Read-only read layer over the event log, with two mechanisms behind one sealed funnel: a DataFusion engine for SQL over replayed partitions, and a per-conversation Parquet projection for participation-scoped search.

Implements the accepted designs tracked by #1178 (epic), #1179, #1202, and the access-control design this crate's authority module implements, plus the participation-scoped search index's own design.

The crate was SQL-only when it was named, so the description says what it now is rather than describing a crate this no longer matches.

The sealed funnel

[authority::QueryAuthority] is the crate's ONE public entry point — one scope path, sealed. Every other module that can build an unscoped engine or read unredacted data (engine, session, provider, views, decode, statement_gate, search_index) is pub(crate): nothing outside this crate can reach a engine::QueryEngine except through [authority::QueryAuthority::scope_for], which only ever accepts an already-verified [authority::Principal] — itself mintable only by [authority::QueryAuthority]'s own verification methods, never by a public constructor. [authority]'s own module doc states the full sealed/public split and how it is pinned.

[output::QueryResultJson] (the wire JSON envelope) and [audit::ReadAuditRecord] (the durable per-query audit record shape) round out the public surface, alongside [QueryLimits] (re-exported here since it is a plain resource- ceilings config struct [authority::QueryAuthority::new_state_backed] takes by value — no reason for a caller assembling one to reach into the pub(crate) engine module for it) — see each module's own doc.

[SearchIndex] is the one exception the seal deliberately makes, and it widens nothing: search_index itself stays pub(crate), and this handle exposes only what a Container must do to keep the projection maintained — open it, register its observer, supervise its worker. It reads nothing back out. The read side arrives as a scope-checked port behind [authority::QueryAuthority], the same funnel every other read goes through.