moflo 4.12.11 → 4.13.0

package/dist/src/cli/config/moflo-config.js

@@ -190,6 +190,39 @@ function coerceMemoryBackend(raw) {
     }
     return DEFAULT_CONFIG.memory.backend;
 }
+/**
+ * Coerce a `worktree.copy` / `worktree.link` entry to a string array (#1481).
+ * Both keys accept a bare string for the common single-entry case; anything
+ * that is neither a string nor an array of strings is dropped rather than
+ * throwing — a malformed entry must never stop a consumer's config loading.
+ */
+function coercePathList(raw) {
+    const list = typeof raw === 'string' ? [raw] : Array.isArray(raw) ? raw : undefined;
+    if (!list)
+        return undefined;
+    const cleaned = list
+        .filter((v) => typeof v === 'string')
+        .map(v => v.trim())
+        .filter(v => v.length > 0);
+    return cleaned.length > 0 ? cleaned : undefined;
+}
+/**
+ * Parse the optional `worktree:` block (#1481). Returns `undefined` when the
+ * block is absent or contains nothing usable, so "not configured" stays
+ * distinguishable from "configured empty". Unknown sub-keys are ignored.
+ */
+function parseWorktreeConfig(raw) {
+    if (!raw || typeof raw !== 'object' || Array.isArray(raw))
+        return undefined;
+    const block = raw;
+    const dir = typeof block.dir === 'string' && block.dir.trim().length > 0 ? block.dir.trim() : undefined;
+    const copy = coercePathList(block.copy);
+    const link = coercePathList(block.link);
+    const setup = typeof block.setup === 'string' && block.setup.trim().length > 0 ? block.setup.trim() : undefined;
+    if (!dir && !copy && !link && !setup)
+        return undefined;
+    return { ...(dir && { dir }), ...(copy && { copy }), ...(link && { link }), ...(setup && { setup }) };
+}
 /**
  * Parse raw config object into typed config, merging with defaults.
  */
@@ -265,6 +298,10 @@ function mergeConfig(raw, root) {
                 return typeof v === 'string' && v.trim().length > 0 ? v.trim() : undefined;
             })(),
         },
+        // #1481 — optional worktree provisioning. The whole block stays `undefined`
+        // when absent so an existing consumer `moflo.yaml` is unaffected, and so
+        // `flo worktree add` can distinguish "not configured" from "configured empty".
+        worktree: parseWorktreeConfig(raw.worktree),
         hooks: {
             pre_edit: raw.hooks?.pre_edit ?? raw.hooks?.preEdit ?? DEFAULT_CONFIG.hooks.pre_edit,
             post_edit: raw.hooks?.post_edit ?? raw.hooks?.postEdit ?? DEFAULT_CONFIG.hooks.post_edit,
@@ -508,6 +545,26 @@ memory:
   #   worktrees never produce. Conductor recipe: set hydrate_from AND snapshot_to
   #   to the SAME absolute path. Overridable per-process via MOFLO_SNAPSHOT_TO.
 
+# Worktree provisioning (#1481) — makes "flo worktree add" (and "/flo -wt")
+# produce a RUNNABLE workspace, not just a valid checkout. Entirely optional:
+# with this block absent, a new worktree is created and nothing is provisioned.
+# worktree:
+#   dir: ../myrepo-worktrees
+#     Where worktrees are created. Defaults to <repo-parent>/<repo>-worktrees.
+#   copy: [".env", ".env.*"]
+#     Gitignored files a fresh checkout lacks, copied from the primary checkout.
+#     Sources must live inside the primary checkout. NOTE: this relocates secret
+#     material to a directory OUTSIDE the repo and outside its .gitignore — keep
+#     the worktree dir out of any repo you commit.
+#   link: ["node_modules"]
+#     Symlinked (junctioned on Windows) from the primary checkout. Opt-in with no
+#     default: a symlinked root node_modules is fragile under npm workspaces —
+#     prefer "setup: npm ci" if your project uses them.
+#   setup: "npm ci"
+#     Run inside the new worktree after copy/link, with MOFLO_WORKTREE_INDEX in
+#     its environment (a small integer unique among live worktrees) so a project
+#     with fixed dev-server ports can offset them per workspace.
+
 # Hook toggles (all on by default — disable to slim down)
 hooks:
   pre_edit: true               # Track file edits for learning

