@massu/core 2.5.0 → 2.5.2

package/dist/cli.js

@@ -1355,6 +1355,13 @@ var init_config = __esm({
     });
     LanguageFrameworkEntrySchema = z2.object({
       framework: z2.string().optional(),
+      // `source_dirs` is emitted by `init` (commands/init.ts:417) and existence-checked
+      // by config validation (init.ts:868-876), but until 2026-08-14 it survived only via
+      // `.passthrough()` — declared in the file, untyped in the schema. `lib/source-layout.ts`
+      // derives the index builders' candidate set from it, so it is typed here rather than
+      // read as an unknown: a consumer that has to shape-check its own SoT is one branch away
+      // from silently contributing `undefined` to a path predicate.
+      source_dirs: z2.array(z2.string()).optional(),
       test_framework: z2.string().optional(),
       test: z2.string().optional(),
       runtime: z2.string().optional(),
@@ -1548,6 +1555,16 @@ var init_memory_vector = __esm({
   }
 });
 
+// src/lib/timestamps.ts
+function nowIso() {
+  return (/* @__PURE__ */ new Date()).toISOString();
+}
+var init_timestamps = __esm({
+  "src/lib/timestamps.ts"() {
+    "use strict";
+  }
+});
+
 // src/db-backup.ts
 import { existsSync as existsSync6, mkdirSync as mkdirSync4, readdirSync as readdirSync2, statSync as statSync2, unlinkSync, copyFileSync, rmSync as rmSync4 } from "fs";
 import { resolve as resolve3, join as join3, basename, dirname as dirname4 } from "path";
@@ -3972,8 +3989,8 @@ function linkSessionToTask(db, sessionId, taskId) {
 }
 function addConversationTurn(db, sessionId, turnNumber, userPrompt, assistantResponse, toolCallsJson, toolCallCount, promptTokens, responseTokens) {
   const result = db.prepare(`
-    INSERT INTO conversation_turns (session_id, turn_number, user_prompt, assistant_response, tool_calls_json, tool_call_count, prompt_tokens, response_tokens)
-    VALUES (?, ?, ?, ?, ?, ?, ?, ?)
+    INSERT INTO conversation_turns (session_id, turn_number, user_prompt, assistant_response, tool_calls_json, tool_call_count, prompt_tokens, response_tokens, created_at)
+    VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)
   `).run(
     sessionId,
     turnNumber,
@@ -3982,14 +3999,15 @@ function addConversationTurn(db, sessionId, turnNumber, userPrompt, assistantRes
     toolCallsJson,
     toolCallCount,
     promptTokens,
-    responseTokens
+    responseTokens,
+    nowIso()
   );
   return Number(result.lastInsertRowid);
 }
 function addToolCallDetail(db, sessionId, turnNumber, toolName, inputSummary, inputSize, outputSize, success, filesInvolved) {
   db.prepare(`
-    INSERT INTO tool_call_details (session_id, turn_number, tool_name, tool_input_summary, tool_input_size, tool_output_size, tool_success, files_involved)
-    VALUES (?, ?, ?, ?, ?, ?, ?, ?)
+    INSERT INTO tool_call_details (session_id, turn_number, tool_name, tool_input_summary, tool_input_size, tool_output_size, tool_success, files_involved, created_at)
+    VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)
   `).run(
     sessionId,
     turnNumber,
@@ -3998,7 +4016,8 @@ function addToolCallDetail(db, sessionId, turnNumber, toolName, inputSummary, in
     inputSize,
     outputSize,
     success ? 1 : 0,
-    filesInvolved ? JSON.stringify(filesInvolved) : null
+    filesInvolved ? JSON.stringify(filesInvolved) : null,
+    nowIso()
   );
 }
 function getLastProcessedLine(db, sessionId) {
@@ -4257,6 +4276,7 @@ var init_memory_db = __esm({
     init_db_driver();
     init_config();
     init_memory_vector();
+    init_timestamps();
     init_db_backup();
     init_rule_delivery();
     init_rule_candidate_store();
@@ -9973,21 +9993,21 @@ var require_pattern = __commonJS({
     exports.removeDuplicateSlashes = removeDuplicateSlashes;
     function partitionAbsoluteAndRelative(patterns) {
       const absolute = [];
-      const relative15 = [];
+      const relative16 = [];
       for (const pattern of patterns) {
-        if (isAbsolute5(pattern)) {
+        if (isAbsolute6(pattern)) {
           absolute.push(pattern);
         } else {
-          relative15.push(pattern);
+          relative16.push(pattern);
         }
       }
-      return [absolute, relative15];
+      return [absolute, relative16];
     }
     exports.partitionAbsoluteAndRelative = partitionAbsoluteAndRelative;
-    function isAbsolute5(pattern) {
+    function isAbsolute6(pattern) {
       return path.isAbsolute(pattern);
     }
-    exports.isAbsolute = isAbsolute5;
+    exports.isAbsolute = isAbsolute6;
   }
 });
 
@@ -11071,41 +11091,41 @@ var require_queue = __commonJS({
       queue.drained = drained;
       return queue;
       function push(value) {
-        var p19 = new Promise(function(resolve45, reject) {
+        var p19 = new Promise(function(resolve47, reject) {
           pushCb(value, function(err, result) {
             if (err) {
               reject(err);
               return;
             }
-            resolve45(result);
+            resolve47(result);
           });
         });
         p19.catch(noop);
         return p19;
       }
       function unshift(value) {
-        var p19 = new Promise(function(resolve45, reject) {
+        var p19 = new Promise(function(resolve47, reject) {
           unshiftCb(value, function(err, result) {
             if (err) {
               reject(err);
               return;
             }
-            resolve45(result);
+            resolve47(result);
           });
         });
         p19.catch(noop);
         return p19;
       }
       function drained() {
-        var p19 = new Promise(function(resolve45) {
+        var p19 = new Promise(function(resolve47) {
           process.nextTick(function() {
             if (queue.idle()) {
-              resolve45();
+              resolve47();
             } else {
               var previousDrain = queue.drain;
               queue.drain = function() {
                 if (typeof previousDrain === "function") previousDrain();
-                resolve45();
+                resolve47();
                 queue.drain = previousDrain;
               };
             }
@@ -11591,9 +11611,9 @@ var require_stream3 = __commonJS({
         });
       }
       _getStat(filepath) {
-        return new Promise((resolve45, reject) => {
+        return new Promise((resolve47, reject) => {
           this._stat(filepath, this._fsStatSettings, (error, stats) => {
-            return error === null ? resolve45(stats) : reject(error);
+            return error === null ? resolve47(stats) : reject(error);
           });
         });
       }
@@ -11617,10 +11637,10 @@ var require_async5 = __commonJS({
         this._readerStream = new stream_1.default(this._settings);
       }
       dynamic(root, options) {
-        return new Promise((resolve45, reject) => {
+        return new Promise((resolve47, reject) => {
           this._walkAsync(root, options, (error, entries) => {
             if (error === null) {
-              resolve45(entries);
+              resolve47(entries);
             } else {
               reject(error);
             }
@@ -11630,10 +11650,10 @@ var require_async5 = __commonJS({
       async static(patterns, options) {
         const entries = [];
         const stream = this._readerStream.static(patterns, options);
-        return new Promise((resolve45, reject) => {
+        return new Promise((resolve47, reject) => {
           stream.once("error", reject);
           stream.on("data", (entry) => entries.push(entry));
-          stream.once("end", () => resolve45(entries));
+          stream.once("end", () => resolve47(entries));
         });
       }
     };
@@ -16598,15 +16618,15 @@ function resolveHooksDir() {
   }
   return "node_modules/@massu/core/dist/hooks";
 }
-function massuRuntimeDir(version) {
-  return resolve9(homedir7(), ".massu", "runtime", version);
+function massuRuntimeDir(version, home = homedir7()) {
+  return resolve9(home, ".massu", "runtime", version);
 }
-function massuRuntimeCliPath(version) {
-  return resolve9(massuRuntimeDir(version), "node_modules", "@massu", "core", "dist", "cli.js");
+function massuRuntimeCliPath(version, home = homedir7()) {
+  return resolve9(massuRuntimeDir(version, home), "node_modules", "@massu", "core", "dist", "cli.js");
 }
-function resolveMassuRuntimeCli(version) {
+function resolveMassuRuntimeCli(version, home = homedir7()) {
   if (process.env.MASSU_NO_NODE_DIRECT === "1") return null;
-  const cli = massuRuntimeCliPath(version);
+  const cli = massuRuntimeCliPath(version, home);
   if (!existsSync19(cli)) return null;
   try {
     execFileSync2(process.execPath, [cli, "--version"], { stdio: "ignore", timeout: 2e4 });
@@ -16615,10 +16635,10 @@ function resolveMassuRuntimeCli(version) {
     return null;
   }
 }
-function materializeMassuRuntime(version) {
+function materializeMassuRuntime(version, home = homedir7()) {
   if (process.env.MASSU_NO_NODE_DIRECT === "1") return false;
-  if (resolveMassuRuntimeCli(version) !== null) return true;
-  const dir = massuRuntimeDir(version);
+  if (resolveMassuRuntimeCli(version, home) !== null) return true;
+  const dir = massuRuntimeDir(version, home);
   try {
     mkdirSync10(dir, { recursive: true });
     execFileSync2(
@@ -16629,10 +16649,10 @@ function materializeMassuRuntime(version) {
   } catch {
     return false;
   }
-  return resolveMassuRuntimeCli(version) !== null;
+  return resolveMassuRuntimeCli(version, home) !== null;
 }
-function massuShimPath() {
-  return resolve9(homedir7(), ".massu", "bin", "massu-hook");
+function massuShimPath(home = homedir7()) {
+  return resolve9(home, ".massu", "bin", "massu-hook");
 }
 function massuShimBody() {
   return `#!/bin/sh
@@ -16657,10 +16677,10 @@ fi
 exec npx -y "@massu/core@\${MASSU_VERSION}" "$@"
 `;
 }
-function installMassuShim() {
+function installMassuShim(home = homedir7()) {
   if (process.env.MASSU_NO_NODE_DIRECT === "1") return false;
   if (process.platform === "win32") return false;
-  const shim = massuShimPath();
+  const shim = massuShimPath(home);
   try {
     mkdirSync10(dirname12(shim), { recursive: true });
     writeFileSync5(shim, massuShimBody(), "utf-8");
@@ -16676,10 +16696,10 @@ function installMassuShim() {
     return status === 2;
   }
 }
-function resolveMassuShim() {
+function resolveMassuShim(home = homedir7()) {
   if (process.env.MASSU_NO_NODE_DIRECT === "1") return null;
   if (process.platform === "win32") return null;
-  const shim = massuShimPath();
+  const shim = massuShimPath(home);
   if (!existsSync19(shim)) return null;
   try {
     execFileSync2(shim, [], { stdio: "ignore", timeout: 1e4 });
@@ -16695,9 +16715,8 @@ function hookCmd(version, hookName, shim) {
 function getHookTimeout(name) {
   return HOOK_TIMEOUTS[name] ?? 5;
 }
-function buildHooksConfig(_hooksDir) {
+function buildHooksConfig(_hooksDir, shim = resolveMassuShim()) {
   const version = getInstallerVersion();
-  const shim = resolveMassuShim();
   return {
     SessionStart: [
       {
@@ -18154,7 +18173,7 @@ function checkHookFiles(projectRoot) {
 }
 async function checkHookExecution(projectRoot, opts = {}) {
   const { spawnSync: spawnSync6 } = await import("child_process");
-  const { mkdtempSync: mkdtempSync2, copyFileSync: copyFileSync4, rmSync: rmSync12 } = await import("fs");
+  const { mkdtempSync: mkdtempSync2, copyFileSync: copyFileSync4, rmSync: rmSync13 } = await import("fs");
   const { tmpdir: tmpdir2 } = await import("os");
   const node = opts.node ?? process.execPath;
   const timeoutMs = opts.timeoutMs ?? 1e4;
@@ -18208,7 +18227,7 @@ async function checkHookExecution(projectRoot, opts = {}) {
     };
   } finally {
     try {
-      rmSync12(tmpCwd, { recursive: true, force: true });
+      rmSync13(tmpCwd, { recursive: true, force: true });
     } catch {
     }
   }
@@ -20429,8 +20448,8 @@ function renderRegion(content, lines) {
 ${lines.join("\n")}
 ` : "\n";
   if (state.kind === "absent") {
-    const sep3 = content.endsWith("\n") ? "" : "\n";
-    return `${content}${sep3}
+    const sep4 = content.endsWith("\n") ? "" : "\n";
+    return `${content}${sep4}
 ${BEGIN_SENTINEL}${body}${END_SENTINEL}
 `;
   }
@@ -20573,7 +20592,7 @@ import { createHash as createHash8 } from "crypto";
 function renderMemoryFiles(db, candidates, opts) {
   const config = opts.config ?? resolveMemoryFilesConfig();
   if (!config.renderEnabled) {
-    return EMPTY("render_disabled");
+    return EMPTY("render_disabled", candidates.length);
   }
   const dryRun = opts.dryRun === true;
   const now = opts.now ?? Date.now();
@@ -20582,7 +20601,7 @@ function renderMemoryFiles(db, candidates, opts) {
   });
   const { memoryDir } = opts;
   if (!existsSync33(memoryDir)) {
-    return EMPTY("no_memory_dir");
+    return EMPTY("no_memory_dir", candidates.length);
   }
   try {
     return withMemoryIndexLock(
@@ -20591,10 +20610,10 @@ function renderMemoryFiles(db, candidates, opts) {
     );
   } catch (err) {
     if (err instanceof MemoryIndexLockBusy) {
-      return EMPTY("lock_busy");
+      return EMPTY("lock_busy", candidates.length);
     }
     audit("memory_file_render_refused", { reason: "unexpected_error", error: String(err) });
-    return EMPTY("error");
+    return EMPTY("error", candidates.length);
   }
 }
 function renderLocked(db, candidates, o) {
@@ -20604,11 +20623,14 @@ function renderLocked(db, candidates, o) {
   try {
     tombstones = readTombstones(memoryDir);
   } catch {
-    return EMPTY("tombstone_ledger_unreadable");
+    return EMPTY("tombstone_ledger_unreadable", candidates.length);
   }
   const ownerOf = relPathOwnerLookup(db);
   const planned = [];
-  for (const c2 of candidates) {
+  let unchanged = 0;
+  let capped = 0;
+  for (let i = 0; i < candidates.length; i++) {
+    const c2 = candidates[i];
     if (!isLocalOrigin(c2.origin)) {
       refusals.push({ name: c2.name, reason: "non_local_origin", detail: c2.origin || "unknown" });
       audit("memory_file_render_refused", { name: c2.name, reason: "non_local_origin" });
@@ -20664,7 +20686,10 @@ function renderLocked(db, candidates, o) {
         continue;
       }
       const next = composeFile(c2, home);
-      if (next !== null && next === existing) continue;
+      if (next !== null && next === existing) {
+        unchanged++;
+        continue;
+      }
     }
     const content = composeFile(c2, home);
     if (content === null) {
@@ -20672,9 +20697,24 @@ function renderLocked(db, candidates, o) {
       continue;
     }
     planned.push({ c: c2, relPath, absPath, content });
-    if (planned.length >= config.renderMaxFilesPerSession) break;
+    if (planned.length >= config.renderMaxFilesPerSession) {
+      capped = candidates.length - (i + 1);
+      break;
+    }
+  }
+  const accounted = planned.length + refusals.length + unchanged + capped;
+  if (accounted !== candidates.length) {
+    audit("memory_file_render_refused", {
+      reason: "accounting_leak",
+      considered: candidates.length,
+      accounted
+    });
+    throw new RenderAccountingLeak(
+      `render did not account for every candidate: considered=${candidates.length} but accounted=${accounted} (planned=${planned.length} refused=${refusals.length} unchanged=${unchanged} capped=${capped}). A candidate was dropped without a bucket.`
+    );
   }
   const indexLines = buildIndexLines(db, memoryDir, planned, config);
+  const books = { considered: candidates.length, unchanged, capped };
   if (dryRun) {
     return {
       enabled: true,
@@ -20682,11 +20722,20 @@ function renderLocked(db, candidates, o) {
       written: planned.map((p19) => p19.relPath),
       refusals,
       indexLines,
-      bytesWritten: 0
+      bytesWritten: 0,
+      ...books
     };
   }
   if (planned.length === 0 && indexLines.length === 0) {
-    return { enabled: true, dryRun: false, written: [], refusals, indexLines: [], bytesWritten: 0 };
+    return {
+      enabled: true,
+      dryRun: false,
+      written: [],
+      refusals,
+      indexLines: [],
+      bytesWritten: 0,
+      ...books
+    };
   }
   if (!hasFreshBackup(memoryDir, home)) {
     try {
@@ -20696,7 +20745,7 @@ function renderLocked(db, candidates, o) {
         reason: "backup_failed",
         error: err instanceof BackupError ? err.message : String(err)
       });
-      return EMPTY("backup_failed");
+      return EMPTY("backup_failed", candidates.length);
     }
   }
   const indexPath = o.indexPath ?? join19(memoryDir, "MEMORY.md");
@@ -20764,7 +20813,10 @@ function renderLocked(db, candidates, o) {
         errors: restored.errors
       });
       return {
-        ...EMPTY("rollback_incomplete"),
+        ...EMPTY("rollback_incomplete", candidates.length),
+        // The books were balanced before the write began; keep them rather than zeroing.
+        unchanged,
+        capped,
         enabled: true,
         refusals: [
           ...refusals,
@@ -20773,9 +20825,9 @@ function renderLocked(db, candidates, o) {
       };
     }
     audit("memory_file_render_refused", { reason: "write_failed", error: String(err) });
-    return { ...EMPTY("write_failed"), enabled: true, refusals };
+    return { ...EMPTY("write_failed", candidates.length), enabled: true, refusals, unchanged, capped };
   }
-  return { enabled: true, dryRun: false, written, refusals, indexLines, bytesWritten };
+  return { enabled: true, dryRun: false, written, refusals, indexLines, bytesWritten, ...books };
 }
 function sha2562(s) {
   return createHash8("sha256").update(s, "utf8").digest("hex");
@@ -20844,7 +20896,7 @@ function buildIndexLines(db, memoryDir, planned, config) {
 function oneLine(s) {
   return s.replace(/[\r\n]+/g, " ").slice(0, 120);
 }
-var EMPTY;
+var RenderAccountingLeak, EMPTY;
 var init_memory_renderer = __esm({
   "src/memory-renderer.ts"() {
     "use strict";
@@ -20859,14 +20911,22 @@ var init_memory_renderer = __esm({
     init_memory_index_region();
     init_memory_files_config();
     init_memory_file_ingest();
-    EMPTY = (reason) => ({
+    RenderAccountingLeak = class extends Error {
+    };
+    EMPTY = (reason, considered = 0) => ({
       enabled: false,
       dryRun: false,
       written: [],
       refusals: [],
       indexLines: [],
       bytesWritten: 0,
-      skippedReason: reason
+      skippedReason: reason,
+      // An early gate refused, so every candidate was dropped — by that ONE named reason.
+      // Reporting `considered` here is what distinguishes "nothing to do" from "walked away
+      // from 59 rows because the lock was busy".
+      considered,
+      unchanged: 0,
+      capped: 0
     });
   }
 });
@@ -21057,25 +21117,46 @@ var init_memory_render_cli = __esm({
 function loadRenderCandidates(db) {
   const cfg = resolveMemoryFilesConfig();
   const typePlaceholders = RENDERABLE_MEMORY_TYPES.map(() => "?").join(", ");
+  const WHERE = `WHERE importance >= ?
+       AND COALESCE(expired_at_epoch, 0) = 0
+       AND type IN (${typePlaceholders})`;
+  const { population } = db.prepare(`SELECT COUNT(*) AS population FROM observations ${WHERE}`).get(cfg.renderMinImportance, ...RENDERABLE_MEMORY_TYPES);
   const rows = db.prepare(
     `SELECT id, title, detail, importance, COALESCE(origin, 'local') AS origin
          FROM observations
-        WHERE importance >= ?
-          AND COALESCE(expired_at_epoch, 0) = 0
-          AND type IN (${typePlaceholders})
+         ${WHERE}
         ORDER BY importance DESC, created_at_epoch DESC
-        LIMIT 50`
+        LIMIT ${CANDIDATE_WINDOW}`
   ).all(cfg.renderMinImportance, ...RENDERABLE_MEMORY_TYPES);
-  return rows.filter((r2) => !r2.title.startsWith("[memory-file]")).map((r2) => ({
-    observationId: r2.id,
-    name: r2.title,
-    title: r2.title,
-    body: r2.detail ?? "",
-    importance: r2.importance,
-    origin: r2.origin
-  }));
+  const reingest = rows.filter((r2) => r2.title.startsWith("[memory-file]"));
+  const kept = rows.filter((r2) => !r2.title.startsWith("[memory-file]"));
+  const excluded = reingest.length ? [{ reason: EXCLUSION_MEMORY_FILE_REINGEST, count: reingest.length }] : [];
+  const ledger = {
+    population,
+    windowed: rows.length,
+    truncatedByWindow: Math.max(0, population - rows.length),
+    excluded,
+    returned: kept.length
+  };
+  const accounted = ledger.returned + ledger.truncatedByWindow + excluded.reduce((n, e2) => n + e2.count, 0);
+  if (accounted !== population) {
+    throw new CandidateAccountingLeak(
+      `candidate ledger does not balance: population=${population} but accounted=${accounted} (returned=${ledger.returned} truncated=${ledger.truncatedByWindow} excluded=${JSON.stringify(excluded)}). A row was dropped without a bucket.`
+    );
+  }
+  return {
+    ledger,
+    candidates: kept.map((r2) => ({
+      observationId: r2.id,
+      name: r2.title,
+      title: r2.title,
+      body: r2.detail ?? "",
+      importance: r2.importance,
+      origin: r2.origin
+    }))
+  };
 }
-var RENDERABLE_MEMORY_TYPES;
+var RENDERABLE_MEMORY_TYPES, CANDIDATE_WINDOW, EXCLUSION_MEMORY_FILE_REINGEST, CandidateAccountingLeak;
 var init_memory_render_candidates = __esm({
   "src/memory-render-candidates.ts"() {
     "use strict";
@@ -21086,6 +21167,10 @@ var init_memory_render_candidates = __esm({
       "incident_near_miss",
       "cr_violation"
     ];
+    CANDIDATE_WINDOW = 50;
+    EXCLUSION_MEMORY_FILE_REINGEST = "memory_file_reingest";
+    CandidateAccountingLeak = class extends Error {
+    };
   }
 });
 
