@cratis/pi 2.22.0 → 2.23.0

package/package/corpus/skills/cratis-chronicle-cli-operations/SKILL.md

@@ -16,8 +16,10 @@ This skill is verified against these exact sources:
 
 | Package | Version | Purpose |
 | --- | --- | --- |
-| `Cratis.Cli` | `2.4.0` | the `cratis` command, its contexts, output formats, and command tree |
-| `Cratis.Chronicle` | `16.45.2` | the observer, partition, sequence, and job concepts the CLI reads |
+| `Cratis.Cli` | `3.2.0` | the `cratis` command, its contexts, output formats, and command tree |
+
+> Re-verified at `Cratis/cli` **v3.2.0** (originally written against 2.4.0): every command, branch, flag and output format this skill names exists there; the 2.x→3.x change is the Chronicle 17/18 wire migration plus new branches (`ai`, `arc`, `screenplay`, `prologue`, `llm`) this skill does not cover.
+| `Cratis.Chronicle` | `18.3.0` | the observer, partition, sequence, and job concepts the CLI reads |
 
 The CLI ships a **versioned machine-readable catalog of its own surface**, and
 that catalog is the authority for exact command names on the installed version:
@@ -110,7 +112,7 @@ error.
 | Is the server healthy at all? | `cratis chronicle diagnose` (exit code 3 when unhealthy) |
 | Why has this read model stopped updating? | `chronicle failed-partitions list --observer <id>` — the error is on the partition, not in the log |
 | An observer is quarantined — why? | `chronicle failed-partitions show <observer> <partition> --detailed`, with attempt history |
-| Did this event actually get appended? | `chronicle events get --event-type <type> --event-source-id <id>`, or `chronicle events tail` |
+| Did this event actually get appended? | `chronicle events get --event-type <type> --event-source-id <id>` (`events tail` returns only the highest sequence number — not a count, not the events) |
 | What is this event's shape in the store? | `chronicle event-types list`, then `chronicle event-types show <type>` |
 | Is this projection registered? | `chronicle projections list`, then `chronicle projections show <id>` |
 | What does the read model actually hold? | `chronicle read-models get <read-model> <key>`, or `read-models instances` |
@@ -165,16 +167,20 @@ Before any of them:
 
 ### Two confirmation traps
 
-**Confirmation prompts do not fire when stdout is not a terminal.** The CLI
-treats a non-interactive session as an implicit yes, so a destructive command
-run from a script, a pipeline, or an agent harness proceeds without `-y` and
-without asking. Never rely on the prompt as the safety mechanism — the
-authorization above is the safety mechanism.
-
-**Not every mutating command prompts, even interactively.** `jobs stop` and
-`jobs resume` describe themselves as prompting for confirmation, but no prompt
-exists in the implementation. `users add`, `applications add`, and
-`subscriptions add` do not prompt either.
+**Destructive commands fail closed outside a terminal.** Every command with a
+confirmation prompt — `observers replay`, `observers replay-partition`,
+`observers retry-partition`, `observers clear-quarantine`, `jobs stop`,
+`jobs resume`, `recommendations perform`, `recommendations ignore`,
+`users remove`, `applications remove`, `subscriptions remove` — asks
+interactively, and when the session is **not** interactive (a script, a
+pipeline, an agent harness) it does *not* proceed: it writes
+"Re-run the command with --yes to confirm the operation" and exits with the
+validation error code. `--yes` is therefore the only way a non-interactive run
+performs one of these, which makes `--yes` the authorization boundary. Declining
+the interactive prompt exits successfully having done nothing.
+
+**Additive commands do not prompt.** `users add`, `applications add` and
+`subscriptions add` run without confirmation in every mode.
 
 Reaching for `--yes` to silence a prompt you have not read is how the wrong
 store gets replayed. A failed partition you have not yet explained is not a

package/package/corpus/skills/cratis-chronicle-client-dotnet/SKILL.md

@@ -17,16 +17,18 @@ There is no host requirement and no application architecture imposed.
 ## Verified product sources
 
 This skill is verified against the `Cratis/Chronicle` repository at tag
-`v17.0.1`, whose client sources are byte-identical to `16.45.2` for every public
-type cited here except the compatibility check noted below.
+`v18.3.0`. Its client sources are unchanged in public shape since `v17.0.1`
+(the 17→18 client diff is converters, options and doc comments), and `v17.0.1`
+was byte-identical to `16.45.2` for every public type cited here except the
+compatibility check noted below.
 
 | Package | Line | Purpose |
 | --- | --- | --- |
-| `Cratis.Chronicle` | `17.x` | `ChronicleClient`, `IEventStore`, `[EventType]`, observers |
-| `Cratis.Chronicle.Connections` | `17.x` | `ChronicleConnectionString`, connection lifecycle |
-| `Cratis.Chronicle.AspNetCore` | `17.x` | ASP.NET Core wiring, header/subdomain namespace resolvers |
-| `Cratis.Chronicle.Testing` | `17.x` | in-process scenarios |
-| `Cratis.Chronicle.CodeAnalysis` | `17.x` | the analyzers, a **separate opt-in** package |
+| `Cratis.Chronicle` | `18.3.0` | `ChronicleClient`, `IEventStore`, `[EventType]`, observers |
+| `Cratis.Chronicle.Connections` | `18.3.0` | `ChronicleConnectionString`, connection lifecycle |
+| `Cratis.Chronicle.AspNetCore` | `18.3.0` | ASP.NET Core wiring, header/subdomain namespace resolvers |
+| `Cratis.Chronicle.Testing` | `18.3.0` | in-process scenarios |
+| `Cratis.Chronicle.CodeAnalysis` | `18.3.0` | the analyzers, a **separate opt-in** package |
 