package/dist/src/cli/index.js

@@ -147,7 +147,7 @@ export class CLI {
                 this.showVersion();
                 return;
             }
-            if (flags.noColor) {
+            if (flags.color === false) {
                 this.output.setColorEnabled(false);
             }
             // Set verbosity level based on flags
@@ -165,7 +165,9 @@ export class CLI {
                 this.output.printDebug(`CWD: ${process.cwd()}`);
             }
             // Run startup update check (non-blocking, silent on skip)
-            if (!flags.noUpdate && commandPath[0] !== 'update') {
+            // `--no-update` parses to `update = false`; `noUpdate` was never set, so
+            // the check ran even when the user asked it not to (#1474).
+            if (flags.update !== false && commandPath[0] !== 'update') {
                 this.checkForUpdatesOnStartup().catch(() => { });
             }
             // Auto-start daemon if configured and not already running (non-blocking).

package/dist/src/cli/init/executor.js

@@ -57,6 +57,7 @@ export const SKILLS_MAP = {
         'vector-search',
         'memory-worktree', // guided memory.durable_path setup (same-machine worktrees)
         'memory-team', // guided memory.team_artifact setup + PR pre-commit hook
+        'optimize-learnings', // curation pass over the `learnings` namespace, wrapping `flo memory audit-learnings`
     ],
     spells: [
         'spell-builder',

