moflo 4.13.2 → 4.13.4

package/bin/build-embeddings.mjs

@@ -20,7 +20,7 @@ import { existsSync, readFileSync } from 'fs';
 import { mofloInternalURL } from './lib/moflo-resolve.mjs';
 import { memoryDbPath, hnswIndexPath, findProjectRoot } from './lib/moflo-paths.mjs';
 import { openBackend } from './lib/get-backend.mjs';
-import { PENDING_EMBEDDING_WHERE } from './lib/embedding-backlog.mjs';
+import { DELIBERATELY_UNEMBEDDED_WHERE, EMBEDDABLE_WHERE, PENDING_EMBEDDING_WHERE } from './lib/embedding-backlog.mjs';
 const FASTEMBED_INLINE = 'dist/src/cli/embeddings/fastembed-inline/index.js';
 const BRIDGE_CORE = 'dist/src/cli/memory/bridge-core.js';
 const HNSW_PERSISTENCE = 'dist/src/cli/memory/hnsw-persistence.js';
@@ -100,12 +100,12 @@ function saveDb(db) {
 // The backlog clause is imported, not restated (#1383): the indexer gate asks
 // this exact question to decide whether to run this script at all, and a gate
 // that approximates its step's own query is how new chunks got left unembedded
-// in the first place. `PENDING_EMBEDDING_WHERE` already carries `status =
-// 'active'`, so the non-forced branch below replaces the base clause rather
-// than appending to it.
+// in the first place. Both clauses carry `status = 'active'` and exclude rows
+// deliberately left unembedded (ephemeral namespaces, opt-outs — #1492), so
+// `--force` re-embeds everything embeddable without resurrecting those.
 function getEntriesNeedingEmbeddings(db, namespace, forceAll) {
   let sql = `SELECT id, key, namespace, content FROM memory_entries WHERE `
-    + (forceAll ? `status = 'active'` : PENDING_EMBEDDING_WHERE);
+    + (forceAll ? EMBEDDABLE_WHERE : PENDING_EMBEDDING_WHERE);
   const params = [];
 
   if (namespace) {
@@ -136,7 +136,7 @@ function getNamespaceStats(db) {
       namespace,
       COUNT(*) as total,
       SUM(CASE WHEN embedding IS NOT NULL AND embedding != '' THEN 1 ELSE 0 END) as vectorized,
-      SUM(CASE WHEN embedding IS NULL OR embedding = '' THEN 1 ELSE 0 END) as missing
+      SUM(CASE WHEN (embedding IS NULL OR embedding = '') AND NOT ${DELIBERATELY_UNEMBEDDED_WHERE} THEN 1 ELSE 0 END) as missing
     FROM memory_entries
     WHERE status = 'active'
     GROUP BY namespace

package/bin/lib/embedding-backlog.mjs

@@ -26,16 +26,65 @@ import { existsSync } from 'node:fs';
 import { openBackendSync } from './get-backend.mjs';
 import { memoryDbPath } from './moflo-paths.mjs';
 
-/**
- * Rows `build-embeddings` will pick up on its next run. Active rows whose
- * embedding is absent — either NULL (never written) or empty string (a
- * producer that failed and wrote a placeholder).
- */
 /** Retry budget for the probe's read-only open. See {@link hasPendingEmbeddings}. */
 const PROBE_BUSY_TIMEOUT_MS = 2000;
 
+/**
+ * Mirrors of `EPHEMERAL_NAMESPACES` / `EPHEMERAL_NAMESPACE_PREFIXES` /
+ * `EMBEDDING_MODEL_OPT_OUT` in `src/cli/memory/bridge-embedder.ts`. `bin/`
+ * cannot import TypeScript source, so the values are restated here and
+ * `tests/bin/embedding-backfill-ephemeral-1492.test.ts` fails if the two
+ * copies drift.
+ */
+export const EPHEMERAL_NAMESPACES = Object.freeze([
+  'hive-mind',
+  'tasklist',
+  'epic-state',
+  'test-bridge-fix',
+  'swarm-agents',
+  'swarm-topology',
+  'swarm-tasks',
+  'swarm-consensus',
+]);
+export const EPHEMERAL_NAMESPACE_PREFIXES = Object.freeze([]);
+export const EMBEDDING_MODEL_OPT_OUT = 'none';
+
+const sqlString = (s) => `'${s.replace(/'/g, "''")}'`;
+
+/**
+ * Rows written deliberately without an embedding — ephemeral run state and
+ * explicit opt-outs. The writers leave `embedding` NULL for these, which is
+ * indistinguishable from "not embedded yet" unless every backfill excludes
+ * them (#1492). Inlined literals rather than bindings so the clause drops into
+ * any statement unchanged; every value is a compile-time constant above.
+ */
+export const DELIBERATELY_UNEMBEDDED_WHERE = (() => {
+  const clauses = [];
+  if (EPHEMERAL_NAMESPACES.length > 0) {
+    clauses.push(`namespace IN (${EPHEMERAL_NAMESPACES.map(sqlString).join(', ')})`);
+  }
+  for (const prefix of EPHEMERAL_NAMESPACE_PREFIXES) clauses.push(`namespace LIKE ${sqlString(`${prefix}%`)}`);
+  clauses.push(`COALESCE(embedding_model, '') = ${sqlString(EMBEDDING_MODEL_OPT_OUT)}`);
+  // COALESCE to a strict 0/1: `namespace` is nullable and `NULL IN (...)` is
+  // NULL, so every negated use below would silently drop a NULL-namespace row.
+  return `COALESCE((${clauses.join(' OR ')}), 0)`;
+})();
+
+/**
+ * Every row a backfill may embed: active, and not deliberately unembedded.
+ * `build-embeddings --force` selects on this alone.
+ */
+export const EMBEDDABLE_WHERE = `status = 'active' AND NOT ${DELIBERATELY_UNEMBEDDED_WHERE}`;
+
+/**
+ * Rows `build-embeddings` will pick up on its next run. Embeddable rows whose
+ * embedding is absent — either NULL (never written) or empty string (a
+ * producer that failed and wrote a placeholder). The embedding test leads so
+ * the steady-state probe — nearly every row embedded — rejects each row before
+ * evaluating the exclusion.
+ */
 export const PENDING_EMBEDDING_WHERE =
-  `status = 'active' AND (embedding IS NULL OR embedding = '')`;
+  `(embedding IS NULL OR embedding = '') AND ${EMBEDDABLE_WHERE}`;
 
 /**
  * Does the memory DB hold rows that still need embedding?

package/bin/session-start-launcher.mjs

@@ -144,6 +144,13 @@ function emitWarning(message) {
     process.stderr.write(`moflo: ${message}\n`);
   } catch { /* stderr write must not throw */ }
 }
+// Advisory stdout line for a condition the user can act on but the launcher
+// deliberately did not change. Not counted in `mutationCount` — nothing mutated.
+function emitNotice(message) {
+  try {
+    process.stdout.write(`moflo: ${message}\n`);
+  } catch { /* writing must never throw */ }
+}
 function errMessage(err) {
   return err && err.message ? err.message : String(err);
 }
@@ -2438,6 +2445,20 @@ try {
         `${plural(result.superseded, 'stale learnings row')} whose verdict already exists in the verify namespace`,
       );
     }
+    if (result?.stripped > 0) {
+      emitMutation(
+        'unindexed run records',
+        `${plural(result.stripped, 'row')} of run state removed from semantic search`,
+      );
+    }
+    // Report-only (#1495): key shape is a heuristic, so these are never moved
+    // automatically — the audit nominates them for a model verdict.
+    if (result?.runSummaries > 0) {
+      emitNotice(
+        `${result.runSummaries} learning${result.runSummaries === 1 ? ' looks' : 's look'} like per-ticket run summaries, not lessons ` +
+          '— review with `flo memory audit-learnings`',
+      );
+    }
   }
 } catch (err) {
   // Non-fatal — leftover rows just sit until the next session retries.
@@ -2521,6 +2542,12 @@ try {
         `${plural(result.flushedToShared, 'durable entry')} pushed to the shared store`,
       );
     }
+    if (result?.healedShared > 0) {
+      emitMutation(
+        'removed verify records from the shared store',
+        `${plural(result.healedShared, 'row')} that are not learnings`,
+      );
+    }
   }
 } catch (err) {
   // Non-fatal — durable sync reconciles on the next session start.

