moflo 4.12.11 → 4.12.12

package/dist/src/cli/commands/memory.js

@@ -14,6 +14,7 @@ import { memoryDbPath } from '../services/moflo-paths.js';
 import { resolveBridgeDbPath } from '../memory/bridge-core.js';
 import { findProjectRoot } from '../services/project-root.js';
 import { generateId } from '../shared/utils/id.js';
+import { auditLearningsCommand } from './memory-audit-learnings.js';
 // Memory backends
 const BACKENDS = [
     { value: 'agentdb', label: 'AgentDB', hint: 'Vector database with HNSW approximate-nearest-neighbor (ANN) indexing' },
@@ -514,6 +515,13 @@ const deleteCommand = {
             if (result.deleted) {
                 output.printSuccess(`Deleted "${key}" from namespace "${namespace}"`);
                 output.printInfo(`Remaining entries: ${result.remainingEntries}`);
+                // Durable deletes are retained as an archived row so the deletion can
+                // reach the team artifact and sibling worktrees (#1463). Say so — a
+                // user auditing the DB should not be surprised to find the row.
+                const { isDurableNamespace } = await import('../services/cherry-pick-learnings.js');
+                if (isDurableNamespace(namespace)) {
+                    output.printInfo('Retained as an archived row so the deletion propagates on the next share; invisible to search and purged after 90 days.');
+                }
             }
             else {
                 output.printWarning(`Key not found: "${key}" in namespace "${namespace}"`);
@@ -762,6 +770,17 @@ const cleanupCommand = {
                     { category: output.bold('Total'), count: output.bold(String(result.candidates.total)) }
                 ]
             });
+            // #1464 — say what was withheld. A zero-candidate result on a store full
+            // of old learnings is otherwise read as "already tidy" when the truth is
+            // "durable entries were never examined".
+            if (result.durableHeldBack) {
+                output.writeln();
+                output.printInfo(`${result.durableHeldBack} durable ${result.durableHeldBack === 1 ? 'entry' : 'entries'} `
+                    + `(learnings, knowledge) held back — age is not evidence of staleness there.`);
+                output.printList([
+                    'Include them deliberately: flo memory cleanup --older-than <age> --namespace learnings',
+                ]);
+            }
             if (dryRun)
                 return { success: true, data: result };
             if (result.candidates.total === 0) {
@@ -1585,7 +1604,7 @@ const indexGuidanceCommand = {
             type: 'string'
         },
         {
-            name: 'no-embeddings',
+            name: 'embeddings',
             description: 'Skip embedding generation after indexing',
             type: 'boolean',
             default: false
@@ -1605,7 +1624,7 @@ const indexGuidanceCommand = {
     action: async (ctx) => {
         const forceReindex = ctx.flags.force;
         const specificFile = ctx.flags.file;
-        const skipEmbeddings = ctx.flags.noEmbeddings;
+        const skipEmbeddings = ctx.flags.embeddings === false;
         const overlapPercent = ctx.flags.overlap || DEFAULT_OVERLAP_PERCENT;
         const NAMESPACE = 'guidance';
         const fs = await import('fs');
@@ -2057,7 +2076,7 @@ const codeMapCommand = {
             default: false
         },
         {
-            name: 'no-embeddings',
+            name: 'embeddings',
             description: 'Skip embedding generation after mapping',
             type: 'boolean',
             default: false
@@ -2072,7 +2091,7 @@ const codeMapCommand = {
         const forceRegen = ctx.flags.force;
         const verbose = ctx.flags.verbose;
         const statsOnly = ctx.flags.stats;
-        const skipEmbeddings = ctx.flags.noEmbeddings;
+        const skipEmbeddings = ctx.flags.embeddings === false;
         const cwd = ctx.cwd || process.cwd();
         output.writeln();
         output.writeln(output.bold('Generating Code Map'));
@@ -2502,15 +2521,45 @@ const teamExportCommand = {
         const projectRoot = findProjectRoot();
         const artifactPath = await resolveTeamArtifact(projectRoot, ctx.flags.to);
         try {
-            const { exportTeamArtifact, ensureSharedArtifactTracked } = await import('../services/team-artifact-sync.js');
+            const { exportTeamArtifact, ensureSharedArtifactTracked, ensureSharedArtifactEol } = await import('../services/team-artifact-sync.js');
             const report = exportTeamArtifact({ projectRoot, artifactPath, sharedAt: new Date().toISOString() });
             const gitignore = ensureSharedArtifactTracked(projectRoot, artifactPath);
+            const gitattributes = ensureSharedArtifactEol(projectRoot, artifactPath);
             const rel = pathModule.relative(projectRoot, artifactPath) || artifactPath;
             output.printSuccess(`Shared ${report.added} new durable entr${report.added === 1 ? 'y' : 'ies'} → ${rel}`);
-            output.printInfo(`Artifact now holds ${report.total} entr${report.total === 1 ? 'y' : 'ies'}.`);
+            // Report every category, not just the appends (#1463). The old summary
+            // named only `added`, which read as "everything was shared" while 32
+            // corrections and 34 deletions sat unpropagated for weeks.
+            const changes = [];
+            if (report.updated > 0)
