Bound indexed retrieval operations

DEVELOPMENT_NOTES.md

@@ -59,9 +59,11 @@ of project size.
 
 The inherited dependency-cycle preparation scanned every edge once for every node. The graph
 validator now constructs dependency adjacency in one edge pass and sorts each adjacency list before
-the existing deterministic depth-first cycle check.
+an iterative deterministic depth-first cycle check. The iterative stack also removes recursion
+depth as a failure mode on large valid graphs. The same edge pass now rejects missing sources as
+well as missing targets.
 
-A 2,000-node regression test counts complete edge-collection iteration passes and caps them at
+A 10,000-node regression test counts complete edge-collection iteration passes and caps them at
 four. The focused correctness and bounded-pass tests pass, and the configured strict source type
 gate is clean.
 
@@ -137,6 +139,21 @@ One audit identified a correctness risk beyond latency: a large mutating MCP ope
 successfully and then be replaced by `result_too_large`. This must be fixed in Milestone 1 so
 exactly-once operations never report a false failure after mutation.
 
+#### Bounded indexed retrieval
+
+Search, metadata filtering, backlinks, dependency traversal, and impact traversal now query one
+extra row beyond the requested bound and report `limit` plus `truncated`. Backlinks, dependency,
+and impact APIs accept the same additive `limit` option through Python, CLI, and MCP surfaces.
+Omitted limits are capped by the project `max_results` policy.
+
+Traversal no longer loads the complete edge table and repeatedly scans it. It performs
+deterministically ordered frontier queries through the existing source primary key or target index.
+Each request also has a deterministic edge-examination budget derived from its result limit. The
+response includes `examined_edges` and `examined_edges_limit` counters so algorithmic work can be
+asserted independently of machine timing. `truncated` is true when either another unique result
+exists or the work budget prevents proving completeness. A focused core, CLI, MCP, Ruff, and
+Pyright gate passes for this work-in-progress slice.
+
 ### Initial design constraints
 
 - Full rebuild remains the recovery and equivalence oracle.