Design decision the Trezy team made for selected parts of the system: when an aggregate exists (e.g. BankAccount, TransactionClassification), its event stream is treated as the source of truth for that logic. All writes must go through the aggregate; bypassing it (e.g. directly mutating the read-model row) introduces hidden states and bugs — exactly what the 'closed bank account with missing events' story illustrates. A conscious trade-off vs. the legacy CRUD data being another de-facto source of truth.