package/dist/src/cli/commands/doctor-embedding-hygiene.js

@@ -17,7 +17,7 @@
  *      row on the canonical label; this check verifies it actually did.
  *
  * Story #729 carve-out: ephemeral-namespace rows (tasklist, hive-mind,
- * epic-state, test-bridge-fix, plus EPHEMERAL_NAMESPACE_PREFIXES) are
+ * epic-state, swarm-*, …, plus EPHEMERAL_NAMESPACE_PREFIXES) are
  * intentionally written with `embedding IS NULL AND embedding_model IS
  * NULL`. They are excluded from the count so they don't trip branch (4)
  * "unrecognised embedding_model" on every publish — see bridge-embedder.ts
@@ -33,7 +33,7 @@ import { existsSync } from 'fs';
 import { CANONICAL_EMBEDDING_MODEL } from '../embeddings/migration/types.js';
 import { memoryDbCandidatePaths } from '../services/moflo-paths.js';
 import { openDaemonDatabase } from '../memory/daemon-backend.js';
-import { EPHEMERAL_NAMESPACES, EPHEMERAL_NAMESPACE_PREFIXES, } from '../memory/bridge-embedder.js';
+import { ephemeralNamespaceSql } from '../memory/bridge-embedder.js';
 import { resolveStateRoot } from '../services/project-root.js';
 /**
  * Known neural-model labels that all share the all-MiniLM-L6-v2 384-dim
@@ -183,21 +183,9 @@ async function loadModelGroups(dbPath) {
         // embedding_model IS NULL`. Without this exclusion every spell run that
         // logs to `tasklist` re-trips branch (4) "unrecognised embedding_model"
         // on the next publish, even though the writer is doing the right thing.
-        const ephemeralNames = [...EPHEMERAL_NAMESPACES];
-        const ephemeralPrefixes = [...EPHEMERAL_NAMESPACE_PREFIXES];
-        const matchClauses = [];
-        const params = [];
-        if (ephemeralNames.length > 0) {
-            matchClauses.push(`namespace IN (${ephemeralNames.map(() => '?').join(', ')})`);
-            params.push(...ephemeralNames);
-        }
-        for (const prefix of ephemeralPrefixes) {
-            matchClauses.push(`namespace LIKE ?`);
-            params.push(`${prefix}%`);
-        }
-        const ephemeralExclusion = matchClauses.length > 0
-            ? `AND NOT (embedding IS NULL AND embedding_model IS NULL AND (${matchClauses.join(' OR ')}))`
-            : '';
+        const ephemeral = ephemeralNamespaceSql();
+        const params = ephemeral.params;
+        const ephemeralExclusion = `AND NOT (embedding IS NULL AND embedding_model IS NULL AND ${ephemeral.sql})`;
         const sql = `SELECT
          COALESCE(embedding_model, 'NULL') AS model,
          COUNT(*) AS n,

package/dist/src/cli/commands/memory-audit-learnings.js

@@ -23,7 +23,6 @@
  * @module commands/memory-audit-learnings
  */
 import * as fs from 'fs';
-import * as pathModule from 'path';
 import { spawn } from 'child_process';
 import { output } from '../output.js';
 import { confirm } from '../prompt.js';
@@ -33,14 +32,13 @@ import { openDaemonDatabase } from '../memory/daemon-backend.js';
 import { resolveBridgeDbPath } from '../memory/bridge-core.js';
 import { findProjectRoot } from '../services/project-root.js';
 import { hasMemoryEntriesTable } from '../services/cherry-pick-learnings.js';
-import { atomicWriteFileSync } from '../shared/utils/atomic-file-write.js';
 import { hashContent } from '../memory/auto-memory-bridge.js';
 import { listWorkspacePrefixes, makeTreeResolver } from '../memory/learnings-tree.js';
 import { LEARNINGS_NAMESPACE, buildAuditPlan, buildJudgePrompt, parseVerdicts, selectArchivable, selectManualActions, DEFAULT_DUPLICATE_THRESHOLD, DEFAULT_JUDGE_LIMIT, DEFAULT_UNUSED_LIMIT, DEFAULT_UNUSED_MIN_AGE_MS, } from '../memory/learnings-audit.js';
-/** Where recorded verdicts live. Local-only — never part of the shared artifact. */
-export const AUDIT_STATE_FILE = 'learnings-audit.json';
-/** Bump when the record shape changes; an older file is discarded, not migrated. */
-const AUDIT_STATE_VERSION = 1;
+// The verdict record moved to `memory/learnings-audit-state.ts` so the
+// session-start purge can read it (#1495); re-exported for existing callers.
+export { AUDIT_STATE_FILE, readAuditState, writeAuditState } from '../memory/learnings-audit-state.js';
+import { readAuditState, writeAuditState } from '../memory/learnings-audit-state.js';
 /** Cheap formatter/judge model — same tier the auto-meditate distill runs on. */
 const JUDGE_MODEL_ID = 'claude-haiku-4-5-20251001';
 /** Hard ceiling on the headless judge; killed past this. */
@@ -54,39 +52,6 @@ const JUDGE_ALLOWED_TOOLS = 'Read';
  * Claude CLI on PATH.
  */
 export const JUDGE_STUB_ENV = 'MOFLO_AUDIT_LEARNINGS_NODE_STUB';
-function stateFilePath(projectRoot) {
-    return pathModule.join(projectRoot, '.moflo', AUDIT_STATE_FILE);
-}
-/** Read recorded verdicts. Any unreadable or stale-version file reads as empty. */
-export function readAuditState(projectRoot) {
-    try {
-        const raw = fs.readFileSync(stateFilePath(projectRoot), 'utf-8');
-        const parsed = JSON.parse(raw);
-        if (parsed?.version !== AUDIT_STATE_VERSION || !parsed.decided)
-            return new Map();
-        return new Map(Object.entries(parsed.decided));
-    }
-    catch {
-        // Absent, truncated, or hand-edited into invalid JSON. Losing the record
-        // costs one re-judgement; refusing to run over it costs the command.
-        return new Map();
-    }
-}
-/**
- * Write the verdict record back.
- *
- * Read-modify-write with no lock: two `--apply` runs racing on the same project
- * would lose one run's verdicts. Not worth a lock — this is a hand-invoked
- * curation command, the loss costs one re-judgement, and `atomicWriteFileSync`
- * already rules out a torn file (its temp name is pid- and random-suffixed, so
- * concurrent writers cannot clobber each other's staging file either).
- */
-export function writeAuditState(projectRoot, decided) {
-    const file = stateFilePath(projectRoot);
-    fs.mkdirSync(pathModule.dirname(file), { recursive: true });
-    const payload = { version: AUDIT_STATE_VERSION, decided: Object.fromEntries(decided) };
-    atomicWriteFileSync(file, `${JSON.stringify(payload, null, 2)}\n`);
-}
 /**
  * Parse a stored embedding. A malformed vector reads as absent rather than
  * throwing — one bad row must not take the whole audit down.
@@ -222,6 +187,7 @@ function printPlan(plan, deadPathsScanned) {
             { bucket: 'Unused and old', count: plan.counts.unused },
             { bucket: 'Superseded vocabulary', count: plan.counts.superseded },
             { bucket: 'Dead path reference', count: plan.counts.deadPath },
+            { bucket: 'Run summary (ticket-shaped key)', count: plan.counts.runSummary },
             { bucket: output.bold('To judge'), count: output.bold(String(plan.candidates.length)) },
         ],
     });

