Package-level declarations

The committed states a node reads: the latest committed state of an aggregate, as the write side keeps it (:runtime's state reads, injected here so that :query does not depend on the runtime).

The Manifest's state schemas as the query schema source (ManifestQuerySchemaSource), for each aggregate whose state schema the Manifest carries in $defs; the Gradle plugin's manifest-tools writes them. An aggregate without one, from a module built with the compiler alone, is queried by its system fields only, and a warning says so once. A model that is no aggregate of the Manifest, such as a dataset whose fields its own definition gives, has none to ask for and is not warned about (DX gap G31).

The aggregate types of a Manifest by what it lists of them, within the contexts a node hosts.

The read side of a node, composed once: the gateways of the three query models (the snapshots and events of each aggregate type a backend serves, the datasets), the schema catalog they compile against, which aggregates and datasets a caller sees (visibility, datasetVisibility), and the reads every entry reads a state through. A host only maps its configuration onto a Builder; the security rules are the builder's:

The one read path of every entry that reads an aggregate's state (HTTP, synchronous calls, ops): read the state, check that the caller may see it, mask it. read loads a state (its latest, at a version or a time, as the entry asks, from the runtime's state reads), hands it to admitted, which checks it against the snapshot query policies of its type (StateVisibility: the caller scope and the application's policies, through the type's snapshot query gateway or, when its snapshots are not queried, its policy gateway) and masks it as the snapshot queries mask a state; event masks an event body the same way.