package/dist/src/cli/mcp-tools/memory-admin-tools.js

@@ -24,6 +24,7 @@ import { BACKEND_LABEL } from '../memory/database-provider.js';
 import { ensureInitialized } from './memory-tools.js';
 import { memoryDbPath } from '../services/moflo-paths.js';
 import { resolveStateRoot } from '../services/project-root.js';
+import { DURABLE_NAMESPACES } from '../services/cherry-pick-learnings.js';
 function dbPath() {
     return memoryDbPath(resolveStateRoot());
 }
@@ -281,7 +282,7 @@ export const memoryAdminTools = [
     },
     {
         name: 'memory_cleanup',
-        description: 'Find and optionally delete expired, stale, or unusable memory entries',
+        description: 'Find and optionally delete expired, stale, or unusable memory entries. Durable namespaces (learnings, knowledge) are exempt from the age-based buckets unless named via `namespace`; TTL-expired rows are collected everywhere.',
         category: 'memory',
         inputSchema: {
             type: 'object',
@@ -290,7 +291,7 @@ export const memoryAdminTools = [
                 dryRun: { type: 'boolean', description: 'Ignored. Cleanup is dry unless apply:true is passed; accepted only so older callers do not error.' },
                 olderThan: { type: 'string', description: 'Age cutoff for stale/unusable entries, e.g. "30d"' },
                 expiredOnly: { type: 'boolean', description: 'Only consider TTL-expired entries' },
-                namespace: { type: 'string', description: 'Restrict cleanup to one namespace' },
+                namespace: { type: 'string', description: 'Restrict cleanup to one namespace. Naming a durable namespace (learnings, knowledge) also opts it back into the age-based buckets it is exempt from by default.' },
             },
         },
         handler: async (input) => {
@@ -308,10 +309,28 @@ export const memoryAdminTools = [
             const now = Date.now();
             const nsClause = namespace ? ` AND namespace = ${sqlString(namespace)}` : '';
             const select = (cond) => `SELECT key, namespace FROM memory_entries WHERE status = 'active' AND ${cond}${nsClause}`;
+            // #1464 — durable namespaces are exempt from the two AGE-based buckets
+            // unless the caller names one explicitly.
+            //
+            // Age is not evidence of worthlessness for a learning: a two-year-old
+            // architectural decision is routinely the most valuable row in the store.
+            // Worse, `COALESCE(last_accessed_at, updated_at, created_at)` collapses to
+            // `created_at` for any row nothing has ever bumped — and until #1464 the
+            // search path, which is how learnings are actually read, bumped nothing.
+            // So "stale (unused)" silently meant "old", and the only purge surface
+            // moflo ships hit the most-consulted learnings exactly as hard as the dead
+            // ones.
+            //
+            // A DEFAULT, not a prohibition — `--namespace learnings` still collects
+            // them. TTL-expired rows stay in scope in every namespace; durable rows
+            // never set a TTL, so nothing durable is lost through that bucket.
+            const exemptDurable = !namespace;
+            const durableIn = DURABLE_NAMESPACES.map(sqlString).join(', ');
+            const durableClause = exemptDurable ? ` AND namespace NOT IN (${durableIn})` : '';
             const expired = await query(select(`expires_at IS NOT NULL AND expires_at < ${now}`));
-            const stale = !expiredOnly && staleMs != null
-                ? await query(select(`expires_at IS NULL AND COALESCE(last_accessed_at, updated_at, created_at) < ${now - staleMs}`))
-                : [];
+            const ageCutoff = staleMs != null ? now - staleMs : null;
+            const staleCond = ageCutoff == null ? null
+                : `expires_at IS NULL AND COALESCE(last_accessed_at, updated_at, created_at) < ${ageCutoff}`;
             // "Unusable" = no embedding (so invisible to semantic search), never
             // read back, AND older than the caller's cutoff.
             //
@@ -321,10 +340,27 @@ export const memoryAdminTools = [
             // selected the entire store for deletion by default. Requiring an
             // explicit cutoff means an unqualified cleanup can only ever remove
             // TTL-expired rows.
-            const lowQuality = !expiredOnly && staleMs != null
-                ? await query(select(`embedding IS NULL AND COALESCE(access_count, 0) = 0 ` +
-                    `AND COALESCE(last_accessed_at, updated_at, created_at) < ${now - staleMs}`))
+            const lowQualityCond = ageCutoff == null ? null
+                : `embedding IS NULL AND COALESCE(access_count, 0) = 0 `
+                    + `AND COALESCE(last_accessed_at, updated_at, created_at) < ${ageCutoff}`;
+            const ageBuckets = !expiredOnly && staleCond != null && lowQualityCond != null;
+            const stale = ageBuckets ? await query(select(staleCond + durableClause)) : [];
+            const lowQuality = ageBuckets ? await query(select(lowQualityCond + durableClause)) : [];
+            // Count what the exemption withheld. Without this the operator reads a
+            // clean result as "learnings are already tidy" rather than "learnings were
+            // not examined" — the same class of quiet lie the missing usage signal was.
+            //
+            // The TTL exclusion is not cosmetic: `lowQualityCond` does not test
+            // `expires_at`, so without it a durable row with an elapsed TTL would be
+            // reported as held back in the same call that deletes it through the
+            // expired bucket.
+            const heldBackRows = ageBuckets && exemptDurable
+                ? await query(`SELECT COUNT(*) FROM memory_entries WHERE status = 'active'`
+                    + ` AND namespace IN (${durableIn})`
+                    + ` AND NOT (expires_at IS NOT NULL AND expires_at < ${now})`
+                    + ` AND ((${staleCond}) OR (${lowQualityCond}))`)
                 : [];
+            const durableHeldBack = heldBackRows.length ? Number(heldBackRows[0][0] ?? 0) : 0;
             const seen = new Set();
             const targets = [];
             for (const rows of [expired, stale, lowQuality]) {
@@ -348,6 +384,7 @@ export const memoryAdminTools = [
                 return {
                     dryRun: true,
                     candidates,
+                    durableHeldBack,
                     deleted: { entries: 0 },
                     freed: { bytes: 0, formatted: '0 B' },
                     duration: Date.now() - started,
@@ -365,6 +402,7 @@ export const memoryAdminTools = [
             return {
                 dryRun: false,
                 candidates,
+                durableHeldBack,
                 deleted: { entries: deleted },
                 freed: { bytes: freedBytes, formatted: formatBytes(freedBytes) },
                 duration: Date.now() - started,

