@massu/core 1.10.8 → 1.12.1

package/dist/cli.js

@@ -146,6 +146,8 @@ Hint: run \`massu config refresh\` to regenerate a valid config or fix the liste
     accessScopes: parsed.accessScopes,
     domains: parsed.domains,
     rules: parsed.rules,
+    // P-M-036: customer-authored CR-style governance rules.
+    governance_rules: parsed.governance_rules,
     analytics: parsed.analytics,
     governance: parsed.governance,
     security: parsed.security,
@@ -548,6 +550,22 @@ var init_config = __esm({
       accessScopes: z.array(z.string()).optional(),
       domains: z.array(DomainConfigSchema).default([]),
       rules: z.array(PatternRuleConfigSchema).default([]),
+      // P-M-036 (plan-stage-d-medium-sweep): customer-authored CR-style
+      // governance rules. DISTINCT from `rules:` above (path-scoped lint hints
+      // used by pattern-scanner). At config-refresh time these entries are
+      // loaded into the `knowledge_rules` SQLite table with
+      // `source = 'customer-config'` so `massu_knowledge_rule` and the
+      // governance docs surface customer-defined rules alongside framework CRs.
+      governance_rules: z.array(
+        z.object({
+          id: z.string().min(1, "governance_rules[].id is required"),
+          title: z.string().min(1, "governance_rules[].title is required"),
+          description: z.string().min(1, "governance_rules[].description is required"),
+          vr_type: z.string().default("VR-CUSTOM"),
+          reference_path: z.string().optional(),
+          severity: z.enum(["critical", "high", "medium", "low", "info"]).default("medium")
+        }).passthrough()
+      ).default([]),
       analytics: AnalyticsConfigSchema,
       governance: GovernanceConfigSchema,
       security: SecurityConfigSchema,
@@ -581,6 +599,7 @@ var init_config = __esm({
 // src/memory-db.ts
 var memory_db_exports = {};
 __export(memory_db_exports, {
+  TOOL_COST_EVENTS_RETENTION_DAYS: () => TOOL_COST_EVENTS_RETENTION_DAYS,
   addConversationTurn: () => addConversationTurn,
   addFailureClass: () => addFailureClass,
   addObservation: () => addObservation,
@@ -614,6 +633,7 @@ __export(memory_db_exports, {
   linkSessionToTask: () => linkSessionToTask,
   pruneOldConversationTurns: () => pruneOldConversationTurns,
   pruneOldObservations: () => pruneOldObservations,
+  pruneToolCostEvents: () => pruneToolCostEvents,
   removePendingSync: () => removePendingSync,
   sanitizeFts5Query: () => sanitizeFts5Query,
   scoreFailureClasses: () => scoreFailureClasses,
@@ -642,6 +662,12 @@ function getMemoryDb() {
   initMemorySchema(db);
   return db;
 }
+function pruneToolCostEvents(db) {
+  const result = db.prepare(
+    `DELETE FROM tool_cost_events WHERE created_at < datetime('now', '-' || ? || ' days')`
+  ).run(TOOL_COST_EVENTS_RETENTION_DAYS);
+  return result.changes;
+}
 function initMemorySchema(db) {
   db.exec(`
     -- Sessions table (linked to Claude Code session IDs)
@@ -1116,6 +1142,12 @@ function initMemorySchema(db) {
       features TEXT DEFAULT '[]'
     );
   `);
+  const licenseCacheCols = db.prepare(`PRAGMA table_info(license_cache)`).all();
+  if (!licenseCacheCols.some((c2) => c2.name === "signed_payload_json")) {
+    db.exec(
+      `ALTER TABLE license_cache ADD COLUMN signed_payload_json TEXT NOT NULL DEFAULT ''`
+    );
+  }
   db.exec(`
     CREATE TABLE IF NOT EXISTS failure_classes (
       id INTEGER PRIMARY KEY AUTOINCREMENT,
@@ -1141,7 +1173,7 @@ function enqueueSyncPayload(db, payload) {
 }
 function dequeuePendingSync(db, limit = 10) {
   const stale = db.prepare(
-    "SELECT id, retry_count, last_error FROM pending_sync WHERE retry_count >= 10"
+    "SELECT id, retry_count, last_error FROM pending_sync WHERE retry_count >= 10 LIMIT 10000"
   ).all();
   if (stale.length > 0) {
     const ids = stale.map((s) => s.id);
@@ -1380,16 +1412,17 @@ function getSessionsByTask(db, taskId) {
     SELECT session_id, status, started_at, ended_at, plan_phase
     FROM sessions WHERE task_id = ?
     ORDER BY started_at_epoch DESC
+    LIMIT 10000
   `).all(taskId);
 }
 function getCrossTaskProgress(db, taskId) {
   const sessions = db.prepare(`
-    SELECT session_id FROM sessions WHERE task_id = ?
+    SELECT session_id FROM sessions WHERE task_id = ? LIMIT 10000
   `).all(taskId);
   const merged = {};
   for (const session of sessions) {
     const summaries = db.prepare(`
-      SELECT plan_progress FROM session_summaries WHERE session_id = ?
+      SELECT plan_progress FROM session_summaries WHERE session_id = ? LIMIT 10000
     `).all(session.session_id);
     for (const summary of summaries) {
       try {
@@ -1688,10 +1721,12 @@ function scoreFailureClasses(db, matchText, filePath, promptContext, weights) {
   }
   return bestMatch;
 }
+var TOOL_COST_EVENTS_RETENTION_DAYS;
 var init_memory_db = __esm({
   "src/memory-db.ts"() {
     "use strict";
     init_config();
+    TOOL_COST_EVENTS_RETENTION_DAYS = 90;
   }
 });
 
@@ -2658,6 +2693,40 @@ var init_install_commands = __esm({
   }
 });
 
+// src/lib/hook-timeouts.ts
+var HOOK_TIMEOUTS;
+var init_hook_timeouts = __esm({
+  "src/lib/hook-timeouts.ts"() {
+    "use strict";
+    HOOK_TIMEOUTS = {
+      // Session lifecycle
+      "session-start": 10,
+      "session-end": 15,
+      "pre-compact": 10,
+      // PreToolUse hooks
+      // P-E-019: `pre-tool-use-gate` is the consolidated PreToolUse hook
+      // (combines security-gate + pre-delete-check into one spawn). The
+      // individual entries below are kept for back-compat with operator
+      // settings.json files that still reference them directly.
+      "pre-tool-use-gate": 5,
+      "security-gate": 5,
+      "pre-delete-check": 5,
+      // PostToolUse hooks
+      "post-tool-use": 10,
+      "quality-event": 5,
+      "cost-tracker": 5,
+      "post-edit-context": 5,
+      // Failure-handling hooks
+      "fix-detector": 5,
+      "classify-failure": 5,
+      "incident-pipeline": 5,
+      "rule-enforcement-pipeline": 5,
+      // Auto-learning
+      "auto-learning-pipeline": 10
+    };
+  }
+});
+
 // src/detect/manifest-registry.ts
 var manifest_registry_exports = {};
 __export(manifest_registry_exports, {
@@ -10567,8 +10636,9 @@ function evictBeyondRetainCount(retain = getCacheRetainCount()) {
       continue;
     }
     if (stat.isSymbolicLink() || !stat.isFile()) {
-      console.error(
-        `[tree-sitter-loader] cache eviction skipped non-regular file: ${path} (possible symlink attack \u2014 see Phase 3.5 finding F-008).`
+      process.stderr.write(
+        `[tree-sitter-loader] cache eviction skipped non-regular file: ${path} (possible symlink attack \u2014 see Phase 3.5 finding F-008).
+`
       );
       continue;
     }
@@ -10681,8 +10751,9 @@ async function loadGrammar(language, options = {}) {
     }
     evictBeyondRetainCount();
   } catch (e2) {
-    console.error(
-      `[tree-sitter-loader] cache write failed for ${language}: ${e2 instanceof Error ? e2.message : String(e2)} \u2014 loading directly from memory.`
+    process.stderr.write(
+      `[tree-sitter-loader] cache write failed for ${language}: ${e2 instanceof Error ? e2.message : String(e2)} \u2014 loading directly from memory.
+`
     );
   }
   const lang = await Language.load(body);
@@ -11509,14 +11580,6 @@ var init_python_flask = __esm({
   }
 });
 
-// src/detect/adapters/go-chi.ts
-import { goChiAdapter } from "@massu/adapter-go-chi";
-var init_go_chi = __esm({
-  "src/detect/adapters/go-chi.ts"() {
-    "use strict";
-  }
-});
-
 // src/detect/adapters/rails.ts
 import { railsAdapter } from "@massu/adapter-rails";
 var init_rails = __esm({
@@ -11525,22 +11588,6 @@ var init_rails = __esm({
   }
 });
 
-// src/detect/adapters/phoenix.ts
-import { phoenixAdapter } from "@massu/adapter-phoenix";
-var init_phoenix = __esm({
-  "src/detect/adapters/phoenix.ts"() {
-    "use strict";
-  }
-});
-
-// src/detect/adapters/aspnet.ts
-import { aspnetAdapter } from "@massu/adapter-aspnet";
-var init_aspnet = __esm({
-  "src/detect/adapters/aspnet.ts"() {
-    "use strict";
-  }
-});
-
 // src/detect/adapters/spring.ts
 import { springAdapter } from "@massu/adapter-spring";
 var init_spring = __esm({
@@ -11773,10 +11820,7 @@ var init_codebase_introspector = __esm({
     init_nextjs_trpc();
     init_swift_swiftui();
     init_python_flask();
-    init_go_chi();
     init_rails();
-    init_phoenix();
-    init_aspnet();
     init_spring();
     FIRST_PARTY_ADAPTERS = [
       pythonFastApiAdapter,
@@ -11784,10 +11828,7 @@ var init_codebase_introspector = __esm({
       pythonFlaskAdapter,
       nextjsTrpcAdapter,
       swiftSwiftUiAdapter,
-      goChiAdapter,
       railsAdapter,
-      phoenixAdapter,
-      aspnetAdapter,
       springAdapter
     ];
   }
@@ -13648,46 +13689,50 @@ function resolveHooksDir() {
 function hookCmd(version, hookName) {
   return `npx -y @massu/core@${version} hook-runner ${hookName}`;
 }
+function getHookTimeout(name) {
+  return HOOK_TIMEOUTS[name] ?? 5;
+}
 function buildHooksConfig(_hooksDir) {
   const version = getInstallerVersion();
   return {
     SessionStart: [
       {
         hooks: [
-          { type: "command", command: hookCmd(version, "session-start"), timeout: 10 }
+          { type: "command", command: hookCmd(version, "session-start"), timeout: getHookTimeout("session-start") }
         ]
       }
     ],
     PreToolUse: [
+      // P-E-019 (plan-stage-e-low-info-sweep): consolidated PreToolUse
+      // gate. Single hook spawn covers BOTH security-gate (Bash
+      // dangerous-pattern + Write/Edit protected-path + Python
+      // dangerous-code) AND pre-delete-check (sentinel feature impact +
+      // Python import graph). Cuts ~200ms of cold-start spawn overhead
+      // per tool call. Matcher includes both Bash + Write so the single
+      // hook fires once for every operation either check cares about.
       {
-        matcher: "Bash",
-        hooks: [
-          { type: "command", command: hookCmd(version, "security-gate"), timeout: 5 }
-        ]
-      },
-      {
-        matcher: "Bash|Write",
+        matcher: "Bash|Write|Edit",
         hooks: [
-          { type: "command", command: hookCmd(version, "pre-delete-check"), timeout: 5 }
+          { type: "command", command: hookCmd(version, "pre-tool-use-gate"), timeout: getHookTimeout("pre-tool-use-gate") }
         ]
       }
     ],
     PostToolUse: [
       {
         hooks: [
-          { type: "command", command: hookCmd(version, "post-tool-use"), timeout: 10 },
-          { type: "command", command: hookCmd(version, "quality-event"), timeout: 5 },
-          { type: "command", command: hookCmd(version, "cost-tracker"), timeout: 5 }
+          { type: "command", command: hookCmd(version, "post-tool-use"), timeout: getHookTimeout("post-tool-use") },
+          { type: "command", command: hookCmd(version, "quality-event"), timeout: getHookTimeout("quality-event") },
+          { type: "command", command: hookCmd(version, "cost-tracker"), timeout: getHookTimeout("cost-tracker") }
         ]
       },
       {
         matcher: "Edit|Write",
         hooks: [
-          { type: "command", command: hookCmd(version, "post-edit-context"), timeout: 5 },
+          { type: "command", command: hookCmd(version, "post-edit-context"), timeout: getHookTimeout("post-edit-context") },
           // Auto-learning pipeline — classifies failures and detects fixes on
           // file changes. See Phase 5-6 of the autodetect plan.
-          { type: "command", command: hookCmd(version, "fix-detector"), timeout: 5 },
-          { type: "command", command: hookCmd(version, "classify-failure"), timeout: 5 }
+          { type: "command", command: hookCmd(version, "fix-detector"), timeout: getHookTimeout("fix-detector") },
+          { type: "command", command: hookCmd(version, "classify-failure"), timeout: getHookTimeout("classify-failure") }
         ]
       },
       {
@@ -13695,32 +13740,32 @@ function buildHooksConfig(_hooksDir) {
         hooks: [
           // Incident + rule enforcement pipelines fire on Write-only (incidents
           // are authored as .md files; rules are enforced after new-file drops).
-          { type: "command", command: hookCmd(version, "incident-pipeline"), timeout: 5 },
-          { type: "command", command: hookCmd(version, "rule-enforcement-pipeline"), timeout: 5 }
+          { type: "command", command: hookCmd(version, "incident-pipeline"), timeout: getHookTimeout("incident-pipeline") },
+          { type: "command", command: hookCmd(version, "rule-enforcement-pipeline"), timeout: getHookTimeout("rule-enforcement-pipeline") }
         ]
       }
     ],
     Stop: [
       {
         hooks: [
-          { type: "command", command: hookCmd(version, "session-end"), timeout: 15 },
+          { type: "command", command: hookCmd(version, "session-end"), timeout: getHookTimeout("session-end") },
           // Session-end auto-learning aggregation (failure-class roll-up).
-          { type: "command", command: hookCmd(version, "auto-learning-pipeline"), timeout: 10 }
+          { type: "command", command: hookCmd(version, "auto-learning-pipeline"), timeout: getHookTimeout("auto-learning-pipeline") }
         ]
       }
     ],
     PreCompact: [
       {
         hooks: [
-          { type: "command", command: hookCmd(version, "pre-compact"), timeout: 10 }
+          { type: "command", command: hookCmd(version, "pre-compact"), timeout: getHookTimeout("pre-compact") }
         ]
       }
     ],
     UserPromptSubmit: [
       {
         hooks: [
-          { type: "command", command: hookCmd(version, "user-prompt"), timeout: 5 },
-          { type: "command", command: hookCmd(version, "intent-suggester"), timeout: 5 }
+          { type: "command", command: hookCmd(version, "user-prompt"), timeout: getHookTimeout("user-prompt") },
+          { type: "command", command: hookCmd(version, "intent-suggester"), timeout: getHookTimeout("intent-suggester") }
         ]
       }
     ]
@@ -13905,7 +13950,15 @@ function summarizeDetection2(detection) {
     const dirs = detection.sourceDirs[lang]?.source_dirs ?? [];
     const dirSuffix = dirs.length > 0 ? ` in ${dirs.join(",")}` : "";
     const fwName = fw?.framework ?? "no-framework";
-    parts.push(`${capitalize(lang)}/${fwName}${dirSuffix}`);
+    const slotParts = [];
+    const router = fw?.router;
+    const orm = fw?.orm;
+    const ui = fw?.ui;
+    if (router && router !== "none") slotParts.push(`router=${router}`);
+    if (orm && orm !== "none") slotParts.push(`orm=${orm}`);
+    if (ui && ui !== "none") slotParts.push(`ui=${ui}`);
+    const slotSuffix = slotParts.length > 0 ? ` (${slotParts.join(", ")})` : "";
+    parts.push(`${capitalize(lang)}/${fwName}${slotSuffix}${dirSuffix}`);
   }
   const mono = detection.monorepo.type;
   const monoSuffix = mono && mono !== "single" ? ` [${mono} monorepo]` : "";
@@ -14178,6 +14231,7 @@ var init_init = __esm({
     init_install_commands();
     init_settings_local();
     init_memory_path();
+    init_hook_timeouts();
     init_detect();
     init_drift();
     __filename2 = fileURLToPath2(import.meta.url);
@@ -14216,7 +14270,7 @@ var init_license_pubkey_generated = __esm({
 });
 
