v3.10.39

First implementation landed from the dream-cycle research cluster (#2316-#2324). Adds entity matching as a third RRF arm in `hybridSearch` alongside dense (HNSW/RaBitQ) and sparse (FTS5/BM25), plus per-result signal provenance.

## What's new

**`@claude-flow/memory` 3.0.0-alpha.20** — entity arm + signal provenance in the `hybridSearch` controller:

- **`entity-tagger.ts`** — regex extractor for emails, URLs, file paths (POSIX + Windows), quoted phrases, proper-noun 2-grams. Deliberately conservative: false negatives OK, false positives would dilute RRF.
- **`hybridSearch`** now runs three arms in parallel: dense + sparse + entity (per-token keyword scan, gated on `extractEntities(query).length > 0`). Empty entity set drops the arm rather than passing `[]` to dilute fusion.
- **`signals: ('vector' | 'bm25' | 'entity')[]`** on every fused result. Computed by pre-fusion set membership; lets callers debug which arms surfaced an entry without re-running the search.

## Capability smoke (end-to-end against built dist)

Corpus: 30 generic "authentication" entries + 1 "Alice Smith" needle. Query: `"Alice Smith authentication"`:

```
score=0.0477  signals=["vector","bm25","entity"]  key=alice-needle      ← #1
score=0.0323  signals=["vector","bm25"]           key=generic-1
score=0.0323  signals=["vector","bm25"]           key=generic-0
score=0.0313  signals=["vector","bm25"]           key=generic-3
score=0.0301  signals=["vector","bm25"]           key=generic-2
```

Alice ranks **#1** with full triplet provenance — runners-up only fire on vector + sparse. **~47% RRF score boost** from the entity signal.

## Packages

| Package | Old | New | Tags |
|---|---|---|---|
| `@claude-flow/memory` | 3.0.0-alpha.19 | 3.0.0-alpha.20 | latest, alpha, v3alpha |
| `@claude-flow/cli` | 3.10.38 | 3.10.39 | latest, alpha, v3alpha |
| `claude-flow` | 3.10.38 | 3.10.39 | latest, alpha, v3alpha |
| `ruflo` | 3.10.38 | 3.10.39 | latest, alpha, v3alpha |

`@claude-flow/cli`'s `@claude-flow/memory` dep pinned to `^3.0.0-alpha.20` so wrapper users get the entity arm automatically. `v3/pnpm-lock.yaml` regen included (lesson from #2311 — bumping a workspace dep without lockfile regen breaks `pnpm install --frozen-lockfile`).

## What this implements vs the dream-cycle ADR

ADR-147 (#2317) split the work as P1 "wire FTS5 + RRF fusion" and P2 "entity arm + provenance". The investigation found **P1 was already shipped** in `controller-registry.ts:713` before the ADR was filed — `applyRRF(k=60)` + `applyMMR(λ=0.7)` over dense + sparse was already in. This release lands the actual gap, **P2**.

Tracking note for the dream-cycle process posted on #2324.

## Tests

- 12 new `entity-tagger.test.ts` (regex pinning — generic prose returns empty, `and/or` → empty, `"a" over "b"` → empty, single capitalized words → empty)
- 2 new `graceful-retrieval.test.ts` ADR-147 assertions (signal provenance on every fused result; needle-in-haystack)
- Full memory suite: 416/420 (4 pre-existing Windows-env failures in `agent-memory-scope`, `auto-memory-bridge`, `benchmark` — untouched files)

## Out of scope (follow-ups)

- **Dedicated SQL entity index** — current per-entity `searchKeyword` calls are fine for typical query entity counts (1-3); unbounded if a query mentions 20+. A future ADR can add an `entity_index` table for hard-bound latency.
- **Async writes by default** (ADR-147 P3) — orthogonal; consolidator already handles HNSW background rebuild.
- **LoCoMo benchmark publication** (ADR-147 P4) — needs harness wiring + dataset access; separate workstream.