v0.9.27

Wave release closing several breaking regressions reported against v0.9.26, plus an agent-scope isolation security fix, an iii version-pin audit fix, and a benchmark scorecard correction. No breaking changes; drop-in upgrade.

## Security

- **`AGENTMEMORY_AGENT_SCOPE=isolated` not enforced on `mem::search` / `POST /agentmemory/search` / `memory_recall` / `recall_context`** ([#817](https://github.com/rohitg00/agentmemory/issues/817)). PR #654's isolation work covered smart-search, `/memories`, `/observations`, and `/sessions` but missed the BM25-only recall path. An isolated worker booted with `AGENT_ID=B` could read agent A's memories via the standard MCP `memory_recall` tool. Fail-closed: if isolated mode is on and no agent id resolves, the call throws rather than dropping the filter.

## Fixed

- **`/graph/query` and `/graph/stats` timed out with `"Invocation stopped"` on large existing corpora** ([#814](https://github.com/rohitg00/agentmemory/issues/814), [PR #816](https://github.com/rohitg00/agentmemory/pull/816)). Refactored `mem::graph-extract` to maintain three side-indexes (`graphNameIndex`, `graphEdgeKey`, `graphNodeDegree`) so every extract path is O(1), never O(n). Hot path reads exclusively from a precomputed top-degree snapshot updated inline on every extract.
- **All data lost on `agentmemory stop` followed by restart** ([#843](https://github.com/rohitg00/agentmemory/issues/843)). Stop order inverted: worker first with a 5s SIGTERM grace so index flush can land, engine second.
- **`mem::graph-snapshot-rebuild` and `mem::graph-reset` heartbeat-crashed on legacy >25K-node corpora** ([#825](https://github.com/rohitg00/agentmemory/issues/825)). Rebuild now refuses pre-flight when no prior snapshot exists. Reset is now enumeration-free: writes empty snapshot with `resetAt` epoch marker. Future extracts treat any pre-`resetAt` row as orphan.
- **Multi-instance port collisions on one host** ([#750](https://github.com/rohitg00/agentmemory/issues/750), [PR #815](https://github.com/rohitg00/agentmemory/pull/815)). `--port N` now drags streams + engine. New `--instance N` shortcut picks a 100-port block.
- **iii console install pulled latest engine instead of the pinned v0.11.2** (audit). Install command now passes `VERSION=${IIPINNED_VERSION}`. Render path is platform-aware: Windows users get a PowerShell hint.

## Added

- `POST /agentmemory/graph/snapshot-rebuild` (≤25K nodes, `force: true` to bypass).
- `POST /agentmemory/graph/reset` enumeration-free clean-restart.
- `--instance N` CLI flag for multi-daemon (max N=50).
- `GraphSnapshot.topDegrees`, `GraphSnapshot.resetAt`, `GraphQueryResult.fromSnapshot`, `GraphQueryResult.warning`.

## Changed

- REST endpoint count: 126 → 128.
- `mem::graph-stats` reads exclusively from snapshot.
- `mem::graph-query` empty-body / nodeType path reads exclusively from snapshot.
- `mem::search` over-fetch triggers on agentId filter too.

## Docs

- Corrected coding-agent-life-v1 P@5 numbers ([#796](https://github.com/rohitg00/agentmemory/issues/796)).
- README refresh: stats 174 files / 1,390+ tests / 258 functions; "New in vX.Y.Z" callout removed.
- `import-jsonl` users warned about Claude Code's `cleanupPeriodDays` 30-day default.


**Full changelog:** [CHANGELOG.md](https://github.com/rohitg00/agentmemory/blob/v0.9.27/CHANGELOG.md)