moflo 4.13.3 → 4.13.5

package/dist/src/cli/commands/memory-audit-learnings.js

@@ -23,7 +23,6 @@
  * @module commands/memory-audit-learnings
  */
 import * as fs from 'fs';
-import * as pathModule from 'path';
 import { spawn } from 'child_process';
 import { output } from '../output.js';
 import { confirm } from '../prompt.js';
@@ -33,14 +32,13 @@ import { openDaemonDatabase } from '../memory/daemon-backend.js';
 import { resolveBridgeDbPath } from '../memory/bridge-core.js';
 import { findProjectRoot } from '../services/project-root.js';
 import { hasMemoryEntriesTable } from '../services/cherry-pick-learnings.js';
-import { atomicWriteFileSync } from '../shared/utils/atomic-file-write.js';
 import { hashContent } from '../memory/auto-memory-bridge.js';
 import { listWorkspacePrefixes, makeTreeResolver } from '../memory/learnings-tree.js';
 import { LEARNINGS_NAMESPACE, buildAuditPlan, buildJudgePrompt, parseVerdicts, selectArchivable, selectManualActions, DEFAULT_DUPLICATE_THRESHOLD, DEFAULT_JUDGE_LIMIT, DEFAULT_UNUSED_LIMIT, DEFAULT_UNUSED_MIN_AGE_MS, } from '../memory/learnings-audit.js';
-/** Where recorded verdicts live. Local-only — never part of the shared artifact. */
-export const AUDIT_STATE_FILE = 'learnings-audit.json';
-/** Bump when the record shape changes; an older file is discarded, not migrated. */
-const AUDIT_STATE_VERSION = 1;
+// The verdict record moved to `memory/learnings-audit-state.ts` so the
+// session-start purge can read it (#1495); re-exported for existing callers.
+export { AUDIT_STATE_FILE, readAuditState, writeAuditState } from '../memory/learnings-audit-state.js';
+import { readAuditState, writeAuditState } from '../memory/learnings-audit-state.js';
 /** Cheap formatter/judge model — same tier the auto-meditate distill runs on. */
 const JUDGE_MODEL_ID = 'claude-haiku-4-5-20251001';
 /** Hard ceiling on the headless judge; killed past this. */
@@ -54,39 +52,6 @@ const JUDGE_ALLOWED_TOOLS = 'Read';
  * Claude CLI on PATH.
  */
 export const JUDGE_STUB_ENV = 'MOFLO_AUDIT_LEARNINGS_NODE_STUB';
-function stateFilePath(projectRoot) {
-    return pathModule.join(projectRoot, '.moflo', AUDIT_STATE_FILE);
-}
-/** Read recorded verdicts. Any unreadable or stale-version file reads as empty. */
-export function readAuditState(projectRoot) {
-    try {
-        const raw = fs.readFileSync(stateFilePath(projectRoot), 'utf-8');
-        const parsed = JSON.parse(raw);
-        if (parsed?.version !== AUDIT_STATE_VERSION || !parsed.decided)
-            return new Map();
-        return new Map(Object.entries(parsed.decided));
-    }
-    catch {
-        // Absent, truncated, or hand-edited into invalid JSON. Losing the record
-        // costs one re-judgement; refusing to run over it costs the command.
-        return new Map();
-    }
-}
-/**
- * Write the verdict record back.
- *
- * Read-modify-write with no lock: two `--apply` runs racing on the same project
- * would lose one run's verdicts. Not worth a lock — this is a hand-invoked
- * curation command, the loss costs one re-judgement, and `atomicWriteFileSync`
- * already rules out a torn file (its temp name is pid- and random-suffixed, so
- * concurrent writers cannot clobber each other's staging file either).
- */
-export function writeAuditState(projectRoot, decided) {
-    const file = stateFilePath(projectRoot);
-    fs.mkdirSync(pathModule.dirname(file), { recursive: true });
-    const payload = { version: AUDIT_STATE_VERSION, decided: Object.fromEntries(decided) };
-    atomicWriteFileSync(file, `${JSON.stringify(payload, null, 2)}\n`);
-}
 /**
  * Parse a stored embedding. A malformed vector reads as absent rather than
  * throwing — one bad row must not take the whole audit down.
@@ -222,6 +187,7 @@ function printPlan(plan, deadPathsScanned) {
             { bucket: 'Unused and old', count: plan.counts.unused },
             { bucket: 'Superseded vocabulary', count: plan.counts.superseded },
             { bucket: 'Dead path reference', count: plan.counts.deadPath },
+            { bucket: 'Run summary (ticket-shaped key)', count: plan.counts.runSummary },
             { bucket: output.bold('To judge'), count: output.bold(String(plan.candidates.length)) },
         ],
     });