package/dist/src/cli/mcp-tools/moflodb-tools.js

@@ -433,17 +433,38 @@ export const moflodbConsolidate = {
         }
     },
 };
-// ===== moflodb_batch — Batch operations (insert, update, delete) =====
+// ===== moflodb_batch — Batch insert into the episodes store =====
+/**
+ * `update` and `delete` were removed in #1465 — both reported `success: true`
+ * with a count taken from the input array while changing nothing the caller
+ * could address. Rejected here, at the tool boundary, naming the tool that
+ * does the job.
+ *
+ * A Map, not an object literal: `operation` is caller-controlled, and a plain
+ * object would resolve 'constructor'/'toString'/'__proto__' up the prototype
+ * chain to a truthy function, returning an error whose message JSON-serializes
+ * to nothing.
+ */
+const REMOVED_BATCH_OPERATIONS = new Map([
+    [
+        'delete',
+        "moflodb_batch no longer supports 'delete' (#1465): it targeted the episodes store and could not address a namespaced memory entry, while reporting success. Use memory_delete with an explicit namespace.",
+    ],
+    [
+        'update',
+        "moflodb_batch no longer supports 'update' (#1465): it targeted the episodes store and could not address a namespaced memory entry, while reporting success. Use memory_store to overwrite an entry.",
+    ],
+]);
 export const moflodbBatch = {
     name: 'moflodb_batch',
-    description: 'Batch operations on memory entries (insert, update, delete)',
+    description: 'Batch-insert episodes into the MofloDb bridge store. Use memory_delete to remove entries and memory_store to overwrite them.',
     inputSchema: {
         type: 'object',
         properties: {
             operation: {
                 type: 'string',
-                description: 'Batch operation type',
-                enum: ['insert', 'update', 'delete'],
+                description: "Batch operation type. Only 'insert' is supported; 'update'/'delete' were removed in #1465.",
+                enum: ['insert'],
             },
             entries: {
                 type: 'array',
@@ -465,8 +486,11 @@ export const moflodbBatch = {
             const operation = validateString(params.operation, 'operation', 20);
             if (!operation)
                 return { success: false, error: 'operation is required (string)' };
-            if (!['insert', 'update', 'delete'].includes(operation)) {
-                return { success: false, error: `Invalid operation: ${operation}. Must be insert, update, or delete` };
+            const removed = REMOVED_BATCH_OPERATIONS.get(operation);
+            if (removed)
+                return { success: false, error: removed };
+            if (operation !== 'insert') {
+                return { success: false, error: `Invalid operation: ${operation}. Must be insert` };
             }
             if (!Array.isArray(params.entries) || params.entries.length === 0) {
                 return { success: false, error: 'entries is required (non-empty array)' };

