knodin 0.7.5 → 0.8.2

package/dist/src/engine/index.js

@@ -18,8 +18,10 @@ import path from "node:path";
 import { fileURLToPath } from "node:url";
 import chokidar from "chokidar";
 import Parser from "web-tree-sitter";
+import { compareBytes } from "../compare.js";
 import { readIndexActivity } from "../index-activity.js";
 import { runReadOnlyLspQuery } from "../lsp-readonly.js";
+import { acquireRepairLease } from "../repair-lease.js";
 import { contentFingerprint, writeStructuralSnapshot, } from "../structural-snapshot.js";
 import { KNODIN_VERSION } from "../version.js";
 import * as ann from "./ann-hnsw.js";
@@ -28,9 +30,11 @@ import { walkRepoFiles } from "./file-walker.js";
 import { clearGitHistorySignalCache, collectGitHistorySignals, } from "./git-history.js";
 import { beginPerfPhase, measurePerfPhase, measurePerfPhaseSync } from "./perf.js";
 import { isIndexablePath, makeWatchIgnorePredicate } from "./prune.js";
+import { readSarifLog, SARIF_DEFAULT_LIMITS, } from "./sarif-import.js";
 import { readScipIndex, SCIP_DEFAULT_LIMITS, } from "./scip-import.js";
 import { isIndexableSourcePath } from "./source-policy.js";
 import { Database } from "./sqlite.js";
+import { lookupMirror, mayWriteToRepository, resolveDbPath, resolveStateDir, } from "./state-paths.js";
 import { deleteAllSymbols, deleteSymbolsForFile, deleteSymbolsMatchingPath, ORPHANED_EMBEDDING_PREDICATE, purgeOrphanEmbeddings, } from "./symbol-delete.js";
 // ES Module resolution
 const __filename = fileURLToPath(import.meta.url);
@@ -69,7 +73,7 @@ export const REPO_WIDE_QUERY_PATTERNS = [
     "api_contract_mismatches",
 ];
 const unquote = (value) => {
-    const match = value.trim().match(/^(["'`])([\s\S]*?)\1$/);
+    const match = /^(["'`])([\s\S]*?)\1$/.exec(value.trim());
     return match && !(match[1] === "\x60" && match[2].includes("${")) ? match[2] : undefined;
 };
 function isExecutablePosition(source, target) {
@@ -106,7 +110,7 @@ function isExecutablePosition(source, target) {
             blockComment = true;
             i++;
         }
-        else if (char === '"' || char === "'" || char.charCodeAt(0) === 96)
+        else if (char === '"' || char === "'" || char.codePointAt(0) === 96)
             quote = char;
     }
     return !quote && !lineComment && !blockComment;
@@ -139,11 +143,94 @@ function splitCallArguments(value) {
     result.push(value.slice(start).trim());
     return result;
 }
+/**
+ * Masks block comments, replacing each with `mask(comment)`.
+ *
+ * This deliberately does not use a regular expression. The pattern it replaces,
+ * `/\/\*[\s\S]*?\*\//g`, is quadratic on source containing many unclosed `/*`:
+ * a global regex restarts at every position where `/*` could begin, and each
+ * attempt lazily expands to end of input hunting a `*​/` that never arrives.
+ * Measured at ~4x cost per doubling of input, roughly 50s on a 1 MB file.
+ *
+ * The obvious regex repair — the "unrolled loop" form
+ * `/\/\*[^*]*\*+(?:[^/*][^*]*\*+)*\//g` — was measured and is *also* quadratic,
+ * and about 12x slower again, because its trailing group backtracks through the
+ * whole input before failing. Reasoning about regex-engine behaviour was how
+ * this bug survived; indexOf advances monotonically, so linearity here is a
+ * property of the code rather than a claim about the engine.
+ *
+ * Behaviour matches the pattern it replaces, including leaving an unterminated
+ * `/*` and everything after it untouched.
+ */
+function maskBlockComments(content, mask) {
+    let open = content.indexOf("/*");
+    if (open === -1)
+        return content;
+    let out = "";
+    let pos = 0;
+    while (open !== -1) {
+        const close = content.indexOf("*/", open + 2);
+        // Nothing closes after this point, so no later `/*` can match either.
+        if (close === -1)
+            break;
+        out += content.slice(pos, open) + mask(content.slice(open, close + 2));
+        pos = close + 2;
+        open = content.indexOf("/*", pos);
+    }
+    return pos === 0 ? content : out + content.slice(pos);
+}
+/** Earliest of two `indexOf` results, or -1 when neither matched. */
+function earliestIndex(a, b) {
+    if (a === -1)
+        return b;
+    if (b === -1)
+        return a;
+    return Math.min(a, b);
+}
+/**
+ * Removes block and line comments in one left-to-right pass.
+ *
+ * Kept as a single pass rather than two because the alternation this replaces,
+ * `/\/\*[\s\S]*?\*\/|\/\/.*$/gm`, prefers a block comment only where one starts
+ * at the current position. Stripping block comments first and line comments
+ * second is not equivalent: a line comment containing `/*` would let the block
+ * pass consume everything up to a later `*​/`, deleting real code between them.
+ */
+function stripBlockAndLineComments(content) {
+    let out = "";
+    let pos = 0;
+    let blockPossible = true;
+    for (;;) {
+        const block = blockPossible ? content.indexOf("/*", pos) : -1;
+        const line = content.indexOf("//", pos);
+        const next = earliestIndex(block, line);
+        if (next === -1)
+            break;
+        if (next === block) {
+            const close = content.indexOf("*/", block + 2);
+            if (close === -1) {
+                // No block comment closes anywhere after here; keep looking for
+                // line comments, which is what the alternation would go on to do.
+                blockPossible = false;
+                continue;
+            }
+            out += content.slice(pos, block);
+            pos = close + 2;
+            continue;
+        }
+        // `$` under /m stops before the newline, so the newline itself survives.
+        const eol = content.indexOf("\n", line);
+        out += content.slice(pos, line);
+        pos = eol === -1 ? content.length : eol;
+    }
+    return pos === 0 ? content : out + content.slice(pos);
+}
 /** Extract executable TypeScript MCP SDK registrations; comments are masked first. */
 export function extractMcpToolRegistrations(source, file, root) {
-    const clean = source
-        .replace(/\/\*[\s\S]*?\*\//g, (m) => m.replace(/[^\n]/g, " "))
-        .replace(/(^|\n)\s*\/\/[^\n]*/g, (m) => m.replace(/[^\n]/g, " "));
+    // `[^\S\n]` (whitespace except newline) rather than `\s`: `\s` overlaps the
+    // `(^|\n)` before it, so every start position in a run of blank lines
+    // backtracks through the whole run — super-linear on blank-line-heavy files.
+    const clean = maskBlockComments(source, (m) => m.replace(/[^\n]/g, " ")).replace(/(^|\n)[^\S\n]*\/\/[^\n]*/g, (m) => m.replace(/[^\n]/g, " "));
     const rows = [];
     const astCallStarts = new Set();
     const astCalls = [];
@@ -228,9 +315,9 @@ export function extractMcpToolRegistrations(source, file, root) {
         ? astCalls.find((call) => /setRequestHandler\s*\(\s*CallToolRequestSchema/.test(call))
         : clean;
     if (callToolHandler && /setRequestHandler\s*\(\s*CallToolRequestSchema/.test(callToolHandler)) {
-        const name = callToolHandler.match(/\bname\s*!==?\s*(["'`])([^"'`]+)\1/)?.[2];
-        const handler = callToolHandler.match(/await\s+([\w$]*(?:handle|dispatch)[\w$]*)\s*\(\s*args/i)?.[1];
-        const factory = source.match(/setRequestHandler\s*\(\s*ListToolsRequestSchema[\s\S]*?tools\s*:\s*(\w*Tools)\s*\(/)?.[1];
+        const name = /\bname\s*!==?\s*(["'`])([^"'`]+)\1/.exec(callToolHandler)?.[2];
+        const handler = /await\s+([\w$]*(?:handle|dispatch)[\w$]*)\s*\(\s*args/i.exec(callToolHandler)?.[1];
+        const factory = /setRequestHandler\s*\(\s*ListToolsRequestSchema[\s\S]*?tools\s*:\s*(\w*Tools)\s*\(/.exec(source)?.[1];
         if (name && handler)
             rows.push({
                 name,
@@ -243,7 +330,7 @@ export function extractMcpToolRegistrations(source, file, root) {
     }
     // Descriptor objects are accepted only inside an explicit Tool[] factory,
     // never from unrelated fixture/config objects in an SDK-importing file.
-    const descriptorFunctionMatch = clean.match(/(?:export\s+)?function\s+(\w*Tools)\s*\([^)]*\)\s*:\s*Tool\[\]\s*\{([\s\S]*?)\n\}/);
+    const descriptorFunctionMatch = /(?:export\s+)?function\s+(\w*Tools)\s*\([^)]*\)\s*:\s*Tool\[\]\s*\{([\s\S]*?)\n\}/.exec(clean);
     const descriptorFunction = descriptorFunctionMatch?.[2];
     const descriptorScopes = root
         ? [
@@ -254,11 +341,11 @@ export function extractMcpToolRegistrations(source, file, root) {
             ? [descriptorFunction]
             : [];
     for (const descriptorScope of descriptorScopes) {
-        const scopeAssociationKey = descriptorScope.match(/function\s+(\w*Tools)\b/)?.[1] ??
-            descriptorScope.match(/tools\s*:\s*(\w*Tools)\s*\(/)?.[1] ??
+        const scopeAssociationKey = /function\s+(\w*Tools)\b/.exec(descriptorScope)?.[1] ??
+            /tools\s*:\s*(\w*Tools)\s*\(/.exec(descriptorScope)?.[1] ??
             `file:${file}`;
         for (const match of descriptorScope.matchAll(/\bname\s*:\s*(["'`])([^"'`]+)\1\s*,([\s\S]{0,30000}?)\binputSchema\s*:/g)) {
-            const description = unquote(match[3].match(/\bdescription\s*:\s*((?:["'`])[^"'`]*(?:["'`]))/)?.[1] ?? "");
+            const description = unquote(/\bdescription\s*:\s*((?:["'`])[^"'`]*(?:["'`]))/.exec(match[3])?.[1] ?? "");
             rows.push({
                 name: match[2],
                 description,
@@ -272,6 +359,8 @@ export function extractMcpToolRegistrations(source, file, root) {
     }
     return rows;
 }
+/** `meta` key holding the last index's unparsed-file tally, as a JSON object. */
+export const COVERAGE_UNPARSED_META_KEY = "coverageUnparsedByExtension";
 function repairMetadataFamily(filePath) {
     const segments = filePath.replaceAll("\\", "/").split("/");
     const extension = path.extname(filePath).toLowerCase();
@@ -337,7 +426,7 @@ function symbolIdentity(repoPath, row) {
 }
 const SQLITE_SCOPE_CHUNK_SIZE = 400;
 function scopedFilePaths(filePaths) {
-    return filePaths === undefined ? undefined : [...new Set(filePaths)].sort();
+    return filePaths === undefined ? undefined : [...new Set(filePaths)].sort(compareBytes);
 }
 function symbolsForFiles(db, filePaths) {
     if (filePaths === undefined) {
@@ -410,8 +499,18 @@ function persistSymbolIdentities(db, repoPath, filePaths) {
                 .slice(Math.max(0, row.startLine - 1), row.endLine)
                 .join("\n")
                 .split(/\r?\n/, 1)[0]
-                .replace(/\s*=>.*$/, "")
-                .replace(/\s*\{.*$/, "")
+                // `(?<!\s)` pins the match to the start of a whitespace run; without it
+                // every position inside the run rescans it, which is quadratic.
+                //
+                // S8786 reports the brace variant as super-linear anyway. Measured on
+                // a pure whitespace run with no brace: 0.02ms at n=4,000 rising to
+                // 0.11ms at n=32,000 — ratios 1.29 / 1.94 / 2.17 per doubling, i.e.
+                // linear. The lookbehind is what makes it so. The arrow variant on
+                // the line below is built identically and is not reported, which is
+                // the inconsistency that identifies this as a false positive rather
+                // than a rule we are ducking.
+                .replace(/(?<!\s)\s*=>.*$/, "")
+                .replace(/(?<!\s)\s*\{.*$/, "") // NOSONAR S8786 — measured linear, see above
                 .replace(/:\s*(?:#.*)?$/, "")
                 .replace(/\s+/g, " ")
                 .trim() || `${row.kind}:${row.name}`;
@@ -637,7 +736,7 @@ const ARCHITECTURE_CACHE_LIMIT = 16;
 function getArchitectureMetadataSnapshot(allRepos, resolvedRepoPath) {
     const cacheKey = JSON.stringify([resolvedRepoPath, allRepos.map((repo) => repo.path)]);
     const cached = architectureMetadataCache.get(cacheKey);
-    if (cached && cached.generation === indexGeneration)
+    if (cached?.generation === indexGeneration)
         return cached.snapshot;
     const formatPath = makePathFormatter(resolvedRepoPath);
     const communities = detectSymbolCommunities(allRepos, formatPath);
@@ -705,7 +804,7 @@ function setBoundedCache(cache, key, value, limit) {
     }
 }
 function getGraphAnalyticsSnapshot(allRepos, resolvedRepoPath, topN = 15, relationKinds) {
-    const normalizedKinds = [...(relationKinds ?? [])].sort();
+    const normalizedKinds = [...(relationKinds ?? [])].sort(compareBytes);
     const cacheKey = JSON.stringify([
         resolvedRepoPath,
         allRepos.map((repo) => repo.path),
@@ -713,7 +812,7 @@ function getGraphAnalyticsSnapshot(allRepos, resolvedRepoPath, topN = 15, relati
         normalizedKinds,
     ]);
     const cached = graphAnalyticsCache.get(cacheKey);
-    if (cached && cached.generation === indexGeneration)
+    if (cached?.generation === indexGeneration)
         return cached.result;
     const result = measurePerfPhase("graph_analytics", async () => {
         const formatPath = makePathFormatter(resolvedRepoPath);
@@ -755,7 +854,7 @@ function traversalNodeKey(name, file) {
 }
 function getTraversalSnapshot(repoPath, db) {
     const cached = traversalSnapshotCache.get(repoPath);
-    if (cached && cached.generation === indexGeneration)
+    if (cached?.generation === indexGeneration)
         return cached.snapshot;
     const snapshot = measurePerfPhaseSync("traversal_snapshot", () => {
         const edges = db
@@ -857,7 +956,7 @@ export function resetSearchCacheStats() {
 function getSearchMetadataSnapshot(repoPath, db) {
     const cacheKey = path.resolve(repoPath);
     const cached = searchMetadataCache.get(cacheKey);
-    if (cached && cached.generation === indexGeneration) {
+    if (cached?.generation === indexGeneration) {
         searchCacheStats.metadataCacheHits++;
         return cached.snapshot;
     }
@@ -893,7 +992,7 @@ function getSearchMetadataSnapshot(repoPath, db) {
 function getSearchCommunityLookup(allRepos, resolvedRepoPath) {
     const cacheKey = JSON.stringify([resolvedRepoPath, allRepos.map((repo) => repo.path)]);
     const cached = searchCommunityLookupCache.get(cacheKey);
-    if (cached && cached.generation === indexGeneration) {
+    if (cached?.generation === indexGeneration) {
         searchCacheStats.communityLookupCacheHits++;
         return cached.lookup;
     }
@@ -916,7 +1015,7 @@ function getSearchCommunityLookup(allRepos, resolvedRepoPath) {
  */
 function getAnnIndex(repoPath, rows) {
     const cached = annIndexCache.get(repoPath);
-    if (cached && cached.generation === indexGeneration)
+    if (cached?.generation === indexGeneration)
         return cached.index;
     const parsed = [];
     for (const r of rows) {
@@ -964,7 +1063,7 @@ function getAnnIndex(repoPath, rows) {
  */
 function computeFlows(db, resolvedRepoPath) {
     const cached = flowsCache.get(resolvedRepoPath);
-    if (cached && cached.generation === indexGeneration)
+    if (cached?.generation === indexGeneration)
         return cached.result;
     // Resolved call edges only (the callee resolves to a concrete file).
     const edgeRows = db
@@ -1013,8 +1112,8 @@ function computeFlows(db, resolvedRepoPath) {
         }
         if (!src)
             return false;
-        const escaped = name.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
-        return new RegExp(`\\bexport\\s+(?:default\\s+)?(?:function|class|const|let|var|type|interface|enum)\\s+${escaped}\\b`).test(src);
+        const escaped = name.replace(/[.*+?^${}()|[\]\\]/g, String.raw `\$&`);
+        return new RegExp(String.raw `\bexport\s+(?:default\s+)?(?:function|class|const|let|var|type|interface|enum)\s+${escaped}\b`).test(src);
     };
     // Entry points: endpoints + exported functions with zero callers.
     const outDegree = (name) => adj.get(name)?.length ?? 0;
@@ -1097,7 +1196,7 @@ function computeFlows(db, resolvedRepoPath) {
  */
 function getFileToFlowLookup(db, resolvedRepoPath) {
     const cached = fileToFlowLookupCache.get(resolvedRepoPath);
-    if (cached && cached.generation === indexGeneration)
+    if (cached?.generation === indexGeneration)
         return cached.result;
     const byFile = new Map();
     for (const flow of computeFlows(db, resolvedRepoPath)) {
@@ -1325,7 +1424,8 @@ function getPrecedingComment(node) {
         if (text.startsWith("/*")) {
             text = text
                 .replace(/^\/\*+\s*/, "")
-                .replace(/\*+\/$/, "")
+                // `(?<!\*)` pins the match to the start of the star run (quadratic otherwise).