package/dist/src/cli/commands/memory.js

@@ -2541,6 +2541,8 @@ const teamExportCommand = {
                 changes.push(`${report.deleted} retired`);
             if (report.resurrected > 0)
                 changes.push(`${report.resurrected} restored`);
+            if (report.droppedMisfiled > 0)
+                changes.push(`${report.droppedMisfiled} verify record${report.droppedMisfiled === 1 ? '' : 's'} removed (not learnings, #1495)`);
             if (changes.length > 0)
                 output.printInfo(`Also propagated: ${changes.join(', ')}.`);
             if (report.keptRemote > 0) {
@@ -2616,6 +2618,9 @@ const teamImportCommand = {
             if (report.skippedCorrupt > 0) {
                 output.printWarning(`${report.skippedCorrupt} artifact line${report.skippedCorrupt === 1 ? '' : 's'} NOT imported — captured tool-call markup in the content (#1467).`);
             }
+            if (report.skippedMisfiled > 0) {
+                output.printInfo(`${report.skippedMisfiled} verify record${report.skippedMisfiled === 1 ? '' : 's'} in the artifact ignored (not learnings, #1495) — \`flo memory team-export\` removes them.`);
+            }
             if (report.skippedNonDurable > 0) {
                 output.printWarning(`${report.skippedNonDurable} non-durable entr${report.skippedNonDurable === 1 ? 'y' : 'ies'} skipped (only learnings/knowledge are shared).`);
             }

package/dist/src/cli/memory/bridge-embedder.js

@@ -76,6 +76,11 @@ export const EMBEDDING_MODEL_LEGACY_DEFAULT = 'local';
  * `tasklist`, because the dashboard's Flo Runs tab
  * (`daemon-dashboard.ts handleSpells`) reads tasklist; purging it on every
  * session would empty the tab between sessions (#968).
+ *
+ * `verify` is deliberately NOT here (decided in #1497): `/verify` Step 0 runs a
+ * semantic `memory_search` over that namespace to surface prior verdicts for
+ * the area being changed, which needs embeddings. Its size is bounded by
+ * {@link VERIFY_RETENTION_CAP} instead.
  */
 export const EPHEMERAL_NAMESPACES = new Set([
     'hive-mind',

package/dist/src/cli/memory/learnings-audit-state.js

@@ -0,0 +1,53 @@
+/**
+ * The verdict record `flo memory audit-learnings --apply` keeps between runs
+ * (#1466), at `.moflo/learnings-audit.json`.
+ *
+ * Carved out of the command so the session-start purge can read it without
+ * importing CLI command machinery: the purge's run-summary count (#1495) skips
+ * keys a human already judged, so the notice clears once the store is curated.
+ *
+ * Local-only — never part of the shared artifact.
+ *
+ * @module memory/learnings-audit-state
+ */
+import * as fs from 'fs';
+import * as path from 'path';
+import { atomicWriteFileSync } from '../shared/utils/atomic-file-write.js';
+/** Where recorded verdicts live, under `.moflo/`. */
+export const AUDIT_STATE_FILE = 'learnings-audit.json';
+/** Bump when the record shape changes; an older file is discarded, not migrated. */
+const AUDIT_STATE_VERSION = 1;
+function stateFilePath(projectRoot) {
+    return path.join(projectRoot, '.moflo', AUDIT_STATE_FILE);
+}
+/** Read recorded verdicts. Any unreadable or stale-version file reads as empty. */
+export function readAuditState(projectRoot) {
+    try {
+        const raw = fs.readFileSync(stateFilePath(projectRoot), 'utf-8');
+        const parsed = JSON.parse(raw);
+        if (parsed?.version !== AUDIT_STATE_VERSION || !parsed.decided)
+            return new Map();
+        return new Map(Object.entries(parsed.decided));
+    }
+    catch {
+        // Absent, truncated, or hand-edited into invalid JSON. Losing the record
+        // costs one re-judgement; refusing to run over it costs the command.
+        return new Map();
+    }
+}
+/**
+ * Write the verdict record back.
+ *
+ * Read-modify-write with no lock: two `--apply` runs racing on the same project
+ * would lose one run's verdicts. Not worth a lock — this is a hand-invoked
+ * curation command, the loss costs one re-judgement, and `atomicWriteFileSync`
+ * already rules out a torn file (its temp name is pid- and random-suffixed, so
+ * concurrent writers cannot clobber each other's staging file either).
+ */
+export function writeAuditState(projectRoot, decided) {
+    const file = stateFilePath(projectRoot);
+    fs.mkdirSync(path.dirname(file), { recursive: true });
+    const payload = { version: AUDIT_STATE_VERSION, decided: Object.fromEntries(decided) };
+    atomicWriteFileSync(file, `${JSON.stringify(payload, null, 2)}\n`);
+}
+//# sourceMappingURL=learnings-audit-state.js.map