 Take the exact version from nuget.org. The version in source is a `1.0.0`
 placeholder injected at pack time (`Source/Directory.Build.props`), so the
@@ -182,23 +184,23 @@ and an optional `EventStoreNamespaceResolverType`.
 Since Chronicle 17 the compatibility check is a server-side RPC, and **the client
 runs it automatically inside `Connect()`** —
 `Source/Clients/Connections/ChronicleConnection.cs:310` calls
-`CheckCompatibility` (`:405`), sending the client type, client version, protocol
-version, and the descriptor set its contracts package was built with (`:411-417`).
-The rationale is at `:400-404`: Chronicle has clients in four languages and only
+`CheckCompatibility` (`:414`), sending the client type, client version, protocol
+version, and the descriptor set its contracts package was built with (`:420-426`).
+The rationale is at `:409-413`: Chronicle has clients in four languages and only
 some can build a descriptor set at runtime, so each ships the one it was built
 with and the server does the single comparison.
 
 Behavior you can rely on:
 
 - A server too old to have the RPC answers `Unimplemented`, and the client falls
-  back to the previous client-side exchange (`:419-425`) — upgrading the client
+  back to the previous client-side exchange (`:428-434`) — upgrading the client
   does not silently drop the check.
-- Any other transport error is **logged and ignored** (`:426-432`), on the stated
+- Any other transport error is **logged and ignored** (`:435-441`), on the stated
   reasoning that failing to ask says nothing about whether the two sides agree.
 - A genuine mismatch throws `IncompatibleServerException`
   (`Source/Clients/Connections/IncompatibleServerException.cs:10`) whose message
   names the server address, its version, its protocol version, and the specific
-  incompatibilities (`:436-443`).
+  incompatibilities (`:443-449`).
 
 The client identifies itself as `".NET"`
 (`Source/Clients/Connections/ChronicleClientIdentity.cs:22`) with its assembly
@@ -333,8 +335,8 @@ Read models are queried through `eventStore.ReadModels`
 Artifacts are found by **assembly scanning**, with no registration call and no DI
 container required. `DefaultClientArtifactsProvider.Default` composes the
 project-referenced and package-referenced assemblies
-(`Source/Clients/DotNET/DefaultClientArtifactsProvider.cs:35`), and the
-predicates are exactly (`:230-238`):
+(`Source/Clients/DotNET/DefaultClientArtifactsProvider.cs:37`), and the
+predicates are exactly (`:242-251`):
 
 | Kind | Predicate |
 | --- | --- |

package/package/corpus/skills/cratis-chronicle-client-elixir/SKILL.md

@@ -12,33 +12,37 @@ to yours, and everything after that is ordinary OTP.
 
 ## Verified product sources
 
-This skill is verified against `Cratis/Chronicle.Elixir` at tag **`v2.2.0`**,
-which is the version actually published on Hex.
+This skill was written against `Cratis/Chronicle.Elixir` at tag **`v2.2.0`** and
+re-verified at **`v3.1.0`** (published on Hex as `3.1.0`; `3.0.0` is the
+Chronicle 17/18 wire migration — gRPC request/response shapes, no public API
+removed). Every module, function and option this skill names exists at `v3.1.0`;
+the `file:line` citations below were taken at `v2.2.0` and may have shifted.
 
 | Fact | Value | Source |
 | --- | --- | --- |
 | OTP app / Hex package | `:cratis_chronicle` | `Source/chronicle/mix.exs:14` |
-| Published version | `2.2.0` | hex.pm |
-| Elixir requirement | `~> 1.14` | `Source/chronicle/mix.exs:16` |
-| Contracts dependency | `cratis_chronicle_contracts` resolved to `16.13.4` | `Source/chronicle/mix.lock` |
+| Published versions | `3.1.0`, `3.0.0`, `2.2.0`, `2.1.x`, `2.0.0`, `1.0.x`, `0.x` — **no `2.3.0`** | hex.pm |
+| Elixir requirement | `~> 1.14` | `Source/chronicle/mix.exs` |
+| Contracts dependency | `cratis_chronicle_contracts` resolved to `18.2.0` at `v3.1.0` (`16.13.4` at `v2.2.0`) | `Source/chronicle/mix.lock` |
 
 > **The `v2.3.0` git tag was never published to Hex.** `mix deps.get` cannot
-> fetch it. Anything introduced there — notably the `Chronicle.Concept` macro,
-> which does not exist at `v2.2.0` — must not be documented as available.
+> fetch it. What it introduced — notably the `Chronicle.Concept` macro
+> (`use Chronicle.Concept, type: :string`, a single-value concept that carries its
+> `pii` classification once, mirroring `ConceptAs<T>`) — **is published from
+> `3.0.0`**. On `2.2.0` it does not exist; on `3.x` it is the preferred way to
+> classify a personal value.
 
