The cursor auto-import route no longer contains raw SQL — that query now lives in src/lib/cursor/tokenExtractor.ts, outside the route/handler scope check-db-rules scans. The allowlist entry was stale, tripping the stale-enforcement gate.