package/dist/src/cli/memory/learnings-audit.js

@@ -33,9 +33,10 @@
 // audit's public surface — a caller configuring the pass should not have to
 // know which file the detector was carved into.
 import { findDeadPaths } from './learnings-dead-paths.js';
+import { isRunSummaryKey, LEARNINGS_NAMESPACE } from '../services/durable-key-rules.js';
 export { DEFAULT_DEAD_PATHS_PER_ENTRY, extractCandidatePaths, findDeadPaths, resolvesInTree, } from './learnings-dead-paths.js';
 /** The namespace this audit is scoped to. */
-export const LEARNINGS_NAMESPACE = 'learnings';
+export { LEARNINGS_NAMESPACE };
 export const AUDIT_VERDICTS = ['KEEP', 'RETIRE', 'COMPRESS', 'MERGE'];
 /**
  * Retired vocabulary. **Ships empty, and a guard test keeps it that way.**
@@ -238,11 +239,18 @@ export function buildAuditPlan(rows, options = {}) {
         const candidate = nominate(hit.row, 'dead-path');
         candidate.deadPaths = hit.deadPaths;
     }
+    // A run summary is git history stored as a learning (#1495). The key shape
+    // only nominates — a lesson can carry its ticket number as provenance, which
+    // is the case the model verdict tells apart.
+    const runSummaries = pending.filter((row) => isRunSummaryKey(row.key));
+    for (const row of runSummaries)
+        nominate(row, 'run-summary');
     const counts = {
         duplicate: duplicates.length,
         unused: unused.length,
         superseded: superseded.length,
         deadPath: deadPaths.length,
+        runSummary: runSummaries.length,
     };
     // Most-nominated first, then oldest — an entry three passes agree on is the
     // one a bounded prompt should spend its budget on.
@@ -273,6 +281,9 @@ function describeBuckets(candidate) {
         else if (bucket === 'dead-path') {
             parts.push(`cites path(s) that resolve nowhere in the tree: ${(candidate.deadPaths ?? []).join(', ')}`);
         }
+        else if (bucket === 'run-summary') {
+            parts.push('key is shaped like a per-ticket run summary');
+        }
         else {
             const terms = (candidate.supersededTerms ?? [])
                 .map((t) => `"${t.from}" → "${t.to}"`)
@@ -339,6 +350,10 @@ export function buildJudgePrompt(candidates, now = Date.now()) {
         '| Deleted, but the lesson generalises past it | COMPRESS — drop the path, keep the rule |',
         '| The entry is a historical record, correct as written | KEEP |',
         '',
+        'A run-summary flag means the key looks like a ticket record ("flo-123-...", "...-done").',
+        'What one ticket changed is git history, not a lesson: RETIRE it unless the content states a',
+        'rule that would help a DIFFERENT task, in which case COMPRESS it down to that rule.',
+        '',
         `Answer with exactly ${candidates.length} line(s), nothing else. One line per entry:`,
         '',
         '<key><TAB><VERDICT><TAB><reason in under 15 words>',

