Pull partner token ledgers into a RAM cache so fleet totals are fleet-wide

AI/README-AI.md

@@ -250,11 +250,23 @@ straight from the shell, since it is just a delimited file:
 awk -F'|' -v d="$(date +%F)" '$1==d {p+=$6; c+=$7} END {print p+c}' data/ai_token_history.db
 ```
 
-**The host column is where the turn ran, not where the file is read.** Each host keeps its own
-`data/` and nothing syncs it, so a host only ever sees its own rows — the partner shows as
-"not collected here" on the tab, never as zero. Carrying a partner's totals would mean extending
-the partnership payload fetch; the column exists so that stays a display change rather than a
-migration.
+**The host column is where the turn ran, not where the file is read.** Each host writes only its
+own rows.
+
+`ai_token_sync.sh` pulls each partner's ledger into `/tmp/.cache/vv/ai/<slot>.tokens.db` — the
+same trick `conf_sync.sh` uses for partner confs, and it runs from
+`INTERMEDIATE_MAINTENANCE_SCRIPTS` every four hours. The tab then reads every ledger it can see,
+so a fleet total is a fleet total.
+
+Pull only, no push: nothing here is needed by anyone else, and a reader that fetches its own data
+controls its own freshness instead of depending on the partner's cron. A partner file may only
+contribute rows whose `host` column matches its filename — a ledger copied into the wrong slot
+would otherwise be double-counted against a total that still looked plausible.
+
+The cache is tmpfs with **no save/restore pair**, unlike the conf cache. Stale counters are worse
+than absent ones: absent renders as "not collected here", stale renders as fact. An unreachable
+partner leaves its file alone and logs at info, because a partner being down for weeks is a
+normal state, not an incident.
 
 Pruning is by row count (`AI_TOKEN_RETAIN_ROWS`, default 20000) and happens on write, but only
 once the file passes a size threshold — an ordinary turn costs a `stat()` and an append. The CLI