Release Query Tools 0.2.0

docs/ARCHITECTURE.md

@@ -1,3 +1,21 @@
 # Architecture
 
-`core/data.ts` performs bounded static parsing into JSON-compatible values. `core/query.ts` tokenizes a fixed grammar, interprets field paths and returns an explain plan; it never compiles or evaluates code. React retains the last valid dataset/result after errors. Relative assets and a same-origin service worker support nested offline deployment.
+`core/data.ts` performs bounded static parsing into JSON-compatible values while
+retaining raw numeric and cell-inference evidence. `core/query.ts` tokenizes the
+fixed SQL-like and path grammars, exposes their bounded syntax trees, interprets
+field paths and returns an explain plan; it never compiles or evaluates code.
+
+`core/duckdb.ts` is a separately selected adapter for the locally bundled
+single-threaded DuckDB-WASM MVP build. A lexical security gate accepts exactly
+one `SELECT` statement and rejects semicolons plus mutation, attachment,
+extension, file and configuration keywords before DuckDB performs its complete
+SQL parse. The adapter serializes at most 10,000 bounded rows into an in-memory
+table, disables external access and extension auto-install/auto-load, caps
+database memory at 128 MiB, limits results to 1,000 rows and terminates the
+disposable worker after completion, cancellation or a hard deadline.
+
+React retains the last valid dataset/result after errors and suppresses stale
+asynchronous results. Relative assets and a same-origin service worker support
+nested offline deployment. The static host serves hashed WASM as
+`application/wasm` with immutable caching and grants only the CSP allowances
+needed for same-origin WASM and workers.