 > **The repository's `VERSION` file says `0.0.5` and is a build-time
 > placeholder** overwritten by the publish workflow. Never quote it.
 
-> **Do not copy from the repository's root `README.md`.** At `v2.2.0` it uses
-> module names that do not exist — `use Chronicle.EventType`,
-> `use Chronicle.ReadModel`, `use Chronicle.Reactor`, `use Chronicle.Reducer`,
-> `use Chronicle.Seeder` (`README.md:9-13`, `:49`, `:54`). The real modules are
-> namespaced: `Chronicle.Events.EventType`, `Chronicle.ReadModels.ReadModel`,
-> `Chronicle.Reactors.Reactor`, `Chronicle.Reducers.Reducer`,
-> `Chronicle.Seeding.Seeder`. **Copy from `Documentation/client-snippets/`
-> instead** — those are CI-validated and correct at every version.
+> **The real modules are namespaced** — `Chronicle.Events.EventType`,
+> `Chronicle.ReadModels.ReadModel`, `Chronicle.Reactors.Reactor`,
+> `Chronicle.Reducers.Reducer`, `Chronicle.Seeding.Seeder`. The `v2.2.0` root
+> `README.md` used unnamespaced names that do not exist (`use Chronicle.EventType`,
+> …); the `3.x` README is correct. When in doubt, copy from
+> `Documentation/client-snippets/` — those are CI-validated at every version.
 
-> `Documentation/get-started.md:12` pins `{:cratis_chronicle, "~> 0.1"}`, which
+> `Documentation/get-started.md:13` pins `{:cratis_chronicle, "~> 0.1"}`, which
 > does not match the published `2.2.0`. Use a `2.x` requirement.
 
 ## Adding it
@@ -211,7 +215,7 @@ the outcome.
 | `get_from_sequence_number/2` | | `:369` |
 | `get_tail_sequence_number/2` | | `:408` |
 
-Append options (`event_log.ex:79-94`): `:client`, `:namespace`,
+Append options (`event_log.ex:79-94`, plus `:occurred` read at `:720`): `:client`, `:namespace`,
 `:event_sequence_id` (default `"event-log"`), `:event_source_type` (default
 `"Default"`), `:event_stream_type` (default **`"All"`**), `:event_stream_id`
 (default `"Default"`), `:tags`, `:subject`, `:correlation_id`, `:identity`,
@@ -398,9 +402,9 @@ attempt.
 
 | Pitfall | Why it bites |
 | --- | --- |
-| Copying the root `README.md` | Its module names do not exist at `v2.2.0` |
-| Using `Chronicle.Concept` | It exists only in the unpublished `v2.3.0` tag |
-| `{:cratis_chronicle, "~> 0.1"}` from the docs | Does not match the published `2.2.0` |
+| Copying the `v2.2.0` root `README.md` | Its module names do not exist; the `3.x` README is correct |
+| Using `Chronicle.Concept` on `2.2.0` | It ships from `3.0.0`; on `2.2.0` annotate fields with `pii/1,2` instead |
+| Copying the dependency line from the README | It lags the published version; take the version from hex.pm |
 | Quoting the `VERSION` file | It is a `0.0.5` build-time placeholder |
 | Putting configuration in `config.exs` | The client reads no application env; options are child-spec keywords |
 | Omitting `:otp_app` | Discovery falls back to scanning every loaded module |

package/package/corpus/skills/cratis-chronicle-client-kotlin/SKILL.md

@@ -13,14 +13,20 @@ you construct a client, ask it for an event store, and append or observe.
 
 ## Verified product sources
 
-This skill is verified against this exact source:
+This skill was written against `Chronicle.Kotlin` at tag `v4.0.0` (commit
+`63ff629`) and re-verified at **`v5.1.0`**: every class, function, option and
+Spring bean this skill names exists there. The `4→5` major is the Chronicle 17/18
+wire migration (gRPC request/response shapes and `ensureSuccess` result
+envelopes — internal to the client); `5.0.0` also adds a `ChronicleCommandRejected`
+exception for a rejected server-side command. The `file:line` citations below
+were taken at `v4.0.0` and may have shifted.
 
 | Artifact | Version | Verified from |
 | --- | --- | --- |
-| `io.cratis:chronicle` | `4.0.0` | `Chronicle.Kotlin` at tag `v4.0.0` (commit `63ff629`) |
-| `io.cratis:chronicle-spring-boot-starter` | `4.0.0` | same tag, `Integrations/SpringBoot` |
-| `io.cratis:chronicle-testing` | `4.0.0` | same tag, `Testing` |
-| `io.cratis:chronicle-contracts` | `16.44.1` | `Source/build.gradle.kts:11` |
+| `io.cratis:chronicle` | `5.1.0` | `Chronicle.Kotlin` at tag `v5.1.0` |
+| `io.cratis:chronicle-spring-boot-starter` | `5.1.0` | same tag, `Integrations/SpringBoot` |
+| `io.cratis:chronicle-testing` | `5.1.0` | same tag, `Testing` |
+| `io.cratis:chronicle-contracts` | `18.2.0` | `Source/build.gradle.kts` (`chronicleContractsVersion`) |
 
 All three artifacts are published to Maven Central under `io.cratis`
 (`Source/build.gradle.kts:54`, `Testing/build.gradle.kts:32`,
@@ -35,9 +41,10 @@ All three artifacts are published to Maven Central under `io.cratis`
 > the checked-in source never carries the real number. Take it from Maven
 > Central.
 
