Package-level declarations

The ids the view store derives from what an aggregate is for, so a route finds the aggregate without a lookup: the same parts always give the same id. They are derived exactly as the 9.x view store derived them (ViewPreferencesIds, DatasetWordingIds): the tenant first, then the parts, joined by NUL, the first 32 hex digits of their SHA-256. So the preferences and the wordings migrate-data imports from 9.x keep their ids, and a route finds them after the cut-over (found by the 8c.1 rehearsal). The tenant is redundant in 10.x, whose ids are unique per tenant (axiom A6), and no part names the aggregate type, since each type has its own streams; both stay for this compatibility.

The application a command comes from: its standard request fact app_id (RequestFacts.APP_ID), the application the service's caller resolver authenticated for the request (CoSec's: the app of the request's CoSec scope). A client's own header is never read.

The codes the view store rejects a command with: the 9.x ViewStoreErrorCodes as 10.x rejections. A rule the 9.x starter checked on the path (the scope ids, the closed routes) has no code: 10.x takes the identity from the principal, and its routes are the Manifest's.