@@ -21165,13 +21250,13 @@ function pruneNoiseObservations(db, opts = {}) {
   const counts = countNoise(db);
   if (dryRun || counts.total === 0) return { counts, expired: 0, dryRun };
   const nowSec = opts.now ?? Math.floor(Date.now() / 1e3);
-  const nowIso = new Date(nowSec * 1e3).toISOString();
+  const nowIso2 = new Date(nowSec * 1e3).toISOString();
   const res = db.prepare(
     `UPDATE observations
           SET expired_at = ?, expired_at_epoch = ?, valid_to = ?, valid_to_epoch = ?
         WHERE COALESCE(expired_at_epoch, 0) = 0
           AND ((${DA_PREDICATE}) OR (${FT_DECISION_PREDICATE}) OR (${DB_PREDICATE}))`
-  ).run(nowIso, nowSec, nowIso, nowSec);
+  ).run(nowIso2, nowSec, nowIso2, nowSec);
   return { counts, expired: res.changes, dryRun: false };
 }
 var DA_PREDICATE, FT_DECISION_PREDICATE, DB_PREDICATE;
@@ -21216,7 +21301,7 @@ async function runMemoryRenderCli(sub, args2) {
           };
         }
         const cfg = resolveMemoryFilesConfig();
-        const candidates = loadRenderCandidates(db);
+        const { candidates, ledger } = loadRenderCandidates(db);
         const result = renderMemoryFiles(db, candidates, {
           memoryDir,
           dryRun: true,
@@ -21231,6 +21316,19 @@ async function runMemoryRenderCli(sub, args2) {
         }
         lines.push(`Massu would write ${result.written.length} file(s):`);
         for (const f2 of result.written) lines.push(`  ${f2}`);
+        lines.push("", "Where every row went:");
+        lines.push(`  candidate population (type+importance+expiry) : ${ledger.population}`);
+        if (ledger.truncatedByWindow > 0) {
+          lines.push(`    truncated by the row window                : ${ledger.truncatedByWindow}`);
+        }
+        for (const e2 of ledger.excluded) {
+          lines.push(`    excluded: ${e2.reason.padEnd(30)} : ${e2.count}`);
+        }
+        lines.push(`    -> reached the renderer                    : ${ledger.returned}`);
+        lines.push(
+          `  renderer: considered ${result.considered} = written ${result.written.length} + refused ${result.refusals.length} + unchanged ${result.unchanged} + capped ${result.capped}`
+        );
+        lines.push(`  skipped: ${result.skippedReason ?? "(none)"}`);
         if (result.indexLines.length > 0) {
           lines.push("", "MEMORY.md \u2014 inside the massu:learned region only:");
           for (const l2 of result.indexLines) lines.push(`  ${l2}`);
@@ -22817,8 +22915,8 @@ function writeCustomDestination(opts, candidate, slug, targets) {
   const rendered = renderTemplate2(entry.template, vars);
   if (!existsSync38(dirname19(destPath))) mkdirSync17(dirname19(destPath), { recursive: true });
   const pre = existsSync38(destPath) ? readFileSync29(destPath, "utf-8") : "";
-  const sep3 = pre && !pre.endsWith("\n") ? "\n" : "";
-  writeFileSync11(destPath, pre + sep3 + rendered + (rendered.endsWith("\n") ? "" : "\n"), "utf-8");
+  const sep4 = pre && !pre.endsWith("\n") ? "\n" : "";
+  writeFileSync11(destPath, pre + sep4 + rendered + (rendered.endsWith("\n") ? "" : "\n"), "utf-8");
 }
 function dismissRuleCandidate(db, opts) {
   if (!CANDIDATE_ID_PATTERN.test(opts.candidateId)) {
@@ -22871,8 +22969,8 @@ function dismissRuleCandidate(db, opts) {
     const dismissedLog = join24(projectRoot, ".massu", "rule-candidates", ".dismissed.jsonl");
     if (!existsSync38(dirname19(dismissedLog))) mkdirSync17(dirname19(dismissedLog), { recursive: true });
     const pre = existsSync38(dismissedLog) ? readFileSync29(dismissedLog, "utf-8") : "";
-    const sep3 = pre && !pre.endsWith("\n") ? "\n" : "";
-    writeFileSync11(dismissedLog, pre + sep3 + JSON.stringify({
+    const sep4 = pre && !pre.endsWith("\n") ? "\n" : "";
+    writeFileSync11(dismissedLog, pre + sep4 + JSON.stringify({
       id: opts.candidateId,
       prompt_hash: candidate.prompt_hash,
       score: candidate.score,
@@ -22903,8 +23001,8 @@ function appendFailureLog(projectRoot, entry) {
     if (!existsSync38(dir)) mkdirSync17(dir, { recursive: true });
     const logPath = join24(dir, ".failures.jsonl");
     const pre = existsSync38(logPath) ? readFileSync29(logPath, "utf-8") : "";
-    const sep3 = pre && !pre.endsWith("\n") ? "\n" : "";
-    writeFileSync11(logPath, pre + sep3 + JSON.stringify(entry) + "\n", "utf-8");
+    const sep4 = pre && !pre.endsWith("\n") ? "\n" : "";
+    writeFileSync11(logPath, pre + sep4 + JSON.stringify(entry) + "\n", "utf-8");
   } catch {
   }
 }
@@ -23389,7 +23487,7 @@ async function pullInstalledPackRules(db, opts = {}) {
   }
   const packs = parsePacks(envelope.packs_json);
   const result = { ...ZERO };
-  const nowIso = (/* @__PURE__ */ new Date()).toISOString();
+  const nowIso2 = (/* @__PURE__ */ new Date()).toISOString();
   for (const pack of packs) {
     if (!isValidInstalledPack(pack)) continue;
     for (const rawRule of pack.rules) {
@@ -23406,7 +23504,7 @@ async function pullInstalledPackRules(db, opts = {}) {
         result.skipped += 1;
         continue;
       }
-      materializeCandidate(projectRoot, candidatePath, promptHash, rule, pack, signedOrgId, nowIso, opts.home ?? homedir20());
+      materializeCandidate(projectRoot, candidatePath, promptHash, rule, pack, signedOrgId, nowIso2, opts.home ?? homedir20());
       result.materialized += 1;
     }
   }
@@ -23453,7 +23551,7 @@ function alreadyApplied(db, promptHash) {
     return false;
   }
 }
-function materializeCandidate(projectRoot, candidatePath, promptHash, rule, pack, orgId, nowIso, home) {
+function materializeCandidate(projectRoot, candidatePath, promptHash, rule, pack, orgId, nowIso2, home) {
   const promptText = `${rule.title}: ${rule.description}`.replace(/\n+/g, " ").slice(0, 200) || `pack rule ${promptHash}`;
   const draftText = rule.pattern ?? rule.check ?? rule.description;
   const hardened = isExecutableDestination(rule.destination);
@@ -23469,7 +23567,7 @@ function materializeCandidate(projectRoot, candidatePath, promptHash, rule, pack
     score: 0,
     signals: [],
     prior_turn_files: [],
-    timestamp: nowIso,
+    timestamp: nowIso2,
     session_id: `pack:${pack.slug}`,
     // Provenance (P2-002/P2-003): the applier's team-origin / hardened apply-gate
     // keys on this. `origin:'pack'` rides the SAME gate as a team origin
@@ -23481,7 +23579,7 @@ function materializeCandidate(projectRoot, candidatePath, promptHash, rule, pack
       origin: "pack",
       org_id: orgId,
       promoted_by: `pack:${pack.slug}`,
-      promoted_at: nowIso,
+      promoted_at: nowIso2,
       signature_verified: true,
       ...applyMac ? { apply_mac: applyMac } : {},
       pack_slug: pack.slug,
@@ -25289,12 +25387,102 @@ var init_gitToplevel = __esm({
   }
 });
 
