create-walle 0.9.21 → 0.9.23

package/template/wall-e/brain.js

@@ -1,4 +1,15 @@
 // --- WALL-E Brain: SQLite Database Layer (WAL mode, better-sqlite3) ---
+const {
+  assertNoForeignSqliteOwner,
+} = require('../shared/sqlite-owner-guard');
+
+assertNoForeignSqliteOwner({
+  blockedEnv: 'CTM_PROCESS_ROLE',
+  overrideEnv: 'WALL_E_ALLOW_EMBEDDED_BRAIN_IN_CTM',
+  databaseLabel: 'Wall-E brain DB',
+  ownerLabel: 'Wall-E',
+});
+
 const Database = require('better-sqlite3');
 const path = require('path');
 const fs = require('fs');
@@ -9,6 +20,16 @@ const { createWriteAuditLog } = require('./db/write-audit');
 const { inferProviderFromModel, normalizeEvalProvider } = require('./eval/provider-normalizer');
 const { capabilitiesForOllamaModel } = require('./llm/ollama');
 const { findSupportedModel, supportedModelIdsForProvider } = require('./llm/supported-models');
+const { isPortkeyProviderConfig } = require('./llm/portkey');
+const {
+  enforceSqliteStoragePolicy,
+} = require('../shared/sqlite-storage-policy');
+const {
+  installSqliteWriteLock,
+} = require('../shared/sqlite-write-lock');
+const {
+  createSqliteOwnerWriteQueue,
+} = require('../shared/sqlite-owner-write-queue');
 const _brainEvents = new EventEmitter();
 _brainEvents.setMaxListeners(20);
 let _stripNoise;
@@ -28,16 +49,124 @@ configureDevboxGateway();
 
 const DATA_DIR = process.env.WALL_E_DATA_DIR || path.join(process.env.HOME, '.walle', 'data');
 const DEFAULT_DB_PATH = path.join(DATA_DIR, 'wall-e-brain.db');
-const BACKUP_DIR = path.join(DATA_DIR, 'backups');
+const DEFAULT_BACKUP_DIR = _normalizeUserPath(process.env.WALL_E_BACKUP_DIR || path.join(DATA_DIR, 'backups'));
+let BACKUP_DIR = DEFAULT_BACKUP_DIR;
+let BACKUP_DIR_SOURCE = process.env.WALL_E_BACKUP_DIR ? 'env' : 'default';
 const writeAuditLog = createWriteAuditLog({ dataDir: DATA_DIR });
 const { logWrite } = writeAuditLog;
 
 let db = null;
 let currentDbPath = null;
+let ownerWriteQueue = null;
 let _daemonOwned = false; // When true, closeDb() is a no-op (daemon manages lifecycle)
+let storageRisk = null;
+
+function _normalizeUserPath(value) {
+  const raw = String(value || '').trim().replace(/[\r\n\0]/g, '');
+  if (!raw) return '';
+  const expanded = raw === '~'
+    ? process.env.HOME
+    : raw.replace(/^~(?=\/|$)/, process.env.HOME || '~');
+  return path.resolve(expanded);
+}
+
+function _ensureBackupDir(dir) {
+  const target = _normalizeUserPath(dir || BACKUP_DIR || DEFAULT_BACKUP_DIR);
+  if (!target) throw new Error('Backup directory is empty');
+  fs.mkdirSync(target, { recursive: true });
+  const stat = fs.statSync(target);
+  if (!stat.isDirectory()) throw new Error('Backup path is not a directory');
+  return target;
+}
+
+function _moveFileAcrossDevices(src, dst) {
+  try {
+    fs.renameSync(src, dst);
+    return;
+  } catch (err) {
+    if (err && err.code !== 'EXDEV') throw err;
+  }
+  fs.copyFileSync(src, dst, fs.constants.COPYFILE_EXCL);
+  fs.unlinkSync(src);
+}
+
+function _wallEBackupFile(name) {
+  return /^wall-e-brain-.+\.db$/i.test(String(name || ''));
+}
+
+function moveBackupsToDir(targetDir, opts = {}) {
+  const previous = _backupDirForCurrentDb();
+  const target = _ensureBackupDir(targetDir || DEFAULT_BACKUP_DIR);
+  const moved = [];
+  const skipped = [];
+  if (path.resolve(previous) !== path.resolve(target) && fs.existsSync(previous)) {
+    for (const name of fs.readdirSync(previous)) {
+      if (!_wallEBackupFile(name)) continue;
+      const src = path.join(previous, name);
+      const dst = path.join(target, name);
+      try {
+        if (fs.existsSync(dst)) {
+          skipped.push({ name, reason: 'exists' });
+          continue;
+        }
+        _moveFileAcrossDevices(src, dst);
+        moved.push(name);
+      } catch (e) {
+        skipped.push({ name, reason: e.message });
+        if (opts.failFast !== false) throw e;
+      }
+    }
+  }
+  return { ok: true, previous_backup_dir: previous, backup_dir: target, moved, skipped };
+}
+
+function setBackupDir(dir, opts = {}) {
+  const requested = String(dir || '').trim();
+  const target = _ensureBackupDir(requested || DEFAULT_BACKUP_DIR);
+  const previous = BACKUP_DIR;
+  if (opts.moveExisting) moveBackupsToDir(target, { failFast: true });
+  BACKUP_DIR = target;
+  BACKUP_DIR_SOURCE = requested ? 'settings' : (process.env.WALL_E_BACKUP_DIR ? 'env' : 'default');
+  if (opts.persist && db) {
+    setKv('backup_dir', requested ? target : '');
+  }
+  return {
+    ok: true,
+    backup_dir: BACKUP_DIR,
+    previous_backup_dir: previous,
+    default_backup_dir: DEFAULT_BACKUP_DIR,
+    source: BACKUP_DIR_SOURCE,
+  };
+}
+
+function getBackupDirInfo() {
+  let configured = '';
+  try {
+    if (db) configured = getKv('backup_dir') || '';
+  } catch {}
+  return {
+    backup_dir: _backupDirForCurrentDb(),
+    default_backup_dir: DEFAULT_BACKUP_DIR,
+    configured_backup_dir: configured,
+    source: configured ? 'settings' : BACKUP_DIR_SOURCE,
+  };
+}
+
+function _applyPersistedBackupDirSetting() {
+  try {
+    if (!db) return;
+    const configured = getKv('backup_dir') || '';
+    setBackupDir(configured, { persist: false });
+  } catch (e) {
+    console.error('[brain] Backup directory setting ignored:', e.message);
+    _ensureBackupDir(DEFAULT_BACKUP_DIR);
+    BACKUP_DIR = DEFAULT_BACKUP_DIR;
+    BACKUP_DIR_SOURCE = process.env.WALL_E_BACKUP_DIR ? 'env' : 'default';
+  }
+}
 
 // --- Schema versioning via PRAGMA user_version ---
-const SCHEMA_VERSION = 14; // Bump on every migration addition
+const SCHEMA_VERSION = 18; // Bump on every migration addition
 
 const MIGRATIONS = {
   1: (d) => {
@@ -79,6 +208,7 @@ const MIGRATIONS = {
     d.prepare("CREATE INDEX IF NOT EXISTS idx_memories_topic ON memories(topic)").run();
     // History column on chat_branches
     addCol('chat_branches', 'history', "TEXT NOT NULL DEFAULT '[]'");
+    addCol('chat_branches', 'updated_at_ms', 'INTEGER NOT NULL DEFAULT 0');
     // Temporal validity on knowledge
     addCol('knowledge', 'valid_from', 'TEXT');
     addCol('knowledge', 'valid_to', 'TEXT');
@@ -365,6 +495,82 @@ const MIGRATIONS = {
         ON channel_message_events(delivery_id);
     `);
   },
+  15: (d) => {
+    const addCol = (table, col, type) => {
+      try { d.prepare(`SELECT ${col} FROM ${table} LIMIT 0`).run(); } catch (_) {
+        d.prepare(`ALTER TABLE ${table} ADD COLUMN ${col} ${type}`).run();
+      }
+    };
+    addCol('model_registry', 'source', "TEXT DEFAULT 'catalog'");
+    addCol('model_registry', 'verification_status', "TEXT DEFAULT 'verified'");
+    addCol('model_registry', 'last_seen_at', 'TEXT');
+    addCol('model_registry', 'gateway_type', 'TEXT');
+    d.prepare("UPDATE model_registry SET source = 'catalog' WHERE source IS NULL OR source = ''").run();
+    d.prepare("UPDATE model_registry SET verification_status = 'verified' WHERE verification_status IS NULL OR verification_status = ''").run();
+  },
+  16: (d) => {
+    // Daily question digest: track when a question was delivered so it isn't re-asked every
+    // day (the digest is once/day and includes only not-yet-delivered pending questions).
+    const addCol = (table, col, type) => {
+      try { d.prepare(`SELECT ${col} FROM ${table} LIMIT 0`).run(); } catch (_) {
+        d.prepare(`ALTER TABLE ${table} ADD COLUMN ${col} ${type}`).run();
+      }
+    };
+    addCol('pending_questions', 'digest_delivered_at', 'TEXT');
+    d.prepare('CREATE INDEX IF NOT EXISTS idx_questions_digest ON pending_questions(status, digest_delivered_at)').run();
+  },
+  17: (d) => {
+    d.exec(`
+      CREATE TABLE IF NOT EXISTS model_usage_ledger (
+        id TEXT PRIMARY KEY,
+        occurred_at TEXT NOT NULL DEFAULT (datetime('now')),
+        source TEXT NOT NULL DEFAULT 'wall-e.chat',
+        feature TEXT,
+        session_id TEXT,
+        branch_id TEXT,
+        message_id TEXT,
+        request_id TEXT,
+        provider_type TEXT,
+        provider_id TEXT,
+        model_id TEXT,
+        model_registry_id TEXT,
+        gateway_type TEXT,
+        route_label TEXT,
+        input_tokens INTEGER DEFAULT 0,
+        output_tokens INTEGER DEFAULT 0,
+        total_tokens INTEGER DEFAULT 0,
+        cached_input_tokens INTEGER DEFAULT 0,
+        reasoning_output_tokens INTEGER DEFAULT 0,
+        latency_ms INTEGER,
+        stop_reason TEXT,
+        status TEXT DEFAULT 'success',
+        error_type TEXT,
+        cost_usd REAL,
+        cost_source TEXT,
+        metadata TEXT,
+        created_at TEXT DEFAULT (datetime('now'))
+      );
+      CREATE UNIQUE INDEX IF NOT EXISTS idx_model_usage_ledger_request
+        ON model_usage_ledger(source, request_id)
+        WHERE request_id IS NOT NULL AND request_id != '';
+      CREATE INDEX IF NOT EXISTS idx_model_usage_ledger_occurred
+        ON model_usage_ledger(occurred_at);
+      CREATE INDEX IF NOT EXISTS idx_model_usage_ledger_session
+        ON model_usage_ledger(session_id, occurred_at);
+      CREATE INDEX IF NOT EXISTS idx_model_usage_ledger_provider_model
+        ON model_usage_ledger(provider_type, model_id, occurred_at);
+      CREATE INDEX IF NOT EXISTS idx_model_usage_ledger_registry
+        ON model_usage_ledger(model_registry_id, occurred_at);
+    `);
+  },
+  18: (d) => {
+    const addCol = (table, col, type) => {
+      try { d.prepare(`SELECT ${col} FROM ${table} LIMIT 0`).run(); } catch (_) {
+        d.prepare(`ALTER TABLE ${table} ADD COLUMN ${col} ${type}`).run();
+      }
+    };
+    addCol('chat_branches', 'updated_at_ms', 'INTEGER NOT NULL DEFAULT 0');
+  },
 };
 
 // Schema invariants — columns/tables that MUST exist after the named migration.
@@ -382,6 +588,9 @@ const SCHEMA_INVARIANTS = [
   { migration: 9, table: 'agent_runner_evaluations', column: 'runner_id' },
   { migration: 10, table: 'eval_benchmark_runs', column: 'dataset_version' },
   { migration: 14, table: 'channel_message_events', column: 'channel' },
+  { migration: 15, table: 'model_registry', column: 'source' },
+  { migration: 17, table: 'model_usage_ledger', column: 'id' },
+  { migration: 18, table: 'chat_branches', column: 'updated_at_ms' },
 ];
 
 function _columnExists(d, table, column) {
@@ -540,6 +749,428 @@ function getDbPath() {
   return currentDbPath || DEFAULT_DB_PATH;
 }
 
