docs(changelog): 0.9.94 — add the SQL, markdown, mcp, cross-repo, and ObjC fixes

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

CHANGELOG.md

@@ -4,7 +4,7 @@ Full release notes with details on each version: [GitHub Releases](https://githu
 
 ## 0.9.94 (2026-10-22)
 
-Eleven community pull requests. A security pass on ingestion: a fetched URL with no hostname, with a malformed or zero port, or with embedded `user:pass@` credentials is now rejected before the request leaves, on the first fetch and on every redirect, and a text capture no longer follows a dangling symlink out of the corpus. Extraction and resolution: a Maven POM contributes only its own dependencies, a JS/TS member call on an untyped receiver stops guessing a same-named method in the same file, a CommonJS `require` binding no longer shadows the class the required file exports, and Objective-C category node ids stay repo-relative instead of embedding the absolute checkout path. Plus a quoted Codex hook command for install paths with spaces, an IPv6 bracketed-`Host` serve fix, and a complete, drift-guarded `--platform` list in `--help`. The AST cache schema is bumped, so the first build after upgrading re-extracts.
+Nineteen community pull requests. A security pass on ingestion: a fetched URL with no hostname, with a malformed or zero port, or with embedded `user:pass@` credentials is now rejected before the request leaves, on the first fetch and on every redirect, and a text capture no longer follows a dangling symlink out of the corpus. Extraction and resolution: a Maven POM contributes only its own dependencies, a JS/TS member call on an untyped receiver stops guessing a same-named method in the same file, a CommonJS `require` binding no longer shadows the class the required file exports, and Objective-C category node ids stay repo-relative instead of embedding the absolute checkout path. SQL gets its own pass: T-SQL bracketed names are unbracketed, a `GO` batch separator ends the statement, cross-file table stubs fold onto their real definition, and a procedure emits `reads_from`/`writes_to` edges. Plus a markdown bare method only links when its class is cited, the MCP node lookup refuses a substring near-miss instead of answering with an unrelated node, a cross-repo edge points at the call site, Objective-C calls resolve across a split header/impl, an incremental build stops re-queuing files an extractor declined by design, a quoted Codex hook command for install paths with spaces, an IPv6 bracketed-`Host` serve fix, and a complete, drift-guarded `--platform` list in `--help`. The AST cache schema is bumped, so the first build after upgrading re-extracts.
 
 - Fix: **security** `validate_url` rejects a fetched URL that has no hostname (`http:///path`), a non-numeric, out-of-range, or zero port, or embedded `user:pass@` credentials, before the request is made and again on every redirect, so a malformed or credential-bearing URL is no longer fetched or persisted into the graph; a normal `@` in a path or query and a valid high port still pass (#4643, #4644, #4645, thanks @cellrishi-code).
 - Fix: **manifest** a Maven `pom.xml` contributes only its own `<dependencies>` (including those under `<profiles>`), not the version pins under `<dependencyManagement>` or a build plugin's own `<dependencies>`, so a parent or BOM POM no longer emits dependency edges it only manages (#4596, thanks @jayhemnani9910).
@@ -15,6 +15,14 @@ Eleven community pull requests. A security pass on ingestion: a fetched URL with
 - Fix: **serve** an IPv6 HTTP bind accepts its own bracketed `Host` header (`[::1]:port`), so a server bound to an IPv6 loopback no longer refuses every request with a 421 (#4656, thanks @zydo).
 - Fix: **ingest** a text capture never writes through an existing entry: the free-path search uses `lstat`, so a name that is a dangling symlink is treated as occupied and the capture is diverted instead of following the link and writing outside the corpus (#4657, thanks @zydo).
 - Fix: **cli** `graphify --help` lists every accepted `--platform` value (it had omitted amp, copilot, kilo, kimi, and antigravity-windows); the list is derived from the same source as the install usage so the two cannot drift, with a guard test (#4655, thanks @zydo).
+- Fix: **sql** T-SQL bracketed identifiers (`[dbo].[Orders]`) are unbracketed so a name matches across styles, and a stored procedure's body emits `reads_from`/`writes_to` edges for the tables it reads and writes; aliases, variables, temp tables, strings, and comments never become targets (#4635, #4649, thanks @Deepjyoti-Sarmah; reported by @RuVl).
+- Fix: **sql** a `GO` batch separator (a client command, not a terminator) ends the statement, so a statement after a `GO` with no trailing `;` parses on its own instead of merging into one malformed node; a `GO` inside a string, comment, or column name is left alone (#4651, #4652, thanks @Deepjyoti-Sarmah).
+- Fix: **sql** a table referenced before its `CREATE TABLE` is seen folds onto the real definition instead of staying a separate stub, and a schema-qualified name binds correctly, while two genuinely different tables in different schemas (`dbo.Orders` vs `sales.Orders`) stay distinct and a SQL stub no longer binds to a same-named class in another language (#4653, #4654, thanks @Deepjyoti-Sarmah).
+- Fix: **markdown** a bare method name in prose (for example `redis` where only `Cache.redis` exists) only links to the method when the owning class is cited in the same document, so a plain word is no longer turned into a false `references` edge; a qualified `Class.method` or `Class::method` mention still resolves (#4609, #4617, thanks @nothariharan; reported by @saad-siddique).
+- Fix: **mcp** the `get_node` and `get_neighbors` tools, and the `explain` command, refuse a substring-only near-miss with candidate suggestions instead of returning an unrelated node as the answer; an exact or prefix match still resolves (#3917, #4618, thanks @nothariharan; reported by @Alexandre-Aktisea).
+- Fix: **cross-repo** a cross-repo call edge points at the real call site rather than the caller's header declaration, so the edge's `source_file` and `source_location` name the line that makes the call (#4668, #4669, thanks @xiongjianxu).
+- Fix: **extract** an incremental build no longer re-queues, on every run, a code file an extractor declined by design (for example a virtual-workspace manifest); the file is marked `ast_empty` and left alone, while a genuinely failed or transiently empty extraction is still retried (#2543, #4672, thanks @xiongjianxu).
+- Fix: **objc** a member call resolves when a class is split across a header and an implementation in different directories, binding the selector to its single definition; two unrelated same-named classes that both define the selector stay ambiguous and get no edge (#4673, #4674, thanks @xiongjianxu).
 
 ## 0.9.93 (2026-10-20)