v3.36.0 — @metaharness/turn-credit integration + stale pin fixes

v3.36.0 — @metaharness/turn-credit integration + stale pin fixes

What's in this release

• metaharness#176 (upstream) shipped @metaharness/turn-credit (ADR-248 — recursive turn-level credit assignment for agent trajectories, based on AgentOPSD/arXiv:2608.05987), plus a bump to @metaharness/darwin 0.9.0 (ADR-249 additive scorer signal seams) and @metaharness/router 0.4.0 (new calibration-audit module).
• This release brings ruflo's dependency contract in sync with that upstream work:
  • Adds @metaharness/turn-credit@~0.1.0 as a new installable optionalDependency, following the same pattern as darwin/flywheel/radio (ADR-150) — dependency-free, ~65KB unpacked, no lifecycle scripts.
  • Fixes two stale pins the review turned up: @metaharness/darwin (~0.8.3 → ~0.9.0) and @metaharness/router's peer range (^0.3.2 → ^0.4.0) — both had drifted out of range of what's actually published.
  • Bumps the no-cli-optdep-bloat-2561 CI guard's budget from 10 → 13, fixing a "zero slack" trap left by the previous release (v3.35.0) that would have broken on the very next unrelated optional dependency.
  • Fixes a live ReferenceError in a test file (MH_DARWIN_PIN referenced but never imported) that had somehow slipped through v3.35.0's CI.

👉 Full plain-language write-up (what turn-credit does, why the pin bugs mattered, and a lesson learned about pnpm lockfile drift): https://gist.github.com/ruvnet/0202e6a060b04b3a4f5d9bd18345169d

Upgrade

npx ruflo@latest --version   # 3.36.0
npm install @metaharness/turn-credit   # optional — new capability, not auto-installed by ruflo's own peer/opt-in design

No breaking changes — backward-compatible minor release.

Verification

All three packages (@claude-flow/cli, claude-flow, ruflo) published at 3.36.0 with latest/alpha/v3alpha dist-tags aligned, verified via npm view <pkg> dist-tags --json and a live npx ruflo@latest --version smoke test.

🤖 Generated with RuFlo

Addendum (2026-08-11)

This release's published npm artifact also included three data-integrity/correctness
fixes whose commit landed in git after this tag was
originally cut, because the build that was published included that work before it was
committed. The v3.36.0 git tag has been moved to point at the commit that actually
matches what's published (efd0406e7); the original tag target (f35c545fb) only had
the turn-credit/pin-fix work above.

Fixed in this release (see #2966):

• #2887 — agentdb_hierarchical-store reported success:true for writes that were never persisted (agentdb dropped its HierarchicalMemory export at 3.0.0-alpha.17; the fallback store is now durable and refuses to claim success for a lost write). Also required publishing @claude-flow/memory@3.0.0-alpha.22 — that package carries the fix and is an independent optional dependency, not bundled into this tarball.
• #2878 — concurrent memory.db writers silently lost updates while reporting success (10/12 lost in a 12-way repro). All mutating paths now serialize under withMemoryDbLock.
• #2877 — daemon lock/PID keyed to raw cwd, letting a subdirectory invocation spawn a duplicate daemon for the same project.

Action needed for the #2887 fix to take effect: run npm install @claude-flow/memory@latest (or reinstall @claude-flow/cli) to pick up 3.0.0-alpha.22.