+// src/watch/canary.ts
+import { mkdirSync as mkdirSync20, rmSync as rmSync10, writeFileSync as writeFileSync15 } from "fs";
+import { isAbsolute as isAbsolute3, relative as relative7, resolve as resolve20, sep as sep2 } from "path";
+function toRelative(projectRoot, p19) {
+  const raw = String(p19);
+  const rel = isAbsolute3(raw) ? relative7(projectRoot, raw) : raw;
+  return rel.split(sep2).join("/");
+}
+function isCanaryPath(projectRoot, p19) {
+  const rel = toRelative(projectRoot, p19);
+  return rel === CANARY_DIR_REL || rel.startsWith(`${CANARY_DIR_REL}/`);
+}
+function canaryAwareIgnore(ignore, projectRoot) {
+  const withoutMassu = ignore.filter((g2) => g2 !== "**/.massu/**");
+  const massuButNotCanary = (p19) => {
+    if (isCanaryPath(projectRoot, p19)) return false;
+    const rel = toRelative(projectRoot, p19);
+    return rel === ".massu" || rel.startsWith(".massu/") || rel.includes("/.massu/");
+  };
+  return [...withoutMassu, massuButNotCanary];
+}
+function createWatcherCanary(opts) {
+  const projectRoot = resolve20(opts.projectRoot);
+  const now = opts.now ?? Date.now;
+  const filePath = resolve20(projectRoot, CANARY_FILE_REL);
+  let outstanding = false;
+  let echoed = false;
+  let consecutiveDead = 0;
+  let armedAt = 0;
+  return {
+    dirRel: CANARY_DIR_REL,
+    filePath,
+    get consecutiveDead() {
+      return consecutiveDead;
+    },
+    arm() {
+      if (outstanding) return "armed";
+      try {
+        mkdirSync20(resolve20(projectRoot, CANARY_DIR_REL), { recursive: true });
+        writeFileSync15(filePath, `${now()}
+`, "utf-8");
+      } catch {
+        outstanding = false;
+        echoed = false;
+        return "unwritable";
+      }
+      outstanding = true;
+      echoed = false;
+      armedAt = now();
+      return "armed";
+    },
+    observe(path) {
+      if (!isCanaryPath(projectRoot, path)) return false;
+      if (outstanding) echoed = true;
+      return true;
+    },
+    evaluate() {
+      if (!outstanding) return "idle";
+      if (now() - armedAt < CANARY_MIN_GRACE_MS) return "idle";
+      outstanding = false;
+      if (echoed) {
+        consecutiveDead = 0;
+        return "alive";
+      }
+      consecutiveDead += 1;
+      return "dead";
+    },
+    cleanup() {
+      try {
+        rmSync10(filePath, { force: true });
+      } catch {
+      }
+    }
+  };
+}
+var CANARY_DIR_REL, CANARY_FILE_REL, CANARY_DEAD_STRIKES_BEFORE_REBUILD, CANARY_MIN_GRACE_MS, CANARY_DEAD_LOG, CANARY_REBUILD_LOG, CANARY_UNWRITABLE_LOG, CANARY_RECOVERED_LOG;
+var init_canary = __esm({
+  "src/watch/canary.ts"() {
+    "use strict";
+    CANARY_DIR_REL = ".massu/watch-canary";
+    CANARY_FILE_REL = `${CANARY_DIR_REL}/liveness`;
+    CANARY_DEAD_STRIKES_BEFORE_REBUILD = 2;
+    CANARY_MIN_GRACE_MS = 2500;
+    CANARY_DEAD_LOG = "[massu] watcher liveness canary NOT echoed";
+    CANARY_REBUILD_LOG = "[massu] rebuilding file watcher";
+    CANARY_UNWRITABLE_LOG = "[massu] watcher liveness canary could not be written";
+    CANARY_RECOVERED_LOG = "[massu] file watcher recovered";
+  }
+});
+
 // src/watch/lockfile-detector.ts
 import { existsSync as existsSync45, statSync as statSync15 } from "fs";
-import { resolve as resolve20 } from "path";
+import { resolve as resolve21 } from "path";
 function lockfileMidWrite(projectRoot, now = Date.now(), windowMs = LOCKFILE_WINDOW_MS) {
   for (const lf of KNOWN_LOCKFILES) {
-    const p19 = resolve20(projectRoot, lf);
+    const p19 = resolve21(projectRoot, lf);
     if (!existsSync45(p19)) continue;
     try {
       const stat = statSync15(p19);
@@ -25308,7 +25496,7 @@ function lockfileMidWrite(projectRoot, now = Date.now(), windowMs = LOCKFILE_WIN
 function gitMidOperation(projectRoot) {
   const sentinels = ["MERGE_HEAD", "REBASE_HEAD", "CHERRY_PICK_HEAD", "rebase-apply", "rebase-merge"];
   for (const s of sentinels) {
-    if (existsSync45(resolve20(projectRoot, ".git", s))) return true;
+    if (existsSync45(resolve21(projectRoot, ".git", s))) return true;
   }
   return false;
 }
@@ -25507,13 +25695,13 @@ var init_paths = __esm({
 });
 
 // src/watch/state.ts
-import { closeSync as closeSync5, existsSync as existsSync46, fsyncSync as fsyncSync5, mkdirSync as mkdirSync20, openSync as openSync5, readFileSync as readFileSync34, renameSync as renameSync5, rmSync as rmSync10, writeFileSync as writeFileSync15, writeSync as writeSync3 } from "fs";
-import { dirname as dirname21, resolve as resolve21 } from "path";
+import { closeSync as closeSync5, existsSync as existsSync46, fsyncSync as fsyncSync5, mkdirSync as mkdirSync21, openSync as openSync5, readFileSync as readFileSync34, renameSync as renameSync5, rmSync as rmSync11, writeFileSync as writeFileSync16, writeSync as writeSync3 } from "fs";
+import { dirname as dirname21, resolve as resolve22 } from "path";
 function watchStatePath(projectRoot) {
-  return resolve21(projectRoot, ".massu", "watch-state.json");
+  return resolve22(projectRoot, ".massu", "watch-state.json");
 }
 function backupStatePath(projectRoot) {
-  return resolve21(projectRoot, ".massu", "watch-state.v0.bak.json");
+  return resolve22(projectRoot, ".massu", "watch-state.v0.bak.json");
 }
 function readState(projectRoot) {
   const path = watchStatePath(projectRoot);
@@ -25560,14 +25748,14 @@ function readState(projectRoot) {
 }
 function archiveCorrupt(projectRoot, content) {
   const bak = backupStatePath(projectRoot);
-  mkdirSync20(dirname21(bak), { recursive: true });
-  writeFileSync15(bak, content, "utf-8");
+  mkdirSync21(dirname21(bak), { recursive: true });
+  writeFileSync16(bak, content, "utf-8");
 }
 function writeStateAtomic(projectRoot, state) {
   const path = watchStatePath(projectRoot);
   writeStateAtomicCounter = writeStateAtomicCounter + 1 >>> 0;
   const tmp = `${path}.${process.pid}.${writeStateAtomicCounter}.tmp`;
-  mkdirSync20(dirname21(path), { recursive: true });
+  mkdirSync21(dirname21(path), { recursive: true });
   let renamed = false;
   try {
     const fd = openSync5(tmp, "w");
@@ -25583,7 +25771,7 @@ function writeStateAtomic(projectRoot, state) {
   } finally {
     if (!renamed && existsSync46(tmp)) {
       try {
-        rmSync10(tmp, { force: true });
+        rmSync11(tmp, { force: true });
       } catch {
       }
     }
@@ -25626,6 +25814,8 @@ var init_state = __esm({
 