package/dist/src/cli/memory/bridge-entries.js

@@ -10,6 +10,7 @@
 import { cosineSim, execRows, generateId, logBridgeError, persistBridgeDb, refreshVectorStatsCache, searchCandidateCap, withDb } from './bridge-core.js';
 import { embeddingResponseFrom, getBridgeEmbedder, resolveBridgeEmbedding } from './bridge-embedder.js';
 import { errorDetail } from '../shared/utils/error-detail.js';
+import { archiveDurableRow, isDurableNamespace } from '../services/durable-store-io.js';
 /**
  * Run `persistBridgeDb` and convert any throw into a `persist failed:`
  * error string for the caller. Centralises the #982 single-store /
@@ -59,6 +60,112 @@ function makeEntryCacheKey(namespace, key) {
  * trade; a systematic undercount of HOT keys — the #1396 defect — is not.
  */
 const ACCESS_FLUSH_INTERVAL_MS = 30_000;
+/**
+ * The access bump, shared by the two throttles that issue it. Adding the
+ * accumulated delta in SQL — rather than writing a client-computed absolute —
+ * is what keeps the counter correct under concurrency, so the statement is
+ * written once and reused rather than retyped per call site.
+ */
+const ACCESS_BUMP_SQL = `UPDATE memory_entries SET access_count = access_count + ?, last_accessed_at = ? WHERE id = ?`;
+/**
+ * Deferred `access_count` deltas for rows returned by SEARCH, per database.
+ *
+ * #1464 — `memory_search` is the read path for durable learnings (CLAUDE.md
+ * routes every prompt through it before any other read), but nothing on that
+ * path recorded usage: `access_count` / `last_accessed_at` moved only on
+ * retrieve-by-key. The most-consulted learning in the store looked untouched
+ * since the day it was written, which in turn made every age-based cleanup
+ * heuristic a guess dressed up as a measurement.
+ *
+ * Scoped to DURABLE namespaces on purpose. Structural namespaces (code-map,
+ * patterns, tests) are re-indexed wholesale on a schedule and their usage
+ * counts are noise — paying a write for them would tax the hot path to record
+ * nothing anyone reads.
+ *
+ * KEYED BY THE DATABASE HANDLE, not module-global. Entry ids are only
+ * meaningful inside the store that issued them, so a process that reaches a
+ * second database — a `dbPath` override, or a bridge rebuilt against a
+ * different project root — must not carry the first one's deltas across.
+ * Module-global state would flush ids that match nothing in the new store and
+ * then clear them, silently discarding counts against the "defer, never lose"
+ * rule below. A WeakMap also means a torn-down bridge's state is collected with
+ * its handle rather than accumulating for the life of the daemon, and each test
+ * gets clean state from its own database with no reset hook to remember.
+ *
+ * Same trade as the per-key entry-cache throttle below: defer writes, never
+ * lose counts. The flush stamp is per DATABASE rather than per key because a
+ * search touches a whole result set at once — the unit being coalesced here is
+ * the search, not the key.
+ */
+const searchAccessByDb = new WeakMap();
+/**
+ * Hard bound on one database's pending deltas. Durable namespaces are small, so
+ * this is a backstop rather than a working limit — but an unbounded map inside
+ * a daemon that lives for days is a leak regardless of how unlikely it is to
+ * fill. Reaching the cap forces a flush; it never drops deltas.
+ */
+const SEARCH_ACCESS_PENDING_CAP = 1_000;
+/**
+ * Accumulate one access per returned durable row, flushing at most once per
+ * {@link ACCESS_FLUSH_INTERVAL_MS}.
+ *
+ * `ids` are already filtered to durable rows by the caller, which is also where
+ * the per-row namespace test happens — a structural hit never reaches this map.
+ * Call with an empty array to give a pending set its chance to flush.
+ *
+ * Best-effort by construction: a throw leaves the deltas pending for the next
+ * attempt and search results are returned either way. Usage is observability,
+ * not correctness — #1058 is the standing proof of what happens when the read
+ * path takes on a write obligation it cannot honour safely. What it issues is a
+ * bounded per-row UPDATE, never the whole-DB `db.export()` writeback that
+ * clobbered concurrent writers.
+ */
+function recordSearchAccess(db, ids, now) {
+    let state = searchAccessByDb.get(db);
+    if (!state) {
+        // Nothing to record and nothing pending — don't allocate state for a
+        // database whose searches never return a durable row.
+        if (ids.length === 0)
+            return;
+        state = { deltas: new Map(), lastFlushAt: 0 };
+        searchAccessByDb.set(db, state);
+    }
+    for (const id of ids)
+        state.deltas.set(id, (state.deltas.get(id) ?? 0) + 1);
+    if (state.deltas.size === 0)
+        return;
+    // A database this process has never flushed writes immediately rather than
+    // waiting out the interval — moflo's CLI processes are short-lived and would
+    // otherwise exit with every access still pending, reintroducing the silent
+    // undercount this exists to remove.
+    const forced = state.deltas.size >= SEARCH_ACCESS_PENDING_CAP;
+    if (!forced && now - state.lastFlushAt < ACCESS_FLUSH_INTERVAL_MS)
+        return;
+    try {
+        const stmt = db.prepare(ACCESS_BUMP_SQL);
+        db.run('BEGIN');
+        try {
+            for (const [id, delta] of state.deltas)
+                stmt.run([delta, now, id]);
+            db.run('COMMIT');
+        }
+        catch (err) {
+            try {
+                db.run('ROLLBACK');
+            }
+            catch { /* a failed COMMIT already ended the txn */ }
+            throw err;
+        }
+        // Clear ONLY after the commit lands. Clearing on a throw would discard the
+        // accumulated hits outright — the throttle defers writes, it does not drop
+        // them.
+        state.deltas.clear();
+        state.lastFlushAt = now;
+    }
+    catch (err) {
+        logBridgeError('search access flush failed', err);
+    }
+}
 /** Normalise `metadata` for the `metadata` TEXT column; `undefined` → `'{}'` (#1064). */
 export function serialiseMetadata(metadata) {
     if (metadata == null)
@@ -544,6 +651,15 @@ export async function bridgeSearchEntries(options) {
         const { termDocFreqs, avgDocLength } = computeTermDocFreqs(queryTerms, rows);
