Poll changes

Same durable journal as SSE. Every durable event has one identity and appears exactly once in a forward cursor traversal, in stable order with per-Record order preserved. Concurrent writes to different Records need not appear in exact commit order. Reusing an older cursor can redeliver events. Without cursor, return empty items and an exact start-now cursor, excluding already committed changes while retaining then-in-flight writes. Readers advance only through a safe published prefix; aborted allocations may leave gaps. In healthy parallel mode, publication delay is bounded by the longest configured engine transaction timeout (30 seconds by default) plus two 100 ms publisher polls. Outside long-running or prepared transactions and database unavailability can delay publication; readers fail closed rather than skip late commits. Cursor binds Organization, Corpus filter and authorization scope. Expiry is 410 cursor_expired with resync_url, never silent reset; changed scope/filter is 409 cursor_scope_changed with resync_url. resync_url is the API-relative Record catalog route for the Corpus (/v0/records?corpus_id=...). next_cursor advances over scanned events even when none are visible. Public events are invalidations; reread current state, do not replay historical content into a current mirror.