package/dist/src/cli/commands/memory.js

@@ -1888,9 +1888,13 @@ const rebuildIndexCommand = {
         output.writeln(output.bold('Rebuilding Embedding Index'));
         output.writeln(output.dim('─'.repeat(50)));
         const { db, dbPath } = await openDb(cwd);
-        // Build query
-        let sql = `SELECT id, key, namespace, content FROM memory_entries WHERE status = 'active'`;
-        const params = [];
+        // Build query. Rows deliberately left unembedded (ephemeral namespaces,
+        // explicit opt-outs) are excluded even under --force: NULL there means
+        // "never embed", not "not embedded yet" (#1492).
+        const { backfillExclusionSql } = await import('../memory/bridge-embedder.js');
+        const exclusion = backfillExclusionSql();
+        let sql = `SELECT id, key, namespace, content FROM memory_entries WHERE status = 'active' ${exclusion.sql}`;
+        const params = [...exclusion.params];
         if (!forceAll) {
             sql += ` AND (embedding IS NULL OR embedding = '')`;
         }
@@ -2537,6 +2541,8 @@ const teamExportCommand = {
                 changes.push(`${report.deleted} retired`);
             if (report.resurrected > 0)
                 changes.push(`${report.resurrected} restored`);
+            if (report.droppedMisfiled > 0)
+                changes.push(`${report.droppedMisfiled} verify record${report.droppedMisfiled === 1 ? '' : 's'} removed (not learnings, #1495)`);
             if (changes.length > 0)
                 output.printInfo(`Also propagated: ${changes.join(', ')}.`);
             if (report.keptRemote > 0) {
@@ -2612,6 +2618,9 @@ const teamImportCommand = {
             if (report.skippedCorrupt > 0) {
                 output.printWarning(`${report.skippedCorrupt} artifact line${report.skippedCorrupt === 1 ? '' : 's'} NOT imported — captured tool-call markup in the content (#1467).`);
             }
+            if (report.skippedMisfiled > 0) {
+                output.printInfo(`${report.skippedMisfiled} verify record${report.skippedMisfiled === 1 ? '' : 's'} in the artifact ignored (not learnings, #1495) — \`flo memory team-export\` removes them.`);
+            }
             if (report.skippedNonDurable > 0) {
                 output.printWarning(`${report.skippedNonDurable} non-durable entr${report.skippedNonDurable === 1 ? 'y' : 'ies'} skipped (only learnings/knowledge are shared).`);
             }

package/dist/src/cli/memory/bridge-embedder.js

@@ -53,6 +53,18 @@ export const EMBEDDING_MODEL_LEGACY_DEFAULT = 'local';
  * - `tasklist`      — Spell run records (sp-*) written by spells/core/runner.ts + daemon-dashboard.ts
  * - `epic-state`    — Epic progress (epic-N, story-M) written by commands/epic.ts
  * - `test-bridge-fix` — Single 2026-04-23 row left over from a one-off test
+ * - `swarm-agents`, `swarm-topology`, `swarm-tasks`, `swarm-consensus` —
+ *   coordinator state written through by `swarm/swarm-persistence.ts` and
+ *   read back by key on hydrate, never by similarity (#1492). Embed-skip
+ *   ONLY: they are deliberately absent from the purge sets below, because the
+ *   swarm must survive an MCP-server restart (Story #806).
+ *
+ * The rule is enforced at write time AND at backfill time. The writers leave
+ * `embedding` NULL; every backfill selector (`bin/build-embeddings.mjs`, the
+ * backlog probe in `bin/lib/embedding-backlog.mjs`, `flo memory rebuild-index`)
+ * excludes these rows via {@link backfillExclusionSql} or its `bin/` mirror —
+ * otherwise NULL reads as "not embedded yet" and the backfill embeds them
+ * anyway (#1492). The `bin/` copy is parity-guarded against this set.
  *
  * Membership is also extended by {@link EPHEMERAL_NAMESPACE_PREFIXES} for
  * dynamic-name namespaces (e.g. `doctor-memprobe-<persona>`). Most callers
@@ -70,6 +82,10 @@ export const EPHEMERAL_NAMESPACES = new Set([
     'tasklist',
     'epic-state',
     'test-bridge-fix',
+    'swarm-agents',
+    'swarm-topology',
+    'swarm-tasks',
+    'swarm-consensus',
 ]);
 /**
  * Prefix patterns that extend {@link EPHEMERAL_NAMESPACES} for namespaces
@@ -146,6 +162,47 @@ export function isEphemeralNamespace(namespace) {
     }
     return false;
 }
+/**
+ * SQL match for a namespace set: exact `names` or any `prefixes` (as
+ * `LIKE 'p%'`). Returned parenthesised with positional bindings so callers can
+ * wrap it in `NOT (...)` or use it as a positive filter; an empty set matches
+ * nothing.
+ */
+export function namespaceMatchSql(names, prefixes) {
+    const exact = [...names];
+    const likes = [...prefixes].map((p) => `${p}%`);
+    const clauses = [];
+    // Bare column, not COALESCE'd, so positive filters (the session-start purge)
+    // keep using the namespace index. Negate via `NOT COALESCE(match, 0)`.
+    if (exact.length > 0)
+        clauses.push(`namespace IN (${exact.map(() => '?').join(', ')})`);
+    for (let i = 0; i < likes.length; i++)
+        clauses.push('namespace LIKE ?');
+    return {
+        sql: clauses.length > 0 ? `(${clauses.join(' OR ')})` : '(0)',
+        params: [...exact, ...likes],
+    };
+}
+/** {@link namespaceMatchSql} over the ephemeral (embed-skip) namespaces. */
+export function ephemeralNamespaceSql() {
+    return namespaceMatchSql(EPHEMERAL_NAMESPACES, EPHEMERAL_NAMESPACE_PREFIXES);
+}
+/**
+ * `AND ...` fragment every embedding backfill appends to its selector (#1492):
+ * skip ephemeral namespaces and rows a writer explicitly opted out of
+ * (`embedding_model = 'none'`). Both write a NULL `embedding` that means
+ * "deliberately unembedded", which the backfill must not read as "pending".
+ * Mirrored in `bin/lib/embedding-backlog.mjs` (parity-guarded).
+ */
+export function backfillExclusionSql() {
+    const ephemeral = ephemeralNamespaceSql();
+    return {
+        // COALESCE: `namespace` is nullable and `NOT (NULL IN (...))` is NULL,
+        // which would silently drop a NULL-namespace row from the backfill.
+        sql: `AND NOT COALESCE(${ephemeral.sql}, 0) AND COALESCE(embedding_model, '') <> ?`,
+        params: [...ephemeral.params, EMBEDDING_MODEL_OPT_OUT],
+    };
+}
 /**
  * Return `true` if a namespace should be hard-purged on session start —
  * either an exact member of {@link PURGE_ON_SESSION_START_NAMESPACES} or one