 // src/security/license-response-verifier.ts
-import { createPublicKey } from "crypto";
+import { createPublicKey, verify as cryptoVerify } from "crypto";
 function verifyLicenseResponse(payload) {
   if (!KNOWN_LICENSE_PUBKEY_FINGERPRINTS.has(LICENSE_PUBKEY_FINGERPRINT_HEX)) {
     return {
@@ -14263,8 +14317,7 @@ function verifyLicenseResponse(payload) {
     ]);
     const der = Buffer.concat([spkiPrefix, Buffer.from(LICENSE_PUBKEY_ED25519)]);
     const pubkey = createPublicKey({ key: der, format: "der", type: "spki" });
-    const { verify } = __require("crypto");
-    const ok = verify(
+    const ok = cryptoVerify(
       null,
       Buffer.from(canonical, "utf-8"),
       pubkey,
@@ -14311,13 +14364,31 @@ function isToolAllowed(toolName, userTier) {
   return tierLevel(userTier) >= tierLevel(requiredTier);
 }
 function annotateToolDefinitions(defs) {
+  for (const def of defs) {
+    const expectedTier = getToolTier(def.name);
+    const incomingTier = def.annotations?.tier;
+    if (incomingTier !== void 0 && incomingTier !== expectedTier) {
+      throw new Error(
+        `TOOL_TIER_MAP bijection violation (P-M-033): tool "${def.name}" has annotations.tier="${incomingTier}" but TOOL_TIER_MAP says "${expectedTier}". TOOL_TIER_MAP is the SoT \u2014 fix the source instead.`
+      );
+    }
+    const expectedPrefix = TIER_LABELS[expectedTier];
+    for (const otherPrefix of Object.values(TIER_LABELS)) {
+      if (otherPrefix && otherPrefix !== expectedPrefix && def.description.startsWith(otherPrefix)) {
+        throw new Error(
+          `TOOL_TIER_MAP bijection violation (P-M-033): tool "${def.name}" description starts with "${otherPrefix}" but TOOL_TIER_MAP tier is "${expectedTier}" (expected prefix "${expectedPrefix}").`
+        );
+      }
+    }
+  }
   return defs.map((def) => {
     const tier = getToolTier(def.name);
     const label = TIER_LABELS[tier];
+    const stripped = label && def.description.startsWith(label) ? def.description.slice(label.length) : def.description;
     return {
       ...def,
       annotations: { ...def.annotations ?? {}, tier },
-      description: label ? `${label}${def.description}` : def.description
+      description: label ? `${label}${stripped}` : stripped
     };
   });
 }
@@ -14329,17 +14400,14 @@ async function validateLicense(apiKey) {
   const memDb = getMemoryDb();
   try {
     const cached = memDb.prepare(
-      "SELECT tier, valid_until, last_validated, features FROM license_cache WHERE api_key_hash = ?"
+      "SELECT tier, valid_until, last_validated, features, signed_payload_json FROM license_cache WHERE api_key_hash = ?"
     ).get(keyHash);
-    if (cached) {
+    const trusted = cached ? readTrustedCache(cached) : null;
+    if (cached && trusted) {
       const lastValidated = new Date(cached.last_validated);
       const hourAgo = new Date(Date.now() - 60 * 60 * 1e3);
       if (lastValidated > hourAgo) {
-        return {
-          tier: cached.tier,
-          validUntil: cached.valid_until,
-          features: JSON.parse(cached.features || "[]")
-        };
+        return trusted;
       }
     }
     const config = getConfig();
@@ -14368,7 +14436,13 @@ async function validateLicense(apiKey) {
             const tier = data.plan ? PLAN_TO_TIER_MAP[data.plan] ?? "free" : data.tier ?? "free";
             const validUntil = data.validUntil ?? "";
             const features = data.features ?? [];
-            updateLicenseCache(apiKey, tier, validUntil, features);
+            updateLicenseCache(
+              apiKey,
+              tier,
+              validUntil,
+              features,
+              sigResult.kind === "valid" ? data : null
+            );
             return { tier, validUntil, features };
           }
           return { tier: "free", validUntil: "", features: [] };
@@ -14376,15 +14450,11 @@ async function validateLicense(apiKey) {
       } catch {
       }
     }
-    if (cached) {
+    if (cached && trusted) {
       const lastValidated = new Date(cached.last_validated);
       const sevenDaysAgo = new Date(Date.now() - 7 * 24 * 60 * 60 * 1e3);
       if (lastValidated > sevenDaysAgo) {
-        return {
-          tier: cached.tier,
-          validUntil: cached.valid_until,
-          features: JSON.parse(cached.features || "[]")
-        };
+        return trusted;
       }
     }
     return { tier: "free", validUntil: "", features: [] };
@@ -14392,18 +14462,49 @@ async function validateLicense(apiKey) {
     memDb.close();
   }
 }
-function updateLicenseCache(apiKey, tier, validUntil, features = []) {
+function updateLicenseCache(apiKey, tier, validUntil, features = [], signedPayload = null) {
   const keyHash = createHash5("sha256").update(apiKey).digest("hex");
   const memDb = getMemoryDb();
   try {
     memDb.prepare(`
-      INSERT OR REPLACE INTO license_cache (api_key_hash, tier, valid_until, last_validated, features)
-      VALUES (?, ?, ?, datetime('now'), ?)
-    `).run(keyHash, tier, validUntil, JSON.stringify(features));
+      INSERT OR REPLACE INTO license_cache (api_key_hash, tier, valid_until, last_validated, features, signed_payload_json)
+      VALUES (?, ?, ?, datetime('now'), ?, ?)
+    `).run(
+      keyHash,
+      tier,
+      validUntil,
+      JSON.stringify(features),
+      signedPayload ? JSON.stringify(signedPayload) : ""
+    );
   } finally {
     memDb.close();
   }
 }
+function readTrustedCache(cached) {
+  if (!cached.signed_payload_json) {
+    if (isLicenseSignatureRequired()) return null;
+    warnLicenseSigOnce("cache_unsigned_transition");
+    return {
+      tier: cached.tier,
+      validUntil: cached.valid_until,
+      features: JSON.parse(cached.features || "[]")
+    };
+  }
+  let parsed;
+  try {
+    parsed = JSON.parse(cached.signed_payload_json);
+  } catch {
+    return null;
+  }
+  const result = verifyLicenseResponse(parsed);
+  if (result.kind !== "valid") return null;
+  const verifiedPlan = typeof parsed.plan === "string" ? parsed.plan : null;
+  const verifiedTierField = typeof parsed.tier === "string" ? parsed.tier : null;
+  const tier = verifiedPlan ? PLAN_TO_TIER_MAP[verifiedPlan] ?? "free" : verifiedTierField ?? "free";
+  const validUntil = typeof parsed.validUntil === "string" ? parsed.validUntil : "";
+  const features = Array.isArray(parsed.features) ? parsed.features : [];
+  return { tier, validUntil, features };
+}
 async function getCurrentTier() {
   if (cachedTier && Date.now() - cachedTierTimestamp < IN_MEMORY_CACHE_TTL_MS) {
     return cachedTier.tier;
@@ -14511,6 +14612,12 @@ var init_license = __esm({
       coupling_check: "free",
       memory_search: "free",
       memory_ingest: "free",
+      // P-M-042 (plan-stage-d-medium-sweep): memory_backfill serves the
+      // customer's MEMORY.md ingestion workflow and was registered in
+      // memory-tools.ts but missing from TOOL_TIER_MAP. The bijection
+      // drift-guard (P-M-033) would have caught it on next add; we land it
+      // explicitly as Free since it's a customer-owned-data ingestion path.
+      memory_backfill: "free",
       regression_risk: "free",
       feature_health: "free",
       license_status: "free",
@@ -14586,7 +14693,7 @@ var init_license = __esm({
       cloud_enterprise: "enterprise"
     };
     TIER_LABELS = {
-      free: "",
+      free: "[FREE] ",
       pro: "[PRO] ",
       team: "[TEAM] ",
       enterprise: "[ENTERPRISE] "
@@ -14615,7 +14722,12 @@ var init_hook_registry = __esm({
       "post-edit-context",
       "post-tool-use",
       "pre-compact",
+      // P-E-019 (1.12.0): security-gate + pre-delete-check are kept registered
+      // for back-compat (operator settings.json may still reference them
+      // individually), but new installs emit only `pre-tool-use-gate` —
+      // the consolidated single-spawn PreToolUse hook.
       "pre-delete-check",
+      "pre-tool-use-gate",
       "quality-event",
       "rule-enforcement-pipeline",
       "security-gate",
@@ -18027,10 +18139,11 @@ var init_adapters = __esm({
   "src/detect/adapters/index.ts"() {
     "use strict";
     CORE_BUNDLED_IDS = /* @__PURE__ */ new Set([
-      "aspnet",
-      "go-chi",
+      // P-M-032 (plan-stage-d-medium-sweep): aspnet, go-chi, phoenix REMOVED
+      // — zero downstream consumers (each had a single 1-line re-export shim).
+      // Rails (5 consumers) + Spring (1 consumer) deferred to Stage E as the
+      // JVM/Ruby ecosystem-watch pair per operator decision.
       "nextjs-trpc",
-      "phoenix",
       "python-django",
       "python-fastapi",
       "python-flask",
@@ -18977,6 +19090,184 @@ var init_db = __esm({
   }
 });
 