-> **The client and the kernel version independently.** Client `4.0.0` is built
-> against `chronicle-contracts` `16.44.1`; the Chronicle server has since moved
-> to a `17.x` line. Confirm the client/server pair you intend to run is
+> **The client and the kernel version independently.** Client `5.1.0` is built
+> against `chronicle-contracts` `18.2.0` (the `4.x` line was built against
+> `16.44.1` and does not speak the 17/18 wire shapes); the Chronicle server is
+> on `18.x`. Confirm the client/server pair you intend to run is
 > supported before relying on it — do not infer compatibility from the fact that
 > both are "latest".
 
@@ -82,11 +89,11 @@ fun main() = runBlocking {
 | `fun evictEventStores()` | `:36` | drops the local cache, keeps the client |
 | `fun dispose()` | `:39` | `IChronicleClient : AutoCloseable`, `close()` delegates to it (`:41`) |
 
-**The client connects in its constructor.** `ChronicleClient.kt:13` is
+**The client connects in its constructor.** `ChronicleClient.kt:12` is
 `ChronicleConnection(options.connectionString).also { it.connect() }` — there is
 no separate `connect()` step to call, and constructing the client is the
 connecting act. Event stores are cached per `"$name/$namespace"`
-(`ChronicleClient.kt:22`), so repeated `getEventStore` calls return the same
+(`ChronicleClient.kt:21`), so repeated `getEventStore` calls return the same
 instance.
 
 The default namespace is the literal `"Default"` —
@@ -355,13 +362,15 @@ A model-bound projection puts the projection on the read model with `@FromEvent`
 (`projections/SetFrom.kt:22`); the full family also includes `SetValue`,
 `SetFromContext`, `AddFrom`, `SubtractFrom`, `Increment`, `Decrement`, `Count`,
 `Join`, `RemovedWith`, `RemovedWithJoin`, `ChildrenFrom`, `ClearWith`,
-`FromAll`, `FromEvery`, `Nested`, `NoAutoMap`, `NotRewindable`. The declarative
+`FromAll`, `FromEvery`, `FromEventSourceId`, `CountFromAll`, `IncrementFromAll`,
+`DecrementFromAll`, `Nested`, `NoAutoMap`, `NoAutoMapProperties`,
+`NotRewindable`. The declarative
 alternative is a class implementing `IProjectionFor<TReadModel>`.
 
 ## Discovery and registration
 
 `ClientArtifacts` scans the classpath with ClassGraph
-(`artifacts/ClientArtifacts.kt:44-48`), and `ClientArtifacts.default` is a
+(`artifacts/ClientArtifacts.kt:66-98`), and `ClientArtifacts.default` is a
 process-wide lazy singleton (`:156`). What it looks for (`:66-98`):
 
 | Kind | Rule |
@@ -377,6 +386,8 @@ process-wide lazy singleton (`:156`). What it looks for (`:66-98`):
 | seeders | implements `ICanSeedEvents` |
 | webhooks | implements `IWebhookDefiner` |
 | captures | implements `ICapture` |
+| reactor middlewares | implements `IReactorMiddleware` or `BlockingReactorMiddleware` |
+| reactor argument resolvers | implements `IReactorMethodArgumentResolver` or `BlockingReactorMethodArgumentResolver` |
 
 > The `FromEvent$Container` entry is not incidental: Kotlin's `@Repeatable`
 > replaces repeated annotations with a synthetic container, so a class carrying
@@ -464,7 +475,7 @@ In Spring Boot, Java injects the `Chronicle` bean instead — it already takes
 folds a reducer through the same handler-shape rules as production
 (`ReadModelScenario.kt:139-150`). Its scope is small — appends and reducer folds
 only; there is no in-process reactor, projection, or constraint scenario
-(`Testing/api/Testing.api` is 56 lines).
+(`Testing/api/Testing.api` is 57 lines).
 
