Module bounded_query 

Read-only Git queries of the auto-push, each with a deadline and separate output streams. What: Run one read-only Git query that is ended only when it shows no sign of work, with separate output streams. Why: The auto-push asks Git a handful of questions before it pushes, and a question that never returns would hold the service’s push for good. A query that shows no sign of work for the quiet window is stopped and reported, so the commit stays saved. A query that works is never stopped for being slow: no total time bounds it (owner, 2026-11-03: “Stop only on no progress”; the coordinator’s scope addition to picks 4 and 9 of doc/planning/cli-git-shipped-limits-audit.md, open to the owner’s veto). Before this, a query shared the push’s wall-clock stop and the journal showed a git status stopped at 2026-11-03T08:28 with outcome=retrying push_ms=97398. The longest quiet gap of every query is kept in the ledger.

In TS you’d write (pseudocode):

const { exitCode, stdout, stderr } = await nanoSpawn(gitPath, args, { cwd, signal: quietFor(windowMs) }); // quiet, not slow

Structs

QueryOutput

What: What a finished query printed and how it ended. Why: Callers read an exit code as an answer (“not an ancestor”) or a failure, never both.

Functions

query_window

What: The quiet window of a query: the push’s stall window. Why: One setting bounds how long every Git child of the auto-push may show no sign of work. The cap of 120 seconds a query used to have is gone with the wall-clock stop it belonged to.

run_bounded_query

What: Run a query command to its end, or until it has shown no sign of work for the quiet window. Why: Both streams go to anonymous files, so no reader thread can outlive a stopped query. A query that was stopped for being quiet is a coordination failure, not an answer.