+function getStorageRisk() {
+  return storageRisk;
+}
+
+function _storagePolicyEnvForCurrentProcess() {
+  const isScriptSkillProcess = Boolean(process.env.WALLE_BUNDLED_SKILL_NAME || process.env.WALL_E_SKILL_DIR);
+  if (!isScriptSkillProcess) return process.env;
+  if (process.env.WALL_E_SQLITE_STORAGE_POLICY || process.env.SQLITE_STORAGE_POLICY) return process.env;
+  return {
+    ...process.env,
+    WALL_E_SQLITE_STORAGE_POLICY: 'error',
+  };
+}
+
+function _checkStoragePolicy(dbPath) {
+  storageRisk = enforceSqliteStoragePolicy(dbPath, {
+    env: _storagePolicyEnvForCurrentProcess(),
+    prefix: 'WALL_E',
+    label: 'Wall-E wall-e-brain.db',
+  });
+  return storageRisk;
+}
+
+function _loadSqliteVec(d) {
+  // Load sqlite-vec before schema/PRAGMA reads. Without it, DBs containing
+  // vec0 virtual tables can look corrupt even when the file is structurally OK.
+  try {
+    const sqliteVec = require('sqlite-vec');
+    sqliteVec.load(d);
+  } catch {
+    // sqlite-vec not installed — fine if DB has no vec0 tables.
+  }
+}
+
+function _quickCheckFile(filePath) {
+  let d = null;
+  try {
+    if (!fs.existsSync(filePath) || fs.statSync(filePath).size === 0) {
+      return { ok: true, skipped: true, reason: 'missing_or_empty' };
+    }
+    d = new Database(filePath, { readonly: true, fileMustExist: true });
+    _loadSqliteVec(d);
+    d.pragma('busy_timeout = 5000');
+    const rows = d.pragma('quick_check');
+    const messages = (Array.isArray(rows) ? rows : [rows])
+      .map(row => String(Object.values(row || {})[0] || '').trim())
+      .filter(Boolean);
+    if (messages.length === 1 && messages[0].toLowerCase() === 'ok') return { ok: true };
+    return { ok: false, error: messages.join('\n') || 'quick_check failed', classification: 'sqlite_structural_corruption' };
+  } catch (err) {
+    return _classifySqliteError(err);
+  } finally {
+    try { if (d) d.close(); } catch {}
+  }
+}
+
+// Map a thrown SQLite error to {ok:false, error, code, classification}.
+function _classifySqliteError(err) {
+  const code = String(err?.code || '');
+  const message = String(err?.message || err || '');
+  const text = `${code} ${message}`.toLowerCase();
+  let classification = 'unknown';
+  if (/sqlite_(corrupt|notadb)|database disk image is malformed|malformed database|database schema is corrupt|file is not a database/.test(text)) {
+    classification = 'sqlite_structural_corruption';
+  } else if (/sqlite_(busy|locked)|database is locked|database table is locked/.test(text)) {
+    classification = 'sqlite_locked';
+  } else if (/sqlite_cantopen|unable to open database file/.test(text)) {
+    classification = 'sqlite_unavailable';
+  }
+  return { ok: false, error: message, code: code || undefined, classification };
+}
+
+// Cheap boot-time integrity probe: open readonly + read the header (user_version) and the
+// schema. Catches GROSS corruption (truncated / not-a-db / malformed header or schema) in
+// milliseconds, WITHOUT the full-file `quick_check` page scan — which costs 12-42s on a
+// multi-GB brain on EVERY boot (measured via the boot profile). Deep page-level integrity
+// is still verified off the boot path by the daily backup job (createBackup runs
+// quick_check on the produced image and fails/alerts if it's bad).
+function _cheapIntegrityCheck(filePath) {
+  let d = null;
+  try {
+    if (!fs.existsSync(filePath) || fs.statSync(filePath).size === 0) {
+      return { ok: true, skipped: true, reason: 'missing_or_empty' };
+    }
+    d = new Database(filePath, { readonly: true, fileMustExist: true });
+    d.pragma('busy_timeout = 5000');
+    d.pragma('user_version');                                   // reads the DB header
+    d.prepare('SELECT count(*) AS n FROM sqlite_master').get(); // reads the schema
+    return { ok: true };
+  } catch (err) {
+    return _classifySqliteError(err);
+  } finally {
+    try { if (d) d.close(); } catch {}
+  }
+}
+
+function _archiveDbFamily(dbPath, reason) {
+  const ts = new Date().toISOString().replace(/[:.]/g, '-');
+  const archived = [];
+  for (const ext of ['', '-wal', '-shm']) {
+    const src = dbPath + ext;
+    if (!fs.existsSync(src)) continue;
+    const dst = `${dbPath}.corrupt-${ts}${ext}`;
+    fs.renameSync(src, dst);
+    archived.push(dst);
+  }
+  console.error(`[brain] Archived corrupt DB family (${reason}): ${archived.map(f => path.basename(f)).join(', ')}`);
+  return archived;
+}
+
+function _backupDirsForRestore(dbPath) {
+  const dirs = [
+    path.join(path.dirname(dbPath), 'backups'),
+    BACKUP_DIR,
+  ];
+  return [...new Set(dirs)].filter(Boolean);
+}
+
+function _materializeBackupCandidate(backupPath, tmpPath) {
+  fs.rmSync(tmpPath, { force: true });
+  fs.copyFileSync(backupPath, tmpPath);
+}
+
+function _restoreLatestHealthyBackup(dbPath) {
+  const candidates = [];
+  for (const dir of _backupDirsForRestore(dbPath)) {
+    if (!fs.existsSync(dir)) continue;
+    for (const name of fs.readdirSync(dir)) {
+      if (!name.startsWith('wall-e-brain-') || !name.endsWith('.db')) continue;
+      const backupPath = path.join(dir, name);
+      try {
+        candidates.push({ path: backupPath, mtimeMs: fs.statSync(backupPath).mtimeMs });
+      } catch {}
+    }
+  }
+  candidates.sort((a, b) => b.mtimeMs - a.mtimeMs);
+
+  const dir = path.dirname(dbPath);
+  for (const candidate of candidates) {
+    const tmp = path.join(dir, `wall-e-brain.db.restore-candidate-${process.pid}-${Date.now()}`);
+    try {
+      _materializeBackupCandidate(candidate.path, tmp);
+      const check = _quickCheckFile(tmp);
+      if (!check.ok) {
+        fs.rmSync(tmp, { force: true });
+        continue;
+      }
+      fs.renameSync(tmp, dbPath);
+      console.error(`[brain] Recovered from healthy backup ${path.basename(candidate.path)}`);
+      return candidate.path;
+    } catch (err) {
+      console.error(`[brain] Skipped backup candidate ${path.basename(candidate.path)}: ${err.message}`);
+      try { fs.rmSync(tmp, { force: true }); } catch {}
+    }
+  }
+  return null;
+}
+
+function _recoverCorruptDbIfNeeded(dbPath) {
+  if (!fs.existsSync(dbPath) || fs.statSync(dbPath).size === 0) return null;
+  // Cheap header/schema probe (ms) instead of a full quick_check (12-42s/boot). Gross
+  // corruption that actually blocks operation is still caught here → archive + restore.
+  // Subtle page corruption is caught off-boot by the daily backup's quick_check.
+  const check = _cheapIntegrityCheck(dbPath);
+  if (check.ok) return null;
+  const classification = check.classification || 'unknown';
+  if (classification !== 'sqlite_structural_corruption') {
+    throw new Error(`Wall-E brain health check failed with ${classification}: ${check.error}`);
+  }
+  _archiveDbFamily(dbPath, `quick_check failed: ${String(check.error || '').split('\n')[0] || 'sqlite structural corruption'}`);
+  const restoredFrom = _restoreLatestHealthyBackup(dbPath);
+  if (!restoredFrom) {
+    throw new Error(`Wall-E brain quick_check failed and no healthy backup was found: ${check.error}`);
+  }
+  return { restoredFrom };
+}
+
+function _sqliteTimeoutMs(name, fallback) {
+  const n = Number(process.env[name]);
+  return Number.isFinite(n) ? Math.max(0, Math.trunc(n)) : fallback;
+}
+
+function _sqlitePositiveInt(name, fallback) {
+  const n = Number(process.env[name]);
+  return Number.isFinite(n) ? Math.max(1, Math.trunc(n)) : fallback;
+}
+
+function _isWriteLockBusyError(err) {
+  if (!err) return false;
+  if (err.code === 'SQLITE_BUSY' || err.code === 'SQLITE_WRITE_LOCK_BUSY') return true;
+  return /write lock busy|SQLITE_BUSY/i.test(String(err.message || ''));
+}
+
+// Boot-only bounded SYNC retry for cross-process write-lock contention while
+// OPENING the brain (journal_mode=WAL, table create, migrations). Steady-state
+// writes keep their 0ms main-thread fail-fast (set at installSqliteWriteLock);
+// this runs only during initDb — before the daemon serves — so a transient busy
+// lock at boot no longer throws FATAL and crash-loops with "MCP never became
+// ready". The wrapped init writes are all idempotent, so re-running is safe.
+function _retryBusySync(fn, deadlineMs, pollMs = 50) {
+  const start = Date.now();
+  for (;;) {
+    try {
+      return fn();
+    } catch (err) {
+      if (!_isWriteLockBusyError(err) || (Date.now() - start) >= deadlineMs) throw err;
+      try {
+        Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, Math.max(1, pollMs));
+      } catch {
+        /* SharedArrayBuffer unavailable — fall through and retry immediately */
+      }
+    }
+  }
+}
+
+// ---------------------------------------------------------------------------
+// Write-lock probes (mirrors CTM's db.js instrumentation). The brain DB is
+// contended CROSS-PROCESS (the daemon + each spawned skill subprocess opens its
+// own connection to the same file lock), so unlike CTM the relevant identity is
+// the OS pid, not a worker threadId. We aggregate per-label acquire/busy/hold/wait
+// stats with hold/wait histograms (p50/p95) and, on slow/busy events, log the
+// originating caller plus the lock HOLDER's pid — so log analysis can map
+// "caller X in pid A blocked by holder pid B". Exposed via
+// GET /api/wall-e/diagnostics/write-lock.
+const WRITE_LOCK_SLOW_HOLD_MS = _sqlitePositiveInt('WALL_E_WRITE_LOCK_SLOW_HOLD_MS', 250);
+const WRITE_LOCK_SLOW_WAIT_MS = _sqlitePositiveInt('WALL_E_WRITE_LOCK_SLOW_WAIT_MS', 250);
+const WRITE_LOCK_HIST_BUCKETS_MS = [1, 5, 25, 100, 500, 2000];
+function _newWriteLockHist() {
+  return new Array(WRITE_LOCK_HIST_BUCKETS_MS.length + 1).fill(0);
+}
+function _writeLockHistAdd(hist, ms) {
+  const value = Number(ms) || 0;
+  for (let i = 0; i < WRITE_LOCK_HIST_BUCKETS_MS.length; i += 1) {
+    if (value < WRITE_LOCK_HIST_BUCKETS_MS[i]) { hist[i] += 1; return; }
+  }
+  hist[WRITE_LOCK_HIST_BUCKETS_MS.length] += 1;
+}
+function _writeLockBucketLabel(i) {
+  if (i < WRITE_LOCK_HIST_BUCKETS_MS.length) return `<${WRITE_LOCK_HIST_BUCKETS_MS[i]}ms`;
+  return `>=${WRITE_LOCK_HIST_BUCKETS_MS[WRITE_LOCK_HIST_BUCKETS_MS.length - 1]}ms`;
+}
+function _writeLockPercentile(hist, pct) {
+  const total = hist.reduce((a, b) => a + b, 0);
+  if (!total) return null;
+  const target = Math.ceil(total * pct);
+  let cumulative = 0;
+  for (let i = 0; i < hist.length; i += 1) {
+    cumulative += hist[i];
+    if (cumulative >= target) return _writeLockBucketLabel(i);
+  }
+  return _writeLockBucketLabel(hist.length - 1);
+}
+function _newWriteLockStats() {
+  return {
+    startedAtMs: Date.now(),
+    acquires: 0, busy: 0, contended: 0,
+    holdSum: 0, holdMax: 0, holdHist: _newWriteLockHist(),
+    waitSum: 0, waitMax: 0, waitHist: _newWriteLockHist(),
+    byLabel: new Map(),
+  };
+}
+let _writeLockStats = _newWriteLockStats();
+function _writeLockLabelStat(label) {
+  let stat = _writeLockStats.byLabel.get(label);
+  if (!stat) {
+    stat = { acquires: 0, busy: 0, holdSum: 0, holdMax: 0, waitMax: 0 };
+    _writeLockStats.byLabel.set(label, stat);
+  }
+  return stat;
+}
+// Identify the originating call site for slow/busy log lines. onEvent runs
+// synchronously inside withSqliteWriteLock (invoked synchronously via
+// stmt.run/exec/pragma/transaction), so the caller frame is still on the stack.
+// Only computed on a slow/busy event (rare), so the Error().stack cost is moot.
+function _writeLockCallerHint() {
+  try {
+    const lines = String(new Error().stack || '').split('\n').slice(2);
+    for (const line of lines) {
+      if (/sqlite-write-lock\.js|_onWriteLockEvent|_writeLockCallerHint|node:|node_modules/.test(line)) continue;
+      const m = line.match(/at\s+(?:(\S+)\s+\()?(?:.*\/)?([^/\s):]+):(\d+):\d+\)?/);
+      if (m) return `${m[1] ? m[1] + '@' : ''}${m[2]}:${m[3]}`;
+    }
+  } catch {}
+  return '?';
+}
+// Pull the lock HOLDER's pid out of the busy error (the shared lock module formats
+// it as "... pid=<n> label=<l>: <path>.write-lock"). Cross-process attribution.
+function _writeLockHolderPid(err) {
+  const m = /pid=(\d+)/.exec(err && err.message ? err.message : '');
+  return m ? m[1] : '?';
+}
+function _onWriteLockEvent(ev) {
+  try {
+    const label = ev.label || '';
+    const labelStat = _writeLockLabelStat(label);
+    const waited = Number(ev.waitedMs) || 0;
+    _writeLockStats.waitSum += waited;
+    if (waited > _writeLockStats.waitMax) _writeLockStats.waitMax = waited;
+    if (waited > labelStat.waitMax) labelStat.waitMax = waited;
+    _writeLockHistAdd(_writeLockStats.waitHist, waited);
+
+    if (ev.acquired === false) {
+      _writeLockStats.busy += 1;
+      labelStat.busy += 1;
+      const holder = _writeLockHolderPid(ev.error);
+      console.warn(`[sqlite-write-lock] busy fail-fast label=${label} waitedMs=${waited} pid=${process.pid} holder=${holder} caller=${_writeLockCallerHint()}`);
+      return;
+    }
+
+    const held = Number(ev.heldMs) || 0;
+    _writeLockStats.acquires += 1;
+    labelStat.acquires += 1;
+    if (ev.contended) _writeLockStats.contended += 1;
+    _writeLockStats.holdSum += held;
+    if (held > _writeLockStats.holdMax) _writeLockStats.holdMax = held;
+    labelStat.holdSum += held;
+    if (held > labelStat.holdMax) labelStat.holdMax = held;
+    _writeLockHistAdd(_writeLockStats.holdHist, held);
+
+    if (held >= WRITE_LOCK_SLOW_HOLD_MS || waited >= WRITE_LOCK_SLOW_WAIT_MS) {
+      console.warn(`[sqlite-write-lock] slow label=${label} heldMs=${held} waitedMs=${waited} contended=${ev.contended} pid=${process.pid} caller=${_writeLockCallerHint()}`);
+    }
+  } catch {}
+}
+// Snapshot accumulated write-lock stats for this process. `byLabel` sorted by
+// total hold time (the most likely contention culprit first).
+function getWriteLockStats() {
+  const s = _writeLockStats;
+  const topLabelsByHold = [...s.byLabel.entries()]
+    .map(([label, v]) => ({
+      label,
+      acquires: v.acquires,
+      busy: v.busy,
+      holdSumMs: v.holdSum,
+      holdMaxMs: v.holdMax,
+      holdAvgMs: v.acquires ? Math.round(v.holdSum / v.acquires) : 0,
+      waitMaxMs: v.waitMax,
+    }))
+    .sort((a, b) => b.holdSumMs - a.holdSumMs)
+    .slice(0, 12);
+  return {
+    pid: process.pid,
+    uptimeMs: Date.now() - s.startedAtMs,
+    acquires: s.acquires,
+    busy: s.busy,
+    contended: s.contended,
+    hold: {
+      sumMs: s.holdSum,
+      maxMs: s.holdMax,
+      avgMs: s.acquires ? Math.round(s.holdSum / s.acquires) : 0,
+      p50: _writeLockPercentile(s.holdHist, 0.5),
+      p95: _writeLockPercentile(s.holdHist, 0.95),
+    },
+    wait: { sumMs: s.waitSum, maxMs: s.waitMax, p95: _writeLockPercentile(s.waitHist, 0.95) },
+    topLabelsByHold,
+  };
+}
+function resetWriteLockStats() {
+  const previous = getWriteLockStats();
+  _writeLockStats = _newWriteLockStats();
+  return previous;
+}
+
+function _closeOwnerWriteQueueNoDrain() {
+  const queue = ownerWriteQueue;
+  ownerWriteQueue = null;
+  if (!queue) return;
+  try { queue.close({ drain: false }).catch(() => {}); } catch {}
+}
+
+function _resetOwnerWriteQueue(dbPath) {
+  _closeOwnerWriteQueueNoDrain();
+  ownerWriteQueue = createSqliteOwnerWriteQueue({
+    name: `wall-e-brain:${path.basename(dbPath || DEFAULT_DB_PATH)}`,
+    maxDepth: _sqlitePositiveInt('WALL_E_SQLITE_OWNER_WRITE_QUEUE_MAX_DEPTH', 1000),
+  });
+  return ownerWriteQueue;
+}
+
+function _getOwnerWriteQueue() {
+  if (!ownerWriteQueue) {
+    ownerWriteQueue = createSqliteOwnerWriteQueue({
+      name: `wall-e-brain:${path.basename(currentDbPath || DEFAULT_DB_PATH)}`,
+      maxDepth: _sqlitePositiveInt('WALL_E_SQLITE_OWNER_WRITE_QUEUE_MAX_DEPTH', 1000),
+    });
+  }
+  return ownerWriteQueue;
+}
+
+function enqueueOwnerWrite(labelOrFn, fnOrOptions, maybeOptions) {
+  const label = typeof labelOrFn === 'string' ? labelOrFn : 'write';
+  const fn = typeof labelOrFn === 'function' ? labelOrFn : fnOrOptions;
+  const options = typeof labelOrFn === 'function' ? (fnOrOptions || {}) : (maybeOptions || {});
+  if (typeof fn !== 'function') throw new TypeError('enqueueOwnerWrite requires a function');
+  return _getOwnerWriteQueue().enqueue(() => fn(getDb()), { ...options, label });
+}
+
+function getOwnerWriteQueueStatus() {
+  return ownerWriteQueue
+    ? ownerWriteQueue.getStatus()
+    : {
+      name: `wall-e-brain:${path.basename(currentDbPath || DEFAULT_DB_PATH)}`,
+      active: null,
+      running: false,
+      pending: 0,
+      accepting: false,
+      closed: true,
+      maxDepth: _sqlitePositiveInt('WALL_E_SQLITE_OWNER_WRITE_QUEUE_MAX_DEPTH', 1000),
+      enqueued: 0,
+      completed: 0,
+      failed: 0,
+      idle: true,
+    };
+}
+
+function drainOwnerWrites(options = {}) {
+  if (!ownerWriteQueue) {
+    return Promise.resolve({ ok: true, timedOut: false, ...getOwnerWriteQueueStatus() });
+  }
+  return ownerWriteQueue.drain(options);
+}
+
 const _VALID_CHECKPOINT_MODES = new Set(['PASSIVE', 'FULL', 'RESTART', 'TRUNCATE']);
 function checkpointWalOrThrow(mode) {
   const d = getDb();
@@ -563,40 +1194,52 @@ function runImmediateTransaction(d, fn, ...args) {
 