+// src/knowledge-db.ts
+import Database3 from "better-sqlite3";
+import { dirname as dirname14 } from "path";
+import { existsSync as existsSync28, mkdirSync as mkdirSync11 } from "fs";
+function getKnowledgeDb() {
+  const dbPath = getResolvedPaths().knowledgeDbPath;
+  const dir = dirname14(dbPath);
+  if (!existsSync28(dir)) {
+    mkdirSync11(dir, { recursive: true });
+  }
+  const db = new Database3(dbPath);
+  db.pragma("journal_mode = WAL");
+  db.pragma("foreign_keys = ON");
+  initKnowledgeSchema(db);
+  return db;
+}
+function initKnowledgeSchema(db) {
+  db.exec(`
+    -- Core document chunks (parsed from .claude/**/*.md)
+    CREATE TABLE IF NOT EXISTS knowledge_documents (
+      id INTEGER PRIMARY KEY AUTOINCREMENT,
+      file_path TEXT NOT NULL,
+      category TEXT NOT NULL,
+      title TEXT NOT NULL,
+      description TEXT,
+      content_hash TEXT NOT NULL,
+      indexed_at TEXT NOT NULL,
+      indexed_at_epoch INTEGER NOT NULL
+    );
+
+    CREATE UNIQUE INDEX IF NOT EXISTS idx_kd_filepath ON knowledge_documents(file_path);
+    CREATE INDEX IF NOT EXISTS idx_kd_category ON knowledge_documents(category);
+
+    -- Structured chunks within documents
+    CREATE TABLE IF NOT EXISTS knowledge_chunks (
+      id INTEGER PRIMARY KEY AUTOINCREMENT,
+      document_id INTEGER NOT NULL REFERENCES knowledge_documents(id) ON DELETE CASCADE,
+      chunk_type TEXT NOT NULL CHECK(chunk_type IN (
+        'section', 'table_row', 'code_block', 'rule', 'incident', 'pattern', 'command', 'mismatch'
+      )),
+      heading TEXT,
+      content TEXT NOT NULL,
+      line_start INTEGER,
+      line_end INTEGER,
+      metadata TEXT DEFAULT '{}'
+    );
+
+    CREATE INDEX IF NOT EXISTS idx_kc_doc ON knowledge_chunks(document_id);
+    CREATE INDEX IF NOT EXISTS idx_kc_type ON knowledge_chunks(chunk_type);
+    CREATE INDEX IF NOT EXISTS idx_kc_heading ON knowledge_chunks(heading);
+
+    -- Canonical Rules index
+    CREATE TABLE IF NOT EXISTS knowledge_rules (
+      id INTEGER PRIMARY KEY AUTOINCREMENT,
+      rule_id TEXT UNIQUE NOT NULL,
+      rule_text TEXT NOT NULL,
+      vr_type TEXT,
+      reference_path TEXT,
+      severity TEXT DEFAULT 'HIGH',
+      prevention_summary TEXT
+    );
+
+    CREATE INDEX IF NOT EXISTS idx_kr_id ON knowledge_rules(rule_id);
+  `);
+  const rulesCols = db.prepare(`PRAGMA table_info(knowledge_rules)`).all();
+  if (!rulesCols.some((c2) => c2.name === "source")) {
+    db.exec(
+      `ALTER TABLE knowledge_rules ADD COLUMN source TEXT NOT NULL DEFAULT 'framework'`
+    );
+  }
+  db.exec(`
+
+    -- Verification Requirements index
+    CREATE TABLE IF NOT EXISTS knowledge_verifications (
+      id INTEGER PRIMARY KEY AUTOINCREMENT,
+      vr_type TEXT UNIQUE NOT NULL,
+      command TEXT NOT NULL,
+      expected TEXT NOT NULL,
+      use_when TEXT NOT NULL,
+      catches TEXT,
+      category TEXT
+    );
+
+    CREATE INDEX IF NOT EXISTS idx_kv_type ON knowledge_verifications(vr_type);
+    CREATE INDEX IF NOT EXISTS idx_kv_category ON knowledge_verifications(category);
+
+    -- Incident index
+    CREATE TABLE IF NOT EXISTS knowledge_incidents (
+      id INTEGER PRIMARY KEY AUTOINCREMENT,
+      incident_num INTEGER UNIQUE NOT NULL,
+      date TEXT NOT NULL,
+      type TEXT NOT NULL,
+      gap_found TEXT NOT NULL,
+      prevention TEXT NOT NULL,
+      cr_added TEXT,
+      root_cause TEXT,
+      user_quote TEXT
+    );
+
+    CREATE INDEX IF NOT EXISTS idx_ki_num ON knowledge_incidents(incident_num);
+    CREATE INDEX IF NOT EXISTS idx_ki_type ON knowledge_incidents(type);
+    CREATE INDEX IF NOT EXISTS idx_ki_cr ON knowledge_incidents(cr_added);
+
+    -- Schema mismatch quick lookup
+    -- P-H013 (plan-stage-c-high-batch): the source column no longer has a
+    -- SQL DEFAULT. Previously the value was a JS template-literal
+    -- interpolation baked into the customer SQLite at schema creation
+    -- time, so later config changes were ignored. Default is now applied
+    -- at INSERT time via getConfig().conventions.knowledgeSourceFiles[0]
+    -- in knowledge-indexer.ts -- a runtime config lookup that reflects
+    -- the customers current config.
+    CREATE TABLE IF NOT EXISTS knowledge_schema_mismatches (
+      id INTEGER PRIMARY KEY AUTOINCREMENT,
+      table_name TEXT NOT NULL,
+      wrong_column TEXT NOT NULL,
+      correct_column TEXT NOT NULL,
+      source TEXT NOT NULL
+    );
+
+    CREATE INDEX IF NOT EXISTS idx_ksm_table ON knowledge_schema_mismatches(table_name);
+
+    -- Cross-reference graph
+    CREATE TABLE IF NOT EXISTS knowledge_edges (
+      id INTEGER PRIMARY KEY AUTOINCREMENT,
+      source_type TEXT NOT NULL,
+      source_id TEXT NOT NULL,
+      target_type TEXT NOT NULL,
+      target_id TEXT NOT NULL,
+      edge_type TEXT NOT NULL
+    );
+
+    CREATE INDEX IF NOT EXISTS idx_ke_source ON knowledge_edges(source_type, source_id);
+    CREATE INDEX IF NOT EXISTS idx_ke_target ON knowledge_edges(target_type, target_id);
+    CREATE UNIQUE INDEX IF NOT EXISTS idx_ke_unique ON knowledge_edges(source_type, source_id, target_type, target_id, edge_type);
+
+    -- Staleness tracking
+    CREATE TABLE IF NOT EXISTS knowledge_meta (
+      key TEXT PRIMARY KEY,
+      value TEXT NOT NULL
+    );
+  `);
+  try {
+    db.exec(`
+      CREATE VIRTUAL TABLE IF NOT EXISTS knowledge_fts USING fts5(
+        heading, content, chunk_type, file_path
+      );
+
+      CREATE TRIGGER IF NOT EXISTS kc_fts_insert AFTER INSERT ON knowledge_chunks BEGIN
+        INSERT INTO knowledge_fts(rowid, heading, content, chunk_type, file_path)
+        SELECT new.id, new.heading, new.content, new.chunk_type, kd.file_path
+        FROM knowledge_documents kd WHERE kd.id = new.document_id;
+      END;
+
+      CREATE TRIGGER IF NOT EXISTS kc_fts_delete AFTER DELETE ON knowledge_chunks BEGIN
+        INSERT INTO knowledge_fts(knowledge_fts, rowid, heading, content, chunk_type, file_path)
+        SELECT 'delete', old.id, old.heading, old.content, old.chunk_type, kd.file_path
+        FROM knowledge_documents kd WHERE kd.id = old.document_id;
+      END;
+
+      CREATE TRIGGER IF NOT EXISTS kc_fts_update AFTER UPDATE ON knowledge_chunks BEGIN
+        INSERT INTO knowledge_fts(knowledge_fts, rowid, heading, content, chunk_type, file_path)
+        SELECT 'delete', old.id, old.heading, old.content, old.chunk_type, kd.file_path
+        FROM knowledge_documents kd WHERE kd.id = old.document_id;
+        INSERT INTO knowledge_fts(rowid, heading, content, chunk_type, file_path)
+        SELECT new.id, new.heading, new.content, new.chunk_type, kd.file_path
+        FROM knowledge_documents kd WHERE kd.id = new.document_id;
+      END;
+    `);
+  } catch {
+  }
+}
+var init_knowledge_db = __esm({
+  "src/knowledge-db.ts"() {
+    "use strict";
+    init_config();
+  }
+});
+
 // src/security-utils.ts
 import { resolve as resolve24, normalize } from "path";
 function ensureWithinRoot(filePath, projectRoot) {
@@ -19054,8 +19345,8 @@ var init_rules = __esm({
 });
 
 // src/import-resolver.ts
-import { readFileSync as readFileSync25, existsSync as existsSync28, statSync as statSync12 } from "fs";
-import { resolve as resolve25, dirname as dirname14, join as join13 } from "path";
+import { readFileSync as readFileSync25, existsSync as existsSync29, statSync as statSync12 } from "fs";
+import { resolve as resolve25, dirname as dirname15, join as join13 } from "path";
 function parseImports(source) {
   const imports = [];
   const lines = source.split("\n");
@@ -19113,21 +19404,21 @@ function resolveImportPath(specifier, fromFile) {
     const paths = getResolvedPaths();
     basePath = resolve25(paths.pathAlias["@"] ?? paths.srcDir, specifier.slice(2));
   } else {
-    basePath = resolve25(dirname14(fromFile), specifier);
+    basePath = resolve25(dirname15(fromFile), specifier);
   }
-  if (existsSync28(basePath) && !isDirectory(basePath)) {
+  if (existsSync29(basePath) && !isDirectory(basePath)) {
     return toRelative(basePath);
   }
   const resolvedPaths = getResolvedPaths();
   for (const ext of resolvedPaths.extensions) {
     const withExt = basePath + ext;
-    if (existsSync28(withExt)) {
+    if (existsSync29(withExt)) {
       return toRelative(withExt);
     }
   }
   for (const indexFile of resolvedPaths.indexFiles) {
     const indexPath = join13(basePath, indexFile);
-    if (existsSync28(indexPath)) {
+    if (existsSync29(indexPath)) {
       return toRelative(indexPath);
     }
   }
@@ -19164,7 +19455,7 @@ function buildImportIndex(dataDb, codegraphDb) {
   let batch = [];
   for (const file of files) {
     const absPath = ensureWithinRoot(resolve25(projectRoot, file.path), projectRoot);
-    if (!existsSync28(absPath)) continue;
+    if (!existsSync29(absPath)) continue;
     let source;
     try {
       source = readFileSync25(absPath, "utf-8");
@@ -19204,12 +19495,12 @@ var init_import_resolver = __esm({
 });
 
 // src/trpc-index.ts
-import { readFileSync as readFileSync26, existsSync as existsSync29, readdirSync as readdirSync16 } from "fs";
+import { readFileSync as readFileSync26, existsSync as existsSync30, readdirSync as readdirSync16 } from "fs";
 import { resolve as resolve26, join as join14 } from "path";
 function parseRootRouter() {
   const paths = getResolvedPaths();
   const rootPath = paths.rootRouterPath;
-  if (!existsSync29(rootPath)) {
+  if (!existsSync30(rootPath)) {
     throw new Error(`Root router not found at ${rootPath}`);
   }
   const source = readFileSync26(rootPath, "utf-8");
@@ -19224,12 +19515,12 @@ function parseRootRouter() {
     for (const ext of [".ts", ".tsx", ""]) {
       const candidate = fullPath + ext;
       const routersRelPath = getConfig().paths.routers ?? "src/server/api/routers";
-      if (existsSync29(candidate)) {
+      if (existsSync30(candidate)) {
         filePath = routersRelPath + "/" + filePath + ext;
         break;
       }
       const indexCandidate = join14(fullPath, "index.ts");
-      if (existsSync29(indexCandidate)) {
+      if (existsSync30(indexCandidate)) {
         filePath = routersRelPath + "/" + filePath + "/index.ts";
         break;
       }
@@ -19249,7 +19540,7 @@ function parseRootRouter() {
 }
 function extractProcedures(routerFilePath) {
   const absPath = resolve26(getProjectRoot(), routerFilePath);
-  if (!existsSync29(absPath)) return [];
+  if (!existsSync30(absPath)) return [];
   const source = readFileSync26(absPath, "utf-8");
   const procedures = [];
   const seen = /* @__PURE__ */ new Set();
@@ -19279,7 +19570,7 @@ function findUICallSites(routerKey, procedureName) {
   ];
   const searchPattern = `api.${routerKey}.${procedureName}`;
   for (const dir of searchDirs) {
-    if (!existsSync29(dir)) continue;
+    if (!existsSync30(dir)) continue;
     searchDirectory(dir, searchPattern, callSites);
   }
   return callSites;
@@ -19357,7 +19648,7 @@ var init_trpc_index = __esm({
 });
 