package/dist/src/cli/services/durable-key-rules.js

@@ -0,0 +1,70 @@
+/**
+ * Rows that must never live in a durable namespace, whichever store they are in
+ * (#1495).
+ *
+ * #1375 moved `verify:*` verdict records out of `learnings`, but only in the
+ * local `.moflo/moflo.db`. The same rows still sat in the two durable copies —
+ * the worktree shared store (`<git-common-dir>/moflo/durable.db`) and the team
+ * JSONL artifact — and the session-start seed and import wrote them straight
+ * back. The cleanup ran on every session and never converged, because each
+ * store was healed by its own code path and none of the sync paths knew the
+ * rule.
+ *
+ * This module is the ONE statement of the rule. The sync boundary applies it
+ * (`readDurableSnapshot` never returns a misfiled row, so no flush, seed,
+ * import or export can carry one), the shared store and artifact drop what they
+ * already hold, and the local purge relocates or drops the local copy. A new
+ * relocation rule is a new entry in {@link MISFILED_DURABLE_RULES} — never a
+ * new clause in one store's cleanup, which is the shape that failed.
+ *
+ * Pure: no fs, no sqlite.
+ *
+ * @module cli/services/durable-key-rules
+ */
+import { VERIFY_RECORD_NAMESPACE } from '../memory/bridge-embedder.js';
+/** The durable namespace user-authored lessons live in. */
+export const LEARNINGS_NAMESPACE = 'learnings';
+/** Every rule. `/verify` verdicts used to be written to `learnings` (#1375). */
+export const MISFILED_DURABLE_RULES = [
+    { namespace: LEARNINGS_NAMESPACE, keyPrefix: `${VERIFY_RECORD_NAMESPACE}:`, relocateTo: VERIFY_RECORD_NAMESPACE },
+];
+/** True when `(namespace, key)` is a row no durable store should hold. */
+export function isMisfiledDurable(namespace, key) {
+    return MISFILED_DURABLE_RULES.some((r) => r.namespace === namespace && key.startsWith(r.keyPrefix));
+}
+/** SQL predicate matching the rows of ONE rule — the only place its shape is spelled. */
+export function misfiledRuleSql(rule) {
+    return { sql: '(namespace = ? AND key GLOB ?)', params: [rule.namespace, `${rule.keyPrefix}*`] };
+}
+/**
+ * SQL predicate matching every misfiled row, with its bindings. Callers negate
+ * it (`NOT (...)`) to read a clean durable slice, or use it as-is to delete.
+ */
+export function misfiledDurableSql() {
+    if (MISFILED_DURABLE_RULES.length === 0)
+        return { sql: '0', params: [] };
+    const parts = MISFILED_DURABLE_RULES.map(misfiledRuleSql);
+    return { sql: `(${parts.map((p) => p.sql).join(' OR ')})`, params: parts.flatMap((p) => p.params) };
+}
+/**
+ * Key shapes of a per-ticket run summary stored as a learning: `flo-2595-...`,
+ * `2679-...`, or a `-done`/`-complete`/`-shipped`/`-merged` suffix.
+ *
+ * A heuristic on key shape only, which is why nothing moves on it
+ * automatically: the session start COUNTS matches, and
+ * `flo memory audit-learnings` nominates them for a verdict. Content is not
+ * consulted — a real lesson can open with a ticket number as provenance
+ * (`1145-daemon-port-collision-fix`), and that is exactly the case a model
+ * verdict exists to tell apart.
+ */
+const TICKET_PREFIX = /^(?:flo-)?\d{3,5}-/;
+const STATUS_SUFFIX = /-(?:done|complete|completed|shipped|merged)$/;
+/** A date-prefixed key (`2026-09-28-...`) is a dated note, not a ticket number. */
+const DATE_PREFIX = /^\d{4}-\d{2}-\d{2}(?:\D|$)/;
+/** True when a `learnings` key looks like a per-ticket run summary. */
+export function isRunSummaryKey(key) {
+    if (STATUS_SUFFIX.test(key))
+        return true;
+    return TICKET_PREFIX.test(key) && !DATE_PREFIX.test(key);
+}
+//# sourceMappingURL=durable-key-rules.js.map

