fix(BUG-1): use str(depth_safe) literal in Cypher path pattern -- Neo4j rejects parameters in *min..max

fix(encoding): strip non-ASCII from 4 remaining files

fix(frontend+api): L-06+LOGIC -- evidence XSS and WS dedup

fix(api+graph+pipeline): M-04+M-05+M-08+M-09 -- misc medium fixes

fix(api+ai): M-01+M-02+M-03 -- version consistency and duplicate assignments

fix(api+pipeline): C-05+C-06 -- unsearchable nodes and hardcoded ICIJ names

fix(api): C-04 -- /investigate was using DeepInvestigator not MultiInvestigator

fix(api): C-02+H-04 -- risk None crash and missing risk signals

fix(encoding): strip non-ASCII chars from all modified files

fix(api): BUG-26 -- add explanatory comment for middleware ordering

fix(api): BUG-28 -- gate debug endpoints behind DEBUG_MODE env var

fix(api): BUG-17 -- fragile rstrip(s) filter normalisation in search

fix(api): BUG-12 -- SearchResult model missing risk_level field

fix(api): BUG-10 -- deduplicate graph edges before sending to frontend

fix(api): BUG-10 -- deduplicate graph edges before sending to frontend

feat(api): register /runtime route, bump version to 0.31.0

feat(api): add GET /runtime endpoint

fix(encoding): rewrite api/main.py as pure ASCII

fix(ci): collapse route import to single line for test.yml regex

fix

fix(admin): BUG-21/22/30 — driver reuse, bond key, 7 missing scrapers

fix(search): BUG-1/4/10/18 — type() crash, missing types, source map

fix(api): BUG-15/5/9/28 — CORS env var, real feed data, WS cleanup

fix(BUG-03/22): removed duplicate fallback block; added sources field to ProfileResponse

fix(BUG-13/14): audit_logger uses per-process file; rate_limiter evicts stale windows

fix(BUG-09): removed IGNORECASE — 'Union Bank' and 'Call Centre' no longer blocked

fix(BUG-08): DossierGenerator no longer caches stale Neo4j driver

fix(BUG-04): all investigation routes wrapped in try/except — no more raw 500s

fix(BUG-01/06/24): WebSocket now pushes heartbeat every 15s; /stats uses single session

fix(BUG-02/15/16): pipeline loads all 13 scrapers; reuses driver; auto-detects loaders

fix(BUG-07): generic fallback for AuditReport/Contract/NGO/ElectoralBond profiles

fix(BUG-09): depth via Cypher param not f-string; use explicit node/rel RETURN

fix(BUG-03/08): RiskScorer() takes no args; scorer.score()→use get_risk() route

fix(BUG-06): replace full-scan MATCH(n) with 14 indexed label queries — HTTP 500 on non-English

fix(BUG-05): per_label was 20÷14=1; now max(10, limit*2÷types)

fix(BUG-01): reconnect stale Neo4j driver — was causing intermittent HTTP 500s

fix(profile): generic fallback for AuditReport/Contract/NGO/ElectoralBond entity types

fix(search): replace full-scan MATCH(n) with 9 indexed queries — fixes HTTP 500 on non-English search

fix(admin): seed now creates relationships, bump version to 0.29.0

feat(update): evidence panel 4-tabs, connection map, language selector, API root route, 575-source CSV

feat(api): search expansion + version 0.28.0 + docs

feat(search): add 6 new entity types to search route

feat(ai): complete — Multi-Agent Debate Engine

Merge branch 'main' into fix/codeql-all-security-fixes

fix(api): search product field, max_hops, evidence coalesce, sources, stats

fix(security): remove cleartext logging and info exposure — CodeQL alerts 4-11

fix(security): path traversal guards on file output paths — CodeQL alerts 12-16

fix(api): search coverage, connection mapper, sources, and stats

fix(security): cleartext logging and information exposure fixes

feat(ai): complete — Adversarial Counterevidence and Competing Hypotheses