+                changes.push(`${report.updated} corrected`);
+            if (report.deleted > 0)
+                changes.push(`${report.deleted} retired`);
+            if (report.resurrected > 0)
+                changes.push(`${report.resurrected} restored`);
+            if (changes.length > 0)
+                output.printInfo(`Also propagated: ${changes.join(', ')}.`);
+            if (report.keptRemote > 0) {
+                output.printWarning(`${report.keptRemote} local change${report.keptRemote === 1 ? '' : 's'} NOT shared — the artifact's version is newer. Run \`flo memory team-import\` first.`);
+            }
+            if (report.skippedMalformed > 0) {
+                output.printWarning(`${report.skippedMalformed} malformed line${report.skippedMalformed === 1 ? '' : 's'} skipped.`);
+            }
+            if (report.skippedCorrupt > 0) {
+                output.printWarning(`${report.skippedCorrupt} entr${report.skippedCorrupt === 1 ? 'y' : 'ies'} NOT shared — captured tool-call markup in the value (#1467). `
+                    + `Run \`flo memory list --namespace learnings\` to find and rewrite them.`);
+            }
+            if (!report.wrote) {
+                output.printInfo('Nothing changed — the artifact was left untouched.');
+            }
+            const tombstoneNote = report.tombstones > 0 ? ` (+ ${report.tombstones} tombstone${report.tombstones === 1 ? '' : 's'})` : '';
+            output.printInfo(`Artifact now holds ${report.total} entr${report.total === 1 ? 'y' : 'ies'}${tombstoneNote}.`);
             if (gitignore !== 'unchanged') {
                 output.printInfo(`.gitignore ${gitignore} so the shared artifact is tracked while the rest of .moflo/ stays ignored.`);
             }
+            if (gitattributes !== 'unchanged') {
+                output.printInfo(`.gitattributes ${gitattributes} to pin the artifact to LF — without it a Windows checkout conflicts on every line when two teammates' artifacts merge.`);
+            }
             output.printInfo(`Commit it to share: git add ${rel} && git commit -m "share learnings"`);
             return { success: true, data: report };
         }
@@ -2545,16 +2594,28 @@ const teamImportCommand = {
             const { importTeamArtifact } = await import('../services/team-artifact-sync.js');
             const report = importTeamArtifact({ projectRoot, artifactPath });
             output.printSuccess(`Merged ${report.imported} durable entr${report.imported === 1 ? 'y' : 'ies'} from the team artifact`);
-            if (report.considered > report.imported) {
-                output.printInfo(`${report.considered - report.imported} already present (skipped, conflict-free).`);
+            const applied = [];
+            if (report.updated > 0)
+                applied.push(`${report.updated} corrected`);
+            if (report.deleted > 0)
+                applied.push(`${report.deleted} retired locally`);
+            if (report.resurrected > 0)
+                applied.push(`${report.resurrected} restored`);
+            if (applied.length > 0)
+                output.printInfo(`Also applied: ${applied.join(', ')}.`);
+            if (report.keptLocal > 0) {
+                output.printInfo(`${report.keptLocal} artifact change${report.keptLocal === 1 ? '' : 's'} skipped — the local entry is newer.`);
             }
             if (report.skippedMalformed > 0) {
                 output.printWarning(`${report.skippedMalformed} malformed line${report.skippedMalformed === 1 ? '' : 's'} skipped.`);
             }
+            if (report.skippedCorrupt > 0) {
+                output.printWarning(`${report.skippedCorrupt} artifact line${report.skippedCorrupt === 1 ? '' : 's'} NOT imported — captured tool-call markup in the content (#1467).`);
+            }
             if (report.skippedNonDurable > 0) {
                 output.printWarning(`${report.skippedNonDurable} non-durable entr${report.skippedNonDurable === 1 ? 'y' : 'ies'} skipped (only learnings/knowledge are shared).`);
             }
-            if (report.imported > 0) {
+            if (report.imported > 0 || report.updated > 0 || report.resurrected > 0) {
                 output.printInfo('Restart your Claude Code session (or run `flo memory rebuild-index`) so the merged learnings are embedded + searchable.');
             }
             return { success: true, data: report };
@@ -2663,7 +2724,7 @@ const restoreCommand = {
 export const memoryCommand = {
     name: 'memory',
     description: 'Memory management commands',
-    subcommands: [initMemoryCommand, storeCommand, retrieveCommand, searchCommand, listCommand, deleteCommand, statsCommand, configureCommand, cleanupCommand, compressCommand, exportCommand, importCommand, indexGuidanceCommand, rebuildIndexCommand, codeMapCommand, refreshCommand, restoreLearningsCommand, syncCommand, teamExportCommand, teamImportCommand, backupCommand, restoreCommand],
+    subcommands: [initMemoryCommand, storeCommand, retrieveCommand, searchCommand, listCommand, deleteCommand, statsCommand, configureCommand, cleanupCommand, auditLearningsCommand, compressCommand, exportCommand, importCommand, indexGuidanceCommand, rebuildIndexCommand, codeMapCommand, refreshCommand, restoreLearningsCommand, syncCommand, teamExportCommand, teamImportCommand, backupCommand, restoreCommand],
     options: [],
     examples: [
         { command: 'flo memory store -k "key" -v "value"', description: 'Store data' },

