[NOTICKET][DB] fix(query): R2 - always compile a bounded LIMIT

An IR with no limit compiled to a LIMIT-less SELECT, and DbExecutor materialized
the entire result set before capping at 10k rows - an unbounded fetch that can OOM
on a large user table.

- SqlCompiler now bounds every query: an explicit IR limit is honored (clamped to
MAX_RESULT_ROWS=10000); an unbounded query gets LIMIT cap+1 so the executor can
distinguish exactly-the-cap from more-rows-existed and flag truncation.
- CompiledSql.row_cap carries the effective cap; DbExecutor caps + derives truncated
from it and drops its own _ROW_HARD_CAP constant.
- test_sql.py: no-limit golden strings get the safety bound; +3 cases (no-limit
bounded, explicit-limit clamp, row_cap). Restored S608 to tests/** ruff ignore
(documented in PR3-DB but missing from pyproject) - golden tests assert literal SQL.

Also logs R13: a pre-existing, unrelated test_prompt failure found while running R2.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

PROGRESS.md

@@ -38,7 +38,7 @@ Verified against code before logging. Severity: **critical** / important / nice-
 | # | Fix | Severity | Owner | Status |
 |---|---|---|---|---|
 | R1 | **AuthN/AuthZ** on data endpoints — derive `user_id` from JWT (`security/auth.py` helpers exist), reject body-supplied IDs. `/chat/stream` has none (`chat.py:40,128`); tenant isolation is client honesty. **Gates the engine-cache work.** | **critical** | DB/B | `[ ]` |
-| R2 | **Always compile a LIMIT** — `sql.py:281` emits no LIMIT when `ir.limit is None`; `db.py:93` materializes ALL rows before the 10k cap. Compile `LIMIT min(ir.limit or CAP, CAP)+1`. | **critical** | DB | `[ ]` |
+| R2 | **Always compile a LIMIT** — `sql.py` now emits a bound for every query: explicit limit honored (clamped to `MAX_RESULT_ROWS=10000`), unbounded queries get `LIMIT cap+1` so an unbounded SELECT can't stream a whole table into memory. `CompiledSql.row_cap` carries the cap; `DbExecutor` caps + flags truncation from it (dropped its own `_ROW_HARD_CAP`). Tests updated (`test_sql.py`, +3 cases); `S608` restored to `tests/**` ruff ignore (was dropped). | **critical** | DB | `[x]` |
 | R3 | **Commit `tests/` + minimal CI** — `tests/` is gitignored; the 200+ tests cited as done exist only on laptops (already caused rename rot). GitHub origin carries tests; HF Space gets the Docker build (already doesn't COPY tests). | **critical (process)** | shared | `[ ]` |
 | DB1 | **In-memory `describe_source`** (request-scoped `MemoizingCatalogReader`, `reader.py`) + **LLM-client hoist** (shared module-level `ChatHandler` in `chat.py`). Measured live: `describe_source` 3.5s→~2.0s (structured read now served from the planner's cached snapshot; only the unstructured read remains a round-trip), catalog reads/request ~5→~2. External `query_structured` handshake unchanged (DB2's job) so total slow path is ~flat until DB2. Tests: `tests/catalog/test_reader.py`. | important | agent | `[x]` |
 | DB2 | **Keyed engine cache** (LRU, small pool, `pool_recycle`, `pool_pre_ping`) replacing per-call `engine_scope`; read-only + statement_timeout via `connect_args options` (zero SET round-trips, read-only-at-birth); invalidate on client update/delete. Extract to `src/database_client/engine.py`. **Land with/after R1.** | important | DB | `[ ]` |
@@ -52,6 +52,7 @@ Verified against code before logging. Severity: **critical** / important / nice-
 | R10 | **Read-only enforcement is session-state, not a server role.** `REPO_CONTEXT.md` counts "read-only DB credentials" as a defense layer but nothing requests/verifies a read-only role. Either request read-only creds at registration (verify via `SELECT current_setting(...)`) or drop the claim. | important | DB | `[ ]` |
 | R11 | **De-duplicate** `_PLACEHOLDER_RE` (`task_runner.py:31` vs validator) and `_DATA_ACCESS_TOOLS` (invoker vs planner registry) — import one from the other; comments aren't a sync mechanism. | nice-to-have | agent/tool | `[ ]` |
 | R12 | **Doc/process hygiene** — gitignored canonical docs (`AGENT_ARCHITECTURE_CONTEXT_new.md`, `PROJECT_SUMMARY.md`) are cited by code docstrings but absent on disk; `CLAUDE.md` lists deleted modules (enricher, `pipeline/orchestrator.py`); `main` is 38 commits behind on a dead architecture. | nice-to-have | agent | `[ ]` |
+| R13 | **Pre-existing test failure** (found during R2, NOT caused by it): `tests/query/planner/test_prompt.py::test_render_catalog_with_sources` fails — `query/planner/prompt.py::render_catalog` now renders stable IDs (`src_test_db`) the test asserts are absent. Old query-planner path; confirmed failing on a clean tree. | nice-to-have | DB | `[ ]` |
 