 // src/watch/daemon.ts
 import * as chokidar from "chokidar";
+import { mkdirSync as mkdirSync22 } from "fs";
+import { resolve as resolve23 } from "path";
 function readDaemonConfig(projectRoot) {
   const cfg = getConfig();
   const w2 = cfg.watch ?? {};
@@ -25659,6 +25849,10 @@ async function startDaemon(projectRoot, hooks) {
   let tickTimer = null;
   let stopped = false;
   let runningRefresh = false;
+  let canary = null;
+  let watchSpec = null;
+  let rebuilding = false;
+  let watcherReady = false;
   function clearDebounce() {
     if (ctx.debounceTimer) {
       clearTimeout(ctx.debounceTimer);
@@ -25765,6 +25959,110 @@ async function startDaemon(projectRoot, hooks) {
       await watcher.close();
       watcher = null;
     }
+    if (canary) {
+      canary.cleanup();
+      canary = null;
+    }
+  }
+  function createWatcherInstance() {
+    const spec = watchSpec;
+    if (!spec) throw new Error("watch spec not derived before createWatcherInstance()");
+    const w2 = chokidar.watch(spec.watch, {
+      cwd: cfg.projectRoot,
+      ignored: spec.ignored,
+      ignoreInitial: true,
+      persistent: true,
+      awaitWriteFinish: false
+    });
+    w2.on("ready", () => {
+      watcherReady = true;
+    });
+    w2.on("all", (event, path) => {
+      if (canary?.observe(path)) return;
+      if (!STACK_RELEVANT_EVENTS.has(event)) return;
+      pushEvent(path);
+    });
+    w2.on("error", (err) => {
+      const msg = err instanceof Error ? err.message : String(err);
+      writeStderr(`[massu] chokidar error: ${msg}
+`);
+      try {
+        updateState(cfg.projectRoot, { lastError: `chokidar: ${msg}` });
+      } catch {
+      }
+    });
+    return w2;
+  }
+  function armCanary() {
+    if (!canary || stopped) return;
+    if (canary.arm() === "unwritable") {
+      writeStderr(
+        `${CANARY_UNWRITABLE_LOG} (${canary.filePath}); watcher liveness is UNKNOWN for this interval
+`
+      );
+    }
+  }
+  function isPowerOfTwo(n) {
+    return n > 0 && (n & n - 1) === 0;
+  }
+  async function rebuildWatcher() {
+    if (rebuilding || stopped || !watchSpec) return;
+    rebuilding = true;
+    try {
+      const old = watcher;
+      watcher = null;
+      if (old) {
+        try {
+          await old.close();
+        } catch {
+        }
+      }
+      if (stopped) return;
+      watcherReady = false;
+      watcher = createWatcherInstance();
+    } catch (err) {
+      const msg = err instanceof Error ? err.message : String(err);
+      writeStderr(`[massu] watcher rebuild FAILED: ${msg}
+`);
+    } finally {
+      rebuilding = false;
+    }
+  }
+  function checkWatcherLiveness() {
+    if (!canary || !watcher || rebuilding || !watcherReady) return;
+    const priorDead = canary.consecutiveDead;
+    const verdict = canary.evaluate();
+    if (verdict === "dead") {
+      const streak = canary.consecutiveDead;
+      if (!isPowerOfTwo(streak)) return armCanary();
+      writeStderr(
+        `${CANARY_DEAD_LOG} after ${streak} consecutive interval(s): the watcher reported ready and emitted no error, but did not deliver its own canary write (${canary.filePath}). Treating it as DEAD and reconciling so changes are not silently missed.
+`
+      );
+      try {
+        updateState(cfg.projectRoot, {
+          lastError: `watcher liveness canary not echoed for ${streak} consecutive interval(s)`
+        });
+      } catch {
+      }
+      void forceReconciliation();
+      if (streak >= CANARY_DEAD_STRIKES_BEFORE_REBUILD) {
+        writeStderr(`${CANARY_REBUILD_LOG} after ${streak} dead interval(s) (close + re-watch)
+`);
+        void rebuildWatcher();
+        return;
+      }
+      return armCanary();
+    }
+    if (verdict === "alive" && priorDead > 0) {
+      writeStderr(`${CANARY_RECOVERED_LOG} after ${priorDead} dead interval(s)
+`);
+      try {
+        updateState(cfg.projectRoot, { lastError: null });
+      } catch {
+      }
+    }
+    armCanary();
   }
   function tick() {
     if (stopped) return;
@@ -25781,6 +26079,7 @@ async function startDaemon(projectRoot, hooks) {
 `);
       void forceReconciliation();
     }
+    checkWatcherLiveness();
   }
   if (!hooks.noWatcher) {
     const cfgYaml = getConfig();
@@ -25805,23 +26104,16 @@ async function startDaemon(projectRoot, hooks) {
       `[massu] watch surface: ${countLabel} files (cap ${cap}, opted-in: ${optedIn}, scan ${surfaceMs}ms, scope: ${globs.effectiveScope})
 `
     );
-    watcher = chokidar.watch(globs.watch, {
-      cwd: cfg.projectRoot,
-      ignored: globs.ignore,
-      ignoreInitial: true,
-      persistent: true,
-      awaitWriteFinish: false
-    });
-    watcher.on("all", (_event, path) => pushEvent(path));
-    watcher.on("error", (err) => {
-      const msg = err instanceof Error ? err.message : String(err);
-      writeStderr(`[massu] chokidar error: ${msg}
-`);
-      try {
-        updateState(cfg.projectRoot, { lastError: `chokidar: ${msg}` });
-      } catch {
-      }
-    });
+    canary = createWatcherCanary({ projectRoot: cfg.projectRoot, now });
+    try {
+      mkdirSync22(resolve23(cfg.projectRoot, canary.dirRel), { recursive: true });
+    } catch {
+    }
+    watchSpec = {
+      watch: [...globs.watch, canary.dirRel],
+      ignored: canaryAwareIgnore(globs.ignore, cfg.projectRoot)
+    };
+    watcher = createWatcherInstance();
   }
   resetConfig();
   try {
@@ -25833,15 +26125,16 @@ async function startDaemon(projectRoot, hooks) {
     });
   } catch {
   }
-  tickTimer = setInterval(tick, TICK_INTERVAL_MS);
+  tickTimer = setInterval(tick, hooks.tickIntervalMs ?? TICK_INTERVAL_MS);
   if (typeof tickTimer.unref === "function") tickTimer.unref();
   return { pushEvent, flushNow, stop, forceReconciliation };
 }
-var STORM_WINDOW_MS, DEEP_STORM_WINDOW_MS, STORM_WAIT_MS, DEEP_STORM_WAIT_MS, TICK_INTERVAL_MS, TICK_GAP_THRESHOLD_MS;
+var STORM_WINDOW_MS, DEEP_STORM_WINDOW_MS, STORM_WAIT_MS, DEEP_STORM_WAIT_MS, TICK_INTERVAL_MS, TICK_GAP_THRESHOLD_MS, STACK_RELEVANT_EVENTS;
 var init_daemon = __esm({
   "src/watch/daemon.ts"() {
     "use strict";
     init_config();
+    init_canary();
     init_lockfile_detector();
     init_paths();
     init_state();
@@ -25851,6 +26144,7 @@ var init_daemon = __esm({
     DEEP_STORM_WAIT_MS = 12e4;
     TICK_INTERVAL_MS = 1e4;
     TICK_GAP_THRESHOLD_MS = 3e4;
+    STACK_RELEVANT_EVENTS = /* @__PURE__ */ new Set(["add", "change", "unlink"]);
   }
 });
 
@@ -25863,8 +26157,8 @@ __export(watch_exports, {
   runWatch: () => runWatch
 });
 import { spawnSync as spawnSync5 } from "child_process";
-import { basename as basename8, dirname as dirname22, resolve as resolve22 } from "path";
-import { appendFileSync as appendFileSync4, existsSync as existsSync47, mkdirSync as mkdirSync21, readFileSync as readFileSync35 } from "fs";
+import { basename as basename8, dirname as dirname22, resolve as resolve24 } from "path";
+import { appendFileSync as appendFileSync4, existsSync as existsSync47, mkdirSync as mkdirSync23, readFileSync as readFileSync35 } from "fs";
 function parseFlags(args2) {
   const out = {
     foreground: false,
@@ -25889,7 +26183,7 @@ function parseFlags(args2) {
 }
 function findClaudeBg() {
   const home = process.env.HOME ?? "";
-  const fixed = home ? resolve22(home, ".claude", "bin", "claude-bg") : null;
+  const fixed = home ? resolve24(home, ".claude", "bin", "claude-bg") : null;
   if (fixed && existsSync47(fixed)) return fixed;
   const which = spawnSync5("which", ["claude-bg"], { encoding: "utf-8" });
   if (which.status === 0 && which.stdout) {
@@ -26033,7 +26327,7 @@ async function runForeground(root) {
     }
     throw err;
   }
-  return new Promise((resolve45) => {
+  return new Promise((resolve47) => {
     const shutdown = async () => {
       if (stopped) return;
       stopped = true;
@@ -26043,7 +26337,7 @@ async function runForeground(root) {
         process.chdir(priorCwd);
       } catch {
       }
-      resolve45({ exitCode: 0 });
+      resolve47({ exitCode: 0 });
     };
     process.on("SIGINT", () => {
       void shutdown();
@@ -26104,12 +26398,12 @@ async function runOnQuiescent(projectRoot) {
   );
 }
 function refreshLogPath(projectRoot) {
-  return resolve22(projectRoot, ".massu", "refresh-log.jsonl");
+  return resolve24(projectRoot, ".massu", "refresh-log.jsonl");
 }
 function appendRefreshLog(projectRoot, event) {
   const path = refreshLogPath(projectRoot);
   try {
-    mkdirSync21(dirname22(path), { recursive: true });
+    mkdirSync23(dirname22(path), { recursive: true });
     appendFileSync4(path, JSON.stringify(event) + "\n", "utf-8");
   } catch {
   }
@@ -26195,10 +26489,10 @@ import {
   closeSync as closeSync6,
   existsSync as existsSync48,
   fsyncSync as fsyncSync6,
-  mkdirSync as mkdirSync22,
+  mkdirSync as mkdirSync24,
   openSync as openSync6,
   renameSync as renameSync6,
-  rmSync as rmSync11,
+  rmSync as rmSync12,
   statSync as statSync16,
   writeSync as writeSync4
 } from "node:fs";
@@ -26212,7 +26506,7 @@ function atomicWrite(path, content, opts = {}) {
       if (opts.ensureParentDirMode !== void 0) {
         mkdirOpts.mode = opts.ensureParentDirMode;
       }
-      mkdirSync22(parentDir, mkdirOpts);
+      mkdirSync24(parentDir, mkdirOpts);
     }
     const buf = typeof content === "string" ? Buffer.from(content, "utf-8") : content;
     const openMode = opts.mode ?? 420;
@@ -26231,7 +26525,7 @@ function atomicWrite(path, content, opts = {}) {
   } catch (err) {
     if (existsSync48(tmpPath)) {
       try {
-        rmSync11(tmpPath, { force: true });
+        rmSync12(tmpPath, { force: true });
       } catch {
       }
     }
@@ -26580,13 +26874,13 @@ var init_fetcher = __esm({
 // src/security/manifest-cache.ts
 import { existsSync as existsSync49, readFileSync as readFileSync36, statSync as statSync17 } from "node:fs";
 import { homedir as homedir21 } from "node:os";
-import { resolve as resolve23 } from "node:path";
+import { resolve as resolve25 } from "node:path";
 import { z as z5 } from "zod";
 function defaultCachePaths() {
-  const dir = resolve23(homedir21(), ".massu");
+  const dir = resolve25(homedir21(), ".massu");
   return {
-    cachePath: resolve23(dir, "adapter-manifest.json"),
-    lockPath: resolve23(dir, ".adapter-manifest.lock")
+    cachePath: resolve25(dir, "adapter-manifest.json"),
+    lockPath: resolve25(dir, ".adapter-manifest.lock")
   };
 }
 function loadCachedManifest(paths = defaultCachePaths()) {
@@ -26786,13 +27080,13 @@ var init_adapter_origin = __esm({
 // src/security/local-fingerprint.ts
 import { existsSync as existsSync50, readFileSync as readFileSync37, lstatSync as lstatSync5 } from "node:fs";
 import { homedir as homedir22 } from "node:os";
-import { resolve as resolve24, isAbsolute as isAbsolute3 } from "node:path";
+import { resolve as resolve26, isAbsolute as isAbsolute4 } from "node:path";
 import { createHash as createHash14 } from "node:crypto";
 import { z as z6 } from "zod";
 function computeLocalFingerprint(localPaths, projectRoot) {
   const tuples = [];
   for (const p19 of localPaths) {
-    const abs = isAbsolute3(p19) ? p19 : resolve24(projectRoot, p19);
+    const abs = isAbsolute4(p19) ? p19 : resolve26(projectRoot, p19);
     let contentTag;
     try {
       const lst = lstatSync5(abs);
@@ -26864,7 +27158,7 @@ var init_local_fingerprint = __esm({
     "use strict";
     init_atomic_write();
     init_manifest_schema();
-    FINGERPRINT_PATH = resolve24(homedir22(), ".massu", "adapters-local-fingerprint.json");
+    FINGERPRINT_PATH = resolve26(homedir22(), ".massu", "adapters-local-fingerprint.json");
     FingerprintSentinelSchema = z6.object({
       fingerprint: z6.string().regex(/^[0-9a-f]{64}$/),
       source: z6.enum(["cli", "cli-resync"]),
@@ -26881,9 +27175,9 @@ var init_local_fingerprint = __esm({
 
 // src/security/install-tracking.ts
 import { readFileSync as readFileSync38, readdirSync as readdirSync17, lstatSync as lstatSync6, existsSync as existsSync51 } from "node:fs";
-import { join as join28, relative as relative7, sep as sep2 } from "node:path";
+import { join as join28, relative as relative8, sep as sep3 } from "node:path";
 import { homedir as homedir23 } from "node:os";
-import { resolve as resolve25 } from "node:path";
+import { resolve as resolve27 } from "node:path";
 import { createHash as createHash15 } from "node:crypto";
 import { z as z7 } from "zod";
 function containsHiddenDirs(packageDir) {
@@ -26926,7 +27220,7 @@ function sha256OfDir(dir, opts = {}) {
           `sha256OfDir: file ${absPath} exceeds maxFileBytes (${lst.size} > ${maxFileBytes}); adapter packages should not ship files this large.`
         );
       }
-      const rel = relative7(dir, absPath).split(sep2).join("/");
+      const rel = relative8(dir, absPath).split(sep3).join("/");
       files.push({ relativePath: rel, absPath });
     }
   }
@@ -27010,7 +27304,7 @@ var init_install_tracking = __esm({
   "src/security/install-tracking.ts"() {
     "use strict";
     init_atomic_write();
-    INSTALLED_MANIFEST_PATH = resolve25(homedir23(), ".massu", "adapter-manifest-installed.json");
+    INSTALLED_MANIFEST_PATH = resolve27(homedir23(), ".massu", "adapter-manifest-installed.json");
     DEFAULT_MAX_FILE_BYTES = 64 * 1024 * 1024;
     EXCLUDED_DIR_NAMES = /* @__PURE__ */ new Set([".git", "node_modules", ".cache", ".tmp"]);
     InstallEntrySchema = z7.object({
@@ -27034,10 +27328,10 @@ var init_install_tracking = __esm({
 
