LIA

Wave 2 of the full-codebase audit — closes seven systemic classes of near-zero-risk defect (not just their occurrences). Each class gets a permanent guard — a CI test, a Prometheus metric, or a written convention — so it cannot silently recur. Architecture decision: ADR-095.

Data persistence

• In-place JSONB mutations are now persisted. SQLAlchemy silently skips the UPDATE on obj.meta["k"] = v / .update() / .extend(). Four sites fixed (API-key last_used_at, connector auth-failure diagnostics, two psyche-state writes). Guard: an AST test fails CI on any in-place JSONB mutation anywhere in src/.

Billing-cycle statistics

• No counter leaks across a cycle boundary. Three rollover paths (message, STT, dashboard) each hand-reset a different subset of counters, so voice/image/Google/token silos leaked. All now delegate to one reset_cycle() that zeroes every cycle_* column by introspection. Guard: multi-silo test + a sentinel that fails if a new counter is added untested.

Privacy (GDPR data-minimization)

• No personal data at INFO and above. Home address/GPS, resolved contact names/emails, email recipients/subjects and memory previews removed from operational logs. Guard: a level-sensitive net redacts content fields at INFO+ and allows them only at DEBUG.

Tool registry robustness

• A broken tool module can no longer vanish silently. Imports now fail loudly outside production and increment tool_module_import_failures_total in production. Guard: a three-layer registry smoke test imports and invokes all ~95 tools (it caught two latent runtime bugs, now fixed).

Internationalization

• Chinese users get Chinese (two modules never reached the zh-CN tables); the language-normalization chokepoint is unified into a single implementation.
• The last-resort fallback message is localized in all 6 languages (was hardcoded accent-less French).

Also

• Five docstrings corrected to match the code.

No DB schema change, no migration, no new .env key (one new Prometheus metric). Backend 8656 unit tests green + 1069 agents green; Ruff / Black / MyPy strict clean; i18n key parity across all 6 locales; Docker startup verified healthy.