 ## Common pitfalls
 
@@ -474,9 +485,9 @@ only; there is no in-process reactor, projection, or constraint scenario
 | Two `@EventType` classes sharing a simple name | The id defaults to the simple name, so they collide on the wire (`EventTypesService.kt:67`) |
 | Shipping the default connection string to production | `skipTlsValidation` defaults to **true**; certificate validation is off (`ChronicleConnectionString.kt:28`) |
 | Copying a version from the README or docs | Both are stale at `v4.0.0`; the real version comes from the release, not the source |
-| Expecting `getEventStore` to suspend | It does not — the client already connected in its constructor (`ChronicleClient.kt:13`) |
+| Expecting `getEventStore` to suspend | It does not — the client already connected in its constructor (`ChronicleClient.kt:12`) |
 | Expecting `awaitRegistration()` to mean "registered" | It completes in a `finally`, so it also returns after a failed pass (`ArtifactRegistrations.kt:47-57`) |
-| Expecting a registration failure to throw | Failures are printed to `System.err`, not raised (`EventStore.kt:236`) |
+| Expecting a registration failure to throw | Failures are printed to `System.err`, not raised (`EventStore.kt:244`) |
 | Expecting read model reactors to be discovered | `IReadModelReactor` is absent from the scan and from `IEventStore`; construct `ReadModelReactors(...)` yourself |
 | Leaving the default classpath scan on in a large app | Use `withArtifactsFrom(...)` or `artifact-packages` to narrow it (`ChronicleOptions.kt:58`) |
 | Expecting WebFlux support from the starter | The web auto-configuration is `SERVLET`-only (`ChronicleWebAutoConfiguration.kt:29`) |

package/package/corpus/skills/cratis-chronicle-client-typescript/SKILL.md

@@ -13,13 +13,17 @@ HTTP and never sees this package.
 
 ## Verified product sources
 
-This skill is verified against `Cratis/Chronicle.TypeScript` at tag `v4.0.0`
-(commit `bed0b86`), which is the version published on npm.
+This skill was written against `Cratis/Chronicle.TypeScript` at tag `v4.0.0`
+(commit `bed0b86`) and re-verified at **`v5.1.0`** (published on npm as
+`5.1.0`): every class, function and option this skill names exists there. The
+`4→5` major is the Chronicle 17/18 wire migration (internal gRPC shapes; it adds
+`ensureCommandResponse` for server-side command results). The `file:line`
+citations below were taken at `v4.0.0` and may have shifted.
 
 | Package | Version | Where |
 | --- | --- | --- |
-| `@cratis/chronicle` | `4.0.0` | `Source/package.json:2` |
-| `@cratis/chronicle.contracts` | `17.0.0` | `Source/package.json` dependency |
+| `@cratis/chronicle` | `5.1.0` | npm; `Source/package.json` carries a `1.0.0` placeholder |
+| `@cratis/chronicle.contracts` | `18.2.0` | `Source/package.json` dependency at `v5.1.0` |
 | `@cratis/fundamentals` | `^7.14.0` | **peer dependency** — you install it |
 
