moflo 4.9.0-rc.2 → 4.9.0-rc.4

package/.claude/helpers/statusline.cjs

@@ -602,32 +602,36 @@ function getIntegrationStatus() {
   return { mcpServers, hasDatabase, hasApi };
 }
 
-// Upgrade notice (#636) — written by the session-start launcher; null when missing, expired, or malformed.
+// Upgrade notice (#636, #738, #743) — written by the session-start launcher
+// ONLY while upgrade work is in flight; the launcher deletes the file when
+// work completes. We render it strictly for status='in-progress' so a stale
+// notice (legacy "complete" file from pre-#738 launchers, zombie write from
+// an aborted launcher, future writer mistakes) cannot turn the statusline
+// segment into a permanent column. The launcher's section 0-pre also drops
+// any leftover file at session start as a second line of defence.
 function getUpgradeNotice() {
   const data = readJSON(path.join(CWD, '.moflo', 'upgrade-notice.json'));
   if (!data || typeof data !== 'object') return null;
+  if (data.status !== 'in-progress') return null;
   const expiresAt = data.expiresAt ? new Date(data.expiresAt).getTime() : 0;
   if (!expiresAt || Date.now() > expiresAt) return null;
   return {
     kind: data.kind === 'repair' ? 'repair' : 'upgrade',
     from: typeof data.from === 'string' ? data.from : '',
     to: typeof data.to === 'string' ? data.to : '',
-    changes: typeof data.changes === 'number' && data.changes > 0 ? data.changes : 0,
   };
 }
 
 function formatUpgradeNoticeSegment(notice) {
   if (!notice) return '';
-  const changesPart = notice.changes > 0
-    ? ` ${c.dim}(${notice.changes} ${notice.changes === 1 ? 'change' : 'changes'})${c.reset}`
-    : '';
+  const suffix = ` ${c.dim}(updating…)${c.reset}`;
   if (notice.kind === 'repair') {
-    return `${c.brightYellow}📦 install repaired${c.reset}${changesPart}`;
+    return `${c.brightYellow}📦 install repaired${c.reset}${suffix}`;
   }
   const versions = notice.from && notice.to
     ? `${notice.from} → ${notice.to}`
     : (notice.to || 'upgraded');
-  return `${c.brightYellow}📦 ${versions}${c.reset}${changesPart}`;
+  return `${c.brightYellow}📦 ${versions}${c.reset}${suffix}`;
 }
 
 // Session stats (pure file reads)
@@ -671,11 +675,14 @@ function generateStatusline() {
 
   const parts = [];
 
+  // Upgrade notice \u2014 leading position so it reads as a transient banner
+  // rather than a permanent column (#738). Only renders during the upgrade
+  // window; the launcher deletes the notice file after work completes.
+  pushUpgradeNoticeSegment(parts);
+
   // Branding (always shown when enabled)
   parts.push(`${c.bold}${c.brightPurple}\u258A ${SL_CONFIG.branding}${c.reset}`);
 
-  pushUpgradeNoticeSegment(parts);
-
   // User + swarm indicator
   const dot = swarm.coordinationActive ? `${c.brightGreen}\u25CF${c.reset}` : `${c.brightCyan}\u25CF${c.reset}`;
   parts.push(`${dot} ${c.brightCyan}${git.name}${c.reset}`);
@@ -758,8 +765,9 @@ function generateDashboard() {
   if (SL_CONFIG.show_session && session.duration) {
     header += `  ${c.dim}\u2502${c.reset}  ${c.cyan}\u23F1 ${session.duration}${c.reset}`;
   }
-  lines.push(header);
+  // Upgrade notice \u2014 leading line so it reads as a transient banner (#738).
   pushUpgradeNoticeSegment(lines);
+  lines.push(header);
 
   // Separator
   lines.push(`${c.dim}${'─'.repeat(53)}${c.reset}`);
@@ -834,8 +842,9 @@ function generateCompactDashboard() {
   if (SL_CONFIG.show_session && session.duration) {
     header += `  ${c.dim}\u2502${c.reset}  ${c.cyan}\u23F1 ${session.duration}${c.reset}`;
   }
-  lines.push(header);
+  // Upgrade notice \u2014 leading line so it reads as a transient banner (#738).
   pushUpgradeNoticeSegment(lines);
+  lines.push(header);
 
   // Combined swarm + agentdb + mcp line
   const segments = [];

