, render them as a
+// numbered message, and resolve them from the owner's reply. Channel fan-out (Slack/email/
+// CTM tab) and the once-a-day scheduling wrap these pure helpers so they stay testable.
+//
+// Design: docs/superpowers/specs/2026-05-31-question-digest-and-brain-retention-design.md
+// (daily-digest-only; deliver to Slack + email + CTM tab; answer via Slack reply or CTM).
+
+const brain = require('../brain');
+
+const DEFAULT_MAX = Number(process.env.WALL_E_QUESTION_DIGEST_MAX || 10);
+
+function _ownerName() {
+  try { return brain.getOwnerName() || 'there'; } catch { return 'there'; }
+}
+
+// Render a numbered, priority-tagged digest the owner can answer by replying "1: ... 2: ...".
+function renderDigestText(questions, ownerName = _ownerName()) {
+  if (!questions || questions.length === 0) return '';
+  const n = questions.length;
+  const lines = [
+    `Hi ${ownerName} — Wall-E has ${n} question${n === 1 ? '' : 's'} for you:`,
+    '',
+  ];
+  questions.forEach((q, i) => {
+    const tag = q.priority && q.priority !== 'normal' ? `[${q.priority}] ` : '';
+    lines.push(`${i + 1}. ${tag}${q.question}`);
+  });
+  lines.push('');
+  lines.push('Reply like "1: your answer  2: your answer" — or answer in the Wall-E tab.');
+  return lines.join('\n');
+}
+
+// Build today's digest from undelivered pending questions. Does NOT mark delivered — the
+// caller marks only after a successful send (so a send failure re-tries tomorrow).
+function buildDigest({ max = DEFAULT_MAX } = {}) {
+  const questions = brain.listUndeliveredDigestQuestions({ max });
+  return {
+    count: questions.length,
+    questions,
+    text: renderDigestText(questions),
+  };
+}
+
+// Parse an owner reply that answers numbered questions, e.g.:
+//   "1: yes   2 - it's the Dropbox path\n3. no"
+// Maps each leading number to the question at that 1-based position in `questions`.
+// Returns [{ id, answer }]. Unparseable lines are ignored.
+function parseDigestReply(text, questions) {
+  if (!text || !Array.isArray(questions) || questions.length === 0) return [];
+  const out = [];
+  const seen = new Set();
+  const re = /(?:^|\n)\s*(\d{1,2})\s*[:.\)\-]\s*(.+?)(?=\n\s*\d{1,2}\s*[:.\)\-]|$)/gs;
+  let m;
+  while ((m = re.exec(text)) !== null) {
+    const idx = parseInt(m[1], 10) - 1;
+    const answer = m[2].trim();
+    if (idx < 0 || idx >= questions.length || !answer) continue;
+    const q = questions[idx];
+    if (!q || seen.has(q.id)) continue;
+    seen.add(q.id);
+    out.push({ id: q.id, answer });
+  }
+  return out;
+}
+
+// Resolve questions from parsed replies. Returns the count resolved.
+function applyDigestReplies(parsed, { resolutionEvidence = 'digest reply' } = {}) {
+  if (!Array.isArray(parsed)) return 0;
+  let resolved = 0;
+  for (const { id, answer } of parsed) {
+    try {
+      brain.answerQuestion(id, { answer, resolution_type: 'answered', resolution_evidence: resolutionEvidence });
+      resolved += 1;
+    } catch { /* question may have been resolved/expired already */ }
+  }
+  return resolved;
+}
+
+// ---- Channel fan-out -------------------------------------------------------------------
+// The CTM Wall-E tab is the always-on surface (it lists pending questions + Answer/Dismiss
+// buttons, no opt-in). Slack DM and email are OPT-IN push notifications, off by default,
+// enabled via kv flags (set from the Wall-E settings UI). "Delivered" only gates the push
+// channels — the CTM tab always shows pending questions regardless.
+const KV = {
+  slackEnabled: 'digest:slack_enabled',
+  emailEnabled: 'digest:email_enabled',
+  slackChannel: 'digest:slack_channel',
+  emailTo: 'digest:email_to',
+  lastSent: 'digest:last_sent_date',
+};
+function _kv(key) { try { return brain.getKv(key) || ''; } catch { return ''; } }