 // src/page-deps.ts
-import { readFileSync as readFileSync27, existsSync as existsSync30 } from "fs";
+import { readFileSync as readFileSync27, existsSync as existsSync31 } from "fs";
 import { resolve as resolve27 } from "path";
 function deriveRoute(pageFile) {
   let route = pageFile.replace(/^src\/app/, "").replace(/\/page\.tsx?$/, "").replace(/\/page\.jsx?$/, "");
@@ -19377,7 +19668,7 @@ function traceImports(startFile, dataDb, visited, components, hooks, maxDepth =
   if (maxDepth <= 0 || visited.has(startFile)) return;
   visited.add(startFile);
   const imports = dataDb.prepare(
-    `SELECT target_file, imported_names FROM ${t("imports")} WHERE source_file = ?`
+    `SELECT target_file, imported_names FROM ${t("imports")} WHERE source_file = ? LIMIT 10000`
   ).all(startFile);
   for (const imp of imports) {
     const target = imp.target_file;
@@ -19397,7 +19688,7 @@ function findRouterCalls(files) {
   const projectRoot = getProjectRoot();
   for (const file of files) {
     const absPath = ensureWithinRoot(resolve27(projectRoot, file), projectRoot);
-    if (!existsSync30(absPath)) continue;
+    if (!existsSync31(absPath)) continue;
     try {
       const source = readFileSync27(absPath, "utf-8");
       const apiCallRegex = /api\.(\w+)\.\w+/g;
@@ -19414,11 +19705,11 @@ function findTablesFromRouters(routerNames, dataDb) {
   const tables = /* @__PURE__ */ new Set();
   for (const routerName of routerNames) {
     const procs = dataDb.prepare(
-      `SELECT DISTINCT router_file FROM ${t("trpc_procedures")} WHERE router_name = ?`
+      `SELECT DISTINCT router_file FROM ${t("trpc_procedures")} WHERE router_name = ? LIMIT 10000`
     ).all(routerName);
     for (const proc of procs) {
       const absPath = ensureWithinRoot(resolve27(getProjectRoot(), proc.router_file), getProjectRoot());
-      if (!existsSync30(absPath)) continue;
+      if (!existsSync31(absPath)) continue;
       try {
         const source = readFileSync27(absPath, "utf-8");
         const dbPattern = getConfig().dbAccessPattern ?? "ctx.db.{table}";
@@ -19437,7 +19728,7 @@ function findTablesFromRouters(routerNames, dataDb) {
 function buildPageDeps(dataDb, codegraphDb) {
   dataDb.exec(`DELETE FROM ${t("page_deps")}`);
   const pages = codegraphDb.prepare(
-    "SELECT path FROM files WHERE path LIKE 'src/app/%/page.tsx' OR path = 'src/app/page.tsx'"
+    "SELECT path FROM files WHERE path LIKE 'src/app/%/page.tsx' OR path = 'src/app/page.tsx' LIMIT 10000"
   ).all();
   const insertStmt = dataDb.prepare(
     `INSERT INTO ${t("page_deps")} (page_file, route, portal, components, hooks, routers, tables_touched) VALUES (?, ?, ?, ?, ?, ?, ?)`
@@ -19486,7 +19777,7 @@ function findAffectedPages(dataDb, file) {
   const directPage = getPageChain(dataDb, file);
   if (directPage) return [directPage];
   const importers = dataDb.prepare(
-    `SELECT source_file FROM ${t("imports")} WHERE target_file = ?`
+    `SELECT source_file FROM ${t("imports")} WHERE target_file = ? LIMIT 5000`
   ).all(file);
   const affectedFiles = /* @__PURE__ */ new Set([file, ...importers.map((i) => i.source_file)]);
   let frontier = [...importers.map((i) => i.source_file)];
@@ -19497,7 +19788,7 @@ function findAffectedPages(dataDb, file) {
     const next = [];
     for (const f2 of frontier) {
       const upstreamImporters = dataDb.prepare(
-        `SELECT source_file FROM ${t("imports")} WHERE target_file = ?`
+        `SELECT source_file FROM ${t("imports")} WHERE target_file = ? LIMIT 5000`
       ).all(f2);
       for (const imp of upstreamImporters) {
         if (!visited.has(imp.source_file)) {
@@ -19548,7 +19839,7 @@ function buildMiddlewareTree(dataDb) {
   while (queue.length > 0) {
     const current = queue.shift();
     const imports = dataDb.prepare(
-      `SELECT target_file FROM ${t("imports")} WHERE source_file = ?`
+      `SELECT target_file FROM ${t("imports")} WHERE source_file = ? LIMIT 10000`
     ).all(current);
     for (const imp of imports) {
       if (!visited.has(imp.target_file) && imp.target_file.startsWith("src/")) {
@@ -19636,7 +19927,7 @@ function findCrossDomainImports(dataDb) {
   const srcPrefix = config.paths.source;
   const srcPattern = srcPrefix + "/%";
   const imports = dataDb.prepare(
-    `SELECT source_file, target_file FROM ${t("imports")} WHERE source_file LIKE ? AND target_file LIKE ?`
+    `SELECT source_file, target_file FROM ${t("imports")} WHERE source_file LIKE ? AND target_file LIKE ? LIMIT 10000`
   ).all(srcPattern, srcPattern);
   const crossings = [];
   for (const imp of imports) {
@@ -19692,11 +19983,11 @@ var init_domains = __esm({
 });
 
 // src/schema-mapper.ts
-import { readFileSync as readFileSync28, existsSync as existsSync31, readdirSync as readdirSync17 } from "fs";
+import { readFileSync as readFileSync28, existsSync as existsSync32, readdirSync as readdirSync17 } from "fs";
 import { join as join15 } from "path";
 function parsePrismaSchema() {
   const schemaPath = getResolvedPaths().prismaSchemaPath;
-  if (!existsSync31(schemaPath)) {
+  if (!existsSync32(schemaPath)) {
     throw new Error(`Prisma schema not found at ${schemaPath}`);
   }
   const source = readFileSync28(schemaPath, "utf-8");
@@ -19757,7 +20048,7 @@ function toSnakeCase(str) {
 function findColumnUsageInRouters(tableName) {
   const usage = /* @__PURE__ */ new Map();
   const routersDir = getResolvedPaths().routersDir;
-  if (!existsSync31(routersDir)) return usage;
+  if (!existsSync32(routersDir)) return usage;
   scanDirectory(routersDir, tableName, usage);
   return usage;
 }
@@ -19819,7 +20110,7 @@ function detectMismatches(models) {
 }
 function findFilesUsingColumn(dir, column, tableName) {
   const result = [];
-  if (!existsSync31(dir)) return result;
+  if (!existsSync32(dir)) return result;
   const entries = readdirSync17(dir, { withFileTypes: true });
   for (const entry of entries) {
     const fullPath = join15(dir, entry.name);
@@ -19972,14 +20263,14 @@ var init_import_parser = __esm({
 });
 
 // src/python/import-resolver.ts
-import { readFileSync as readFileSync29, existsSync as existsSync32, readdirSync as readdirSync18 } from "fs";
-import { resolve as resolve29, join as join16, relative as relative6, dirname as dirname15 } from "path";
+import { readFileSync as readFileSync29, existsSync as existsSync33, readdirSync as readdirSync18 } from "fs";
+import { resolve as resolve29, join as join16, relative as relative6, dirname as dirname16 } from "path";
 function resolvePythonModulePath(module, fromFile, pythonRoot, level) {
   const projectRoot = getProjectRoot();
   if (level > 0) {
-    let baseDir = dirname15(resolve29(projectRoot, fromFile));
+    let baseDir = dirname16(resolve29(projectRoot, fromFile));
     for (let i = 1; i < level; i++) {
-      baseDir = dirname15(baseDir);
+      baseDir = dirname16(baseDir);
     }
     const modulePart = module.replace(/^\.+/, "");
     if (modulePart) {
@@ -19993,13 +20284,13 @@ function resolvePythonModulePath(module, fromFile, pythonRoot, level) {
   return tryResolvePythonPath(candidate, projectRoot);
 }
 function tryResolvePythonPath(basePath, projectRoot) {
-  if (existsSync32(basePath + ".py")) {
+  if (existsSync33(basePath + ".py")) {
     return relative6(projectRoot, basePath + ".py");
   }
-  if (existsSync32(join16(basePath, "__init__.py"))) {
+  if (existsSync33(join16(basePath, "__init__.py"))) {
     return relative6(projectRoot, join16(basePath, "__init__.py"));
   }
-  if (basePath.endsWith(".py") && existsSync32(basePath)) {
+  if (basePath.endsWith(".py") && existsSync33(basePath)) {
     return relative6(projectRoot, basePath);
   }
   return null;
@@ -21201,7 +21492,7 @@ function handleDetail(args2, db) {
   if (!ids || ids.length === 0) return text("Error: ids array is required");
   const placeholders = ids.map(() => "?").join(",");
   const observations = db.prepare(
-    `SELECT * FROM observations WHERE id IN (${placeholders}) ORDER BY created_at_epoch ASC`
+    `SELECT * FROM observations WHERE id IN (${placeholders}) ORDER BY created_at_epoch ASC LIMIT 10000`
   ).all(...ids);
   if (observations.length === 0) {
     return text("No observations found for the given IDs.");
@@ -21352,7 +21643,7 @@ var init_memory_tools = __esm({
 });
 
 // src/docs-tools.ts
-import { readFileSync as readFileSync34, existsSync as existsSync33 } from "fs";
+import { readFileSync as readFileSync34, existsSync as existsSync34 } from "fs";
 import { resolve as resolve30, basename as basename6 } from "path";
 function p3(baseName) {
   return `${getConfig().toolPrefix}_${baseName}`;
@@ -21408,7 +21699,7 @@ function handleDocsToolCall(name, args2) {
 }
 function loadDocsMap() {
   const mapPath = getResolvedPaths().docsMapPath;
-  if (!existsSync33(mapPath)) {
+  if (!existsSync34(mapPath)) {
     throw new Error(`docs-map.json not found at ${mapPath}`);
   }
   return JSON.parse(readFileSync34(mapPath, "utf-8"));
@@ -21482,9 +21773,9 @@ function extractFrontmatter(content) {
 function extractProcedureNames(routerPath) {
   const root = getProjectRoot();
   const absPath = ensureWithinRoot(resolve30(getResolvedPaths().srcDir, "..", routerPath), root);
-  if (!existsSync33(absPath)) {
+  if (!existsSync34(absPath)) {
     const altPath = ensureWithinRoot(resolve30(getResolvedPaths().srcDir, "../server/api/routers", basename6(routerPath)), root);
-    if (!existsSync33(altPath)) return [];
+    if (!existsSync34(altPath)) return [];
     return extractProcedureNamesFromContent(readFileSync34(altPath, "utf-8"));
   }
   return extractProcedureNamesFromContent(readFileSync34(absPath, "utf-8"));
@@ -21528,7 +21819,7 @@ function handleDocsAudit(args2) {
     const mapping = docsMap.mappings.find((m3) => m3.id === mappingId);
     if (!mapping) continue;
     const helpPagePath = ensureWithinRoot(resolve30(getResolvedPaths().helpSitePath, mapping.helpPage), getProjectRoot());
-    if (!existsSync33(helpPagePath)) {
+    if (!existsSync34(helpPagePath)) {
       results.push({
         helpPage: mapping.helpPage,
         mappingId,
@@ -21581,7 +21872,7 @@ function handleDocsAudit(args2) {
     for (const [guideName, parentId] of Object.entries(docsMap.userGuideInheritance.examples)) {
       if (parentId === mappingId) {
         const guidePath = ensureWithinRoot(resolve30(getResolvedPaths().helpSitePath, `pages/user-guides/${guideName}/index.mdx`), getProjectRoot());
-        if (existsSync33(guidePath)) {
+        if (existsSync34(guidePath)) {
           const guideContent = readFileSync34(guidePath, "utf-8");
           const guideFrontmatter = extractFrontmatter(guideContent);
           if (!guideFrontmatter?.lastVerified || status === "STALE") {
@@ -21616,7 +21907,7 @@ function handleDocsCoverage(args2) {
   const mappings = filterDomain ? docsMap.mappings.filter((m3) => m3.id === filterDomain) : docsMap.mappings;
   for (const mapping of mappings) {
     const helpPagePath = ensureWithinRoot(resolve30(getResolvedPaths().helpSitePath, mapping.helpPage), getProjectRoot());
-    const exists = existsSync33(helpPagePath);
+    const exists = existsSync34(helpPagePath);
     let hasContent = false;
     let lineCount = 0;
     let lastVerified = null;
@@ -21963,7 +22254,7 @@ var init_observability_tools = __esm({
 });
 
 // src/sentinel-db.ts
-import { existsSync as existsSync34 } from "fs";
+import { existsSync as existsSync35 } from "fs";
 import { resolve as resolve31 } from "path";
 function parsePortalScope(raw) {
   if (!raw) return [];
@@ -22109,7 +22400,7 @@ function getFeatureImpact(db, filePaths) {
   const affectedFeatureIds = /* @__PURE__ */ new Set();
   for (const filePath of filePaths) {
     const links = db.prepare(
-      `SELECT feature_id FROM ${t("sentinel_components")} WHERE component_file = ?`
+      `SELECT feature_id FROM ${t("sentinel_components")} WHERE component_file = ? LIMIT 10000`
     ).all(filePath);
     for (const link of links) {
       affectedFeatureIds.add(link.feature_id);
@@ -22122,7 +22413,7 @@ function getFeatureImpact(db, filePaths) {
     const feature = getFeatureById(db, featureId);
     if (!feature || feature.status !== "active") continue;
     const allComponents = db.prepare(
-      `SELECT component_file, is_primary FROM ${t("sentinel_components")} WHERE feature_id = ?`
+      `SELECT component_file, is_primary FROM ${t("sentinel_components")} WHERE feature_id = ? LIMIT 10000`
     ).all(featureId);
     const affected = allComponents.filter((c2) => fileSet.has(c2.component_file));
     const remaining = allComponents.filter((c2) => !fileSet.has(c2.component_file));
@@ -22201,22 +22492,22 @@ function validateFeatures(db, domainFilter) {
     const missingPages = [];
     for (const comp of components) {
       const absPath = resolve31(PROJECT_ROOT, comp.component_file);
-      if (!existsSync34(absPath)) {
+      if (!existsSync35(absPath)) {
         missingComponents.push(comp.component_file);
       }
     }
     for (const proc of procedures) {
       const routerPath = resolve31(PROJECT_ROOT, `src/server/api/routers/${proc.router_name}.ts`);
-      if (!existsSync34(routerPath)) {
+      if (!existsSync35(routerPath)) {
         missingProcedures.push({ router: proc.router_name, procedure: proc.procedure_name });
       }
     }
     for (const page of pages) {
       const routeToPath = page.page_route.replace(/^\/(portal-[^/]+\/)?/, "src/app/").replace(/\/$/, "") + "/page.tsx";
       const absPath = resolve31(PROJECT_ROOT, routeToPath);
-      if (page.page_route.startsWith("/") && !existsSync34(absPath)) {
+      if (page.page_route.startsWith("/") && !existsSync35(absPath)) {
         const altPath = resolve31(PROJECT_ROOT, `src/app${page.page_route}/page.tsx`);
-        if (!existsSync34(altPath)) {
+        if (!existsSync35(altPath)) {
           missingPages.push(page.page_route);
         }
       }
@@ -22742,8 +23033,8 @@ var init_sentinel_tools = __esm({
 });
 