package/bin/lib/db-repair.mjs

@@ -0,0 +1,100 @@
+/**
+ * Memory-DB integrity check + auto-REINDEX (story #743).
+ *
+ * The `.moflo/moflo.db` SQLite file routinely accumulates index corruption of
+ * the form `row N missing from index sqlite_autoindex_memory_entries_1` —
+ * the row data is intact, only the unique-key index has drifted. The most
+ * common trigger is sql.js's whole-file dump-on-flush behaviour racing with
+ * concurrent writes (see `feedback_sqljs_writeback_clobber.md` and #714).
+ *
+ * Symptoms when uncorrected:
+ *  - `index-guidance.mjs` and `index-patterns.mjs` fail mid-write with
+ *    `database disk image is malformed`, leaving partial state.
+ *  - The ephemeral-namespace purge (#729) fails silently, so hive-mind /
+ *    tasklist / epic-state / test-bridge-fix rows accumulate.
+ *  - Vector counts in the statusline stay inflated (observed: 4415 with
+ *    1025 unpurged ephemeral rows).
+ *
+ * Fix shape: REINDEX rebuilds indexes from the canonical row data — much less
+ * destructive than a full rebuild and works for the typical drift mode. If
+ * REINDEX itself fails to restore integrity we leave the file alone and
+ * report; manual `flo memory rebuild-index` is the fallback.
+ *
+ * MUST run BEFORE any long-lived sql.js consumer (MCP server, daemon) opens
+ * the DB and BEFORE the embeddings migration / soft-delete purge / ephemeral
+ * purge — those all swallow corruption errors and silently no-op.
+ */
+import { existsSync, readFileSync, writeFileSync } from 'node:fs';
+import { memoryDbPath } from './moflo-paths.mjs';
+
+let _initSqlJs = null;
+
+async function loadSqlJs() {
+  if (_initSqlJs) return _initSqlJs;
+  // sql.js is a hard dependency of moflo (see top-level package.json);
+  // resolving it from the consumer's node_modules works because the launcher
+  // runs from the consumer cwd.
+  const mod = await import('sql.js');
+  _initSqlJs = mod.default || mod;
+  return _initSqlJs;
+}
+
+function isOk(execResult) {
+  const rows = execResult?.[0]?.values ?? [];
+  return rows.length === 1 && rows[0]?.[0] === 'ok';
+}
+
+function corruptionCount(execResult) {
+  return execResult?.[0]?.values?.length ?? 0;
+}
+
+/**
+ * Probe the memory DB for index corruption and run REINDEX in place if
+ * found. Returns `{ repaired, errors, persistent }`:
+ *  - `repaired: true` and `errors > 0` when REINDEX restored integrity.
+ *  - `repaired: false, errors: 0` when the DB is healthy or absent.
+ *  - `repaired: false, errors > 0, persistent: true` when corruption survives
+ *    REINDEX (caller should surface to the user — manual rebuild needed).
+ *
+ * Never throws; any internal failure becomes `{ repaired: false, errors: 0 }`
+ * so a probe failure cannot block session start.
+ */
+export async function repairMemoryDbIfCorrupt(projectRoot) {
+  const dbPath = memoryDbPath(projectRoot);
+  if (!existsSync(dbPath)) return { repaired: false, errors: 0 };
+
+  let initSql;
+  try {
+    initSql = await loadSqlJs();
+  } catch {
+    return { repaired: false, errors: 0 };
+  }
+
+  let db = null;
+  try {
+    const SQL = await initSql();
+    const data = readFileSync(dbPath);
+    db = new SQL.Database(data);
+
+    const before = db.exec('PRAGMA integrity_check');
+    if (isOk(before)) {
+      return { repaired: false, errors: 0 };
+    }
+
+    const errors = corruptionCount(before);
+    db.run('REINDEX');
+
+    const after = db.exec('PRAGMA integrity_check');
+    if (!isOk(after)) {
+      return { repaired: false, errors, persistent: true };
+    }
+
+    const out = Buffer.from(db.export());
+    writeFileSync(dbPath, out);
+    return { repaired: true, errors };
+  } catch {
+    return { repaired: false, errors: 0 };
+  } finally {
+    if (db) try { db.close(); } catch { /* non-fatal */ }
+  }
+}

package/bin/session-start-launcher.mjs

@@ -9,9 +9,10 @@
 
 import { spawn } from 'child_process';
 import { existsSync, readFileSync, writeFileSync, copyFileSync, unlinkSync, readdirSync, mkdirSync, statSync } from 'fs';
-import { resolve, dirname } from 'path';
+import { resolve, dirname, join } from 'path';
 import { fileURLToPath } from 'url';
-import { migrateClaudeFlowToMoflo, migrateMemoryDbToMoflo } from './lib/moflo-paths.mjs';
+import { migrateClaudeFlowToMoflo, migrateMemoryDbToMoflo, mofloDir } from './lib/moflo-paths.mjs';
+import { repairMemoryDbIfCorrupt } from './lib/db-repair.mjs';
 
 const __dirname = dirname(fileURLToPath(import.meta.url));
 
@@ -56,6 +57,55 @@ const plural = (n, word) => `${n} ${word}${n === 1 ? '' : 's'}`;
 // can persist `.moflo/upgrade-notice.json` for the statusline (#636).
 let upgradeNoticeContext = null;
 
+// Deferred so we commit it AFTER every upgrade-work block (see 3g). The stamp
+// is the "launcher fully completed" signal — writing it mid-flight lets an
+// aborted launcher strand consumers on a half-applied upgrade (#730).
+let pendingVersionStampWrite = null;
+
+// 5-min TTL is a safety net for zombie launchers (statusline ignores past-TTL
+// files). The launcher deletes the notice when upgrade work finishes — no
+// "complete" state lingers, see #738.
+const UPGRADE_NOTICE_INPROGRESS_TTL_MS = 5 * 60 * 1000;
+const UPGRADE_NOTICE_PATH = () => join(mofloDir(projectRoot), 'upgrade-notice.json');
+
+function writeInProgressUpgradeNotice() {
+  if (!upgradeNoticeContext) return;
+  try {
+    mkdirSync(mofloDir(projectRoot), { recursive: true });
+    const now = Date.now();
+    const notice = {
+      status: 'in-progress',
+      kind: upgradeNoticeContext.kind,
+      from: upgradeNoticeContext.from,
+      to: upgradeNoticeContext.to,
+      at: new Date(now).toISOString(),
+      expiresAt: new Date(now + UPGRADE_NOTICE_INPROGRESS_TTL_MS).toISOString(),
+      changes: 0,
+    };
+    writeFileSync(UPGRADE_NOTICE_PATH(), JSON.stringify(notice, null, 2));
+  } catch { /* non-fatal — statusline just won't show the segment */ }
+}
+
+function clearUpgradeNotice() {
+  try {
+    unlinkSync(UPGRADE_NOTICE_PATH());
+  } catch { /* non-fatal — already gone or never existed */ }
+}
+
+// ── 0-pre. Drop any stale upgrade notice (#738, #743) ───────────────────────
+// `upgrade-notice.json` is a transient handshake between launcher and
+// statusline — it should never survive past the launcher run that wrote it.
+// Pre-#738 launchers wrote a 1-hour-TTL "complete" notice after upgrade work
+// finished; with the #738 contract that file can only be a leftover, but the
+// statusline still rendered it for the rest of the hour. Unconditionally
+// removing it here makes the contract self-healing — any future zombie
+// notice (legacy file, aborted launcher, future writer mistake) gets dropped
+// before the statusline can see it. The in-progress notice for THIS session,
+// if any, is written later in section 3 and cleared in section 3f.
+try {
+  unlinkSync(join(mofloDir(projectRoot), 'upgrade-notice.json'));
+} catch { /* non-fatal — file usually doesn't exist */ }
+
 // ── 0. LEGACY state migration (#699) ─────────────────────────────────────────
 // Consumers upgrading from older moflo builds (inherited from upstream Ruflo)
 // get a one-time auto-migration of LEGACY `.claude-flow/` → `.moflo/` so claim
@@ -91,6 +141,38 @@ try {
   // Non-fatal — failed migration leaves both DBs in place; next session retries.
 }
 