package/dist/src/cli/services/durable-store-io.js

@@ -37,13 +37,20 @@ import { DURABLE_NAMESPACES, DURABLE_INSERT_OR_IGNORE_SQL, DURABLE_ROW_COLUMNS,
 // rather than each assembling its own copy of the retire-a-durable-row rule.
 export { isDurableNamespace };
 import { reconcileId, } from './durable-reconcile.js';
+import { misfiledDurableSql } from './durable-key-rules.js';
 /** The `status` value that marks a durable row as deleted-but-propagatable. */
 export const ARCHIVED_STATUS = 'archived';
 // Same column list as the shared INSERT, so a future column can never be added
 // to one half of the round trip only. The status filter is what differs from
 // the legacy cherry-pick read: archived rows are the deletions we must carry.
+//
+// Misfiled rows (#1495) are excluded HERE, at the one read every sync direction
+// shares, so none of them — flush, seed, artifact import, artifact export — can
+// carry a `verify:*` record in either state. Filtering per call site is what let
+// the local cleanup be undone by the next seed.
 const selectDurableSql = (placeholders, columns, byKey) => `SELECT ${columns} FROM memory_entries ` +
-    `WHERE namespace IN (${placeholders}) AND status IN ('active', '${ARCHIVED_STATUS}')` +
+    `WHERE namespace IN (${placeholders}) AND status IN ('active', '${ARCHIVED_STATUS}') ` +
+    `AND NOT ${misfiledDurableSql().sql}` +
     (byKey ? ` AND key = ?` : '');
 /**
  * The columns the merge rule alone needs. A comparison never looks at the
@@ -69,7 +76,8 @@ export function readDurableSnapshot(db, namespaces = DURABLE_NAMESPACES, opts =
     const placeholders = namespaces.map(() => '?').join(',');
     const stmt = db.prepare(selectDurableSql(placeholders, withPayloads ? DURABLE_ROW_COLUMNS : RECORD_ONLY_COLUMNS, opts.key != null));
     try {
-        stmt.bind(opts.key != null ? [...namespaces, opts.key] : namespaces.slice());
+        const misfiled = misfiledDurableSql().params;
+        stmt.bind(opts.key != null ? [...namespaces, ...misfiled, opts.key] : [...namespaces, ...misfiled]);
         while (stmt.step()) {
             const row = stmt.getAsObject();
             const namespace = String(row.namespace);
@@ -288,4 +296,26 @@ export function pruneExpiredArchives(db, now, ttlMs, namespaces = DURABLE_NAMESP
         `AND namespace IN (${placeholders}) AND updated_at < ?`, [...namespaces, now - ttlMs]);
     return db.getRowsModified();
 }
+/**
+ * Hard-delete every misfiled row (#1495) from a DURABLE TRANSFER store — the
+ * worktree shared store, never a project's own `.moflo/moflo.db` (the local
+ * purge relocates those instead, since the local copy is the one worth keeping).
+ *
+ * A shared store holds only durable namespaces, so a `verify:*` record there has
+ * no home to move to, and a tombstone for it would be pointless: the snapshot
+ * read already ignores the key in every store. Deleting is what makes the store
+ * shrink rather than carry the rows forever. Returns rows removed.
+ */
+export function deleteMisfiledDurableRows(db) {
+    if (!hasMemoryEntriesTable(db))
+        return 0;
+    const { sql, params } = misfiledDurableSql();
+    // Probe first: the steady state is a clean store, and a DELETE would open a
+    // write transaction on every session start for nothing.
+    const probe = db.exec(`SELECT 1 FROM memory_entries WHERE ${sql} LIMIT 1`, params);
+    if (!probe[0]?.values?.[0])
+        return 0;
+    db.run(`DELETE FROM memory_entries WHERE ${sql}`, params);
+    return db.getRowsModified();
+}