package/dist/src/cli/commands/spell-schedule.js

@@ -78,7 +78,7 @@ const createCommand = {
         { name: 'cron', short: 'c', description: 'Cron expression (5-field)', type: 'string' },
         { name: 'interval', short: 'i', description: 'Interval (e.g., "6h", "30m", "1d")', type: 'string' },
         { name: 'at', short: 'a', description: 'One-time ISO 8601 datetime', type: 'string' },
-        { name: 'no-autostart', description: 'Do not register the daemon as an OS login service', type: 'boolean' },
+        { name: 'autostart', description: 'Register the daemon as an OS login service (--no-autostart to skip)', type: 'boolean', default: true },
     ],
     examples: [
         { command: 'moflo spell schedule create -n audit --cron "0 9 * * *"', description: 'Daily at 9am' },
@@ -169,8 +169,10 @@ const createCommand = {
         // Short-circuit: a fresh create can only ever trigger an install (count
         // just went up). If the service is already installed, the reconcile is a
         // guaranteed noop — skip the count fetch entirely.
-        // Note: parser normalises --no-autostart to ctx.flags.noAutostart (#787).
-        const skipAutostart = ctx.flags.noAutostart === true;
+        // The parser turns `--no-autostart` into `autostart = false`; it has never
+        // produced a `noAutostart` key, so the previous read here was always
+        // undefined and the flag was a no-op (#1474).
+        const skipAutostart = ctx.flags.autostart === false;
         const alreadyInstalled = readiness.daemonInstalled;
         let reconcileTransition = 'noop';
         if (!skipAutostart && !alreadyInstalled) {

package/dist/src/cli/index.js

@@ -147,7 +147,7 @@ export class CLI {
                 this.showVersion();
                 return;
             }
-            if (flags.noColor) {
+            if (flags.color === false) {
                 this.output.setColorEnabled(false);
             }
             // Set verbosity level based on flags
@@ -165,7 +165,9 @@ export class CLI {
                 this.output.printDebug(`CWD: ${process.cwd()}`);
             }
             // Run startup update check (non-blocking, silent on skip)
-            if (!flags.noUpdate && commandPath[0] !== 'update') {
+            // `--no-update` parses to `update = false`; `noUpdate` was never set, so
+            // the check ran even when the user asked it not to (#1474).
+            if (flags.update !== false && commandPath[0] !== 'update') {
                 this.checkForUpdatesOnStartup().catch(() => { });
             }
             // Auto-start daemon if configured and not already running (non-blocking).

