admitRecord

Point-read admission of record, the snapshot-shaped record of a state that selection chose (by id; a tracing read also states its deletion scope), under caller's entry and scope.

Step 0 accepts the entry and, when the entry policy says so, requires an authenticated scope against schema's profile (the snapshot profile without one), as a query route does. Steps 2 and 3 then run on a QueryType.SINGLE query of selection: the caller's scope and every QueryPolicy restriction are appended, then the snapshot model's default scope. There is no submitted query to budget or rewrite, so the budget and step 1 do not apply. The resulting filter is then admitted as trusted code's query of a record (Trusted.single against schema's in-memory form, recordSchema): aliases replaced, validated, normalized, relative time resolved to its range, and evaluated on record by the same code the in-memory backend runs (InMemoryFilters), so a policy admits the same rows on a point read as on a query. Resolution refuses everything the evaluation cannot run (a full-text search, which the in-memory facts do not grant; a field the schema does not know; a value its type refuses; an element's field outside its ELEMENT_MATCH), and relative time is lowered to a range first: a refused restriction fails closed, the record hidden, and a failure past resolution is a defect, not a policy's answer.

Returns record, or null when the caller may not read it. The record returned is masked by schema's response masks (maskRecord).