ajianaz · Aug 11, 2026 · Aug 11, 2026 · Aug 13, 2026 · Aug 13, 2026 · Aug 13, 2026
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
@@ -110,6 +110,10 @@ jobs:
       # #1131: the embedder-less profile (cloud/OpenAI embedders only, no
       # onnx) must keep compiling — the embedding cache is backend-agnostic.
       - run: cargo check -p uteke-core --no-default-features --features vecq
+      # #1168: dual-engine profile (usearch + vecq compiled together, runtime
+      # selection) must keep compiling and passing the engine-switch tests.
+      - run: cargo test -p uteke-core --features "usearch,vecq" --lib vector_engine
+      - run: cargo test -p uteke-core --features "usearch,vecq" --lib memory::vector
 
   docs-check:
     name: API Docs Fresh

diff --git a/.github/workflows/cla-check.yml b/.github/workflows/cla-check.yml
@@ -12,7 +12,7 @@ permissions:
 jobs:
   cla-check:
     runs-on: ubuntu-latest
-    if: "!contains(fromJSON('[\"app/dependabot\", \"app/renovate\", \"github-actions[bot]\"]'), github.event.pull_request.user.login)"
+    if: "!contains(fromJSON('[\"dependabot[bot]\", \"renovate[bot]\", \"github-actions[bot]\", \"app/dependabot\", \"app/renovate\"]'), github.event.pull_request.user.login)"
     steps:
       - name: Fetch & check CLA signature
         id: check
@@ -48,7 +48,7 @@ jobs:
 
       - name: Comment on PR (unsigned only)
         if: steps.check.outputs.signed != 'true'
-        uses: actions/github-script@v7
+        uses: actions/github-script@v9
         with:
           script: |
             const author = '${{ github.event.pull_request.user.login }}';
@@ -97,7 +97,7 @@ jobs:
             }
 
       - name: Set commit status
-        uses: actions/github-script@v7
+        uses: actions/github-script@v9
         with:
           script: |
             const signed = '${{ steps.check.outputs.signed }}' === 'true';

diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -1,5 +1,34 @@
 # Changelog
 