+                .replace(/(?<!\*)\*+\/$/, "")
                 .split("\n")
                 .map((line) => line.trim().replace(/^\*\s*/, ""))
                 .join("\n")
@@ -1347,9 +1447,9 @@ function getPythonDocstring(node) {
     const body = node.childForFieldName("body");
     if (body && body.childCount > 0) {
         const first = body.child(0);
-        if (first && first.type === "expression_statement") {
+        if (first?.type === "expression_statement") {
             const expr = first.child(0);
-            if (expr && expr.type === "string") {
+            if (expr?.type === "string") {
                 return expr.text.replace(/^["']{3}|["']{3}$/g, "").trim();
             }
         }
@@ -1468,8 +1568,8 @@ function balancedEnd(source, openIndex, open = "(", close = ")") {
 function objectKeys(source) {
     const keys = new Set();
     for (const entry of splitCallArguments(source)) {
-        const property = entry.match(/^\s*(?:["']([^"']+)["']|([A-Za-z_$][\w$]*))\s*(?::|,|$)/);
-        const key = property?.[1] ?? property?.[2] ?? entry.match(/^\s*([A-Za-z_$][\w$]*)\s*$/)?.[1];
+        const property = /^\s*(?:["']([^"']+)["']|([A-Za-z_$][\w$]*))\s*(?::|,|$)/.exec(entry);
+        const key = property?.[1] ?? property?.[2] ?? /^\s*([A-Za-z_$][\w$]*)\s*$/.exec(entry)?.[1];
         if (key && key !== "..." && !key.startsWith("..."))
             keys.add(key);
     }
@@ -1509,7 +1609,7 @@ function topLevelObjectKeys(source) {
         }
         if (depth !== 0 || !propertyStart || /\s/.test(char))
             continue;
-        const match = source.slice(i).match(/^(?:["']([^"']+)["']|([A-Za-z_$][\w$]*))\s*:/);
+        const match = /^(?:["']([^"']+)["']|([A-Za-z_$][\w$]*))\s*:/.exec(source.slice(i));
         if (match) {
             keys.add(match[1] ?? match[2]);
             propertyStart = false;
@@ -1534,21 +1634,25 @@ function fieldsFromType(typeExpression, types) {
         for (const field of types.get(name[0]) ?? [])
             fields.add(field);
     }
-    const inline = typeExpression.match(/\{([\s\S]*)\}/);
-    if (inline)
-        for (const field of objectKeys(inline[1]))
+    // Widest `{ … }` span, scanned rather than matched: the equivalent regex
+    // (`/\{([\s\S]*)\}/`) backtracks quadratically on brace-heavy type expressions.
+    const braceStart = typeExpression.indexOf("{");
+    const braceEnd = typeExpression.lastIndexOf("}");
+    if (braceStart >= 0 && braceEnd > braceStart) {
+        for (const field of objectKeys(typeExpression.slice(braceStart + 1, braceEnd)))
             fields.add(field);
+    }
     return [...fields];
 }
 function apiPath(expression, isClient) {
     const trimmed = expression.trim();
     let value = null;
     let unresolved = false;
-    const quoted = trimmed.match(/^(["'])([\s\S]*?)\1$/);
+    const quoted = /^(["'])([\s\S]*?)\1$/.exec(trimmed);
     if (quoted)
         value = quoted[2];
     else {
-        const template = trimmed.match(/^`([\s\S]*)`$/);
+        const template = /^`([\s\S]*)`$/.exec(trimmed);
         if (template && isClient)
             value = template[1].replace(/\$\{\s*([A-Za-z_$][\w$]*)\s*\}/g, "{$1}");
         else
@@ -1608,9 +1712,7 @@ function declaredResponseFields(source, types) {
 function extractApiContracts(content, definitions, references) {
     const facts = [];
     const types = typeFieldMap(content);
-    const masked = content
-        .replace(/\/\*[\s\S]*?\*\//g, (match) => match.replace(/[^\n]/g, " "))
-        .replace(/(^|\s)\/\/.*$/gm, (match, prefix) => prefix + " ".repeat(match.length - prefix.length));
+    const masked = maskBlockComments(content, (match) => match.replace(/[^\n]/g, " ")).replace(/(^|\s)\/\/.*$/gm, (match, prefix) => prefix + " ".repeat(match.length - prefix.length));
     for (const match of masked.matchAll(/\b([A-Za-z_$][\w$]*)\.(get|post|put|patch|delete)\s*\(/gi)) {
         const receiver = match[1].toLowerCase();
         if (!new Set(["app", "router", "route", "fastify", "server"]).has(receiver))
@@ -1661,7 +1763,7 @@ function extractApiContracts(content, definitions, references) {
     const addClient = (framework, method, index, args) => {
         const route = apiPath(args[0] ?? "", true);
         if (framework === "fetch") {
-            const methodMatch = (args[1] ?? "").match(/\bmethod\s*:\s*["'](get|post|put|patch|delete)["']/i);
+            const methodMatch = /\bmethod\s*:\s*["'](get|post|put|patch|delete)["']/i.exec(args[1] ?? "");
             if (methodMatch)
                 method = methodMatch[1].toUpperCase();
         }
@@ -1677,12 +1779,12 @@ function extractApiContracts(content, definitions, references) {
             .match(/(?:const|let)\s+([A-Za-z_$][\w$]*)\s*=\s*await\s*$/)?.[1];
         const bodyMatch = response
             ? framework === "fetch"
-                ? new RegExp(`(?:const|let)\\s+([A-Za-z_$][\\w$]*)\\s*=\\s*\\(\\s*await\\s+${response}\\.json\\(\\)\\s*\\)\\s+as\\s+([^;\\n]+)`).exec(source)
-                : new RegExp(`(?:const|let)\\s+([A-Za-z_$][\\w$]*)\\s*=\\s*${response}\\.data\\s+as\\s+([^;\\n]+)`).exec(source)
+                ? new RegExp(String.raw `(?:const|let)\s+([A-Za-z_$][\w$]*)\s*=\s*\(\s*await\s+${response}\.json\(\)\s*\)\s+as\s+([^;\n]+)`).exec(source)
+                : new RegExp(String.raw `(?:const|let)\s+([A-Za-z_$][\w$]*)\s*=\s*${response}\.data\s+as\s+([^;\n]+)`).exec(source)
             : null;
         const body = bodyMatch?.[1];
         const accessed = body
-            ? [...source.matchAll(new RegExp(`\\b${body}\\.([A-Za-z_$][\\w$]*)`, "g"))].map((entry) => entry[1])
+            ? [...source.matchAll(new RegExp(String.raw `\b${body}\.([A-Za-z_$][\w$]*)`, "g"))].map((entry) => entry[1])
             : [];
         facts.push({
             kind: "client",
@@ -1751,7 +1853,7 @@ function extractSymbolsAndReferences(rootNode, isPython, isApex = false, filePat
     const isGo = filePath.endsWith(".go");
     const isRust = filePath.endsWith(".rs");
     function getEnclosingSymbol() {
-        return symbolStack.length > 0 ? symbolStack[symbolStack.length - 1] : null;
+        return symbolStack.at(-1) ?? null;
     }
     function traverse(node) {
         let isNewSymbol = false;
@@ -2187,7 +2289,7 @@ function extractSymbolsAndReferences(rootNode, isPython, isApex = false, filePat
             else if (node.type === "variable_declarator") {
                 const nameNode = node.childForFieldName("name");
                 const valueNode = node.childForFieldName("value");
-                if (nameNode && nameNode.type === "identifier") {
+                if (nameNode?.type === "identifier") {
                     const name = nameNode.text;
                     symName = name;
                     const isFunc = valueNode &&
@@ -2235,7 +2337,7 @@ function extractSymbolsAndReferences(rootNode, isPython, isApex = false, filePat
         if (!isPython && !isApex) {
             if (node.type === "import_statement" || node.type === "import_declaration") {
                 const sourceNode = node.childForFieldName("source");
-                if (sourceNode && sourceNode.type === "string") {
+                if (sourceNode?.type === "string") {
                     const srcText = sourceNode.text.replace(/^['"`]|['"`]$/g, "");
                     fileDependencies.push(srcText);
                     // Record which local names this module binds, so a later call to
@@ -2334,14 +2436,14 @@ function extractSymbolsAndReferences(rootNode, isPython, isApex = false, filePat
             }
             else if (node.type === "query_expression") {
                 const queryText = node.text;
-                const soqlMatches = [...queryText.matchAll(/from\s+([a-zA-Z0-9_]+)/gi)];
+                const soqlMatches = [...queryText.matchAll(/from\s+(\w+)/gi)];
                 for (const match of soqlMatches) {
                     const tableName = match[1];
                     if (tableName) {
                         tableDependencies.push(tableName);
                     }
                 }
-                const soslMatches = [...queryText.matchAll(/returning\s+([a-zA-Z0-9_]+)/gi)];
+                const soslMatches = [...queryText.matchAll(/returning\s+(\w+)/gi)];
                 for (const match of soslMatches) {
                     const tableName = match[1];
                     if (tableName) {
@@ -2519,20 +2621,20 @@ function extractSymbolsAndReferences(rootNode, isPython, isApex = false, filePat
                             node.children.find((c) => c.type === "arguments");
                         if (argsNode && argsNode.childCount > 0) {
                             let firstArg = argsNode.child(0);
-                            if (firstArg && firstArg.text === "(") {
+                            if (firstArg?.text === "(") {
                                 firstArg = argsNode.child(1);
                             }
                             if (firstArg) {
                                 const tableName = firstArg.text.replace(/['"`]/g, "");
                                 const columns = [];
                                 let secondArg = argsNode.child(2);
-                                if (secondArg && secondArg.text === ",") {
+                                if (secondArg?.text === ",") {
                                     secondArg = argsNode.child(3);
                                 }
-                                if (secondArg && secondArg.type === "object") {
+                                if (secondArg?.type === "object") {
                                     for (let i = 0; i < secondArg.childCount; i++) {
                                         const prop = secondArg.child(i);
-                                        if (prop && prop.type === "pair") {
+                                        if (prop?.type === "pair") {
                                             const keyNode = prop.childForFieldName("key") || prop.child(0);
                                             if (keyNode) {
                                                 columns.push(keyNode.text.replace(/['"`]/g, ""));
@@ -2574,7 +2676,7 @@ function extractSymbolsAndReferences(rootNode, isPython, isApex = false, filePat
     const content = rootNode.text;
     const apiContracts = extractApiContracts(content, definitions, references);
     // Drizzle ORM fallback regex
-    const drizzleRegex = /(?:pgTable|sqliteTable|mysqlTable)\s*\(\s*['"`]([a-zA-Z0-9_]+)['"`]/g;
+    const drizzleRegex = /(?:pgTable|sqliteTable|mysqlTable)\s*\(\s*['"`](\w+)['"`]/g;
     let drizzleMatch = drizzleRegex.exec(content);
     while (drizzleMatch !== null) {
         const tableName = drizzleMatch[1];
@@ -2596,14 +2698,14 @@ function extractSymbolsAndReferences(rootNode, isPython, isApex = false, filePat
     }
     // Python: SQLAlchemy / Django Models
     if (isPython) {
-        const tablenameRegex = /__tablename__\s*=\s*['"`]([a-zA-Z0-9_]+)['"`]/g;
+        const tablenameRegex = /__tablename__\s*=\s*['"`](\w+)['"`]/g;
         let tablenameMatch = tablenameRegex.exec(content);
         while (tablenameMatch !== null) {
             const tableName = tablenameMatch[1];
             ormDependencies.push({ to: tableName, kind: "orm-relation" });
             tablenameMatch = tablenameRegex.exec(content);
         }
-        const dbtableRegex = /db_table\s*=\s*['"`]([a-zA-Z0-9_]+)['"`]/g;
+        const dbtableRegex = /db_table\s*=\s*['"`](\w+)['"`]/g;
         let dbtableMatch = dbtableRegex.exec(content);
         while (dbtableMatch !== null) {
             const tableName = dbtableMatch[1];
@@ -2613,7 +2715,7 @@ function extractSymbolsAndReferences(rootNode, isPython, isApex = false, filePat
     }
     // Java: JPA / Hibernate annotations
     if (isJava) {
-        const javaTableRegex = /@Table\s*\(\s*name\s*=\s*['"`]([a-zA-Z0-9_]+)['"`]\s*\)/gi;
+        const javaTableRegex = /@Table\s*\(\s*name\s*=\s*['"`](\w+)['"`]\s*\)/gi;
         let javaTableMatch = javaTableRegex.exec(content);
         while (javaTableMatch !== null) {
             const tableName = javaTableMatch[1];
@@ -2623,7 +2725,7 @@ function extractSymbolsAndReferences(rootNode, isPython, isApex = false, filePat
     }
     // C#: EF Core ToTable
     if (isCSharp) {
-        const csTableRegex = /\.ToTable\s*\(\s*['"`]([a-zA-Z0-9_]+)['"`]\s*\)/g;
+        const csTableRegex = /\.ToTable\s*\(\s*['"`](\w+)['"`]\s*\)/g;
         let csTableMatch = csTableRegex.exec(content);
         while (csTableMatch !== null) {
             const tableName = csTableMatch[1];
@@ -2635,7 +2737,7 @@ function extractSymbolsAndReferences(rootNode, isPython, isApex = false, filePat
     // Mask out comments so we don't detect example endpoints in docstrings.
     let maskedContent = rootNode.text;
     // Mask block comments preserving newlines
-    maskedContent = maskedContent.replace(/\/\*[\s\S]*?\*\//g, (match) => match.replace(/[^\n]/g, " "));
+    maskedContent = maskBlockComments(maskedContent, (match) => match.replace(/[^\n]/g, " "));
     // Mask line comments (// or #) preserving length
     maskedContent = maskedContent.replace(/(^|\s)(\/\/|#).*$/gm, (match, prefix) => {
         return prefix + " ".repeat(match.length - prefix.length);
@@ -2676,9 +2778,16 @@ function extractSymbolsAndReferences(rootNode, isPython, isApex = false, filePat
                 // For decorators, find the decorated function on the next few lines
                 const remaining = fileContent.substring(pattern.regex.lastIndex);
                 // Match something like "async function name(" or "def name(" or "class name" or "methodName("
-                const funcMatch = remaining.match(/^\s*(?:async\s+)?(?:function|def)\s+([a-zA-Z0-9_]+)\b|^\s*(?:@Get|@Post|@Put|@Delete|@Patch|@app|@router|private|public|protected|async|static|\s)*\s*([a-zA-Z0-9_]+)\s*\(/i);
+                // The modifier group already has `\s` as an alternative, so neither a
+                // leading `\s*` nor a trailing `\s*` may wrap it: either one splits a
+                // whitespace run with the group and backtracks catastrophically.
+                // Both forms are `^`-anchored and there is no `m` flag, so trying them
+                // in order is exactly the alternation they replace, minus its complexity.
+                const declaredFunc = /^\s*(?:async\s+)?(?:function|def)\s+(\w+)\b/i.exec(remaining);
+                const funcMatch = declaredFunc ??
+                    /^(?:@Get|@Post|@Put|@Delete|@Patch|@app|@router|private|public|protected|async|static|\s)*(\w+)\s*\(/i.exec(remaining);
                 if (funcMatch) {
-                    handlerName = funcMatch[1] || funcMatch[2];
+                    handlerName = funcMatch[1];
                 }
             }
             // If the handler is a method like controller.method, extract the method name too.
@@ -2812,9 +2921,9 @@ function extractSymbolsAndReferences(rootNode, isPython, isApex = false, filePat
             // Bare single positional arg (`@GetMapping("/foo")`, optionally followed
             // by other attributes): a quoted literal at the very start, with no
             // `value =` prefix.
-            const bareMatch = args.match(/^\s*["']([^"']+)["']/);
+            const bareMatch = /^\s*["']([^"']+)["']/.exec(args);
             // Named `value = "..."` attribute, anywhere in the argument list.
-            const namedMatch = args.match(/\bvalue\s*=\s*["']([^"']+)["']/);
+            const namedMatch = /\bvalue\s*=\s*["']([^"']+)["']/.exec(args);
             const rawPath = bareMatch?.[1] ?? namedMatch?.[1];
             if (!rawPath)
                 continue;
@@ -2846,7 +2955,7 @@ function isMinifiedSource(content) {
         return false;
     let newlines = 0;
     for (let i = 0; i < content.length; i++) {
-        if (content.charCodeAt(i) === 10)
+        if (content.codePointAt(i) === 10)
             newlines++;
     }
     return content.length / (newlines + 1) > 2000;
@@ -2861,7 +2970,7 @@ function isMinifiedSource(content) {
  * statements stay intact and the file indexes cleanly.
  */
 function sanitizeDollarQuotedSql(content) {
-    return content.replace(/\$([A-Za-z0-9_]*)\$[\s\S]*?\$\1\$/g, "''");
+    return content.replace(/\$(\w*)\$[\s\S]*?\$\1\$/g, "''");
 }
 const RESOLVE_EXTS = [".ts", ".tsx", ".js", ".jsx", ".py", ".mts", ".cts", ".mjs", ".cjs"];
 // TS ESM writes `.js` specifiers that map to `.ts` source (and .jsx->.tsx, etc.).
@@ -3038,8 +3147,8 @@ function fileDefinesOrReexports(repoPath, relFile, name, seen) {
         return true;
     try {
         const src = fs.readFileSync(path.join(repoPath, relFile), "utf-8");
-        const escaped = name.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
-        if (new RegExp(`\\b(?:function|class|const|let|var|type|interface|enum)\\s+${escaped}\\b`).test(src)) {
+        const escaped = name.replace(/[.*+?^${}()|[\]\\]/g, String.raw `\$&`);
+        if (new RegExp(String.raw `\b(?:function|class|const|let|var|type|interface|enum)\s+${escaped}\b`).test(src)) {
             return true;
         }
     }
@@ -3096,7 +3205,7 @@ function salesforceExperienceFile(relativePath) {
     const normalized = relativePath.replaceAll("\\", "/");
     if (normalized === "lwr.config.json")
         return { type: "lwrConfig" };
-    const match = normalized.match(/^(force-app\/main\/default\/experiences\/[A-Za-z][A-Za-z0-9_]*?)\/(routes|views|themes|assets)\/[^/]+\.(json|svg)$/);
+    const match = /^(force-app\/main\/default\/experiences\/[A-Za-z]\w*?)\/(routes|views|themes|assets)\/[^/]+\.(json|svg)$/.exec(normalized);
     if (!match)
         return null;
     const type = match[2];
@@ -3131,7 +3240,7 @@ function experienceSiteFile(sitePath, category, value, repoPath) {
 function findExperienceComponentFile(value, repoPath) {
     if (typeof value !== "string")
         return null;
-    const component = value.match(/^c:([A-Za-z][A-Za-z0-9_]*)$/)?.[1];
+    const component = /^c:([A-Za-z]\w*)$/.exec(value)?.[1];
     if (!component)
         return null;
     return (findSalesforceLwcComponentFile(component, repoPath) ??