 function initDb(dbPath) {
   dbPath = dbPath || DEFAULT_DB_PATH;
-  currentDbPath = dbPath;
+  if (db && currentDbPath === dbPath) return db;
+  if (db && currentDbPath !== dbPath) closeDb(true);
   const dir = path.dirname(dbPath);
-  if (!fs.existsSync(dir)) fs.mkdirSync(dir, { recursive: true });
-  if (!fs.existsSync(BACKUP_DIR)) fs.mkdirSync(BACKUP_DIR, { recursive: true });
-
-  const newDb = new Database(dbPath);
-  // Load sqlite-vec extension BEFORE any schema reads (including PRAGMAs).
-  // If the DB has vec0 virtual tables and the extension isn't loaded,
-  // SQLite returns SQLITE_CORRUPT: "malformed database schema".
-  try {
-    const sqliteVec = require('sqlite-vec');
-    sqliteVec.load(newDb);
-  } catch {
-    // sqlite-vec not installed — fine if DB has no vec0 tables
-  }
+  let newDb = null;
+  const boot = require('./lib/boot-profile'); // per-phase timing (surfaced at /api/wall-e/boot-profile)
   try {
-    newDb.pragma('journal_mode = WAL');
-    newDb.pragma('busy_timeout = 5000');
+    if (!fs.existsSync(dir)) fs.mkdirSync(dir, { recursive: true });
+    _ensureBackupDir(BACKUP_DIR);
+    boot.measure('initDb.storagePolicy', () => _checkStoragePolicy(dbPath));
+    boot.measure('initDb.recoverCorruptCheck', () => _recoverCorruptDbIfNeeded(dbPath));
+
+    const busyTimeoutMs = _sqliteTimeoutMs('WALL_E_SQLITE_BUSY_TIMEOUT_MS', 1000);
+    newDb = boot.measure('initDb.openDatabase', () => new Database(dbPath, { timeout: busyTimeoutMs }));
+    installSqliteWriteLock(newDb, dbPath, {
+      label: 'wall-e-brain',
+      timeoutMs: _sqliteTimeoutMs('WALL_E_SQLITE_WRITE_LOCK_TIMEOUT_MS', 0),
+      staleMs: Number(process.env.WALL_E_SQLITE_WRITE_LOCK_STALE_MS || 10 * 60 * 1000),
+      onEvent: _onWriteLockEvent,
+    });
+    boot.measure('initDb.loadSqliteVec', () => _loadSqliteVec(newDb));
+    // Boot writes tolerate transient cross-process lock contention (a few seconds)
+    // instead of FATAL-ing the daemon before MCP is ready. journal_mode=WAL can also
+    // trigger WAL recovery/checkpoint work on open — measured separately.
+    const bootLockWaitMs = _sqliteTimeoutMs('WALL_E_BRAIN_BOOT_LOCK_WAIT_MS', 7000);
+    boot.measure('initDb.pragma.walMode', () => _retryBusySync(() => newDb.pragma('journal_mode = WAL'), bootLockWaitMs));
+    newDb.pragma(`busy_timeout = ${busyTimeoutMs}`);
     newDb.pragma('foreign_keys = ON');
     db = newDb;
-    createTables();
+    currentDbPath = dbPath;
+    _resetOwnerWriteQueue(dbPath);
+    boot.measure('initDb.createTables', () => _retryBusySync(() => createTables(), bootLockWaitMs));
+    boot.measure('initDb.backupDirSetting', () => _retryBusySync(() => _applyPersistedBackupDirSetting(), bootLockWaitMs));
 
     // --- Schema migrations via PRAGMA user_version ---
     // ensureSchema runs forward migrations and then verifies invariants;
     // it returns the pre-migration pragma value so telemetry can still
     // report what version we upgraded from.
-    const previousSchemaVersion = ensureSchema(newDb);
+    const previousSchemaVersion = boot.measure('initDb.ensureSchema', () => _retryBusySync(() => ensureSchema(newDb), bootLockWaitMs));
 
     // --- Upgrade detection (Phase 2) ---
-    _detectUpgrade(previousSchemaVersion);
+    boot.measure('initDb.detectUpgrade', () => _detectUpgrade(previousSchemaVersion));
   } catch (err) {
-    newDb.close();
+    if (newDb) newDb.close();
     db = null;
     currentDbPath = null;
+    _closeOwnerWriteQueueNoDrain();
     throw err;
   }
   return db;
@@ -848,7 +1491,8 @@ function createTables() {
       session_id TEXT PRIMARY KEY,
       branches TEXT NOT NULL DEFAULT '{}',
       active TEXT NOT NULL DEFAULT '{}',
-      history TEXT NOT NULL DEFAULT '[]'
+      history TEXT NOT NULL DEFAULT '[]',
+      updated_at_ms INTEGER NOT NULL DEFAULT 0
     );
 
     CREATE TABLE IF NOT EXISTS skills (
@@ -1071,6 +1715,10 @@ function createTables() {
       speed_tier INTEGER DEFAULT 3,
       enabled INTEGER DEFAULT 1,
       is_fine_tuned INTEGER DEFAULT 0,
+      source TEXT DEFAULT 'catalog',
+      verification_status TEXT DEFAULT 'verified',
+      last_seen_at TEXT,
+      gateway_type TEXT,
       UNIQUE(provider_id, model_id)
     );
 
@@ -1088,6 +1736,36 @@ function createTables() {
       created_at TEXT DEFAULT (datetime('now'))
     );
 