 //# sourceMappingURL=durable-store-io.js.map

package/dist/src/cli/services/durable-sync.js

@@ -53,7 +53,7 @@ import { loadMofloConfig } from '../config/moflo-config.js';
 import { openDaemonDatabase } from '../memory/daemon-backend.js';
 import { CHERRY_PICK_SKIP_REASONS, DURABLE_NAMESPACES, isDurableNamespace, } from './cherry-pick-learnings.js';
 import { planReconcile, TOMBSTONE_TTL_MS } from './durable-reconcile.js';
-import { readDurableSnapshot, applyDurableActions, pruneExpiredArchives } from './durable-store-io.js';
+import { readDurableSnapshot, applyDurableActions, pruneExpiredArchives, deleteMisfiledDurableRows, } from './durable-store-io.js';
 export { isDurableNamespace };
 /**
  * Read `<projectRoot>/.git` ONCE and classify the checkout for worktree sharing,
@@ -249,10 +249,10 @@ export function reconcileDurableStores(sourcePath, targetPath, opts = {}) {
     return result;
 }
 /**
- * Apply the archive retention window to one store. Best-effort: a missing or
- * unopenable store is "nothing to prune", never an error that fails a sync.
+ * Run one best-effort maintenance write against a store. A missing or
+ * unopenable store is "nothing to do", never an error that fails a sync.
  */
-function pruneStore(dbPath) {
+function maintainStore(dbPath, op) {
     if (!fs.existsSync(dbPath))
         return 0;
     let db;
@@ -263,7 +263,7 @@ function pruneStore(dbPath) {
         return 0;
     }
     try {
-        return pruneExpiredArchives(db, Date.now(), TOMBSTONE_TTL_MS);
+        return op(db);
     }
     catch {
         return 0;
@@ -272,6 +272,8 @@ function pruneStore(dbPath) {
         db.close();
     }
 }
+/** Apply the archive retention window to one store. */
+const pruneStore = (dbPath) => maintainStore(dbPath, (db) => pruneExpiredArchives(db, Date.now(), TOMBSTONE_TTL_MS));
 /** Total rows a direction actually changed — what the launcher reports. */
 export function changedRows(result) {
     return result.copied + result.updated + result.archived + result.resurrected;
@@ -331,6 +333,7 @@ export async function syncDurableAtSessionStart(opts = {}) {
             skipped,
             flushedToShared: 0,
             seededToLocal: 0,
+            healedShared: 0,
             prunedArchives: pruneStore(memoryDbPath(projectRoot)),
         };
     }
@@ -345,12 +348,24 @@ export async function syncDurableAtSessionStart(opts = {}) {
     // flush re-inserts the purged entry into every workspace. Running the seed
     // first means this store has applied the deletion before anything drops the
     // evidence for it.
-    const pruned = pruneStore(memoryDbPath(projectRoot)) + pruneStore(durablePath);
+    //
+    // The shared store also sheds misfiled rows (#1495) in the same open — it is
+    // the store sibling worktrees contend on, so a second open is a second lock
+    // wait. Neither direction above can move such a row (the snapshot read
+    // excludes them), so this only shrinks the store. The local copy is the
+    // purge's job, which relocates rather than deletes.
+    let healedShared = 0;
+    const pruned = pruneStore(memoryDbPath(projectRoot)) +
+        maintainStore(durablePath, (db) => {
+            healedShared = deleteMisfiledDurableRows(db);
+            return pruneExpiredArchives(db, Date.now(), TOMBSTONE_TTL_MS);
+        });
     return {
         durablePath,
         autoWorktree: autoWorktree ?? false,
         flushedToShared: changedRows(flush),
         seededToLocal: changedRows(seed),
+        healedShared,
         prunedArchives: pruned,
     };
 }

