diff --git a/CLAUDE.md b/CLAUDE.md
index 7f72aa4..a3cc5e5 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -18,6 +18,7 @@ Regel: Keine Datei in legacy/ wird verändert. Nur lesen.
 @rules/session-protocol.md
 @rules/parallel-agents.md
 @rules/language-conventions.md
+@rules/discovery-waves.md
 
 ## Aktiver Scope
 Aktuelle Phase: 1 — Discovery
diff --git a/docs/A_discovery/task.md b/docs/A_discovery/task.md
index 6dedcf8..01c370e 100644
--- a/docs/A_discovery/task.md
+++ b/docs/A_discovery/task.md
@@ -1,10 +1,27 @@
 # Phase 1 — Discovery
 
 ## Ziel
-Den Legacy-Code so weit verstehen, dass das Domänenmodell, 
+Den Legacy-Code so weit verstehen, dass das Domänenmodell,
 die Capabilities und die KI-Kandidaten dokumentiert sind.
 
+## Analyse-Wellen (siehe @rules/discovery-waves.md)
+
+### Wave 1 — Structure
+- [ ] docs/A_discovery/structure-map.md — Directory structure, modules, layers
+
+### Wave 2 — Entry Points
+- [ ] docs/A_discovery/entry-points.md — Project files, routers, schemas, config
+
+### Wave 3 — Module Deep Dives
+<!-- After Wave 1: list discovered modules here with checkboxes -->
+<!-- Example:
+- [ ] Module: invoicing (legacy/src/invoicing/)
+- [ ] Module: auth (legacy/src/auth/)
+-->
+
 ## Ergebnisse (Definition of Done)
+- [ ] docs/A_discovery/structure-map.md — Verzeichnisstruktur, Module, Schichten
+- [ ] docs/A_discovery/entry-points.md — Einstiegspunkte, Abhängigkeiten
 - [ ] docs/A_discovery/domain-model.md — Entitäten, Beziehungen, Kernregeln
 - [ ] docs/A_discovery/capabilities-inventory.md — Was kann das System?
 - [ ] docs/A_discovery/data-candidates.md — Welche Daten eignen sich für KI?
diff --git a/rules/discovery-waves.md b/rules/discovery-waves.md
new file mode 100644
index 0000000..3c6c8a2
--- /dev/null
+++ b/rules/discovery-waves.md
@@ -0,0 +1,42 @@
+# Hierarchical Wave Analysis
+
+Large codebases must be analyzed in waves — never attempt full analysis in a single session.
+Each wave produces a condensed document that replaces raw context for subsequent waves.
+
+## Wave 1 — Structure, No Code
+- Read only directory structure and file names (ls, tree, glob) — do NOT open files
+- Derive: rough modules, layers, top-level organization
+- Output: `docs/A_discovery/structure-map.md`
+- Context cost: minimal
+
+## Wave 2 — Entry Points and Dependencies
+- Read only structurally informative files: project files (.csproj, package.json, pom.xml),
+  main routers/controllers, DB migrations/schema files, configuration
+- Do NOT read business logic yet
+- Output: `docs/A_discovery/entry-points.md`
+- Context loaded: structure-map.md
+
+## Wave 3 — Module-by-Module Deep Dive
+- One module = one session (or one subagent)
+- Analyze ONLY the subtree for that module — ignore everything else
+- Context loaded: structure-map.md + capabilities-inventory.md (current state)
+- Output per module: dedicated discovery document in `docs/A_discovery/`
+- After each module: update capabilities-inventory.md with new findings
+
+## Key Principles
+- Each wave produces a condensed document that replaces raw context
+- Raw code (large, unstructured) → condensed docs (small, oriented) → growing inventory
+- Never load the full codebase into a single session
+- When dispatching parallel agents for Wave 3: each agent gets exactly one module subtree
+- Track analyzed modules explicitly in task.md with checkboxes
+
+## Wave Progression
+```
+Raw code (large, unstructured)
+    ↓ Wave 1
+structure-map.md (small, orienting)
+    ↓ Wave 2
+entry-points.md (small, precise)
+    ↓ Wave 3 × N modules
+domain-model.md, capabilities-inventory.md (growing, condensed)
+```