package/dist/src/cli/memory/learnings-audit-state.js

@@ -0,0 +1,53 @@
+/**
+ * The verdict record `flo memory audit-learnings --apply` keeps between runs
+ * (#1466), at `.moflo/learnings-audit.json`.
+ *
+ * Carved out of the command so the session-start purge can read it without
+ * importing CLI command machinery: the purge's run-summary count (#1495) skips
+ * keys a human already judged, so the notice clears once the store is curated.
+ *
+ * Local-only — never part of the shared artifact.
+ *
+ * @module memory/learnings-audit-state
+ */
+import * as fs from 'fs';
+import * as path from 'path';
+import { atomicWriteFileSync } from '../shared/utils/atomic-file-write.js';
+/** Where recorded verdicts live, under `.moflo/`. */
+export const AUDIT_STATE_FILE = 'learnings-audit.json';
+/** Bump when the record shape changes; an older file is discarded, not migrated. */
+const AUDIT_STATE_VERSION = 1;
+function stateFilePath(projectRoot) {
+    return path.join(projectRoot, '.moflo', AUDIT_STATE_FILE);
+}
+/** Read recorded verdicts. Any unreadable or stale-version file reads as empty. */
+export function readAuditState(projectRoot) {
+    try {
+        const raw = fs.readFileSync(stateFilePath(projectRoot), 'utf-8');
+        const parsed = JSON.parse(raw);
+        if (parsed?.version !== AUDIT_STATE_VERSION || !parsed.decided)
+            return new Map();
+        return new Map(Object.entries(parsed.decided));
+    }
+    catch {
+        // Absent, truncated, or hand-edited into invalid JSON. Losing the record
+        // costs one re-judgement; refusing to run over it costs the command.
+        return new Map();
+    }
+}
+/**
+ * Write the verdict record back.
+ *
+ * Read-modify-write with no lock: two `--apply` runs racing on the same project
+ * would lose one run's verdicts. Not worth a lock — this is a hand-invoked
+ * curation command, the loss costs one re-judgement, and `atomicWriteFileSync`
+ * already rules out a torn file (its temp name is pid- and random-suffixed, so
+ * concurrent writers cannot clobber each other's staging file either).
+ */
+export function writeAuditState(projectRoot, decided) {
+    const file = stateFilePath(projectRoot);
+    fs.mkdirSync(path.dirname(file), { recursive: true });
+    const payload = { version: AUDIT_STATE_VERSION, decided: Object.fromEntries(decided) };
+    atomicWriteFileSync(file, `${JSON.stringify(payload, null, 2)}\n`);
+}
+//# sourceMappingURL=learnings-audit-state.js.map

package/dist/src/cli/memory/learnings-audit.js

@@ -33,9 +33,10 @@
 // audit's public surface — a caller configuring the pass should not have to
 // know which file the detector was carved into.
 import { findDeadPaths } from './learnings-dead-paths.js';
+import { isRunSummaryKey, LEARNINGS_NAMESPACE } from '../services/durable-key-rules.js';
 export { DEFAULT_DEAD_PATHS_PER_ENTRY, extractCandidatePaths, findDeadPaths, resolvesInTree, } from './learnings-dead-paths.js';
 /** The namespace this audit is scoped to. */
-export const LEARNINGS_NAMESPACE = 'learnings';
+export { LEARNINGS_NAMESPACE };
 export const AUDIT_VERDICTS = ['KEEP', 'RETIRE', 'COMPRESS', 'MERGE'];
 /**
  * Retired vocabulary. **Ships empty, and a guard test keeps it that way.**
@@ -238,11 +239,18 @@ export function buildAuditPlan(rows, options = {}) {
         const candidate = nominate(hit.row, 'dead-path');
         candidate.deadPaths = hit.deadPaths;
     }
+    // A run summary is git history stored as a learning (#1495). The key shape
+    // only nominates — a lesson can carry its ticket number as provenance, which
+    // is the case the model verdict tells apart.
+    const runSummaries = pending.filter((row) => isRunSummaryKey(row.key));
+    for (const row of runSummaries)
+        nominate(row, 'run-summary');
     const counts = {
         duplicate: duplicates.length,
         unused: unused.length,
         superseded: superseded.length,
         deadPath: deadPaths.length,
+        runSummary: runSummaries.length,
     };
     // Most-nominated first, then oldest — an entry three passes agree on is the
     // one a bounded prompt should spend its budget on.
@@ -273,6 +281,9 @@ function describeBuckets(candidate) {
         else if (bucket === 'dead-path') {
             parts.push(`cites path(s) that resolve nowhere in the tree: ${(candidate.deadPaths ?? []).join(', ')}`);
         }
+        else if (bucket === 'run-summary') {
+            parts.push('key is shaped like a per-ticket run summary');
+        }
         else {
             const terms = (candidate.supersededTerms ?? [])
                 .map((t) => `"${t.from}" → "${t.to}"`)
@@ -339,6 +350,10 @@ export function buildJudgePrompt(candidates, now = Date.now()) {
         '| Deleted, but the lesson generalises past it | COMPRESS — drop the path, keep the rule |',
         '| The entry is a historical record, correct as written | KEEP |',
         '',
+        'A run-summary flag means the key looks like a ticket record ("flo-123-...", "...-done").',
+        'What one ticket changed is git history, not a lesson: RETIRE it unless the content states a',
+        'rule that would help a DIFFERENT task, in which case COMPRESS it down to that rule.',
+        '',
         `Answer with exactly ${candidates.length} line(s), nothing else. One line per entry:`,
         '',
         '<key><TAB><VERDICT><TAB><reason in under 15 words>',

package/dist/src/cli/services/durable-key-rules.js

@@ -0,0 +1,70 @@
+/**
+ * Rows that must never live in a durable namespace, whichever store they are in
+ * (#1495).
+ *
+ * #1375 moved `verify:*` verdict records out of `learnings`, but only in the
+ * local `.moflo/moflo.db`. The same rows still sat in the two durable copies —
+ * the worktree shared store (`<git-common-dir>/moflo/durable.db`) and the team
+ * JSONL artifact — and the session-start seed and import wrote them straight
+ * back. The cleanup ran on every session and never converged, because each
+ * store was healed by its own code path and none of the sync paths knew the
+ * rule.
+ *
+ * This module is the ONE statement of the rule. The sync boundary applies it
+ * (`readDurableSnapshot` never returns a misfiled row, so no flush, seed,
+ * import or export can carry one), the shared store and artifact drop what they
+ * already hold, and the local purge relocates or drops the local copy. A new
+ * relocation rule is a new entry in {@link MISFILED_DURABLE_RULES} — never a
+ * new clause in one store's cleanup, which is the shape that failed.
+ *
+ * Pure: no fs, no sqlite.
+ *
+ * @module cli/services/durable-key-rules
+ */
+import { VERIFY_RECORD_NAMESPACE } from '../memory/bridge-embedder.js';
+/** The durable namespace user-authored lessons live in. */
+export const LEARNINGS_NAMESPACE = 'learnings';
+/** Every rule. `/verify` verdicts used to be written to `learnings` (#1375). */
+export const MISFILED_DURABLE_RULES = [
+    { namespace: LEARNINGS_NAMESPACE, keyPrefix: `${VERIFY_RECORD_NAMESPACE}:`, relocateTo: VERIFY_RECORD_NAMESPACE },
+];
+/** True when `(namespace, key)` is a row no durable store should hold. */
+export function isMisfiledDurable(namespace, key) {
+    return MISFILED_DURABLE_RULES.some((r) => r.namespace === namespace && key.startsWith(r.keyPrefix));
+}
+/** SQL predicate matching the rows of ONE rule — the only place its shape is spelled. */
+export function misfiledRuleSql(rule) {
+    return { sql: '(namespace = ? AND key GLOB ?)', params: [rule.namespace, `${rule.keyPrefix}*`] };
+}
+/**
+ * SQL predicate matching every misfiled row, with its bindings. Callers negate
+ * it (`NOT (...)`) to read a clean durable slice, or use it as-is to delete.
+ */
+export function misfiledDurableSql() {
+    if (MISFILED_DURABLE_RULES.length === 0)
+        return { sql: '0', params: [] };
+    const parts = MISFILED_DURABLE_RULES.map(misfiledRuleSql);
+    return { sql: `(${parts.map((p) => p.sql).join(' OR ')})`, params: parts.flatMap((p) => p.params) };
+}
+/**
+ * Key shapes of a per-ticket run summary stored as a learning: `flo-2595-...`,
+ * `2679-...`, or a `-done`/`-complete`/`-shipped`/`-merged` suffix.
+ *
+ * A heuristic on key shape only, which is why nothing moves on it
+ * automatically: the session start COUNTS matches, and
+ * `flo memory audit-learnings` nominates them for a verdict. Content is not
+ * consulted — a real lesson can open with a ticket number as provenance
+ * (`1145-daemon-port-collision-fix`), and that is exactly the case a model
+ * verdict exists to tell apart.
+ */
+const TICKET_PREFIX = /^(?:flo-)?\d{3,5}-/;
+const STATUS_SUFFIX = /-(?:done|complete|completed|shipped|merged)$/;
+/** A date-prefixed key (`2026-09-28-...`) is a dated note, not a ticket number. */
+const DATE_PREFIX = /^\d{4}-\d{2}-\d{2}(?:\D|$)/;
+/** True when a `learnings` key looks like a per-ticket run summary. */
+export function isRunSummaryKey(key) {
+    if (STATUS_SUFFIX.test(key))
+        return true;
+    return TICKET_PREFIX.test(key) && !DATE_PREFIX.test(key);
+}
+//# sourceMappingURL=durable-key-rules.js.map