+## [0.17.0] — 2026-09-06
+
+Minor release. Theme: **inspectable, trustworthy memory** — explain recall on
+every surface, auditable conflict resolution with a measurable payoff, honest
+graphs, pagination metadata, and a dual-engine vector layer.
+
+### Added
+
+- **Contradiction benchmark segment (#1172, phase 3)** — `benchmarks/longmemeval/contradiction_segment.py`: 40-topic active-store segment measuring conflict-resolution quality end-to-end. Baseline (both facts active) vs resolved (superseded): fusion winner@1 0.975 → 1.000, stale@5 0.825 → 0.000. Published in `benchmarks/longmemeval/RESULTS.md`. Also adds `uteke supersede <old> <new> [--reason]` — CLI surface parity for supersession (previously MCP/HTTP only).
+
+- **`/list` pagination metadata (#1188)** — `POST /list` accepts `"include_meta": true` to respond with an envelope `{memories, total, has_more, next_offset}` (`next_offset` is `null` on the last page) so clients no longer blind-paginate with 100-row guesses. The default response is unchanged (bare array) — existing clients are untouched; `include_meta` is ignored in `at` (point-in-time) mode, which stays a bare array.
+
+- **Explain recall (#1160)** — `explain` mode on every recall surface shows WHY each memory ranked where it did: vector similarity and rank, FTS rank, RRF score with per-channel fusion contributions, and jaccard/salience/recency/graph boost deltas. Surfaces: `uteke recall "…" --explain` (human-readable, combine with `--json` for machine output), `POST /recall` with `"explain": true` (memory-only — combined with `search_type`/`at`/`before`/`after` returns 400), and the `explain` flag on the MCP `uteke_recall` tool. The explanation path replays the active strategy's exact pipeline (same channel depths, RRF constants, and boost order) while bypassing the recall cache, so the explanation always matches the returned results; fts5 explanation works without an embedder, other strategies embed the query once (~50 ms, same as a cold recall).
+
+- **Contradiction resolution ledger + undo (#1172, phase 2)** — supersessions are now a first-class, auditable ledger instead of a side effect: `Uteke::contradiction_resolutions(namespace, limit)` lists superseded-but-not-restored memories (winner, reason, timestamp via the deprecation row), `Uteke::undo_supersession(id)` restores a retired memory, removes the supersession edge pair, and records a `supersession_undone` event on both sides (only memories carrying a live `superseded_by` edge can be undone — the undo is itself auditable). Ledger membership is edge-driven (deprecated row + `superseded_by` edge), the same predicate undo resolves against, and re-superseding an already-deprecated memory refreshes the stored reason/timestamp so the ledger always names the current winner. Surfaces: `GET /contradictions?namespace=&limit=`, `POST /contradictions/undo` (`{id}`; 404 when nothing to undo), `uteke contradictions list|undo`, and MCP `uteke_contradictions` / `uteke_contradictions_undo`. Fixed in the process: the no-namespace ledger query bound its limit parameter to a nonexistent placeholder (`?2`) and failed at runtime — caught by the new MCP roundtrip test.
+
+- **Provenance data model (#1172, phase 1)** — schema v18 (additive): `memories.source_hash` records the SHA-256 of content at write time (tamper evidence — audits recompute it against live content), and `timeline_events.actor`/`evidence_json` record who performed an event and what evidence supports it. New `Uteke::provenance(id)` returns the full report (provenance fields, trust tier, hash comparison, event chain) — exposed as `GET /provenance?id=`, `uteke provenance <id>`, and the `uteke_provenance` MCP tool.
+
+### Fixed
+
+- **Graph data returned stale nodes (#1189)** — `GET /graph` without a namespace returned every `graph_nodes` row raw, including nodes whose parent memory had been forgotten or deprecated; with soft-delete the store accumulated stale nodes on every conflict resolution. Memory-linked nodes are now filtered by liveness (memory exists and `deprecated = 0`) in every `graph_data` path, edges touching removed nodes are dropped, and `stats` counts the filtered graph.
+- **Memory graph nodes labeled with raw UUIDs (#1187)** — `ensure_node_for_memory` now labels new memory nodes with a readable content preview (first 60 chars of the memory) instead of the raw memory UUID, and upgrades legacy UUID-labeled rows in place on next access. Entity nodes are unaffected.
+
+- **Namespace management API (#1181)** — namespaces are a derived view, now with sanctioned ops: `PUT /memory` accepts `namespace` (move a memory — plain column update, no re-embed), `POST /namespaces/rename` (`{from, to}`; existing target = merge, returns `{from, to, moved, target_existed}`), and `POST /namespaces/delete` with an explicit strategy for its memories: `refuse` (default — 409 while any memory references the name), `merge` (move all memories to `target`, the name vanishes), or `deprecate` (soft-delete — restorable via promote, never hard-deleted). `GET /namespaces?with_counts=true` now adds `active`/`deprecated` breakdown fields (`count` stays the total). CLI parity: `uteke namespace move|rename|delete` (delete requires `--confirm`). MCP parity: `uteke_namespace_rename`, `uteke_namespace_delete`, and `namespace` field on `uteke_update`.
+
+### Fixed
+
+- **`POST /graph/edge` always returned 500 for valid memory IDs (#1180)** — the handler validated `source`/`target` as memory IDs but inserted them directly into `graph_edges`, whose foreign keys point at `graph_nodes(id)`. Memory IDs are now resolved to their linked graph node (or a node is ensured automatically) before insertion. `DELETE /graph/edge` accepts memory IDs or graph node IDs the same way, and its documented query params are corrected to `?source=...&target=...`. `POST /graph/edge` now responds with `{ok, source_node, target_node}` so clients can track the created nodes.
+
 ## [0.16.0] — 2026-08-28
 
 Minor release. One theme: retrieval quality that ships by default.

diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
@@ -272,4 +272,28 @@ See [CODE_OF_CONDUCT.md](CODE_OF_CONDUCT.md).
 