 // src/detect/adapters/discover.ts
 import { existsSync as existsSync52, readdirSync as readdirSync18, readFileSync as readFileSync39, lstatSync as lstatSync7 } from "node:fs";
-import { resolve as resolve26, isAbsolute as isAbsolute4 } from "node:path";
+import { resolve as resolve28, isAbsolute as isAbsolute5 } from "node:path";
 import { z as z8 } from "zod";
 function walkNodeModules(projectRoot, warnings) {
-  const nodeModulesDir = resolve26(projectRoot, "node_modules");
+  const nodeModulesDir = resolve28(projectRoot, "node_modules");
   if (!existsSync52(nodeModulesDir)) {
     return [];
   }
@@ -27051,7 +27345,7 @@ function walkNodeModules(projectRoot, warnings) {
   }
   for (const entry of topLevelEntries) {
     if (entry.startsWith(".")) continue;
-    const entryPath = resolve26(nodeModulesDir, entry);
+    const entryPath = resolve28(nodeModulesDir, entry);
     let entryStat;
     try {
       entryStat = lstatSync7(entryPath);
@@ -27073,7 +27367,7 @@ function walkNodeModules(projectRoot, warnings) {
         continue;
       }
       for (const sub of scopedEntries) {
-        const subPath = resolve26(entryPath, sub);
+        const subPath = resolve28(entryPath, sub);
         let subStat;
         try {
           subStat = lstatSync7(subPath);
@@ -27092,7 +27386,7 @@ function walkNodeModules(projectRoot, warnings) {
   return candidates;
 }
 function tryReadAdapterPackage(packageDir, warnings) {
-  const pkgJsonPath = resolve26(packageDir, "package.json");
+  const pkgJsonPath = resolve28(packageDir, "package.json");
   if (!existsSync52(pkgJsonPath)) return null;
   let raw;
   try {
@@ -27230,7 +27524,7 @@ function discoverAdapters(opts) {
   const localSet = new Set(opts.configLocalPaths);
   for (const localPath of opts.configLocalPaths) {
     if (seenIds.has(localPath)) continue;
-    const absPath = isAbsolute4(localPath) ? localPath : resolve26(opts.projectRoot, localPath);
+    const absPath = isAbsolute5(localPath) ? localPath : resolve28(opts.projectRoot, localPath);
     if (!existsSync52(absPath)) {
       warnings.push(
         `local adapter file not found: ${localPath} (resolved to ${absPath}). Remove via: massu adapters remove-local ${localPath}`
@@ -27314,7 +27608,7 @@ __export(adapters_exports, {
   runAdaptersSearch: () => runAdaptersSearch
 });
 import { existsSync as existsSync53, readFileSync as readFileSync40 } from "node:fs";
-import { resolve as resolve27 } from "node:path";
+import { resolve as resolve29 } from "node:path";
 import { parseDocument } from "yaml";
 async function handleAdaptersSubcommand(args2) {
   const sub = args2[0];
@@ -27581,7 +27875,7 @@ function mutateLocalArray(mutator, command) {
     );
     return { exitCode: 2 };
   }
-  const yamlPath = resolve27(projectRoot, "massu.config.yaml");
+  const yamlPath = resolve29(projectRoot, "massu.config.yaml");
   if (!existsSync53(yamlPath)) {
     process.stderr.write(
       `${command}: massu.config.yaml not found at ${yamlPath}. Run \`massu init\` first.
@@ -27612,7 +27906,7 @@ function mutateLocalArray(mutator, command) {
   if (next === null) {
     return { exitCode: 0 };
   }
-  const lockPath = resolve27(projectRoot, ".massu", "adapters-local-mutate.lock");
+  const lockPath = resolve29(projectRoot, ".massu", "adapters-local-mutate.lock");
   return withFileLockSync(lockPath, () => {
     doc.setIn(["adapters", "local"], next);
     const newYaml = doc.toString();
@@ -27681,7 +27975,7 @@ async function runAdaptersInstall(args2) {
 `);
     return { exitCode: 1 };
   }
-  const packageDir = resolve27(projectRoot, "node_modules", ...packageName.split("/"));
+  const packageDir = resolve29(projectRoot, "node_modules", ...packageName.split("/"));
   if (!existsSync53(packageDir)) {
     process.stderr.write(
       `install: ${packageName} is not installed in node_modules. Run \`npm install ${packageName}\` first.
@@ -27689,7 +27983,7 @@ async function runAdaptersInstall(args2) {
     );
     return { exitCode: 1 };
   }
-  const pkgJsonPath = resolve27(packageDir, "package.json");
+  const pkgJsonPath = resolve29(packageDir, "package.json");
   if (!existsSync53(pkgJsonPath)) {
     process.stderr.write(`install: ${packageName} has no package.json at ${pkgJsonPath}
 `);
@@ -27816,7 +28110,7 @@ async function runAdaptersResign(_args) {
       removeInstalledManifestEntry(name);
       continue;
     }
-    const packageDir = resolve27(projectRoot, "node_modules", ...name.split("/"));
+    const packageDir = resolve29(projectRoot, "node_modules", ...name.split("/"));
     if (!existsSync53(packageDir)) {
       removed++;
       warnings.push(`${name}@${entry.version}: not present in node_modules \u2014 REMOVED from sidecar`);
@@ -27915,7 +28209,7 @@ var init_sql_table_names = __esm({
 
 // src/db.ts
 import { dirname as dirname24, join as join29 } from "path";
-import { existsSync as existsSync54, mkdirSync as mkdirSync23, readdirSync as readdirSync19, statSync as statSync18 } from "fs";
+import { existsSync as existsSync54, mkdirSync as mkdirSync25, readdirSync as readdirSync19, statSync as statSync18 } from "fs";
 function getCodeGraphDb() {
   const dbPath = getResolvedPaths().codegraphDbPath;
   assertCodegraphUsable(dbPath);
@@ -27927,7 +28221,7 @@ function getDataDb() {
   const dbPath = getResolvedPaths().dataDbPath;
   const dir = dirname24(dbPath);
   if (!existsSync54(dir)) {
-    mkdirSync23(dir, { recursive: true });
+    mkdirSync25(dir, { recursive: true });
   }
   const db = openDatabase2(dbPath);
   db.pragma("journal_mode = WAL");
@@ -28181,12 +28475,23 @@ function initDataSchema(db) {
     END;
   `);
 }
+function codegraphIndexedAtToEpochMs(raw) {
+  const ceiling = Date.now() + CODEGRAPH_TS_SKEW_MS;
+  const asMs = raw;
+  const asSeconds = raw * 1e3;
+  if (asMs >= CODEGRAPH_TS_FLOOR_MS && asMs <= ceiling) return asMs;
+  if (asSeconds >= CODEGRAPH_TS_FLOOR_MS && asSeconds <= ceiling) return asSeconds;
+  const describe = (ms) => Number.isFinite(ms) && Math.abs(ms) <= 864e13 ? new Date(ms).toISOString() : "out of representable range";
+  throw new Error(
+    `CodeGraph files.indexed_at=${raw} is implausible as both milliseconds (${describe(asMs)}) and seconds (${describe(asSeconds)}). Expected a timestamp between ${new Date(CODEGRAPH_TS_FLOOR_MS).toISOString()} and now. The CodeGraph engine's timestamp format may have changed \u2014 do not guess the unit.`
+  );
+}
 function isDataStale(dataDb, codegraphDb) {
   const lastBuild = dataDb.prepare(`SELECT value FROM ${t("meta")} WHERE key = 'last_build_time'`).get();
   if (!lastBuild) return true;
   const latestIndexed = codegraphDb.prepare("SELECT MAX(indexed_at) as latest FROM files").get();
   if (!latestIndexed?.latest) return true;
-  return latestIndexed.latest * 1e3 > new Date(lastBuild.value).getTime();
+  return codegraphIndexedAtToEpochMs(latestIndexed.latest) > new Date(lastBuild.value).getTime();
 }
 function updateBuildTimestamp(dataDb) {
   dataDb.prepare(`INSERT OR REPLACE INTO ${t("meta")} (key, value) VALUES ('last_build_time', ?)`).run((/* @__PURE__ */ new Date()).toISOString());
@@ -28216,6 +28521,7 @@ function isPythonDataStale(dataDb, pythonRoot) {
 function updatePythonBuildTimestamp(dataDb) {
   dataDb.prepare(`INSERT OR REPLACE INTO ${t("py_meta")} (key, value) VALUES ('last_build_time', ?)`).run((/* @__PURE__ */ new Date()).toISOString());
 }
+var CODEGRAPH_TS_FLOOR_MS, CODEGRAPH_TS_SKEW_MS;
 var init_db2 = __esm({
   "src/db.ts"() {
     "use strict";
@@ -28224,14 +28530,16 @@ var init_db2 = __esm({
     init_config();
     init_sql_table_names();
     init_preflight();
+    CODEGRAPH_TS_FLOOR_MS = 15778368e5;
+    CODEGRAPH_TS_SKEW_MS = 864e5;
   }
 });
 
 // src/security-utils.ts
-import { resolve as resolve28, normalize } from "path";
+import { resolve as resolve30, normalize } from "path";
 function ensureWithinRoot(filePath, projectRoot) {
-  const resolvedRoot = resolve28(projectRoot);
-  const resolvedPath = resolve28(resolvedRoot, filePath);
+  const resolvedRoot = resolve30(projectRoot);
+  const resolvedPath = resolve30(resolvedRoot, filePath);
   const normalizedPath = normalize(resolvedPath);
   const normalizedRoot = normalize(resolvedRoot);
   if (!normalizedPath.startsWith(normalizedRoot + "/") && normalizedPath !== normalizedRoot) {
@@ -28303,9 +28611,125 @@ var init_rules = __esm({
   }
 });
 
+// src/lib/source-layout.ts
+function normalizeDir(raw) {
+  if (typeof raw !== "string") return null;
+  const posix = raw.replace(/\\/g, "/");
+  if (posix.startsWith("/") || /^[A-Za-z]:\//.test(posix)) return null;
+  const parts = posix.split("/").filter((p19) => p19 !== "" && p19 !== ".");
+  if (parts.some((p19) => p19 === "..")) return null;
+  if (parts.length === 0) return ".";
+  return parts.join("/");
+}
+function declaredLanguageSourceDirs() {
+  const languages = getConfig().framework.languages;
+  if (!languages) return [];
+  const out = [];
+  for (const entry of Object.values(languages)) {
+    if (Array.isArray(entry.source_dirs)) out.push(...entry.source_dirs);
+  }
+  return out;
+}
+function getSourceLayout() {
+  const config = getConfig();
+  const paths = config.paths;
+  const declared = [
+    paths.source,
+    ...paths.monorepo_roots ?? [],
+    ...declaredLanguageSourceDirs()
+  ];
+  const normalized = declared.map(normalizeDir).filter((d2) => d2 !== null);
+  const includesRoot = normalized.includes(".");
+  const sourceDirs = includesRoot ? [] : [...new Set(normalized)].sort();
+  const source = normalizeDir(paths.source) ?? ".";
+  const under = (child) => source === "." ? child : `${source}/${child}`;
+  return {
+    sourceDirs,
+    includesRoot,
+    extensions: getResolvedPaths().extensions,
+    pagesDir: normalizeDir(paths.pages ?? under("app")) ?? under("app"),
+    componentsDir: normalizeDir(paths.components ?? under("components")) ?? under("components")
+  };
+}
+function escapeLike(literal) {
+  return literal.replace(/[\\%_]/g, (m3) => `\\${m3}`);
+}
+function assertIdentifier(column) {
+  if (!/^[A-Za-z_][A-Za-z0-9_]*$/.test(column)) {
+    throw new Error(`source-layout: refusing to interpolate '${column}' as a SQL column name`);
+  }
+  return column;
+}
+function likeAny(column, patterns) {
+  if (patterns.length === 0) return { sql: "1=0", params: [] };
+  const col = assertIdentifier(column);
+  const sql = patterns.map(() => `${col} LIKE ? ESCAPE '\\'`).join(" OR ");
+  return { sql: `(${sql})`, params: patterns };
+}
+function sourceDirPredicate(column = "path", layout = getSourceLayout()) {
+  if (layout.includesRoot) return { sql: `(${assertIdentifier(column)} IS NOT NULL)`, params: [] };
+  return likeAny(column, layout.sourceDirs.map((d2) => `${escapeLike(d2)}/%`));
+}
+function sourceFilePredicate(column = "path", layout = getSourceLayout()) {
+  const dirs = sourceDirPredicate(column, layout);
+  const exts = likeAny(column, layout.extensions.map((e2) => `%${escapeLike(e2)}`));
+  return {
+    sql: `${dirs.sql} AND ${exts.sql}`,
+    params: [...dirs.params, ...exts.params]
+  };
+}
+function pagesPredicate(layout = getSourceLayout()) {
+  const dir = escapeLike(layout.pagesDir);
+  return {
+    sql: `(path LIKE ? ESCAPE '\\' OR path = ?)`,
+    params: [`${dir}/%/page.tsx`, `${layout.pagesDir}/page.tsx`]
+  };
+}
+function componentsPredicate(layout = getSourceLayout()) {
+  return {
+    sql: `path LIKE ? ESCAPE '\\'`,
+    params: [`${escapeLike(layout.componentsDir)}/%`]
+  };
+}
+function isUnderSourceDir(path, layout = getSourceLayout()) {
+  if (normalizeDir(path) === null) return false;
+  if (layout.includesRoot) return true;
+  return layout.sourceDirs.some((d2) => path.startsWith(`${d2}/`));
+}
+function assertSourceCandidateSet(codegraphDb, builder, layout = getSourceLayout()) {
+  const present = codegraphDb.prepare("SELECT COUNT(*) AS n FROM files").get().n;
+  if (present === 0) return;
+  const pred = sourceDirPredicate("path", layout);
+  const matched = codegraphDb.prepare(`SELECT COUNT(*) AS n FROM files WHERE ${pred.sql}`).get(...pred.params).n;
+  if (matched > 0) return;
+  const prefixes = codegraphDb.prepare(
+    `SELECT CASE WHEN instr(path, '/') > 0 THEN substr(path, 1, instr(path, '/') - 1) ELSE '<root>' END AS prefix,
+              COUNT(*) AS n
+         FROM files GROUP BY prefix ORDER BY n DESC LIMIT 20`
+  ).all();
+  const declared = layout.includesRoot ? "<project root>" : layout.sourceDirs.join(", ") || "<none>";
+  const found = prefixes.map((p19) => `${p19.prefix} (${p19.n})`).join(", ") || "<none>";
+  throw new CandidateSetContractError(
+    `${builder}: declared source dirs match 0 of ${present} indexed files. Declared: ${declared}. Present in CodeGraph: ${found}. Declare the real layout in massu.config.yaml (paths.source, paths.monorepo_roots, or framework.languages.<lang>.source_dirs) \u2014 an index built from an empty candidate set is indistinguishable from a project with no imports.`
+  );
+}
+var CandidateSetContractError;
+var init_source_layout = __esm({
+  "src/lib/source-layout.ts"() {
+    "use strict";
+    init_config();
+    CandidateSetContractError = class extends Error {
+      constructor(message) {
+        super(message);
+        this.name = "CandidateSetContractError";
+      }
+    };
+  }
+});
+
 // src/import-resolver.ts
 import { readFileSync as readFileSync41, existsSync as existsSync55, statSync as statSync19 } from "fs";
-import { resolve as resolve29, dirname as dirname25, join as join30 } from "path";
+import { resolve as resolve31, dirname as dirname25, join as join30 } from "path";
 function parseImports(source) {
   const imports = [];
   const lines = source.split("\n");
@@ -28361,24 +28785,24 @@ function resolveImportPath(specifier, fromFile) {
   let basePath;
   if (specifier.startsWith("@/")) {
     const paths = getResolvedPaths();
-    basePath = resolve29(paths.pathAlias["@"] ?? paths.srcDir, specifier.slice(2));
+    basePath = resolve31(paths.pathAlias["@"] ?? paths.srcDir, specifier.slice(2));
   } else {
-    basePath = resolve29(dirname25(fromFile), specifier);
+    basePath = resolve31(dirname25(fromFile), specifier);
   }
   if (existsSync55(basePath) && !isDirectory(basePath)) {
-    return toRelative(basePath);
+    return toRelative2(basePath);
   }
   const resolvedPaths = getResolvedPaths();
   for (const ext of resolvedPaths.extensions) {
     const withExt = basePath + ext;
     if (existsSync55(withExt)) {
-      return toRelative(withExt);
+      return toRelative2(withExt);
     }
   }
   for (const indexFile of resolvedPaths.indexFiles) {
     const indexPath = join30(basePath, indexFile);
     if (existsSync55(indexPath)) {
-      return toRelative(indexPath);
+      return toRelative2(indexPath);
     }
   }
   return null;
@@ -28390,7 +28814,7 @@ function isDirectory(path) {
     return false;
   }
 }
-function toRelative(absPath) {
+function toRelative2(absPath) {
   const root = getProjectRoot();
   if (absPath.startsWith(root)) {
     return absPath.slice(root.length + 1);
@@ -28398,7 +28822,15 @@ function toRelative(absPath) {
   return absPath;
 }
 function buildImportIndex(dataDb, codegraphDb) {
-  const files = codegraphDb.prepare("SELECT path FROM files WHERE path LIKE 'src/%'").all();
+  assertSourceCandidateSet(codegraphDb, "buildImportIndex");
+  const filesPredicate = sourceFilePredicate();
+  const FILE_SCAN_LIMIT = 2e5;
+  const files = codegraphDb.prepare(`SELECT path FROM files WHERE ${filesPredicate.sql} LIMIT ${FILE_SCAN_LIMIT}`).all(...filesPredicate.params);
+  if (files.length === FILE_SCAN_LIMIT) {
+    throw new Error(
+      `buildImportIndex: candidate set hit the ${FILE_SCAN_LIMIT}-row scan limit, so the import index would be built from a truncated file list. Narrow the declared source dirs in massu.config.yaml, or raise FILE_SCAN_LIMIT deliberately.`
+    );
+  }
   dataDb.exec(`DELETE FROM ${t("imports")}`);
   const insertStmt = dataDb.prepare(
     `INSERT INTO ${t("imports")} (source_file, target_file, import_type, imported_names, line) VALUES (?, ?, ?, ?, ?)`
@@ -28413,7 +28845,7 @@ function buildImportIndex(dataDb, codegraphDb) {
   const batchSize = 500;
   let batch = [];
   for (const file of files) {
-    const absPath = ensureWithinRoot(resolve29(projectRoot, file.path), projectRoot);
+    const absPath = ensureWithinRoot(resolve31(projectRoot, file.path), projectRoot);
     if (!existsSync55(absPath)) continue;
     let source;
     try {
@@ -28450,12 +28882,13 @@ var init_import_resolver = __esm({
     init_config();
     init_security_utils();
     init_sql_table_names();
+    init_source_layout();
   }
 });
 