 **Architecture verdict:** fundamentally sound (catalog-driven IR + deterministic compiler
 + static plan is the right call). Debt is transitional duplication (two planners/registries/

pyproject.toml

@@ -120,7 +120,9 @@ ignore = [
 ]
 
 [tool.ruff.lint.per-file-ignores]
-"tests/**" = ["S101", "S105", "S106"]
+# S608: golden compiler tests assert literal SQL strings (incl. concatenated
+# suffixes) — they never execute against a DB, so it's a false positive here.
+"tests/**" = ["S101", "S105", "S106", "S608"]
 
 [tool.mypy]
 python_version = "3.12"

src/query/compiler/sql.py

@@ -30,11 +30,18 @@ from ..ir.models import (
 )
 from .base import BaseCompiler
 
+# Hard ceiling on rows returned to the agent layer. Every compiled query is
+# bounded by this even when the IR sets no limit, so an unbounded SELECT can never
+# stream an entire user table over the wire / into memory. The executor caps to
+# `row_cap` and flags truncation.
+MAX_RESULT_ROWS = 10_000
+
 
 @dataclass
 class CompiledSql:
     sql: str
     params: dict[str, Any] = field(default_factory=dict)
+    row_cap: int = MAX_RESULT_ROWS  # executor caps rows to this; flags truncation
 
 
 class SqlCompilerError(Exception):
@@ -69,14 +76,14 @@ class SqlCompiler(BaseCompiler):
         orderby_clause = self._build_orderby(
             ir.order_by, table, cols_by_id, select_aliases
         )
-        limit_clause = self._build_limit(ir.limit)
+        limit_clause, row_cap = self._build_limit(ir.limit)
 
         parts: list[str] = [select_clause, from_clause]
         for clause in (where_clause, groupby_clause, orderby_clause, limit_clause):
             if clause:
                 parts.append(clause)
 
-        return CompiledSql(sql=" ".join(parts), params=params)
+        return CompiledSql(sql=" ".join(parts), params=params, row_cap=row_cap)
 
     # ------------------------------------------------------------------
     # Catalog lookup
@@ -277,10 +284,18 @@ class SqlCompiler(BaseCompiler):
             parts.append(f"{ref} {ob.dir.upper()}")
         return "ORDER BY " + ", ".join(parts)
 
-    def _build_limit(self, limit: int | None) -> str:
+    def _build_limit(self, limit: int | None) -> tuple[str, int]:
+        """Return (LIMIT clause, row_cap).
+
+        Always bounded. An explicit IR limit is honored exactly (capped at
+        MAX_RESULT_ROWS). When the IR has no limit we still emit
+        `LIMIT MAX_RESULT_ROWS + 1` — the extra row lets the executor tell
+        "exactly the cap" from "more rows existed" and flag truncation.
+        """
         if limit is None:
-            return ""
-        return f"LIMIT {int(limit)}"
+            return f"LIMIT {MAX_RESULT_ROWS + 1}", MAX_RESULT_ROWS
+        row_cap = min(int(limit), MAX_RESULT_ROWS)
+        return f"LIMIT {row_cap}", row_cap
 
     # ------------------------------------------------------------------
     # Helpers

src/query/executor/db.py

@@ -40,7 +40,6 @@ from .base import BaseExecutor, QueryResult
 logger = get_logger("db_executor")
 
 _QUERY_TIMEOUT_SECONDS = 30
-_ROW_HARD_CAP = 10_000  # belt-and-suspenders cap regardless of LIMIT
 _DBCLIENT_PREFIX = "dbclient://"
 _POSTGRES_LIKE = frozenset({"postgres", "supabase"})
 
@@ -90,8 +89,10 @@ class DbExecutor(BaseExecutor):
                 timeout=_QUERY_TIMEOUT_SECONDS,
             )
 
-            truncated = len(rows) > _ROW_HARD_CAP
-            capped = rows[:_ROW_HARD_CAP]
+            # The compiler bounded the SQL to `row_cap` (+1 when the IR was
+            # unbounded). More than row_cap rows means the result was truncated.
+            truncated = len(rows) > compiled.row_cap
+            capped = rows[:compiled.row_cap]
             elapsed_ms = int((time.perf_counter() - started) * 1000)
             logger.info(
                 "db query complete",