package/dist/src/cli/init/executor.js

@@ -57,6 +57,7 @@ export const SKILLS_MAP = {
         'vector-search',
         'memory-worktree', // guided memory.durable_path setup (same-machine worktrees)
         'memory-team', // guided memory.team_artifact setup + PR pre-commit hook
+        'optimize-learnings', // curation pass over the `learnings` namespace, wrapping `flo memory audit-learnings`
     ],
     spells: [
         'spell-builder',

package/dist/src/cli/mcp-tools/memory-admin-tools.js

@@ -24,6 +24,7 @@ import { BACKEND_LABEL } from '../memory/database-provider.js';
 import { ensureInitialized } from './memory-tools.js';
 import { memoryDbPath } from '../services/moflo-paths.js';
 import { resolveStateRoot } from '../services/project-root.js';
+import { DURABLE_NAMESPACES } from '../services/cherry-pick-learnings.js';
 function dbPath() {
     return memoryDbPath(resolveStateRoot());
 }
@@ -281,7 +282,7 @@ export const memoryAdminTools = [
     },
     {
         name: 'memory_cleanup',
-        description: 'Find and optionally delete expired, stale, or unusable memory entries',
+        description: 'Find and optionally delete expired, stale, or unusable memory entries. Durable namespaces (learnings, knowledge) are exempt from the age-based buckets unless named via `namespace`; TTL-expired rows are collected everywhere.',
         category: 'memory',
         inputSchema: {
             type: 'object',
@@ -290,7 +291,7 @@ export const memoryAdminTools = [
                 dryRun: { type: 'boolean', description: 'Ignored. Cleanup is dry unless apply:true is passed; accepted only so older callers do not error.' },
                 olderThan: { type: 'string', description: 'Age cutoff for stale/unusable entries, e.g. "30d"' },
                 expiredOnly: { type: 'boolean', description: 'Only consider TTL-expired entries' },
-                namespace: { type: 'string', description: 'Restrict cleanup to one namespace' },
+                namespace: { type: 'string', description: 'Restrict cleanup to one namespace. Naming a durable namespace (learnings, knowledge) also opts it back into the age-based buckets it is exempt from by default.' },
             },
         },
         handler: async (input) => {
@@ -308,10 +309,28 @@ export const memoryAdminTools = [
             const now = Date.now();
             const nsClause = namespace ? ` AND namespace = ${sqlString(namespace)}` : '';
             const select = (cond) => `SELECT key, namespace FROM memory_entries WHERE status = 'active' AND ${cond}${nsClause}`;
+            // #1464 — durable namespaces are exempt from the two AGE-based buckets
+            // unless the caller names one explicitly.
+            //
+            // Age is not evidence of worthlessness for a learning: a two-year-old
+            // architectural decision is routinely the most valuable row in the store.
+            // Worse, `COALESCE(last_accessed_at, updated_at, created_at)` collapses to
+            // `created_at` for any row nothing has ever bumped — and until #1464 the
+            // search path, which is how learnings are actually read, bumped nothing.
+            // So "stale (unused)" silently meant "old", and the only purge surface
+            // moflo ships hit the most-consulted learnings exactly as hard as the dead
+            // ones.
+            //
+            // A DEFAULT, not a prohibition — `--namespace learnings` still collects
+            // them. TTL-expired rows stay in scope in every namespace; durable rows
+            // never set a TTL, so nothing durable is lost through that bucket.
+            const exemptDurable = !namespace;
+            const durableIn = DURABLE_NAMESPACES.map(sqlString).join(', ');
+            const durableClause = exemptDurable ? ` AND namespace NOT IN (${durableIn})` : '';
             const expired = await query(select(`expires_at IS NOT NULL AND expires_at < ${now}`));
-            const stale = !expiredOnly && staleMs != null
-                ? await query(select(`expires_at IS NULL AND COALESCE(last_accessed_at, updated_at, created_at) < ${now - staleMs}`))
-                : [];
+            const ageCutoff = staleMs != null ? now - staleMs : null;
+            const staleCond = ageCutoff == null ? null
+                : `expires_at IS NULL AND COALESCE(last_accessed_at, updated_at, created_at) < ${ageCutoff}`;
             // "Unusable" = no embedding (so invisible to semantic search), never
             // read back, AND older than the caller's cutoff.
             //
@@ -321,10 +340,27 @@ export const memoryAdminTools = [
             // selected the entire store for deletion by default. Requiring an
             // explicit cutoff means an unqualified cleanup can only ever remove
             // TTL-expired rows.
-            const lowQuality = !expiredOnly && staleMs != null
-                ? await query(select(`embedding IS NULL AND COALESCE(access_count, 0) = 0 ` +
-                    `AND COALESCE(last_accessed_at, updated_at, created_at) < ${now - staleMs}`))
+            const lowQualityCond = ageCutoff == null ? null
+                : `embedding IS NULL AND COALESCE(access_count, 0) = 0 `
+                    + `AND COALESCE(last_accessed_at, updated_at, created_at) < ${ageCutoff}`;
+            const ageBuckets = !expiredOnly && staleCond != null && lowQualityCond != null;
+            const stale = ageBuckets ? await query(select(staleCond + durableClause)) : [];
+            const lowQuality = ageBuckets ? await query(select(lowQualityCond + durableClause)) : [];
+            // Count what the exemption withheld. Without this the operator reads a
+            // clean result as "learnings are already tidy" rather than "learnings were
+            // not examined" — the same class of quiet lie the missing usage signal was.
+            //
+            // The TTL exclusion is not cosmetic: `lowQualityCond` does not test
+            // `expires_at`, so without it a durable row with an elapsed TTL would be
+            // reported as held back in the same call that deletes it through the
+            // expired bucket.
+            const heldBackRows = ageBuckets && exemptDurable
+                ? await query(`SELECT COUNT(*) FROM memory_entries WHERE status = 'active'`
+                    + ` AND namespace IN (${durableIn})`
+                    + ` AND NOT (expires_at IS NOT NULL AND expires_at < ${now})`
+                    + ` AND ((${staleCond}) OR (${lowQualityCond}))`)
                 : [];
+            const durableHeldBack = heldBackRows.length ? Number(heldBackRows[0][0] ?? 0) : 0;
             const seen = new Set();
             const targets = [];
             for (const rows of [expired, stale, lowQuality]) {
@@ -348,6 +384,7 @@ export const memoryAdminTools = [
                 return {
                     dryRun: true,
                     candidates,
+                    durableHeldBack,
                     deleted: { entries: 0 },
                     freed: { bytes: 0, formatted: '0 B' },
                     duration: Date.now() - started,
@@ -365,6 +402,7 @@ export const memoryAdminTools = [
             return {
                 dryRun: false,
                 candidates,
+                durableHeldBack,
                 deleted: { entries: deleted },
                 freed: { bytes: freedBytes, formatted: formatBytes(freedBytes) },
                 duration: Date.now() - started,

