v0.9.27

A large maintenance release: install-safety fixes, node-identity/canonicalization fixes, cross-file resolution improvements, and a batch of community contributions.

**Install and data safety**

- `claude`/`gemini`/`codex`/`codebuddy install` no longer overwrite a settings/hooks file they cannot parse (#2167). On any JSON parse error they used to fall back to an empty config and rewrite the whole file, destroying the user's settings (most often triggered by a UTF-8 BOM). They now read `utf-8-sig`, refuse to modify a non-JSON-object file, and back up to `<name>.graphify-bak` before any write.
- Incremental `extract --no-cluster` no longer overwrites the full graph with just the changed files (#2169). It now merges the existing graph forward with the same replace/prune semantics as the clustered path and canonicalizes cross-file edge targets.
- Running the test suite no longer touches the developer's real `~/.claude`/`~/.gemini`/`~/.codebuddy`/`~/.copilot` (#2168).

**Node identity and caching**

- `stat-index.json` is stored with root-relative keys (re-anchored on load, mirroring `manifest.json`) and pruned of deleted-file entries, so a moved or cloned corpus keeps its cache hits instead of re-extracting everything (#2199).
- JavaScript/TypeScript regex-rescued imports (Svelte/Astro/Vue) no longer create ghost target nodes with absolute-path ids (#2195).
- Cross-file `concept` nodes with identical normalized labels now merge, matching the behavior already applied to near-identical labels (#2182).
- Absolute `source_file` paths (for example from a Windows scan) no longer break node identity (#2197), and `build_from_json` folds legacy field aliases (`name`/`path`/`type`/`confidence_score`) so alias-carrying nodes stop entering the graph invisible and unmergeable (#2194).

**Resolution**

- C# member calls on a typed receiver now resolve namespace-aware, with `base.`/`this.field` receivers, inherited-member lookup through the `inherits` chain, and shadow-poisoning so a local shadowing a field of a different type no longer produces a wrong edge (#1609, adapted from #1620 by @TheFedaikin).
- Python decorators now create graph edges so `affected <decorator>` finds what a decorator touches, with builtin/stdlib decorators excluded (#2154, thanks @Rishet11).
- JavaScript/TypeScript non-relative imports resolve through `jsconfig.json`/`tsconfig.json` `baseUrl` and `paths` (#2153, thanks @Rishet11).
- Swift/Foundation/SwiftUI builtins are filtered from call resolution and god-node ranking (#2147, thanks @MasterFede5).
- `graphify query`/`explain` no longer fabricate `indirect_call` edges to class definitions (#2137, thanks @Rishet11).
- Bash calls into a `source`d file resolve for extensionless scripts and bare `source lib.sh` (#2171), and `source "${VAR}/lib.sh"` resolves against the variable's real directory (#2172). Both thanks @Souptik96.
- SQL routines with PL/pgSQL-only bodies that tree-sitter cannot parse are recovered by a raw-text scan, gated on a failed parse (#2180, thanks @Souptik96).

**Windows and hooks**

- The git-hook interpreter allowlist accepts Windows backslash paths (#2126, thanks @Rishet11) and interpreter paths containing a space (#2166, thanks @Souptik96); the rebuild timeout is armed on Windows via a threading fallback (#2148, thanks @Rishet11); the extraction process pool is skipped when only one worker is available (#2173, thanks @Souptik96).
- The Codex `PreToolUse` hook is documented as an intentional no-op (#2165, thanks @Souptik96).