feat(query): make every archive read bounded, cancellable, and resumable

[Sinity]

Outcome

Every potentially large archive read uses one shared query-transaction contract across CLI, MCP, Python, daemon HTTP, and web surfaces. A client can bound work, cancel it, resume it without losing filters or ordering, inspect the query identity and continuation state, and receive the same truthful totals/degraded semantics regardless of transport.

This is a public product/reliability outcome. The executable internal authority remains the Beads program polylogue-z9gh.9, with delivery owner polylogue-z9gh.9.1 and current repair prerequisites polylogue-z9gh.1 and polylogue-z9gh.2.

Current reality

Polylogue has strong query grammar, typed query-unit metadata, multiple lowerers, and several bounded-query mechanisms. The remaining problem is not parser availability. Read execution is still not uniformly one transaction across every surface, and historical incidents have included:

• blocking or uncancellable SQLite work;
• archive-wide action/delegation materialization;
• oversized responses without durable continuation;
• continuation paths that lose filters or sort state;
• totals that diverge across transports;
• client disconnects that do not reliably stop underlying work;
• query identities and evidence refs that are not consistently visible.

Do not reopen the completed query-DSL substrate. This issue owns execution, continuation, cancellation, and cross-surface parity.

Contract

A query transaction must carry at least:

• stable query identity and normalized request;
• selected unit, filters, ordering, and projection;
• deadline/resource budget and cancellation state;
• cursor/continuation token with all semantics preserved;
• result page plus exact/estimated/deferred total semantics;
• degraded/unsupported reasons that fail narrow rather than broaden;
• evidence/query refs sufficient to reproduce or inspect the read;
• transport-neutral error and completion state.

Surface wrappers may use different envelopes. They may not implement different query semantics.

Acceptance criteria

• One shared transaction/request implementation owns representative reads across CLI, MCP, Python, daemon HTTP, and web.
• Cancellation interrupts underlying database/runtime-transform work, including client disconnect and deadline expiry.
• Continuation preserves filters, unit, ordering, projection, and authorization; resuming cannot silently broaden or reorder a query.
• Large action/delegation/global reads avoid archive-wide in-memory materialization and hidden N+1 hydration.
• Result totals state whether they are exact, estimated, deferred, stale, or budget-exceeded.
• Query identity and continuation/evidence refs are visible in machine-readable responses.
• Cross-surface fixtures prove equivalent representative results and typed failures.
• A real-scale archive probe demonstrates bounded memory, useful time-to-first-page, cancellation, and successful resume.

Tracker authority

• GitHub: public outcome, review discussion, and externally legible closure.
• Beads epic: polylogue-z9gh.9 (public_parent).
• Delivery owner: polylogue-z9gh.9.1 (implements).
• Prerequisite repair slices: polylogue-z9gh.1, polylogue-z9gh.2 (implements).
• Related public issues: Build completion on shared query grammar #1844 owns interactive discovery/completion; perf(archive): prove current full-corpus ingest and rebuild bounds #2391 owns current full-corpus ingest/performance measurement. Neither substitutes for this read-transaction contract.

Non-goals

• No second query grammar.
• No transport-specific query semantics.
• No raw SQL public surface.
• No claim that every total must be exact when exactness would violate the declared budget; uncertainty must instead be explicit.
• No broad query feature expansion merely to exercise the transaction abstraction.