package/dist/src/cli/services/durable-store-io.js

@@ -37,13 +37,20 @@ import { DURABLE_NAMESPACES, DURABLE_INSERT_OR_IGNORE_SQL, DURABLE_ROW_COLUMNS,
 // rather than each assembling its own copy of the retire-a-durable-row rule.
 export { isDurableNamespace };
 import { reconcileId, } from './durable-reconcile.js';
+import { misfiledDurableSql } from './durable-key-rules.js';
 /** The `status` value that marks a durable row as deleted-but-propagatable. */
 export const ARCHIVED_STATUS = 'archived';
 // Same column list as the shared INSERT, so a future column can never be added
 // to one half of the round trip only. The status filter is what differs from
 // the legacy cherry-pick read: archived rows are the deletions we must carry.
+//
+// Misfiled rows (#1495) are excluded HERE, at the one read every sync direction
+// shares, so none of them — flush, seed, artifact import, artifact export — can
+// carry a `verify:*` record in either state. Filtering per call site is what let
+// the local cleanup be undone by the next seed.
 const selectDurableSql = (placeholders, columns, byKey) => `SELECT ${columns} FROM memory_entries ` +
-    `WHERE namespace IN (${placeholders}) AND status IN ('active', '${ARCHIVED_STATUS}')` +
+    `WHERE namespace IN (${placeholders}) AND status IN ('active', '${ARCHIVED_STATUS}') ` +
+    `AND NOT ${misfiledDurableSql().sql}` +
     (byKey ? ` AND key = ?` : '');
 /**
  * The columns the merge rule alone needs. A comparison never looks at the
@@ -69,7 +76,8 @@ export function readDurableSnapshot(db, namespaces = DURABLE_NAMESPACES, opts =
     const placeholders = namespaces.map(() => '?').join(',');
     const stmt = db.prepare(selectDurableSql(placeholders, withPayloads ? DURABLE_ROW_COLUMNS : RECORD_ONLY_COLUMNS, opts.key != null));
     try {
-        stmt.bind(opts.key != null ? [...namespaces, opts.key] : namespaces.slice());
+        const misfiled = misfiledDurableSql().params;
+        stmt.bind(opts.key != null ? [...namespaces, ...misfiled, opts.key] : [...namespaces, ...misfiled]);
         while (stmt.step()) {
             const row = stmt.getAsObject();
             const namespace = String(row.namespace);
@@ -288,4 +296,26 @@ export function pruneExpiredArchives(db, now, ttlMs, namespaces = DURABLE_NAMESP
         `AND namespace IN (${placeholders}) AND updated_at < ?`, [...namespaces, now - ttlMs]);
     return db.getRowsModified();
 }
+/**
+ * Hard-delete every misfiled row (#1495) from a DURABLE TRANSFER store — the
+ * worktree shared store, never a project's own `.moflo/moflo.db` (the local
+ * purge relocates those instead, since the local copy is the one worth keeping).
+ *
+ * A shared store holds only durable namespaces, so a `verify:*` record there has
+ * no home to move to, and a tombstone for it would be pointless: the snapshot
+ * read already ignores the key in every store. Deleting is what makes the store
+ * shrink rather than carry the rows forever. Returns rows removed.
+ */
+export function deleteMisfiledDurableRows(db) {
+    if (!hasMemoryEntriesTable(db))
+        return 0;
+    const { sql, params } = misfiledDurableSql();
+    // Probe first: the steady state is a clean store, and a DELETE would open a
+    // write transaction on every session start for nothing.
+    const probe = db.exec(`SELECT 1 FROM memory_entries WHERE ${sql} LIMIT 1`, params);
+    if (!probe[0]?.values?.[0])
+        return 0;
+    db.run(`DELETE FROM memory_entries WHERE ${sql}`, params);
+    return db.getRowsModified();
+}
 //# sourceMappingURL=durable-store-io.js.map

package/dist/src/cli/services/durable-sync.js

@@ -53,7 +53,7 @@ import { loadMofloConfig } from '../config/moflo-config.js';
 import { openDaemonDatabase } from '../memory/daemon-backend.js';
 import { CHERRY_PICK_SKIP_REASONS, DURABLE_NAMESPACES, isDurableNamespace, } from './cherry-pick-learnings.js';
 import { planReconcile, TOMBSTONE_TTL_MS } from './durable-reconcile.js';
-import { readDurableSnapshot, applyDurableActions, pruneExpiredArchives } from './durable-store-io.js';
+import { readDurableSnapshot, applyDurableActions, pruneExpiredArchives, deleteMisfiledDurableRows, } from './durable-store-io.js';
 export { isDurableNamespace };
 /**
  * Read `<projectRoot>/.git` ONCE and classify the checkout for worktree sharing,
@@ -249,10 +249,10 @@ export function reconcileDurableStores(sourcePath, targetPath, opts = {}) {
     return result;
 }
 /**
- * Apply the archive retention window to one store. Best-effort: a missing or
- * unopenable store is "nothing to prune", never an error that fails a sync.
+ * Run one best-effort maintenance write against a store. A missing or
+ * unopenable store is "nothing to do", never an error that fails a sync.
  */
-function pruneStore(dbPath) {
+function maintainStore(dbPath, op) {
     if (!fs.existsSync(dbPath))
         return 0;
     let db;
@@ -263,7 +263,7 @@ function pruneStore(dbPath) {
         return 0;
     }
     try {
-        return pruneExpiredArchives(db, Date.now(), TOMBSTONE_TTL_MS);
+        return op(db);
     }
     catch {
         return 0;
@@ -272,6 +272,8 @@ function pruneStore(dbPath) {
         db.close();
     }
 }
+/** Apply the archive retention window to one store. */
+const pruneStore = (dbPath) => maintainStore(dbPath, (db) => pruneExpiredArchives(db, Date.now(), TOMBSTONE_TTL_MS));
 /** Total rows a direction actually changed — what the launcher reports. */
 export function changedRows(result) {
     return result.copied + result.updated + result.archived + result.resurrected;
@@ -331,6 +333,7 @@ export async function syncDurableAtSessionStart(opts = {}) {
             skipped,
             flushedToShared: 0,
             seededToLocal: 0,
+            healedShared: 0,
             prunedArchives: pruneStore(memoryDbPath(projectRoot)),
         };
     }
@@ -345,12 +348,24 @@ export async function syncDurableAtSessionStart(opts = {}) {
     // flush re-inserts the purged entry into every workspace. Running the seed
     // first means this store has applied the deletion before anything drops the
     // evidence for it.
-    const pruned = pruneStore(memoryDbPath(projectRoot)) + pruneStore(durablePath);
+    //
+    // The shared store also sheds misfiled rows (#1495) in the same open — it is
+    // the store sibling worktrees contend on, so a second open is a second lock
+    // wait. Neither direction above can move such a row (the snapshot read
+    // excludes them), so this only shrinks the store. The local copy is the
+    // purge's job, which relocates rather than deletes.
+    let healedShared = 0;
+    const pruned = pruneStore(memoryDbPath(projectRoot)) +
+        maintainStore(durablePath, (db) => {
+            healedShared = deleteMisfiledDurableRows(db);
+            return pruneExpiredArchives(db, Date.now(), TOMBSTONE_TTL_MS);
+        });
     return {
         durablePath,
         autoWorktree: autoWorktree ?? false,
         flushedToShared: changedRows(flush),
         seededToLocal: changedRows(seed),
+        healedShared,
         prunedArchives: pruned,
     };
 }