+// ── 0c. Memory DB index repair (#743) ───────────────────────────────────────
+// The .moflo/moflo.db SQLite file accumulates index corruption ("row N missing
+// from sqlite_autoindex_memory_entries_1") when sql.js's whole-file flush
+// races with concurrent writes. Symptom is silent: indexers fail mid-write,
+// the ephemeral-namespace purge (#729) silently no-ops, vector counts inflate.
+//
+// Probe + REINDEX in place. Must run BEFORE any sql.js consumer (the
+// embeddings migration in 3e, the soft-delete + ephemeral purges in 3e-728/
+// 3e-729, and the long-lived MCP server / daemon spawned in section 4) — all
+// of those swallow corruption errors and silently drop work on the floor.
+//
+// Awaited because every downstream sql.js touch this session depends on a
+// healthy index. Cost on the happy path is one PRAGMA check (~10ms).
+try {
+  const repair = await repairMemoryDbIfCorrupt(projectRoot);
+  if (repair?.repaired) {
+    emitMutation(
+      'repaired memory db index',
+      `${plural(repair.errors, 'index error')} fixed via REINDEX`,
+    );
+  } else if (repair?.persistent) {
+    // Surface to stderr — Claude additionalContext + the user both see this.
+    // Manual `flo memory rebuild-index` is the next step.
+    process.stderr.write(
+      `moflo: memory db has ${plural(repair.errors, 'index error')} REINDEX could not fix — run 'flo memory rebuild-index'\n`,
+    );
+  }
+} catch {
+  // Non-fatal — repair is best-effort; downstream code paths report their
+  // own errors if the DB is still broken.
+}
+
 // ── 1. Helper: fire-and-forget a background process ─────────────────────────
 function fireAndForget(cmd, args, label) {
   try {
@@ -213,6 +295,11 @@ try {
         };
         emitMutation('repaired stale install', 'manifest drift detected');
       }
+      // Surface a transient "(updating…)" badge in the statusline before the
+      // long-running upgrade work (manifest sync, daemon recycle, embeddings
+      // migration). See #738 — the launcher clears this file after work
+      // completes, so the badge naturally disappears once the user is unblocked.
+      writeInProgressUpgradeNotice();
       const binDir = resolve(projectRoot, 'node_modules/moflo/bin');
 
       // ── Manifest-based auto-update ──────────────────────────────────────
@@ -358,12 +445,13 @@ try {
         }
       } catch { /* non-fatal — daemon recycle is best-effort */ }
 
-      // Write updated manifest + version stamp
+      // Manifest reflects synced files immediately; version stamp is deferred
+      // to 3g so an aborted launcher re-runs upgrade detection (#730).
       try {
         const cfDir = resolve(projectRoot, '.moflo');
         if (!existsSync(cfDir)) mkdirSync(cfDir, { recursive: true });
         writeFileSync(manifestPath, JSON.stringify(currentManifest, null, 2));
-        writeFileSync(versionStampPath, installedVersion);
+        pendingVersionStampWrite = { path: versionStampPath, version: installedVersion };
       } catch {}
     }
   }
@@ -665,37 +753,83 @@ try {
   } catch { /* writing the failure itself must not throw */ }
 }
 