package/dist/src/cli/mcp-tools/moflodb-tools.js

@@ -433,17 +433,38 @@ export const moflodbConsolidate = {
         }
     },
 };
-// ===== moflodb_batch — Batch operations (insert, update, delete) =====
+// ===== moflodb_batch — Batch insert into the episodes store =====
+/**
+ * `update` and `delete` were removed in #1465 — both reported `success: true`
+ * with a count taken from the input array while changing nothing the caller
+ * could address. Rejected here, at the tool boundary, naming the tool that
+ * does the job.
+ *
+ * A Map, not an object literal: `operation` is caller-controlled, and a plain
+ * object would resolve 'constructor'/'toString'/'__proto__' up the prototype
+ * chain to a truthy function, returning an error whose message JSON-serializes
+ * to nothing.
+ */
+const REMOVED_BATCH_OPERATIONS = new Map([
+    [
+        'delete',
+        "moflodb_batch no longer supports 'delete' (#1465): it targeted the episodes store and could not address a namespaced memory entry, while reporting success. Use memory_delete with an explicit namespace.",
+    ],
+    [
+        'update',
+        "moflodb_batch no longer supports 'update' (#1465): it targeted the episodes store and could not address a namespaced memory entry, while reporting success. Use memory_store to overwrite an entry.",
+    ],
+]);
 export const moflodbBatch = {
     name: 'moflodb_batch',
-    description: 'Batch operations on memory entries (insert, update, delete)',
+    description: 'Batch-insert episodes into the MofloDb bridge store. Use memory_delete to remove entries and memory_store to overwrite them.',
     inputSchema: {
         type: 'object',
         properties: {
             operation: {
                 type: 'string',
-                description: 'Batch operation type',
-                enum: ['insert', 'update', 'delete'],
+                description: "Batch operation type. Only 'insert' is supported; 'update'/'delete' were removed in #1465.",
+                enum: ['insert'],
             },
             entries: {
                 type: 'array',
@@ -465,8 +486,11 @@ export const moflodbBatch = {
             const operation = validateString(params.operation, 'operation', 20);
             if (!operation)
                 return { success: false, error: 'operation is required (string)' };
-            if (!['insert', 'update', 'delete'].includes(operation)) {
-                return { success: false, error: `Invalid operation: ${operation}. Must be insert, update, or delete` };
+            const removed = REMOVED_BATCH_OPERATIONS.get(operation);
+            if (removed)
+                return { success: false, error: removed };
+            if (operation !== 'insert') {
+                return { success: false, error: `Invalid operation: ${operation}. Must be insert` };
             }
             if (!Array.isArray(params.entries) || params.entries.length === 0) {
                 return { success: false, error: 'entries is required (non-empty array)' };