+    CREATE TABLE IF NOT EXISTS model_usage_ledger (
+      id TEXT PRIMARY KEY,
+      occurred_at TEXT NOT NULL DEFAULT (datetime('now')),
+      source TEXT NOT NULL DEFAULT 'wall-e.chat',
+      feature TEXT,
+      session_id TEXT,
+      branch_id TEXT,
+      message_id TEXT,
+      request_id TEXT,
+      provider_type TEXT,
+      provider_id TEXT,
+      model_id TEXT,
+      model_registry_id TEXT,
+      gateway_type TEXT,
+      route_label TEXT,
+      input_tokens INTEGER DEFAULT 0,
+      output_tokens INTEGER DEFAULT 0,
+      total_tokens INTEGER DEFAULT 0,
+      cached_input_tokens INTEGER DEFAULT 0,
+      reasoning_output_tokens INTEGER DEFAULT 0,
+      latency_ms INTEGER,
+      stop_reason TEXT,
+      status TEXT DEFAULT 'success',
+      error_type TEXT,
+      cost_usd REAL,
+      cost_source TEXT,
+      metadata TEXT,
+      created_at TEXT DEFAULT (datetime('now'))
+    );
+
     CREATE TABLE IF NOT EXISTS agent_runner_evaluations (
       id INTEGER PRIMARY KEY AUTOINCREMENT,
       runner_id TEXT NOT NULL,
@@ -1117,6 +1795,13 @@ function createTables() {
     CREATE INDEX IF NOT EXISTS idx_model_registry_provider ON model_registry(provider_id);
     CREATE INDEX IF NOT EXISTS idx_model_evaluations_model ON model_evaluations(model_registry_id);
     CREATE INDEX IF NOT EXISTS idx_model_evaluations_created ON model_evaluations(created_at);
+    CREATE UNIQUE INDEX IF NOT EXISTS idx_model_usage_ledger_request
+      ON model_usage_ledger(source, request_id)
+      WHERE request_id IS NOT NULL AND request_id != '';
+    CREATE INDEX IF NOT EXISTS idx_model_usage_ledger_occurred ON model_usage_ledger(occurred_at);
+    CREATE INDEX IF NOT EXISTS idx_model_usage_ledger_session ON model_usage_ledger(session_id, occurred_at);
+    CREATE INDEX IF NOT EXISTS idx_model_usage_ledger_provider_model ON model_usage_ledger(provider_type, model_id, occurred_at);
+    CREATE INDEX IF NOT EXISTS idx_model_usage_ledger_registry ON model_usage_ledger(model_registry_id, occurred_at);
     CREATE INDEX IF NOT EXISTS idx_agent_runner_eval_runner ON agent_runner_evaluations(runner_id, task_type);
     CREATE INDEX IF NOT EXISTS idx_agent_runner_eval_created ON agent_runner_evaluations(created_at);
 
@@ -1406,13 +2091,13 @@ function createTables() {
  */
 function closeDb(force = false) {
   if (_daemonOwned && !force) return; // Skill called closeDb() in-process — ignore
-  if (backupIntervalId) {
-    clearInterval(backupIntervalId);
-    backupIntervalId = null;
-  }
+  _closeOwnerWriteQueueNoDrain();
   writeAuditLog.close();
   if (db) {
-    try { db.pragma('wal_checkpoint(TRUNCATE)'); } catch {} // no-op if not in WAL mode
+    // Standalone bundled skills run in separate processes while the daemon and
+    // other skills may still have this DB open. TRUNCATE can invalidate shared
+    // WAL state for those peers; PASSIVE is the safe close-time checkpoint.
+    try { db.pragma('wal_checkpoint(PASSIVE)'); } catch (e) { /* no-op if not in WAL mode */ }
     db.close();
     db = null;
     currentDbPath = null;
@@ -1455,6 +2140,11 @@ function insertMemory(mem) {
 
   // Strip noise from content at ingestion time (preserves raw in content_raw)
   const cleanContent = _stripNoise ? _stripNoise(mem.content) : mem.content;
+  // Only persist content_raw when it actually differs from the stored content; otherwise
+  // NULL and readers fall back via `content_raw ?? content`. Avoids duplicating the text
+  // for every memory whose raw == content (the common no-noise-stripped case).
+  const _effectiveRaw = mem.content_raw || mem.content;
+  const _rawToStore = _effectiveRaw === cleanContent ? null : _effectiveRaw;
 
   const id = uuidv4();
   getDb().prepare(`
@@ -1463,7 +2153,7 @@ function insertMemory(mem) {
   `).run(
     id, mem.source, mem.source_id || null, mem.source_channel || null,
     mem.memory_type, mem.direction || null, mem.participants || null,
-    mem.subject || null, cleanContent, mem.content_raw || mem.content,
+    mem.subject || null, cleanContent, _rawToStore,
     mem.metadata || null, mem.importance ?? 0.5, mem.timestamp
   );
   logWrite('insert', 'memories', { id, source: mem.source, subject: mem.subject });
@@ -1472,7 +2162,10 @@ function insertMemory(mem) {
 }
 
 function getMemory(id) {
-  return getDb().prepare('SELECT * FROM memories WHERE id = ?').get(id) || null;
+  const row = getDb().prepare('SELECT * FROM memories WHERE id = ?').get(id) || null;
+  // content_raw is NULL when identical to content (dedup); present it as the effective raw.
+  if (row && row.content_raw == null) row.content_raw = row.content;
+  return row;
 }
 
 function listMemories({ source, since, extractionStatus, limit } = {}) {
@@ -1505,34 +2198,129 @@ function listMemories({ source, since, extractionStatus, limit } = {}) {
   return getDb().prepare(sql).all(...params);
 }
 
-function searchMemories({ query, limit, source, memory_type, since, until } = {}) {
-  if (!query || !query.trim()) return [];
-  const terms = query.trim().split(/\s+/).filter(Boolean);
-  const conditions = terms.map(() => "content LIKE ? ESCAPE '\\'");
-  const params = terms.map(t => '%' + t.replace(/[%_\\]/g, '\\$&') + '%');
-  if (source) {
-    conditions.push('source = ?');
-    params.push(source);
-  }
-  if (memory_type) {
-    conditions.push('memory_type = ?');
-    params.push(memory_type);
-  }
-  if (since) {
-    conditions.push('timestamp >= ?');
-    params.push(since);
-  }
-  if (until) {
-    conditions.push('timestamp <= ?');
-    params.push(until);
+// COUNT variant of listMemories. Callers that only need `.length` were pulling every
+// matching row (with content blobs) just to count them — a full materialization on a
+// 350k-row brain. This counts in the DB instead.
+function countMemories({ source, since, extractionStatus } = {}) {
+  const conditions = ['archived_at IS NULL'];
+  const params = [];
+  if (source) { conditions.push('source = ?'); params.push(source); }
+  if (since) { conditions.push('timestamp >= ?'); params.push(since); }
+  if (extractionStatus) { conditions.push('extraction_status = ?'); params.push(extractionStatus); }
+  const sql = 'SELECT count(*) AS c FROM memories WHERE ' + conditions.join(' AND ');
+  return getDb().prepare(sql).get(...params).c;
+}
+
+// Low-signal words dropped from free-text memory queries. The old search ANDed a
+// LIKE for EVERY whitespace token, so a natural-language request ("search history
+// about Eric Gu and write a note that reads like me") required one memory to
+// contain all ~14 words and matched nothing. Proper nouns/keywords carry the
+// signal; stopwords only ever weaken recall.
+const _MEMORY_STOPWORDS = new Set([
+  'a','an','the','and','or','but','to','of','in','on','at','for','with','from','by','as',
+  'is','are','was','were','be','been','being','it','this','that','these','those',
+  'my','me','i','you','your','our','we','us','he','she','they','them','his','her','their',
+  'can','could','would','should','will','shall','may','might','do','does','did','done','have','has','had',
+  'please','help','write','writing','make','made','read','reads','reading','like','about',
+  'search','find','history','note','notes','some','any','so','if','then','just','also',
+  'get','got','want','wants','need','needs','tell','give','show','what','who','whom','when','where','why','how',
+  'up','out','over','into','than','too','very','more','most','here','there','now','today',
+]);
+
+// Tokenize a free-text query into the high-signal terms used for matching. Caller
+// may pass `extraTerms` (e.g. a person's aliases/emails/handles) to broaden recall.
+function _memoryQueryTerms(query, extraTerms) {
+  const raw = String(query || '').toLowerCase().match(/[\p{L}\p{N}][\p{L}\p{N}.@_+-]*/gu) || [];
+  if (Array.isArray(extraTerms)) {
+    for (const t of extraTerms) {
+      const v = String(t || '').toLowerCase().trim();
+      if (v) raw.push(v);
+    }
   }
+  const seen = new Set();
+  const all = [];
+  for (const t of raw) { if (!seen.has(t)) { seen.add(t); all.push(t); } }
+  let signal = all.filter(t => t.length >= 2 && !_MEMORY_STOPWORDS.has(t));
+  if (!signal.length) signal = all;          // query was all stopwords — fall back to using them
+  return signal.slice(0, 12);
+}
+
+// Lexical memory search. Matches a memory if it contains ANY of the high-signal
+// terms (OR), then ranks by how many distinct terms it matched (so all-terms hits
+// rank above any-term hits) and recency. This keeps recall high for multi-word /
+// natural-language queries while preserving precision at the top of the list.
+function searchMemories({ query, limit, source, memory_type, since, until, terms } = {}) {
+  const searchTerms = _memoryQueryTerms(query, terms);
+  if (!searchTerms.length) return [];
+  const likePatterns = searchTerms.map(t => '%' + t.replace(/[%_\\]/g, '\\$&') + '%');
+  const scoreExpr = likePatterns.map(() => "(content LIKE ? ESCAPE '\\')").join(' + ');
+  const orExpr = '(' + likePatterns.map(() => "content LIKE ? ESCAPE '\\'").join(' OR ') + ')';
+  const params = [...likePatterns, ...likePatterns];   // score CASEs first, then WHERE OR
+  const conditions = [orExpr];
+  if (source) { conditions.push('source = ?'); params.push(source); }
+  if (memory_type) { conditions.push('memory_type = ?'); params.push(memory_type); }
+  if (since) { conditions.push('timestamp >= ?'); params.push(since); }
+  if (until) { conditions.push('timestamp <= ?'); params.push(until); }
   const lim = Math.min(Math.max(limit || 50, 1), 200);
   params.push(lim);
   return getDb().prepare(
-    `SELECT * FROM memories WHERE archived_at IS NULL AND ${conditions.join(' AND ')} ORDER BY timestamp DESC LIMIT ?`
+    `SELECT *, (${scoreExpr}) AS match_score FROM memories
+     WHERE archived_at IS NULL AND ${conditions.join(' AND ')}
+     ORDER BY match_score DESC, timestamp DESC LIMIT ?`
   ).all(...params);
 }
 
+// Resolve a person's name to all of their searchable identities — canonical name,
+// aliases, emails, @handles — by consulting the people table and the entity graph.
+// Lets a memory search match messages that reference someone by email/handle even
+// when the brain has no memory containing their full display name.
+// Returns { found, canonical, terms: [...] }.
+function resolvePersonIdentities(name) {
+  const clean = String(name || '').trim();
+  const out = { found: false, canonical: clean, terms: [] };
+  if (!clean) return out;
+  const push = (v) => {
+    const s = String(v == null ? '' : v).trim();
+    if (s && !out.terms.some(t => t.toLowerCase() === s.toLowerCase())) out.terms.push(s);
+  };
+  push(clean);
+  const lower = clean.toLowerCase();
+  const db = getDb();
+  let person = null;
+  try {
+    person = db.prepare('SELECT * FROM people WHERE LOWER(name) = ?').get(lower)
+      || db.prepare('SELECT * FROM people WHERE LOWER(name) LIKE ? LIMIT 1').get('%' + lower.replace(/[%_\\]/g, '\\$&') + '%');
+    if (!person) {
+      const withAliases = db.prepare('SELECT * FROM people WHERE aliases IS NOT NULL').all();
+      person = withAliases.find(p => {
+        try { return (JSON.parse(p.aliases) || []).some(a => String(a).toLowerCase().trim() === lower); }
+        catch { return false; }
+      }) || null;
+    }
+  } catch {}
+  if (person) {
+    out.found = true;
+    out.canonical = person.name || clean;
+    push(person.name);
+    try { (JSON.parse(person.aliases || '[]') || []).forEach(push); } catch {}
+    try {
+      const ids = JSON.parse(person.identities || '[]');
+      if (Array.isArray(ids)) ids.forEach(id => push(typeof id === 'string' ? id : (id && (id.value || id.email || id.handle || id.id))));
+      else if (ids && typeof ids === 'object') Object.values(ids).forEach(push);
+    } catch {}
+  }
+  try {
+    const ent = findEntityFuzzy(clean);
+    if (ent) {
+      out.found = true;
+      if (!person) out.canonical = ent.canonical_name || out.canonical;
+      push(ent.canonical_name);
+      try { (JSON.parse(ent.aliases || '[]') || []).forEach(push); } catch {}
+    }
+  } catch {}
+  return out;
+}
+
 function updateMemoryExtraction(id, status) {
   getDb().prepare('UPDATE memories SET extraction_status = ? WHERE id = ?').run(status, id);
   logWrite('update_extraction', 'memories', { id, source: `status:${status}` });
@@ -1551,18 +2339,44 @@ function touchMemory(id) {
   ).run(id);
 }
 
