Post-v0.9.0 strategy covering benchmark baselines, scale ceiling, algorithmic depth, recall quality, and concurrency. Positions the embedded Rust stack (graph-cjk/vector-index/graph-pool) vs alcove, harness-mem, and Neo4j agent-memory. Linked from the ROADMAP research index.

Drop consumer-specific framing; the strategy now stands on llm-kernel's own v1.0.0 production readiness (benchmarks, algorithmic depth, Korean recall, concurrency proof).

…ilarity) (#46)

* feat(graph): add CSR graph algorithms (pagerank, community, path, similarity)

Pure-Rust zero-dependency module (src/graph/algo/) compiled in behind the
existing `graph` feature — no Cargo.toml change, no petgraph. Closes the
Neo4j/GDS algorithm gap flagged in issue #45 Axis C.

- CsrGraph: directed weighted CSR snapshot with dangling-node detection
- pagerank: weighted power iteration with dangling-node redistribution
- community: connected components (union-find) + label propagation
- path: Dijkstra weighted shortest path (distance = -ln(weight))
- similarity: Jaccard, common neighbors, Adamic-Adar, link prediction

smart_recall's graph boost (W_GRAPH) now ranks the top-100 candidates by
true PageRank over their induced subgraph, replacing the approximate
degree-centrality neighbor-weight sum. The SQLite (recall.rs) and
PostgreSQL (pg.rs) recall paths share pagerank_default, permanently
removing the cross-backend boost-logic drift.

All algorithms validated by hand-computed unit tests (diamond PageRank,
jaccard 1/3, adamic-adar 1/ln(2), two-hop-beats-direct Dijkstra) plus
criterion benchmarks (PageRank 1000 nodes: ~4.9us). 570 tests pass,
clippy/fmt/rustdoc clean.

* docs(graph): record algorithm benchmark baseline, link from README

docs/benchmarks/graph.md captures the 2026-06-26 criterion measurements
(PageRank 1000 nodes: 4.87us, connected components 9.50us, Dijkstra 41us,
CSR build 727us) as the v1.0.0 baseline for issue #45 Axis A / ROADMAP #3.
README Benchmarks section now links to it and lists the new algorithm
benchmark groups.

* fix(graph): clamp edge weights in dijkstra to prevent negative cost

edge_cost now clamps weight to [SHORTEST_PATH_W_MIN, 1.0]. A
contract-violating weight > 1.0 previously produced -ln(w) < 0, a negative
edge cost that breaks Dijkstra's non-negative-edge assumption and silently
returns wrong shortest paths. It is now treated as maximal strength
(cost 0). Adds a regression test asserting no negative distances.

* test(graph): verify pagerank boost ranking in smart_recall

recall_graph_boost asserted only len()==2 despite a comment claiming the
boost was applied. Now also asserts the dangling sink outranks its source:
with hint=None and identical base scores the score difference is purely the
graph boost, so this is the one test exercising its ranking effect.
Normalizes the contract-violating weight 2.0 to 1.0.

Bumps [anyhow](https://github.com/dtolnay/anyhow) from 1.0.102 to 1.0.103.
- [Release notes](https://github.com/dtolnay/anyhow/releases)
- [Commits](dtolnay/anyhow@1.0.102...1.0.103)

---
updated-dependencies:
- dependency-name: anyhow
  dependency-version: 1.0.103
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

)

Resolves RUSTSEC-2026-0185 in quinn-proto, the advisory that was failing
the audit CI gate on every PR (#44, #46). quinn-proto reaches the
lockfile via the reqwest 0.12 tree but is not activated under any
feature/target combination (cargo tree -i reports nothing to print), so
this is a lockfile-only patch. Verified: cargo audit now reports 0
vulnerabilities (exit 0); cargo test --all-features green.