 > **Do not read the version out of the repository.** `Source/package.json` says
@@ -75,7 +79,7 @@ try {
 }
 ```
 
-`IChronicleClient` is three members — `Source/IChronicleClient.ts:16-39`:
+`IChronicleClient` is four members — `Source/IChronicleClient.ts:16-39`:
 
 | Member | Line |
 | --- | --- |
@@ -125,7 +129,7 @@ Two facts to carry into production guidance:
   is not validated, because a development kernel serves a self-signed
   certificate. Set `?skipTlsValidation=false` against a real server.
 - **A connection string with no credentials silently falls back to the
-  development client credentials** (`Source/connection/ChronicleConnection.ts`).
+  development client credentials** (`Source/connection/ChronicleConnection.ts:319-326`; the constants live in `ChronicleConnectionString.ts:453-454`).
   An anonymous-looking connection string is not anonymous; it is
   `chronicle-dev-client`.
 
@@ -208,13 +212,13 @@ if (!result.isSuccess) {
   `EventContext.sequenceNumber` is a `bigint` too.
 - `AppendOptions` — `Source/eventSequences/AppendOptions.ts`: `correlationId?`,
   `eventSourceId?`, `concurrencyScope?`, `concurrencyScopes?`, and **`tags?`**
-  (`:22-29`, new in `4.0.0`).
+  (`:22-29`, since `4.0.0`; unchanged at `5.1.0`).
 
 > **Single `append()` cannot target a stream or a subject.** It hardcodes
 > `EventSourceType: 'Default'`, `EventStreamType: 'Default'`,
 > `EventStreamId: eventSourceId`, and `Subject: eventSourceId`
-> (`Source/eventSequences/EventSequence.ts:100-119`). Only `tags` became a real
-> option in `4.0.0` (`:117`). To target a different stream or subject, use the
+> (`Source/eventSequences/EventSequence.ts:100-120`). Only `tags` became a real
+> option in `4.0.0` (`:118`). To target a different stream or subject, use the
 > `EventForEventSourceId[]` overload, whose entries carry `eventStreamType`,
 > `eventStreamId`, `eventSourceType`, `subject`, and `tags`.
 
@@ -252,7 +256,7 @@ Reducers do the same (`Source/reducers/Reducers.ts:454-460`). A handler whose
 method name does not match is simply never called — **there is no error**.
 
 > The docstring at `Source/reactors/reactor.ts:28-29` claims dispatch is by the
-> first parameter's type. **It is wrong**, and it is still wrong at `4.0.0`. The
+> first parameter's type. **It is wrong**, and it is still wrong at `5.1.0`. The
 > code is the authority; so are the client snippets under `Documentation/`, which
 > state the name rule explicitly.
 
@@ -281,7 +285,7 @@ a failed side-effect append fails the partition.
 
 `@reducer(id?, eventSequenceId?, readModel?, isActive?)` —
 `Source/reducers/reducer.ts:58`. Passing `readModel` also registers that type as a
-read model. **The reducer handler takes three arguments at `4.0.0`** —
+read model. **The reducer handler takes three arguments (`4.0.0` through `5.1.0`)** —
 `reducerInstance[methodName](content, currentState, context)`
 (`Source/reducers/Reducers.ts:400`). The third is optional by arity, and a handler
 may be sync or async.

package/package/corpus/skills/cratis-chronicle-compliance/SKILL.md

@@ -17,8 +17,8 @@ This skill is verified against this exact public release:
 
 | Package | Version | Purpose |
 | --- | --- | --- |
-| `Cratis.Chronicle` | `16.45.3` | `Cratis.Chronicle.Compliance.GDPR`, `Cratis.Chronicle.SubjectAttribute`, `IEventSequence.Redact`, `IReadModels.Release` |
-| `Cratis.Chronicle.CodeAnalysis` | `16.45.3` | `CHR0026`, `CHR0034`, `CHR0035`, `CHR0043`, `CHR0046` |
+| `Cratis.Chronicle` | `18.3.0` | `Cratis.Chronicle.Compliance.GDPR`, `Cratis.Chronicle.SubjectAttribute`, `IEventSequence.Redact`, `IReadModels.Release` |
+| `Cratis.Chronicle.CodeAnalysis` | `18.3.0` | `CHR0026`, `CHR0034`, `CHR0035`, `CHR0043`, `CHR0046` |
 
 Reverify product sources before claiming support for another version.
 
@@ -224,7 +224,18 @@ storage, configured under `Cratis:Chronicle:Compliance:Encryption`.
   noise: which person owns the resulting document?
 - Bearer tokens, magic links, and signed URLs are secrets, not durable facts.
   Store a keyed hash or an opaque reference. Chronicle has no attribute that
-  withholds a secret from the log.
+  withholds a secret from the log (Arc's `[NotAudited]` keeps a *command
+  property* out of the causation chain — see **cratis-arc-command** — but a
+  secret placed in an event payload is in the log for good).
+- **Erasure is wider than the event log.** Crypto-shredding removes readability
+  of `[PII]` values in events and read models. It does nothing for a copy that
+  left Chronicle: an exported CSV, a generated PDF, a search index, an email
+  body, a blob the command uploaded, a database backup, or a restored
+  encryption-key backup that makes shredded ciphertext readable again. Model the
+  erasure request as a flow that covers those destinations too — and decide,
+  with the product owner, what happens when a backup is restored (re-erase on
+  restore, or a fence that refuses to restore keys). Those are product and legal
+  decisions; this skill only insists they are made, not left implicit.
 - If a subject boundary cannot be made person-level without changing product
   behavior, stop and surface the trade-off before implementing.
 

package/package/corpus/skills/cratis-chronicle-event-constraints/SKILL.md

@@ -17,9 +17,11 @@ Constraints are discovered automatically. There is no registration call.
 
 | Package | Version | Purpose |
 | --- | --- | --- |
-| `Cratis.Chronicle` (client) | `16.45.2` | `[Unique]`, `[RemoveConstraint]`, `IConstraint`, `IConstraintBuilder`, `IUniqueConstraintBuilder`, `ConstraintViolation`, `IAppendResult` |
-| `Cratis.Chronicle` code analysis | `16.45.2` | `CHR0017`, `CHR0018`, `CHR0020` |
-| `Cratis.Chronicle.Testing` | `16.45.2` | `EventScenario` and the `IAppendResult` `Should*` assertions |
+| `Cratis.Chronicle` (client) | `18.3.0` | `[Unique]`, `[RemoveConstraint]`, `IConstraint`, `IConstraintBuilder`, `IUniqueConstraintBuilder`, `ConstraintViolation`, `IAppendResult` |
+| `Cratis.Chronicle` code analysis | `18.3.0` | `CHR0017`, `CHR0018`, `CHR0020` |
+| `Cratis.Chronicle.Testing` | `18.3.0` | `EventScenario` and the `IAppendResult` `Should*` assertions |
+
+> Re-verified at the versions above by **symbol and signature**: every type, attribute and member this skill names exists at that tag, and the public surface it describes is unchanged since the previous verification (Chronicle 16.45.x / Arc 22.10.4 — the Chronicle 16→18 client diff is converters, options and doc comments; no type was removed or renamed). Behavior claims were verified at the earlier tag unless a section says otherwise.
 
 Reverify against the Chronicle repository before claiming support for another
 version. Never translate an attribute argument order or an assertion name from
@@ -150,9 +152,14 @@ Note the asymmetry: `AppendResult` exposes a singular nullable
 `ConcurrencyViolations`. Only the `HasConcurrencyViolations` flag is on the
 interface.
 
-⚠️ A `[PII]` property's value is encrypted before the constraint index sees it,
-so the claimed value and the violation details hold the encrypted form.
-Uniqueness still works; a human reading the index will not see the plaintext.
+⚠️ Constraints are evaluated and indexed against the **plaintext** of a `[PII]`
+property, not its ciphertext — PII encryption is non-deterministic (a fresh key
+and nonce per value), so hashing the encrypted form would never detect a
+collision. The kernel builds a plaintext copy for the constraint check and
+persists only the encrypted event; on reindex it releases (decrypts) stored
+content to recompute the hashes, and skips subjects whose key has been erased so
+they do not all collide on the hash of an empty value. The index therefore holds
+plaintext-derived hashes, not the personal value itself.
 
 ## Step 6 — Specify the violation
 

package/package/corpus/skills/cratis-chronicle-event-modeling/SKILL.md

@@ -25,8 +25,8 @@ This skill is verified against these exact sources:
 
 | Package | Version | Purpose |
 | --- | --- | --- |
-| `Cratis.Chronicle` | `16.45.2` | event types, event-source identities, subjects, `[PII]` |
-| `Cratis.Chronicle.CodeAnalysis` | `16.45.2` | `CHR0012`, `CHR0026`, `CHR0034`, `CHR0035` |
+| `Cratis.Chronicle` | `18.3.0` | event types, event-source identities, subjects, `[PII]` |
+| `Cratis.Chronicle.CodeAnalysis` | `18.3.0` | `CHR0012`, `CHR0026`, `CHR0034`, `CHR0035` |
 
 Reverify product sources before claiming support for another version.
 

package/package/corpus/skills/cratis-chronicle-event-specifications/SKILL.md

@@ -14,8 +14,10 @@ application's constraints discovered and active.
 
 | Package | Version | Purpose |
 | --- | --- | --- |
-| `Cratis.Chronicle.Testing` | `16.45.2` | `EventScenario`, its `Given`/`When` builders, the `IAppendResult` `Should*` assertions |
-| `Cratis.Chronicle` | `16.45.2` | `IEventSequence.Append`/`AppendMany`, `IAppendResult`, `ConstraintViolation` |
+| `Cratis.Chronicle.Testing` | `18.3.0` | `EventScenario`, its `Given`/`When` builders, the `IAppendResult` `Should*` assertions |
+| `Cratis.Chronicle` | `18.3.0` | `IEventSequence.Append`/`AppendMany`, `IAppendResult`, `ConstraintViolation` |
+
+> Re-verified at the versions above by **symbol and signature**: every type, attribute and member this skill names exists at that tag, and the public surface it describes is unchanged since the previous verification (Chronicle 16.45.x / Arc 22.10.4 — the Chronicle 16→18 client diff is converters, options and doc comments; no type was removed or renamed). Behavior claims were verified at the earlier tag unless a section says otherwise.
 