-function decayImportance() {
+// Batched touch: one UPDATE (one write-lock acquisition) instead of N. Hot paths like
+// search_memories touch every result row; the per-row loop was an N+1 of write-locked
+// statements. Ids are parameterized.
+function touchMemories(ids) {
+  const list = Array.isArray(ids) ? ids.filter(Boolean) : [];
+  if (!list.length) return 0;
+  const placeholders = list.map(() => '?').join(',');
+  const res = getDb().prepare(
+    `UPDATE memories SET last_accessed = datetime('now'), access_count = COALESCE(access_count, 0) + 1 WHERE id IN (${placeholders})`
+  ).run(...list);
+  return res.changes;
+}
+
+function decayImportance({ windowSize = 5000 } = {}) {
   const db = getDb();
   const thirtyDaysAgo = new Date(Date.now() - 30 * 24 * 60 * 60 * 1000).toISOString();
-  const decayed = db.prepare(`
+  // Window by rowid instead of two single UPDATEs over the whole table. On a 350k-row
+  // brain a global UPDATE holds the cross-process write lock for its entire duration,
+  // which makes the OTHER process (CTM) busy-wait on its main thread (the
+  // session-integrity starvation class). Disjoint rowid windows process each row exactly
+  // once (same result) but release the write lock between statements. The decay and boost
+  // predicates are mutually exclusive on last_accessed, so no row is touched twice.
+  const decayStmt = db.prepare(`
     UPDATE memories SET importance = MAX(0.1, importance * 0.95)
-    WHERE (last_accessed IS NULL OR last_accessed < ?) AND importance > 0.1
-  `).run(thirtyDaysAgo);
-  const boosted = db.prepare(`
+    WHERE rowid >= ? AND rowid < ? AND (last_accessed IS NULL OR last_accessed < ?) AND importance > 0.1
+  `);
+  const boostStmt = db.prepare(`
     UPDATE memories SET importance = MIN(1.0, importance * 1.02)
-    WHERE last_accessed IS NOT NULL AND last_accessed >= ? AND importance < 1.0
-  `).run(thirtyDaysAgo);
-  return { decayed: decayed.changes, boosted: boosted.changes };
+    WHERE rowid >= ? AND rowid < ? AND last_accessed IS NOT NULL AND last_accessed >= ? AND importance < 1.0
+  `);
+  const maxRow = db.prepare('SELECT max(rowid) AS m FROM memories').get().m || 0;
+  const step = Math.max(500, Number(windowSize) || 5000);
+  let decayed = 0, boosted = 0;
+  for (let lo = 0; lo <= maxRow; lo += step) {
+    decayed += decayStmt.run(lo, lo + step, thirtyDaysAgo).changes;
+    boosted += boostStmt.run(lo, lo + step, thirtyDaysAgo).changes;
+  }
+  return { decayed, boosted };
 }
 
 // -- Knowledge CRUD --
@@ -1805,54 +2619,80 @@ function deleteSchedulerJobState(job_name) {
 
 // -- Backup --
 
-let backupIntervalId = null;
+function _backupDirForCurrentDb() {
+  const dbDir = path.dirname(currentDbPath || DEFAULT_DB_PATH);
+  if (BACKUP_DIR_SOURCE === 'default' && dbDir !== path.dirname(DEFAULT_DB_PATH)) {
+    return path.join(dbDir, 'backups');
+  }
+  return BACKUP_DIR;
+}
 
-function createBackup(label) {
-  getDb(); // throws if not initialized
-  checkpointWalOrThrow('TRUNCATE');
+function _quickCheckBackupFile(filePath) {
+  return _quickCheckFile(filePath);
+}
 
-  // Use backup dir relative to the current DB, not the module-level constant.
-  // This prevents test runs from writing backups to the production backup dir.
-  const dbDir = path.dirname(currentDbPath);
-  const backupDir = dbDir === path.dirname(DEFAULT_DB_PATH) ? BACKUP_DIR : path.join(dbDir, 'backups');
+async function createBackup(label) {
+  getDb(); // throws if not initialized
+  const backupDir = _backupDirForCurrentDb();
 
   const timestamp = new Date().toISOString().replace(/:/g, '-');
-  const backupName = `wall-e-brain-${timestamp}-${label}.db`;
+  const safeLabel = String(label || 'manual').replace(/[^a-z0-9_.-]+/gi, '-').replace(/^-+|-+$/g, '') || 'manual';
+  const backupName = `wall-e-brain-${timestamp}-${safeLabel}.db`;
   const backupPath = path.join(backupDir, backupName);
+  const tmpPath = path.join(backupDir, `.${backupName}.${process.pid}.tmp`);
 
   if (!fs.existsSync(backupDir)) fs.mkdirSync(backupDir, { recursive: true });
-  fs.copyFileSync(currentDbPath, backupPath);
+  fs.rmSync(tmpPath, { force: true });
+  try {
+    // Online incremental backup. better-sqlite3's db.backup() copies the database in
+    // page batches and YIELDS to the event loop between them (default 100 pages/batch),
+    // so a multi-GB brain never freezes the loop — unlike the old synchronous
+    // `VACUUM INTO`, which blocked for 30-120s. Like VACUUM INTO it reads a consistent
+    // snapshot via a read transaction and does not force a WAL checkpoint that would
+    // perturb peer processes; SQLite transparently re-copies any pages a peer writes
+    // mid-backup. The quick_check below validates the produced image before we keep it.
+    await getDb().backup(tmpPath);
+    const check = _quickCheckBackupFile(tmpPath);
+    if (!check.ok) {
+      throw new Error(`backup quick_check failed: ${check.error}`);
+    }
+    fs.renameSync(tmpPath, backupPath);
+  } catch (err) {
+    try { fs.rmSync(tmpPath, { force: true }); } catch {}
+    throw err;
+  }
 
-  cleanOldBackups();
+  cleanOldBackups(backupDir);
 
   return { backupName, backupPath, timestamp };
 }
 
 function listBackups() {
-  if (!fs.existsSync(BACKUP_DIR)) return [];
-  return fs.readdirSync(BACKUP_DIR)
+  const backupDir = _backupDirForCurrentDb();
+  if (!fs.existsSync(backupDir)) return [];
+  return fs.readdirSync(backupDir)
     .filter(f => f.startsWith('wall-e-brain-') && f.endsWith('.db'))
     .sort().reverse()
     .map(f => {
-      const stat = fs.statSync(path.join(BACKUP_DIR, f));
-      return { name: f, path: path.join(BACKUP_DIR, f), size: stat.size, createdAt: stat.mtime.toISOString() };
+      const stat = fs.statSync(path.join(backupDir, f));
+      return { name: f, path: path.join(backupDir, f), size: stat.size, createdAt: stat.mtime.toISOString() };
     });
 }
 
 function deleteBackup(backupName) {
-  const p = path.join(BACKUP_DIR, path.basename(backupName));
+  const p = path.join(_backupDirForCurrentDb(), path.basename(backupName));
   if (fs.existsSync(p)) fs.unlinkSync(p);
 }
 
-function cleanOldBackups() {
-  if (!fs.existsSync(BACKUP_DIR)) return;
-  const files = fs.readdirSync(BACKUP_DIR);
+function cleanOldBackups(backupDir = BACKUP_DIR) {
+  if (!fs.existsSync(backupDir)) return;
+  const files = fs.readdirSync(backupDir);
   const cutoff = Date.now() - 7 * 24 * 60 * 60 * 1000;
 
   // Always keep at least 3
   const brainFiles = files.filter(f => f.startsWith('wall-e-brain-') && f.endsWith('.db')).sort().reverse();
   for (const file of brainFiles.slice(3)) {
-    const filePath = path.join(BACKUP_DIR, file);
+    const filePath = path.join(backupDir, file);
     const stat = fs.statSync(filePath);
     if (stat.mtimeMs < cutoff) {
       fs.unlinkSync(filePath);
@@ -1860,37 +2700,24 @@ function cleanOldBackups() {
   }
 }
 
-function startDailyBackup() {
-  // Check if backup exists for today
+// Ensure a daily backup exists for today. Idempotent — skips if today's daily backup
+// is already present. This is registered as a SCHEDULER job (see agent.js), NOT coupled
+// to process boot or a hand-rolled hourly poll: the scheduler owns "run once a day +
+// replay if a day was missed during downtime" (persistJobState), and runs it well after
+// startup so the backup never blocks port bind / MCP readiness. Returns
+// { created: boolean, backupName?, backupPath?, timestamp? }.
+async function ensureDailyBackup() {
   const today = new Date().toISOString().slice(0, 10);
-  let needsBackup = true;
-
-  if (fs.existsSync(BACKUP_DIR)) {
-    const files = fs.readdirSync(BACKUP_DIR);
+  const backupDir = _backupDirForCurrentDb();
+  if (fs.existsSync(backupDir)) {
+    const files = fs.readdirSync(backupDir);
     const todayPrefix = `wall-e-brain-${today}`;
-    needsBackup = !files.some(f => f.startsWith(todayPrefix) && f.endsWith('-daily.db'));
-  }
-
-  if (needsBackup) {
-    try { createBackup('daily'); } catch (_) {}
-  }
-
-  // Check hourly
-  backupIntervalId = setInterval(() => {
-    const todayNow = new Date().toISOString().slice(0, 10);
-    let exists = false;
-    if (fs.existsSync(BACKUP_DIR)) {
-      const files = fs.readdirSync(BACKUP_DIR);
-      const prefix = `wall-e-brain-${todayNow}`;
-      exists = files.some(f => f.startsWith(prefix) && f.endsWith('-daily.db'));
-    }
-    if (!exists) {
-      try { createBackup('daily'); } catch (_) {}
+    if (files.some(f => f.startsWith(todayPrefix) && f.endsWith('-daily.db'))) {
+      return { created: false };
     }
-  }, 60 * 60 * 1000);
-
-  // Don't keep process alive just for backups
-  if (backupIntervalId.unref) backupIntervalId.unref();
+  }
+  const result = await createBackup('daily');
+  return { created: true, ...result };
 }
 
 // -- People CRUD --
@@ -1973,29 +2800,37 @@ function findEntityFuzzy(name, maxDistance = 2) {
   const lower = name.toLowerCase().trim();
   const exact = findEntity(name);
   if (exact) return exact;
-  // Check aliases (exact match)
-  const all = getDb().prepare('SELECT * FROM entities WHERE aliases IS NOT NULL').all();
-  for (const e of all) {
+  // Check aliases (exact match). Only the alias column is needed for the scan; pull the
+  // full row lazily once we've found the match.
+  const aliasRows = getDb().prepare('SELECT id, aliases FROM entities WHERE aliases IS NOT NULL').all();
+  for (const e of aliasRows) {
     try {
       const aliases = JSON.parse(e.aliases);
-      if (Array.isArray(aliases) && aliases.some(a => a.toLowerCase().trim() === lower)) return e;
+      if (Array.isArray(aliases) && aliases.some(a => a.toLowerCase().trim() === lower)) {
+        return getDb().prepare('SELECT * FROM entities WHERE id = ?').get(e.id);
+      }
     } catch {}
   }
   // LIKE prefix match
   const likeMatch = getDb().prepare('SELECT * FROM entities WHERE LOWER(canonical_name) LIKE ? LIMIT 1').get(`%${lower}%`);
   if (likeMatch) return likeMatch;
-  // Levenshtein fuzzy match (catches typos like "Jhon" → "John")
+  // Levenshtein fuzzy match (catches typos like "Jhon" → "John"). Select only id +
+  // canonical_name (not SELECT *), and skip any name whose length differs by more than
+  // maxDistance — it can't possibly be within edit distance, so we avoid the O(n*m) DP
+  // for the vast majority of rows.
   if (lower.length >= 3) {
-    const allEntities = getDb().prepare('SELECT * FROM entities').all();
-    let bestMatch = null, bestDist = maxDistance + 1;
-    for (const e of allEntities) {
-      const dist = _editDistance(lower, e.canonical_name.toLowerCase().trim());
+    const candidates = getDb().prepare('SELECT id, canonical_name FROM entities').all();
+    let bestId = null, bestDist = maxDistance + 1;
+    for (const e of candidates) {
+      const cn = (e.canonical_name || '').toLowerCase().trim();
+      if (Math.abs(cn.length - lower.length) > maxDistance) continue;
+      const dist = _editDistance(lower, cn);
       if (dist > 0 && dist <= maxDistance && dist < bestDist) {
-        bestMatch = e;
+        bestId = e.id;
         bestDist = dist;
       }
     }
-    if (bestMatch) return bestMatch;
+    if (bestId) return getDb().prepare('SELECT * FROM entities WHERE id = ?').get(bestId);
   }
   return null;
 }
@@ -2146,6 +2981,17 @@ function listQuestions({ status, question_type, limit } = {}) {
   return getDb().prepare(sql).all(...params);
 }
 