-// ── 3f. Persist upgrade notice for statusline (#636) ────────────────────────
-// When this session bumped the version stamp or repaired manifest drift, write
-// a transient `.moflo/upgrade-notice.json` so the statusline can show a
-// leading user-visible segment (`📦 vX → vY (N changes)`). The file expires
-// via TTL — statusline silently ignores it after `expiresAt`. The next
-// upgrade overwrites the file, so no manual cleanup is needed.
-//
-// Stdout emits go to Claude's `additionalContext` (collapsed by default in
-// the system reminder); this notice surfaces the same information directly
-// in the user's UI. Together they close the "Claude appears hung and CPU
-// spikes" gap from #629 — the user always knows when an upgrade procedure
-// just ran.
-const UPGRADE_NOTICE_TTL_MS = 60 * 60 * 1000; // 1 hour
-if (upgradeNoticeContext && mutationCount > 0) {
+// ── 3e-728. Hard-delete leftover soft-delete tombstones (#728) ─────────────
+// Soft-delete was retired in story #728 — `status='deleted'` rows are now
+// unrecoverable bloat from prior moflo versions. Purge any stragglers and
+// VACUUM. Idempotent: returns `purged: 0` once the DB is clean. Runs BEFORE
+// background MCP/daemon spawn (per #727's clobber-hazard analysis) so the
+// foreground sql.js write isn't overwritten by a concurrent flush.
+try {
+  const purgePaths = [
+    resolve(projectRoot, 'node_modules/moflo/dist/src/cli/services/soft-delete-purge.js'),
+    resolve(projectRoot, 'dist/src/cli/services/soft-delete-purge.js'),
+  ];
+  const purgePath = purgePaths.find((p) => existsSync(p));
+  if (purgePath) {
+    const { purgeSoftDeletedEntries } = await import(`file://${purgePath.replace(/\\/g, '/')}`);
+    const result = await purgeSoftDeletedEntries();
+    if (result?.purged > 0) {
+      emitMutation(
+        'reclaimed soft-deleted memory entries',
+        `${plural(result.purged, 'tombstone')} purged + VACUUM`,
+      );
+    }
+  }
+} catch (err) {
+  // Non-fatal — leftover tombstones just sit until the next session retries.
   try {
-    const cfDir = resolve(projectRoot, '.moflo');
-    if (!existsSync(cfDir)) mkdirSync(cfDir, { recursive: true });
-    const now = Date.now();
-    const notice = {
-      kind: upgradeNoticeContext.kind,
-      from: upgradeNoticeContext.from,
-      to: upgradeNoticeContext.to,
-      at: new Date(now).toISOString(),
-      expiresAt: new Date(now + UPGRADE_NOTICE_TTL_MS).toISOString(),
-      changes: mutationCount,
-    };
-    writeFileSync(
-      resolve(cfDir, 'upgrade-notice.json'),
-      JSON.stringify(notice, null, 2),
-    );
-  } catch { /* non-fatal — statusline just won't show the segment */ }
+    const msg = err && err.message ? err.message : String(err);
+    process.stderr.write(`soft-delete purge skipped: ${msg}\n`);
+  } catch { /* writing the failure itself must not throw */ }
+}
+
+// ── 3e-729. Purge ephemeral-namespace rows (#729) ───────────────────────────
+// Four namespaces (hive-mind, tasklist, epic-state, test-bridge-fix) store
+// internal moflo run-tracking — never user knowledge — and were polluting the
+// embeddings index. Going forward, writes to those namespaces skip embedding
+// generation (see EPHEMERAL_NAMESPACES in memory/bridge-embedder.ts); existing
+// rows from prior versions get hard-deleted here. Idempotent — returns
+// `purged: 0` once the DB is clean. Runs BEFORE background MCP/daemon spawn
+// so the foreground sql.js write isn't overwritten by a concurrent flush.
+try {
+  const purgePaths = [
+    resolve(projectRoot, 'node_modules/moflo/dist/src/cli/services/ephemeral-namespace-purge.js'),
+    resolve(projectRoot, 'dist/src/cli/services/ephemeral-namespace-purge.js'),
+  ];
+  const purgePath = purgePaths.find((p) => existsSync(p));
+  if (purgePath) {
+    const { purgeEphemeralNamespaces } = await import(`file://${purgePath.replace(/\\/g, '/')}`);
+    const result = await purgeEphemeralNamespaces();
+    if (result?.purged > 0) {
+      emitMutation(
+        'pruned ephemeral namespace rows',
+        `${plural(result.purged, 'row')} from internal run-tracking`,
+      );
+    }
+  }
+} catch (err) {
+  // Non-fatal — leftover rows just sit until the next session retries.
+  try {
+    const msg = err && err.message ? err.message : String(err);
+    process.stderr.write(`ephemeral-namespace purge skipped: ${msg}\n`);
+  } catch { /* writing the failure itself must not throw */ }
+}
+
+// ── 3f. Clear the in-progress upgrade notice (#636, #738) ───────────────────
+// Upgrade work is finished; drop the notice so the statusline badge disappears
+// immediately. Change summary is already in stdout emits (Claude's
+// `additionalContext`); a lingering "you upgraded a while ago" badge is noise.
+if (upgradeNoticeContext) {
+  clearUpgradeNotice();
+}
+
+// ── 3g. Commit deferred version stamp (#730) ────────────────────────────────
+// Written LAST so an abort above leaves the stamp unchanged and the next
+// launcher re-detects the upgrade.
+if (pendingVersionStampWrite) {
+  try {
+    writeFileSync(pendingVersionStampWrite.path, pendingVersionStampWrite.version);
+  } catch { /* non-fatal — next launcher re-detects + retries the upgrade */ }
 }
 
 // Bypasses emitMutation — framing, not a mutation, so it must not inflate the count.

package/dist/src/cli/memory/application/commands/delete-memory.command.js

@@ -1,8 +1,10 @@
 /**
  * Delete Memory Command - Application Layer (CQRS)
  *
- * Command for deleting memory entries.
- * Supports soft delete and hard delete.
+ * Hard-deletes memory entries. Soft-delete was retired in story #728 because
+ * tombstones were write-only (no code path ever restored a `status='deleted'`
+ * row) and bloated the DB indefinitely. The legitimate "keep but hide" case
+ * is `archived` — see `MemoryEntry.archive()` / `restore()`.
  *
  * @module v3/memory/application/commands
  */
@@ -25,42 +27,10 @@ export class DeleteMemoryCommandHandler {
             entryId = entry?.id;
         }
         if (!entryId) {
-            return {
-                success: false,
-                deleted: false,
-                wasHardDelete: false,
-            };
+            return { success: false, deleted: false };
         }
-        if (input.hardDelete) {
-            // Hard delete - remove from database
-            const deleted = await this.repository.delete(entryId);
-            return {
-                success: true,
-                deleted,
-                entryId,
-                wasHardDelete: true,
-            };
-        }
-        else {
-            // Soft delete - mark as deleted
-            const entry = await this.repository.findById(entryId);
-            if (entry) {
-                entry.delete();
-                await this.repository.save(entry);
-                return {
-                    success: true,
-                    deleted: true,
-                    entryId,
-                    wasHardDelete: false,
-                };
-            }
-        }
-        return {
-            success: false,
-            deleted: false,
-            entryId,
-            wasHardDelete: false,
-        };
+        const deleted = await this.repository.delete(entryId);
+        return { success: true, deleted, entryId };
     }
 }
 /**
@@ -83,47 +53,15 @@ export class BulkDeleteMemoryCommandHandler {
                 .map((e) => e.id);
         }
         if (idsToDelete.length === 0) {
-            return {
-                success: true,
-                deletedCount: 0,
-                failedCount: 0,
-                errors: [],
-            };
-        }
-        if (input.hardDelete) {
-            const result = await this.repository.deleteMany(idsToDelete);
-            return {
-                success: result.failed === 0,
-                deletedCount: result.success,
-                failedCount: result.failed,
-                errors: result.errors,
-            };
-        }
-        else {
-            // Soft delete
-            const entries = await this.repository.findByIds(idsToDelete);
-            let deletedCount = 0;
-            const errors = [];
-            for (const entry of entries) {
-                try {
-                    entry.delete();
-                    await this.repository.save(entry);
-                    deletedCount++;
-                }
-                catch (error) {
-                    errors.push({
-                        id: entry.id,
-                        error: error instanceof Error ? error.message : 'Unknown error',
-                    });
-                }
-            }
-            return {
-                success: errors.length === 0,
-                deletedCount,
-                failedCount: errors.length,
-                errors,
-            };
+            return { success: true, deletedCount: 0, failedCount: 0, errors: [] };
         }
+        const result = await this.repository.deleteMany(idsToDelete);
+        return {
+            success: result.failed === 0,
+            deletedCount: result.success,
+            failedCount: result.failed,
+            errors: result.errors,
+        };
     }
 }
 //# sourceMappingURL=delete-memory.command.js.map