 // src/trpc-index.ts
 import { readFileSync as readFileSync42, existsSync as existsSync56, readdirSync as readdirSync20 } from "fs";
-import { resolve as resolve30, join as join31 } from "path";
+import { resolve as resolve32, join as join31 } from "path";
 function parseRootRouter() {
   const paths = getResolvedPaths();
   const rootPath = paths.rootRouterPath;
@@ -28470,7 +28903,7 @@ function parseRootRouter() {
   while ((match = importRegex.exec(source)) !== null) {
     const variable = match[1];
     let filePath = match[2];
-    const fullPath = resolve30(paths.routersDir, filePath);
+    const fullPath = resolve32(paths.routersDir, filePath);
     for (const ext of [".ts", ".tsx", ""]) {
       const candidate = fullPath + ext;
       const routersRelPath = getConfig().paths.routers ?? "src/server/api/routers";
@@ -28498,7 +28931,7 @@ function parseRootRouter() {
   return mappings;
 }
 function extractProcedures(routerFilePath) {
-  const absPath = resolve30(getProjectRoot(), routerFilePath);
+  const absPath = resolve32(getProjectRoot(), routerFilePath);
   if (!existsSync56(absPath)) return [];
   const source = readFileSync42(absPath, "utf-8");
   const procedures = [];
@@ -28523,9 +28956,9 @@ function findUICallSites(routerKey, procedureName) {
   const root = getProjectRoot();
   const src = config.paths.source;
   const searchDirs = [
-    resolve30(root, config.paths.pages ?? src + "/app"),
-    resolve30(root, config.paths.components ?? src + "/components"),
-    resolve30(root, config.paths.hooks ?? src + "/hooks")
+    resolve32(root, config.paths.pages ?? src + "/app"),
+    resolve32(root, config.paths.components ?? src + "/components"),
+    resolve32(root, config.paths.hooks ?? src + "/hooks")
   ];
   const searchPattern = `api.${routerKey}.${procedureName}`;
   for (const dir of searchDirs) {
@@ -28608,9 +29041,11 @@ var init_trpc_index = __esm({
 
 // src/page-deps.ts
 import { readFileSync as readFileSync43, existsSync as existsSync57 } from "fs";
-import { resolve as resolve31 } from "path";
+import { resolve as resolve33 } from "path";
 function deriveRoute(pageFile) {
-  let route = pageFile.replace(/^src\/app/, "").replace(/\/page\.tsx?$/, "").replace(/\/page\.jsx?$/, "");
+  const pagesDir = getSourceLayout().pagesDir;
+  const prefix3 = pagesDir.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+  let route = pageFile.replace(new RegExp(`^${prefix3}`), "").replace(/\/page\.tsx?$/, "").replace(/\/page\.jsx?$/, "");
   return route || "/";
 }
 function derivePortal(route) {
@@ -28637,7 +29072,7 @@ function traceImports(startFile, dataDb, visited, components, hooks, maxDepth =
     if (target.includes("/hooks/") || target.match(/use[A-Z]/)) {
       hooks.add(target);
     }
-    if (target.startsWith("src/")) {
+    if (isUnderSourceDir(target)) {
       traceImports(target, dataDb, visited, components, hooks, maxDepth - 1);
     }
   }
@@ -28646,7 +29081,7 @@ function findRouterCalls(files) {
   const routers = /* @__PURE__ */ new Set();
   const projectRoot = getProjectRoot();
   for (const file of files) {
-    const absPath = ensureWithinRoot(resolve31(projectRoot, file), projectRoot);
+    const absPath = ensureWithinRoot(resolve33(projectRoot, file), projectRoot);
     if (!existsSync57(absPath)) continue;
     try {
       const source = readFileSync43(absPath, "utf-8");
@@ -28667,7 +29102,7 @@ function findTablesFromRouters(routerNames, dataDb) {
       `SELECT DISTINCT router_file FROM ${t("trpc_procedures")} WHERE router_name = ? LIMIT 10000`
     ).all(routerName);
     for (const proc of procs) {
-      const absPath = ensureWithinRoot(resolve31(getProjectRoot(), proc.router_file), getProjectRoot());
+      const absPath = ensureWithinRoot(resolve33(getProjectRoot(), proc.router_file), getProjectRoot());
       if (!existsSync57(absPath)) continue;
       try {
         const source = readFileSync43(absPath, "utf-8");
@@ -28685,10 +29120,12 @@ function findTablesFromRouters(routerNames, dataDb) {
   return [...tables];
 }
 function buildPageDeps(dataDb, codegraphDb) {
+  assertSourceCandidateSet(codegraphDb, "buildPageDeps");
   dataDb.exec(`DELETE FROM ${t("page_deps")}`);
+  const pagesPred = pagesPredicate();
   const pages = codegraphDb.prepare(
-    "SELECT path FROM files WHERE path LIKE 'src/app/%/page.tsx' OR path = 'src/app/page.tsx' LIMIT 10000"
-  ).all();
+    `SELECT path FROM files WHERE ${pagesPred.sql} LIMIT 10000`
+  ).all(...pagesPred.params);
   const insertStmt = dataDb.prepare(
     `INSERT INTO ${t("page_deps")} (page_file, route, portal, components, hooks, routers, tables_touched) VALUES (?, ?, ?, ?, ?, ?, ?)`
   );
@@ -28783,6 +29220,7 @@ var init_page_deps = __esm({
     init_config();
     init_security_utils();
     init_sql_table_names();
+    init_source_layout();
   }
 });
 
@@ -28801,7 +29239,7 @@ function buildMiddlewareTree(dataDb) {
       `SELECT target_file FROM ${t("imports")} WHERE source_file = ? LIMIT 10000`
     ).all(current);
     for (const imp of imports) {
-      if (!visited.has(imp.target_file) && imp.target_file.startsWith("src/")) {
+      if (!visited.has(imp.target_file) && isUnderSourceDir(imp.target_file)) {
         visited.add(imp.target_file);
         queue.push(imp.target_file);
       }
@@ -28825,6 +29263,7 @@ var init_middleware_tree = __esm({
     "use strict";
     init_config();
     init_sql_table_names();
+    init_source_layout();
   }
 });
 
@@ -28882,12 +29321,11 @@ function globMatchSimple(name, pattern) {
 }
 function findCrossDomainImports(dataDb) {
   const domains = getDomains();
-  const config = getConfig();
-  const srcPrefix = config.paths.source;
-  const srcPattern = srcPrefix + "/%";
+  const srcSource = sourceDirPredicate("source_file");
+  const srcTarget = sourceDirPredicate("target_file");
   const imports = dataDb.prepare(
-    `SELECT source_file, target_file FROM ${t("imports")} WHERE source_file LIKE ? AND target_file LIKE ? LIMIT 10000`
-  ).all(srcPattern, srcPattern);
+    `SELECT source_file, target_file FROM ${t("imports")} WHERE ${srcSource.sql} AND ${srcTarget.sql} LIMIT 10000`
+  ).all(...srcSource.params, ...srcTarget.params);
   const crossings = [];
   for (const imp of imports) {
     const sourceDomain = classifyFile(imp.source_file);
@@ -28912,10 +29350,9 @@ function getFilesInDomain(dataDb, codegraphDb, domainName) {
   const config = getConfig();
   const domain = domains.find((d2) => d2.name === domainName);
   if (!domain) return { routers: [], pages: [], components: [] };
-  const srcPrefix = config.paths.source;
   const routersPath = config.paths.routers ?? "src/server/api/routers";
-  const srcPattern = srcPrefix + "/%";
-  const allFiles = codegraphDb.prepare("SELECT path FROM files WHERE path LIKE ?").all(srcPattern);
+  const srcPred = sourceDirPredicate();
+  const allFiles = codegraphDb.prepare(`SELECT path FROM files WHERE ${srcPred.sql} LIMIT 200000`).all(...srcPred.params);
   const routers = [];
   const pages = [];
   const components = [];
@@ -28938,6 +29375,7 @@ var init_domains = __esm({
     init_rules();
     init_config();
     init_sql_table_names();
+    init_source_layout();
   }
 });
 
@@ -29223,11 +29661,11 @@ var init_import_parser = __esm({
 
 // src/python/import-resolver.ts
 import { readFileSync as readFileSync45, existsSync as existsSync59, readdirSync as readdirSync22 } from "fs";
-import { resolve as resolve33, join as join33, relative as relative8, dirname as dirname26 } from "path";
+import { resolve as resolve35, join as join33, relative as relative9, dirname as dirname26 } from "path";
 function resolvePythonModulePath(module, fromFile, pythonRoot, level) {
   const projectRoot = getProjectRoot();
   if (level > 0) {
-    let baseDir = dirname26(resolve33(projectRoot, fromFile));
+    let baseDir = dirname26(resolve35(projectRoot, fromFile));
     for (let i = 1; i < level; i++) {
       baseDir = dirname26(baseDir);
     }
@@ -29239,18 +29677,18 @@ function resolvePythonModulePath(module, fromFile, pythonRoot, level) {
     return tryResolvePythonPath(baseDir, projectRoot);
   }
   const parts = module.split(".");
-  const candidate = join33(resolve33(projectRoot, pythonRoot), ...parts);
+  const candidate = join33(resolve35(projectRoot, pythonRoot), ...parts);
   return tryResolvePythonPath(candidate, projectRoot);
 }
 function tryResolvePythonPath(basePath, projectRoot) {
   if (existsSync59(basePath + ".py")) {
-    return relative8(projectRoot, basePath + ".py");
+    return relative9(projectRoot, basePath + ".py");
   }
   if (existsSync59(join33(basePath, "__init__.py"))) {
-    return relative8(projectRoot, join33(basePath, "__init__.py"));
+    return relative9(projectRoot, join33(basePath, "__init__.py"));
   }
   if (basePath.endsWith(".py") && existsSync59(basePath)) {
-    return relative8(projectRoot, basePath);
+    return relative9(projectRoot, basePath);
   }
   return null;
 }
@@ -29272,7 +29710,7 @@ function walkPythonFiles(dir, excludeDirs) {
 }
 function buildPythonImportIndex(dataDb, pythonRoot, excludeDirs = ["__pycache__", ".venv", "venv", ".mypy_cache", ".pytest_cache"]) {
   const projectRoot = getProjectRoot();
-  const absRoot = resolve33(projectRoot, pythonRoot);
+  const absRoot = resolve35(projectRoot, pythonRoot);
   dataDb.exec(`DELETE FROM ${t("py_imports")}`);
   const insertStmt = dataDb.prepare(
     `INSERT INTO ${t("py_imports")} (source_file, target_file, import_type, imported_names, line) VALUES (?, ?, ?, ?, ?)`
@@ -29286,7 +29724,7 @@ function buildPythonImportIndex(dataDb, pythonRoot, excludeDirs = ["__pycache__"
   });
   const batch = [];
   for (const absFile of files) {
-    const relFile = relative8(projectRoot, absFile);
+    const relFile = relative9(projectRoot, absFile);
     let source;
     try {
       source = readFileSync45(absFile, "utf-8");
@@ -29557,7 +29995,7 @@ var init_route_parser = __esm({
 