 // src/sentinel-scanner.ts
-import { readFileSync as readFileSync35, existsSync as existsSync35, readdirSync as readdirSync23, statSync as statSync13 } from "fs";
-import { resolve as resolve32, join as join21, basename as basename7, dirname as dirname16, relative as relative11 } from "path";
+import { readFileSync as readFileSync35, existsSync as existsSync36, readdirSync as readdirSync23, statSync as statSync13 } from "fs";
+import { resolve as resolve32, join as join21, basename as basename7, dirname as dirname17, relative as relative11 } from "path";
 function inferDomain(filePath) {
   const domains = getConfig().domains;
   const path = filePath.toLowerCase();
@@ -22796,6 +23087,7 @@ function scanTrpcProcedures(dataDb) {
     SELECT router_name, procedure_name, procedure_type, router_file
     FROM ${t("trpc_procedures")}
     ORDER BY router_name, procedure_name
+    LIMIT 100000
   `).all();
   for (const proc of procedures) {
     const subdomain = inferSubdomain(proc.router_name, proc.procedure_name);
@@ -22838,6 +23130,7 @@ function scanPageRoutes(dataDb) {
     SELECT page_file, route, portal, components, hooks, routers
     FROM ${t("page_deps")}
     ORDER BY route
+    LIMIT 100000
   `).all();
   for (const page of pages) {
     const domain = inferDomain(page.route);
@@ -22873,7 +23166,7 @@ function scanComponentExports(dataDb) {
   const componentsBase = config.paths.components ?? config.paths.source + "/components";
   const componentDirs = [];
   const basePath = resolve32(projectRoot, componentsBase);
-  if (existsSync35(basePath)) {
+  if (existsSync36(basePath)) {
     try {
       const entries = readdirSync23(basePath, { withFileTypes: true });
       for (const entry of entries) {
@@ -22886,7 +23179,7 @@ function scanComponentExports(dataDb) {
   }
   for (const dir of componentDirs) {
     const absDir = resolve32(projectRoot, dir);
-    if (!existsSync35(absDir)) continue;
+    if (!existsSync36(absDir)) continue;
     const files = walkDir2(absDir).filter((f2) => f2.endsWith(".tsx") || f2.endsWith(".ts"));
     for (const file of files) {
       const relPath = relative11(projectRoot, file);
@@ -22916,7 +23209,7 @@ function scanComponentExports(dataDb) {
       if (hasHandlers && exportMatch) {
         const componentName = exportMatch[1];
         const domain = inferDomain(relPath);
-        const subdomain = basename7(dirname16(relPath));
+        const subdomain = basename7(dirname17(relPath));
         const featureKey = `component.${subdomain}.${componentName.replace(/([A-Z])/g, "-$1").toLowerCase().replace(/^-/, "")}`;
         if (!annotations.some((a2) => a2.featureKey === featureKey)) {
           features.push({
@@ -23025,7 +23318,7 @@ function calculateQualityScore(db, sessionId) {
   const weights = getWeights();
   const categories = getCategories();
   const observations = db.prepare(
-    "SELECT type, detail FROM observations WHERE session_id = ?"
+    "SELECT type, detail FROM observations WHERE session_id = ? LIMIT 10000"
   ).all(sessionId);
   let score = 50;
   const breakdown = Object.fromEntries(
@@ -23067,6 +23360,7 @@ function backfillQualityScores(db) {
     FROM sessions s
     LEFT JOIN session_quality_scores q ON s.session_id = q.session_id
     WHERE q.session_id IS NULL
+    LIMIT 100000
   `).all();
   let backfilled = 0;
   for (const session of sessions) {
@@ -23165,6 +23459,7 @@ function handleQualityTrend(args2, db, retried = false) {
     FROM session_quality_scores
     WHERE created_at >= datetime('now', ?)
     ORDER BY created_at ASC
+    LIMIT 100000
   `).all(`-${days} days`);
   if (scores.length === 0) {
     if (!retried) {
@@ -23200,6 +23495,7 @@ function handleQualityReport(args2, db, retried = false) {
     SELECT score, security_score, architecture_score, coupling_score, test_score, rule_compliance_score
     FROM session_quality_scores
     WHERE created_at >= datetime('now', ?)
+    LIMIT 10000
   `).all(`-${days} days`);
   if (scores.length === 0) {
     if (!retried) {
@@ -23686,7 +23982,7 @@ function queryAuditLog(db, options) {
 }
 function getFileChain(db, filePath) {
   return db.prepare(
-    "SELECT * FROM audit_log WHERE file_path = ? ORDER BY timestamp ASC"
+    "SELECT * FROM audit_log WHERE file_path = ? ORDER BY timestamp ASC LIMIT 10000"
   ).all(filePath);
 }
 function getAuditToolDefinitions() {
@@ -23930,7 +24226,7 @@ var init_audit_trail = __esm({
 });
 
 // src/validation-engine.ts
-import { existsSync as existsSync36, readFileSync as readFileSync36 } from "fs";
+import { existsSync as existsSync37, readFileSync as readFileSync36 } from "fs";
 function p10(baseName) {
   return `${getConfig().toolPrefix}_${baseName}`;
 }
@@ -23961,7 +24257,7 @@ function validateFile(filePath, projectRoot) {
     });
     return checks;
   }
-  if (!existsSync36(absPath)) {
+  if (!existsSync37(absPath)) {
     checks.push({
       name: "file_exists",
       severity: "error",
@@ -24166,6 +24462,7 @@ function handleValidationReport(args2, db) {
     FROM validation_results
     WHERE created_at >= datetime('now', ?)
     ORDER BY created_at DESC
+    LIMIT 100000
   `).all(`-${days} days`);
   if (results.length === 0) {
     return text9(`No validation results found in the last ${days} days. Run ${p10("validation_check")} { file: "src/path/to/file.ts" } on specific files to generate validation data, or try a longer time range with { days: 90 }.`);
@@ -24415,7 +24712,7 @@ var init_adr_generator = __esm({
 });
 
 // src/security-scorer.ts
-import { existsSync as existsSync37, readFileSync as readFileSync37 } from "fs";
+import { existsSync as existsSync38, readFileSync as readFileSync37 } from "fs";
 function p12(baseName) {
   return `${getConfig().toolPrefix}_${baseName}`;
 }
@@ -24439,7 +24736,7 @@ function scoreFileSecurity(filePath, projectRoot) {
       }]
     };
   }
-  if (!existsSync37(absPath)) {
+  if (!existsSync38(absPath)) {
     return { riskScore: 0, findings: [] };
   }
   let source;
@@ -24576,6 +24873,7 @@ function handleSecurityScore(args2, db) {
       SELECT file_path, risk_score, findings FROM security_scores
       WHERE session_id = ?
       ORDER BY risk_score DESC
+      LIMIT 10000
     `).all(sessionId);
     if (scores.length === 0) {
       return text11(`No security scores for session ${sessionId.slice(0, 8)}... Security scores are generated when files are scanned. Try: ${p12("security_score")} { file_path: "src/server/api/routers/example.ts" } to scan a file, or ${p12("security_heatmap")} {} to see all scanned files.`);
@@ -24733,7 +25031,7 @@ var init_security_scorer = __esm({
 });
 
 // src/dependency-scorer.ts
-import { existsSync as existsSync38, readFileSync as readFileSync38 } from "fs";
+import { existsSync as existsSync39, readFileSync as readFileSync38 } from "fs";
 import { resolve as resolve33 } from "path";
 function p13(baseName) {
   return `${getConfig().toolPrefix}_${baseName}`;
@@ -24767,7 +25065,7 @@ function calculateDepRisk(factors) {
 }
 function getInstalledPackages(projectRoot) {
   const pkgPath = resolve33(projectRoot, "package.json");
-  if (!existsSync38(pkgPath)) return /* @__PURE__ */ new Map();
+  if (!existsSync39(pkgPath)) return /* @__PURE__ */ new Map();
   try {
     const pkg = JSON.parse(readFileSync38(pkgPath, "utf-8"));
     const packages = /* @__PURE__ */ new Map();
@@ -24993,6 +25291,7 @@ function detectConflicts(db, daysBack = 7) {
       AND so1.created_at >= datetime('now', ?)
       AND so2.created_at >= datetime('now', ?)
     GROUP BY so1.file_path, so1.developer_id, so2.developer_id
+    LIMIT 10000
   `).all(`-${daysBack} days`, `-${daysBack} days`);
   return conflicts.map((c2) => ({
     filePath: c2.file_path,
@@ -25142,6 +25441,7 @@ function handleTeamExpertise(args2, db) {
     FROM developer_expertise
     WHERE module = ?
     ORDER BY expertise_score DESC
+    LIMIT 10000
   `).all(targetModule);
   if (experts.length === 0) {
     return text13(`No expertise data for module "${targetModule}". Expertise builds as developers work on files in this module across sessions. Try: ${p14("team_expertise")} {} to see all modules with tracked expertise.`);
@@ -25319,6 +25619,7 @@ function handleRegressionCheck(_args, db) {
     FROM feature_health
     WHERE modifications_since_test > 0
     ORDER BY modifications_since_test DESC
+    LIMIT 10000
   `).all();
   if (recentlyModified.length === 0) {
     return text14(`No features have been modified since their last test run. Low regression risk. Use ${p15("feature_health")} {} to see the full feature health dashboard.`);
@@ -25372,7 +25673,7 @@ var init_regression_detector = __esm({
 