package/dist/src/cli/services/ephemeral-namespace-purge.js

@@ -26,6 +26,26 @@
  *    it on every session start, leaving the tab permanently empty. Trim
  *    instead so users see recent history without unbounded growth.
  *
+ * 4. **Strip vectors** from surviving rows in any ephemeral namespace
+ *    ({@link ephemeralNamespaceSql} — `tasklist`, `swarm-*`, …). Their writers
+ *    leave `embedding` NULL, but until #1492 the background backfill read that
+ *    NULL as "pending" and embedded them, so run records ranked in ordinary
+ *    `memory_search` results. The backfill no longer does; this heals the rows
+ *    every existing install already carries, and re-heals if anything embeds
+ *    them again. Rows are kept — only their vector is cleared, back to the
+ *    shape the writer produced. The next index chain drops them from the HNSW
+ *    sidecar (the DB write invalidates the `hnsw-rebuild` fingerprint).
+ *
+ * 5. **Count run summaries** (#1495) — active `learnings` rows whose key is
+ *    shaped like a per-ticket run summary ({@link isRunSummaryKey}). Report
+ *    only: key shape is a heuristic, so nothing moves on it here.
+ *    `flo memory audit-learnings` nominates them for a verdict instead.
+ *
+ * The relocation in pass 2 is one of three halves of the #1495 heal: the
+ * durable sync never reads a misfiled row (so the shared store and the team
+ * artifact cannot seed it back), and each of those stores drops its own copy.
+ * Healing this DB alone is what #1375 did, and the next seed undid it.
+ *
  * All passes share the file open + final VACUUM + atomic write, so disk I/O
  * is the same as before. Writes back to disk only when something changed.
  *
@@ -38,12 +58,12 @@
  * @module cli/services/ephemeral-namespace-purge
  */
 /* eslint-disable @typescript-eslint/no-explicit-any */
-import { PURGE_ON_SESSION_START_NAMESPACES, PURGE_ON_SESSION_START_PREFIXES, TASKLIST_RETENTION_CAP, VERIFY_RECORD_NAMESPACE, VERIFY_RETENTION_CAP, } from '../memory/bridge-embedder.js';
+import { ephemeralNamespaceSql, namespaceMatchSql, PURGE_ON_SESSION_START_NAMESPACES, PURGE_ON_SESSION_START_PREFIXES, TASKLIST_RETENTION_CAP, VERIFY_RECORD_NAMESPACE, VERIFY_RETENTION_CAP, } from '../memory/bridge-embedder.js';
 import { memoryDbPath } from './moflo-paths.js';
+import { isRunSummaryKey, LEARNINGS_NAMESPACE, MISFILED_DURABLE_RULES, misfiledDurableSql, misfiledRuleSql, } from './durable-key-rules.js';
+import { readAuditState } from '../memory/learnings-audit-state.js';
 import { openDaemonDatabase } from '../memory/daemon-backend.js';
 import { resolveStateRoot } from './project-root.js';
-/** Namespace stray verdict records are re-filed OUT of (#1375). */
-const LEARNINGS_NAMESPACE = 'learnings';
 /**
  * Hard-delete rows in {@link PURGE_ON_SESSION_START_NAMESPACES}, relocate
  * stray `verify:*` records out of `learnings`, and trim the retention-capped
@@ -56,9 +76,10 @@ export async function purgeEphemeralNamespaces(options = {}) {
     const fs = await import('fs');
     const path = await import('path');
     const nothingToDo = {
-        purged: 0, trimmed: 0, relocated: 0, superseded: 0,
+        purged: 0, trimmed: 0, relocated: 0, superseded: 0, stripped: 0, runSummaries: 0,
     };
-    const dbPath = path.resolve(options.dbPath ?? memoryDbPath(resolveStateRoot()));
+    const stateRoot = options.dbPath ? options.projectRoot : (options.projectRoot ?? resolveStateRoot());
+    const dbPath = path.resolve(options.dbPath ?? memoryDbPath(options.projectRoot ?? resolveStateRoot()));
     if (!fs.existsSync(dbPath))
         return nothingToDo;
     // node:sqlite via the unified factory (Phase 5 / #1084). WAL persists each
@@ -77,27 +98,20 @@ export async function purgeEphemeralNamespaces(options = {}) {
         // Purge match shape: exact namespace IN (...) OR namespace LIKE 'prefix-%'.
         // The prefix clause covers runtime-suffixed namespaces like
         // `doctor-memprobe-<persona>` whose set of suffixes isn't known upfront.
-        const namespaces = Array.from(PURGE_ON_SESSION_START_NAMESPACES);
-        const prefixes = Array.from(PURGE_ON_SESSION_START_PREFIXES);
         const caps = [
             ['tasklist', options.tasklistRetentionCap ?? TASKLIST_RETENTION_CAP],
             [VERIFY_RECORD_NAMESPACE, options.verifyRetentionCap ?? VERIFY_RETENTION_CAP],
         ];
-        const exactClause = namespaces.length
-            ? `namespace IN (${namespaces.map(() => '?').join(', ')})`
-            : '0';
-        const prefixClause = prefixes.map(() => 'namespace LIKE ?').join(' OR ');
-        const purgeWhere = prefixClause ? `(${exactClause} OR ${prefixClause})` : exactClause;
-        const purgeBindings = [...namespaces, ...prefixes.map((p) => `${p}%`)];
+        const { sql: purgeWhere, params: purgeBindings } = namespaceMatchSql(PURGE_ON_SESSION_START_NAMESPACES, PURGE_ON_SESSION_START_PREFIXES);
+        // The misfiled-row rule is shared with the durable sync (#1495), so this
+        // pass and the stores it cannot reach agree on exactly which rows move.
         // GLOB, not LIKE: SQLite's LIKE is case-INSENSITIVE for ASCII, so
         // `key LIKE 'verify:%'` would also sweep a `Verify:...` row that
         // `gate.cjs`'s `record-verify-outcome` — which tests
-        // `key.indexOf('verify:') !== 0` — would never have credited. GLOB is
-        // case-sensitive, so this matches exactly the keys /verify writes and the
-        // gate recognises. Neither `*`, `?` nor `[` appears in the literal prefix,
-        // so the only wildcard in the pattern is the trailing `*`.
-        const strayVerifyWhere = 'namespace = ? AND key GLOB ?';
-        const strayVerifyBindings = [LEARNINGS_NAMESPACE, `${VERIFY_RECORD_NAMESPACE}:*`];
+        // `key.indexOf('verify:') !== 0` — would never have credited.
+        const misfiled = misfiledDurableSql();
+        const ephemeral = ephemeralNamespaceSql();
+        const embeddedEphemeralWhere = `${ephemeral.sql} AND embedding IS NOT NULL`;
         // EVERY column needs a distinct alias. `exec` maps each row to an object
         // keyed by column name, so two columns that SQLite names identically
         // collapse into one and silently shift every later index. Unaliased
@@ -106,12 +120,14 @@ export async function purgeEphemeralNamespaces(options = {}) {
         // trims then read a total that isn't theirs.
         const countRows = db.exec(`SELECT
          (SELECT COUNT(*) FROM memory_entries WHERE ${purgeWhere}) AS purgeable,
-         (SELECT COUNT(*) FROM memory_entries WHERE ${strayVerifyWhere}) AS relocatable,
-         ${caps.map((_, i) => `(SELECT COUNT(*) FROM memory_entries WHERE namespace = ?) AS capTotal${i}`).join(',\n         ')}`, [...purgeBindings, ...strayVerifyBindings, ...caps.map(([ns]) => ns)]);
