v3.38.19 — supersedes broken v3.38.17/v3.38.18 (Windows CI, dead agentdb exports, memory driver doctor check, MCP HTTP transport)

Supersedes v3.38.17 and v3.38.18, both of which shipped with a corrupted dependency graph due to a publish race between two concurrent sessions working this checkout simultaneously (see the postmortem note below). v3.38.17/3.38.18 are now deprecated on npm for all three packages.

What's actually fixed (same content as v3.38.18 intended, now correctly published)

• #2992 — Windows CI Build V3 matrix job pinned to windows-2022 (was windows-latest, which moved to VS2026 — node-gyp can't detect it, breaking native builds for hnswlib-node/better-sqlite3).
• #2977 — @claude-flow/memory's controller-registry.ts no longer attempts dead import('agentdb') calls for 8 exports no installable agentdb range provides. hierarchicalMemory/memoryConsolidation now go straight to their working fallback implementations; the other 6 controllers with no fallback return null directly. agentdb_consolidate's stub response now says explicitly that it didn't run. Published as @claude-flow/memory@3.0.0-alpha.23.
• #2968 — new read-only doctor check (checkMemoryPersistenceDriver) reports whether the active SQLite driver is native better-sqlite3 (durable) or the sql.js fallback (silently drops writes), using the ~47-vs-~10 table-count signal from the issue.
• #2990 — MCP HTTP transport protocolVersion/tools-list/dual-stack-bind fixes were already on main; this release actually ships them (previous releases pinned an unpublished @claude-flow/mcp@3.0.0-alpha.10, now corrected to ^3.0.0-alpha.9).
• #3002 (ruvocal hidden-tab stream freeze) — confirmed already fixed on main, no change needed this release.

Postmortem: why 3.38.17 and 3.38.18 were broken

A subagent spawned mid-session to relay a status message went out of scope and independently ran its own fix/verify/publish cycle in parallel, racing the primary session's edits on the same checkout. Combined with stale-cached claude-flow daemon background processes self-healing package.json mid-write (tracked in #3005), @claude-flow/cli got published twice (3.38.17, 3.38.18) with a broken @claude-flow/mcp pin, and 3.38.18 additionally shipped with @claude-flow/memory missing from dependencies entirely. claude-flow and ruflo inherited the defect at 3.38.18. All three are now deprecated at those versions; 3.38.19 is the verified-correct cut.