@@ -3147,7 +3256,7 @@ function findExperienceComponentFile(value, repoPath) {
  */
 function lwcBundleFile(relativePath) {
     const normalized = relativePath.replaceAll("\\", "/");
-    const match = normalized.match(/^(force-app\/main\/default\/lwc\/)([A-Za-z][A-Za-z0-9_]*?)\/\2\.(js|html|css|js-meta\.xml)$/);
+    const match = /^(force-app\/main\/default\/lwc\/)([A-Za-z]\w*?)\/\2\.(js|html|css|js-meta\.xml)$/.exec(normalized);
     if (!match)
         return null;
     return {
@@ -3163,7 +3272,7 @@ function lwcBundleFile(relativePath) {
  */
 function auraBundleFile(relativePath) {
     const normalized = relativePath.replaceAll("\\", "/");
-    const match = normalized.match(/^(force-app\/main\/default\/aura\/)([A-Za-z][A-Za-z0-9_]*?)\/\2\.(app|cmp|css|design|docs|evt|intf|js|svg)$/);
+    const match = /^(force-app\/main\/default\/aura\/)([A-Za-z]\w*?)\/\2\.(app|cmp|css|design|docs|evt|intf|js|svg)$/.exec(normalized);
     if (!match)
         return null;
     return {
@@ -3182,14 +3291,11 @@ function findApexMethodFilePath(className, methodName, repoPath) {
     if (!classFile)
         return null;
     try {
-        const source = fs
-            .readFileSync(path.join(repoPath, classFile), "utf-8")
-            .replace(/\/\*[\s\S]*?\*\/|\/\/.*$/gm, "")
-            .replace(/'(?:\\.|[^'])*'|"(?:\\.|[^"])*"/g, "");
-        const escaped = methodName.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+        const source = stripBlockAndLineComments(fs.readFileSync(path.join(repoPath, classFile), "utf-8")).replace(/'(?:\\.|[^'\\])*'|"(?:\\.|[^"\\])*"/g, "");
+        const escaped = methodName.replace(/[.*+?^${}()|[\]\\]/g, String.raw `\$&`);
         // A source-level import is exact only when its declared Apex method exists,
         // never merely when the method name appears in a call, comment, or string.
-        const declaration = new RegExp(`\\b(?:public|protected|private|global)\\s+(?:(?:static|virtual|override|webService)\\s+)*[A-Za-z_][\\w<>,.?\\[\\]\\s]*?\\s${escaped}\\s*\\(`);
+        const declaration = new RegExp(String.raw `\b(?:public|protected|private|global)\s+(?:(?:static|virtual|override|webService)\s+)*[A-Za-z_][\w<>,.?\[\]\s]*?\s${escaped}\s*\(`);
         return declaration.test(source) ? classFile : null;
     }
     catch {
@@ -3197,7 +3303,7 @@ function findApexMethodFilePath(className, methodName, repoPath) {
     }
 }
 function isUnnamespacedSalesforceIdentifier(value) {
-    return !value.includes("__") && /^[A-Za-z][A-Za-z0-9_]*(?:\.[A-Za-z][A-Za-z0-9_]*)?$/.test(value);
+    return !value.includes("__") && /^[A-Za-z]\w*(?:\.[A-Za-z]\w*)?$/.test(value);
 }
 /**
  * The C20 matcher deliberately recognizes only Salesforce DX metadata paths.
@@ -3209,32 +3315,35 @@ function salesforceMetadataFile(relativePath) {
     const root = "force-app/main/default/";
     if (!normalized.startsWith(root))
         return null;
-    let match = normalized.match(/^force-app\/main\/default\/objects\/([A-Za-z][A-Za-z0-9_]*)\/\1\.object-meta\.xml$/);
+    let match = /^force-app\/main\/default\/objects\/([A-Za-z]\w*)\/\1\.object-meta\.xml$/.exec(normalized);
     if (match)
         return { type: "object", object: match[1] };
-    match = normalized.match(/^force-app\/main\/default\/objects\/([A-Za-z][A-Za-z0-9_]*)\/fields\/([A-Za-z][A-Za-z0-9_]*)\.field-meta\.xml$/);
+    match =
+        /^force-app\/main\/default\/objects\/([A-Za-z]\w*)\/fields\/([A-Za-z]\w*)\.field-meta\.xml$/.exec(normalized);
     if (match)
         return { type: "field", object: match[1], field: match[2] };
-    match = normalized.match(/^force-app\/main\/default\/objects\/([A-Za-z][A-Za-z0-9_]*)\/recordTypes\/([A-Za-z][A-Za-z0-9_]*)\.recordType-meta\.xml$/);
+    match =
+        /^force-app\/main\/default\/objects\/([A-Za-z]\w*)\/recordTypes\/([A-Za-z]\w*)\.recordType-meta\.xml$/.exec(normalized);
     if (match)
         return { type: "recordType", object: match[1], recordType: match[2] };
-    match = normalized.match(/^force-app\/main\/default\/permissionSets\/([A-Za-z][A-Za-z0-9_]*)\.permissionSet-meta\.xml$/);
+    match = /^force-app\/main\/default\/permissionSets\/([A-Za-z]\w*)\.permissionSet-meta\.xml$/.exec(normalized);
     if (match)
         return { type: "permissionSet", name: match[1] };
-    match = normalized.match(/^force-app\/main\/default\/flows\/([A-Za-z][A-Za-z0-9_]*)\.flow-meta\.xml$/);
+    match = /^force-app\/main\/default\/flows\/([A-Za-z]\w*)\.flow-meta\.xml$/.exec(normalized);
     if (match)
         return { type: "flow", name: match[1] };
-    match = normalized.match(/^force-app\/main\/default\/workflows\/([A-Za-z][A-Za-z0-9_]*)\.workflow-meta\.xml$/);
+    match = /^force-app\/main\/default\/workflows\/([A-Za-z]\w*)\.workflow-meta\.xml$/.exec(normalized);
     if (match)
         return { type: "workflow", object: match[1] };
-    match = normalized.match(/^force-app\/main\/default\/approvalProcesses\/([A-Za-z][A-Za-z0-9_]*)\.([A-Za-z][A-Za-z0-9_]*)\.approvalProcess-meta\.xml$/);
+    match =
+        /^force-app\/main\/default\/approvalProcesses\/([A-Za-z]\w*)\.([A-Za-z]\w*)\.approvalProcess-meta\.xml$/.exec(normalized);
     if (match)
         return { type: "approval", object: match[1], name: match[2] };
     return null;
 }
 function staticXmlTagValues(content, tag) {
     const uncommented = content.replace(/<!--[\s\S]*?-->/g, "");
-    const escaped = tag.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+    const escaped = tag.replace(/[.*+?^${}()|[\]\\]/g, String.raw `\$&`);
     const expression = new RegExp(`<${escaped}>([^<]+)</${escaped}>`, "g");
     const values = [];
     for (const match of uncommented.matchAll(expression)) {
@@ -3246,7 +3355,7 @@ function staticXmlTagValues(content, tag) {
 }
 function staticSalesforceIdentifier(value) {
     return value.split(".").every((part) => {
-        if (!/^[A-Za-z][A-Za-z0-9_]*$/.test(part))
+        if (!/^[A-Za-z]\w*$/.test(part))
             return false;
         const customMarkerCount = (part.match(/__/g) ?? []).length;
         // `Thing__c` is an unnamespaced custom object/field. `pkg__Thing__c`
@@ -3255,14 +3364,14 @@ function staticSalesforceIdentifier(value) {
     });
 }
 function findSalesforceLwcComponentFile(componentName, repoPath) {
-    if (!/^[A-Za-z][A-Za-z0-9_]*$/.test(componentName))
+    if (!/^[A-Za-z]\w*$/.test(componentName))
         return null;
     const candidate = `force-app/main/default/lwc/${componentName}/${componentName}.js`;
     return fs.existsSync(path.join(repoPath, candidate)) ? candidate : null;
 }
 function apexMethodIsDeclared(content, methodName) {
-    const escaped = methodName.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
-    return (firstExecutableMatch(content, new RegExp(`\\b(?:public|protected|private|global)\\s+(?:(?:static|virtual|override|webService)\\s+)*[A-Za-z_][\\w<>,.?\\[\\]\\s]*?\\s${escaped}\\s*\\(`, "gi")) !== null);
+    const escaped = methodName.replace(/[.*+?^${}()|[\]\\]/g, String.raw `\$&`);
+    return (firstExecutableMatch(content, new RegExp(String.raw `\b(?:public|protected|private|global)\s+(?:(?:static|virtual|override|webService)\s+)*[A-Za-z_][\w<>,.?\[\]\s]*?\s${escaped}\s*\(`, "gi")) !== null);
 }
 function firstExecutableMatch(source, expression) {
     for (const match of source.matchAll(expression)) {
@@ -3293,8 +3402,8 @@ function findClosingCallParen(source, openParen) {
     return null;
 }
 function implementsApexInterface(clause, interfaceName) {
-    const escaped = interfaceName.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
-    return new RegExp(`(?:^|[,\\s])${escaped}(?=\\s|,|<|$)`, "i").test(clause);
+    const escaped = interfaceName.replace(/[.*+?^${}()|[\]\\]/g, String.raw `\$&`);
+    return new RegExp(String.raw `(?:^|[,\s])${escaped}(?=\s|,|<|$)`, "i").test(clause);
 }
 /**
  * Extract the deliberately narrow source-only part of Apex platform behavior.
@@ -3307,35 +3416,40 @@ function extractApexPlatformDependencies(content, repoPath) {
     const add = (to, kind, sourceEvidence) => {
         dependencies.push({ to, kind, sourceEvidence });
     };
-    const className = firstExecutableMatch(content, /\bclass\s+([A-Za-z][A-Za-z0-9_]*)\b/gi)?.[1];
+    const className = firstExecutableMatch(content, /\bclass\s+([a-z]\w*)\b/gi)?.[1];
     const restResource = firstExecutableMatch(content, /@RestResource\s*\(\s*urlMapping\s*=\s*(["'])([^"']+)\1\s*\)/gi);
     if (restResource) {
-        for (const verb of content.matchAll(/@Http(Get|Post|Put|Patch|Delete)\b[\s\S]{0,300}?\b(?:global|public)\s+static\s+[^({;]+?\s+[A-Za-z][A-Za-z0-9_]*\s*\(/gi)) {
+        // `\s(?:\s|[^({;]*?(?<!\s))` is the return-type span. Written the obvious way
+        // (`\s+[^({;]+?`) both halves can consume whitespace, so every split point of a
+        // whitespace run is retried and the scan is quadratic. Pinning the span to end
+        // on a non-whitespace character — with a bare `\s` for the one-whitespace-char
+        // case that pin would otherwise drop — matches the same text in linear time.
+        for (const verb of content.matchAll(/@Http(Get|Post|Put|Patch|Delete)\b[\s\S]{0,300}?\b(?:global|public)\s+static\s(?:\s|[^({;]*?(?<!\s))\s+[a-z]\w*\s*\(/gi)) {
             if (!isExecutablePosition(content, verb.index ?? 0))
                 continue;
-            const handlerAnnotation = verb[0].match(/^@Http(?:Get|Post|Put|Patch|Delete)/i)?.[0];
+            const handlerAnnotation = /^@Http(?:Get|Post|Put|Patch|Delete)/i.exec(verb[0])?.[0];
             if (!handlerAnnotation)
                 continue;
             add(`REST ${verb[1].toUpperCase()} ${restResource[2]}`, "apex_rest_entry", `${restResource[0].trim()}; ${handlerAnnotation}`);
         }
     }
     if (className) {
-        for (const method of content.matchAll(/\b(?:global|public)\s+static\s+webService\s+[^({;]+?\s+([A-Za-z][A-Za-z0-9_]*)\s*\(/gi)) {
+        for (const method of content.matchAll(/\b(?:global|public)\s+static\s+webService\s(?:\s|[^({;]*?(?<!\s))\s+([a-z]\w*)\s*\(/gi)) {
             if (!isExecutablePosition(content, method.index ?? 0))
                 continue;
             add(`SOAP ${className}.${method[1]}`, "apex_soap_entry", method[0].trim());
         }
-        for (const method of content.matchAll(/@InvocableMethod\b[\s\S]{0,300}?\b(?:global|public)\s+static\s+[^({;]+?\s+([A-Za-z][A-Za-z0-9_]*)\s*\(/gi)) {
+        for (const method of content.matchAll(/@InvocableMethod\b[\s\S]{0,300}?\b(?:global|public)\s+static\s(?:\s|[^({;]*?(?<!\s))\s+([a-z]\w*)\s*\(/gi)) {
             if (!isExecutablePosition(content, method.index ?? 0))
                 continue;
             add(`ApexAction ${className}.${method[1]}`, "apex_invocable_entry", method[0].trim());
         }
-        for (const method of content.matchAll(/@future\b[\s\S]{0,300}?\b(?:global|public)\s+static\s+[^({;]+?\s+([A-Za-z][A-Za-z0-9_]*)\s*\(/gi)) {
+        for (const method of content.matchAll(/@future\b[\s\S]{0,300}?\b(?:global|public)\s+static\s(?:\s|[^({;]*?(?<!\s))\s+([a-z]\w*)\s*\(/gi)) {
             if (!isExecutablePosition(content, method.index ?? 0))
                 continue;
             add(`${className}.${method[1]}`, "apex_async_callback", method[0].trim());
         }
-        const implementsClause = firstExecutableMatch(content, new RegExp(`\\bclass\\s+${className}\\b[^{}]*\\bimplements\\b([^{}]+)`, "gis"))?.[1];
+        const implementsClause = firstExecutableMatch(content, new RegExp(String.raw `\bclass\s+${className}\b[^{}]*\bimplements\b([^{}]+)`, "gis"))?.[1];
         if (implementsClause) {
             const callbacks = [
                 { interfaceName: "Queueable", methods: ["execute"] },
@@ -3356,11 +3470,11 @@ function extractApexPlatformDependencies(content, repoPath) {
             }
         }
     }
-    for (const trigger of content.matchAll(/\btrigger\s+([A-Za-z][A-Za-z0-9_]*)\s+on\s+([A-Za-z][A-Za-z0-9_]*)\s*\(([^)]+)\)/gi)) {
+    for (const trigger of content.matchAll(/\btrigger\s+([a-z]\w*)\s+on\s+([a-z]\w*)\s*\(([^)]+)\)/gi)) {
         if (!isExecutablePosition(content, trigger.index ?? 0))
             continue;
         for (const event of trigger[3].split(",").map((value) => value.trim())) {
-            const normalized = event.match(/^(before|after)\s+(insert|update|delete|undelete)$/i);
+            const normalized = /^(before|after)\s+(insert|update|delete|undelete)$/i.exec(event);
             if (!normalized)
                 continue;
             const target = `${trigger[2]}.${normalized[1].toLowerCase()}${normalized[2][0].toUpperCase()}${normalized[2].slice(1).toLowerCase()}`;
@@ -3372,8 +3486,8 @@ function extractApexPlatformDependencies(content, repoPath) {
         }
     }
     const enqueueCalls = [
-        /\bSystem\.enqueueJob\s*\(\s*new\s+([A-Za-z][A-Za-z0-9_]*)\s*\(/gi,
-        /\bDatabase\.executeBatch\s*\(\s*new\s+([A-Za-z][A-Za-z0-9_]*)\s*\(/gi,
+        /\bSystem\.enqueueJob\s*\(\s*new\s+([a-z]\w*)\s*\(/gi,
+        /\bDatabase\.executeBatch\s*\(\s*new\s+([a-z]\w*)\s*\(/gi,
     ];
     for (const enqueue of enqueueCalls) {
         for (const match of content.matchAll(enqueue)) {
@@ -3394,7 +3508,7 @@ function extractApexPlatformDependencies(content, repoPath) {
         const args = splitCallArguments(content.slice(openParen + 1, closeParen));
         if (args.length !== 3)
             continue;
-        const job = args[2].match(/^new\s+([A-Za-z][A-Za-z0-9_]*)\s*\(/);
+        const job = /^new\s+([A-Za-z]\w*)\s*\(/.exec(args[2]);
         if (!job)
             continue;
         const target = findUniqueApexClassFilePath(job[1], repoPath);
@@ -3443,7 +3557,7 @@ async function indexSalesforceMetadataFile(content, relativePath, repoPath, db,
                     add(entry.value, "permission_set_record_type", entry.evidence);
             }
             for (const entry of staticXmlTagValues(content, "apexClass")) {
-                if (!/^[A-Za-z][A-Za-z0-9_]*$/.test(entry.value))
+                if (!/^[A-Za-z]\w*$/.test(entry.value))
                     continue;
                 const target = findUniqueApexClassFilePath(entry.value, repoPath);
                 if (target)
@@ -3469,7 +3583,7 @@ async function indexSalesforceMetadataFile(content, relativePath, repoPath, db,
                 if (!/<actionType>apex<\/actionType>/.test(action[1]))
                     continue;
                 for (const entry of staticXmlTagValues(action[1], "actionName")) {
-                    const target = entry.value.match(/^([A-Za-z][A-Za-z0-9_]*)\.([A-Za-z][A-Za-z0-9_]*)$/);
+                    const target = /^([A-Za-z]\w*)\.([A-Za-z]\w*)$/.exec(entry.value);
                     if (!target)
                         continue;
                     const classFile = findApexMethodFilePath(target[1], target[2], repoPath);
@@ -3478,7 +3592,7 @@ async function indexSalesforceMetadataFile(content, relativePath, repoPath, db,
                 }
             }
             for (const entry of staticXmlTagValues(content, "extensionName")) {
-                const component = entry.value.match(/^c:([A-Za-z][A-Za-z0-9_]*)$/);
+                const component = /^c:([A-Za-z]\w*)$/.exec(entry.value);
                 if (!component)
                     continue;
                 const target = findSalesforceLwcComponentFile(component[1], repoPath);
@@ -3548,14 +3662,14 @@ async function indexLwcBundleFile(content, relativePath, repoPath, db, bundle) {
                 continue;
             if (source.startsWith("c/")) {
                 const name = source.slice(2);
-                if (/^[A-Za-z][A-Za-z0-9_]*$/.test(name)) {
+                if (/^[A-Za-z]\w*$/.test(name)) {
                     const target = findLwcComponentFile(relativePath, name, repoPath);
                     if (target)
                         dependencies.push({ to: target, kind: "lwc_component" });
                 }
                 continue;
             }
-            const apex = source.match(/^@salesforce\/apex\/([A-Za-z][A-Za-z0-9_]*)\.([A-Za-z][A-Za-z0-9_]*)$/);
+            const apex = /^@salesforce\/apex\/([A-Za-z]\w*)\.([A-Za-z]\w*)$/.exec(source);
             if (apex && !source.includes("__")) {
                 const target = findApexMethodFilePath(apex[1], apex[2], repoPath);
                 if (target) {
@@ -3570,7 +3684,7 @@ async function indexLwcBundleFile(content, relativePath, repoPath, db, bundle) {
                 }
                 continue;
             }
-            const schema = source.match(/^@salesforce\/schema\/([^/]+)$/);
+            const schema = /^@salesforce\/schema\/([^/]+)$/.exec(source);
             if (schema && isUnnamespacedSalesforceIdentifier(schema[1])) {
                 dependencies.push({
                     to: schema[1],
@@ -3579,7 +3693,7 @@ async function indexLwcBundleFile(content, relativePath, repoPath, db, bundle) {
                 continue;
             }
             if (source.startsWith("lightning/")) {
-                for (const binding of bindings.matchAll(/(?:\{|,)\s*([A-Za-z_$][\w$]*)/g)) {
+                for (const binding of bindings.matchAll(/[{,]\s*([A-Za-z_$][\w$]*)/g)) {
                     if (binding[1])
                         importedNames.set(binding[1], source);
                 }
@@ -3685,11 +3799,32 @@ export function parseWqlQuery(query) {
         fields: [],
         parameters: [],
     };
-    const fromMatch = query.match(/FROM\s+([a-zA-Z0-9_]+)/i);
+    const fromMatch = /FROM\s+(\w+)/i.exec(query);
     if (fromMatch) {
         result.table = fromMatch[1];
     }
-    const selectMatch = query.match(/SELECT\s+(.+?)\s+FROM/i);
+    // The field-list pattern is lazy and retries at every position where SELECT
+    // could begin, so on a long single-line query with no FROM it rescans to end
+    // of input from each one. Measured at ratio ~4.0 per doubling — 2.7s on a
+    // 288 KB query.