+// COUNT variant of listQuestions — avoids materializing every pending row just to count.
+function countQuestions({ status, question_type } = {}) {
+  const conditions = [];
+  const params = [];
+  if (status) { conditions.push('status = ?'); params.push(status); }
+  if (question_type) { conditions.push('question_type = ?'); params.push(question_type); }
+  let sql = 'SELECT count(*) AS c FROM pending_questions';
+  if (conditions.length) sql += ' WHERE ' + conditions.join(' AND ');
+  return getDb().prepare(sql).get(...params).c;
+}
+
 function answerQuestion(id, { answer, resolution_type, resolution_evidence }) {
   if (!answer) throw new Error('Answer is required');
   if (!resolution_type) throw new Error('Resolution type is required');
@@ -2167,6 +3013,30 @@ function answerQuestion(id, { answer, resolution_type, resolution_evidence }) {
   if (result.changes === 0) throw new Error(`Question not found: ${id}`);
 }
 
+// Questions worth surfacing in the daily digest: still pending and not yet delivered,
+// highest priority first (high → normal → low), then oldest-first so nothing waits forever.
+function listUndeliveredDigestQuestions({ max = 10 } = {}) {
+  const cap = Math.max(1, Math.min(50, Number(max) || 10));
+  return getDb().prepare(`
+    SELECT * FROM pending_questions
+     WHERE status = 'pending' AND (digest_delivered_at IS NULL OR digest_delivered_at = '')
+     ORDER BY CASE priority WHEN 'high' THEN 0 WHEN 'normal' THEN 1 ELSE 2 END, created_at ASC
+     LIMIT ?
+  `).all(cap);
+}
+
+// Mark questions as delivered in a digest (so they aren't re-asked daily). Call only after
+// the digest was successfully sent.
+function markQuestionsDelivered(ids) {
+  if (!Array.isArray(ids) || ids.length === 0) return 0;
+  const now = new Date().toISOString();
+  const stmt = getDb().prepare('UPDATE pending_questions SET digest_delivered_at = ? WHERE id = ?');
+  let n = 0;
+  const txn = getDb().transaction(() => { for (const id of ids) n += stmt.run(now, id).changes; });
+  txn();
+  return n;
+}
+
 // -- Knowledge updates --
 
 function supersedeKnowledge(oldId, newId) {
@@ -2398,15 +3268,21 @@ function listExchanges({ limit } = {}) {
 
 // ── Chat Messages ──
 
-function insertChatMessage({ role, content, channel, session_id, id, attachments }) {
+function insertChatMessage({ role, content, channel, session_id, id, attachments, model_id, model_provider }) {
   const messageId = id || uuidv4();
   const attachmentsJson = attachments
     ? (typeof attachments === 'string' ? attachments : JSON.stringify(attachments))
     : null;
+  // model_id / model_provider record which model produced an assistant turn so the
+  // conversation log / token badge can attribute it. Columns exist (migrations 84-85)
+  // but were never written; null-coalesced so user/system rows stay NULL.
   getDb().prepare(`
-    INSERT INTO chat_messages (id, role, content, channel, session_id, attachments, created_at)
-    VALUES (?, ?, ?, ?, ?, ?, datetime('now'))
-  `).run(messageId, role, content, channel || 'ctm', session_id || null, attachmentsJson);
+    INSERT INTO chat_messages (id, role, content, channel, session_id, attachments, model_id, model_provider, created_at)
+    VALUES (?, ?, ?, ?, ?, ?, ?, ?, datetime('now'))
+  `).run(
+    messageId, role, content, channel || 'ctm', session_id || null, attachmentsJson,
+    model_id || null, model_provider || null,
+  );
   return { id: messageId };
 }
 
@@ -2458,24 +3334,29 @@ function clearChatSession(session_id) {
 
 // ── Chat Branches (ChatGPT-style edit/resend) ──
 
-function saveChatBranches(session_id, branches, active, history) {
+function saveChatBranches(session_id, branches, active, history, updated_at_ms) {
+  const updatedAtMs = Number.isFinite(Number(updated_at_ms)) && Number(updated_at_ms) > 0
+    ? Math.floor(Number(updated_at_ms))
+    : Date.now();
   getDb().prepare(`
-    INSERT INTO chat_branches (session_id, branches, active, history)
-    VALUES (?, ?, ?, ?)
-    ON CONFLICT(session_id) DO UPDATE SET branches = excluded.branches, active = excluded.active, history = excluded.history
-  `).run(session_id, JSON.stringify(branches), JSON.stringify(active), JSON.stringify(history || []));
+    INSERT INTO chat_branches (session_id, branches, active, history, updated_at_ms)
+    VALUES (?, ?, ?, ?, ?)
+    ON CONFLICT(session_id) DO UPDATE SET branches = excluded.branches, active = excluded.active, history = excluded.history, updated_at_ms = excluded.updated_at_ms
+  `).run(session_id, JSON.stringify(branches), JSON.stringify(active), JSON.stringify(history || []), updatedAtMs);
 }
 
 function loadChatBranches(session_id) {
-  const row = getDb().prepare('SELECT branches, active, history FROM chat_branches WHERE session_id = ?').get(session_id);
-  if (!row) return { branches: {}, active: {}, history: [] };
+  const row = getDb().prepare('SELECT branches, active, history, updated_at_ms FROM chat_branches WHERE session_id = ?').get(session_id);
+  if (!row) return { branches: {}, active: {}, history: [], exists: false };
   try {
     return {
       branches: JSON.parse(row.branches),
       active: JSON.parse(row.active),
       history: JSON.parse(row.history || '[]'),
+      updated_at_ms: Number(row.updated_at_ms || 0) || 0,
+      exists: true,
     };
-  } catch (e) { return { branches: {}, active: {}, history: [] }; }
+  } catch (e) { return { branches: {}, active: {}, history: [], exists: true }; }
 }
 
 // -- Skills CRUD --
@@ -3055,6 +3936,86 @@ function pruneChannelMessageEvents(ttlMs = 7 * 24 * 60 * 60 * 1000) {
   return getDb().prepare('DELETE FROM channel_message_events WHERE updated_at < ?').run(cutoff).changes;
 }
 
+// -- Brain retention (write-volume audit, 2026-05-31) --
+//
+// Age-based pruning for tables that grew unbounded (see
+// docs/superpowers/specs/2026-05-31-question-digest-and-brain-retention-design.md).
+// DELETEs are BATCHED via a bounded `rowid IN (SELECT ... LIMIT ?)` sub-select so each
+// statement holds the cross-process write lock only briefly (a single unbounded DELETE
+// over a huge table can hold it for seconds — see the CTM approval_observations fix). The
+// table/column/where fragments are internal constants, never user input.
+const _RETENTION_BATCH = Math.max(50, Math.min(5000, Number(process.env.WALL_E_RETENTION_BATCH) || 500));
+function _pruneRowsByAge(table, cutoffIso, { batchSize = _RETENTION_BATCH, column = 'created_at', where = '' } = {}) {
+  if (!db) return 0;
+  const batch = Math.max(50, Math.min(5000, Number(batchSize) || _RETENTION_BATCH));
+  const extra = where ? ` AND ${where}` : '';
+  const stmt = getDb().prepare(
+    `DELETE FROM ${table} WHERE rowid IN (
+       SELECT rowid FROM ${table} WHERE ${column} < ?${extra} ORDER BY rowid LIMIT ?
+     )`
+  );
+  let deleted = 0;
+  for (let i = 0; i < 5000; i += 1) { // backstop against a runaway loop
+    const res = stmt.run(cutoffIso, batch);
+    deleted += res.changes || 0;
+    if (!res.changes || res.changes < batch) break;
+  }
+  return deleted;
+}
+
+function _ageCutoffIso(days, fallbackDays) {
+  const d = Math.max(1, Number(days) || fallbackDays);
+  return new Date(Date.now() - d * 24 * 60 * 60 * 1000).toISOString();
+}
+
+// Stale unanswered questions. With the generator fixed (contradictions auto-supersede),
+// only genuine questions persist; a still-`pending` question older than the window has
+// gone stale (the daily digest gave it ~30 chances). Resolved rows (answered/dismissed/
+// inferred) are kept for audit — they're few. Deleting reclaims space from the historical
+// 125k-row contradiction backlog.
+function pruneStalePendingQuestions({ retentionDays = 30, batchSize } = {}) {
+  return { deleted: _pruneRowsByAge('pending_questions', _ageCutoffIso(retentionDays, 30), { batchSize, where: "status = 'pending'" }) };
+}
+
+function pruneActivityLog({ retentionDays = 30, batchSize } = {}) {
+  return { deleted: _pruneRowsByAge('activity_log', _ageCutoffIso(retentionDays, 30), { batchSize }) };
+}
+
+function pruneSkillExecutions({ retentionDays = 30, batchSize } = {}) {
+  return { deleted: _pruneRowsByAge('skill_executions', _ageCutoffIso(retentionDays, 30), { batchSize }) };
+}
+
+function pruneInitiativeLog({ retentionDays = 90, batchSize } = {}) {
+  return { deleted: _pruneRowsByAge('initiative_log', _ageCutoffIso(retentionDays, 90), { batchSize }) };
+}
+
+// Hard-delete a memory and everything keyed to it: its memory_index row(s) and its
+// embeddings (embedding_map + vec entries). Skills that re-sync external data
+// (gws-workspace, claude-code-reader, google-calendar) used to `DELETE FROM memories
+// WHERE id = ?` directly, which orphaned the embedding (the audited 47,649) and the
+// memory_index row. Route those deletes here so nothing leaks. memory_index has no FK to
+// memories so it must be cleaned explicitly.
+function deleteMemory(id) {
+  if (!id) return 0;
+  const d = getDb();
+  const changes = d.prepare('DELETE FROM memories WHERE id = ?').run(id).changes;
+  try { d.prepare('DELETE FROM memory_index WHERE memory_id = ?').run(id); } catch {}
+  try { require('./embeddings').deleteEmbeddingsForEntity(id); } catch {}
+  return changes;
+}
+
+// One pass over all age-based retention. Returns per-table deleted counts. Env-tunable TTLs.
+function runBrainRetention(opts = {}) {
+  const ttl = (name, dflt) => _sqlitePositiveInt(name, dflt);
+  const out = {};
+  try { out.pending_questions = pruneStalePendingQuestions({ retentionDays: ttl('WALL_E_RETAIN_QUESTIONS_DAYS', 30), ...opts }).deleted; } catch (e) { out.pending_questions = `err:${e.message}`; }
+  try { out.activity_log = pruneActivityLog({ retentionDays: ttl('WALL_E_RETAIN_ACTIVITY_DAYS', 30), ...opts }).deleted; } catch (e) { out.activity_log = `err:${e.message}`; }
+  try { out.skill_executions = pruneSkillExecutions({ retentionDays: ttl('WALL_E_RETAIN_SKILL_EXEC_DAYS', 30), ...opts }).deleted; } catch (e) { out.skill_executions = `err:${e.message}`; }
+  try { out.initiative_log = pruneInitiativeLog({ retentionDays: ttl('WALL_E_RETAIN_INITIATIVE_DAYS', 90), ...opts }).deleted; } catch (e) { out.initiative_log = `err:${e.message}`; }
+  try { out.orphan_embeddings = require('./embeddings').pruneOrphanEmbeddings({ batchSize: opts.batchSize }).deleted; } catch (e) { out.orphan_embeddings = `err:${e.message}`; }
+  return out;
+}
+
 // -- Slack Inbound Event Ledger --
 
 function slackInboundEventId(channelId, messageTs) {
@@ -3104,6 +4065,90 @@ function pruneSlackInboundEvents(ttlMs = 48 * 60 * 60 * 1000) {
 