 ```bash
 dotnet add package Cratis.Chronicle.Testing
@@ -43,9 +45,13 @@ version. Never translate an assertion name from memory.
 
 ## When you do not
 
-- **Concurrency violations cannot be provoked here.** `EventScenario` wires a
-  no-op concurrency-scope strategy, so `HasConcurrencyViolations` is never true
-  inside the scenario however the append is shaped. Specify concurrency against
+- **Concurrency violations are not what the scenario's defaults exercise.**
+  `EventScenario` wires a strategy that always answers `ConcurrencyScope.None`,
+  which the validator skips, so an append that lets the strategy pick the scope
+  (`When`, or `EventLog.Append` without a `concurrencyScope`) can never report
+  `HasConcurrencyViolations`. Only an append that passes an explicit scope on
+  `scenario.EventLog.Append(...)` reaches the in-process validator at all — and
+  that is a spec of the scope you hand-built, not of the application's strategy. Specify concurrency against
   the real kernel with an out-of-process integration specification, and do not
   write a scenario specification that looks like it covers it — it would pass
   vacuously, which is worse than not having one.

package/package/corpus/skills/cratis-chronicle-event-type-migration/SKILL.md

@@ -22,8 +22,8 @@ This skill is verified against these exact sources:
 
 | Package | Version | Purpose |
 | --- | --- | --- |
-| `Cratis.Chronicle` | `16.45.2` | `Cratis.Chronicle.Events` and `Cratis.Chronicle.Events.Migrations` |
-| `Cratis.Chronicle.CodeAnalysis` | `16.45.2` | `CHR0012`, `CHR0037`, `CHR0049`, `CHR0050` |
+| `Cratis.Chronicle` | `18.3.0` | `Cratis.Chronicle.Events` and `Cratis.Chronicle.Events.Migrations` |
+| `Cratis.Chronicle.CodeAnalysis` | `18.3.0` | `CHR0012`, `CHR0037`, `CHR0049`, `CHR0050` |
 
 Reverify product sources before claiming support for another version.
 

package/package/corpus/skills/cratis-chronicle-multi-tenancy/SKILL.md

@@ -23,8 +23,8 @@ This skill is verified against this exact source:
 
 | Package | Version | Purpose |
 | --- | --- | --- |
-| `Cratis.Chronicle` | `16.45.2` | `EventStoreNamespaceName`, `IEventStoreNamespaceResolver`, `IChronicleClient.GetEventStore` |
-| `Cratis.Chronicle.AspNetCore` | `16.45.2` | the header and subdomain namespace resolvers |
+| `Cratis.Chronicle` | `18.3.0` | `EventStoreNamespaceName`, `IEventStoreNamespaceResolver`, `IChronicleClient.GetEventStore` |
+| `Cratis.Chronicle.AspNetCore` | `18.3.0` | the header and subdomain namespace resolvers |
 
