fix: SPEC audit P0–P2 correctness, hardening, and walk-quality fixes

[douglasjordan2]

Implements the actionable findings from the code audit (SPEC waves 1–3 plus selected polish). All changes are behavior-compatible except #3's exit-code change (called out below for anyone whose hooks/scripts check $? on add concept).

Verified locally: cargo fmt, cargo build (default + sessions), cargo clippy --all-targets (now denies unwrap_used/expect_used with zero violations), cargo test (26 pass). MERGE idempotency and the exit-2 path were also confirmed live against Neo4j.

Correctness & security (P0)

• build(deps): bump actions/checkout from 5 to 6 #1 invalidate --by — unresolved freetext attribution is now stored as a property on the invalidated node instead of minting an Event that leaked into walk output; ensure_event removed.
• build(deps): bump dirs from 5.0.1 to 6.0.0 #2 relate() — CREATE → MERGE, so repeated hook/script runs no longer accrete duplicate edges.
• build(deps): bump chrono from 0.4.43 to 0.4.45 #3 blocked-as-duplicate — add concept now exits 2 (was 0) when the fuzzy-duplicate guard blocks a create, so callers can branch on $?; adds --quiet/-q for hook use. ⚠️ Behavior change — scripts checking $? will now see 2 instead of 0.
• build(deps): bump regex from 1.12.2 to 1.12.4 #4 walk traversal — constrained to Concept/KnowledgePatch labels, a deny-list for bookkeeping/session relationship types, and a LIMIT with a --limit escape hatch (default 200). Previously any label over any rel type with no cap.
• build(deps): bump anyhow from 1.0.100 to 1.0.102 #5 clippy gate — unwrap_used/expect_used escalated to deny so the stated policy fails the build; the real sites are fixed, provably-infallible statics and test modules carry narrow #[allow]s. (Full -D warnings not yet enabled — 200+ style warnings remain, tracked separately.)

Robustness (P1)

• fix: relate() errors on missing endpoint instead of false success #7 — OllamaClient builds the reqwest::Client once and reuses it (connection pooling on hot loops).
• fix(patches): prevent and recover empty KnowledgePatch shells #8 — describe writes the description even when Ollama is down and lets backfill embeddings fill the vector later, instead of blocking capture on the sidecar.
• #9a — reflector invokes the binary via current_exe() instead of c0 on $PATH (fixes silent failures under systemd).
• feat(sessions): make enrichment Ollama timeout configurable #19 — reflector stamps --source reflector so its commits are auditable.
• fix(search): normalize hybrid RRF scores and boost exact name matches #20 — find no longer logs zero-row Cypher results as knowledge dead-ends.

Architecture / polish (P2/P3)

• ci: group Dependabot minor/patch updates #14 — new c0 move patch <name> --to <ns>, mirroring move concept.
• build(deps): bump serde_json from 1.0.149 to 1.0.150 #6 — docker-compose allows a NEO4J_AUTH override; README documents the single-user threat model.
• Add a retrieval evaluation harness (recall@k, MRR, LLM-as-judge) #22 — ships systemd timer units (scripts/systemd/) for discrete reflector runs.
• build(deps): bump the cargo-minor-patch group across 1 directory with 4 updates #15 — declares rust-version = "1.85".

Deferred (not in this PR)

The larger structural/credibility items from the audit are intentionally left for follow-up: integration tests (#10), the main.rs/graph.rs refactors (#11/#12), find JSON output (#13), audit duplicates (#16), benchmark growth (#17), release hygiene (#18), and the relationship-type vocabulary (#21).

🤖 Generated with Claude Code