 // -- Model Provider CRUD --
 
+const VALID_PROVIDER_ROUTE_POLICIES = new Set(['auto', 'direct', 'portkey']);
+
+function _modelProviderRoutePolicyKey(type) {
+  return `model_provider_route_policy:${String(type || '').trim().toLowerCase()}`;
+}
+
+function _modelProviderConnectionKind(row = {}) {
+  if (row.auth_method && row.auth_method !== 'api_key') return row.auth_method;
+  return isPortkeyProviderConfig({
+    baseUrl: row.base_url || row.baseUrl,
+    customHeaders: row.custom_headers || row.customHeaders,
+  }) ? 'portkey' : 'direct';
+}
+
+function _modelProviderHasCredential(row = {}) {
+  const type = row.type || row.provider_type;
+  if (!row) return false;
+  if (type === 'ollama' || type === 'mlx') return true;
+  if (row.auth_method && row.auth_method !== 'api_key') return true;
+  if (row.api_key_encrypted) return true;
+  if (type === 'anthropic' && process.env.ANTHROPIC_API_KEY) return true;
+  if (type === 'openai' && process.env.OPENAI_API_KEY) return true;
+  if (type === 'google' && (process.env.GOOGLE_API_KEY || process.env.GEMINI_API_KEY)) return true;
+  if (type === 'deepseek' && process.env.DEEPSEEK_API_KEY) return true;
+  if (type === 'moonshot' && process.env.MOONSHOT_API_KEY) return true;
+  return false;
+}
+
+function _modelProviderRouteRank(row = {}, policy = 'auto') {
+  const kind = _modelProviderConnectionKind(row);
+  const isPortkey = kind === 'portkey';
+  const hasCredential = _modelProviderHasCredential(row);
+  let policyRank = 50;
+  if (policy === 'portkey') policyRank = isPortkey ? 0 : 10;
+  else if (policy === 'direct') policyRank = isPortkey ? 10 : 0;
+  else policyRank = isPortkey ? 10 : 0;
+  const credentialRank = hasCredential ? 0 : 20;
+  const defaultRank = /-(default|auto)$/.test(String(row.id || '')) ? 0 : 2;
+  return policyRank + credentialRank + defaultRank;
+}
+
+function sortModelProvidersByRoutePolicy(rows = [], policy = 'auto') {
+  const normalizedPolicy = VALID_PROVIDER_ROUTE_POLICIES.has(policy) ? policy : 'auto';
+  return [...(rows || [])].sort((a, b) => {
+    const ar = _modelProviderRouteRank(a, normalizedPolicy);
+    const br = _modelProviderRouteRank(b, normalizedPolicy);
+    if (ar !== br) return ar - br;
+    const au = Date.parse(a.updated_at || '') || 0;
+    const bu = Date.parse(b.updated_at || '') || 0;
+    if (bu !== au) return bu - au;
+    return String(a.name || a.id || '').localeCompare(String(b.name || b.id || ''));
+  });
+}
+
+function setProviderRoutePolicy({ type, policy }) {
+  const providerType = String(type || '').trim().toLowerCase();
+  const routePolicy = String(policy || 'auto').trim().toLowerCase();
+  if (!providerType) throw new Error('Provider type required');
+  if (!VALID_PROVIDER_ROUTE_POLICIES.has(routePolicy)) {
+    throw new Error(`Invalid provider route policy: ${routePolicy}`);
+  }
+  setKv(_modelProviderRoutePolicyKey(providerType), routePolicy);
+  return { type: providerType, policy: routePolicy };
+}
+
+function getProviderRoutePolicy(type) {
+  const providerType = String(type || '').trim().toLowerCase();
+  if (!providerType) return 'auto';
+  const policy = getKv(_modelProviderRoutePolicyKey(providerType));
+  return VALID_PROVIDER_ROUTE_POLICIES.has(policy) ? policy : 'auto';
+}
+
+function getPreferredModelProviderForType(type) {
+  const providerType = String(type || '').trim().toLowerCase();
+  if (!providerType) return null;
+  const rows = getDb().prepare(`
+    SELECT *
+    FROM model_providers
+    WHERE type = ? AND enabled = 1
+  `).all(providerType);
+  if (!rows.length) return null;
+  return sortModelProvidersByRoutePolicy(rows, getProviderRoutePolicy(providerType))[0] || null;
+}
+
 function upsertModelProvider({ id, name, type, baseUrl, apiKeyEncrypted, customHeaders, enabled }) {
   if (!id || !name || !type) throw new Error('Provider requires id, name, type');
   getDb().prepare(`
@@ -3187,6 +4232,8 @@ function saveSetupProvider({
   setDefault = false,
   authMethod,
   preserveExistingKey = true,
+  preserveExistingBaseUrl = true,
+  preserveExistingCustomHeaders = true,
   registerModel = true,
 }) {
   if (!type) throw new Error('Provider type required');
@@ -3199,9 +4246,9 @@ function saveSetupProvider({
   return runImmediateTransaction(db, () => {
     const currentDefaultProvider = getKv('walle_provider') || process.env.WALLE_PROVIDER || 'anthropic';
     const syncDefaultModel = !!(model && currentDefaultProvider === type && !setDefault);
+    const existingProvider = getModelProviderWithKey(providerId);
     let storedKey = apiKeyEncrypted || null;
     if (!storedKey && preserveExistingKey) {
-      const existingProvider = getModelProviderWithKey(providerId);
       storedKey = existingProvider?.api_key_encrypted || null;
       if (!storedKey) {
         const row = db.prepare(
@@ -3210,14 +4257,34 @@ function saveSetupProvider({
         storedKey = row?.api_key_encrypted || null;
       }
     }
+    let storedBaseUrl = baseUrl;
+    if (storedBaseUrl === undefined && preserveExistingBaseUrl) {
+      storedBaseUrl = existingProvider?.base_url;
+      if (!storedBaseUrl) {
+        const row = db.prepare(
+          'SELECT base_url FROM model_providers WHERE type = ? AND enabled = 1 AND base_url IS NOT NULL ORDER BY updated_at DESC LIMIT 1'
+        ).get(type);
+        storedBaseUrl = row?.base_url;
+      }
+    }
+    let storedCustomHeaders = customHeaders;
+    if (storedCustomHeaders === undefined && preserveExistingCustomHeaders) {
+      storedCustomHeaders = existingProvider?.custom_headers;
+      if (!storedCustomHeaders) {
+        const row = db.prepare(
+          'SELECT custom_headers FROM model_providers WHERE type = ? AND enabled = 1 AND custom_headers IS NOT NULL ORDER BY updated_at DESC LIMIT 1'
+        ).get(type);
+        storedCustomHeaders = row?.custom_headers;
+      }
+    }
 
     upsertModelProvider({
       id: providerId,
       name: displayName,
       type,
-      baseUrl: baseUrl || null,
+      baseUrl: storedBaseUrl || null,
       apiKeyEncrypted: storedKey,
-      customHeaders: customHeaders || null,
+      customHeaders: storedCustomHeaders || null,
       enabled,
     });
     if (authMethod) setProviderAuthMethod(type, authMethod);
@@ -3294,14 +4361,31 @@ function disableModelProviderByType(type) {
 
 // -- Model Registry CRUD --
 
-function upsertModelRegistryEntry({ id, providerId, modelId, displayName, capabilities, costPer1mInput, costPer1mOutput, maxContextTokens, maxOutputTokens, speedTier, enabled, isFineTuned }) {
+function upsertModelRegistryEntry({
+  id,
+  providerId,
+  modelId,
+  displayName,
+  capabilities,
+  costPer1mInput,
+  costPer1mOutput,
+  maxContextTokens,
+  maxOutputTokens,
+  speedTier,
+  enabled,
+  isFineTuned,
+  source,
+  verificationStatus,
+  lastSeenAt,
+  gatewayType,
+}) {
   if (!id || !providerId || !modelId || !displayName) throw new Error('Registry entry requires id, providerId, modelId, displayName');
   const caps = (Array.isArray(capabilities) || (capabilities && typeof capabilities === 'object'))
     ? JSON.stringify(capabilities)
     : (capabilities || '[]');
   getDb().prepare(`
-    INSERT INTO model_registry (id, provider_id, model_id, display_name, capabilities, cost_per_1m_input, cost_per_1m_output, max_context_tokens, max_output_tokens, speed_tier, enabled, is_fine_tuned)
-    VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
+    INSERT INTO model_registry (id, provider_id, model_id, display_name, capabilities, cost_per_1m_input, cost_per_1m_output, max_context_tokens, max_output_tokens, speed_tier, enabled, is_fine_tuned, source, verification_status, last_seen_at, gateway_type)
+    VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
     ON CONFLICT(id) DO UPDATE SET
       provider_id = excluded.provider_id,
       model_id = excluded.model_id,
@@ -3313,8 +4397,29 @@ function upsertModelRegistryEntry({ id, providerId, modelId, displayName, capabi
       max_output_tokens = excluded.max_output_tokens,
       speed_tier = excluded.speed_tier,
       enabled = excluded.enabled,
-      is_fine_tuned = excluded.is_fine_tuned
-  `).run(id, providerId, modelId, displayName, caps, costPer1mInput || null, costPer1mOutput || null, maxContextTokens || null, maxOutputTokens || null, speedTier || 3, enabled !== undefined ? (enabled ? 1 : 0) : 1, isFineTuned ? 1 : 0);
+      is_fine_tuned = excluded.is_fine_tuned,
+      source = COALESCE(excluded.source, model_registry.source, 'catalog'),
+      verification_status = COALESCE(excluded.verification_status, model_registry.verification_status, 'verified'),
+      last_seen_at = COALESCE(excluded.last_seen_at, model_registry.last_seen_at),
+      gateway_type = COALESCE(excluded.gateway_type, model_registry.gateway_type)
+  `).run(
+    id,
+    providerId,
+    modelId,
+    displayName,
+    caps,
+    costPer1mInput || null,
+    costPer1mOutput || null,
+    maxContextTokens || null,
+    maxOutputTokens || null,
+    speedTier || 3,
+    enabled !== undefined ? (enabled ? 1 : 0) : 1,
+    isFineTuned ? 1 : 0,
+    source || null,
+    verificationStatus || null,
+    lastSeenAt || null,
+    gatewayType || null,
+  );
 }
 
 function getModelRegistryEntry(id) {
@@ -3335,6 +4440,15 @@ function listModelsByProvider(providerId) {
   return rows;
 }
 
+function listModelCountsByProvider() {
+  return getDb().prepare(`
+    SELECT provider_id, COUNT(*) AS model_count
+    FROM model_registry
+    WHERE enabled = 1
+    GROUP BY provider_id
+  `).all();
+}
+
 function listAllModels() {
   const rows = getDb().prepare(`
     SELECT mr.*, mp.name AS provider_name, mp.type AS provider_type
@@ -3350,6 +4464,328 @@ function listAllModels() {
   return rows;
 }
 
