docs: record ADR keeping graph queries as validate-on-read

[lesnik512]

Records the outcome of architecture-review candidate 4 ("split the query from the gate in the graph", the Speculative one) as an ADR. No code change.

Conclusion: the query-as-validator pattern and the gate/emit recompute are the deliberate consequence of accepted decisions, not a defect:

• The gate and emit operate at different scopes, so a shared "compute the graph once" artifact cannot span them. validate(compose) is target-agnostic; _plan is target-scoped (startup_order(services, target)). The gate can't compute the dependency closure without a target — cycle/unknown-dep detection is inherently target-scoped.
• The independent recompute is the accepted price of parse-don't-validate (2026-07-10) — validate and emit are independent readers with no shared computed model. Threading a graph reintroduces the coupling that ADR declined.
• Query-as-validator is the "validate owns emit shapes" pattern (2026-07-10.01). Splitting the raise out of the queries would leave emit's reader non-validating — emit_script(malformed_dict) would crash instead of raising UnsupportedComposeError.

The only ADR-neutral change (deduping depends_on within _plan) is marginal and partial (startup_order normalizes independently anyway). Revisit triggers recorded: the gate becoming target-aware, or the graph walk profiling as a real hotspot.

planning/decisions/2026-07-12-keep-graph-query-as-validator.md