 // src/knowledge-indexer.ts
 import { createHash as createHash9 } from "crypto";
-import { readFileSync as readFileSync39, readdirSync as readdirSync24, statSync as statSync14, existsSync as existsSync39 } from "fs";
+import { readFileSync as readFileSync39, readdirSync as readdirSync24, statSync as statSync14, existsSync as existsSync40 } from "fs";
 import { resolve as resolve34, relative as relative12, basename as basename8, extname as extname2 } from "path";
 function getKnowledgePaths() {
   const resolved = getResolvedPaths();
@@ -25680,11 +25981,11 @@ function indexAllKnowledge(db) {
     files.push(...memFiles);
   } catch {
   }
-  if (existsSync39(paths.plansDir)) {
+  if (existsSync40(paths.plansDir)) {
     const planFiles = discoverMarkdownFiles(paths.plansDir);
     files.push(...planFiles);
   }
-  if (existsSync39(paths.docsDir)) {
+  if (existsSync40(paths.docsDir)) {
     const excludePatterns = getConfig().conventions?.excludePatterns ?? ["/ARCHIVE/", "/SESSION-HISTORY/"];
     const docsFiles = discoverMarkdownFiles(paths.docsDir).filter((f2) => !f2.includes("/plans/") && !excludePatterns.some((p19) => f2.includes(p19)));
     files.push(...docsFiles);
@@ -25727,7 +26028,7 @@ function indexAllKnowledge(db) {
     } catch {
     }
     for (const filePath of files) {
-      if (!existsSync39(filePath)) continue;
+      if (!existsSync40(filePath)) continue;
       const content = readFileSync39(filePath, "utf-8");
       const hash = hashContent2(content);
       const relPath = filePath.startsWith(paths.claudeDir) ? relative12(paths.claudeDir, filePath) : filePath.startsWith(paths.plansDir) ? "plans/" + relative12(paths.plansDir, filePath) : filePath.startsWith(paths.docsDir) ? "docs/" + relative12(paths.docsDir, filePath) : filePath.startsWith(paths.memoryDir) ? `memory/${relative12(paths.memoryDir, filePath)}` : basename8(filePath);
@@ -25826,6 +26127,21 @@ Rule: ${c2.rule}`,
         }
       }
     }
+    const customerRules = getConfig().governance_rules ?? [];
+    const insertCustomerRule = db.prepare(
+      `INSERT OR REPLACE INTO knowledge_rules (rule_id, rule_text, vr_type, reference_path, severity, source)
+       VALUES (?, ?, ?, ?, ?, 'customer-config')`
+    );
+    for (const rule of customerRules) {
+      const namespacedId = rule.id.startsWith("customer:") ? rule.id : `customer:${rule.id}`;
+      insertCustomerRule.run(
+        namespacedId,
+        `${rule.title}: ${rule.description}`,
+        rule.vr_type ?? "VR-CUSTOM",
+        rule.reference_path ?? null,
+        rule.severity?.toUpperCase() ?? "MEDIUM"
+      );
+    }
     stats.edgesCreated = buildCrossReferences(db);
     const finalNow = /* @__PURE__ */ new Date();
     const finalIso = finalNow.toISOString();
@@ -25848,10 +26164,10 @@ function isKnowledgeStale(db) {
     files.push(...discoverMarkdownFiles(paths.memoryDir));
   } catch {
   }
-  if (existsSync39(paths.plansDir)) {
+  if (existsSync40(paths.plansDir)) {
     files.push(...discoverMarkdownFiles(paths.plansDir));
   }
-  if (existsSync39(paths.docsDir)) {
+  if (existsSync40(paths.docsDir)) {
     const excludePatterns = getConfig().conventions?.excludePatterns ?? ["/ARCHIVE/", "/SESSION-HISTORY/"];
     const docsFiles = discoverMarkdownFiles(paths.docsDir).filter((f2) => !f2.includes("/plans/") && !excludePatterns.some((p19) => f2.includes(p19)));
     files.push(...docsFiles);
@@ -26211,7 +26527,7 @@ function handleRule(db, args2) {
     }
     if (withIncidents) {
       const edges = db.prepare(
-        "SELECT source_id FROM knowledge_edges WHERE target_type = 'cr' AND target_id = ? AND source_type = 'incident'"
+        "SELECT source_id FROM knowledge_edges WHERE target_type = 'cr' AND target_id = ? AND source_type = 'incident' LIMIT 5000"
       ).all(ruleId);
       if (edges.length > 0) {
         lines.push("### Related Incidents");
@@ -26228,7 +26544,7 @@ function handleRule(db, args2) {
     }
   } else if (keyword) {
     const rules = db.prepare(
-      "SELECT * FROM knowledge_rules WHERE rule_text LIKE ? OR rule_id LIKE ? ORDER BY rule_id"
+      "SELECT * FROM knowledge_rules WHERE rule_text LIKE ? OR rule_id LIKE ? ORDER BY rule_id LIMIT 1000"
     ).all(`%${keyword}%`, `%${keyword}%`);
     lines.push(`## Rules matching "${keyword}" (${rules.length} found)`);
     lines.push("");
@@ -26268,7 +26584,7 @@ function handleIncident(db, args2) {
     if (incident.user_quote) lines.push(`| **User Quote** | ${incident.user_quote.replace(/\|/g, "\\|")} |`);
     lines.push("");
     const edges = db.prepare(
-      "SELECT target_id FROM knowledge_edges WHERE source_type = 'incident' AND source_id = ? AND target_type = 'cr'"
+      "SELECT target_id FROM knowledge_edges WHERE source_type = 'incident' AND source_id = ? AND target_type = 'cr' LIMIT 5000"
     ).all(String(incidentNum));
     if (edges.length > 0) {
       lines.push("### Linked Rules");
@@ -26313,7 +26629,7 @@ function handleSchemaCheck(db, args2) {
   const lines = [];
   if (table) {
     const mismatches = db.prepare(
-      "SELECT * FROM knowledge_schema_mismatches WHERE table_name = ?"
+      "SELECT * FROM knowledge_schema_mismatches WHERE table_name = ? LIMIT 1000"
     ).all(table);
     if (mismatches.length > 0) {
       lines.push(`## Schema Mismatches for \`${table}\``);
@@ -26331,7 +26647,7 @@ function handleSchemaCheck(db, args2) {
   }
   if (column) {
     const mismatches = db.prepare(
-      "SELECT * FROM knowledge_schema_mismatches WHERE wrong_column = ?"
+      "SELECT * FROM knowledge_schema_mismatches WHERE wrong_column = ? LIMIT 1000"
     ).all(column);
     if (mismatches.length > 0) {
       if (lines.length > 0) lines.push("");
@@ -26370,7 +26686,7 @@ function handlePattern(db, args2) {
     `patterns-quickref`
   ];
   const docs = db.prepare(
-    "SELECT id, file_path, title FROM knowledge_documents WHERE category = 'patterns' OR category = 'reference' OR category = 'root'"
+    "SELECT id, file_path, title FROM knowledge_documents WHERE category = 'patterns' OR category = 'reference' OR category = 'root' LIMIT 1000"
   ).all();
   const relevantDocs = docs.filter(
     (d2) => domainPatterns.some((pat) => d2.file_path.toLowerCase().includes(pat.toLowerCase()))
@@ -26415,7 +26731,7 @@ function handlePattern(db, args2) {
   if (!topic && relevantDocs.length > 0) {
     for (const doc of relevantDocs.slice(0, 2)) {
       const chunks = db.prepare(
-        "SELECT heading, content, chunk_type FROM knowledge_chunks WHERE document_id = ? AND chunk_type = 'section' ORDER BY line_start"
+        "SELECT heading, content, chunk_type FROM knowledge_chunks WHERE document_id = ? AND chunk_type = 'section' ORDER BY line_start LIMIT 5000"
       ).all(doc.id);
       lines.push(`### From: ${claudeDir}/${doc.file_path}`);
       lines.push("");
@@ -26471,7 +26787,7 @@ function handleVerification(db, args2) {
     if (vr.category) lines.push(`| **Category** | ${vr.category} |`);
   } else if (situation) {
     const results = db.prepare(
-      "SELECT * FROM knowledge_verifications WHERE use_when LIKE ? OR vr_type LIKE ? OR catches LIKE ? ORDER BY vr_type"
+      "SELECT * FROM knowledge_verifications WHERE use_when LIKE ? OR vr_type LIKE ? OR catches LIKE ? ORDER BY vr_type LIMIT 1000"
     ).all(`%${situation}%`, `%${situation}%`, `%${situation}%`);
     lines.push(`## Verifications for "${situation}" (${results.length} found)`);
     lines.push("");
@@ -26509,10 +26825,10 @@ function handleGraph(db, args2) {
     lines.push("");
     for (const entity of currentLevel) {
       const outgoing = db.prepare(
-        "SELECT target_type, target_id, edge_type FROM knowledge_edges WHERE source_type = ? AND source_id = ?"
+        "SELECT target_type, target_id, edge_type FROM knowledge_edges WHERE source_type = ? AND source_id = ? LIMIT 5000"
       ).all(entity.type, entity.id);
       const incoming = db.prepare(
-        "SELECT source_type, source_id, edge_type FROM knowledge_edges WHERE target_type = ? AND target_id = ?"
+        "SELECT source_type, source_id, edge_type FROM knowledge_edges WHERE target_type = ? AND target_id = ? LIMIT 5000"
       ).all(entity.type, entity.id);
       for (const edge of outgoing) {
         const key = `${edge.target_type}:${edge.target_id}`;
@@ -26587,6 +26903,7 @@ function handleCommand(db, args2) {
       JOIN knowledge_documents kd ON kd.id = kc.document_id
       WHERE kc.chunk_type = 'command' AND (kc.content LIKE ? OR kc.heading LIKE ?)
       ORDER BY kc.heading
+      LIMIT 1000
     `).all(`%${keyword}%`, `%${keyword}%`);
     lines.push(`## Commands matching "${keyword}" (${results.length} found)`);
     lines.push("");
@@ -26601,6 +26918,7 @@ function handleCommand(db, args2) {
       JOIN knowledge_documents kd ON kd.id = kc.document_id
       WHERE kc.chunk_type = 'command'
       ORDER BY kc.heading
+      LIMIT 1000
     `).all();
     lines.push(`## All Commands (${commands.length} total)`);
     lines.push("");
@@ -26717,7 +27035,7 @@ function handlePlan(db, args2) {
     if (doc.description) lines.push(`**Description**: ${doc.description}`);
     lines.push("");
     const items = db.prepare(
-      "SELECT heading, content FROM knowledge_chunks WHERE document_id = ? AND metadata LIKE '%plan_item_id%' ORDER BY heading"
+      "SELECT heading, content FROM knowledge_chunks WHERE document_id = ? AND metadata LIKE '%plan_item_id%' ORDER BY heading LIMIT 5000"
     ).all(doc.id);
     if (items.length > 0) {
       lines.push(`### Plan Items (${items.length})`);
@@ -26743,7 +27061,7 @@ function handlePlan(db, args2) {
     }
   } else if (status) {
     const docs = db.prepare(
-      "SELECT kd.file_path, kd.title, kc.content FROM knowledge_chunks kc JOIN knowledge_documents kd ON kd.id = kc.document_id WHERE kd.category = 'plan' AND kc.heading = 'IMPLEMENTATION STATUS' AND kc.content LIKE ? ORDER BY kd.file_path DESC"
+      "SELECT kd.file_path, kd.title, kc.content FROM knowledge_chunks kc JOIN knowledge_documents kd ON kd.id = kc.document_id WHERE kd.category = 'plan' AND kc.heading = 'IMPLEMENTATION STATUS' AND kc.content LIKE ? ORDER BY kd.file_path DESC LIMIT 1000"
     ).all(`%${status}%`);
     lines.push(`## Plans with status "${status}" (${docs.length} found)`);
     lines.push("");
@@ -26829,7 +27147,7 @@ function handleGaps(db, args2) {
     }
   } else if (checkType === "patterns") {
     const patternDocs = db.prepare(
-      "SELECT file_path, title FROM knowledge_documents WHERE category = 'patterns'"
+      "SELECT file_path, title FROM knowledge_documents WHERE category = 'patterns' LIMIT 10000"
     ).all();
     const documentedDomains = new Set(patternDocs.map((d2) => d2.title.replace("-patterns", "").replace(" Patterns", "").toLowerCase()));
     lines.push("### Pattern Coverage");
@@ -26839,7 +27157,7 @@ function handleGaps(db, args2) {
     try {
       dataDb = getDataDb();
       const domains = dataDb.prepare(
-        `SELECT DISTINCT domain FROM ${t("sentinel")} WHERE status = 'active' ORDER BY domain`
+        `SELECT DISTINCT domain FROM ${t("sentinel")} WHERE status = 'active' ORDER BY domain LIMIT 10000`
       ).all();
       for (const d2 of domains) {
         const hasPattern = documentedDomains.has(d2.domain.toLowerCase());
@@ -26968,176 +27286,6 @@ var init_knowledge_tools = __esm({
   }
 });
 
