KatrielMoses/voidaccess](https:

v1.9.4

Foundation fixes for the upcoming 2.0.0 non-LLM orchestration work.

Fixed

• Co-occurrence graph builder saw only ~1.4% of an investigation's real entities (missing InvestigationEntityLink join under the global entity dedup model) — now correctly sees the full entity set, matching what get_entities already returns. Measured impact on real investigations: 0 to 642 edges, 0 to 106 connected entities on one real run.
• Gazetteer lookups now strip generic suffixes/prefixes (ransomware, group, etc.) before matching, correctly classifying compound forms like 'Akira ransomware' and 'LockBit Ransomware Group' that previously fell through to unclassified.
• Freshness threshold keys corrected to match real entity type names (CVE_NUMBER, THREAT_ACTOR_HANDLE, FILE_HASH_SHA1) — 21 of 26 entity types were silently falling back to default thresholds due to a naming mismatch.
• Added a separate investigation_count field to track genuine cross-investigation entity corroboration, distinct from corroborating_sources (which remains enrichment provenance).
• Consolidated CLI and API search timeout/retry/backoff configuration into one shared source of truth, closing a duplicate-implementation drift.
• Fixed an alembic_version column width limitation that could silently break future migrations with longer revision IDs.

This release lays the foundation for 2.0.0's non-LLM orchestration and network posture work.