package/dist/src/cli/memory/bridge-entries.js

@@ -10,6 +10,7 @@
 import { cosineSim, execRows, generateId, logBridgeError, persistBridgeDb, refreshVectorStatsCache, searchCandidateCap, withDb } from './bridge-core.js';
 import { embeddingResponseFrom, getBridgeEmbedder, resolveBridgeEmbedding } from './bridge-embedder.js';
 import { errorDetail } from '../shared/utils/error-detail.js';
+import { archiveDurableRow, isDurableNamespace } from '../services/durable-store-io.js';
 /**
  * Run `persistBridgeDb` and convert any throw into a `persist failed:`
  * error string for the caller. Centralises the #982 single-store /
@@ -59,6 +60,112 @@ function makeEntryCacheKey(namespace, key) {
  * trade; a systematic undercount of HOT keys — the #1396 defect — is not.
  */
 const ACCESS_FLUSH_INTERVAL_MS = 30_000;
+/**
+ * The access bump, shared by the two throttles that issue it. Adding the
+ * accumulated delta in SQL — rather than writing a client-computed absolute —
+ * is what keeps the counter correct under concurrency, so the statement is
+ * written once and reused rather than retyped per call site.
+ */
+const ACCESS_BUMP_SQL = `UPDATE memory_entries SET access_count = access_count + ?, last_accessed_at = ? WHERE id = ?`;
+/**
+ * Deferred `access_count` deltas for rows returned by SEARCH, per database.
+ *
+ * #1464 — `memory_search` is the read path for durable learnings (CLAUDE.md
+ * routes every prompt through it before any other read), but nothing on that
+ * path recorded usage: `access_count` / `last_accessed_at` moved only on
+ * retrieve-by-key. The most-consulted learning in the store looked untouched
+ * since the day it was written, which in turn made every age-based cleanup
+ * heuristic a guess dressed up as a measurement.
+ *
+ * Scoped to DURABLE namespaces on purpose. Structural namespaces (code-map,
+ * patterns, tests) are re-indexed wholesale on a schedule and their usage
+ * counts are noise — paying a write for them would tax the hot path to record
+ * nothing anyone reads.
+ *
+ * KEYED BY THE DATABASE HANDLE, not module-global. Entry ids are only
+ * meaningful inside the store that issued them, so a process that reaches a
+ * second database — a `dbPath` override, or a bridge rebuilt against a
+ * different project root — must not carry the first one's deltas across.
+ * Module-global state would flush ids that match nothing in the new store and
+ * then clear them, silently discarding counts against the "defer, never lose"
+ * rule below. A WeakMap also means a torn-down bridge's state is collected with
+ * its handle rather than accumulating for the life of the daemon, and each test
+ * gets clean state from its own database with no reset hook to remember.
+ *
+ * Same trade as the per-key entry-cache throttle below: defer writes, never
+ * lose counts. The flush stamp is per DATABASE rather than per key because a
+ * search touches a whole result set at once — the unit being coalesced here is
+ * the search, not the key.
+ */
+const searchAccessByDb = new WeakMap();
+/**
+ * Hard bound on one database's pending deltas. Durable namespaces are small, so
+ * this is a backstop rather than a working limit — but an unbounded map inside
+ * a daemon that lives for days is a leak regardless of how unlikely it is to
+ * fill. Reaching the cap forces a flush; it never drops deltas.
+ */
+const SEARCH_ACCESS_PENDING_CAP = 1_000;
+/**
+ * Accumulate one access per returned durable row, flushing at most once per
+ * {@link ACCESS_FLUSH_INTERVAL_MS}.
+ *
+ * `ids` are already filtered to durable rows by the caller, which is also where
+ * the per-row namespace test happens — a structural hit never reaches this map.
+ * Call with an empty array to give a pending set its chance to flush.
+ *
+ * Best-effort by construction: a throw leaves the deltas pending for the next
+ * attempt and search results are returned either way. Usage is observability,
+ * not correctness — #1058 is the standing proof of what happens when the read
+ * path takes on a write obligation it cannot honour safely. What it issues is a
+ * bounded per-row UPDATE, never the whole-DB `db.export()` writeback that
+ * clobbered concurrent writers.
