main emits post-1.2.0 graphs (no _module, body-node ids, connected lattice) still stamped analyzer_version 1.2.0 — bump before cutting 1.3.0

[rahlk]

Observation

main (currently v1.2.0-13-g977198e) carries schema-affecting changes that are not in the 1.2.0 release — #169 connects the L4 port lattice to the statement DDG, #165 stamps id on body nodes and parameters, #166 retires _module from the Neo4j graph and scopes destructive statements on the can:// prefix, plus the entrypoints tiers — yet a graph emitted from main still stamps

analyzer_version: '1.2.0'

on :Application and in analysis.json's analyzer.version.

Why it matters

A consumer that gates on analyzer_version (the Python SDK's Neo4j backend refuses graphs below a floor and adapts to what a generation carries — it did exactly this for codeanalyzer-python 1.4.0 vs 1.4.1, where _module disappeared) cannot distinguish a 1.2.0 graph (has _module, no body-node ids, disconnected lattice) from a main graph (none of those) — they carry the same version string. Any consumer built against main's shape will silently mis-serve real 1.2.0 graphs, and vice versa.

Suggested fix

• Bump package.json (and whatever feeds analyzer.version) on main ahead of the next cut, or stamp a dev suffix (1.3.0-dev.<sha>) on unreleased builds so a graph is never mislabelled.
• Cut 1.3.0 when ready: the changes above are the ones downstream is waiting on (python-sdk leg 2.5 pins the release, not main, by the SDK's lockstep rule).

Definition of done

• A graph emitted from main carries an analyzer_version that is not equal to any released version.
• 1.3.0 is tagged with fix(dataflow): connect the L4 port lattice to the statement ddg #169, feat(schema): body nodes and parameters carry their id in analysis.json #165, fix(neo4j)!: scope every destructive statement on the can:// id prefix; retire _module #166 and the entrypoints tiers in its notes.

Found while emitting a reference graph for python-sdk leg 2.5 from source.