package/dist/src/cli/memory/application/services/memory-application-service.js

@@ -101,25 +101,24 @@ export class MemoryApplicationService {
     /**
      * Delete a memory entry by namespace and key
      */
-    async delete(namespace, key, hardDelete = false) {
-        const result = await this.deleteHandler.execute({ namespace, key, hardDelete });
+    async delete(namespace, key) {
+        const result = await this.deleteHandler.execute({ namespace, key });
         return result.deleted;
     }
     /**
      * Delete a memory entry by ID
      */
-    async deleteById(id, hardDelete = false) {
-        const result = await this.deleteHandler.execute({ id, hardDelete });
+    async deleteById(id) {
+        const result = await this.deleteHandler.execute({ id });
         return result.deleted;
     }
     /**
      * Delete all entries in a namespace
      */
-    async deleteNamespace(namespace, hardDelete = false) {
+    async deleteNamespace(namespace) {
         const entries = await this.repository.findByNamespace(namespace);
         const result = await this.bulkDeleteHandler.execute({
             ids: entries.map((e) => e.id),
-            hardDelete,
         });
         return result.deletedCount;
     }

package/dist/src/cli/memory/bridge-core.js

@@ -222,7 +222,7 @@ const MEMORY_ENTRIES_DDL = `CREATE TABLE IF NOT EXISTS memory_entries (
   expires_at INTEGER,
   last_accessed_at INTEGER,
   access_count INTEGER DEFAULT 0,
-  status TEXT DEFAULT 'active' CHECK(status IN ('active', 'archived', 'deleted')),
+  status TEXT DEFAULT 'active' CHECK(status IN ('active', 'archived')),
   UNIQUE(namespace, key)
 )`;
 export function getDb(registry) {

package/dist/src/cli/memory/bridge-embedder.js

@@ -42,6 +42,27 @@ export const EMBEDDING_MODEL_OPT_OUT = 'none';
  * #651 doctor check can detect pre-fix residue without re-typing the literal.
  */
 export const EMBEDDING_MODEL_LEGACY_DEFAULT = 'local';
+/**
+ * Namespaces that store internal moflo run-tracking, never user knowledge.
+ * Writes here skip embedding generation entirely — both `embedding` and
+ * `embedding_model` land as NULL, distinct from the opt-out path which still
+ * tags rows with `'none'`. Existing rows in these namespaces are hard-deleted
+ * on upgrade by `services/ephemeral-namespace-purge.ts`.
+ *
+ * Members:
+ * - `hive-mind`     — MCP broadcast traffic (msg:*, agent_join, consensus_propose)
+ * - `tasklist`      — Spell run records (sp-*) written by spells/core/runner.ts + daemon-dashboard.ts
+ * - `epic-state`    — Epic progress (epic-N, story-M) written by commands/epic.ts
+ * - `test-bridge-fix` — Single 2026-04-23 row left over from a one-off test
+ *
+ * See story #729 for the source-trace and rationale.
+ */
+export const EPHEMERAL_NAMESPACES = new Set([
+    'hive-mind',
+    'tasklist',
+    'epic-state',
+    'test-bridge-fix',
+]);
 let cachedEmbedder = null;
 let testOverride = null;
 class LazyFastembedBridgeEmbedder {
@@ -83,7 +104,24 @@ class LazyFastembedBridgeEmbedder {
         return vector;
     }
 }
-export async function resolveBridgeEmbedding(value, precomputed, generateEmbeddingFlag) {
+/**
+ * Build the `embedding` field of a store-entry response from a resolved
+ * embedding. Returns `undefined` for skip paths (opt-out and ephemeral) so
+ * the caller can pass it straight through.
+ */
+export function embeddingResponseFrom(resolved) {
+    // json !== null narrows to the embedded variant where model is `string`.
+    return resolved.json !== null
+        ? { dimensions: resolved.dimensions, model: resolved.model }
+        : undefined;
+}
+export async function resolveBridgeEmbedding(value, precomputed, generateEmbeddingFlag, namespace) {
+    // Ephemeral namespaces (run-tracking, never user knowledge) skip embeddings
+    // unconditionally — even precomputed vectors are dropped. Result row has
+    // `embedding IS NULL` and `embedding_model IS NULL`. See #729.
+    if (namespace && EPHEMERAL_NAMESPACES.has(namespace)) {
+        return { ok: true, json: null, dimensions: 0, model: null };
+    }
     const wantsEmbedding = generateEmbeddingFlag !== false && value.length > 0;
     if (!wantsEmbedding) {
         return { ok: true, json: null, dimensions: 0, model: EMBEDDING_MODEL_OPT_OUT };