package/dist/src/cli/services/ephemeral-namespace-purge.js

@@ -36,6 +36,16 @@
  *    shape the writer produced. The next index chain drops them from the HNSW
  *    sidecar (the DB write invalidates the `hnsw-rebuild` fingerprint).
  *
+ * 5. **Count run summaries** (#1495) — active `learnings` rows whose key is
+ *    shaped like a per-ticket run summary ({@link isRunSummaryKey}). Report
+ *    only: key shape is a heuristic, so nothing moves on it here.
+ *    `flo memory audit-learnings` nominates them for a verdict instead.
+ *
+ * The relocation in pass 2 is one of three halves of the #1495 heal: the
+ * durable sync never reads a misfiled row (so the shared store and the team
+ * artifact cannot seed it back), and each of those stores drops its own copy.
+ * Healing this DB alone is what #1375 did, and the next seed undid it.
+ *
  * All passes share the file open + final VACUUM + atomic write, so disk I/O
  * is the same as before. Writes back to disk only when something changed.
  *
@@ -50,10 +60,10 @@
 /* eslint-disable @typescript-eslint/no-explicit-any */
 import { ephemeralNamespaceSql, namespaceMatchSql, PURGE_ON_SESSION_START_NAMESPACES, PURGE_ON_SESSION_START_PREFIXES, TASKLIST_RETENTION_CAP, VERIFY_RECORD_NAMESPACE, VERIFY_RETENTION_CAP, } from '../memory/bridge-embedder.js';
 import { memoryDbPath } from './moflo-paths.js';
+import { isRunSummaryKey, LEARNINGS_NAMESPACE, MISFILED_DURABLE_RULES, misfiledDurableSql, misfiledRuleSql, } from './durable-key-rules.js';
+import { readAuditState } from '../memory/learnings-audit-state.js';
 import { openDaemonDatabase } from '../memory/daemon-backend.js';
 import { resolveStateRoot } from './project-root.js';
-/** Namespace stray verdict records are re-filed OUT of (#1375). */
-const LEARNINGS_NAMESPACE = 'learnings';
 /**
  * Hard-delete rows in {@link PURGE_ON_SESSION_START_NAMESPACES}, relocate
  * stray `verify:*` records out of `learnings`, and trim the retention-capped
@@ -66,9 +76,10 @@ export async function purgeEphemeralNamespaces(options = {}) {
     const fs = await import('fs');
     const path = await import('path');
     const nothingToDo = {
-        purged: 0, trimmed: 0, relocated: 0, superseded: 0, stripped: 0,
+        purged: 0, trimmed: 0, relocated: 0, superseded: 0, stripped: 0, runSummaries: 0,
     };
-    const dbPath = path.resolve(options.dbPath ?? memoryDbPath(resolveStateRoot()));
+    const stateRoot = options.dbPath ? options.projectRoot : (options.projectRoot ?? resolveStateRoot());
+    const dbPath = path.resolve(options.dbPath ?? memoryDbPath(options.projectRoot ?? resolveStateRoot()));
     if (!fs.existsSync(dbPath))
         return nothingToDo;
     // node:sqlite via the unified factory (Phase 5 / #1084). WAL persists each
@@ -92,15 +103,13 @@ export async function purgeEphemeralNamespaces(options = {}) {
             [VERIFY_RECORD_NAMESPACE, options.verifyRetentionCap ?? VERIFY_RETENTION_CAP],
         ];
         const { sql: purgeWhere, params: purgeBindings } = namespaceMatchSql(PURGE_ON_SESSION_START_NAMESPACES, PURGE_ON_SESSION_START_PREFIXES);
+        // The misfiled-row rule is shared with the durable sync (#1495), so this
+        // pass and the stores it cannot reach agree on exactly which rows move.
         // GLOB, not LIKE: SQLite's LIKE is case-INSENSITIVE for ASCII, so
         // `key LIKE 'verify:%'` would also sweep a `Verify:...` row that
         // `gate.cjs`'s `record-verify-outcome` — which tests
-        // `key.indexOf('verify:') !== 0` — would never have credited. GLOB is
-        // case-sensitive, so this matches exactly the keys /verify writes and the
-        // gate recognises. Neither `*`, `?` nor `[` appears in the literal prefix,
-        // so the only wildcard in the pattern is the trailing `*`.
-        const strayVerifyWhere = 'namespace = ? AND key GLOB ?';
-        const strayVerifyBindings = [LEARNINGS_NAMESPACE, `${VERIFY_RECORD_NAMESPACE}:*`];
+        // `key.indexOf('verify:') !== 0` — would never have credited.
+        const misfiled = misfiledDurableSql();
         const ephemeral = ephemeralNamespaceSql();
         const embeddedEphemeralWhere = `${ephemeral.sql} AND embedding IS NOT NULL`;
         // EVERY column needs a distinct alias. `exec` maps each row to an object
@@ -111,9 +120,9 @@ export async function purgeEphemeralNamespaces(options = {}) {
         // trims then read a total that isn't theirs.
         const countRows = db.exec(`SELECT
          (SELECT COUNT(*) FROM memory_entries WHERE ${purgeWhere}) AS purgeable,
-         (SELECT COUNT(*) FROM memory_entries WHERE ${strayVerifyWhere}) AS relocatable,
+         (SELECT COUNT(*) FROM memory_entries WHERE ${misfiled.sql}) AS relocatable,
          (SELECT COUNT(*) FROM memory_entries WHERE ${embeddedEphemeralWhere}) AS strippable,
-         ${caps.map((_, i) => `(SELECT COUNT(*) FROM memory_entries WHERE namespace = ?) AS capTotal${i}`).join(',\n         ')}`, [...purgeBindings, ...strayVerifyBindings, ...ephemeral.params, ...caps.map(([ns]) => ns)]);
+         ${caps.map((_, i) => `(SELECT COUNT(*) FROM memory_entries WHERE namespace = ?) AS capTotal${i}`).join(',\n         ')}`, [...purgeBindings, ...misfiled.params, ...ephemeral.params, ...caps.map(([ns]) => ns)]);
         const counts = countRows[0]?.values?.[0] ?? [];
         const purgeable = Number(counts[0] ?? 0);
         const relocatable = Number(counts[1] ?? 0);
@@ -126,22 +135,27 @@ export async function purgeEphemeralNamespaces(options = {}) {
         }
         let relocated = 0;