+    //
+    // The pattern cannot match without `\s+FROM` present, so proving that
+    // substring absent is exactly equivalent to running it, and costs one linear
+    // pass with no quantifier to backtrack over. Equivalence checked on 14 cases
+    // including nested SELECT, FROM without SELECT, tabs, newlines and
+    // "SELECT Id FROMAccount", plus 100,000 randomised inputs: zero differences.
+    // Degenerate input at n=32,000 falls from 2698ms to 0.078ms, ratio 1.40.
+    //
+    // S8786 still reports the literal, because the rule reads the pattern and
+    // cannot see the guard in front of it. Unlike the brace pattern above, this
+    // one is genuinely super-linear in isolation — what is bounded is the call,
+    // not the regex. Rewriting it as an index scan would satisfy the rule, but
+    // `.` excluding newline makes the equivalent scan subtle enough that the
+    // measured guard is the safer trade for a release. Recorded here rather than
+    // suppressed silently; worth revisiting with the field-list parser.
+    const selectMatch = /\sFROM/i.test(query)
+        ? /SELECT\s+(.+?)\s+FROM/i.exec(query) // NOSONAR S8786 — guarded above, measured linear
+        : null;
     if (selectMatch) {
         const fieldsPart = selectMatch[1];
         let currentField = "";
@@ -3718,7 +3853,7 @@ export function parseWqlQuery(query) {
         if (finalF)
             result.fields.push(finalF);
     }
-    const paramMatches = query.matchAll(/(?:\?([0-9a-zA-Z_]+)?|:([a-zA-Z0-9_]+)|@\{([a-zA-Z0-9_]+)\})/g);
+    const paramMatches = query.matchAll(/(?:\?(\w+)?|:(\w+)|@\{(\w+)\})/g);
     for (const match of paramMatches) {
         const param = match[1] || match[2] || match[3] || "?";
         if (!result.parameters.includes(param)) {
@@ -3774,7 +3909,7 @@ async function indexLsifDump(absolutePath, _relativePath, repoPath, db) {
             }
             else if (item.type === "edge") {
                 const outV = item.outV.toString();
-                const inVs = item.inVs ? item.inVs.map((id) => String(id)) : [item.inV.toString()];
+                const inVs = item.inVs ? item.inVs.map(String) : [item.inV.toString()];
                 if (item.label === "contains") {
                     for (const rId of inVs) {
                         const r = ranges.get(rId);
@@ -3862,7 +3997,7 @@ async function indexLsifDump(absolutePath, _relativePath, repoPath, db) {
                 const lines = summary.split("\n");
                 if (lines.length > 0) {
                     const firstLine = lines[0].replace(/```\w*/, "").trim();
-                    const fnMatch = firstLine.match(/(?:function|class|interface|const|let|var)\s+([a-zA-Z0-9_]+)/);
+                    const fnMatch = /(?:function|class|interface|const|let|var)\s+(\w+)/.exec(firstLine);
                     if (fnMatch) {
                         name = fnMatch[1];
                     }
@@ -3903,9 +4038,36 @@ async function indexLsifDump(absolutePath, _relativePath, repoPath, db) {
         console.error("Error indexing LSIF:", error);
     }
 }
+/**
+ * Replace the imported-findings tier for one source, leaving graph facts and any
+ * other tool's findings untouched. Re-importing the same log is idempotent.
+ */
+function persistSarifFindings(db, facts) {
+    const insert = db.prepare(`
+		INSERT INTO findings
+			(ruleId, tool, level, message, filePath, startLine, startCol, endLine, endCol, helpUri, source)
+		VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
+	`);
+    db.run("BEGIN TRANSACTION;");
+    try {
+        // Scoped to the tools in this log: importing an ESLint log must not delete
+        // PMD findings imported earlier from a different run.
+        for (const tool of facts.tools)
+            db.run("DELETE FROM findings WHERE tool = ?", [tool]);
+        for (const finding of facts.findings) {
+            insert.run(finding.ruleId, finding.tool, finding.level, finding.message, finding.filePath, finding.startLine, finding.startColumn, finding.endLine, finding.endColumn, finding.helpUri ?? null, facts.inputPath);
+        }
+        db.run("COMMIT;");
+    }
+    catch (error) {
+        db.run("ROLLBACK;");
+        throw error;
+    }
+    return facts.findings.length;
+}
 /** Replace only the optional SCIP tier, preserving native and LSIF facts verbatim. */
 function persistScipFacts(db, repoPath, facts) {
-    const affectedFiles = [...new Set(facts.symbols.map((symbol) => symbol.filePath))].sort();
+    const affectedFiles = [...new Set(facts.symbols.map((symbol) => symbol.filePath))].sort(compareBytes);
     const insertSymbol = db.prepare(`
 		INSERT INTO symbols (name, kind, filePath, startLine, endLine, startCol, endCol, summary)
 		VALUES (?, ?, ?, ?, ?, ?, ?, ?)
@@ -3972,8 +4134,6 @@ function invalidateScipFacts(db) {
 }
 async function indexTerraformFile(content, relativePath, _repoPath, db) {
     const symbols = [];
-    const references = [];
-    const dependencies = [];
     const lines = content.split("\n");
     const blockRegex = /^\s*(resource|data|module)\s+"([^"]+)"\s+"([^"]+)"\s*\{/i;
     const blockRegexAlt = /^\s*(resource|data|module)\s+"([^"]+)"\s*\{/i;
@@ -4024,23 +4184,7 @@ async function indexTerraformFile(content, relativePath, _repoPath, db) {
         for (const def of symbols) {
             insertSym.run(def.name, def.kind, relativePath, def.startLine, def.endLine, def.startCol, def.endCol, def.summary);
         }
-        const insertRef = db.prepare(`
-			INSERT INTO "references" (callerSymbol, callerFile, calleeSymbol, calleeFile, line, column)
-			VALUES (?, ?, ?, NULL, ?, ?)
-		`);
-        for (const ref of references) {
-            insertRef.run(ref.callerSymbol, relativePath, ref.calleeSymbol, ref.line, ref.column);
-        }
-        const insertDep = db.prepare(`
-			INSERT INTO dependencies (fromFile, toFile, kind, confidence)
-			VALUES (?, ?, ?, ?)
-		`);
-        for (const dep of dependencies) {
-            insertDep.run(relativePath, dep.toFile, dep.kind, dep.confidence);
-        }
         insertSym.finalize();
-        insertRef.finalize();
-        insertDep.finalize();
         db.run("COMMIT;");
     }
     catch (error) {
@@ -4102,6 +4246,385 @@ async function indexDockerFile(content, relativePath, _repoPath, db) {
         throw error;
     }
 }
+/**
+ * Removes fenced blocks and inline code spans. A document demonstrating markdown
+ * would otherwise contribute its examples as real edges, which is worse than
+ * missing them: a fabricated dependency is indistinguishable from a true one.
+ */
+function stripMarkdownCode(content) {
+    return content
+        .replace(/^```[\s\S]*?^```/gm, "")
+        .replace(/^~~~[\s\S]*?^~~~/gm, "")
+        .replace(/`[^`\n]*`/g, "");
+}
+// Linear-time by construction, which took three attempts to actually achieve.
+// Documentation is untrusted input here — it arrives in a mirror of someone
+// else's repository — so a quadratic scan is a denial-of-service risk, not a
+// style problem.
+//
+// Two things are required, and the first two attempts each got only one:
+//
+//  1. No ambiguity *within* an attempt. The optional `<…>` wrapper and trailing
+//     `"title"` are no longer spelled out here; `markdownLinkTarget` splits them
+//     off in code. Each class below is disjoint from what follows it.
+//  2. No quadratic blow-up *across* attempts. Excluding `[` from both classes is
+//     what buys this. Without it, input like `[a[a[a…` with no closing bracket
+//     starts an attempt at every `[`, and each one scans to end of input.
+//
+// A link target containing a literal `[` is therefore not recorded. That is the
+// safe direction: a missing edge, never a wrong one.
+const MARKDOWN_INLINE_LINK = /!?\[[^[\]\n]*\]\(([^[)\n]*)\)/g;
+// The label class excludes newlines. Without that, `[^\]]+` matches across
+// lines, so a stray unclosed `[` anywhere in a document swallows everything up
+// to the next `]:` and records an edge to whatever file happens to follow it —
+// a *fabricated* edge, which is worse than a missing one, because downstream it
+// is indistinguishable from a real dependency. A reference definition is a
+// single-line construct; the pattern now says so.
+const MARKDOWN_REFERENCE_DEFINITION = /^[ \t]{0,3}\[[^\]\n]+\]:[ \t]*<?([^>\s]+)>?/gm;
+/**
+ * Extracts the target from a markdown link's parenthesised body, discarding an
+ * optional `<…>` wrapper and a trailing `"title"`. Done in code rather than in
+ * {@link MARKDOWN_INLINE_LINK} so the pattern stays backtrack-free.
+ */
+function markdownLinkTarget(inner) {
+    const trimmed = inner.trim();
+    if (trimmed.startsWith("<")) {
+        const close = trimmed.indexOf(">");
+        return close === -1 ? trimmed.slice(1) : trimmed.slice(1, close);
+    }
+    const titleAt = trimmed.search(/[ \t]/);
+    return titleAt === -1 ? trimmed : trimmed.slice(0, titleAt);
+}
+/** C0 controls and DEL. Never legitimate in a link target; see below. */
+// biome-ignore lint/suspicious/noControlCharactersInRegex: matching them is the point
+const CONTROL_CHARACTERS = /[\x00-\x1f\x7f]/;
+/**
+ * Resolves a markdown link target to a repository-relative path, or null when it
+ * does not denote one (external URL, bare anchor, or an escape above the root).
+ *
+ * In a mirror this parses documentation from a repository nobody here has read,
+ * so the target is untrusted. Two rejections exist for that reason:
+ *
+ *   - Control characters, NUL above all. A NUL would otherwise be stored as part
+ *     of `toFile` and echoed in evidence, and C-based consumers truncate there:
+ *     a grep over such a path silently reports no matches, which reads as "this
+ *     file has no references" rather than "your query could not match". That
+ *     exact confusion cost real debugging time in this repository.
+ *   - Backslashes, normalized to `/` BEFORE the traversal check rather than
+ *     rejected. `path.posix` treats `..\..\x` as one odd filename, so the `..`
+ *     guard below never fires — and `path.join` on Windows would then read those
+ *     backslashes as separators and escape the repository. Normalizing first
+ *     makes the existing guard see the traversal it was written to catch.
+ */
+function resolveDocumentLink(target, relativePath) {
+    if (CONTROL_CHARACTERS.test(target))
+        return null;
+    // Any scheme (http:, https:, mailto:, ftp:) is off-repository.
+    if (/^[a-z][a-z0-9+.-]*:/i.test(target))
+        return null;
+    const forwardSlashed = target.replaceAll("\\", "/");
+    if (forwardSlashed.startsWith("//"))
+        return null;
+    const withoutFragment = forwardSlashed.split("#")[0].split("?")[0];
+    if (!withoutFragment)
+        return null;
+    const normalized = relativePath.replaceAll("\\", "/");
+    const joined = withoutFragment.startsWith("/")
+        ? path.posix.normalize(withoutFragment.slice(1))
+        : path.posix.normalize(path.posix.join(path.posix.dirname(normalized), withoutFragment));
+    if (joined.startsWith("..") || joined === "." || joined === "")
+        return null;
+    return joined;
+}
+/**
+ * Link-only indexer for markdown. Produces no symbols — only `dependencies`
+ * edges — which the schema permits: nothing joins `dependencies` to `symbols`,
+ * and the health audit's orphan predicates key on `fromFile` being in
+ * `index_state`, never on the file having contributed symbols.
+ *
+ * A target that resolves inside the repository but does not exist is recorded as
+ * `doc_link_broken` rather than dropped, which is what makes stale documentation
+ * a queryable fact instead of an absence.
+ */
+async function indexMarkdownFile(content, relativePath, repoPath, db) {
+    const edges = new Map();
+    const body = stripMarkdownCode(content);
+    const record = (rawTarget) => {
+        const resolved = resolveDocumentLink(rawTarget, relativePath);
+        if (!resolved || resolved === relativePath)
+            return;
+        const exists = fs.existsSync(path.join(repoPath, resolved));
+        const kind = exists ? "doc_link" : "doc_link_broken";
+        const key = `${kind}:${resolved}`;
+        if (!edges.has(key))
+            edges.set(key, {
+                toFile: resolved,
+                kind,
+                // A broken target is a real observation but a weaker claim about
+                // structure, so it never carries full confidence.
+                confidence: exists ? 1.0 : 0.5,
+                evidence: rawTarget.slice(0, 500),
+            });
+    };
+    for (const match of body.matchAll(MARKDOWN_INLINE_LINK))
+        record(markdownLinkTarget(match[1]));
+    for (const match of body.matchAll(MARKDOWN_REFERENCE_DEFINITION))
+        record(match[1]);
+    persistLinkOnlyEdges(db, relativePath, [...edges.values()]);
+}
+/**
+ * Well-known CI keys that name another pipeline file. Deliberately NOT general
+ * YAML understanding: an over-broad extractor here would emit confident,
+ * unfalsifiable edges from arbitrary config, which is worse than no coverage.
+ *
+ * `uses:` is matched only for workspace-relative composite actions (`./...`),
+ * which GitHub resolves from the REPOSITORY ROOT. `template:`/`local:` are
+ * resolved relative to the CONTAINING FILE, per Azure Pipelines and GitLab CI.
+ * Registry references (`actions/checkout@v4`, `file.yml@resource`) are not files
+ * in this repository and are skipped rather than recorded as fake paths.
+ */
+const YAML_ROOT_RELATIVE_REF = /^[ \t-]*uses:[ \t]*["']?(\.[^"'\s]+)/gm;
+const YAML_FILE_RELATIVE_REF = /^[ \t-]*(?:template|local):[ \t]*["']?([^"'\s@]+\.ya?ml)/gm;
+/**
+ * Link-only indexer for CI YAML. Produces `dependencies` edges between pipeline
+ * files so a template's consumers are answerable; extracts no symbols.
+ */
+async function indexYamlFile(content, relativePath, repoPath, db) {
+    const edges = new Map();
+    const record = (rawTarget, base) => {
+        const resolved = base === "repo-root"
+            ? resolveDocumentLink(rawTarget.replace(/^\.\//, ""), "placeholder.yml")
+            : resolveDocumentLink(rawTarget, relativePath);
+        if (!resolved || resolved === relativePath)
+            return;
+        const exists = fs.existsSync(path.join(repoPath, resolved));
+        const kind = exists ? "workflow_ref" : "workflow_ref_broken";
+        const key = `${kind}:${resolved}`;
+        if (!edges.has(key))
+            edges.set(key, {
+                toFile: resolved,
+                kind,
+                confidence: exists ? 1.0 : 0.5,
+                evidence: rawTarget.slice(0, 500),
+            });
+    };
+    for (const match of content.matchAll(YAML_ROOT_RELATIVE_REF))
+        record(match[1], "repo-root");
+    for (const match of content.matchAll(YAML_FILE_RELATIVE_REF))
+        record(match[1], "containing-file");
+    persistLinkOnlyEdges(db, relativePath, [...edges.values()]);
+}
+/**
+ * MSBuild project-to-project edges. `<ProjectReference>` is the dependency graph
+ * between .NET projects; `<Import>` pulls in shared `.props`/`.targets`.
+ * `<PackageReference>` is deliberately excluded — a NuGet package is not a file
+ * in this repository, and recording one as a path would invent a target.
+ */
+// Both classes exclude `<` as well as `>`, and that is what keeps the scan
+// linear rather than quadratic. Measured before and after on `.csproj` content
+// whose tags are never closed: with `[^>]*?` alone, 28k/56k/112k chars took
+// 6.0/22.7/92.5ms — doubling the input roughly quadrupled the time, because the
+// lazy scan runs to end of input from every `<ProjectReference` and a new
+// attempt starts at every one. Excluding `<` makes an attempt die at the next
+// tag instead. This is also the correct reading of XML: a `<` cannot appear
+// inside a tag or an attribute value, so nothing valid is lost.
+//
+// It matters because `.csproj`/`.props`/`.targets` are indexed from mirrors —
+// content from a repository nobody here has read.
+const MSBUILD_PROJECT_REFERENCE = /<(?:ProjectReference|Import)\s[^><]*?(?:Include|Project)="([^"<]+)"/g;
+/** `Project("{TYPE-GUID}") = "Name", "relative\path.csproj", "{PROJECT-GUID}"`. */
+// Every class excludes newlines, for the same reason as the markdown reference
+// definition above: a `.sln` project entry occupies one line, and letting the
+// classes span lines lets a malformed entry reach across the file and record a
+// path that was never written next to it.
