release(rc.96): version stamp, CHANGELOG, ROADMAP roll, landing footer sweep

[xerj-org]

Cuts v1.0.0-rc.96, a pre-hub release that ships every fix merged since rc.95.

Corpus Hub v2 is not a feature of this release. The code is on main (#1423), but HUB_PUBKEY_HEX is still empty and no key is baked in, so no pack can be verified. The CHANGELOG says this. #1491 (which must merge first) makes every hub surface say it too: xerj ask, xerj "<question>", hub sync and hub pull exit 5 with one plain message, the MCP hub tools return the same message, xerj init no longer teaches the hub, and --help says the command is unavailable. #1407 and #1410 (HOLD) are excluded.

Window since rc.95 (every merged PR is cited in ## [1.0.0-rc.96]; the release-notes gate checks this):

• Search correctness: total tie order holds on two more term routes (fix(engine): preserve #191 total tie order on dynamic-text and keyword term queries (#1359) #1393, closes #191 tie order is not total on two term routes: text with no doc-values (the post-#1329 default) and keyword — bounded pages stop being prefixes #1359). Inferred text fields now take the ES doc_values: false default (fix(engine): inferred text fields take the ES dynamic-mapping doc-values default #1329, with test(engine): fix agg_bucket_cap_terms after #1329 (main is red) #1331 and test(engine): graph_expand fixture declares the §2.2 edges mapping after #1329 #1356).
• autoindex / corpus: sub-GB file caps (autoindex: allow a whole-file size cap below 1 GB (#1233) #1321, closes autoindex: support a positive file-size cap smaller than 1 GB #1233). An aborted run no longer prints the "searchable" footer (fix(autoindex): an aborted run never prints the "searchable" success footer (#1183) #1318). Finalize read-back progress and old-server detection (fix: autoindex catalog read-back walk is its own progress phase #1267 #1320, fix(autoindex): probe server generation before finalize-verify #1267 #1430; finalize read-back lanes on a pre-#1260 server: per-digest term+exists probes brute-scan 3.4s each; 2,600+ probes in the live cve-records resume #1267 stays open). Corpus-builder refusals (harvest: refuse two silent-wrong-result paths in the corpus builder (advances #1110) #1315). Symbol passages (fix(xccode): render symbol code field and exclude ax_* from longest-string fallback (carries #1390) #1431) and map --prefix (fix(autoindex): scope map to explicit --prefix and omit blank wall_seconds (carries #1391) #1459), both carrying todie's PRs. Opt-in xerj code --fuse-symbols (feat(autoindex,common): index symbol impl bodies + opt-in RRF fusion (carries #1401 by @todie, #1237) #1457, carries todie's feat(autoindex,common): index symbol impl bodies and fuse with file hits via RRF (#1237) #1401).
• Engine/server: empty shards skip the shared finalize gate (perf(engine): skip empty shards in flush/refresh finalize fan-out (partial #1226) #1319, and perf(engine,api): skip empty shards before the finalize gate + O(1) selector lookups (carries #1399 by @todie, #1226) #1456, which carries todie's perf(engine,api): skip empty shards before flush gate and avoid O(N_indices) selector scans (#1226) #1399; closes Server: _refresh / delete_by_query?refresh=true costs 5-16s under concurrent bulk write load #1226). The breaker watermark is live-tunable (fix(governor): make the parent memory breaker watermark live-tunable (partial #1250) #1323; Multi-index ingest oscillates against the 16GB memory breaker: bulk concurrency yo-yos 32->1->32, throughput averages 34 items/s #1250 stays open). Native /v1/cluster/health reports the configured topology (cluster: native /v1/cluster/health reports honest topology (partial #1170) #1316; cluster: the Raft ring is never connected to the engine — no ClusterCommand is ever proposed, writes do not replicate (tracking) #1170 stays open).
• Windows / init: home directory falls back to USERPROFILE (fix(home): fall back to USERPROFILE when HOME is unset (native Windows) #1427, fix(mcp): resolve code_root via xerj_common::home::home_dir #1436–fix(common): localauth finds ~/.xerj admin.key via home::home_dir #1439). xerj init backs up before editing (fix(init): never edit .mcp.json or AGENTS.md without a backup #1411) and version-marks its teaching files (feat(init): version-mark the teaching files so a re-run upgrades stale ones #1444).
• Security: quinn-proto 0.11.19 (chore(deps): bump quinn-proto to 0.11.19 (RUSTSEC-2026-0338 … -0342) #1357). calamine 0.36.1 + zip 8 (fix(autoindex): upgrade calamine to 0.36.1 and zip to 8 to clear cargo-audit advisories (#1358) #1398, closes CI: cargo-audit fails on 7 vulnerabilities — quinn-proto ×5 (PR #1357) + quick-xml ×2 blocked by the calamine =0.26.1 pin #1358).
• Console fixes (fix(console): the bootstrap banner names a recovery that exists (#1424) #1426, fix(ux): a superseded console render never paints over the newer route (#1425) #1428), help/doc corrections, field reports, CLA signatures, cleanups.

Stamp: version rc.95→rc.96 (Cargo.toml + Cargo.lock). CHANGELOG [1.0.0-rc.96]; the #1108 Measured entry moves in from [Unreleased]. ROADMAP review line + roll: open defects go from nine to six, because #1108, #1183 and #1226 closed in the window. Landing footer sweep RC.95→RC.96, the data-latest-tag fallback, and a regenerated sitemap.

Local gates: docs_capability_lists 15/0 and docs_do_not_promise_the_next_release 3/0. The landing constants guard passes. All seo.yml checks pass (test_article_schema, the 5 generators --check, seo_lint, factcheck self-test/fixtures/fail-on-error). The workflow timeout guard passes. The release-notes gate passes except freshness. I will merge main (and #1491) into this branch right before the final merge.

Credit: some CHANGELOG wording for the PRs merged before 2026-10-14 is adapted from @todie's draft release PR #1397 (credited in the notes). We cut releases ourselves, so #1397 will be closed with thanks once rc.96 ships.

🤖 Generated with Claude Code