package/dist/src/cli/memory/bridge-entries.js

@@ -8,7 +8,7 @@
  * @module v3/cli/bridge-entries
  */
 import { cosineSim, execRows, generateId, persistBridgeDb, refreshVectorStatsCache, withDb } from './bridge-core.js';
-import { resolveBridgeEmbedding } from './bridge-embedder.js';
+import { embeddingResponseFrom, resolveBridgeEmbedding } from './bridge-embedder.js';
 function makeEntryCacheKey(namespace, key) {
     const safeNs = String(namespace).replace(/:/g, '_');
     const safeKey = String(key).replace(/:/g, '_');
@@ -98,13 +98,12 @@ export async function bridgeStoreEntry(options) {
         if (!guardResult.allowed) {
             return { success: false, id, error: `MutationGuard rejected: ${guardResult.reason}` };
         }
-        const resolved = await resolveBridgeEmbedding(value, options.precomputedEmbedding, options.generateEmbeddingFlag);
+        const resolved = await resolveBridgeEmbedding(value, options.precomputedEmbedding, options.generateEmbeddingFlag, namespace);
         if (!resolved.ok) {
             return { success: false, id, error: `embedding generation failed: ${resolved.reason}` };
         }
-        const embeddingJson = resolved.json;
-        const dimensions = resolved.dimensions;
-        const model = resolved.model;
+        const { json: embeddingJson, dimensions, model } = resolved;
+        const embeddingResponse = embeddingResponseFrom(resolved);
         const insertSql = options.upsert
             ? `INSERT OR REPLACE INTO memory_entries (
           id, key, namespace, content, type,
@@ -135,7 +134,7 @@ export async function bridgeStoreEntry(options) {
         return {
             success: true,
             id,
-            embedding: embeddingJson ? { dimensions, model } : undefined,
+            embedding: embeddingResponse,
             guarded: true,
             cached: true,
             attested: true,
@@ -175,12 +174,13 @@ export async function bridgeStoreEntries(items, dbPath) {
             const { key, value, namespace = 'default', tags = [], ttl } = opts;
             const id = generateId('entry');
             const now = Date.now();
-            const resolved = await resolveBridgeEmbedding(value, opts.precomputedEmbedding, opts.generateEmbeddingFlag);
+            const resolved = await resolveBridgeEmbedding(value, opts.precomputedEmbedding, opts.generateEmbeddingFlag, namespace);
             if (!resolved.ok) {
                 results.push({ success: false, id, error: `embedding generation failed: ${resolved.reason}` });
                 continue;
             }
             const { json: embeddingJson, dimensions, model } = resolved;
+            const embeddingResponse = embeddingResponseFrom(resolved);
             const insertSql = opts.upsert
                 ? `INSERT OR REPLACE INTO memory_entries (
             id, key, namespace, content, type,
@@ -217,7 +217,7 @@ export async function bridgeStoreEntries(items, dbPath) {
             results.push({
                 success: true,
                 id,
-                embedding: embeddingJson ? { dimensions, model } : undefined,
+                embedding: embeddingResponse,
             });
         }
         // Cache writes and attestation logs are independent post-hoc bookkeeping —
@@ -436,10 +436,9 @@ export async function bridgeDeleteEntry(options) {
         let changes = 0;
         try {
             ctx.db.prepare(`
-        UPDATE memory_entries
-        SET status = 'deleted', updated_at = ?
+        DELETE FROM memory_entries
         WHERE key = ? AND namespace = ? AND status = 'active'
-      `).run([Date.now(), key, namespace]);
+      `).run([key, namespace]);
             // sql.js Statement.run returns true/false, not { changes }. Use
             // db.getRowsModified() to read the row count from the last statement.
             changes = ctx.db.getRowsModified?.() ?? 0;

package/dist/src/cli/memory/domain/entities/memory-entry.js

@@ -150,13 +150,6 @@ export class MemoryEntry {
             this._updatedAt = new Date();
         }
     }
-    /**
-     * Mark as deleted (soft delete)
-     */
-    delete() {
-        this._status = 'deleted';
-        this._updatedAt = new Date();
-    }
     /**
      * Check if memory has expired based on TTL
      */

package/dist/src/cli/memory/infrastructure/repositories/hybrid-memory-repository.js

@@ -294,7 +294,6 @@ export class HybridMemoryRepository {
         let totalSize = 0;
         let activeCount = 0;
         let archivedCount = 0;
-        let deletedCount = 0;
         for (const entry of entries) {
             // Count by namespace
             entriesByNamespace[entry.namespace] = (entriesByNamespace[entry.namespace] ?? 0) + 1;
@@ -311,9 +310,6 @@ export class HybridMemoryRepository {
                 case 'archived':
                     archivedCount++;
                     break;
-                case 'deleted':
-                    deletedCount++;
-                    break;
             }
         }
         // Find hottest and coldest
@@ -324,7 +320,6 @@ export class HybridMemoryRepository {
             totalEntries: entries.length,
             activeEntries: activeCount,
             archivedEntries: archivedCount,
-            deletedEntries: deletedCount,
             totalSize,
             entriesByNamespace,
             entriesByType,

package/dist/src/cli/memory/memory-initializer.js

@@ -14,7 +14,7 @@ import { mofloImport } from '../services/moflo-require.js';
 import { atomicWriteFileSync } from '../services/atomic-file-write.js';
 import { formatEmbeddingError } from './embedding-errors.js';
 import { HnswLite } from './hnsw-lite.js';
-import { EMBEDDING_MODEL_OPT_OUT, getBridgeEmbedder } from './bridge-embedder.js';
+import { EMBEDDING_MODEL_OPT_OUT, EPHEMERAL_NAMESPACES, getBridgeEmbedder } from './bridge-embedder.js';
 import { toFloat32 } from './controllers/_shared.js';
 import { writeVectorStatsJson } from './bridge-core.js';
 import { MOFLO_DIR, hnswIndexPath, legacyMemoryDbPath, memoryDbPath, } from '../services/moflo-paths.js';
@@ -104,7 +104,7 @@ CREATE TABLE IF NOT EXISTS memory_entries (
   access_count INTEGER DEFAULT 0,
 
   -- Status
-  status TEXT DEFAULT 'active' CHECK(status IN ('active', 'archived', 'deleted')),
+  status TEXT DEFAULT 'active' CHECK(status IN ('active', 'archived')),
 