+         (SELECT COUNT(*) FROM memory_entries WHERE ${misfiled.sql}) AS relocatable,
+         (SELECT COUNT(*) FROM memory_entries WHERE ${embeddedEphemeralWhere}) AS strippable,
+         ${caps.map((_, i) => `(SELECT COUNT(*) FROM memory_entries WHERE namespace = ?) AS capTotal${i}`).join(',\n         ')}`, [...purgeBindings, ...misfiled.params, ...ephemeral.params, ...caps.map(([ns]) => ns)]);
         const counts = countRows[0]?.values?.[0] ?? [];
         const purgeable = Number(counts[0] ?? 0);
         const relocatable = Number(counts[1] ?? 0);
-        const capTotals = caps.map((_, i) => Number(counts[i + 2] ?? 0));
+        const strippable = Number(counts[2] ?? 0);
+        const capTotals = caps.map((_, i) => Number(counts[i + 3] ?? 0));
         let purged = 0;
         if (purgeable > 0) {
             db.run(`DELETE FROM memory_entries WHERE ${purgeWhere}`, purgeBindings);
@@ -119,27 +135,41 @@ export async function purgeEphemeralNamespaces(options = {}) {
         }
         let relocated = 0;
         let superseded = 0;
-        if (relocatable > 0) {
+        let relocatedIntoVerify = 0;
+        for (const rule of relocatable > 0 ? MISFILED_DURABLE_RULES : []) {
+            const { sql: ruleWhere, params: ruleBindings } = misfiledRuleSql(rule);
             // UNIQUE(namespace, key): a stray row whose key already exists in the
             // target cannot simply move — the UPDATE would violate the constraint,
             // and `UPDATE OR REPLACE` would clobber the newer record with the older.
-            // Drop the `learnings` copy instead, and COUNT it: this is the one place
-            // the pass destroys a row rather than re-filing it, so it must surface in
-            // the result rather than hide inside `relocated`.
+            // Drop the stray copy instead, and COUNT it: this is the one place the
+            // pass destroys a row rather than re-filing it, so it must surface in the
+            // result rather than hide inside `relocated`.
             db.run(`DELETE FROM memory_entries
-          WHERE ${strayVerifyWhere}
-            AND key IN (SELECT key FROM memory_entries WHERE namespace = ?)`, [...strayVerifyBindings, VERIFY_RECORD_NAMESPACE]);
-            superseded = db.getRowsModified?.() ?? 0;
+          WHERE ${ruleWhere}
+            AND key IN (SELECT key FROM memory_entries WHERE namespace = ?)`, [...ruleBindings, rule.relocateTo]);
+            superseded += db.getRowsModified?.() ?? 0;
             // Content is unchanged, so the row's existing embedding stays valid: the
             // HNSW sidecar is keyed by row id and re-reads `namespace` from SQL on
             // every index build, so this is a re-filing, not a re-index.
-            db.run(`UPDATE memory_entries SET namespace = ? WHERE ${strayVerifyWhere}`, [VERIFY_RECORD_NAMESPACE, ...strayVerifyBindings]);
-            relocated = db.getRowsModified?.() ?? 0;
+            db.run(`UPDATE memory_entries SET namespace = ? WHERE ${ruleWhere}`, [rule.relocateTo, ...ruleBindings]);
+            const moved = db.getRowsModified?.() ?? 0;
+            relocated += moved;
+            if (rule.relocateTo === VERIFY_RECORD_NAMESPACE)
+                relocatedIntoVerify += moved;
+        }
+        // After the purge, so rows it already deleted are not counted twice. Model
+        // goes back to NULL — the exact shape the ephemeral writers produce.
+        let stripped = 0;
+        if (strippable > 0) {
+            db.run(`UPDATE memory_entries
+            SET embedding = NULL, embedding_model = NULL, embedding_dimensions = NULL
+          WHERE ${embeddedEphemeralWhere}`, ephemeral.params);
+            stripped = db.getRowsModified?.() ?? 0;
         }
         let trimmed = 0;
         for (const [i, [ns, cap]] of caps.entries()) {
             // Rows just relocated into `verify` count toward its cap in this same run.
-            const total = capTotals[i] + (ns === VERIFY_RECORD_NAMESPACE ? relocated : 0);
+            const total = capTotals[i] + (ns === VERIFY_RECORD_NAMESPACE ? relocatedIntoVerify : 0);
             if (total <= cap)
                 continue;
             // Keep the newest `cap` rows by created_at, falling back to `id DESC`
@@ -154,21 +184,46 @@ export async function purgeEphemeralNamespaces(options = {}) {
            )`, [ns, ns, cap]);
             trimmed += db.getRowsModified?.() ?? 0;
         }
-        if (purged === 0 && trimmed === 0 && relocated === 0 && superseded === 0)
-            return nothingToDo;
+        const runSummaries = countRunSummaries(db, stateRoot);
+        if (purged === 0 && trimmed === 0 && relocated === 0 && superseded === 0 && stripped === 0) {
+            return { ...nothingToDo, runSummaries };
+        }
         // VACUUM only after a DELETE actually freed pages. A relocation is an
-        // UPDATE — it reclaims nothing, so VACUUMing for it would rewrite the whole
-        // file (60+ MB on a populated store) in the foreground of session start for
-        // no benefit. Has to run outside any open transaction; node:sqlite/sql.js
+        // UPDATE that reclaims nothing; a vector strip frees some pages, but later
+        // writes reuse them. VACUUMing for either would rewrite the whole file
+        // (60+ MB on a populated store) in the foreground of session start for no
+        // real benefit. Has to run outside any open transaction; node:sqlite/sql.js
         // both auto-commit each `db.run`, so this is safe to chain.
         if (purged > 0 || trimmed > 0 || superseded > 0)
             db.run('VACUUM');
-        return { purged, trimmed, relocated, superseded };
+        return { purged, trimmed, relocated, superseded, stripped, runSummaries };
     }
     finally {
         db.close();
     }
 }
+/**
+ * Count active `learnings` rows keyed like a per-ticket run summary. Keys only
+ * — a single indexed read of short strings, cheap on a store of thousands.
+ *
+ * Keys `flo memory audit-learnings` already judged are skipped: a KEEP is a
+ * human saying "this one is a lesson", and a notice that ignored it would print
+ * on every session forever.
+ */
+function countRunSummaries(db, projectRoot) {
+    const rows = db.exec(`SELECT key FROM memory_entries WHERE namespace = ? AND status = 'active'`, [LEARNINGS_NAMESPACE]);
+    let decided = null;
+    let count = 0;
+    for (const [raw] of rows[0]?.values ?? []) {
+        const key = String(raw);
+        if (!isRunSummaryKey(key))
+            continue;
+        decided ??= projectRoot ? readAuditState(projectRoot) : new Map();
+        if (!decided.has(key))
+            count++;
+    }
+    return count;
+}
 /**
  * Hard-delete rows whose namespace matches one of
  * {@link PURGE_ON_SESSION_START_PREFIXES} — currently `doctor-memprobe-*`