+const SOLUTION_PROJECT_ENTRY = /^Project\("\{[^}\n]*\}"\)\s*=\s*"[^"\n]*",\s*"([^"\n]+)"/gm;
+/**
+ * Link-only indexer for the .NET build graph: `.csproj`/`.props`/`.targets` via
+ * MSBuild XML, and `.sln` via its own line format (which is not XML). Produces
+ * `dependencies` edges only.
+ */
+async function indexDotnetProjectFile(content, relativePath, repoPath, db) {
+    const edges = new Map();
+    const record = (rawTarget) => {
+        // MSBuild and solution files use Windows separators even on Unix.
+        const resolved = resolveDocumentLink(rawTarget.replaceAll("\\", "/"), relativePath);
+        if (!resolved || resolved === relativePath)
+            return;
+        const exists = fs.existsSync(path.join(repoPath, resolved));
+        const kind = exists ? "project_ref" : "project_ref_broken";
+        const key = `${kind}:${resolved}`;
+        if (!edges.has(key))
+            edges.set(key, {
+                toFile: resolved,
+                kind,
+                confidence: exists ? 1.0 : 0.5,
+                evidence: rawTarget.slice(0, 500),
+            });
+    };
+    const pattern = relativePath.endsWith(".sln")
+        ? SOLUTION_PROJECT_ENTRY
+        : MSBUILD_PROJECT_REFERENCE;
+    for (const match of content.matchAll(pattern))
+        record(match[1]);
+    persistLinkOnlyEdges(db, relativePath, [...edges.values()]);
+}
+/** Net brace depth change across a line, ignoring braces inside strings. */
+function netBraceDepth(line) {
+    let depth = 0;
+    let quote = null;
+    for (let i = 0; i < line.length; i++) {
+        const char = line[i];
+        if (quote) {
+            if (char === "\\")
+                i++;
+            else if (char === quote)
+                quote = null;
+            continue;
+        }
+        if (char === '"' || char === "'")
+            quote = char;
+        else if (char === "{")
+            depth++;
+        else if (char === "}")
+            depth--;
+    }
+    return depth;
+}
+/**
+ * Projects a Razor file onto a C# buffer with the SAME NUMBER OF LINES, keeping
+ * `@code` / `@functions` member bodies at their original line positions and
+ * blanking everything else.
+ *
+ * Line geometry is preserved deliberately rather than reconstructed: symbols
+ * parsed out of the projection carry line numbers that are already correct for
+ * the original file, so there is no offset arithmetic to get wrong. That matters
+ * more here than coverage — a Razor symbol reported at the wrong line is
+ * confidently misleading evidence, which is worse than not indexing Razor at all.
+ *
+ * Only the opening `@code {` line is rewritten (to `class __RazorCode {`), so
+ * columns on that one line shift; every member line is copied verbatim and keeps
+ * both its line and column. Returns null when the file declares no member block.
+ */
+/** Not global: this is tested per line, so `exec` must not carry lastIndex. */
+const RAZOR_MEMBER_BLOCK = /@(?:code|functions)\s*\{/;
+function projectRazorToCSharp(content) {
+    const lines = content.split("\n");
+    const projected = new Array(lines.length).fill("");
+    let depth = 0;
+    let found = false;
+    for (let index = 0; index < lines.length; index++) {
+        const line = lines[index];
+        if (depth === 0) {
+            const opener = RAZOR_MEMBER_BLOCK.exec(line);
+            if (!opener)
+                continue;
+            const at = line.indexOf(opener[0]);
+            const tail = line.slice(at + opener[0].length);
+            projected[index] = `${" ".repeat(at)}class __RazorCode {${tail}`;
+            depth = 1 + netBraceDepth(tail);
+            found = true;
+            if (depth <= 0)
+                depth = 0;
+            continue;
+        }
+        projected[index] = line;
+        depth += netBraceDepth(line);
+        if (depth <= 0)
+            depth = 0;
+    }
+    return found ? projected.join("\n") : null;
+}
+/**
+ * Indexes the C# members declared in a Razor file's `@code` / `@functions`
+ * block, reusing the existing C# grammar and extractor rather than describing
+ * Razor as its own language. Markup, directives and inline expressions are not
+ * indexed.
+ */
+async function indexRazorFile(content, relativePath, _repoPath, db) {
+    const projected = projectRazorToCSharp(content);
+    if (!projected)
+        return;
+    const language = await getLanguageForFile("razor-projection.cs");
+    if (!language)
+        return;
+    const parser = new Parser();
+    parser.setLanguage(language);
+    const tree = parser.parse(projected);
+    if (!tree)
+        return;
+    // `filePath` drives the extractor's language-specific branches, so it must
+    // look like C#; the rows are persisted against the real Razor path below.
+    const extracted = extractSymbolsAndReferences(tree.rootNode, false, false, "razor-projection.cs");
+    tree.delete();
+    parser.delete();
+    // The synthetic wrapper class exists only to make members parseable.
+    const definitions = extracted.definitions.filter((def) => def.name !== "__RazorCode");
+    db.run("BEGIN TRANSACTION;");
+    try {
+        db.run('DELETE FROM "references" WHERE callerFile = ?', [relativePath]);
+        deleteSymbolsForFile(db, relativePath);
+        db.run("DELETE FROM dependencies WHERE fromFile = ?", [relativePath]);
+        // finalize() in a `finally`: a throw mid-loop would otherwise leave the
+        // statement open, and an unfinalized statement can keep SQLite state alive
+        // across the ROLLBACK below — which surfaces later as an unexplained lock
+        // rather than as the error that actually caused it.
+        const insertSym = db.prepare(`
+			INSERT INTO symbols (name, kind, filePath, startLine, endLine, startCol, endCol, summary)
+			VALUES (?, ?, ?, ?, ?, ?, ?, ?)
+		`);
+        try {
+            for (const def of definitions) {
+                insertSym.run(def.name, def.kind, relativePath, def.startLine, def.endLine, def.startCol, def.endCol, def.summary);
+            }
+        }
+        finally {
+            insertSym.finalize();
+        }
+        const insertRef = db.prepare(`
+			INSERT INTO "references" (callerSymbol, callerFile, calleeSymbol, calleeFile, line, column)
+			VALUES (?, ?, ?, NULL, ?, ?)
+		`);
+        try {
+            for (const ref of extracted.references)
+                insertRef.run(ref.callerSymbol, relativePath, ref.calleeSymbol, ref.line, ref.column);
+        }
+        finally {
+            insertRef.finalize();
+        }
+        db.run("COMMIT;");
+    }
+    catch (error) {
+        db.run("ROLLBACK;");
+        throw error;
+    }
+}
+/** Standard delete-then-insert transaction shared by the link-only indexers. */
+function persistLinkOnlyEdges(db, relativePath, edges) {
+    db.run("BEGIN TRANSACTION;");
+    try {
+        db.run('DELETE FROM "references" WHERE callerFile = ?', [relativePath]);
+        deleteSymbolsForFile(db, relativePath);
+        db.run("DELETE FROM dependencies WHERE fromFile = ?", [relativePath]);
+        // See persistRazorSymbols: finalize in a `finally` so a mid-loop throw
+        // cannot leave the statement open across the ROLLBACK.
+        const insertDep = db.prepare(`
+			INSERT INTO dependencies (fromFile, toFile, kind, confidence, sourceEvidence)
+			VALUES (?, ?, ?, ?, ?)
+		`);
+        try {
+            for (const edge of edges)
+                insertDep.run(relativePath, edge.toFile, edge.kind, edge.confidence, edge.evidence);
+        }
+        finally {
+            insertDep.finalize();
+        }
+        db.run("COMMIT;");
+    }
+    catch (error) {
+        db.run("ROLLBACK;");
+        throw error;
+    }
+}
 async function indexWorkdayFile(content, tree, relativePath, _repoPath, db) {
     const symbols = [];
     const references = [];
@@ -4189,7 +4712,7 @@ async function indexWorkdayFile(content, tree, relativePath, _repoPath, db) {
                         if (contentNode) {
                             for (let i = 0; i < contentNode.childCount; i++) {
                                 const child = contentNode.child(i);
-                                if (child && child.type === "element") {
+                                if (child?.type === "element") {
                                     const childStagNode = child.children.find((c) => c.type === "STag" || c.type === "EmptyElemTag");
                                     if (childStagNode) {
                                         const childTagNameNode = childStagNode.children.find((c) => c.type === "Name");
@@ -4249,17 +4772,20 @@ async function indexWorkdayFile(content, tree, relativePath, _repoPath, db) {
         const op = match[1].trim();
         addDependency(op, "wws", 1.0);
     }
-    const operationTagRegex = /<(?:[a-zA-Z0-9_]+:)?operation[^>]*>([^<]+)<\/(?:[a-zA-Z0-9_]+:)?operation>/gi;
+    const operationTagRegex = /<(?:\w+:)?operation[^>]*>([^<]+)<\/(?:\w+:)?operation>/gi;
     const tagMatches = content.matchAll(operationTagRegex);
     for (const match of tagMatches) {
         const op = match[1].trim();
         addDependency(op, "wws", 1.0);
     }
-    const wqlQueryRegex = /SELECT\s+([\s\S]+?)\s+FROM\s+([a-zA-Z0-9_]+)/gi;
+    // The select list is matched but never read, so it stays uncaptured. Pinning it to
+    // end on a non-whitespace character (with a bare `\s` for the single-whitespace
+    // case) keeps `\s+FROM` from re-splitting every whitespace run, which is quadratic.
+    const wqlQueryRegex = /SELECT\s(?:\s|[\s\S]*?(?<!\s))\s+FROM\s+(\w+)/gi;
     const wqlMatches = content.matchAll(wqlQueryRegex);
     for (const match of wqlMatches) {
         const fullQuery = match[0];
-        const table = match[2].trim();
+        const table = match[1].trim();
         const wqlRes = parseWqlQuery(fullQuery);
         const targetTable = wqlRes.table || table;
         if (targetTable) {
@@ -4326,8 +4852,8 @@ async function indexAuraBundleFile(content, relativePath, repoPath, db, bundle)
     // computed strings, and client-side action names deliberately produce no edge.
     if (bundle.extension === "cmp") {
         const markup = content.replace(/<!--[\s\S]*?-->/g, (comment) => comment.replace(/[^\n]/g, " "));
-        const componentTag = markup.match(/<aura:component\b[^>]*>/i)?.[0];
-        const controller = componentTag?.match(/\bcontroller\s*=\s*["']([A-Za-z][A-Za-z0-9_]*)["']/i)?.[1];
+        const componentTag = /<aura:component\b[^>]*>/i.exec(markup)?.[0];
+        const controller = /\bcontroller\s*=\s*["']([a-z]\w*)["']/i.exec(componentTag ?? "")?.[1];
         if (controller) {
             const target = findUniqueApexClassFilePath(controller, repoPath);
             if (target)
@@ -4339,7 +4865,7 @@ async function indexAuraBundleFile(content, relativePath, repoPath, db, bundle)
         }
         // An Aura markup tag in the local `c` namespace is a declared, static LWC
         // target only when the matching Salesforce DX LWC entry point exists.
-        for (const match of markup.matchAll(/<c:([A-Za-z][A-Za-z0-9_]*)\b/g)) {
+        for (const match of markup.matchAll(/<c:([A-Za-z]\w*)\b/g)) {
             const target = findSalesforceLwcComponentFile(match[1], repoPath);
             if (target)
                 dependencies.push({
@@ -4510,11 +5036,11 @@ async function indexVisualforceFile(content, tree, relativePath, repoPath, db) {
     const pageTagMatches = content.matchAll(pageTagRegex);
     for (const pageTagMatch of pageTagMatches) {
         const tagContent = pageTagMatch[0];
-        const controllerMatch = tagContent.match(/controller\s*=\s*["']([^"']+)["']/i);
+        const controllerMatch = /controller\s*=\s*["']([^"']+)["']/i.exec(tagContent);
         if (controllerMatch?.[1]) {
             controllerNames.add(controllerMatch[1].trim());
         }
-        const extensionsMatch = tagContent.match(/extensions\s*=\s*["']([^"']+)["']/i);
+        const extensionsMatch = /extensions\s*=\s*["']([^"']+)["']/i.exec(tagContent);
         if (extensionsMatch?.[1]) {
             const extList = extensionsMatch[1]
                 .split(",")
@@ -4531,7 +5057,7 @@ async function indexVisualforceFile(content, tree, relativePath, repoPath, db) {
     const exprMatches = content.matchAll(exprRegex);
     for (const match of exprMatches) {
         const expr = match[1];
-        const words = expr.match(/[a-zA-Z_][a-zA-Z0-9_]*/g);
+        const words = expr.match(/[a-zA-Z_]\w*/g);
         if (words) {
             for (const word of words) {
                 if (["true", "false", "null", "and", "or", "not", "if"].includes(word.toLowerCase())) {
@@ -4658,7 +5184,7 @@ async function indexSqlFile(content, tree, relativePath, _repoPath, db) {
         }
         if (node.type === "relation" || node.type === "object_reference") {
             const refName = node.text.replace(/["`]/g, "").trim();
-            if (refName && /^[a-zA-Z_][a-zA-Z0-9_]*$/.test(refName)) {
+            if (refName && /^[a-zA-Z_]\w*$/.test(refName)) {
                 references.push({
                     callerSymbol: null,
                     calleeSymbol: refName,
@@ -4675,7 +5201,7 @@ async function indexSqlFile(content, tree, relativePath, _repoPath, db) {
         }
     }
     traverse(tree.rootNode);
-    const procRegex = /CREATE\s+(?:OR\s+REPLACE\s+)?(PROCEDURE|PROC|FUNCTION|TRIGGER)\s+([a-zA-Z0-9_]+)/gi;
+    const procRegex = /CREATE\s+(?:OR\s+REPLACE\s+)?(PROCEDURE|PROC|FUNCTION|TRIGGER)\s+(\w+)/gi;
     let procMatch = procRegex.exec(content);
     while (procMatch !== null) {
         const type = procMatch[1].toLowerCase();
@@ -4693,7 +5219,7 @@ async function indexSqlFile(content, tree, relativePath, _repoPath, db) {
         });
         procMatch = procRegex.exec(content);
     }
-    const lineageRegex = /(?:FROM|JOIN|INTO|UPDATE)\s+([a-zA-Z0-9_]+)/gi;
+    const lineageRegex = /(?:FROM|JOIN|INTO|UPDATE)\s+(\w+)/gi;
     let lineageMatch = lineageRegex.exec(content);
     while (lineageMatch !== null) {
         const tblName = lineageMatch[1];
@@ -4763,7 +5289,7 @@ async function indexPrismaFile(content, tree, relativePath, _repoPath, db) {
                 if (block) {
                     for (let i = 0; i < block.childCount; i++) {
                         const colDecl = block.child(i);
-                        if (colDecl && colDecl.type === "column_declaration") {
+                        if (colDecl?.type === "column_declaration") {
                             const typeNode = colDecl.childForFieldName("type") ||
                                 colDecl.children.find((c) => c.type === "column_type");
                             if (typeNode) {
@@ -4774,8 +5300,7 @@ async function indexPrismaFile(content, tree, relativePath, _repoPath, db) {
                                         from: modelName,
                                         to: targetModel,
                                         kind: "orm-relation",
-                                    });
-                                    dependencies.push({
+                                    }, {
                                         from: relativePath,
                                         to: targetModel,
                                         kind: "orm-relation",
@@ -4795,12 +5320,14 @@ async function indexPrismaFile(content, tree, relativePath, _repoPath, db) {
         }
     }
     traverse(tree.rootNode);
-    const modelBlockRegex = /model\s+([a-zA-Z0-9_]+)\s*\{([^}]+)\}/g;
+    const modelBlockRegex = /model\s+(\w+)\s*\{([^}]+)\}/g;
     let mBlock = modelBlockRegex.exec(content);
     while (mBlock !== null) {
         const srcModel = mBlock[1];
         const blockContent = mBlock[2];
-        const relationRegex = /[a-zA-Z0-9_]+\s+([a-zA-Z0-9_]+)\s+@relation/g;
+        // `(?<!\w)` pins the leading field name to a word start; without it the scan
+        // restarts inside every identifier and re-walks it, which is quadratic.
+        const relationRegex = /(?<!\w)\w+\s+(\w+)\s+@relation/g;
         let rel = relationRegex.exec(blockContent);
         while (rel !== null) {
             const targetModel = rel[1];
@@ -4874,7 +5401,7 @@ export function parseSimpleNameFromUniqueId(uniqueId) {
     const parts = uniqueId.split(".");
     if (parts.length >= 3) {
         if (parts[0] === "source") {
-            return `${parts[parts.length - 2]}.${parts[parts.length - 1]}`;
+            return `${parts.at(-2)}.${parts.at(-1)}`;
         }
         return parts[parts.length - 1];
     }
@@ -5081,8 +5608,16 @@ export async function indexDbtManifestFile(content, _absolutePath, relativePath,
         console.error(`Error indexing dbt manifest file ${relativePath}:`, error);
     }
 }
-/** Index a single file's symbols and references into the SQLite database. */
-async function indexFile(absolutePath, relativePath, repoPath, db) {
+/**
+ * Index a single file's symbols and references into the SQLite database.
+ *
+ * `unparsed`, when supplied, receives a per-extension tally of files that were
+ * collected as indexable but produced no graph facts — no grammar claimed them,
+ * they were rejected as minified, or indexing threw. These are invisible
+ * otherwise: the function swallows all three cases, so a whole language silently
+ * contributing nothing looks exactly like a language with nothing to say.