+ */
+function recordSearchAccess(db, ids, now) {
+    let state = searchAccessByDb.get(db);
+    if (!state) {
+        // Nothing to record and nothing pending — don't allocate state for a
+        // database whose searches never return a durable row.
+        if (ids.length === 0)
+            return;
+        state = { deltas: new Map(), lastFlushAt: 0 };
+        searchAccessByDb.set(db, state);
+    }
+    for (const id of ids)
+        state.deltas.set(id, (state.deltas.get(id) ?? 0) + 1);
+    if (state.deltas.size === 0)
+        return;
+    // A database this process has never flushed writes immediately rather than
+    // waiting out the interval — moflo's CLI processes are short-lived and would
+    // otherwise exit with every access still pending, reintroducing the silent
+    // undercount this exists to remove.
+    const forced = state.deltas.size >= SEARCH_ACCESS_PENDING_CAP;
+    if (!forced && now - state.lastFlushAt < ACCESS_FLUSH_INTERVAL_MS)
+        return;
+    try {
+        const stmt = db.prepare(ACCESS_BUMP_SQL);
+        db.run('BEGIN');
+        try {
+            for (const [id, delta] of state.deltas)
+                stmt.run([delta, now, id]);
+            db.run('COMMIT');
+        }
+        catch (err) {
+            try {
+                db.run('ROLLBACK');
+            }
+            catch { /* a failed COMMIT already ended the txn */ }
+            throw err;
+        }
+        // Clear ONLY after the commit lands. Clearing on a throw would discard the
+        // accumulated hits outright — the throttle defers writes, it does not drop
+        // them.
+        state.deltas.clear();
+        state.lastFlushAt = now;
+    }
+    catch (err) {
+        logBridgeError('search access flush failed', err);
+    }
+}
 /** Normalise `metadata` for the `metadata` TEXT column; `undefined` → `'{}'` (#1064). */
 export function serialiseMetadata(metadata) {
     if (metadata == null)
@@ -544,6 +651,15 @@ export async function bridgeSearchEntries(options) {
         const { termDocFreqs, avgDocLength } = computeTermDocFreqs(queryTerms, rows);
         const docCount = rows.length;
         const results = [];
+        // #1464 — usage recording needs the FULL row id; the emitted `id` above is
+        // truncated to 12 chars for the envelope and would match no row. Keyed by
+        // the result object rather than by index because `results` is sorted and
+        // sliced before the returned set is known. Never spread into the response.
+        //
+        // Null for a namespace-scoped search of a structural namespace: nothing it
+        // returns can be durable, so it skips the bookkeeping outright rather than
+        // testing every row against a set that will never match.
+        const durableIdByResult = namespace === 'all' || isDurableNamespace(namespace) ? new Map() : null;
         for (const row of rows) {
             let semanticScore = 0;
             let bm25ScoreVal = 0;
@@ -568,7 +684,7 @@ export async function bridgeSearchEntries(options) {
                     ? `semantic:${semanticScore.toFixed(3)}+bm25:${bm25ScoreVal.toFixed(3)}`
                     : `bm25:${bm25ScoreVal.toFixed(3)}`;
                 const metadataStr = row.metadata != null ? String(row.metadata) : undefined;
-                results.push({
+                const hit = {
                     id: String(row.id).substring(0, 12),
                     // The substring is a fallback id-prefix when key is missing —
                     // applying it to the full expression truncates valid keys (#845).
@@ -578,13 +694,34 @@ export async function bridgeSearchEntries(options) {
                     namespace: String(row.namespace || 'default'),
                     provenance,
                     metadata: metadataStr,
-                });
+                };
+                results.push(hit);
+                // Per row, not per search: an `all`-namespace search returns mostly
+                // structural hits, and storing an id only to discard it at flush time
+                // is work every prompt in every consumer project would pay.
+                if (durableIdByResult && isDurableNamespace(hit.namespace)) {