         const docCount = rows.length;
         const results = [];
+        // #1464 — usage recording needs the FULL row id; the emitted `id` above is
+        // truncated to 12 chars for the envelope and would match no row. Keyed by
+        // the result object rather than by index because `results` is sorted and
+        // sliced before the returned set is known. Never spread into the response.
+        //
+        // Null for a namespace-scoped search of a structural namespace: nothing it
+        // returns can be durable, so it skips the bookkeeping outright rather than
+        // testing every row against a set that will never match.
+        const durableIdByResult = namespace === 'all' || isDurableNamespace(namespace) ? new Map() : null;
         for (const row of rows) {
             let semanticScore = 0;
             let bm25ScoreVal = 0;
@@ -568,7 +684,7 @@ export async function bridgeSearchEntries(options) {
                     ? `semantic:${semanticScore.toFixed(3)}+bm25:${bm25ScoreVal.toFixed(3)}`
                     : `bm25:${bm25ScoreVal.toFixed(3)}`;
                 const metadataStr = row.metadata != null ? String(row.metadata) : undefined;
-                results.push({
+                const hit = {
                     id: String(row.id).substring(0, 12),
                     // The substring is a fallback id-prefix when key is missing —
                     // applying it to the full expression truncates valid keys (#845).
@@ -578,13 +694,34 @@ export async function bridgeSearchEntries(options) {
                     namespace: String(row.namespace || 'default'),
                     provenance,
                     metadata: metadataStr,
-                });
+                };
+                results.push(hit);
+                // Per row, not per search: an `all`-namespace search returns mostly
+                // structural hits, and storing an id only to discard it at flush time
+                // is work every prompt in every consumer project would pay.
+                if (durableIdByResult && isDurableNamespace(hit.namespace)) {
+                    durableIdByResult.set(hit, String(row.id));
+                }
             }
         }
         results.sort((a, b) => b.score - a.score);
+        const returned = results.slice(0, limit);
+        // #1464 — record usage for the durable rows this search actually returned.
+        // Placed after the slice so an over-fetched candidate the caller never sees
+        // does not count as a read. Called even when this search returned none, so
+        // a set left pending by an earlier search still gets its flush.
+        if (durableIdByResult) {
+            const durableIds = [];
+            for (const r of returned) {
+                const id = durableIdByResult.get(r);
+                if (id)
+                    durableIds.push(id);
+            }
+            recordSearchAccess(ctx.db, durableIds, Date.now());
+        }
         return {
             success: true,
-            results: results.slice(0, limit),
+            results: returned,
             searchTime: Date.now() - startTime,
             searchMethod: queryEmbedding ? 'hybrid-bm25-semantic' : 'bm25-only',
         };
@@ -700,7 +837,8 @@ export async function bridgeGetEntry(options) {
             const lastFlushAt = cached.lastAccessFlushAt ?? 0;
             if (now - lastFlushAt >= ACCESS_FLUSH_INTERVAL_MS) {
                 try {
-                    ctx.db.prepare(`UPDATE memory_entries SET access_count = access_count + ?, last_accessed_at = ? WHERE id = ?`).run([cached.pendingAccessDelta, now, String(cached.id || '')]);
+                    ctx.db.prepare(ACCESS_BUMP_SQL)
+                        .run([cached.pendingAccessDelta, now, String(cached.id || '')]);
                     // Clear ONLY after the write lands. Clearing on a throw would discard
                     // the accumulated hits outright — the throttle defers writes, it does
                     // not drop them.
@@ -819,12 +957,22 @@ export async function bridgeDeleteEntry(options) {
         }
         let changes = 0;
         try {
-            ctx.db.prepare(`
-        DELETE FROM memory_entries
-        WHERE key = ? AND namespace = ? AND status = 'active'
-      `).run([key, namespace]);
+            // Durable namespaces archive rather than hard-delete, so the deletion can
+            // reach the team artifact and sibling worktrees (#1463). Same rule as the
+            // offline path in `entries-write.deleteEntry` — see the rationale there.
+            if (isDurableNamespace(namespace)) {
+                archiveDurableRow(ctx.db, namespace, key, Date.now());
+            }
+            else {
+                ctx.db.prepare(`
+          DELETE FROM memory_entries
+          WHERE key = ? AND namespace = ? AND status = 'active'
+        `).run([key, namespace]);
+            }
             // sql.js Statement.run returns true/false, not { changes }. Use
-            // db.getRowsModified() to read the row count from the last statement.
+            // db.getRowsModified() to read the row count from the last statement —
+            // an UPDATE reports rows affected the same way, so the zero-rows
+            // inconsistency check below covers the archive path too.
             changes = ctx.db.getRowsModified?.() ?? 0;
         }
         catch (err) {

package/dist/src/cli/memory/controllers/batch-operations.js

@@ -6,8 +6,13 @@
  *
  * Consumer surface (from src/cli/memory/memory-bridge.ts):
  *   - insertEpisodes([{content, metadata?, embedding?}])
- *   - bulkDelete(table, conditions)
- *   - bulkUpdate(table, updates, conditions)
+ *
+ * bulkDelete/bulkUpdate remain here — they report rows actually affected and
+ * are covered by this controller's tests — but #1465 removed their only
+ * caller. `moflodb_batch` routed them at the `episodes` store through a schema
+ * with no `namespace`, so they could not address a caller's `memory_entries`
+ * row; entry deletion belongs to `memory_delete`. Do not re-wire a bridge
+ * operation to them without a namespace-aware target.
  *
  * Only the `episodes` table is whitelisted for delete/update to keep the
  * SQL surface narrow; attempts to target any other table throw.