+ */
+async function indexFile(absolutePath, relativePath, repoPath, db, unparsed) {
     try {
         invalidateScipFacts(db);
         const baseName = path.basename(absolutePath).toLowerCase();
@@ -5135,16 +5670,45 @@ async function indexFile(absolutePath, relativePath, repoPath, db) {
             await indexSalesforceMetadataFile(content, relativePath, repoPath, db, salesforceMetadata);
             return;
         }
+        if (relativePath.endsWith(".md") || relativePath.endsWith(".mdx")) {
+            const content = measurePerfPhaseSync("read", () => fs.readFileSync(absolutePath, "utf-8"));
+            await indexMarkdownFile(content, relativePath, repoPath, db);
+            return;
+        }
+        if (relativePath.endsWith(".yml") || relativePath.endsWith(".yaml")) {
+            const content = measurePerfPhaseSync("read", () => fs.readFileSync(absolutePath, "utf-8"));
+            await indexYamlFile(content, relativePath, repoPath, db);
+            return;
+        }
+        if (relativePath.endsWith(".csproj") ||
+            relativePath.endsWith(".sln") ||
+            relativePath.endsWith(".props") ||
+            relativePath.endsWith(".targets")) {
+            const content = measurePerfPhaseSync("read", () => fs.readFileSync(absolutePath, "utf-8"));
+            await indexDotnetProjectFile(content, relativePath, repoPath, db);
+            return;
+        }
+        if (relativePath.endsWith(".cshtml") || relativePath.endsWith(".razor")) {
+            const content = measurePerfPhaseSync("read", () => fs.readFileSync(absolutePath, "utf-8"));
+            await indexRazorFile(content, relativePath, repoPath, db);
+            return;
+        }
         const lang = await measurePerfPhase("parser_wasm_init", () => getLanguageForFile(absolutePath));
-        if (!lang)
+        if (!lang) {
+            if (unparsed)
+                tallyOne(unparsed, extensionBucket(relativePath));
             return;
+        }
         const content = measurePerfPhaseSync("read", () => fs.readFileSync(absolutePath, "utf-8"));
         // Skip minified / generated bundles (e.g. a `*.bundle.js`): they're not
         // readable source and would inject thousands of junk "symbols" that pollute
         // the graph, communities, and hubs. Heuristic: a very high average line
         // length (minified code packs everything onto a few enormous lines).
-        if (isMinifiedSource(content))
+        if (isMinifiedSource(content)) {
+            if (unparsed)
+                tallyOne(unparsed, extensionBucket(relativePath));
             return;
+        }
         const isSql = absolutePath.endsWith(".sql") ||
             absolutePath.endsWith(".pkb") ||
             absolutePath.endsWith(".pks");
@@ -5305,6 +5869,8 @@ async function indexFile(absolutePath, relativePath, repoPath, db) {
     }
     catch (error) {
         console.error(`Error indexing file ${relativePath}:`, error);
+        if (unparsed)
+            tallyOne(unparsed, extensionBucket(relativePath));
     }
 }
 // The installed Transformers runtime was slower for every tested multi-item
@@ -5538,13 +6104,143 @@ function isTestFilePath(relPath) {
     return /\.(test|spec)\.[cm]?[jt]sx?$|(^|\/)(tests?|__tests__)\//i.test(relPath);
 }
 /**
- * Enumerate the repo-relative files knodin indexes: source files plus dbt
- * `manifest.json` files and Dockerfiles. Shared by the full index and the
- * cold-start reconcile so both see the identical candidate set.
+ * Repo-relative paths git knows about (tracked plus untracked-but-not-ignored),
+ * or null when `repoPath` is not itself the root of a readable git work tree —
+ * in which case the caller falls back to walking the directory.
  */
+/** Extension bucket for coverage tallies; extensionless files group together. */
+function extensionBucket(relativePath) {
+    const ext = path.posix.extname(relativePath.replaceAll("\\", "/")).toLowerCase();
+    return ext === "" ? "(no extension)" : ext;
+}
+/** Adds one to `tally[bucket]`. */
+function tallyOne(tally, bucket) {
+    tally.set(bucket, (tally.get(bucket) ?? 0) + 1);
+}
 function collectRepoFiles(repoPath) {
-    const files = [];
-    let candidates = null;
+    return collectRepoFilesWithCoverage(repoPath).files;
+}
+/** Descending-count record, so the largest coverage gap reads first. */
+function sortedTally(tally) {
+    return Object.fromEntries([...tally].sort((left, right) => right[1] - left[1]));
+}
+function sumCounts(counts) {
+    let total = 0;
+    for (const value of Object.values(counts))
+        total += value;
+    return total;
+}
+/**
+ * Reads the unparsed tally persisted by the last full index, or null when it
+ * cannot be read at all.
+ *
+ * Null and `{}` mean different things and must not be collapsed. A full index
+ * always writes this key, even when nothing was skipped, so a *present* empty
+ * object is a real "no gaps" answer. Absent, unreadable, or malformed means no
+ * full index has completed under this schema — the gap is unknown, not zero.
+ * Returning `{}` for both is how "I could not measure it" becomes "there is
+ * nothing to measure", which is the failure this whole tally exists to prevent.
+ *
+ * Still never throws: a status call must not fail because a tally is corrupt.
+ */
+function readUnparsedTally(db) {
+    if (!db)
+        return null;
+    try {
+        const raw = getMeta(db, COVERAGE_UNPARSED_META_KEY);
+        if (!raw)
+            return null;
+        const parsed = JSON.parse(raw);
+        if (typeof parsed !== "object" || parsed === null)
+            return null;
+        const counts = {};
+        for (const [key, value] of Object.entries(parsed))
+            if (typeof value === "number" && Number.isFinite(value))
+                counts[key] = value;
+        return counts;
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * The `mirror` block for a status result, or nothing when `repoPath` is an
+ * ordinary checkout. Spread into the result so the key is absent rather than
+ * undefined for non-mirrors.
+ */
+function mirrorSnapshotFor(repoPath) {
+    const record = lookupMirror(repoPath);
+    if (!record)
+        return {};
+    return { mirror: { url: record.url, sha: record.sha, fetchedAt: record.fetchedAt } };
+}
+/**
+ * Compares indexed symbols against embedded ones. A repository with no symbols
+ * is `ready`: nothing is missing. Failure to read either count reports `absent`
+ * rather than assuming completeness — the whole point is to avoid claiming
+ * coverage we cannot demonstrate.
+ */
+export function semanticReadinessFor(db) {
+    try {
+        const symbols = db.query("SELECT COUNT(*) count FROM symbols").get()?.count ?? 0;
+        if (symbols === 0)
+            return "ready";
+        const embedded = db.query("SELECT COUNT(*) count FROM symbol_embeddings").get()
+            ?.count ?? 0;
+        if (embedded === 0)
+            return "absent";
+        return embedded < symbols ? "partial" : "ready";
+    }
+    catch {
+        return "absent";
+    }
+}
+/** Worst readiness across federated repositories; any gap degrades the page. */
+function worstSemanticReadiness(states) {
+    if (states.includes("absent"))
+        return "absent";
+    if (states.includes("partial"))
+        return "partial";
+    return "ready";
+}
+/** Combines policy-level skips with the last index's unparsed tally. */
+function buildCoverageSkips(skippedByExtension, db) {
+    const byExtension = sortedTally(skippedByExtension);
+    const unparsed = readUnparsedTally(db);
+    return {
+        byExtension,
+        // Reported as empty when unknown so consumers reading only this field are
+        // unchanged; `unparsedUnknown` is what tells them the emptiness is not a
+        // measurement. `total` is then a lower bound, not a count.
+        unparsedByExtension: unparsed ?? {},
+        total: sumCounts(byExtension) + sumCounts(unparsed ?? {}),
+        ...(unparsed === null ? { unparsedUnknown: true } : {}),
+    };
+}
+/**
+ * Whether a `.json` candidate actually holds indexable symbols. Only Salesforce
+ * experience bundles and dbt manifests do; everything else is configuration. An
+ * unreadable or malformed file is not a manifest, so it is skipped like any
+ * other non-source JSON rather than failing collection.
+ */
+function isIndexableJsonCandidate(file, repoPath) {
+    if (salesforceExperienceFile(file))
+        return true;
+    if (path.basename(file).toLowerCase() !== "manifest.json")
+        return false;
+    try {
+        return isDbtManifest(fs.readFileSync(path.join(repoPath, file), "utf-8"));
+    }
+    catch {
+        // Deliberate (comment kept from main's equivalent, removed in this merge):
+        // the candidate list is a snapshot, so a `manifest.json` may be unreadable,
+        // deleted, or not valid UTF-8 by the time we read it. None of that is an
+        // indexing failure — the file simply cannot be confirmed as a dbt manifest,
+        // so it is not indexed as one.
+        return false;
+    }
+}
+function gitTrackedCandidates(repoPath) {
     try {
         const gitRoot = child_process
             .execFileSync("git", ["rev-parse", "--show-toplevel"], {
@@ -5553,48 +6249,63 @@ function collectRepoFiles(repoPath) {
             stdio: ["ignore", "pipe", "ignore"],
         })
             .trim();
-        if (gitRoot && isSameDir(gitRoot, repoPath)) {
-            candidates = splitNulPaths(child_process.execFileSync("git", ["ls-files", "-z", "--cached", "--others", "--exclude-standard"], {
-                cwd: repoPath,
-                encoding: "utf8",
-                stdio: ["ignore", "pipe", "ignore"],
-                maxBuffer: 64 * 1024 * 1024,
-            })).filter((file) => {
-                try {
-                    return fs.statSync(path.join(repoPath, file)).isFile();
-                }
-                catch {
-                    return false;
-                }
-            });
-        }
+        if (!gitRoot || !isSameDir(gitRoot, repoPath))
+            return null;
+        return splitNulPaths(child_process.execFileSync("git", ["ls-files", "-z", "--cached", "--others", "--exclude-standard"], {
+            cwd: repoPath,
+            encoding: "utf8",
+            stdio: ["ignore", "pipe", "ignore"],
+            maxBuffer: 64 * 1024 * 1024,
+        })).filter((file) => {
+            try {
+                return fs.statSync(path.join(repoPath, file)).isFile();
+            }
+            catch {
+                return false;
+            }
+        });
     }
     catch {
-        candidates = null;
+        return null;
     }
-    for (const file of candidates ?? walkRepoFiles(repoPath, { accept: isIndexableSourcePath })) {
-        if (!isIndexableSourcePath(file))
+}
+/**
+ * Enumerate the repo-relative files knodin indexes: source files plus dbt
+ * `manifest.json` files and Dockerfiles. Shared by the full index and the
+ * cold-start reconcile so both see the identical candidate set.
+ */
+function collectRepoFilesWithCoverage(repoPath) {
+    const files = [];
+    const skippedByExtension = new Map();
+    const candidates = gitTrackedCandidates(repoPath);
+    // The walk deliberately does NOT pre-filter with `accept`: both branches must
+    // see the same candidate superset so the skip tally below counts identically
+    // whether or not the repository is a Git work tree. (main passed
+    // `{ accept: isIndexableSourcePath }` here; filtering during the walk would
+    // make the excluded files invisible to the tally, which is the whole point of
+    // this function.)
+    for (const file of candidates ?? walkRepoFiles(repoPath)) {
+        // Pruned infrastructure (node_modules, dist, .git, state dirs) is not a
+        // coverage gap and is never counted as one.
+        if (!isIndexablePath(file))
+            continue;
+        if (!isIndexableSourcePath(file)) {
+            tallyOne(skippedByExtension, extensionBucket(file));
             continue;
-        const baseName = path.basename(file).toLowerCase();
-        if (file.endsWith(".json")) {
-            // Only dbt manifest.json files hold indexable symbols; skip all other JSON.
-            if (salesforceExperienceFile(file)) {
-                files.push(file);
-            }
-            else if (baseName === "manifest.json") {
-                try {
-                    if (isDbtManifest(fs.readFileSync(path.join(repoPath, file), "utf-8"))) {
-                        files.push(file);
-                    }
-                }
-                catch (_) { }
-            }
         }
-        else {
+        if (!file.endsWith(".json")) {
             files.push(file);
         }
+        else if (isIndexableJsonCandidate(file, repoPath)) {
+            files.push(file);
+        }
+        else {
+            tallyOne(skippedByExtension, ".json");
+        }
     }
-    return files.sort();
+    // Sorted on a copy with `compareBytes`, main's shared byte-order comparator,
+    // so both file-discovery paths produce identical machine-independent ordering.
+    return { files: [...files].sort(compareBytes), skippedByExtension };
 }
 /** Current HEAD sha of a git work tree, or null when not a git repo / no commits. */
 function gitHead(repoPath) {
@@ -5832,7 +6543,7 @@ async function reconcileIndex(repoPath, db, progress) {
                 changed.add(file);
         const candidates = [...changed]
             .filter((file) => isIndexableSourcePath(file) || indexedPaths.has(file))
-            .sort();
+            .sort(compareBytes);
         progress?.("indexing-files", 0, `Reconciling ${candidates.length.toLocaleString()} changed files`, {
             phaseTotal: candidates.length,
         });
@@ -5876,6 +6587,16 @@ async function reconcileIndex(repoPath, db, progress) {
             await indexEmbeddings(db, repoPath, progress);
             indexGeneration++;
         }
+        else if (semanticReadinessFor(db) !== "ready") {
+            // Unchanged files do NOT imply current embeddings: a deferred
+            // (`skipEmbeddings`) or interrupted pass leaves symbols unembedded while
+            // every file looks reconciled. Without this, the follow-up index a user
+            // is told to run would do nothing and semantic search would stay
+            // silently short forever.
+            progress?.("finalizing", 0, "Completing deferred semantic embeddings");
+            await indexEmbeddings(db, repoPath, progress);
+            indexGeneration++;
+        }
         // Advance the stored HEAD so the next cold start diffs forward from here,
         // and snapshot the working tree so the per-query guard (R9) can tell
         // "dirty, and indexed that way" from "dirty, and moved since".
@@ -6073,7 +6794,8 @@ function gitWorkTreeProbe(repoPath) {
                 dirty.push(p);
         }
     }
-    return { head, root, dirty: dirty.sort() };
+    dirty.sort(compareBytes);
+    return { head, root, dirty };
 }
 /** True when two paths name the same directory (symlinks resolved). */
 function isSameDir(a, b) {
@@ -6242,9 +6964,14 @@ function stalenessFor(repoPath) {
     return freshnessProbes.get(path.resolve(repoPath))?.staleness ?? "unknown";
 }
 /** Recursively indexes all matching files within the repository. */
-async function indexRepo(repoPath, db, progress) {
+async function indexRepo(repoPath, db, progress, skipEmbeddings = false) {
     progress?.("collecting-files", 0, "Discovering indexable files");
-    const files = measurePerfPhaseSync("file_collection", () => collectRepoFiles(repoPath));
+    const collected = measurePerfPhaseSync("file_collection", () => collectRepoFilesWithCoverage(repoPath));
+    const files = collected.files;
+    // Files that reach the indexer but yield nothing can only be observed here,
+    // during the parse. Persisted below so `status` can report the gap without
+    // re-indexing the repository to rediscover it.
+    const unparsedByExtension = new Map();
     progress?.("indexing-files", 0, `Indexing ${files.length.toLocaleString()} files`, {
         phaseTotal: files.length,
     });
@@ -6258,7 +6985,7 @@ async function indexRepo(repoPath, db, progress) {
     let lastYieldAt = Date.now();
     for (let offset = 0; offset < files.length; offset++) {
         const file = files[offset];
-        await indexFile(path.join(repoPath, file), file, repoPath, db);
+        await indexFile(path.join(repoPath, file), file, repoPath, db, unparsedByExtension);
         recordIndexState(db, repoPath, file);
         progress?.("indexing-files", offset + 1, `Indexing ${files.length.toLocaleString()} files`, {
             phaseTotal: files.length,
@@ -6270,11 +6997,17 @@ async function indexRepo(repoPath, db, progress) {
     }
     progress?.("finalizing", 0, "Persisting symbol identities and semantic index");
     persistSymbolIdentities(db, repoPath);
-    await indexEmbeddings(db, repoPath, progress);
+    // Structure is complete at this point; embeddings are the expensive tail. When
+    // deferred, `semanticReadiness` reports the gap until a later pass fills it —
+    // `indexEmbeddings` only ever embeds symbols that lack one, so resuming is
+    // cheap and repeating is free.
+    if (!skipEmbeddings)
+        await indexEmbeddings(db, repoPath, progress);
     // Remember the HEAD we indexed at so a later cold start can diff forward.
     setMeta(db, "lastIndexedHead", gitHead(repoPath) ?? "");
     setMeta(db, "lastSuccessfulReconciliation", new Date().toISOString());
     setMeta(db, "mcpBackfillVersion", "17");
+    setMeta(db, COVERAGE_UNPARSED_META_KEY, JSON.stringify(Object.fromEntries(unparsedByExtension)));
     recordFreshnessBaseline(repoPath, db);
     indexGeneration++;
 }
@@ -6321,7 +7054,7 @@ function startFileWatcher(repoPath, db) {
             return queue.flushPromise;
         queue.flushPromise = (async () => {
             do {
-                const paths = [...queue.pending].sort();
+                const paths = [...queue.pending].sort(compareBytes);
                 queue.pending.clear();
                 if (paths.length === 0)
                     break;
@@ -6416,27 +7149,31 @@ async function getOrInitDb(repoPath, options = {}) {
                 dbPath = ":memory:";
             }
             else {
-                const knodinDir = path.join(normalizedPath, ".knodin");
-                await fs.promises.mkdir(knodinDir, { recursive: true });
-                // Ensure .knodin is in .gitignore
-                try {
-                    const gitignorePath = path.join(normalizedPath, ".gitignore");
-                    let gitignoreContent = "";
-                    if (fs.existsSync(gitignorePath)) {
-                        gitignoreContent = await fs.promises.readFile(gitignorePath, "utf-8");
+                const stateDir = resolveStateDir(normalizedPath);
+                await fs.promises.mkdir(stateDir, { recursive: true });
+                // Ensure .knodin is in .gitignore. Skipped for mirrors: their state
+                // lives outside the clone, and the clone must stay byte-identical to
+                // the remote so a refetch has nothing of ours to discard.
+                if (mayWriteToRepository(normalizedPath)) {
+                    try {
+                        const gitignorePath = path.join(normalizedPath, ".gitignore");
+                        let gitignoreContent = "";
+                        if (fs.existsSync(gitignorePath)) {
+                            gitignoreContent = await fs.promises.readFile(gitignorePath, "utf-8");
+                        }
+                        const lines = gitignoreContent.split("\n").map((l) => l.trim());
+                        if (!lines.includes(".knodin") &&
+                            !lines.includes(".knodin/") &&
+                            !lines.includes("/.knodin")) {
+                            const prefix = gitignoreContent.length > 0 && !gitignoreContent.endsWith("\n") ? "\n" : "";
+                            await fs.promises.appendFile(gitignorePath, `${prefix}\n# knodin\n.knodin\n`);
+                        }
                     }
-                    const lines = gitignoreContent.split("\n").map((l) => l.trim());
-                    if (!lines.includes(".knodin") &&
-                        !lines.includes(".knodin/") &&
-                        !lines.includes("/.knodin")) {
-                        const prefix = gitignoreContent.length > 0 && !gitignoreContent.endsWith("\n") ? "\n" : "";
-                        await fs.promises.appendFile(gitignorePath, `${prefix}\n# knodin\n.knodin\n`);
+                    catch (e) {
+                        console.error("Failed to update .gitignore", e);
                     }
                 }
-                catch (e) {
-                    console.error("Failed to update .gitignore", e);
-                }
-                dbPath = path.join(knodinDir, "db.sqlite");
+                dbPath = path.join(stateDir, "db.sqlite");
             }
             const finishDbOpenMigration = beginPerfPhase("db_open_migration");
             const db = new Database(dbPath);
@@ -6480,12 +7217,14 @@ async function getOrInitDb(repoPath, options = {}) {
             // be revisited once as well. v20 distinguishes a known empty object from
             // an unknown response shape, preserving C9's precision-first rule. v21
             // adds source-only LWR/Experience Bundle topology and must revisit its
-            // newly indexable JSON files.