+// -- Model Usage Ledger --
+
+function _finiteNumberOrNull(value) {
+  if (value == null || value === '') return null;
+  const n = Number(value);
+  return Number.isFinite(n) ? n : null;
+}
+
+function _nonNegativeInteger(value) {
+  const n = Number(value);
+  if (!Number.isFinite(n) || n <= 0) return 0;
+  return Math.max(0, Math.round(n));
+}
+
+function _ledgerMetadata(value) {
+  if (value == null) return null;
+  if (typeof value === 'string') return value;
+  try { return JSON.stringify(value); } catch { return String(value); }
+}
+
+function _parseLedgerMetadata(row) {
+  if (!row || !row.metadata) return row;
+  try { row.metadata = JSON.parse(row.metadata); } catch {}
+  return row;
+}
+
+function _normalizeUsageTokens({ usage, inputTokens, outputTokens, cachedInputTokens, reasoningOutputTokens }) {
+  const raw = usage && typeof usage === 'object' ? usage : {};
+  const input = _nonNegativeInteger(inputTokens ?? raw.input ?? raw.input_tokens ?? raw.prompt_tokens);
+  const output = _nonNegativeInteger(outputTokens ?? raw.output ?? raw.output_tokens ?? raw.completion_tokens);
+  const cached = _nonNegativeInteger(
+    cachedInputTokens
+      ?? raw.cached_input
+      ?? raw.cachedInput
+      ?? raw.cached_input_tokens
+      ?? raw.prompt_tokens_details?.cached_tokens
+  );
+  const reasoning = _nonNegativeInteger(
+    reasoningOutputTokens
+      ?? raw.reasoning_output
+      ?? raw.reasoningOutput
+      ?? raw.reasoning_output_tokens
+      ?? raw.completion_tokens_details?.reasoning_tokens
+  );
+  return {
+    inputTokens: input,
+    outputTokens: output,
+    totalTokens: _nonNegativeInteger(raw.total ?? raw.total_tokens) || input + output,
+    cachedInputTokens: cached,
+    reasoningOutputTokens: reasoning,
+  };
+}
+
+function findModelRegistryForUsage({ providerType, providerId, modelId, modelRegistryId } = {}) {
+  const db = getDb();
+  const registryKey = String(modelRegistryId || '').trim();
+  if (registryKey) {
+    const row = db.prepare(`
+      SELECT mr.*, mp.name AS provider_name, mp.type AS provider_type
+      FROM model_registry mr
+      LEFT JOIN model_providers mp ON mr.provider_id = mp.id
+      WHERE mr.id = ?
+      LIMIT 1
+    `).get(registryKey);
+    if (row) return row;
+  }
+
+  const model = String(modelId || '').trim();
+  if (!model) return null;
+  const modelLower = model.toLowerCase();
+  const typeLower = String(providerType || '').trim().toLowerCase();
+  const providerKey = String(providerId || '').trim();
+  const where = ['(lower(mr.model_id) = ? OR lower(mr.id) = ?)'];
+  const params = [modelLower, modelLower];
+  if (providerKey) {
+    where.push('mr.provider_id = ?');
+    params.push(providerKey);
+  } else if (typeLower) {
+    where.push('lower(mp.type) = ?');
+    params.push(typeLower);
+  }
+  const row = db.prepare(`
+    SELECT mr.*, mp.name AS provider_name, mp.type AS provider_type
+    FROM model_registry mr
+    LEFT JOIN model_providers mp ON mr.provider_id = mp.id
+    WHERE ${where.join(' AND ')}
+    ORDER BY
+      mr.enabled DESC,
+      CASE WHEN mr.cost_per_1m_input IS NOT NULL AND mr.cost_per_1m_output IS NOT NULL THEN 0 ELSE 1 END,
+      datetime(COALESCE(mr.last_seen_at, '1970-01-01')) DESC,
+      mr.id ASC
+    LIMIT 1
+  `).get(...params);
+  if (row) return row;
+
+  // Last resort for legacy rows that recorded only the executable model id.
+  return db.prepare(`
+    SELECT mr.*, mp.name AS provider_name, mp.type AS provider_type
+    FROM model_registry mr
+    LEFT JOIN model_providers mp ON mr.provider_id = mp.id
+    WHERE lower(mr.model_id) = ? OR lower(mr.id) = ?
+    ORDER BY
+      CASE WHEN ? != '' AND lower(mp.type) = ? THEN 0 ELSE 1 END,
+      mr.enabled DESC,
+      CASE WHEN mr.cost_per_1m_input IS NOT NULL AND mr.cost_per_1m_output IS NOT NULL THEN 0 ELSE 1 END,
+      datetime(COALESCE(mr.last_seen_at, '1970-01-01')) DESC,
+      mr.id ASC
+    LIMIT 1
+  `).get(modelLower, modelLower, typeLower, typeLower) || null;
+}
+
+function estimateModelUsageCost({ providerType, providerId, modelId, modelRegistryId, inputTokens, outputTokens } = {}) {
+  const registry = findModelRegistryForUsage({ providerType, providerId, modelId, modelRegistryId });
+  if (!registry) {
+    return {
+      costUsd: null,
+      costSource: modelId || modelRegistryId ? 'missing_model_registry' : 'missing_model',
+      modelRegistryId: modelRegistryId || null,
+      providerId: providerId || null,
+      providerType: providerType || null,
+      gatewayType: null,
+    };
+  }
+  const inputPrice = _finiteNumberOrNull(registry.cost_per_1m_input);
+  const outputPrice = _finiteNumberOrNull(registry.cost_per_1m_output);
+  const result = {
+    costUsd: null,
+    costSource: 'missing_price',
+    modelRegistryId: registry.id,
+    providerId: registry.provider_id || providerId || null,
+    providerType: registry.provider_type || providerType || null,
+    gatewayType: registry.gateway_type || null,
+  };
+  if (inputPrice == null || outputPrice == null) return result;
+  result.costUsd = ((_nonNegativeInteger(inputTokens) * inputPrice) + (_nonNegativeInteger(outputTokens) * outputPrice)) / 1_000_000;
+  result.costSource = 'model_registry';
+  return result;
+}
+
+function recordModelUsage({
+  id,
+  occurredAt,
+  source = 'wall-e.chat',
+  feature,
+  sessionId,
+  branchId,
+  messageId,
+  requestId,
+  providerType,
+  providerId,
+  modelId,
+  modelRegistryId,
+  gatewayType,
+  routeLabel,
+  usage,
+  inputTokens,
+  outputTokens,
+  cachedInputTokens,
+  reasoningOutputTokens,
+  latencyMs,
+  stopReason,
+  status,
+  errorType,
+  costUsd,
+  costSource,
+  metadata,
+} = {}) {
+  const db = getDb();
+  const normalizedSource = String(source || 'wall-e.chat').trim() || 'wall-e.chat';
+  const normalizedRequestId = requestId == null ? null : String(requestId).trim();
+  if (normalizedRequestId) {
+    const existing = db.prepare('SELECT * FROM model_usage_ledger WHERE source = ? AND request_id = ?').get(normalizedSource, normalizedRequestId);
+    if (existing) return _parseLedgerMetadata({ ...existing, duplicate: true });
+  }
+
+  const tokens = _normalizeUsageTokens({ usage, inputTokens, outputTokens, cachedInputTokens, reasoningOutputTokens });
+  const explicitCost = _finiteNumberOrNull(costUsd);
+  const estimate = explicitCost == null
+    ? estimateModelUsageCost({
+      providerType,
+      providerId,
+      modelId,
+      modelRegistryId,
+      inputTokens: tokens.inputTokens,
+      outputTokens: tokens.outputTokens,
+    })
+    : {
+      costUsd: explicitCost,
+      costSource: costSource || 'explicit',
+      modelRegistryId: modelRegistryId || null,
+      providerId: providerId || null,
+      providerType: providerType || null,
+      gatewayType: gatewayType || null,
+    };
+
+  const rowId = id || uuidv4();
+  const insert = db.prepare(`
+    INSERT INTO model_usage_ledger (
+      id, occurred_at, source, feature, session_id, branch_id, message_id, request_id,
+      provider_type, provider_id, model_id, model_registry_id, gateway_type, route_label,
+      input_tokens, output_tokens, total_tokens, cached_input_tokens, reasoning_output_tokens,
+      latency_ms, stop_reason, status, error_type, cost_usd, cost_source, metadata
+    )
+    VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
+  `);
+  try {
+    insert.run(
+      rowId,
+      occurredAt || new Date().toISOString(),
+      normalizedSource,
+      feature || null,
+      sessionId || null,
+      branchId || null,
+      messageId || null,
+      normalizedRequestId || null,
+      providerType || estimate.providerType || null,
+      providerId || estimate.providerId || null,
+      modelId || null,
+      modelRegistryId || estimate.modelRegistryId || null,
+      gatewayType || estimate.gatewayType || null,
+      routeLabel || null,
+      tokens.inputTokens,
+      tokens.outputTokens,
+      tokens.totalTokens,
+      tokens.cachedInputTokens,
+      tokens.reasoningOutputTokens,
+      latencyMs == null ? null : _nonNegativeInteger(latencyMs),
+      stopReason || null,
+      status || 'success',
+      errorType || null,
+      estimate.costUsd,
+      costSource || estimate.costSource || null,
+      _ledgerMetadata(metadata),
+    );
+  } catch (err) {
+    if (normalizedRequestId && /UNIQUE constraint failed/.test(String(err.message || ''))) {
+      const existing = db.prepare('SELECT * FROM model_usage_ledger WHERE source = ? AND request_id = ?').get(normalizedSource, normalizedRequestId);
+      if (existing) return _parseLedgerMetadata({ ...existing, duplicate: true });
+    }
+    throw err;
+  }
+  return _parseLedgerMetadata(db.prepare('SELECT * FROM model_usage_ledger WHERE id = ?').get(rowId));
+}
+
+function getModelUsageLedgerEntry(id) {
+  const row = getDb().prepare('SELECT * FROM model_usage_ledger WHERE id = ?').get(id);
+  return row ? _parseLedgerMetadata(row) : null;
+}
+
+function _modelUsageWhere(filters = {}) {
+  const clauses = [];
+  const params = [];
+  const addEq = (column, value, lower = false) => {
+    const text = String(value || '').trim();
+    if (!text) return;
+    if (lower) {
+      clauses.push(`lower(${column}) = ?`);
+      params.push(text.toLowerCase());
+    } else {
+      clauses.push(`${column} = ?`);
+      params.push(text);
+    }
+  };
+  addEq('session_id', filters.sessionId || filters.session_id);
+  addEq('provider_type', filters.providerType || filters.provider_type || filters.provider, true);
+  addEq('provider_id', filters.providerId || filters.provider_id);
+  addEq('model_id', filters.modelId || filters.model_id || filters.model, true);
+  addEq('model_registry_id', filters.modelRegistryId || filters.model_registry_id);
+  addEq('source', filters.source);
+  if (filters.since) {
+    clauses.push('occurred_at >= ?');
+    params.push(String(filters.since));
+  }
+  if (filters.until) {
+    clauses.push('occurred_at <= ?');
+    params.push(String(filters.until));
+  }
+  return {
+    where: clauses.length ? `WHERE ${clauses.join(' AND ')}` : '',
+    params,
+  };
+}
+
+function listModelUsageLedger(filters = {}) {
+  const { where, params } = _modelUsageWhere(filters);
+  const limit = Math.max(1, Math.min(1000, _nonNegativeInteger(filters.limit) || 100));
+  const rows = getDb().prepare(`
+    SELECT *
+    FROM model_usage_ledger
+    ${where}
+    ORDER BY datetime(occurred_at) DESC, id DESC
+    LIMIT ?
+  `).all(...params, limit);
+  return rows.map((row) => _parseLedgerMetadata(row));
+}
+
+function summarizeModelUsageLedger(filters = {}) {
+  const { where, params } = _modelUsageWhere(filters);
+  const rows = getDb().prepare(`
+    SELECT
+      date(occurred_at) AS day,
+      provider_type,
+      model_id,
+      model_registry_id,
+      COUNT(*) AS calls,
+      SUM(input_tokens) AS input_tokens,
+      SUM(output_tokens) AS output_tokens,
+      SUM(total_tokens) AS total_tokens,
+      SUM(cached_input_tokens) AS cached_input_tokens,
+      SUM(reasoning_output_tokens) AS reasoning_output_tokens,
+      SUM(cost_usd) AS cost_usd,
+      SUM(CASE WHEN cost_usd IS NULL THEN 1 ELSE 0 END) AS missing_cost_rows,
+      MIN(occurred_at) AS first_seen_at,
+      MAX(occurred_at) AS last_seen_at
+    FROM model_usage_ledger
+    ${where}
+    GROUP BY date(occurred_at), provider_type, model_id, model_registry_id
+    ORDER BY datetime(last_seen_at) DESC, provider_type, model_id
+  `).all(...params);
+  return rows;
+}
+
 // -- Model Evaluations --
 
 function getEvaluationDaysCutoff(days) {
@@ -3684,6 +5120,7 @@ function pruneUnsupportedCloudModelRegistryRowsForDb(d, { dryRun = false } = {})
     JOIN model_providers mp ON mr.provider_id = mp.id
     WHERE mp.type IN ('anthropic', 'openai', 'google', 'deepseek', 'moonshot')
       AND COALESCE(mr.is_fine_tuned, 0) = 0
+      AND COALESCE(mr.source, 'catalog') IN ('catalog', 'builtin')
   `).all();
   const stale = rows.filter((row) => {
     const allowed = allowedByType.get(row.provider_type);
@@ -4480,10 +5917,18 @@ module.exports = {
   getDb,
   closeDb,
   getDbPath,
+  enqueueOwnerWrite,
+  drainOwnerWrites,
+  getOwnerWriteQueueStatus,
+  getStorageRisk,
   /** Mark DB as daemon-owned — closeDb() becomes no-op unless force=true */
   setDaemonOwned() { _daemonOwned = true; },
   DATA_DIR,
-  BACKUP_DIR,
+  get BACKUP_DIR() { return _backupDirForCurrentDb(); },
+  DEFAULT_BACKUP_DIR,
+  getBackupDirInfo,
+  setBackupDir,
+  moveBackupsToDir,
   // Owner
   setOwner,
   getOwner,
@@ -4559,7 +6004,7 @@ module.exports = {
   createBackup,
   listBackups,
   deleteBackup,
-  startDailyBackup,
+  ensureDailyBackup,
   // Skills
   insertSkill,
   getSkill,
@@ -4619,6 +6064,19 @@ module.exports = {
   completeSlackInboundEvent,
   releaseSlackInboundEvent,
   pruneSlackInboundEvents,
+  // Write-lock probes
+  getWriteLockStats,
+  resetWriteLockStats,
+  // Question digest
+  listUndeliveredDigestQuestions,
+  markQuestionsDelivered,
+  // Brain retention
+  deleteMemory,
+  pruneStalePendingQuestions,
+  pruneActivityLog,
+  pruneSkillExecutions,
+  pruneInitiativeLog,
+  runBrainRetention,
   // Model Providers
   upsertModelProvider,
   getModelProvider,
@@ -4626,6 +6084,10 @@ module.exports = {
   listModelProviders,
   listEnabledProviders,
   getProviderByType,
+  setProviderRoutePolicy,
+  getProviderRoutePolicy,
+  getPreferredModelProviderForType,
+  sortModelProvidersByRoutePolicy,
   setProviderAuthMethod,
   getProviderAuthMethod,
   saveSetupProvider,
@@ -4640,7 +6102,15 @@ module.exports = {
   upsertModelRegistryEntry,
   getModelRegistryEntry,
   listModelsByProvider,
+  listModelCountsByProvider,
   listAllModels,
+  // Model Usage Ledger
+  recordModelUsage,
+  getModelUsageLedgerEntry,
+  listModelUsageLedger,
+  summarizeModelUsageLedger,
+  estimateModelUsageCost,
+  findModelRegistryForUsage,
   // Model Evaluations
   insertModelEvaluation,
   getModelScorecard,
@@ -4695,11 +6165,14 @@ module.exports = {
   getBestWorstExamples,
   // MemPalace features
   touchMemory,
+  touchMemories,
+  countMemories,
+  countQuestions,
   decayImportance,
   backfillTemporalValidity,
   updateKnowledgeEntityLinks,
   // Entities
-  insertEntity, getEntity, findEntity, findEntityFuzzy, mergeEntities, listEntities, getEntityGraph,
+  insertEntity, getEntity, findEntity, findEntityFuzzy, resolvePersonIdentities, mergeEntities, listEntities, getEntityGraph,
   // Memory Index
   insertMemoryIndex, searchMemoryIndex, getMemoryIndex,
   // Memory Lifecycle Hooks