v3.42.1 — SONA env-default, review batch, and reliability fixes

A patch release: one small feature (opt-in, fully backward-compatible) plus a batch of independently-reviewed bug fixes, a performance fix, and a dependency bump — all reviewed, tested, and merged in this pass.

What's new for you

SONA learning mode can now default from the environment

RUFLO_INTELLIGENCE_MODE sets a fleet-wide default learning mode (real-time, balanced, research, edge, batch) without threading mode/sonaMode through every call site — useful for a managed deployment that wants every session to learn in a specific profile. An explicit per-call mode always wins; an unset or unrecognised value falls through to balanced, so a typo can never silently pick a profile. (Originally landed with a bug where one of the two places reading this variable only checked it once per process instead of per session — fixed before release, with new regression tests in both places.)

Diagnostics and memory fixes

• ruflo doctor no longer guesses your memory driver from a raw table count (a heuristic that never actually correlated with which driver you're using) — it now reports only what it verifies directly.
• ruflo doctor now resolves the installed MetaHarness version correctly instead of reporting stale/incorrect data.
• memory_stats now answers from the live store instead of a snapshot that couldn't see in-flight writes — a working memory store no longer reports itself as uninitialized. Also fixes a namespace named __proto__ silently vanishing from the breakdown, and a hardcoded row cap that was truncating large stores without saying so.
• A database handle used during memory initialization now closes on every code path, including the failure path that used to leak it.
• Opening the graph database now verifies the handle is actually persistent before using it — a bad argument shape used to silently produce an in-memory-only graph that vanished on exit, with no error.
• Fixed a memory-key bug on Windows where a drive letter's colon wasn't sanitized consistently with how Claude Code derives the same key.

Federation and security

• The federation gateway's untrusted-relay data is now read through the same validated envelope shape the gateway actually sends, closing a gap where some tools could miscount or silently see zero messages.
• WITNESS_ED25519_ROOT now actually resolves @noble/ed25519 for witness-manifest signing (this only affects the maintainer signing path — the separate node:crypto-based signature verification path was never affected).

Performance

• AgentBBS now dedupes redundant peer-hello and watch-replay traffic, and computing the next sequence number no longer requires scanning an entire (potentially large) room log.

Housekeeping

• swarm status/swarm stop now report a real swarm id and no longer get confused by a stale "stopped" state file shadowing a live swarm.
• Bumped agent-browser to 3.37.1 for recording/WebMCP improvements and a Windows headless-Chrome cleanup fix.

Upgrading

:::bash
npx ruflo@latest --version   # should print 3.42.1
# or, if you use the scoped packages directly:
npx @claude-flow/cli@latest --version
npx claude-flow@latest --version

No action needed — every change above is either opt-in or an internal correctness/perf fix with no API changes.

🤖 Generated with RuFlo