fix(memory): validate weights + deterministic tie-break; port #3104 lockfile fix

Per ruvnet's review on #3119:
- weighted RRF fusion previously had undefined ranking semantics for
  malformed weights (NaN poisons the sort comparator, negative/Infinity
  invert or swamp the intended ordering). Each weight component now
  validates independently (finite, >= 0) and falls back to its own
  documented default otherwise, same degradation as an omitted weights
  field already had.
- rrf ties now break deterministically by entry.id (explicit secondary
  sort key) instead of relying on Array.sort's stability plus Map
  insertion order as an undocumented side effect.
- 4 new tests: 3 malformed-weight fallback cases + 1 genuine-tie
  (weights: {semantic:0, structured:0}) deterministic-order case.

Also ports PR #3104's fix verbatim (v3/pnpm-lock.yaml: @claude-flow/mcp
specifier ^3.0.0-alpha.9 -> 3.0.0-alpha.10, matching the CLI manifest's
exact pin) to unblock the install-dependent CI gates this PR needs to
actually execute (issue #3101, also flagged in the review). Root-level
npm ETARGET (issue #3095, package-lock.json) is a separate, still-open,
maintainer-flagged issue with no proposed fix yet -- not addressed here.

Validated: `corepack pnpm install --frozen-lockfile --lockfile-only` and
`--ignore-scripts` both succeed from v3/; full @claude-flow/memory suite
465/466 (same 1 pre-existing unrelated env failure); tsc --noEmit clean.

Co-Authored-By: RuFlo <ruv@ruv.net>
Claude-Session: https://claude.ai/code/session_01AjuAxfhZi6eZXnLbLC14Ay

Author: claude

v3/@claude-flow/memory/src/hybrid-backend.test.ts

@@ -318,6 +318,42 @@ describe('HybridBackend - ADR-009', () => {
       const keys = results.map((r) => r.key).sort();
       expect(keys).toEqual(['fusion-sem-fav', 'fusion-struct-fav']);
     });
+
+    // Review (PR #3119): malformed weights previously had undefined ranking
+    // semantics (NaN poisons the sort comparator, negative/Infinity invert
+    // or swamp the intended ordering). Each malformed component now falls
+    // back to its own default (0.7 semantic / 0.3 structured) — same
+    // ranking as the semantic-heavy default, since 0.7 > 0.3.
+    it.each([
+      ['NaN semantic weight', { semantic: NaN, structured: 0.3 }],
+      ['negative semantic weight', { semantic: -5, structured: 0.3 }],
+      ['Infinity structured weight', { semantic: 0.7, structured: Infinity }],
+    ])('falls back to default weighting for a malformed weight (%s)', async (_label, weights) => {
+      expect(await fusedTopKey(weights)).toBe('fusion-sem-fav');
+    });
+
+    it('breaks exact rrf ties deterministically by entry id, not iteration order', async () => {
+      // weights of 0/0 make every entry's rrf contribution 0 — a genuine
+      // tie between both entries, not just a coincidentally-close score.
+      const results = await backend.queryHybrid({
+        semantic: {
+          content: QUERY_CONTENT,
+          k: 5,
+          threshold: 0.01,
+          filters: { namespace: 'fusion-test' },
+        },
+        structured: {
+          namespace: 'fusion-test',
+          keyPrefix: 'fusion-',
+          limit: 5,
+        },
+        combineStrategy: 'union',
+        weights: { semantic: 0, structured: 0 },
+      });
+      expect(results.map((r) => r.key)).toEqual(
+        ['fusion-sem-fav', 'fusion-struct-fav'].sort((a, b) => a.localeCompare(b))
+      );
+    });
   });
 
   describe('CRUD Operations', () => {

v3/@claude-flow/memory/src/hybrid-backend.ts

@@ -689,22 +689,41 @@ export class HybridBackend extends EventEmitter implements IMemoryBackend {
   ): MemoryEntry[] {
     const RRF_K = 60; // matches smart-retrieval.ts's applyRRF default
 
+    // Review (PR #3119): an unvalidated malformed weight (NaN, negative,
+    // Infinity) gives RRF undefined ranking semantics — NaN poisons every
+    // sum it touches (breaking the sort comparator below), a negative
+    // weight silently inverts that arm's intended preference, and
+    // Infinity swamps the other arm outright. Sanitize per-component: any
+    // non-finite or negative value falls back to that component's own
+    // documented default rather than failing the whole hybrid query (this
+    // mirrors `weights` itself already being optional with a default —
+    // a malformed field degrades the same way a missing one does).
+    const safeWeight = (value: number, fallback: number): number =>
+      Number.isFinite(value) && value >= 0 ? value : fallback;
+    const safeWeights = {
+      semantic: safeWeight(weights.semantic, 0.7),
+      structured: safeWeight(weights.structured, 0.3),
+    };
+
     const fused = new Map<string, { entry: MemoryEntry; rrf: number }>();
 
     semanticScored.forEach(({ entry }, rank) => {
-      const contribution = weights.semantic * (1 / (RRF_K + rank + 1));
+      const contribution = safeWeights.semantic * (1 / (RRF_K + rank + 1));
       const existing = fused.get(entry.id);
       fused.set(entry.id, { entry, rrf: (existing?.rrf ?? 0) + contribution });
     });
 
     structuredResults.forEach((entry, rank) => {
-      const contribution = weights.structured * (1 / (RRF_K + rank + 1));
+      const contribution = safeWeights.structured * (1 / (RRF_K + rank + 1));
       const existing = fused.get(entry.id);
       fused.set(entry.id, { entry, rrf: (existing?.rrf ?? 0) + contribution });
     });
 
+    // Review (PR #3119): break rrf ties deterministically by entry.id
+    // rather than relying on Array.sort's stability + Map insertion order
+    // (semantic-arm-first) as an undocumented accident of iteration order.
     return Array.from(fused.values())
-      .sort((a, b) => b.rrf - a.rrf)
+      .sort((a, b) => b.rrf - a.rrf || a.entry.id.localeCompare(b.entry.id))
       .map((r) => r.entry);
   }