-            const KNODIN_SCHEMA_VERSION = 21;
+            // newly indexable JSON files. v22 admits markdown as a link-only
+            // participant, so previously skipped documentation must be visited once
+            // to populate its doc_link / doc_link_broken edges.
+            const KNODIN_SCHEMA_VERSION = 22;
             // Highest version whose upgrade needs the stored data REBUILT. Versions
             // above it migrate in place, so an upgrade costs a DELETE rather than a
             // full re-index + re-embed (~40 min of CPU on an 18k-symbol corpus).
-            const LAST_REBUILD_SCHEMA_VERSION = 21;
+            const LAST_REBUILD_SCHEMA_VERSION = 22;
             const versionRow = db.query("PRAGMA user_version").get();
             const storedVersion = versionRow?.user_version ?? 0;
             const needsMcpBackfill = storedVersion < 17;
@@ -6611,6 +7350,28 @@ async function getOrInitDb(repoPath, options = {}) {
 					value TEXT
 				)
 			`);
+            // Imported analyzer findings. Deliberately separate from symbols and
+            // references: those are resolved from source, a finding is another
+            // tool's judgement about a location. Keeping it apart means graph
+            // answers never silently inherit somebody else's opinion.
+            db.run(`
+				CREATE TABLE IF NOT EXISTS findings (
+					id INTEGER PRIMARY KEY AUTOINCREMENT,
+					ruleId TEXT NOT NULL,
+					tool TEXT NOT NULL,
+					level TEXT NOT NULL,
+					message TEXT,
+					filePath TEXT NOT NULL,
+					startLine INTEGER NOT NULL,
+					startCol INTEGER NOT NULL,
+					endLine INTEGER NOT NULL,
+					endCol INTEGER NOT NULL,
+					helpUri TEXT,
+					source TEXT NOT NULL
+				)
+			`);
+            db.run("CREATE INDEX IF NOT EXISTS idx_findings_file ON findings(filePath)");
+            db.run("CREATE INDEX IF NOT EXISTS idx_findings_tool ON findings(tool)");
             db.run(`
 				CREATE TABLE IF NOT EXISTS mcp_tools (
 					id INTEGER PRIMARY KEY AUTOINCREMENT,
@@ -6800,7 +7561,7 @@ async function getFederatedRepos(repoPath) {
     // signal, knodin federates to exactly the repos listed in `repos` (possibly
     // none) and nothing else.
     let autoDiscover = process.env.KNODIN_AUTO_FEDERATE === "1" || process.env.KNODIN_AUTO_FEDERATE === "true";
-    const configPath = path.join(resolvedRepoPath, ".knodin/federation.json");
+    const configPath = path.join(resolveStateDir(resolvedRepoPath), "federation.json");
     if (fs.existsSync(configPath)) {
         try {
             const parsed = JSON.parse(fs.readFileSync(configPath, "utf-8"));
@@ -6841,7 +7602,7 @@ async function getFederatedRepos(repoPath) {
                 if (siblingPath === resolvedRepoPath)
                     continue;
                 const isAlreadyIndexed = dbInstances.has(path.resolve(siblingPath)) ||
-                    (!isTest && fs.existsSync(path.join(siblingPath, ".knodin", "db.sqlite")));
+                    (!isTest && fs.existsSync(resolveDbPath(siblingPath)));
                 if (isAlreadyIndexed) {
                     repos.push(siblingPath);
                 }
@@ -6976,10 +7737,11 @@ function queryFileSymbols(db, filePath, repoPath) {
                 .map((line) => line.trim().replace(/^\d+:\s*/, ""))
                 .join(" ")
                 .replace(/\s+/g, " ")
-                .split(/\s*(?:\{|=>)\s*/, 1)[0]
+                // `(?<!\s)` pins the match to the start of a whitespace run (quadratic otherwise).
+                .split(/(?<!\s)\s*(?:\{|=>)\s*/, 1)[0]
                 .slice(0, 500)
             : "";
-        const visibility = header.match(/\b(public|private|protected|internal)\b/)?.[1] ??
+        const visibility = /\b(public|private|protected|internal)\b/.exec(header)?.[1] ??
             (definition.filePath.endsWith(".py") && definition.name.startsWith("_")
                 ? "private"
                 : "default");
@@ -7521,10 +8283,10 @@ function parseUnifiedDiff(stdout) {
                 currentFile = null;
             }
             else if (line.startsWith("@@") && currentFile) {
-                const match = line.match(/^@@ -\d+(?:,\d+)? \+(\d+)(?:,(\d+))? @@/);
+                const match = /^@@ -\d+(?:,\d+)? \+(\d+)(?:,(\d+))? @@/.exec(line);
                 if (match) {
-                    const startLine = parseInt(match[1], 10);
-                    const count = match[2] !== undefined ? parseInt(match[2], 10) : 1;
+                    const startLine = Number.parseInt(match[1], 10);
+                    const count = match[2] !== undefined ? Number.parseInt(match[2], 10) : 1;
                     if (count > 0) {
                         let set = modifiedFiles.get(currentFile);
                         if (!set) {
@@ -7571,6 +8333,15 @@ export function parseGitDiff(base, repoPath, options = {}) {
     if (options.files?.length) {
         return new Map(options.files.map((file) => [safeReviewFile(file), new Set([Number.MAX_SAFE_INTEGER])]));
     }
+    // A mirror is cloned `--depth 1 --single-branch`, so it has no base branch and
+    // no local history to diff against. Git would succeed and return nothing,
+    // producing an empty review that reads as "no changes" — a confident wrong
+    // answer about someone else's code. Fail loudly instead. Explicit `files`
+    // above bypasses git entirely and remains valid on a mirror.
+    const mirror = lookupMirror(repoPath);
+    if (mirror) {
+        throw new Error(`knodin review: ${repoPath} is a read-only mirror of ${mirror.url}, pinned at snapshot ${mirror.sha.slice(0, 12)}. It was cloned without history, so there is nothing to diff against and an empty result would be misleading. Review the source repository directly, or pass explicit files to review.`);
+    }
     if ((options.from === undefined) !== (options.to === undefined)) {
         throw new Error("review revisions require both `from` and `to`");
     }
@@ -7599,7 +8370,7 @@ export function parseGitDiff(base, repoPath, options = {}) {
 function reviewChangedFiles(base, repoPath, options, modified) {
     const files = new Set(modified.keys());
     if (options.files?.length)
-        return [...files].sort();
+        return [...files].sort(compareBytes);
     const scope = options.scope ?? "all";
     try {
         const args = ["diff", "--name-only", "-z"];
@@ -7638,7 +8409,7 @@ function reviewChangedFiles(base, repoPath, options, modified) {
             // The diff result remains usable even if untracked discovery fails.
         }
     }
-    return [...files].sort();
+    return [...files].sort(compareBytes);
 }
 export function getTestFilePaths(filePath) {
     const dir = path.dirname(filePath);
@@ -7670,7 +8441,7 @@ export function findDefinitionNode(rootNode, symbolName, isPython, isApex = fals
         if (isPython) {
             if (node.type === "function_definition" || node.type === "class_definition") {
                 const nameNode = node.childForFieldName("name");
-                if (nameNode && nameNode.text === symbolName) {
+                if (nameNode?.text === symbolName) {
                     isDef = true;
                 }
             }
@@ -7680,28 +8451,26 @@ export function findDefinitionNode(rootNode, symbolName, isPython, isApex = fals
                 node.type === "method_declaration" ||
                 node.type === "trigger_declaration") {
                 const nameNode = node.childForFieldName("name") || node.children.find((c) => c.type === "identifier");
-                if (nameNode && nameNode.text === symbolName) {
+                if (nameNode?.text === symbolName) {
                     isDef = true;
                 }
             }
         }
-        else {
-            if (node.type === "function_declaration" ||
-                node.type === "generator_function_declaration" ||
-                node.type === "class_declaration" ||
-                node.type === "method_definition" ||
-                node.type === "interface_declaration" ||
-                node.type === "type_alias_declaration") {
-                const nameNode = node.childForFieldName("name");
-                if (nameNode && nameNode.text === symbolName) {
-                    isDef = true;
-                }
+        else if (node.type === "function_declaration" ||
+            node.type === "generator_function_declaration" ||
+            node.type === "class_declaration" ||
+            node.type === "method_definition" ||
+            node.type === "interface_declaration" ||
+            node.type === "type_alias_declaration") {
+            const nameNode = node.childForFieldName("name");
+            if (nameNode?.text === symbolName) {
+                isDef = true;
             }
-            else if (node.type === "variable_declarator") {
-                const nameNode = node.childForFieldName("name");
-                if (nameNode && nameNode.type === "identifier" && nameNode.text === symbolName) {
-                    isDef = true;
-                }
+        }
+        else if (node.type === "variable_declarator") {
+            const nameNode = node.childForFieldName("name");
+            if (nameNode?.type === "identifier" && nameNode.text === symbolName) {
+                isDef = true;
             }
         }
         if (isDef) {
@@ -8238,8 +9007,8 @@ function detectSymbolCommunities(allRepos, formatPath, relationKinds) {
     const usedNames = new Set();
     for (const indices of groups.values()) {
         const memberSet = new Set(indices);
-        const symbols = indices.map((i) => nodes[i].name).sort();
-        const files = Array.from(new Set(indices.map((i) => nodes[i].file))).sort();
+        const symbols = indices.map((i) => nodes[i].name).sort(compareBytes);
+        const files = Array.from(new Set(indices.map((i) => nodes[i].file))).sort(compareBytes);
         let internal = 0.0;
         let total = 0.0;
         for (const i of indices) {
@@ -8299,7 +9068,7 @@ async function detectKnowledgeGaps(allRepos, mapResult, resolvedRepoPath, opts)
         const out = new Set();
         for (const f of files)
             out.add(await languageOfFile(f));
-        return [...out].sort();
+        return [...out].sort(compareBytes);
     };
     const singleFileCommunities = [];
     for (const c of mapResult.communities) {
@@ -8665,11 +9434,7 @@ function renderCommunityPage(community, map) {
     const symbols = community.symbols ?? [];
     const fileSet = new Set(files);
     const lines = [];
-    lines.push(`# ${community.name}`, "");
-    lines.push("## Overview", "");
-    lines.push(`- Size: ${community.size} symbol(s)`);
-    lines.push(`- Cohesion: ${community.cohesion}`, "");
-    lines.push("## Files", "");
+    lines.push(`# ${community.name}`, "", "## Overview", "", `- Size: ${community.size} symbol(s)`, `- Cohesion: ${community.cohesion}`, "", "## Files", "");
     if (files.length > 0) {
         for (const f of files)
             lines.push(`- ${f}`);
@@ -8734,10 +9499,7 @@ function renderCommunityPage(community, map) {
 /** Renders `.knodin/wiki/index.md`: repo path, community table, one link per page. */
 function renderWikiIndex(resolvedRepoPath, map, slugs) {
     const lines = [];
-    lines.push("# knodin Wiki", "");
-    lines.push(`Repo: ${resolvedRepoPath}`, "");
-    lines.push("## Communities", "");
-    lines.push("| Name | Size | Cohesion | Top files |", "|---|---|---|---|");
+    lines.push("# knodin Wiki", "", `Repo: ${resolvedRepoPath}`, "", "## Communities", "", "| Name | Size | Cohesion | Top files |", "|---|---|---|---|");
     for (const c of map.communities) {
         const topFiles = (c.files ?? []).slice(0, 3).join(", ");
         lines.push(`| ${c.name} | ${c.size} | ${c.cohesion} | ${topFiles} |`);
@@ -8776,7 +9538,7 @@ function writeWikiPageIfChanged(dirPath, relFile, content, force, written, skipp
 async function writeWiki(engine, repoPath, force) {
     const resolvedRepoPath = path.resolve(repoPath);
     const map = await engine.map(repoPath, "standard");
-    const wikiDir = path.join(resolvedRepoPath, ".knodin", "wiki");
+    const wikiDir = path.join(resolveStateDir(resolvedRepoPath), "wiki");
     fs.mkdirSync(wikiDir, { recursive: true });
     // Slugify community names into unique page filenames (lowercase, hyphenated).
     const slugs = new Map();
@@ -8925,8 +9687,8 @@ function findImportSpecifierLines(absPath, symbol) {
     catch {
         return [];
     }
-    const escaped = symbol.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
-    const wordRe = new RegExp(`\\b${escaped}\\b`);
+    const escaped = symbol.replace(/[.*+?^${}()|[\]\\]/g, String.raw `\$&`);
+    const wordRe = new RegExp(String.raw `\b${escaped}\b`);
     // `export` only opens a statement worth scanning when it re-exports bindings
     // (`export {` / `export *`) — never for `export function foo() {`, whose body
     // braces would otherwise swallow the rest of the file.
@@ -8964,6 +9726,11 @@ function withStaleness(engine) {
             result.staleness = stalenessFor(repoPath);
             return result;
         },
+        async dependencyGraph(repoPath) {
+            const result = await engine.dependencyGraph(repoPath);
+            result.staleness = stalenessFor(repoPath);
+            return result;
+        },
         async map(repoPath, detailLevel = "minimal", options) {
             const raw = await engine.map(repoPath, detailLevel, options);
             const result = options
@@ -9373,6 +10140,39 @@ export function createEngine() {
                 ...(truncated ? { truncated: true } : {}),
             };
         },
+        async dependencyGraph(repoPath) {
+            const db = await getOrInitDb(repoPath);
+            const rows = db
+                .query("SELECT fromFile, toFile, kind, COALESCE(confidence, 1.0) AS confidence, sourceEvidence FROM dependencies")
+                .all();
+            const degrees = {};
+            const edges = [];
+            for (const row of rows) {
+                // A self-edge carries no layout information and would render as a
+                // dot on top of its own node.
+                if (!row.fromFile || !row.toFile || row.fromFile === row.toFile)
+                    continue;
+                degrees[row.fromFile] = (degrees[row.fromFile] ?? 0) + 1;
+                degrees[row.toFile] = (degrees[row.toFile] ?? 0) + 1;
+                edges.push({
+                    fromFile: row.fromFile,
+                    toFile: row.toFile,
+                    kind: row.kind,
+                    confidence: row.confidence,
+                    ...(row.sourceEvidence ? { sourceEvidence: row.sourceEvidence } : {}),
+                });
+            }
+            // Stable order so repeated calls over unchanged evidence agree.
+            edges.sort((left, right) => left.fromFile === right.fromFile
+                ? left.toFile.localeCompare(right.toFile)
+                : left.fromFile.localeCompare(right.fromFile));
+            return {
+                repoPath: path.resolve(repoPath),
+                edges,
+                fileCount: Object.keys(degrees).length,
+                degrees,
+            };
+        },
         async map(repoPath, detailLevel = "minimal", options = {}) {
             const topN = options.topN ?? 15;
             if (!Number.isInteger(topN) || topN < 1 || topN > 1000)
@@ -9395,10 +10195,10 @@ export function createEngine() {
                     resolvedRepoPath,
                     topN,
                     options.sort ?? "relevance",
-                    [...(options.relationKinds ?? [])].sort(),
+                    [...(options.relationKinds ?? [])].sort(compareBytes),
                 ]);
                 const cached = minimalMapCache.get(cacheKey);
-                if (cached && cached.generation === indexGeneration)
+                if (cached?.generation === indexGeneration)
                     return cached.result;
                 const computeMinimalMap = (async () => {
                     const analytics = await getGraphAnalyticsSnapshot(allRepos, resolvedRepoPath, topN, options.relationKinds);
@@ -9468,7 +10268,7 @@ export function createEngine() {
                 return computeMinimalMap;
             }
             const cached = mapCache.get(resolvedRepoPath);
-            if (cached && cached.generation === indexGeneration)
+            if (cached?.generation === indexGeneration)
                 return cached.result;
             const computeMap = (async () => {
                 const repos = await getFederatedRepos(repoPath);
@@ -9506,7 +10306,7 @@ export function createEngine() {
                     for (const rf of refsFiles) {
                         filesSet.add(rf.callerFile);
                     }
-                    const filesList = Array.from(filesSet).sort();
+                    const filesList = Array.from(filesSet).sort(compareBytes);
                     const V = filesList.length;
                     if (V === 0) {
                         return {
@@ -9559,7 +10359,7 @@ export function createEngine() {
                         let calleeFile = r.calleeFile;
                         if (!calleeFile) {
                             const calleeFiles = symbolToFiles.get(r.calleeSymbol);
-                            if (calleeFiles && calleeFiles.length === 1)
+                            if (calleeFiles?.length === 1)
                                 calleeFile = calleeFiles[0];
                         }
                         if (!calleeFile || calleeFile === r.callerFile)
@@ -9598,7 +10398,7 @@ export function createEngine() {
                         filesSet.add(formatPath(repo.path, rf.callerFile));
                     }
                 }
-                const filesList = Array.from(filesSet).sort();
+                const filesList = Array.from(filesSet).sort(compareBytes);
                 const V = filesList.length;
                 if (V === 0) {
                     return {
@@ -9777,13 +10577,15 @@ export function createEngine() {
             // repair and timestamp drift before reporting it. Reuse an active DB in
             // long-lived processes, or open the existing local DB read-only.
             const activeDb = dbInstances.get(resolved);
-            const diskDbPath = path.join(resolved, ".knodin", "db.sqlite");
+            const diskDbPath = resolveDbPath(resolved);
             const db = activeDb ??