-// src/knowledge-db.ts
-import Database3 from "better-sqlite3";
-import { dirname as dirname17 } from "path";
-import { existsSync as existsSync41, mkdirSync as mkdirSync11 } from "fs";
-function getKnowledgeDb() {
-  const dbPath = getResolvedPaths().knowledgeDbPath;
-  const dir = dirname17(dbPath);
-  if (!existsSync41(dir)) {
-    mkdirSync11(dir, { recursive: true });
-  }
-  const db = new Database3(dbPath);
-  db.pragma("journal_mode = WAL");
-  db.pragma("foreign_keys = ON");
-  initKnowledgeSchema(db);
-  return db;
-}
-function initKnowledgeSchema(db) {
-  db.exec(`
-    -- Core document chunks (parsed from .claude/**/*.md)
-    CREATE TABLE IF NOT EXISTS knowledge_documents (
-      id INTEGER PRIMARY KEY AUTOINCREMENT,
-      file_path TEXT NOT NULL,
-      category TEXT NOT NULL,
-      title TEXT NOT NULL,
-      description TEXT,
-      content_hash TEXT NOT NULL,
-      indexed_at TEXT NOT NULL,
-      indexed_at_epoch INTEGER NOT NULL
-    );
-
-    CREATE UNIQUE INDEX IF NOT EXISTS idx_kd_filepath ON knowledge_documents(file_path);
-    CREATE INDEX IF NOT EXISTS idx_kd_category ON knowledge_documents(category);
-
-    -- Structured chunks within documents
-    CREATE TABLE IF NOT EXISTS knowledge_chunks (
-      id INTEGER PRIMARY KEY AUTOINCREMENT,
-      document_id INTEGER NOT NULL REFERENCES knowledge_documents(id) ON DELETE CASCADE,
-      chunk_type TEXT NOT NULL CHECK(chunk_type IN (
-        'section', 'table_row', 'code_block', 'rule', 'incident', 'pattern', 'command', 'mismatch'
-      )),
-      heading TEXT,
-      content TEXT NOT NULL,
-      line_start INTEGER,
-      line_end INTEGER,
-      metadata TEXT DEFAULT '{}'
-    );
-
-    CREATE INDEX IF NOT EXISTS idx_kc_doc ON knowledge_chunks(document_id);
-    CREATE INDEX IF NOT EXISTS idx_kc_type ON knowledge_chunks(chunk_type);
-    CREATE INDEX IF NOT EXISTS idx_kc_heading ON knowledge_chunks(heading);
-
-    -- Canonical Rules index
-    CREATE TABLE IF NOT EXISTS knowledge_rules (
-      id INTEGER PRIMARY KEY AUTOINCREMENT,
-      rule_id TEXT UNIQUE NOT NULL,
-      rule_text TEXT NOT NULL,
-      vr_type TEXT,
-      reference_path TEXT,
-      severity TEXT DEFAULT 'HIGH',
-      prevention_summary TEXT
-    );
-
-    CREATE INDEX IF NOT EXISTS idx_kr_id ON knowledge_rules(rule_id);
-
-    -- Verification Requirements index
-    CREATE TABLE IF NOT EXISTS knowledge_verifications (
-      id INTEGER PRIMARY KEY AUTOINCREMENT,
-      vr_type TEXT UNIQUE NOT NULL,
-      command TEXT NOT NULL,
-      expected TEXT NOT NULL,
-      use_when TEXT NOT NULL,
-      catches TEXT,
-      category TEXT
-    );
-
-    CREATE INDEX IF NOT EXISTS idx_kv_type ON knowledge_verifications(vr_type);
-    CREATE INDEX IF NOT EXISTS idx_kv_category ON knowledge_verifications(category);
-
-    -- Incident index
-    CREATE TABLE IF NOT EXISTS knowledge_incidents (
-      id INTEGER PRIMARY KEY AUTOINCREMENT,
-      incident_num INTEGER UNIQUE NOT NULL,
-      date TEXT NOT NULL,
-      type TEXT NOT NULL,
-      gap_found TEXT NOT NULL,
-      prevention TEXT NOT NULL,
-      cr_added TEXT,
-      root_cause TEXT,
-      user_quote TEXT
-    );
-
-    CREATE INDEX IF NOT EXISTS idx_ki_num ON knowledge_incidents(incident_num);
-    CREATE INDEX IF NOT EXISTS idx_ki_type ON knowledge_incidents(type);
-    CREATE INDEX IF NOT EXISTS idx_ki_cr ON knowledge_incidents(cr_added);
-
-    -- Schema mismatch quick lookup
-    -- P-H013 (plan-stage-c-high-batch): the source column no longer has a
-    -- SQL DEFAULT. Previously the value was a JS template-literal
-    -- interpolation baked into the customer SQLite at schema creation
-    -- time, so later config changes were ignored. Default is now applied
-    -- at INSERT time via getConfig().conventions.knowledgeSourceFiles[0]
-    -- in knowledge-indexer.ts -- a runtime config lookup that reflects
-    -- the customers current config.
-    CREATE TABLE IF NOT EXISTS knowledge_schema_mismatches (
-      id INTEGER PRIMARY KEY AUTOINCREMENT,
-      table_name TEXT NOT NULL,
-      wrong_column TEXT NOT NULL,
-      correct_column TEXT NOT NULL,
-      source TEXT NOT NULL
-    );
-
-    CREATE INDEX IF NOT EXISTS idx_ksm_table ON knowledge_schema_mismatches(table_name);
-
-    -- Cross-reference graph
-    CREATE TABLE IF NOT EXISTS knowledge_edges (
-      id INTEGER PRIMARY KEY AUTOINCREMENT,
-      source_type TEXT NOT NULL,
-      source_id TEXT NOT NULL,
-      target_type TEXT NOT NULL,
-      target_id TEXT NOT NULL,
-      edge_type TEXT NOT NULL
-    );
-
-    CREATE INDEX IF NOT EXISTS idx_ke_source ON knowledge_edges(source_type, source_id);
-    CREATE INDEX IF NOT EXISTS idx_ke_target ON knowledge_edges(target_type, target_id);
-    CREATE UNIQUE INDEX IF NOT EXISTS idx_ke_unique ON knowledge_edges(source_type, source_id, target_type, target_id, edge_type);
-
-    -- Staleness tracking
-    CREATE TABLE IF NOT EXISTS knowledge_meta (
-      key TEXT PRIMARY KEY,
-      value TEXT NOT NULL
-    );
-  `);
-  try {
-    db.exec(`
-      CREATE VIRTUAL TABLE IF NOT EXISTS knowledge_fts USING fts5(
-        heading, content, chunk_type, file_path
-      );
-
-      CREATE TRIGGER IF NOT EXISTS kc_fts_insert AFTER INSERT ON knowledge_chunks BEGIN
-        INSERT INTO knowledge_fts(rowid, heading, content, chunk_type, file_path)
-        SELECT new.id, new.heading, new.content, new.chunk_type, kd.file_path
-        FROM knowledge_documents kd WHERE kd.id = new.document_id;
-      END;
-
-      CREATE TRIGGER IF NOT EXISTS kc_fts_delete AFTER DELETE ON knowledge_chunks BEGIN
-        INSERT INTO knowledge_fts(knowledge_fts, rowid, heading, content, chunk_type, file_path)
-        SELECT 'delete', old.id, old.heading, old.content, old.chunk_type, kd.file_path
-        FROM knowledge_documents kd WHERE kd.id = old.document_id;
-      END;
-
-      CREATE TRIGGER IF NOT EXISTS kc_fts_update AFTER UPDATE ON knowledge_chunks BEGIN
-        INSERT INTO knowledge_fts(knowledge_fts, rowid, heading, content, chunk_type, file_path)
-        SELECT 'delete', old.id, old.heading, old.content, old.chunk_type, kd.file_path
-        FROM knowledge_documents kd WHERE kd.id = old.document_id;
-        INSERT INTO knowledge_fts(rowid, heading, content, chunk_type, file_path)
-        SELECT new.id, new.heading, new.content, new.chunk_type, kd.file_path
-        FROM knowledge_documents kd WHERE kd.id = new.document_id;
-      END;
-    `);
-  } catch {
-  }
-}
-var init_knowledge_db = __esm({
-  "src/knowledge-db.ts"() {
-    "use strict";
-    init_config();
-  }
-});
-
 // src/python/domain-enforcer.ts
 function classifyPythonFileDomain(file) {
   const config = getConfig();
@@ -27334,7 +27482,7 @@ function handlePyImports(args2, dataDb) {
         if (depth > maxDepth || visited.has(f2)) return;
         visited.add(f2);
         const imports = dataDb.prepare(
-          `SELECT target_file, imported_names FROM ${t("py_imports")} WHERE source_file = ?`
+          `SELECT target_file, imported_names FROM ${t("py_imports")} WHERE source_file = ? LIMIT 10000`
         ).all(f2);
         for (const imp of imports) {
           const indent = "  ".repeat(depth);
@@ -27349,7 +27497,7 @@ function handlePyImports(args2, dataDb) {
       traverse2(file, 0);
     } else {
       const imports = dataDb.prepare(
-        `SELECT target_file, import_type, imported_names, line FROM ${t("py_imports")} WHERE source_file = ? ORDER BY line`
+        `SELECT target_file, import_type, imported_names, line FROM ${t("py_imports")} WHERE source_file = ? ORDER BY line LIMIT 10000`
       ).all(file);
       lines.push(`## Imports from ${file} (${imports.length} edges)`);
       for (const imp of imports) {
@@ -27359,7 +27507,7 @@ function handlePyImports(args2, dataDb) {
     }
   } else if (importedBy) {
     const importers = dataDb.prepare(
-      `SELECT source_file, imported_names, line FROM ${t("py_imports")} WHERE target_file = ? ORDER BY source_file`
+      `SELECT source_file, imported_names, line FROM ${t("py_imports")} WHERE target_file = ? ORDER BY source_file LIMIT 10000`
     ).all(importedBy);
     lines.push(`## Files importing ${importedBy} (${importers.length} edges)`);
     for (const imp of importers) {
@@ -27606,14 +27754,14 @@ function handlePyImpact(args2, dataDb) {
   const file = args2.file;
   const lines = [`## Impact Analysis: ${file}`, ""];
   const importedBy = dataDb.prepare(
-    `SELECT source_file FROM ${t("py_imports")} WHERE target_file = ?`
+    `SELECT source_file FROM ${t("py_imports")} WHERE target_file = ? LIMIT 10000`
   ).all(file);
   lines.push(`### Imported By (${importedBy.length} files)`);
   for (const imp of importedBy.slice(0, 20)) {
     lines.push(`- ${imp.source_file}`);
   }
   const routes = dataDb.prepare(
-    `SELECT method, path, function_name FROM ${t("py_routes")} WHERE file = ?`
+    `SELECT method, path, function_name FROM ${t("py_routes")} WHERE file = ? LIMIT 10000`
   ).all(file);
   if (routes.length > 0) {
     lines.push(`
@@ -27623,7 +27771,7 @@ function handlePyImpact(args2, dataDb) {
     }
   }
   const models = dataDb.prepare(
-    `SELECT class_name, table_name FROM ${t("py_models")} WHERE file = ?`
+    `SELECT class_name, table_name FROM ${t("py_models")} WHERE file = ? LIMIT 10000`
   ).all(file);
   if (models.length > 0) {
     lines.push(`
@@ -27636,7 +27784,7 @@ function handlePyImpact(args2, dataDb) {
   if (routeIds.length > 0) {
     const placeholders = routeIds.map(() => "?").join(",");
     const callers = dataDb.prepare(
-      `SELECT DISTINCT frontend_file FROM ${t("py_route_callers")} WHERE route_id IN (${placeholders})`
+      `SELECT DISTINCT frontend_file FROM ${t("py_route_callers")} WHERE route_id IN (${placeholders}) LIMIT 100000`
     ).all(...routeIds.map((r2) => r2.id));
     if (callers.length > 0) {
       lines.push(`
@@ -27677,14 +27825,14 @@ function handlePyContext(args2, dataDb) {
       lines.push(`- ${imp.source_file}`);
     }
   }
-  const routes = dataDb.prepare(`SELECT method, path, function_name, line FROM ${t("py_routes")} WHERE file = ?`).all(file);
+  const routes = dataDb.prepare(`SELECT method, path, function_name, line FROM ${t("py_routes")} WHERE file = ? LIMIT 10000`).all(file);
   if (routes.length > 0) {
     lines.push("\n### Routes");
     for (const r2 of routes) {
       lines.push(`- ${r2.method} ${r2.path} \u2192 ${r2.function_name} (L${r2.line})`);
     }
   }
-  const models = dataDb.prepare(`SELECT class_name, table_name, line FROM ${t("py_models")} WHERE file = ?`).all(file);
+  const models = dataDb.prepare(`SELECT class_name, table_name, line FROM ${t("py_models")} WHERE file = ? LIMIT 10000`).all(file);
   if (models.length > 0) {
     lines.push("\n### Models");
     for (const m3 of models) {
@@ -27946,29 +28094,37 @@ function assertCodegraphDb(codegraphDb, toolName) {
   }
   return codegraphDb;
 }
-async function handleToolCall(name, args2, dataDb, codegraphDb) {
+async function handleToolCall(name, args2, dataDb, codegraphDb, memoryDbCache, knowledgeDbCache) {
   const userTier = await getCurrentTier();
   const requiredTier = getToolTier(name);
   if (!isToolAllowed(name, userTier)) {
     return text17(`This tool requires ${requiredTier} tier. Current tier: ${userTier}. Upgrade at https://massu.ai/pricing`);
   }
   const pfx = prefix2();
+  async function withMemDb(fn) {
+    if (memoryDbCache) return fn(memoryDbCache);
+    const db = getMemoryDb();
+    try {
+      return await fn(db);
+    } finally {
+      db.close();
+    }
+  }
+  async function withKnowledgeDb(fn) {
+    if (knowledgeDbCache) return fn(knowledgeDbCache);
+    const db = getKnowledgeDb();
+    try {
+      return await fn(db);
+    } finally {
+      db.close();
+    }
+  }
   try {
     if (name.startsWith(pfx + "_memory_")) {
-      const memDb = getMemoryDb();
-      try {
-        return handleMemoryToolCall(name, args2, memDb);
-      } finally {
-        memDb.close();
-      }
+      return withMemDb((memDb) => handleMemoryToolCall(name, args2, memDb));
     }
     if (isObservabilityTool(name)) {
-      const memDb = getMemoryDb();
-      try {
-        return handleObservabilityToolCall(name, args2, memDb);
-      } finally {
-        memDb.close();
-      }
+      return withMemDb((memDb) => handleObservabilityToolCall(name, args2, memDb));
     }
     if (name.startsWith(pfx + "_docs_")) {
       return handleDocsToolCall(name, args2);
@@ -27977,92 +28133,37 @@ async function handleToolCall(name, args2, dataDb, codegraphDb) {
       return handleSentinelToolCall(name, args2, assertDataDb(dataDb, name));
     }
     if (isAnalyticsTool(name)) {
-      const memDb = getMemoryDb();
-      try {
-        return handleAnalyticsToolCall(name, args2, memDb);
-      } finally {
-        memDb.close();
-      }
+      return withMemDb((memDb) => handleAnalyticsToolCall(name, args2, memDb));
     }
     if (isCostTool(name)) {
-      const memDb = getMemoryDb();
-      try {
-        return handleCostToolCall(name, args2, memDb);
-      } finally {
