Implement checked aggregation plans, native SQL, and bounded RPC capture

proto/camino/api.proto

@@ -242,6 +242,8 @@ message QueryPendingField {
   optional uint32 residual_window = 7;
   uint32 residual_row = 8;
   string residual_field = 9;
+  optional uint32 relational_capture = 10;
+  uint32 captured_object = 11;
 }
 message QueryStats {
   uint32 sql_count = 1;
@@ -251,6 +253,9 @@ message QueryStats {
   uint32 result_bytes = 5;
   double preparation_ms = 6;
   double total_ms = 7;
+  uint32 relational_stages = 8;
+  uint32 captured_candidates = 9;
+  double relational_ms = 10;
 }
 message QueryResponse {
   Value value = 1;
@@ -264,6 +269,35 @@ message QueryResponse {
   repeated QueryResidualWindow residual_windows = 8;
   // Native reads share one database snapshot; package enrichment does not.
   string consistency = 9;  // native-snapshot | mixed
+  repeated QueryRelationalCapture relational_captures = 10;
+}
+
+// Private coordinator input, removed before publishing a result. Memberships
+// and native facts share one snapshot; package reads are sampled afterwards.
+message QueryCapturedMember {
+  string object_id = 1;
+  string entry_id = 2;
+  Value map_key = 3;
+}
+message QueryCapturedMembers {
+  repeated QueryCapturedMember entries = 1;
+}
+message QueryCapturedObject {
+  string object_id = 1;
+  map<string, Value> fields = 2;
+  map<string, string> field_types = 3;
+  map<string, QueryCapturedMembers> relationships = 4;
+}
+message QueryRelationalCapture {
+  repeated QueryPathPart path = 1;
+  QueryRelationalPlan plan = 2;
+  string root_object_id = 3;
+  repeated QueryCapturedObject objects = 4;
+  string variables_json = 5;
+  uint32 row_limit = 6;
+  uint32 candidate_limit = 7;
+  optional uint32 residual_window = 8;
+  repeated string result_path = 9;
 }
 
 message QueryResidualRow {
@@ -283,6 +317,8 @@ message QueryResidualWindow {
   bool bounded_all = 6;
   repeated QuerySelection selection = 7;
   map<string, string> field_types = 8;
+  bool relational = 9;
+  repeated string matched_entries = 10;
 }
 
 message QueryFieldFailure {