 // src/python/route-indexer.ts
 import { readFileSync as readFileSync46, readdirSync as readdirSync23 } from "fs";
-import { join as join34, relative as relative9 } from "path";
+import { join as join34, relative as relative10 } from "path";
 function walkPyFiles(dir, excludeDirs) {
   const files = [];
   try {
@@ -29586,7 +30024,7 @@ function buildPythonRouteIndex(dataDb, pythonRoot, excludeDirs = ["__pycache__",
   let count = 0;
   dataDb.transaction(() => {
     for (const absFile of files) {
-      const relFile = relative9(projectRoot, absFile);
+      const relFile = relative10(projectRoot, absFile);
       let source;
       try {
         source = readFileSync46(absFile, "utf-8");
@@ -29802,7 +30240,7 @@ var init_model_parser = __esm({
 
 // src/python/model-indexer.ts
 import { readFileSync as readFileSync47, readdirSync as readdirSync24 } from "fs";
-import { join as join35, relative as relative10 } from "path";
+import { join as join35, relative as relative11 } from "path";
 function walkPyFiles2(dir, excludeDirs) {
   const files = [];
   try {
@@ -29834,7 +30272,7 @@ function buildPythonModelIndex(dataDb, pythonRoot, excludeDirs = ["__pycache__",
   let count = 0;
   dataDb.transaction(() => {
     for (const absFile of files) {
-      const relFile = relative10(projectRoot, absFile);
+      const relFile = relative11(projectRoot, absFile);
       let source;
       try {
         source = readFileSync47(absFile, "utf-8");
@@ -30099,7 +30537,7 @@ var init_migration_parser = __esm({
 
 // src/python/migration-indexer.ts
 import { readFileSync as readFileSync48, readdirSync as readdirSync25 } from "fs";
-import { join as join36, relative as relative11 } from "path";
+import { join as join36, relative as relative12 } from "path";
 function buildPythonMigrationIndex(dataDb, alembicDir) {
   const projectRoot = getProjectRoot();
   const absDir = join36(projectRoot, alembicDir);
@@ -30135,7 +30573,7 @@ function buildPythonMigrationIndex(dataDb, alembicDir) {
     rows.push({
       revision: parsed.revision,
       downRevision: parsed.downRevision,
-      file: relative11(projectRoot, absFile),
+      file: relative12(projectRoot, absFile),
       description: parsed.description,
       operations: JSON.stringify(parsed.operations)
     });
@@ -30160,7 +30598,7 @@ var init_migration_indexer = __esm({
 
 // src/python/coupling-detector.ts
 import { readFileSync as readFileSync49, readdirSync as readdirSync26 } from "fs";
-import { join as join37, relative as relative12 } from "path";
+import { join as join37, relative as relative13 } from "path";
 function buildPythonCouplingIndex(dataDb) {
   const projectRoot = getProjectRoot();
   const config = getConfig();
@@ -30193,7 +30631,7 @@ function buildPythonCouplingIndex(dataDb) {
   ];
   dataDb.transaction(() => {
     for (const absFile of frontendFiles) {
-      const relFile = relative12(projectRoot, absFile);
+      const relFile = relative13(projectRoot, absFile);
       let source;
       try {
         source = readFileSync49(absFile, "utf-8");
@@ -30603,7 +31041,7 @@ var init_memory_tools = __esm({
 
 // src/docs-tools.ts
 import { readFileSync as readFileSync50, existsSync as existsSync60 } from "fs";
-import { resolve as resolve34, basename as basename9 } from "path";
+import { resolve as resolve36, basename as basename9 } from "path";
 function p4(baseName) {
   return `${getConfig().toolPrefix}_${baseName}`;
 }
@@ -30731,9 +31169,9 @@ function extractFrontmatter(content) {
 }
 function extractProcedureNames(routerPath) {
   const root = getProjectRoot();
-  const absPath = ensureWithinRoot(resolve34(getResolvedPaths().srcDir, "..", routerPath), root);
+  const absPath = ensureWithinRoot(resolve36(getResolvedPaths().srcDir, "..", routerPath), root);
   if (!existsSync60(absPath)) {
-    const altPath = ensureWithinRoot(resolve34(getResolvedPaths().srcDir, "../server/api/routers", basename9(routerPath)), root);
+    const altPath = ensureWithinRoot(resolve36(getResolvedPaths().srcDir, "../server/api/routers", basename9(routerPath)), root);
     if (!existsSync60(altPath)) return [];
     return extractProcedureNamesFromContent(readFileSync50(altPath, "utf-8"));
   }
@@ -30777,7 +31215,7 @@ function handleDocsAudit(args2) {
   for (const [mappingId, triggeringFiles] of affectedMappings) {
     const mapping = docsMap.mappings.find((m3) => m3.id === mappingId);
     if (!mapping) continue;
-    const helpPagePath = ensureWithinRoot(resolve34(getResolvedPaths().helpSitePath, mapping.helpPage), getProjectRoot());
+    const helpPagePath = ensureWithinRoot(resolve36(getResolvedPaths().helpSitePath, mapping.helpPage), getProjectRoot());
     if (!existsSync60(helpPagePath)) {
       results.push({
         helpPage: mapping.helpPage,
@@ -30830,7 +31268,7 @@ function handleDocsAudit(args2) {
     });
     for (const [guideName, parentId] of Object.entries(docsMap.userGuideInheritance.examples)) {
       if (parentId === mappingId) {
-        const guidePath = ensureWithinRoot(resolve34(getResolvedPaths().helpSitePath, `pages/user-guides/${guideName}/index.mdx`), getProjectRoot());
+        const guidePath = ensureWithinRoot(resolve36(getResolvedPaths().helpSitePath, `pages/user-guides/${guideName}/index.mdx`), getProjectRoot());
         if (existsSync60(guidePath)) {
           const guideContent = readFileSync50(guidePath, "utf-8");
           const guideFrontmatter = extractFrontmatter(guideContent);
@@ -30865,7 +31303,7 @@ function handleDocsCoverage(args2) {
   const gaps = [];
   const mappings = filterDomain ? docsMap.mappings.filter((m3) => m3.id === filterDomain) : docsMap.mappings;
   for (const mapping of mappings) {
-    const helpPagePath = ensureWithinRoot(resolve34(getResolvedPaths().helpSitePath, mapping.helpPage), getProjectRoot());
+    const helpPagePath = ensureWithinRoot(resolve36(getResolvedPaths().helpSitePath, mapping.helpPage), getProjectRoot());
     const exists = existsSync60(helpPagePath);
     let hasContent = false;
     let lineCount = 0;
@@ -31214,7 +31652,7 @@ var init_observability_tools = __esm({
 
 // src/sentinel-db.ts
 import { existsSync as existsSync61 } from "fs";
-import { resolve as resolve35 } from "path";
+import { resolve as resolve37 } from "path";
 function parsePortalScope(raw) {
   if (!raw) return [];
   try {
@@ -31450,22 +31888,22 @@ function validateFeatures(db, domainFilter) {
     const missingProcedures = [];
     const missingPages = [];
     for (const comp of components) {
-      const absPath = resolve35(PROJECT_ROOT, comp.component_file);
+      const absPath = resolve37(PROJECT_ROOT, comp.component_file);
       if (!existsSync61(absPath)) {
         missingComponents.push(comp.component_file);
       }
     }
     for (const proc of procedures) {
-      const routerPath = resolve35(PROJECT_ROOT, `src/server/api/routers/${proc.router_name}.ts`);
+      const routerPath = resolve37(PROJECT_ROOT, `src/server/api/routers/${proc.router_name}.ts`);
       if (!existsSync61(routerPath)) {
         missingProcedures.push({ router: proc.router_name, procedure: proc.procedure_name });
       }
     }
     for (const page of pages) {
       const routeToPath = page.page_route.replace(/^\/(portal-[^/]+\/)?/, "src/app/").replace(/\/$/, "") + "/page.tsx";
-      const absPath = resolve35(PROJECT_ROOT, routeToPath);
+      const absPath = resolve37(PROJECT_ROOT, routeToPath);
       if (page.page_route.startsWith("/") && !existsSync61(absPath)) {
-        const altPath = resolve35(PROJECT_ROOT, `src/app${page.page_route}/page.tsx`);
+        const altPath = resolve37(PROJECT_ROOT, `src/app${page.page_route}/page.tsx`);
         if (!existsSync61(altPath)) {
           missingPages.push(page.page_route);
         }
@@ -31993,7 +32431,7 @@ var init_sentinel_tools = __esm({
 
 // src/sentinel-scanner.ts
 import { readFileSync as readFileSync51, existsSync as existsSync62, readdirSync as readdirSync27, statSync as statSync20 } from "fs";
-import { resolve as resolve36, join as join38, basename as basename10, dirname as dirname27, relative as relative13 } from "path";
+import { resolve as resolve38, join as join38, basename as basename10, dirname as dirname27, relative as relative14 } from "path";
 function inferDomain(filePath) {
   const domains = getConfig().domains;
   const path = filePath.toLowerCase();
@@ -32124,7 +32562,7 @@ function scanComponentExports(dataDb) {
   const projectRoot = getProjectRoot();
   const componentsBase = config.paths.components ?? config.paths.source + "/components";
   const componentDirs = [];
-  const basePath = resolve36(projectRoot, componentsBase);
+  const basePath = resolve38(projectRoot, componentsBase);
   if (existsSync62(basePath)) {
     try {
       const entries = readdirSync27(basePath, { withFileTypes: true });
@@ -32137,11 +32575,11 @@ function scanComponentExports(dataDb) {
     }
   }
   for (const dir of componentDirs) {
-    const absDir = resolve36(projectRoot, dir);
+    const absDir = resolve38(projectRoot, dir);
     if (!existsSync62(absDir)) continue;
     const files = walkDir2(absDir).filter((f2) => f2.endsWith(".tsx") || f2.endsWith(".ts"));
     for (const file of files) {
-      const relPath = relative13(projectRoot, file);
+      const relPath = relative14(projectRoot, file);
       const source = readFileSync51(file, "utf-8");
       const annotations = parseFeatureAnnotations(source);
       if (annotations.length > 0) {
@@ -33722,7 +34160,7 @@ var init_security_scorer = __esm({
 
 // src/dependency-scorer.ts
 import { existsSync as existsSync65, readFileSync as readFileSync54 } from "fs";
-import { resolve as resolve37 } from "path";
+import { resolve as resolve39 } from "path";
 function p13(baseName) {
   return `${getConfig().toolPrefix}_${baseName}`;
 }
@@ -33754,7 +34192,7 @@ function calculateDepRisk(factors) {
   return Math.min(100, risk);
 }
 function getInstalledPackages(projectRoot) {
-  const pkgPath = resolve37(projectRoot, "package.json");
+  const pkgPath = resolve39(projectRoot, "package.json");
   if (!existsSync65(pkgPath)) return /* @__PURE__ */ new Map();
   try {
     const pkg = JSON.parse(readFileSync54(pkgPath, "utf-8"));
@@ -34364,7 +34802,7 @@ var init_regression_detector = __esm({
 // src/knowledge-indexer.ts
 import { createHash as createHash16 } from "crypto";
 import { readFileSync as readFileSync55, readdirSync as readdirSync28, statSync as statSync21, existsSync as existsSync66 } from "fs";
-import { resolve as resolve38, relative as relative14, basename as basename11, extname as extname2 } from "path";
+import { resolve as resolve40, relative as relative15, basename as basename11, extname as extname2 } from "path";
 function getKnowledgePaths() {
   const resolved = getResolvedPaths();
   const config = getConfig();
@@ -34392,7 +34830,7 @@ function discoverMarkdownFiles(baseDir) {
     try {
       const entries = readdirSync28(dir, { withFileTypes: true });
       for (const entry of entries) {
-        const fullPath = resolve38(dir, entry.name);
+        const fullPath = resolve40(dir, entry.name);
         if (entry.isDirectory()) {
           if (entry.name === "archive" && dir.includes("session-state")) continue;
           if (entry.name === "archive" && dir.includes("status")) continue;
@@ -34412,7 +34850,7 @@ function categorizeFile(filePath) {
   const paths = getKnowledgePaths();
   if (filePath.startsWith(paths.plansDir)) return "plan";
   if (filePath.startsWith(paths.docsDir)) {
-    const relFromDocs = relative14(paths.docsDir, filePath).replace(/\\/g, "/").toLowerCase();
+    const relFromDocs = relative15(paths.docsDir, filePath).replace(/\\/g, "/").toLowerCase();
     if (relFromDocs.startsWith("plans/")) return "plan";
     if (relFromDocs.includes("architecture")) return "architecture";
     if (relFromDocs.includes("security")) return "security";
@@ -34428,7 +34866,7 @@ function categorizeFile(filePath) {
   }
   const claudeDirName = getConfig().conventions?.claudeDirName ?? ".claude";
   if (filePath.includes(`${claudeDirName}/projects/`) && filePath.includes("/memory/")) return "memory";
-  const rel = relative14(paths.claudeDir, filePath).replace(/\\/g, "/");
+  const rel = relative15(paths.claudeDir, filePath).replace(/\\/g, "/");
   const firstDir = rel.split("/")[0];
   const knownCategories = getConfig().conventions?.knowledgeCategories ?? [
     "patterns",
@@ -34681,7 +35119,7 @@ function indexAllKnowledge(db) {
     files.push(...docsFiles);
   }
   const now = /* @__PURE__ */ new Date();
-  const nowIso = now.toISOString();
+  const nowIso2 = now.toISOString();
   const nowEpoch = now.getTime();
   const transaction = db.transaction(() => {
     db.exec("DROP TRIGGER IF EXISTS kc_fts_delete");
@@ -34721,11 +35159,11 @@ function indexAllKnowledge(db) {
       if (!existsSync66(filePath)) continue;
       const content = readFileSync55(filePath, "utf-8");
       const hash = hashContent2(content);
-      const relPath = filePath.startsWith(paths.claudeDir) ? relative14(paths.claudeDir, filePath) : filePath.startsWith(paths.plansDir) ? "plans/" + relative14(paths.plansDir, filePath) : filePath.startsWith(paths.docsDir) ? "docs/" + relative14(paths.docsDir, filePath) : filePath.startsWith(paths.memoryDir) ? `memory/${relative14(paths.memoryDir, filePath)}` : basename11(filePath);
+      const relPath = filePath.startsWith(paths.claudeDir) ? relative15(paths.claudeDir, filePath) : filePath.startsWith(paths.plansDir) ? "plans/" + relative15(paths.plansDir, filePath) : filePath.startsWith(paths.docsDir) ? "docs/" + relative15(paths.docsDir, filePath) : filePath.startsWith(paths.memoryDir) ? `memory/${relative15(paths.memoryDir, filePath)}` : basename11(filePath);
       const category = categorizeFile(filePath);
       const title = extractTitle(content, filePath);
       const description = extractDescription2(content);
-      const result = insertDoc.run(relPath, category, title, description, hash, nowIso, nowEpoch);
+      const result = insertDoc.run(relPath, category, title, description, hash, nowIso2, nowEpoch);
       const docId = result.lastInsertRowid;
       stats.filesIndexed++;
       const sections = parseSections(content, filePath);
@@ -34886,8 +35324,8 @@ var init_knowledge_indexer = __esm({
 });
 
