[ajianaz]

What (description of the change)

Release sync for v0.16.0: full develop content into main as a single squash commit (main disallows merge commits).

Contents since v0.15.0: fusion as default recall strategy (CLI/HTTP/MCP), benchmark tooling, pre-release validation runs, docs scrub (#1140), 500Q results (#1139), public benchmark page + chart (#1141), CHANGELOG with validation numbers (#1142).

Conflict resolution: all conflicts take develop (release.yml + release-notes-template.md kept as the self-consistent develop pair — sed ${VER} + __VER__ template, matching actual v0.15.0 asset names with the v prefix).

Supersedes #1143 (closed — merge-conflicted and used a merge commit, which main's rules reject).

Why (the problem you're solving)

Tag v0.16.0 must point at a commit on main per the release workflow prerequisite.

Testing (how you verified this works)

• develop passed 16/16 checks on docs(bench): LongMemEval-S 500Q results page — dual-metric + comparison chart #1141/chore(release): CHANGELOG 0.16.0 — full-release validation numbers #1142 (the final content state)
• Squash content is identical to origin/develop (git diff origin/develop release/v0.16.0 is empty except conflict-resolved files taking develop's side)
• release-notes template/sed pair verified against actual v0.15.0 release assets (naming with v prefix reproduces exactly)

🤖 Generated with Hermes Agent

[github-actions]

🔍 Cora AI Code Review

❌ Blocked — critical issues found.

🔴 Error (1)

• crates/uteke-core/src/structural_export.rs:58 — Possible SQL injection via string concatenation in query. Use parameterized queries.

---

Review powered by cora-code · BYOK · MIT

[ajianaz]

Re: Cora critical finding — verified false positive

The Cora AI review blocked this PR with:

crates/uteke-core/src/structural_export.rs:58 — Possible SQL injection via string concatenation in query. Use parameterized queries.

Manual verification of the flagged code:

pub const SECTIONS: &[&str] = &["memories", "rooms", ..., "timeline_events"];

for s in SECTIONS {
    let count: i64 = conn
        .query_row(&format!("SELECT COUNT(*) FROM {s}"), [], |r| r.get(0))

• SECTIONS is a compile-time constant array of hardcoded table names — there is no user input, no runtime string, no interpolation path into the query. The format! only picks which hardcoded identifier goes into the SQL text.
• Table names cannot be parameterized in SQL anyway (parameters are for values, not identifiers).
• The pattern was introduced in b8c695e (feat: structural export — full-store round-trip (rooms, graph, edges, documents, timeline) #1068) and unchanged since fix(core): structural import silently dropped room_documents (#1078 batch 1) #1081. Same class of false positive previously dismissed on tole (file_tools.rs findings fix(core): verify dedup candidates are live before skipping insert (#1210) #1211–docs(benchmarks): LongMemEval-S re-validated on v0.17.0 — headline numbers unchanged #1213 in the global DB).

Conclusion: dismissed as false positive — no code change needed.