-        memDb.close();
-      }
+      return withMemDb((memDb) => handleCostToolCall(name, args2, memDb));
     }
     if (isPromptTool(name)) {
-      const memDb = getMemoryDb();
-      try {
-        return handlePromptToolCall(name, args2, memDb);
-      } finally {
-        memDb.close();
-      }
+      return withMemDb((memDb) => handlePromptToolCall(name, args2, memDb));
     }
     if (isAuditTool(name)) {
-      const memDb = getMemoryDb();
-      try {
-        return handleAuditToolCall(name, args2, memDb);
-      } finally {
-        memDb.close();
-      }
+      return withMemDb((memDb) => handleAuditToolCall(name, args2, memDb));
     }
     if (isValidationTool(name)) {
-      const memDb = getMemoryDb();
-      try {
-        return handleValidationToolCall(name, args2, memDb);
-      } finally {
-        memDb.close();
-      }
+      return withMemDb((memDb) => handleValidationToolCall(name, args2, memDb));
     }
     if (isAdrTool(name)) {
-      const memDb = getMemoryDb();
-      try {
-        return handleAdrToolCall(name, args2, memDb);
-      } finally {
-        memDb.close();
-      }
+      return withMemDb((memDb) => handleAdrToolCall(name, args2, memDb));
     }
     if (isSecurityTool(name)) {
-      const memDb = getMemoryDb();
-      try {
-        return handleSecurityToolCall(name, args2, memDb);
-      } finally {
-        memDb.close();
-      }
+      return withMemDb((memDb) => handleSecurityToolCall(name, args2, memDb));
     }
     if (isDependencyTool(name)) {
-      const memDb = getMemoryDb();
-      try {
-        return handleDependencyToolCall(name, args2, memDb);
-      } finally {
-        memDb.close();
-      }
+      return withMemDb((memDb) => handleDependencyToolCall(name, args2, memDb));
     }
     if (isTeamTool(name) && isCloudFeatureAvailable()) {
-      const memDb = getMemoryDb();
-      try {
-        return handleTeamToolCall(name, args2, memDb);
-      } finally {
-        memDb.close();
-      }
+      return withMemDb((memDb) => handleTeamToolCall(name, args2, memDb));
     }
     if (isRegressionTool(name)) {
-      const memDb = getMemoryDb();
-      try {
-        return handleRegressionToolCall(name, args2, memDb);
-      } finally {
-        memDb.close();
-      }
+      return withMemDb((memDb) => handleRegressionToolCall(name, args2, memDb));
     }
     if (isKnowledgeTool(name)) {
-      const knowledgeDb = getKnowledgeDb();
-      try {
-        return handleKnowledgeToolCall(name, args2, knowledgeDb);
-      } finally {
-        knowledgeDb.close();
-      }
+      return withKnowledgeDb((kdb) => handleKnowledgeToolCall(name, args2, kdb));
     }
     if (isPythonTool(name)) {
       const pyDataDb = assertDataDb(dataDb, name);
@@ -28070,12 +28171,7 @@ async function handleToolCall(name, args2, dataDb, codegraphDb) {
       return handlePythonToolCall(name, args2, pyDataDb);
     }
     if (isLicenseTool(name)) {
-      const memDb = getMemoryDb();
-      try {
-        return await handleLicenseToolCall(name, args2, memDb);
-      } finally {
-        memDb.close();
-      }
+      return withMemDb((memDb) => handleLicenseToolCall(name, args2, memDb));
     }
     const baseName = stripPrefix3(name);
     switch (baseName) {
@@ -28143,7 +28239,7 @@ Feature scan failed: ${error instanceof Error ? error.message : String(error)}`)
 function handleContext(file, dataDb, codegraphDb) {
   const lines = [];
   const nodes = codegraphDb.prepare(
-    "SELECT name, kind, start_line, end_line FROM nodes WHERE file_path = ? ORDER BY start_line"
+    "SELECT name, kind, start_line, end_line FROM nodes WHERE file_path = ? ORDER BY start_line LIMIT 10000"
   ).all(file);
   if (nodes.length > 0) {
     lines.push("## CodeGraph Nodes");
@@ -28260,7 +28356,7 @@ function handleContext(file, dataDb, codegraphDb) {
         if (relevantCRs.length > 0) {
           const placeholders = relevantCRs.map(() => "?").join(",");
           const crRules = knowledgeDb.prepare(
-            `SELECT rule_id, rule_text, vr_type FROM knowledge_rules WHERE rule_id IN (${placeholders})`
+            `SELECT rule_id, rule_text, vr_type FROM knowledge_rules WHERE rule_id IN (${placeholders}) LIMIT 10000`
           ).all(...relevantCRs);
           if (crRules.length > 0) {
             lines.push("## Relevant Canonical Rules");
@@ -28357,7 +28453,7 @@ function handleTrpcMap(args2, dataDb) {
   const lines = [];
   if (args2.uncoupled) {
     const uncoupled = dataDb.prepare(
-      `SELECT router_name, procedure_name, procedure_type, router_file FROM ${t("trpc_procedures")} WHERE has_ui_caller = 0 ORDER BY router_name, procedure_name`
+      `SELECT router_name, procedure_name, procedure_type, router_file FROM ${t("trpc_procedures")} WHERE has_ui_caller = 0 ORDER BY router_name, procedure_name LIMIT 10000`
     ).all();
     lines.push(`## Uncoupled Procedures (${uncoupled.length} total)`);
     lines.push("These procedures have ZERO UI callers.");
@@ -28372,7 +28468,7 @@ function handleTrpcMap(args2, dataDb) {
     }
   } else if (args2.router) {
     const procs = dataDb.prepare(
-      `SELECT id, procedure_name, procedure_type, has_ui_caller FROM ${t("trpc_procedures")} WHERE router_name = ? ORDER BY procedure_name`
+      `SELECT id, procedure_name, procedure_type, has_ui_caller FROM ${t("trpc_procedures")} WHERE router_name = ? ORDER BY procedure_name LIMIT 10000`
     ).all(args2.router);
     lines.push(`## Router: ${args2.router} (${procs.length} procedures)`);
     lines.push("");
@@ -28380,7 +28476,7 @@ function handleTrpcMap(args2, dataDb) {
       const status = proc.has_ui_caller ? "" : " [NO UI CALLERS]";
       lines.push(`### ${args2.router}.${proc.procedure_name} (${proc.procedure_type})${status}`);
       const callSites = dataDb.prepare(
-        `SELECT file, line, call_pattern FROM ${t("trpc_call_sites")} WHERE procedure_id = ?`
+        `SELECT file, line, call_pattern FROM ${t("trpc_call_sites")} WHERE procedure_id = ? LIMIT 10000`
       ).all(proc.id);
       if (callSites.length > 0) {
         lines.push("UI Call Sites:");
@@ -28394,7 +28490,7 @@ function handleTrpcMap(args2, dataDb) {
     }
   } else if (args2.procedure) {
     const procs = dataDb.prepare(
-      `SELECT id, router_name, router_file, procedure_type, has_ui_caller FROM ${t("trpc_procedures")} WHERE procedure_name = ? ORDER BY router_name`
+      `SELECT id, router_name, router_file, procedure_type, has_ui_caller FROM ${t("trpc_procedures")} WHERE procedure_name = ? ORDER BY router_name LIMIT 10000`
     ).all(args2.procedure);
     lines.push(`## Procedure "${args2.procedure}" found in ${procs.length} routers`);
     lines.push("");
@@ -28402,7 +28498,7 @@ function handleTrpcMap(args2, dataDb) {
       lines.push(`### ${proc.router_name}.${args2.procedure} (${proc.procedure_type})`);
       lines.push(`File: ${proc.router_file}`);
       const callSites = dataDb.prepare(
-        `SELECT file, line, call_pattern FROM ${t("trpc_call_sites")} WHERE procedure_id = ?`
+        `SELECT file, line, call_pattern FROM ${t("trpc_call_sites")} WHERE procedure_id = ? LIMIT 10000`
       ).all(proc.id);
       if (callSites.length > 0) {
         lines.push("UI Call Sites:");
@@ -28447,11 +28543,11 @@ function handleCouplingCheck(args2, dataDb, codegraphDb) {
   let uncoupledProcs;
   if (stagedFiles) {
     uncoupledProcs = dataDb.prepare(
-      `SELECT router_name, procedure_name, procedure_type, router_file FROM ${t("trpc_procedures")} WHERE has_ui_caller = 0 AND router_file IN (${stagedFiles.map(() => "?").join(",")})`
+      `SELECT router_name, procedure_name, procedure_type, router_file FROM ${t("trpc_procedures")} WHERE has_ui_caller = 0 AND router_file IN (${stagedFiles.map(() => "?").join(",")}) LIMIT 10000`
     ).all(...stagedFiles);
   } else {
     uncoupledProcs = dataDb.prepare(
-      `SELECT router_name, procedure_name, procedure_type, router_file FROM ${t("trpc_procedures")} WHERE has_ui_caller = 0`
+      `SELECT router_name, procedure_name, procedure_type, router_file FROM ${t("trpc_procedures")} WHERE has_ui_caller = 0 LIMIT 10000`
     ).all();
   }
   lines.push("## Coupling Check Results");
@@ -28467,12 +28563,12 @@ function handleCouplingCheck(args2, dataDb, codegraphDb) {
     lines.push("");
   }
   const allPages = codegraphDb.prepare(
-    "SELECT path FROM files WHERE path LIKE 'src/app/%/page.tsx' OR path = 'src/app/page.tsx'"
+    "SELECT path FROM files WHERE path LIKE 'src/app/%/page.tsx' OR path = 'src/app/page.tsx' LIMIT 10000"
   ).all();
   const pageImports = /* @__PURE__ */ new Set();
   for (const page of allPages) {
     const imports = dataDb.prepare(
-      `SELECT target_file FROM ${t("imports")} WHERE source_file = ?`
+      `SELECT target_file FROM ${t("imports")} WHERE source_file = ? LIMIT 10000`
     ).all(page.path);
     for (const imp of imports) {
       pageImports.add(imp.target_file);
@@ -28482,7 +28578,7 @@ function handleCouplingCheck(args2, dataDb, codegraphDb) {
   if (stagedFiles) {
     const placeholders = stagedFiles.map(() => "?").join(",");
     componentFiles = codegraphDb.prepare(
-      `SELECT path FROM files WHERE path LIKE 'src/components/%' AND path IN (${placeholders})`
+      `SELECT path FROM files WHERE path LIKE 'src/components/%' AND path IN (${placeholders}) LIMIT 10000`
     ).all(...stagedFiles);
   } else {
     componentFiles = [];
@@ -28544,7 +28640,7 @@ function handleImpact2(file, dataDb, codegraphDb) {
   const fileDomain = classifyFile(file);
   lines.push(`### Domain: ${fileDomain}`);
   const imports = dataDb.prepare(
-    `SELECT target_file FROM ${t("imports")} WHERE source_file = ?`
+    `SELECT target_file FROM ${t("imports")} WHERE source_file = ? LIMIT 10000`
   ).all(file);
   const crossings = [];
   for (const imp of imports) {
@@ -28897,10 +28993,14 @@ var init_tool_db_needs = __esm({
 function createDispatcher(options) {
   let codegraphDbCache = null;
   let dataDbCache = null;
+  let memoryDbCache = null;
+  let knowledgeDbCache = null;
   function resolveDbsForTool(toolName) {
     const needs = getToolDbNeeds(toolName, getConfig().toolPrefix);
     let dataDbResolved;
     let codegraphDbResolved;
+    let memoryDbResolved;
+    let knowledgeDbResolved;
     if (needs.includes("data")) {
       if (!dataDbCache) dataDbCache = getDataDb();
       dataDbResolved = dataDbCache;
@@ -28909,7 +29009,21 @@ function createDispatcher(options) {
       if (!codegraphDbCache) codegraphDbCache = getCodeGraphDb();
       codegraphDbResolved = codegraphDbCache;
     }
-    return { needs, dataDb: dataDbResolved, codegraphDb: codegraphDbResolved };
+    if (needs.includes("memory")) {
+      if (!memoryDbCache) memoryDbCache = getMemoryDb();
+      memoryDbResolved = memoryDbCache;
+    }
+    if (needs.includes("knowledge")) {
+      if (!knowledgeDbCache) knowledgeDbCache = getKnowledgeDb();
+      knowledgeDbResolved = knowledgeDbCache;
+    }
+    return {
+      needs,
+      dataDb: dataDbResolved,
+      codegraphDb: codegraphDbResolved,
+      memoryDb: memoryDbResolved,
+      knowledgeDb: knowledgeDbResolved
+    };
   }
   async function handleRequest(request) {
     const { method, params, id } = request;
@@ -28939,8 +29053,8 @@ function createDispatcher(options) {
         const toolName = params?.name ?? "";
         const toolArgs = params?.arguments ?? {};
         try {
-          const { dataDb, codegraphDb } = resolveDbsForTool(toolName);
-          const result = await handleToolCall(toolName, toolArgs, dataDb, codegraphDb);
+          const { dataDb, codegraphDb, memoryDb, knowledgeDb } = resolveDbsForTool(toolName);
+          const result = await handleToolCall(toolName, toolArgs, dataDb, codegraphDb, memoryDb, knowledgeDb);
           return { jsonrpc: "2.0", id: id ?? null, result };
         } catch (err) {
           if (err instanceof CodegraphDbNotInitializedError) {
@@ -29032,6 +29146,14 @@ function createDispatcher(options) {
       dataDbCache.close();
       dataDbCache = null;
     }
+    if (memoryDbCache) {
+      memoryDbCache.close();
+      memoryDbCache = null;
+    }
+    if (knowledgeDbCache) {
+      knowledgeDbCache.close();
+      knowledgeDbCache = null;
+    }
   }
   return { handleRequest, processLine, closeCachedDbs };
 }
@@ -29039,6 +29161,8 @@ var init_server_dispatch = __esm({
   "src/server-dispatch.ts"() {
     "use strict";
     init_db();
+    init_memory_db();
+    init_knowledge_db();
     init_config();
     init_tools();
     init_tool_db_needs();
@@ -29646,6 +29770,15 @@ async function main() {
       break;
     }
     default: {
+      if (subcommand && !subcommand.startsWith("-")) {
+        process.stderr.write(
+          `Error: Unknown subcommand '${subcommand}'.
+Run \`npx @massu/core --help\` for the list of available subcommands.
+To start the MCP server, run without a subcommand (e.g. \`npx @massu/core\`).
+`
+        );
+        process.exit(2);
+      }
       await Promise.resolve().then(() => (init_server(), server_exports));
     }
   }