 // src/knowledge-tools.ts
-import { readFileSync as readFileSync56, writeFileSync as writeFileSync16, appendFileSync as appendFileSync5, readdirSync as readdirSync29 } from "fs";
-import { resolve as resolve39, basename as basename12 } from "path";
+import { readFileSync as readFileSync56, writeFileSync as writeFileSync17, appendFileSync as appendFileSync5, readdirSync as readdirSync29 } from "fs";
+import { resolve as resolve41, basename as basename12 } from "path";
 function p16(baseName) {
   return `${getConfig().toolPrefix}_${baseName}`;
 }
@@ -34905,10 +35343,19 @@ function ensureKnowledgeIndexed(db) {
   try {
     indexIfStale(db);
     return true;
-  } catch {
+  } catch (err) {
+    recordHookFailure("knowledge-tools:ensure-indexed", err, {
+      note: "knowledge index refresh failed; dispatch continued against the existing index"
+    });
     return false;
   }
 }
+function withStaleIndexWarning(result) {
+  const banner = "\u26A0\uFE0F KNOWLEDGE INDEX NOT REFRESHED \u2014 the re-index for this call FAILED, so the results below come from the last successfully built index and may be out of date. The error was recorded to the hook-failure log under `knowledge-tools:ensure-indexed`.";
+  return {
+    content: [{ type: "text", text: banner }, ...result.content]
+  };
+}
 function hasData(db) {
   const row = db.prepare("SELECT COUNT(*) as cnt FROM knowledge_documents").get();
   return (row?.cnt ?? 0) > 0;
@@ -35089,8 +35536,15 @@ function isKnowledgeTool(name) {
   const baseName = name.startsWith(pfx) ? name.slice(pfx.length) : name;
   return KNOWLEDGE_BASE_NAMES.has(baseName);
 }
-function handleKnowledgeToolCall(name, args2, db) {
-  ensureKnowledgeIndexed(db);
+function handleKnowledgeToolCall(name, args2, db, freshness) {
+  if (freshness === "use-existing") {
+    return dispatchKnowledgeTool(name, args2, db);
+  }
+  const indexed = ensureKnowledgeIndexed(db);
+  const result = dispatchKnowledgeTool(name, args2, db);
+  return indexed ? result : withStaleIndexWarning(result);
+}
+function dispatchKnowledgeTool(name, args2, db) {
   if (!hasData(db)) {
     return text15("No knowledge indexed yet. The knowledge DB will be populated automatically on next MCP server restart.");
   }
@@ -35626,7 +36080,7 @@ function handleCorrect(db, args2) {
   if (!wrong || !correction || !rule) {
     return text15("Error: wrong, correction, and rule are all required.");
   }
-  const correctionsPath = resolve39(getResolvedPaths().memoryDir, "corrections.md");
+  const correctionsPath = resolve41(getResolvedPaths().memoryDir, "corrections.md");
   const today = (/* @__PURE__ */ new Date()).toISOString().split("T")[0];
   const title = rule.slice(0, 60);
   const entry = formatCorrectionEntry({
@@ -35646,7 +36100,7 @@ function handleCorrect(db, args2) {
   if (archiveIdx > 0) {
     const before = existing.slice(0, archiveIdx);
     const after = existing.slice(archiveIdx);
-    writeFileSync16(correctionsPath, before + entry + after);
+    writeFileSync17(correctionsPath, before + entry + after);
   } else {
     appendFileSync5(correctionsPath, entry);
   }
@@ -35960,6 +36414,7 @@ var init_knowledge_tools = __esm({
     init_db2();
     init_memory_db();
     init_sql_table_names();
+    init_hook_failure_signal();
     KNOWLEDGE_BASE_NAMES = /* @__PURE__ */ new Set([
       "knowledge_search",
       "knowledge_rule",
@@ -36596,7 +37051,7 @@ var init_framework_supports = __esm({
 
 // src/tools.ts
 import { readFileSync as readFileSync57, existsSync as existsSync68 } from "fs";
-import { resolve as resolve40, basename as basename13 } from "path";
+import { resolve as resolve42, basename as basename13 } from "path";
 function prefix2() {
   return getConfig().toolPrefix;
 }
@@ -36631,7 +37086,7 @@ function ensureIndexes(dataDb, codegraphDb, force = false) {
   if (config.python?.root) {
     const pythonRoot = config.python.root;
     const excludeDirs = config.python.exclude_dirs || ["__pycache__", ".venv", "venv", ".mypy_cache", ".pytest_cache"];
-    if (force || isPythonDataStale(dataDb, resolve40(getProjectRoot(), pythonRoot))) {
+    if (force || isPythonDataStale(dataDb, resolve42(getProjectRoot(), pythonRoot))) {
       const pyImports = buildPythonImportIndex(dataDb, pythonRoot, excludeDirs);
       results.push(`Python imports: ${pyImports}`);
       const pyRoutes = buildPythonRouteIndex(dataDb, pythonRoot, excludeDirs);
@@ -36854,7 +37309,7 @@ async function handleToolCall(name, args2, dataDb, codegraphDb, memoryDbCache, k
       return withMemDb((memDb) => handleRegressionToolCall(name, args2, memDb));
     }
     if (isKnowledgeTool(name)) {
-      return withKnowledgeDb((kdb) => handleKnowledgeToolCall(name, args2, kdb));
+      return withKnowledgeDb((kdb) => handleKnowledgeToolCall(name, args2, kdb, "ensure-fresh"));
     }
     if (isPythonTool(name)) {
       const pyDataDb = assertDataDb(dataDb, name);
@@ -37014,7 +37469,7 @@ function handleContext(file, dataDb, codegraphDb) {
         try {
           const resolvedPaths = getResolvedPaths();
           const root = getProjectRoot();
-          const absFilePath = ensureWithinRoot(resolve40(resolvedPaths.srcDir, "..", file), root);
+          const absFilePath = ensureWithinRoot(resolve42(resolvedPaths.srcDir, "..", file), root);
           if (existsSync68(absFilePath)) {
             const fileContent = readFileSync57(absFilePath, "utf-8").slice(0, 3e3);
             const keywords = [];
@@ -37253,9 +37708,10 @@ function handleCouplingCheck(args2, dataDb, codegraphDb) {
     lines.push("### Uncoupled Procedures: 0 (PASS)");
     lines.push("");
   }
+  const pagesPred = pagesPredicate();
   const allPages = codegraphDb.prepare(
-    "SELECT path FROM files WHERE path LIKE 'src/app/%/page.tsx' OR path = 'src/app/page.tsx' LIMIT 10000"
-  ).all();
+    `SELECT path FROM files WHERE ${pagesPred.sql} LIMIT 10000`
+  ).all(...pagesPred.params);
   const pageImports = /* @__PURE__ */ new Set();
   for (const page of allPages) {
     const imports = dataDb.prepare(
@@ -37268,9 +37724,10 @@ function handleCouplingCheck(args2, dataDb, codegraphDb) {
   let componentFiles;
   if (stagedFiles) {
     const placeholders = stagedFiles.map(() => "?").join(",");
+    const componentsPred = componentsPredicate();
     componentFiles = codegraphDb.prepare(
-      `SELECT path FROM files WHERE path LIKE 'src/components/%' AND path IN (${placeholders}) LIMIT 10000`
-    ).all(...stagedFiles);
+      `SELECT path FROM files WHERE ${componentsPred.sql} AND path IN (${placeholders}) LIMIT 10000`
+    ).all(...componentsPred.params, ...stagedFiles);
   } else {
     componentFiles = [];
   }
@@ -37453,7 +37910,7 @@ function handleSchema(args2) {
     lines.push("Checking all column references against Prisma schema...");
     lines.push("");
     const projectRoot = getProjectRoot();
-    const absPath = ensureWithinRoot(resolve40(projectRoot, file), projectRoot);
+    const absPath = ensureWithinRoot(resolve42(projectRoot, file), projectRoot);
     if (!existsSync68(absPath)) {
       return text17(`File not found: ${file}`);
     }
@@ -37532,6 +37989,7 @@ var init_tools = __esm({
     init_framework_supports();
     init_license();
     init_sql_table_names();
+    init_source_layout();
   }
 });
 
@@ -37890,7 +38348,7 @@ var init_startup_health = __esm({
 // src/server.ts
 var server_exports = {};
 import { readFileSync as readFileSync58 } from "fs";
-import { resolve as resolve41, dirname as dirname28 } from "path";
+import { resolve as resolve43, dirname as dirname28 } from "path";
 import { fileURLToPath as fileURLToPath6 } from "url";
 function pruneMemoryOnStartup() {
   try {
@@ -37938,7 +38396,7 @@ var init_server = __esm({
     __dirname5 = dirname28(fileURLToPath6(import.meta.url));
     PKG_VERSION = (() => {
       try {
-        const pkg = JSON.parse(readFileSync58(resolve41(__dirname5, "..", "package.json"), "utf-8"));
+        const pkg = JSON.parse(readFileSync58(resolve43(__dirname5, "..", "package.json"), "utf-8"));
         return pkg.version ?? "0.0.0";
       } catch {
         return "0.0.0";
@@ -38241,12 +38699,12 @@ var config_upgrade_exports = {};
 __export(config_upgrade_exports, {
   runConfigUpgrade: () => runConfigUpgrade
 });
-import { existsSync as existsSync69, readFileSync as readFileSync59, writeFileSync as writeFileSync17, copyFileSync as copyFileSync3, unlinkSync as unlinkSync6 } from "fs";
-import { resolve as resolve42 } from "path";
+import { existsSync as existsSync69, readFileSync as readFileSync59, writeFileSync as writeFileSync18, copyFileSync as copyFileSync3, unlinkSync as unlinkSync6 } from "fs";
+import { resolve as resolve44 } from "path";
 import { parse as parseYaml6 } from "yaml";
 async function runConfigUpgrade(opts = {}) {
   const cwd = opts.cwd ?? process.cwd();
-  const configPath = resolve42(cwd, "massu.config.yaml");
+  const configPath = resolve44(cwd, "massu.config.yaml");
   const bakPath = `${configPath}.bak`;
   const log = opts.silent ? () => {
   } : (s) => process.stdout.write(s);
@@ -38300,7 +38758,7 @@ async function runConfigUpgrade(opts = {}) {
   };
   try {
     const original = readFileSync59(configPath, "utf-8");
-    writeFileSync17(bakPath, original, "utf-8");
+    writeFileSync18(bakPath, original, "utf-8");
   } catch (e2) {
     const message = `Failed to write backup: ${e2 instanceof Error ? e2.message : String(e2)}`;
     err(message + "\n");
@@ -38334,7 +38792,7 @@ __export(config_check_drift_exports, {
   runConfigCheckDrift: () => runConfigCheckDrift
 });
 import { existsSync as existsSync70, readFileSync as readFileSync60 } from "fs";
-import { resolve as resolve43 } from "path";
+import { resolve as resolve45 } from "path";
 import { parse as parseYaml7 } from "yaml";
 function renderChanges(changes) {
   if (changes.length === 0) return "(none)\n";
@@ -38342,7 +38800,7 @@ function renderChanges(changes) {
 }
 async function runConfigCheckDrift(opts = {}) {
   const cwd = opts.cwd ?? process.cwd();
-  const configPath = resolve43(cwd, "massu.config.yaml");
+  const configPath = resolve45(cwd, "massu.config.yaml");
   const log = opts.silent ? () => {
   } : (s) => process.stdout.write(s);
   const err = opts.silent ? () => {
@@ -38429,7 +38887,7 @@ var init_config_check_drift = __esm({
 
 // src/cli.ts
 import { readFileSync as readFileSync61 } from "fs";
-import { resolve as resolve44, dirname as dirname29 } from "path";
+import { resolve as resolve46, dirname as dirname29 } from "path";
 import { fileURLToPath as fileURLToPath7 } from "url";
 
 // src/lib/node-bootstrap.ts
@@ -38931,7 +39389,7 @@ Examples:
 }
 function printVersion() {
   try {
-    const pkg = JSON.parse(readFileSync61(resolve44(__dirname6, "../package.json"), "utf-8"));
+    const pkg = JSON.parse(readFileSync61(resolve46(__dirname6, "../package.json"), "utf-8"));
     console.log(`massu v${pkg.version}`);
   } catch {
     console.log("massu v0.1.0");