+function _kvBool(key) { return String(_kv(key)).toLowerCase() === 'true'; }
+
+function getDigestChannelConfig() {
+  return {
+    ctm: true, // always on
+    slack: _kvBool(KV.slackEnabled),
+    slackChannel: _kv(KV.slackChannel),
+    email: _kvBool(KV.emailEnabled),
+    emailTo: _kv(KV.emailTo),
+  };
+}
+
+async function _defaultSendSlack(channel, text) {
+  const { callSlackMcp } = require('../tools/slack-mcp');
+  return callSlackMcp('slack_send_message', { channel, text });
+}
+async function _defaultSendEmail(to, subject, body) {
+  const { sendMail } = require('../tools/local-tools');
+  return sendMail({ to, subject, body, source: 'wall-e-digest' });
+}
+
+// Once-a-day digest job (registered in agent.js). Builds the undelivered digest and pushes
+// it to the OPT-IN channels (Slack/email); marks delivered only if a push actually sent, so
+// enabling a channel later still pushes the backlog once. The CTM tab needs no push.
+// `opts` injects { date, force, sendSlack, sendEmail } for tests.
+async function runDigestJob(opts = {}) {
+  const date = opts.date || new Date();
+  const todayStr = date.toISOString().slice(0, 10);
+  const targetHour = Number(process.env.WALL_E_DIGEST_HOUR || 8);
+  if (!opts.force) {
+    if (date.getHours() < targetHour) return { sent: false, reason: 'before-target-hour' };
+    if (_kv(KV.lastSent) === todayStr) return { sent: false, reason: 'already-sent-today' };
+  }
+  const cfg = getDigestChannelConfig();
+  if (!cfg.slack && !cfg.email) return { sent: false, reason: 'no-push-channels-enabled' };
+
+  const digest = buildDigest({ max: opts.max || DEFAULT_MAX });
+  if (digest.count === 0) return { sent: false, reason: 'no-questions' };
+
+  const sendSlack = opts.sendSlack || _defaultSendSlack;
+  const sendEmail = opts.sendEmail || _defaultSendEmail;
+  const results = {};
+  let anySent = false;
+  if (cfg.slack && cfg.slackChannel) {
+    try { await sendSlack(cfg.slackChannel, digest.text); results.slack = 'sent'; anySent = true; }
+    catch (e) { results.slack = `err:${e.message}`; }
+  } else if (cfg.slack) {
+    results.slack = 'skipped:no-channel-configured';
+  }
+  if (cfg.email && cfg.emailTo) {
+    try { await sendEmail(cfg.emailTo, `Wall-E: ${digest.count} question${digest.count === 1 ? '' : 's'} for you`, digest.text); results.email = 'sent'; anySent = true; }
+    catch (e) { results.email = `err:${e.message}`; }
+  } else if (cfg.email) {
+    results.email = 'skipped:no-recipient-configured';
+  }
+
+  if (anySent) {
+    brain.markQuestionsDelivered(digest.questions.map((q) => q.id));
+    try { brain.setKv(KV.lastSent, todayStr); } catch {}
+  }
+  return { sent: anySent, count: digest.count, results };
+}
+
+module.exports = {
+  buildDigest, renderDigestText, parseDigestReply, applyDigestReplies,
+  getDigestChannelConfig, runDigestJob, DEFAULT_MAX, KV,
+};

package/template/wall-e/loops/reflect.js

@@ -45,12 +45,14 @@ async function runOnce(opts = {}) {
   const checkpoint = brain.getCheckpoint('reflect');
   const lastRunAt = checkpoint ? checkpoint.last_run_at : null;
 
-  // Count new memories since last reflect
+  // Count new memories since last reflect. Use a DB COUNT — listMemories(...).length
+  // pulled every matching row (content blobs and all) just to count them, a full
+  // materialization on a 350k-row brain.
   const sinceOpts = lastRunAt ? { since: lastRunAt } : {};
-  const memoriesSinceLastReflect = brain.listMemories(sinceOpts).length;
+  const memoriesSinceLastReflect = brain.countMemories(sinceOpts);
 
-  // Count pending questions
-  const pendingQuestions = brain.listQuestions({ status: 'pending' }).length;
+  // Count pending questions (DB COUNT, not a full materialization)
+  const pendingQuestions = brain.countQuestions({ status: 'pending' });
 
   // Update checkpoint
   brain.upsertCheckpoint('reflect', {