                 (fs.existsSync(diskDbPath) ? new Database(diskDbPath, { readonly: true }) : null);
             const verifiedAt = new Date().toISOString();
             const activity = options.ignoreActiveOperation ? null : readIndexActivity(resolved);
             if (activity) {
-                const sourceFiles = measurePerfPhaseSync("status_audit", () => collectRepoFiles(resolved));
+                const collected = measurePerfPhaseSync("status_audit", () => collectRepoFilesWithCoverage(resolved));
+                const sourceFiles = collected.files;
+                const skipped = buildCoverageSkips(collected.skippedByExtension, db);
                 let schemaVersion = 0;
                 let indexedFiles = 0;
                 let filesWithSymbols = 0;
@@ -9826,6 +10628,7 @@ export function createEngine() {
                         percent: sourceFiles.length
                             ? Math.round((Math.min(indexedFiles, sourceFiles.length) / sourceFiles.length) * 10000) / 100
                             : 100,
+                        skipped,
                     },
                     orphaned: { embeddings: 0, references: 0, dependencies: 0 },
                     missing: { files: [], records: [] },
@@ -9838,7 +10641,8 @@ export function createEngine() {
                 };
             }
             if (!db) {
-                const sourceFiles = measurePerfPhaseSync("status_audit", () => collectRepoFiles(resolved));
+                const collected = measurePerfPhaseSync("status_audit", () => collectRepoFilesWithCoverage(resolved));
+                const sourceFiles = collected.files;
                 return {
                     status: "repair-needed",
                     repo: resolved,
@@ -9854,6 +10658,7 @@ export function createEngine() {
                         indexedFiles: 0,
                         filesWithSymbols: 0,
                         percent: sourceFiles.length ? 0 : 100,
+                        skipped: buildCoverageSkips(collected.skippedByExtension, null),
                     },
                     orphaned: { embeddings: 0, references: 0, dependencies: 0 },
                     missing: {
@@ -9922,7 +10727,9 @@ export function createEngine() {
                     // reports repair steps instead of hiding the database problem.
                 }
             }
-            const sourceFiles = measurePerfPhaseSync("status_audit", () => collectRepoFiles(resolved));
+            const collected = measurePerfPhaseSync("status_audit", () => collectRepoFilesWithCoverage(resolved));
+            const sourceFiles = collected.files;
+            const coverageSkips = buildCoverageSkips(collected.skippedByExtension, db);
             const schemaVersion = db.query("PRAGMA user_version").get()?.user_version ?? 0;
             const requiredTables = [
                 "symbols",
@@ -9968,6 +10775,7 @@ export function createEngine() {
                         indexedFiles: 0,
                         filesWithSymbols: 0,
                         percent: sourceFiles.length ? 0 : 100,
+                        skipped: coverageSkips,
                     },
                     orphaned: { embeddings: 0, references: 0, dependencies: 0 },
                     missing: { files: sourceFiles, records: schemaProblems },
@@ -10049,7 +10857,10 @@ export function createEngine() {
                     percent: sourceFiles.length
                         ? Math.round(((sourceFiles.length - missingFiles.length) / sourceFiles.length) * 10000) / 100
                         : 100,
+                    skipped: coverageSkips,
                 },
+                ...mirrorSnapshotFor(resolved),
+                semanticReadiness: semanticReadinessFor(db),
                 orphaned,
                 missing: { files: missingFiles, records },
                 lastSuccessfulReconciliation: getMeta(db, "lastSuccessfulReconciliation") ?? null,
@@ -10114,6 +10925,7 @@ export function createEngine() {
             let repairPaths = [];
             let completedFiles = 0;
             let committedWork = false;
+            let repairLease;
             const generationBeforeRepair = indexGeneration;
             const activeOperation = {
                 promise: undefined,
@@ -10151,6 +10963,7 @@ export function createEngine() {
             };
             const operation = Promise.resolve()
                 .then(async () => {
+                repairLease = acquireRepairLease(resolved);
                 const cancelBoundary = () => {
                     if (activeOperation.controller.signal.aborted)
                         throw activeOperation.controller.signal;
@@ -10183,7 +10996,7 @@ export function createEngine() {
                 // Repair partial current-schema databases before normal initialization,
                 // whose reconciliation queries require these columns. ALTER preserves all
                 // healthy index_state rows; the reconciler then refreshes their snapshots.
-                const diskDbPath = path.join(resolved, ".knodin", "db.sqlite");
+                const diskDbPath = resolveDbPath(resolved);
                 if (fs.existsSync(diskDbPath)) {
                     const activeDb = dbInstances.get(resolved);
                     const schemaDb = activeDb ?? new Database(diskDbPath);
@@ -10219,7 +11032,7 @@ export function createEngine() {
                 const eligibleRepairPaths = new Set(collectRepoFiles(resolved));
                 repairPaths = [...repairKinds.keys()]
                     .filter((file) => repairKinds.get(file) === "stale" || fileDriftedFromIndexState(db, resolved, file))
-                    .sort();
+                    .sort(compareBytes);
                 counts.skipped = Math.max(0, repairKinds.size - repairPaths.length);
                 overallTotal = repairPaths.length + 4;
                 emitProgress("planning", repairPaths.length, "Repair plan completed", {
@@ -10427,6 +11240,7 @@ export function createEngine() {
                 return await operation;
             }
             finally {
+                repairLease?.release();
                 options?.signal?.removeEventListener("abort", abortShared);
                 if (options?.onProgress)
                     activeOperation.subscribers.delete(options.onProgress);
@@ -10438,6 +11252,7 @@ export function createEngine() {
             const indexed = [];
             const unchanged = [];
             let scipReport;
+            let sarifReport;
             const progress = createIndexProgressReporter(options?.onProgress);
             progress("starting", 0, "Opening local graph database");
             const db = await getOrInitDb(repoPath, {
@@ -10515,12 +11330,17 @@ export function createEngine() {
                     await reconcileIndex(repoPath, db, progress);
                 }
                 else {
-                    await indexRepo(repoPath, db, progress);
+                    await indexRepo(repoPath, db, progress, options?.skipEmbeddings === true);
                 }
                 // Reuse the same candidate set as indexing/reconciliation. This keeps
                 // LWC HTML/CSS bundle members visible in the response without admitting
                 // arbitrary web assets to the source index.
-                indexed.push(...collectRepoFiles(repoPath));
+                // Appended in a loop, not `push(...files)`: spreading an array as
+                // arguments overflows the call stack once a repository is large
+                // enough. Observed on a 40k-file checkout, which is well within the
+                // range knodin is meant to index.
+                for (const file of collectRepoFiles(repoPath))
+                    indexed.push(file);
                 completionMessage = `${indexed.length.toLocaleString()} repository file(s) are current`;
             }
             if (options?.scip) {
@@ -10550,6 +11370,29 @@ export function createEngine() {
                     if (!indexed.includes(file))
                         indexed.push(file);
             }
+            if (options?.sarif) {
+                const facts = readSarifLog(repoPath, options.sarif);
+                persistSarifFindings(db, facts);
+                // Findings are not graph facts, so no re-embedding and no generation
+                // bump: the graph is unchanged and existing answers stay valid.
+                const bounds = { ...SARIF_DEFAULT_LIMITS, ...options.sarif };
+                sarifReport = {
+                    provenance: "sarif",
+                    inputPath: facts.inputPath,
+                    bytes: facts.bytes,
+                    tools: facts.tools,
+                    rules: facts.rules,
+                    files: facts.files,
+                    findings: facts.findings.length,
+                    skippedUnresolved: facts.skippedUnresolved,
+                    elapsedMs: facts.elapsedMs,
+                    bounds: {
+                        maxBytes: bounds.maxBytes,
+                        maxFindings: bounds.maxFindings,
+                        timeoutMs: bounds.timeoutMs,
+                    },
+                };
+            }
             progress("verifying", 0, "Verifying local graph health", {
                 phaseTotal: 1,
             });
@@ -10604,6 +11447,7 @@ export function createEngine() {
                 indexed,
                 unchanged,
                 scip: scipReport,
+                sarif: sarifReport,
                 verification: {
                     status: health.status,
                     issueCount,
@@ -10621,6 +11465,10 @@ export function createEngine() {
                 throw new Error("knodin search: invalid testScope");
             const repos = options.federate === false ? [resolvedRepoPath] : await getFederatedRepos(repoPath);
             const allRepos = await Promise.all(repos.map(async (r) => ({ path: r, db: await getOrInitDb(r) })));
+            // Computed before any retrieval route runs, so every exit path can report
+            // it: a short result list caused by missing embeddings must not be
+            // indistinguishable from a short list caused by the query.
+            const semanticReadiness = worstSemanticReadiness(allRepos.map((repo) => semanticReadinessFor(repo.db)));
             const searchSnapshots = new Map(allRepos.map((repo) => [repo.path, getSearchMetadataSnapshot(repo.path, repo.db)]));
             // typeof + Number.isFinite rejects undefined/null/NaN alike, so any non-numeric
             // or unset `limit` falls back to the default instead of clamping to 0/1 or
@@ -10771,6 +11619,7 @@ export function createEngine() {
                     limit: maxResults,
                     hasMore: offset + maxResults < matches.length,
                     retrieval: { route: ["exact-name"], embeddingsUsed: false },
+                    semanticReadiness,
                 };
             }
             if (retrievalMode !== "vector-only") {
@@ -10815,6 +11664,7 @@ export function createEngine() {
                                 : [identityQuery ? "stable-identity" : pathQuery ? "exact-path" : "exact-name"],
                             embeddingsUsed: false,
                         },
+                        semanticReadiness,
                     };
                 }
             }
@@ -10901,6 +11751,7 @@ export function createEngine() {
                                 : ["lexical"],
                             embeddingsUsed: false,
                         },
+                        semanticReadiness,
                     };
                 }
             }
@@ -11055,6 +11906,7 @@ export function createEngine() {
                         : ["lexical", "bounded-graph", "embeddings"],
                     embeddingsUsed: true,
                 },
+                semanticReadiness,
             };
         },
         async query(pattern, target, repoPath, to, limit, depth, detailLevel, selector = {}, impactOptions = {}, options = {}) {
@@ -11397,13 +12249,13 @@ export function createEngine() {
                         adjacency.set(edge.fromFile, outgoing);
                     }
                     for (const outgoing of adjacency.values())
-                        outgoing.sort();
+                        outgoing.sort(compareBytes);
                     const cycles = [];
                     const stopAfter = cap + 1;
                     const workLimit = Math.min(Math.max(cap * 1000, 10_000), 1_000_000);
                     let work = 0;
                     let workTruncated = false;
-                    for (const root of [...nodes].sort()) {
+                    for (const root of [...nodes].sort(compareBytes)) {
                         if (cycles.length >= stopAfter || workTruncated)
                             break;
                         const path = [root];
@@ -11581,7 +12433,7 @@ export function createEngine() {
                     const includeTests = impactOptions.includeTests ?? true;
                     const relationKinds = new Set(impactOptions.relationKinds ?? []);
                     const minConfidence = Math.min(Math.max(impactOptions.minConfidence ?? 0, 0), 1);
-                    const isTestFile = (file) => /(^|\/)(test|tests|__tests__)(\/|$)|\.(test|spec)\.[^.]+$/i.test(file);
+                    const isTestFile = (file) => /((^|\/)(test|tests|__tests__)(\/|$))|(\.(test|spec)\.[^.]+$)/i.test(file);
                     const allowed = (kind, confidence, file) => (includeTests || !isTestFile(file)) &&
                         (relationKinds.size === 0 || relationKinds.has(kind)) &&
                         confidence >= minConfidence;
@@ -11596,8 +12448,8 @@ export function createEngine() {
                             const text = fs.readFileSync(path.join(resolvedRepoPath, file), "utf8").split("\n")[line - 1];
                             if (!text)
                                 return undefined;
-                            const escaped = callee.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
-                            const match = text.match(new RegExp(`\\b${escaped}\\s*\\(([^)]*)\\)`));
+                            const escaped = callee.replace(/[.*+?^${}()|[\]\\]/g, String.raw `\$&`);
+                            const match = new RegExp(String.raw `\b${escaped}\s*\(([^)]*)\)`).exec(text);
                             if (!match)
                                 return undefined;
                             return {
@@ -11942,8 +12794,27 @@ export function createEngine() {
                         const src = readSource(relFile);
                         if (!src)
                             return false;
-                        const escaped = name.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
-                        return (new RegExp(`\\bexport\\s+(?:default\\s+)?(?:function|class|const|let|var|type|interface|enum)\\s+${escaped}\\b`).test(src) || new RegExp(`\\bexport\\s*\\{[^}]*\\b${escaped}\\b[^}]*\\}`).test(src));
+                        const escaped = name.replace(/[.*+?^${}()|[\]\\]/g, String.raw `\$&`);
+                        return (new RegExp(String.raw `\bexport\s+(?:default\s+)?(?:function|class|const|let|var|type|interface|enum)\s+${escaped}\b`).test(src) ||
+                            new RegExp(String.raw `\bexport\s*\{[^}]*\b${escaped}\b[^}]*\}`).test(src));
+                    };
+                    // Whether an import/export binding clause may bind `name`. A namespace
+                    // binding, or one whose `{ … }` span cannot be read, is conservatively a
+                    // yes; a readable named list is a yes only when it names the symbol.
+                    const bindingClauseBinds = (bindings, name) => {
+                        if (bindings.includes("*"))
+                            return true;
+                        // First `{ … }` span, scanned rather than matched: the equivalent
+                        // regex re-walks the binding list from every `{`, which is quadratic.
+                        const open = bindings.indexOf("{");
+                        const close = open < 0 ? -1 : bindings.indexOf("}", open + 1);
+                        const named = close < 0 ? undefined : bindings.slice(open + 1, close);
+                        if (!named)
+                            return true;
+                        return named.split(",").some((part) => part
+                            .trim()
+                            .split(/\s+as\s+/)[0]
+                            ?.trim() === name);
                     };
                     const importerMayReachExport = (importer, relFile, name) => {
                         const src = readSource(importer);
@@ -11954,20 +12825,8 @@ export function createEngine() {
                             if (resolveModuleToFile(importer, match[2], repoPath) !== relFile)
                                 continue;
                             matchedTarget = true;
-                            const bindings = match[1].trim();
-                            if (bindings.includes("*"))
+                            if (bindingClauseBinds(match[1].trim(), name))
                                 return true;
-                            const named = bindings.match(/\{([^}]*)\}/)?.[1];
-                            if (!named)
-                                return true;
-                            for (const part of named.split(",")) {
-                                const imported = part
-                                    .trim()
-                                    .split(/\s+as\s+/)[0]
-                                    ?.trim();
-                                if (imported === name)
-                                    return true;
-                            }
                         }
                         // The dependency extractor found an edge but the source pattern was
                         // not recognized (for example, a dynamic loader). Keep it live.
@@ -12520,9 +13379,13 @@ export function createEngine() {
                     // Parameters are reaching definitions at function entry. Deliberately
                     // handles only simple identifiers, not destructuring/default expressions.
                     const signature = functionLines[0] ?? "";
-                    const params = signature.match(/\(([^)]*)\)/)?.[1] ?? "";
+                    // First `( … )` span, scanned rather than matched: the equivalent regex
+                    // re-walks the signature from every `(`, which is quadratic.
+                    const parenOpen = signature.indexOf("(");
+                    const parenClose = parenOpen < 0 ? -1 : signature.indexOf(")", parenOpen + 1);
+                    const params = parenClose < 0 ? "" : signature.slice(parenOpen + 1, parenClose);
                     for (const parameter of params.split(",")) {
-                        const name = parameter.trim().match(/^([A-Za-z_$][\w$]*)/)?.[1];
+                        const name = /^([A-Za-z_$][\w$]*)/.exec(parameter.trim())?.[1];
                         if (name) {
                             trackedVariables.add(name);
                             add("definition", name, 0, signature);
@@ -12532,7 +13395,7 @@ export function createEngine() {
                         const line = raw.trim();
                         if (!line || line.startsWith("//"))
                             continue;
-                        const definition = line.match(/^(?:const|let|var)\s+([A-Za-z_$][\w$]*)\s*=/);
+                        const definition = /^(?:const|let|var)\s+([A-Za-z_$][\w$]*)\s*=/.exec(line);
                         if (definition) {
                             trackedVariables.add(definition[1]);
                             add("definition", definition[1], index, raw);
@@ -12560,13 +13423,11 @@ export function createEngine() {
                             ].includes(variable))
                                 continue;
                             if (definition?.[1] === variable &&
-                                !line
-                                    .slice((definition.index ?? 0) + definition[0].length)
-                                    .match(new RegExp(`\\b${variable}\\b`)))
+                                !new RegExp(String.raw `\b${variable}\b`).exec(line.slice((definition.index ?? 0) + definition[0].length)))
                                 continue;
-                            if (control?.match(new RegExp(`\\b${variable}\\b`)))
+                            if (control?.match(new RegExp(String.raw `\b${variable}\b`)))
                                 add("control", variable, index, raw);
-                            else if (!definition || definition[1] !== variable)
+                            else if (definition?.[1] !== variable)
                                 add("use", variable, index, raw);
                         }
                     }
@@ -12748,7 +13609,7 @@ export function createEngine() {
                         selected,
                     ]);
                     const cachedOverview = architectureOverviewCache.get(overviewCacheKey);
-                    if (cachedOverview && cachedOverview.generation === indexGeneration) {
+                    if (cachedOverview?.generation === indexGeneration) {
                         finishArchitecture();
                         return finish([{ architectureOverview: structuredClone(cachedOverview.result) }]);
                     }
@@ -12880,7 +13741,7 @@ export function createEngine() {
                             .map(([name, value]) => ({
                             name,
                             symbols: value.symbols,
-                            files: [...value.files].sort(),
+                            files: [...value.files].sort(compareBytes),
                         }))
                             .sort((a, b) => b.symbols - a.symbols || a.name.localeCompare(b.name))
                             .slice(0, cap);
@@ -13174,8 +14035,8 @@ export function createEngine() {
             collideStmt.finalize();
             // Line-scoped word-boundary replacement plan: only the lines the preview
             // recorded are touched (never a whole-file blind replace).
-            const escaped = oldName.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
-            const wordRe = new RegExp(`\\b${escaped}\\b`, "g");
+            const escaped = oldName.replace(/[.*+?^${}()|[\]\\]/g, String.raw `\$&`);
+            const wordRe = new RegExp(String.raw `\b${escaped}\b`, "g");
             const linesByFile = new Map();
             // Import-specifier lines are rewritten outside string literals, so a module
             // specifier that happens to contain the old name (`from "./helper"`) is left