Read-only read layer over the event log, with two mechanisms behind one sealed funnel: a DataFusion engine for SQL over replayed partitions, and a per-conversation Parquet projection for participation-scoped search.

Per the accepted designs at docs/reference/datafusion-data-layer.md (tracking: #1178 epic, #1179 phase 1, #1202 phase 2, the 2026-07-21 access-control retrofit this crate's authority module implements) and docs/proposals/participation-scoped-agent-search.md (the search index).

The crate was SQL-only when it was named, so the description says what it now is rather than describing a crate this no longer matches.

The sealed funnel (A2)

[authority::QueryAuthority] is the crate's ONE public entry point — "one scope path, sealed" (docs/reference/datafusion-data-layer.md, "Access control"). Every other module that can build an unscoped engine or read unredacted data (engine, session, provider, views, decode, statement_gate, search_index) is pub(crate): nothing outside this crate can reach a engine::QueryEngine except through [authority::QueryAuthority::scope_for], which only ever accepts an already-verified [authority::Principal] — itself mintable only by [authority::QueryAuthority]'s own verification methods, never by a public constructor. [authority]'s own module doc states the full sealed/public split and how it is pinned.

[output::QueryResultJson] (the wire JSON envelope) and [audit::ReadAuditRecord] (the durable per-query audit record shape) round out the public surface, alongside [QueryLimits] (re-exported here since it is a plain resource- ceilings config struct [authority::QueryAuthority::new_state_backed] takes by value — no reason for a caller assembling one to reach into the pub(crate) engine module for it) — see each module's own doc.

[SearchIndex] is the one exception the seal deliberately makes, and it widens nothing: search_index itself stays pub(crate), and this handle exposes only what a Container must do to keep the projection maintained — open it, register its observer, supervise its worker. It reads nothing back out. The read side arrives as a scope-checked port behind [authority::QueryAuthority], the same funnel every other read goes through.