v0.13.0

A curated sync with upstream DeusData/codebase-memory-mcp, plus the store-integrity cluster the previous pass deferred.

Correctness

• Corruption is no longer silent. Every store row-scan loop discarded the terminal sqlite3_step code, so SQLITE_CORRUPT mid-scan was indistinguishable from a clean end of results. Counts answered from covering indexes stayed correct while row fetches died at the first corrupt page — so search returned total=379 with results=[], Cypher counts diverged from schema counts, and BM25 returned total=0, all with no error anywhere. All 31 scan loops now fail loudly with CBM_STORE_ERR.
• Cypher variable-length paths use shortest-path semantics. The BFS recursive CTE deduped (node, hop) pairs, so a single self-loop minted every hop level for every node it could reach — *k..k matched fabricated walks of arbitrary length and the row set exploded to nodes × depth. MIN(hop) GROUP BY now returns each node once at its minimal distance.
• A clamped hop range is advertised. Exceeding the engine ceiling used to be indistinguishable from "no such path"; it now surfaces as a warning on the result.

Data safety

• Stale WAL sidecars can no longer corrupt a fresh database. Three paths installed a new DB generation without removing the destination's -wal/-shm. SQLite validates a WAL against the sidecar's own header, not the main file, so a crashed session's leftover WAL was replayed on top of the newly installed file.
• The page writer publishes atomically. It now builds into a sibling temp generation and installs it by fsync + atomic replace, so the live database stays intact through every error path.
• Artifact export snapshots consistently. The fast path (watcher / incremental auto-update) read the raw bytes of a live WAL-mode store — committed rows still in the -wal were missing and mid-checkpoint reads produced torn snapshots that imported as corrupt caches. Both quality levels now snapshot via VACUUM INTO, and import refuses page-corrupted artifacts via PRAGMA quick_check. The fast path pays a full consistent copy: a deliberate speed-for-correctness trade, since teammates pull these.

Features

• get_architecture gains an opt-in cycles aspect — circular call dependencies via iterative Tarjan SCC condensation (heap stacks, no recursion overflow). Opt-in only, never via all or overview, because it scans the whole call graph.
• detect_changes now performs real blast-radius analysis. It previously parsed and echoed depth without ever traversing — "impacted" was just the symbols defined in the changed files. It now resolves the diff to those symbols and runs one multi-source traversal to the transitive impact set, with a module rollup and an exact impacted_total. Seeds are excluded, so a changed file reached from another changed file is not counted as extra impact.
• get_code_snippet caps whole-file spans at 500 lines with source_clipped. A structural Module/File node spans its entire file, so an unclipped read could return hundreds of KB in a single call.

Robustness

• GLR stack-merge recursion bounded at 512 frames, preventing a native stack overflow during parsing of deeply nested ambiguous input.
• Windows thread heaps released via a TLS detach callback — a static MinGW link has no DllMain, so every thread previously leaked its allocator heap.

Verification

5641 tests passing; clang-format, cppcheck and the NOLINT gate clean; the 7-layer security audit, smoke test, and an index-determinism check all green. The corruption fix was additionally proven RED-on-revert: neutralising all 31 guards reproduces the exact reported symptom.

Full changelog: v0.12.0...v0.13.0