 Reverify product sources before claiming support for another version.
 

package/package/corpus/skills/cratis-chronicle-projection/SKILL.md

@@ -17,7 +17,7 @@ This skill is verified against this exact source:
 
 | Package | Version | Purpose |
 | --- | --- | --- |
-| `Cratis.Chronicle` | `16.45.2` | `Cratis.Chronicle.Projections`, `Cratis.Chronicle.Projections.ModelBound`, `Cratis.Chronicle.Keys`, `Cratis.Chronicle.EventSequences` |
+| `Cratis.Chronicle` | `18.3.0` | `Cratis.Chronicle.Projections`, `Cratis.Chronicle.Projections.ModelBound`, `Cratis.Chronicle.Keys`, `Cratis.Chronicle.EventSequences` |
 
 Reverify product sources before claiming support for another version.
 
@@ -90,6 +90,20 @@ a read model type is not supported and is not what the API means. If a read mode
 needs a field that only another read model has, the model is missing an event —
 fix the event model rather than cross-reading at runtime.
 
+### A joined property always wins — do not latch on it
+
+A projection re-resolves its joins every time it handles one of the read model's
+own events and applies the joined values **after** the local mappings, so a
+property written both by a `From`/`[SetFrom]` and by a `Join` ends up with the
+joined value regardless of the order the events arrived. A local write can
+therefore never reset or clear a joined property. The natural latch shape — a
+local event sets `IsBlocked = false`, a joined event sets it `true` — compiles,
+reads correctly and silently sticks on the joined value. Give each fact its own
+property (`BlockedAt`, `UnblockedAt`) and derive the outcome from both at the
+query edge. Chronicle's analyzer **`CHR0042` (`JoinOverridesLocalWrite`)** reports
+the overlap; suppress it only when the join is deliberately keeping that property
+fresh.
+
 ## Selecting the source
 
 Class-level `[EventSequence("<name>")]`, `[EventLog]`, or `[EventStore("<name>")]`
@@ -121,9 +135,14 @@ or a reactor rather than annotating the projection.
   `key:` on **both** a parent and a nested or child type for the **same** event
   throws a duplicate-key exception at startup. Keep `[FromEvent<T>]` on the
   nested type only, or switch the nested type to property-level `[SetFrom<T>]`.
-- **Duplicate `[SetFromContext<T>]`.** Two properties with
-  `[SetFromContext<SameEvent>]` on one read model crash at startup. Merge them,
-  or use `[FromEvery]`.
+- **Setting the same read-model property twice for one event.** The per-event
+  builder refuses a second `Set`/`Increment`/`Decrement`/`Add`/`Subtract` on a
+  property it already wrote for that event (`DuplicatePropertyInProjection`,
+  thrown while the projection is built at startup). Model-bound, that is two
+  attributes for the same `<TEvent>` on one property that both target it — for
+  example `[SetFrom<E>]` and `[Count<E>]` together. Several `[SetFromContext<E>]`
+  on one member is a different case: it is accepted and **all but the last are
+  discarded** — analyzer `CHR0040` reports it.
 - **Chaining after `AutoMap()`/`NoAutoMap()`.** Those two return the base builder
   interface, so `.NotRewindable()`, `.Passive()`, `.ContainerName()`, and
   `.FromEventSequence()` will not compile after them. Put them last.

package/package/corpus/skills/cratis-chronicle-projection/references/fluent-builder.md

@@ -1,6 +1,6 @@
 # The fluent projection builder
 
-Verified against `Cratis.Chronicle` `16.45.2`, namespace
+Verified against `Cratis.Chronicle` `18.3.0`, namespace
 `Cratis.Chronicle.Projections`.
 
 ## The interfaces

package/package/corpus/skills/cratis-chronicle-projection/references/model-bound-attributes.md

@@ -1,6 +1,6 @@
 # Model-bound projection attributes
 
-Verified against `Cratis.Chronicle` `16.45.2`.
+Verified against `Cratis.Chronicle` `18.3.0`.
 
 Unless noted, every attribute below lives in
 `Cratis.Chronicle.Projections.ModelBound`. Generic arity is stated exactly:
@@ -27,7 +27,7 @@ attribute takes no generic parameter at all.
 | --- | --- | --- | --- |
 | `[FromEvent<T>]` | `<T>` | `(string? key = default, string? parentKey = default)`, plus `ConstantKey { get; init; }` | class, struct; repeatable |
 | `[RemovedWith<T>]` | `<T>` | `(string? key = default, string? parentKey = default)` | class, struct, property, parameter; repeatable |
-| `[RemovedWithJoin<T>]` | `<T>` | `(string? key = default)` | property, parameter; repeatable |
+| `[RemovedWithJoin<T>]` | `<T>` | `(string? key = default)` | class, struct, property, parameter; repeatable |
 | `[Nested]` | non-generic | none | property, parameter; single |
 | `[FromAll]` | non-generic | `(string? contextProperty = default, string? property = default)` | **property only**; single |
 | `[FromEvery]` | non-generic | `(string? property = default, string? contextProperty = default)` | property, parameter; single |