package/dist/src/cli/services/snapshot-restore.js

@@ -269,7 +269,7 @@ export async function restoreSnapshot(options) {
     let purged = 0;
     try {
         const { purgeEphemeralNamespaces } = await import('./ephemeral-namespace-purge.js');
-        const result = await purgeEphemeralNamespaces({ dbPath: target });
+        const result = await purgeEphemeralNamespaces({ dbPath: target, projectRoot });
         purged = (result?.purged ?? 0) + (result?.trimmed ?? 0);
     }
     catch {

package/dist/src/cli/services/team-artifact-sync.js

@@ -72,6 +72,7 @@ import { isDurableNamespace } from './cherry-pick-learnings.js';
 import { planReconcile, reconcileId, splitReconcileId, isPrunableTombstone, recordStamp, TOMBSTONE_TTL_MS, } from './durable-reconcile.js';
 import { readDurableSnapshot, applyDurableActions, } from './durable-store-io.js';
 import { detectToolCallMarkup } from '../memory/tool-call-markup.js';
+import { isMisfiledDurable } from './durable-key-rules.js';
 /** Allowed `type` values — the schema CHECK set. An out-of-set value would make
  *  INSERT OR IGNORE silently drop a hand-edited artifact row, so we coerce. */
 const VALID_TYPES = new Set([
@@ -208,8 +209,9 @@ function readArtifact(artifactPath) {
     const lines = new Map();
     const records = new Map();
     let malformed = 0;
+    let misfiled = 0;
     if (!fs.existsSync(artifactPath))
-        return { lines, records, malformed, existed: false };
+        return { lines, records, malformed, misfiled, existed: false };
     const raw = fs.readFileSync(artifactPath, 'utf-8');
     for (const line of raw.split(/\r?\n/)) {
         const trimmed = line.trim();
@@ -222,6 +224,13 @@ function readArtifact(artifactPath) {
         }
         const id = lineId(parsed);
         const record = lineToRecord(parsed);
+        // Dropped at the read both directions share, so import never applies one
+        // and export rewrites the file without it — the artifact shrinks instead of
+        // re-seeding every teammate's `learnings` on their next session (#1495).
+        if (isMisfiledDurable(record.namespace, record.key)) {
+            misfiled++;
+            continue;
+        }
         const existing = records.get(id);
         // Newest wins, ties keep the first. Built on the merge rule's own
         // comparison basis so the two cannot disagree about which of a live line
@@ -231,7 +240,7 @@ function readArtifact(artifactPath) {
         lines.set(id, parsed);
         records.set(id, record);
     }
-    return { lines, records, malformed, existed: true };
+    return { lines, records, malformed, misfiled, existed: true };
 }
 /**
  * Serialise lines to JSONL, sorted by the (namespace, key) each line is about —
@@ -296,8 +305,15 @@ function payloadFromLine(id, line) {
         tags: line.tags ? JSON.stringify(line.tags) : null,
         metadata: JSON.stringify({ provenance: line.provenance, sharedFrom: 'team-artifact' }),
         ownerId: line.provenance?.author || null,
-        // created_at/updated_at are INTEGER NOT NULL — never bind null.
-        createdAt: typeof line.created_at === 'number' ? line.created_at : Date.now(),
+        // created_at/updated_at are INTEGER NOT NULL — never bind null. A line with
+        // no created_at falls back to its edit time, never the import time: stamping
+        // now makes a re-imported old entry read as a new learning, which is what
+        // inflated growth metrics after every re-seed (#1495).
+        createdAt: typeof line.created_at === 'number'
+            ? line.created_at
+            : typeof line.updated_at === 'number'
+                ? line.updated_at
+                : Date.now(),
         // The row gets the best timestamp available even when the RECORD compared
         // as 0 (a pre-#1463 line): 0 governs only who wins the merge, while the row
         // itself should carry the most accurate time we have.
@@ -326,7 +342,7 @@ export function exportTeamArtifact(opts) {
     const parsedSharedAt = Date.parse(opts.sharedAt);
     const now = opts.now ?? (Number.isNaN(parsedSharedAt) ? Date.now() : parsedSharedAt);
     const ttlMs = opts.tombstoneTtlMs ?? TOMBSTONE_TTL_MS;
-    const { lines, records: target, malformed, existed } = readArtifact(opts.artifactPath);
+    const { lines, records: target, malformed, misfiled, existed } = readArtifact(opts.artifactPath);
     const provenance = {
         author: resolveAuthor(projectRoot),
         source: resolveSource(),
@@ -418,7 +434,7 @@ export function exportTeamArtifact(opts) {
     }
     // Skip the write when the merge changed nothing AND the file already exists:
     // a git-tracked artifact should not show up as modified after a no-op run.
-    const changed = actions.length > 0 || prunedTombstones > 0 || backfilled > 0;
+    const changed = actions.length > 0 || prunedTombstones > 0 || backfilled > 0 || misfiled > 0;
     const wrote = changed || !existed;
     if (wrote) {
         fs.mkdirSync(path.dirname(opts.artifactPath), { recursive: true });
@@ -436,6 +452,7 @@ export function exportTeamArtifact(opts) {
         backfilled,
         skippedMalformed: malformed,
         skippedCorrupt,
+        droppedMisfiled: misfiled,
         total: live,
         tombstones,
         wrote,
@@ -467,9 +484,11 @@ export function importTeamArtifact(opts) {
         skippedMalformed: 0,
         skippedNonDurable: 0,
         skippedCorrupt: 0,
+        skippedMisfiled: 0,
     };
-    const { lines, records: parsed, malformed } = readArtifact(opts.artifactPath);
+    const { lines, records: parsed, malformed, misfiled } = readArtifact(opts.artifactPath);
     report.skippedMalformed = malformed;
+    report.skippedMisfiled = misfiled;
     if (lines.size === 0)
         return report;
     const source = new Map();

package/dist/src/cli/version.js

@@ -2,5 +2,5 @@
  * Auto-generated by build. Do not edit manually.
  * Source of truth: root package.json → scripts/sync-version.mjs
  */
-export const VERSION = '4.13.2';
+export const VERSION = '4.13.4';
 //# sourceMappingURL=version.js.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "moflo",
-  "version": "4.13.2",
+  "version": "4.13.4",
   "description": "MoFlo — AI agent orchestration for Claude Code. A standalone, opinionated toolkit with semantic memory, learned routing, gates, spells, and the /flo issue-execution skill.",
   "main": "dist/src/cli/index.js",
   "type": "module",
@@ -99,7 +99,7 @@
     "@typescript-eslint/parser": "^8.65.0",
     "eslint": "^10.8.0",
     "glob": "^11.1.0",
-    "moflo": "^4.13.1",
+    "moflo": "^4.13.3",
     "tsx": "^4.21.0",
     "typescript": "^5.9.3",
     "vitest": "^4.0.0"