 ## License
 
-By contributing you agree your work is licensed under [Apache-2.0](LICENSE). No CLA required.
+By contributing you agree your work is licensed under [Apache-2.0](LICENSE).
+
+## CLA
+
+All contributions (code, docs, tests, configuration) require a signed
+Contributor License Agreement before a pull request can be merged:
+
+- 📋 **Individual?** → [Sign the Individual CLA](https://codecoradev.github.io/cla/?type=individual)
+- 🏢 **Contributing on behalf of a company?** → [Sign the Corporate CLA](https://codecoradev.github.io/cla/?type=corporate)
+
+The CLA is a license agreement, not a copyright assignment — you keep
+ownership of your work. Signing takes a couple of minutes and is stored
+in the [codecoradev/.github](https://github.com/codecoradev/.github)
+repository; a bot checks it automatically on every pull request.
+
+## Contributions are unpaid
+
+Contributing to this project is **voluntary and unpaid**. There is no
+compensation, payment, bounty, or financial reward of any kind for
+contributions — now or in the future. You contribute on your own time,
+at your own discretion, because you want to improve the project.
+
+If any paid-contribution program is ever introduced, it will be announced
+explicitly and this document will be updated. Until then, assume every
+contribution is volunteer work under the Apache-2.0 license terms above.
diff --git a/Cargo.lock b/Cargo.lock
diff --git a/Cargo.toml b/Cargo.toml
@@ -9,7 +9,7 @@ members = [
 ]
 
 [workspace.package]
-version = "0.16.0"
+version = "0.17.0"
 edition = "2024"
 license = "Apache-2.0"
 repository = "https://github.com/codecoradev/uteke"

diff --git a/README.md b/README.md
@@ -142,7 +142,13 @@ Every AI tool forgets. Context windows fill up, sessions end, and your AI starts
 | **Recall latency (10K memories)** | **42ms** P50, 50ms P95 | Flat from 100 to 10K memories (HNSW O(log N)) |
 | **Insert throughput** | 6-22 ops/s | CPU-bound (ONNX embedding inference) |
 | **Storage per memory** | ~10KB | SQLite + HNSW, scales linearly |
-| **LongMemEval Recall@5** | **0.946** | Full 500Q validation, zero-config fusion default (R@10 0.977), EmbeddingGemma Q4 |
+| **LongMemEval-S recall_any@5** | **98.2%** | Full 500Q validation, zero-config fusion default (v0.16.0) — the metric competitor benchmarks publish |
+| LongMemEval-S recall_all@10 | 95.4% | Strict: every gold session in top-10 |
+| LongMemEval-S strict recall_all@5 | 88.0% | Every gold session in top-5 (mathematical ceiling 99.4%) |
+
+![uteke vs published systems on LongMemEval-S](docs/assets/longmemeval-comparison.jpg)
+
+> **Don't trust our benchmark — run your own.** We re-ran 108 of the 500 published questions on a 4-core ARM desktop (different CPU architecture from the published Modal x86 run, same v0.16.0 binary and harness): **107/108 produced identical per-question rankings**. The single difference was an adjacent-rank near-tie, both runs retrieved the identical top-10 session set, one gold session swapped ranks 5-6. Details in [RESULTS.md](benchmarks/longmemeval/RESULTS.md).
 
 Full benchmarks: `uteke bench --counts 100,1000,10000 --json` · [Benchmark details](docs/benchmarks.md) · [LongMemEval results](benchmarks/longmemeval/RESULTS.md) — fusion default: R@5 0.946 / R@10 0.977 on the full 500Q validation set (v0.16.0)
 

diff --git a/benchmarks/longmemeval/RESULTS.md b/benchmarks/longmemeval/RESULTS.md
@@ -5,6 +5,28 @@
 