   UNIQUE(namespace, key)
 );
@@ -1592,10 +1592,15 @@ export async function storeEntry(options) {
         // success:false rather than inserting a null-embedded row. Opt-out rows
         // (generateEmbeddingFlag=false) are tagged EMBEDDING_MODEL_OPT_OUT — see
         // the constant's docstring in bridge-embedder.ts for the rationale.
+        // Ephemeral namespaces (#729) skip embedding entirely AND tag model NULL.
         let embeddingJson = null;
         let embeddingDimensions = null;
         let embeddingModel = EMBEDDING_MODEL_OPT_OUT;
-        if (generateEmbeddingFlag && value.length > 0) {
+        const isEphemeralNs = EPHEMERAL_NAMESPACES.has(namespace);
+        if (isEphemeralNs) {
+            embeddingModel = null;
+        }
+        else if (generateEmbeddingFlag && value.length > 0) {
             if (options.precomputedEmbedding) {
                 // Tag with the bridge embedder's canonical model so precomputed rows
                 // are indistinguishable from live single-embed rows downstream.
@@ -2019,14 +2024,10 @@ export async function deleteEntry(options) {
                 error: `Key '${key}' not found in namespace '${namespace}'`
             };
         }
-        // Delete the entry (soft delete by setting status to 'deleted')
-        db.run(`
-      UPDATE memory_entries
-      SET status = 'deleted', updated_at = strftime('%s', 'now') * 1000
-      WHERE key = '${key.replace(/'/g, "''")}'
-        AND namespace = '${namespace.replace(/'/g, "''")}'
-        AND status = 'active'
-    `);
+        // Hard-delete the entry. Soft-delete was retired in story #728: tombstones
+        // were write-only (no code ever restored from status='deleted') and bloated
+        // the DB indefinitely.
+        db.run(`DELETE FROM memory_entries WHERE key = ? AND namespace = ? AND status = 'active'`, [key, namespace]);
         // Get remaining count
         const countResult = db.exec(`SELECT COUNT(*) FROM memory_entries WHERE status = 'active'`);
         const remainingEntries = countResult[0]?.values?.[0]?.[0] || 0;

package/dist/src/cli/services/ephemeral-namespace-purge.js

@@ -0,0 +1,75 @@
+/**
+ * Idempotent ephemeral-namespace purge for moflo's memory DB (`.moflo/moflo.db`).
+ *
+ * Story #729 retired four namespaces from the persistent memory layer because
+ * they store internal moflo run-tracking — not user knowledge — and embedding
+ * them polluted the search index:
+ *
+ *  - `hive-mind`        (MCP broadcast traffic)
+ *  - `tasklist`         (spell run records)
+ *  - `epic-state`       (epic progress tracking)
+ *  - `test-bridge-fix`  (single-row leftover from a one-off test)
+ *
+ * This service hard-deletes any rows in those namespaces left over from prior
+ * moflo versions, then VACUUMs to reclaim disk. Future writes to these
+ * namespaces still land in the DB — but skip embedding generation entirely
+ * (see {@link EPHEMERAL_NAMESPACES} in `memory/bridge-embedder.ts`).
+ *
+ * Lives in `services/` so it has no dependency on the CLI command machinery.
+ * That lets `bin/session-start-launcher.mjs` dynamic-import it and run the
+ * purge in foreground BEFORE long-lived sql.js consumers (MCP server, daemon)
+ * open the DB — sql.js dumps the whole snapshot on every flush and would
+ * otherwise clobber our cleanup (see #727's clobber-hazard analysis).
+ *
+ * @module cli/services/ephemeral-namespace-purge
+ */
+/* eslint-disable @typescript-eslint/no-explicit-any */
+import { EPHEMERAL_NAMESPACES } from '../memory/bridge-embedder.js';
+import { mofloImport } from './moflo-require.js';
+import { atomicWriteFileSync } from './atomic-file-write.js';
+import { memoryDbPath } from './moflo-paths.js';
+/**
+ * Hard-delete every row whose namespace is in {@link EPHEMERAL_NAMESPACES}
+ * and VACUUM. Returns `{ purged: 0 }` on the happy path: no DB, sql.js
+ * unavailable, schema lacks `memory_entries`, or no ephemeral rows present.
+ * Errors propagate to the caller (the launcher absorbs them so a failed
+ * purge never blocks session start).
+ */
+export async function purgeEphemeralNamespaces(options = {}) {
+    const fs = await import('fs');
+    const path = await import('path');
+    const dbPath = path.resolve(options.dbPath ?? memoryDbPath(process.cwd()));
+    if (!fs.existsSync(dbPath))
+        return { purged: 0 };
+    const initSqlJs = (await mofloImport('sql.js'))?.default;
+    if (!initSqlJs)
+        return { purged: 0 };
+    const SQL = await initSqlJs();
+    const buffer = fs.readFileSync(dbPath);
+    const db = new SQL.Database(buffer);
+    try {
+        // Probe: schema must carry `memory_entries`. Older / non-moflo DBs are
+        // a no-op so we don't VACUUM unrelated SQLite files.
+        const probe = db.exec(`SELECT name FROM sqlite_master WHERE type='table' AND name='memory_entries' LIMIT 1`);
+        if (!probe[0]?.values?.[0])
+            return { purged: 0 };
+        const namespaces = Array.from(EPHEMERAL_NAMESPACES);
+        const placeholders = namespaces.map(() => '?').join(', ');
+        // Single-scan delete + rowsModified: skips a redundant COUNT pass on dirty
+        // DBs and avoids the prepare/bind/step/free overhead on clean ones. VACUUM
+        // (and the disk write) only run when something was actually deleted.
+        db.run(`DELETE FROM memory_entries WHERE namespace IN (${placeholders})`, namespaces);
+        const purged = db.getRowsModified?.() ?? 0;
+        if (purged === 0)
+            return { purged: 0 };
+        // VACUUM has to run outside any open transaction; sql.js auto-commits
+        // each `db.run`, so this is safe to chain.
+        db.run('VACUUM');
+        atomicWriteFileSync(dbPath, db.export());
+        return { purged };
+    }
+    finally {
+        db.close();
+    }
+}
+//# sourceMappingURL=ephemeral-namespace-purge.js.map