         let superseded = 0;
-        if (relocatable > 0) {
+        let relocatedIntoVerify = 0;
+        for (const rule of relocatable > 0 ? MISFILED_DURABLE_RULES : []) {
+            const { sql: ruleWhere, params: ruleBindings } = misfiledRuleSql(rule);
             // UNIQUE(namespace, key): a stray row whose key already exists in the
             // target cannot simply move — the UPDATE would violate the constraint,
             // and `UPDATE OR REPLACE` would clobber the newer record with the older.
-            // Drop the `learnings` copy instead, and COUNT it: this is the one place
-            // the pass destroys a row rather than re-filing it, so it must surface in
-            // the result rather than hide inside `relocated`.
+            // Drop the stray copy instead, and COUNT it: this is the one place the
+            // pass destroys a row rather than re-filing it, so it must surface in the
+            // result rather than hide inside `relocated`.
             db.run(`DELETE FROM memory_entries
-          WHERE ${strayVerifyWhere}
-            AND key IN (SELECT key FROM memory_entries WHERE namespace = ?)`, [...strayVerifyBindings, VERIFY_RECORD_NAMESPACE]);
-            superseded = db.getRowsModified?.() ?? 0;
+          WHERE ${ruleWhere}
+            AND key IN (SELECT key FROM memory_entries WHERE namespace = ?)`, [...ruleBindings, rule.relocateTo]);
+            superseded += db.getRowsModified?.() ?? 0;
             // Content is unchanged, so the row's existing embedding stays valid: the
             // HNSW sidecar is keyed by row id and re-reads `namespace` from SQL on
             // every index build, so this is a re-filing, not a re-index.
-            db.run(`UPDATE memory_entries SET namespace = ? WHERE ${strayVerifyWhere}`, [VERIFY_RECORD_NAMESPACE, ...strayVerifyBindings]);
-            relocated = db.getRowsModified?.() ?? 0;
+            db.run(`UPDATE memory_entries SET namespace = ? WHERE ${ruleWhere}`, [rule.relocateTo, ...ruleBindings]);
+            const moved = db.getRowsModified?.() ?? 0;
+            relocated += moved;
+            if (rule.relocateTo === VERIFY_RECORD_NAMESPACE)
+                relocatedIntoVerify += moved;
         }
         // After the purge, so rows it already deleted are not counted twice. Model
         // goes back to NULL — the exact shape the ephemeral writers produce.
@@ -155,7 +169,7 @@ export async function purgeEphemeralNamespaces(options = {}) {
         let trimmed = 0;
         for (const [i, [ns, cap]] of caps.entries()) {
             // Rows just relocated into `verify` count toward its cap in this same run.
-            const total = capTotals[i] + (ns === VERIFY_RECORD_NAMESPACE ? relocated : 0);
+            const total = capTotals[i] + (ns === VERIFY_RECORD_NAMESPACE ? relocatedIntoVerify : 0);
             if (total <= cap)
                 continue;
             // Keep the newest `cap` rows by created_at, falling back to `id DESC`
@@ -170,8 +184,9 @@ export async function purgeEphemeralNamespaces(options = {}) {
            )`, [ns, ns, cap]);
             trimmed += db.getRowsModified?.() ?? 0;
         }
+        const runSummaries = countRunSummaries(db, stateRoot);
         if (purged === 0 && trimmed === 0 && relocated === 0 && superseded === 0 && stripped === 0) {
-            return nothingToDo;
+            return { ...nothingToDo, runSummaries };
         }
         // VACUUM only after a DELETE actually freed pages. A relocation is an
         // UPDATE that reclaims nothing; a vector strip frees some pages, but later
@@ -181,12 +196,34 @@ export async function purgeEphemeralNamespaces(options = {}) {
         // both auto-commit each `db.run`, so this is safe to chain.
         if (purged > 0 || trimmed > 0 || superseded > 0)
             db.run('VACUUM');
-        return { purged, trimmed, relocated, superseded, stripped };
+        return { purged, trimmed, relocated, superseded, stripped, runSummaries };
     }
     finally {
         db.close();
     }
 }
+/**
+ * Count active `learnings` rows keyed like a per-ticket run summary. Keys only
+ * — a single indexed read of short strings, cheap on a store of thousands.
+ *
+ * Keys `flo memory audit-learnings` already judged are skipped: a KEEP is a
+ * human saying "this one is a lesson", and a notice that ignored it would print
+ * on every session forever.
+ */
+function countRunSummaries(db, projectRoot) {
+    const rows = db.exec(`SELECT key FROM memory_entries WHERE namespace = ? AND status = 'active'`, [LEARNINGS_NAMESPACE]);
+    let decided = null;
+    let count = 0;
+    for (const [raw] of rows[0]?.values ?? []) {
+        const key = String(raw);
+        if (!isRunSummaryKey(key))
+            continue;
+        decided ??= projectRoot ? readAuditState(projectRoot) : new Map();
+        if (!decided.has(key))
+            count++;
+    }
+    return count;
+}
 /**
  * Hard-delete rows whose namespace matches one of
  * {@link PURGE_ON_SESSION_START_PREFIXES} — currently `doctor-memprobe-*`

package/dist/src/cli/services/snapshot-restore.js

@@ -269,7 +269,7 @@ export async function restoreSnapshot(options) {
     let purged = 0;
     try {
         const { purgeEphemeralNamespaces } = await import('./ephemeral-namespace-purge.js');
-        const result = await purgeEphemeralNamespaces({ dbPath: target });
+        const result = await purgeEphemeralNamespaces({ dbPath: target, projectRoot });
         purged = (result?.purged ?? 0) + (result?.trimmed ?? 0);
     }
     catch {