 ---
 
+## Independent Reproduction (2026-09-01)
+
+The published 500Q run was produced on Modal x86. To test whether the result depends on that infrastructure, a 108-question subset (pref: 30, kupd: 78) was re-run locally on a 4-core ARM desktop (Oracle Ampere A1, aarch64) — same v0.16.0 binary, same harness (`run_eval.py`), different CPU architecture.
+
+| Subset | Questions | Identical per-question rankings | R@5 published | R@5 re-run |
+|---|---|---|---|---|
+| pref | 30 | 30/30 | 96.7% | 96.7% |
+| kupd | 78 | 77/78 | 100.0% | 99.4% |
+| **Total** | **108** | **107/108** | — | — |
+
+**The one divergence** (question `0977f2af`, knowledge-update, 2 gold sessions): both runs retrieved the identical top-10 session set; one gold session sits at rank 5 (published) vs rank 6 (re-run), moving that question's recall_all@5 from 1.0 to 0.5. The harness persists rankings rather than raw scores, so the exact score gap cannot be shown, but the identical top-10 set identifies this as cross-architecture floating-point noise on an RRF near-tie, not a retrieval failure. R@10 = 1.0 in both runs.
+
+**Reproduce:**
+
+```bash
+python3 run_eval.py --data data/subset_kupd.json --output results_rerun --strategy default --resume
+```
+
+Raw artifacts are kept on the benchmark Modal volume (`uteke-longmemeval`, `default/` and rerun prefixes), consistent with the published run — datasets and result JSONL files are not committed to git (see `.gitignore` here; `download_data.sh` fetches the dataset).
+
+---
+
 ## Uteke Retrieval — Strategy Comparison
 
 ### Vector (semantic only)
@@ -115,3 +137,45 @@ Binary built in-image from exact SHA bfbc296 (PR #1137/#1138), image build print
 
 Context: v0.15.0 hybrid baseline on the same dataset: Overall R@5 = 0.854 / R@10 = 0.885 (2026-08-13).
 Fusion default lifts full-500Q recall@5 by **+9.2 points** (0.854 → 0.946) with zero configuration.
+
+---
+
+## Contradiction-resolution segment (#1172 Fase 3) — 2026-09-06
+
+**Active-store knowledge-update segment**: 40 topics × (stale fact + winner fact + 3 distractors),
+queries ask "which {thing} does {topic} use now?" (semantic, no keyword echo of the answer).
+Baseline ranks with BOTH facts active; resolved ranks after `supersede(stale → winner)` —
+baseline is measured for every strategy BEFORE any resolution, then the store is resolved once.
+Binary: local release build (0.16.0 + #1185 ledger), local ONNX EmbeddingGemma, ARM64.
+
+Harness: `contradiction_segment.py` (this directory). Raw metrics: `results_contradiction_f3/metrics.json`.
+
+| Strategy | Stage | winner@1 | winner@5 | winner MRR | stale@1 | stale@5 |
+|---|---|---|---|---|---|---|
+| fusion (default) | baseline (unresolved) | 0.850 | 1.000 | 0.925 | 0.150 | **1.000** |
+| fusion (default) | resolved (superseded) | **1.000** | 1.000 | **1.000** | 0.000 | 0.000 |
+| hybrid | baseline | 0.025 | 1.000 | 0.469 | 0.975 | 1.000 |
+| hybrid | resolved | 0.225 | 1.000 | 0.588 | 0.000 | 0.000 |
+| vector | baseline | 0.950 | 1.000 | 0.975 | 0.050 | 1.000 |
+| vector | resolved | 1.000 | 1.000 | 1.000 | 0.000 | 0.000 |
+
+Findings:
+
+- **Unresolved conflicts pollute every strategy's top-5**: with both facts active, the stale
+  fact sat in top-5 for 100% of topics on all strategies (hybrid's BM25 even ranks the stale
+  fact top-1 for 97.5% of topics — the old fact's "uses X" phrasing matches "use now?"
+  queries lexically). After `supersede`, stale@1 and stale@5 drop to **0.000** everywhere
+  (deprecated memories are excluded from recall).
+- **Supersede lifts the default surface**: fusion winner@1 0.850 → 1.000, MRR 0.925 → 1.000;
+  vector 0.950 → 1.000. Hybrid stays weakest on winner@1 (lexical BM25 keeps the new fact's
+  "switched to" phrasing behind distractors) but its stale pollution is fully cleared.
+- **Ledger integrity**: `contradictions list` listed all 40 resolutions; every stale fact is
+  restorable via `contradictions undo` (auditable conflict resolution, #1172 F2).
+
+Interpretation: ranking alone often picks the winner, but only explicit conflict resolution
+guarantees stale facts leave the retrieval surface — the difference between "usually right"
+(85–95% top-1) and deterministic freshness (100% top-1, zero stale). For agent memory, where
+"use now" queries are the norm, resolution is what keeps top-1 trustworthy. This segment is
+synthetic and deterministic (fixed topic list); it measures the conflict-resolution pipeline,
+not LongMemEval dataset recall.
+