+                    durableIdByResult.set(hit, String(row.id));
+                }
             }
         }
         results.sort((a, b) => b.score - a.score);
+        const returned = results.slice(0, limit);
+        // #1464 — record usage for the durable rows this search actually returned.
+        // Placed after the slice so an over-fetched candidate the caller never sees
+        // does not count as a read. Called even when this search returned none, so
+        // a set left pending by an earlier search still gets its flush.
+        if (durableIdByResult) {
+            const durableIds = [];
+            for (const r of returned) {
+                const id = durableIdByResult.get(r);
+                if (id)
+                    durableIds.push(id);
+            }
+            recordSearchAccess(ctx.db, durableIds, Date.now());
+        }
         return {
             success: true,
-            results: results.slice(0, limit),
+            results: returned,
             searchTime: Date.now() - startTime,
             searchMethod: queryEmbedding ? 'hybrid-bm25-semantic' : 'bm25-only',
         };
@@ -700,7 +837,8 @@ export async function bridgeGetEntry(options) {
             const lastFlushAt = cached.lastAccessFlushAt ?? 0;
             if (now - lastFlushAt >= ACCESS_FLUSH_INTERVAL_MS) {
                 try {
-                    ctx.db.prepare(`UPDATE memory_entries SET access_count = access_count + ?, last_accessed_at = ? WHERE id = ?`).run([cached.pendingAccessDelta, now, String(cached.id || '')]);
+                    ctx.db.prepare(ACCESS_BUMP_SQL)
+                        .run([cached.pendingAccessDelta, now, String(cached.id || '')]);
                     // Clear ONLY after the write lands. Clearing on a throw would discard
                     // the accumulated hits outright — the throttle defers writes, it does
                     // not drop them.
@@ -819,12 +957,22 @@ export async function bridgeDeleteEntry(options) {
         }
         let changes = 0;
         try {
-            ctx.db.prepare(`
-        DELETE FROM memory_entries
-        WHERE key = ? AND namespace = ? AND status = 'active'
-      `).run([key, namespace]);
+            // Durable namespaces archive rather than hard-delete, so the deletion can
+            // reach the team artifact and sibling worktrees (#1463). Same rule as the
+            // offline path in `entries-write.deleteEntry` — see the rationale there.
+            if (isDurableNamespace(namespace)) {
+                archiveDurableRow(ctx.db, namespace, key, Date.now());
+            }
+            else {
+                ctx.db.prepare(`
+          DELETE FROM memory_entries
+          WHERE key = ? AND namespace = ? AND status = 'active'
+        `).run([key, namespace]);
+            }
             // sql.js Statement.run returns true/false, not { changes }. Use
-            // db.getRowsModified() to read the row count from the last statement.
+            // db.getRowsModified() to read the row count from the last statement —
+            // an UPDATE reports rows affected the same way, so the zero-rows
+            // inconsistency check below covers the archive path too.
             changes = ctx.db.getRowsModified?.() ?? 0;
         }
         catch (err) {

package/dist/src/cli/memory/controllers/batch-operations.js

@@ -6,8 +6,13 @@
  *
  * Consumer surface (from src/cli/memory/memory-bridge.ts):
  *   - insertEpisodes([{content, metadata?, embedding?}])
- *   - bulkDelete(table, conditions)
- *   - bulkUpdate(table, updates, conditions)
+ *
+ * bulkDelete/bulkUpdate remain here — they report rows actually affected and
+ * are covered by this controller's tests — but #1465 removed their only
+ * caller. `moflodb_batch` routed them at the `episodes` store through a schema
+ * with no `namespace`, so they could not address a caller's `memory_entries`
+ * row; entry deletion belongs to `memory_delete`. Do not re-wire a bridge
+ * operation to them without a namespace-aware target.
  *
  * Only the `episodes` table is whitelisted for delete/update to keep the
  * SQL surface narrow; attempts to target any other table throw.