package/dist/src/cli/services/soft-delete-purge.js

@@ -0,0 +1,66 @@
+/**
+ * Idempotent soft-delete purge for moflo's memory DB (`.moflo/moflo.db`).
+ *
+ * Story #728 retired soft-delete from the memory layer: tombstones were
+ * write-only (no code path ever restored a `status='deleted'` row) and bloated
+ * the DB indefinitely. This service hard-deletes any leftover `status='deleted'`
+ * rows from prior moflo versions, then VACUUMs to reclaim disk. `archived`
+ * rows are NOT touched — they are the legitimate "keep but hide" state and
+ * have a working `restore()` path.
+ *
+ * Lives in `services/` so it has no dependency on the CLI command machinery.
+ * That lets `bin/session-start-launcher.mjs` dynamic-import it and run the
+ * purge in foreground BEFORE long-lived sql.js consumers (MCP server, daemon)
+ * open the DB — sql.js dumps the whole snapshot on every flush and would
+ * otherwise clobber our cleanup.
+ *
+ * @module cli/services/soft-delete-purge
+ */
+/* eslint-disable @typescript-eslint/no-explicit-any */
+import { mofloImport } from './moflo-require.js';
+import { atomicWriteFileSync } from './atomic-file-write.js';
+import { memoryDbPath } from './moflo-paths.js';
+/**
+ * Hard-delete all `status='deleted'` rows from the memory DB and VACUUM.
+ *
+ * Returns `{ purged: 0 }` for the happy path: no DB, sql.js unavailable,
+ * schema lacks `memory_entries`, or no tombstones present. Errors propagate
+ * to the caller (the launcher absorbs them so a failed purge never blocks
+ * session start).
+ */
+export async function purgeSoftDeletedEntries(options = {}) {
+    const fs = await import('fs');
+    const path = await import('path');
+    const dbPath = path.resolve(options.dbPath ?? memoryDbPath(process.cwd()));
+    if (!fs.existsSync(dbPath))
+        return { purged: 0 };
+    const initSqlJs = (await mofloImport('sql.js'))?.default;
+    if (!initSqlJs)
+        return { purged: 0 };
+    const SQL = await initSqlJs();
+    const buffer = fs.readFileSync(dbPath);
+    const db = new SQL.Database(buffer);
+    try {
+        // Probe: schema must carry `memory_entries`. Older / non-moflo DBs are
+        // a no-op so we don't VACUUM unrelated SQLite files.
+        const probe = db.exec(`SELECT name FROM sqlite_master WHERE type='table' AND name='memory_entries' LIMIT 1`);
+        if (!probe[0]?.values?.[0])
+            return { purged: 0 };
+        // Count first — VACUUM is expensive (it rewrites the whole file), so we
+        // skip it entirely when there's nothing to reclaim.
+        const countRows = db.exec(`SELECT COUNT(*) FROM memory_entries WHERE status = 'deleted'`);
+        const purged = Number(countRows[0]?.values?.[0]?.[0] ?? 0);
+        if (purged === 0)
+            return { purged: 0 };
+        db.run(`DELETE FROM memory_entries WHERE status = 'deleted'`);
+        // VACUUM has to run outside any open transaction; sql.js auto-commits
+        // each `db.run`, so this is safe to chain.
+        db.run('VACUUM');
+        atomicWriteFileSync(dbPath, db.export());
+        return { purged };
+    }
+    finally {
+        db.close();
+    }
+}
+//# sourceMappingURL=soft-delete-purge.js.map

package/dist/src/cli/transfer/storage/gcs.js

@@ -23,12 +23,20 @@ export function getGCSConfig() {
         prefix: process.env.GCS_PREFIX || 'claude-flow-patterns',
     };
 }
+// Bound the subprocess so a slow / hung gcloud spawn doesn't stretch test
+// timeouts (or session-start probes) indefinitely. gcloud responds in ~100ms
+// when present; 5s is generous for a contended CI runner.
+const GCLOUD_PROBE_TIMEOUT_MS = 5_000;
 /**
  * Check if gcloud CLI is available
  */
 export function isGCloudAvailable() {
     try {
-        execSync('gcloud --version', { stdio: 'pipe', windowsHide: true });
+        execSync('gcloud --version', {
+            stdio: 'pipe',
+            windowsHide: true,
+            timeout: GCLOUD_PROBE_TIMEOUT_MS,
+        });
         return true;
     }
     catch {
@@ -40,7 +48,11 @@ export function isGCloudAvailable() {
  */
 export async function isGCloudAuthenticated() {
     try {
-        execSync('gcloud auth print-access-token', { stdio: 'pipe', windowsHide: true });
+        execSync('gcloud auth print-access-token', {
+            stdio: 'pipe',
+            windowsHide: true,
+            timeout: GCLOUD_PROBE_TIMEOUT_MS,
+        });
         return true;
     }
     catch {

package/dist/src/cli/version.js

@@ -2,5 +2,5 @@
  * Auto-generated by build. Do not edit manually.
  * Source of truth: root package.json → scripts/sync-version.mjs
  */
-export const VERSION = '4.9.0-rc.2';
+export const VERSION = '4.9.0-rc.4';
 //# sourceMappingURL=version.js.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "moflo",
-  "version": "4.9.0-rc.2",
+  "version": "4.9.0-rc.4",
   "description": "MoFlo — AI agent orchestration for Claude Code. Forked from ruflo/claude-flow with patches applied to source, plus feature-level orchestration.",
   "main": "dist/src/cli/index.js",
   "type": "module",
@@ -78,7 +78,7 @@
     "@typescript-eslint/eslint-plugin": "^7.18.0",
     "@typescript-eslint/parser": "^7.18.0",
     "eslint": "^8.0.0",
-    "moflo": "^4.9.0-rc.1",
+    "moflo": "^4.9.0-rc.3",
     "tsx": "^4.21.0",
     "typescript": "^5.9.3",
     "vitest": "^4.0.0"