@cratis/pi 2.22.0 → 2.23.1

package/package/corpus/skills/cratis-chronicle-client-elixir/SKILL.md

@@ -12,33 +12,37 @@ to yours, and everything after that is ordinary OTP.
 
 ## Verified product sources
 
-This skill is verified against `Cratis/Chronicle.Elixir` at tag **`v2.2.0`**,
-which is the version actually published on Hex.
+This skill was written against `Cratis/Chronicle.Elixir` at tag **`v2.2.0`** and
+re-verified at **`v3.1.0`** (published on Hex as `3.1.0`; `3.0.0` is the
+Chronicle 17/18 wire migration — gRPC request/response shapes, no public API
+removed). Every module, function and option this skill names exists at `v3.1.0`;
+the `file:line` citations below were taken at `v2.2.0` and may have shifted.
 
 | Fact | Value | Source |
 | --- | --- | --- |
 | OTP app / Hex package | `:cratis_chronicle` | `Source/chronicle/mix.exs:14` |
-| Published version | `2.2.0` | hex.pm |
-| Elixir requirement | `~> 1.14` | `Source/chronicle/mix.exs:16` |
-| Contracts dependency | `cratis_chronicle_contracts` resolved to `16.13.4` | `Source/chronicle/mix.lock` |
+| Published versions | `3.1.0`, `3.0.0`, `2.2.0`, `2.1.x`, `2.0.0`, `1.0.x`, `0.x` — **no `2.3.0`** | hex.pm |
+| Elixir requirement | `~> 1.14` | `Source/chronicle/mix.exs` |
+| Contracts dependency | `cratis_chronicle_contracts` resolved to `18.2.0` at `v3.1.0` (`16.13.4` at `v2.2.0`) | `Source/chronicle/mix.lock` |
 
 > **The `v2.3.0` git tag was never published to Hex.** `mix deps.get` cannot
-> fetch it. Anything introduced there — notably the `Chronicle.Concept` macro,
-> which does not exist at `v2.2.0` — must not be documented as available.
+> fetch it. What it introduced — notably the `Chronicle.Concept` macro
+> (`use Chronicle.Concept, type: :string`, a single-value concept that carries its
+> `pii` classification once, mirroring `ConceptAs<T>`) — **is published from
+> `3.0.0`**. On `2.2.0` it does not exist; on `3.x` it is the preferred way to
+> classify a personal value.
 
 > **The repository's `VERSION` file says `0.0.5` and is a build-time
 > placeholder** overwritten by the publish workflow. Never quote it.
 
-> **Do not copy from the repository's root `README.md`.** At `v2.2.0` it uses
-> module names that do not exist — `use Chronicle.EventType`,
-> `use Chronicle.ReadModel`, `use Chronicle.Reactor`, `use Chronicle.Reducer`,
-> `use Chronicle.Seeder` (`README.md:9-13`, `:49`, `:54`). The real modules are
-> namespaced: `Chronicle.Events.EventType`, `Chronicle.ReadModels.ReadModel`,
-> `Chronicle.Reactors.Reactor`, `Chronicle.Reducers.Reducer`,
-> `Chronicle.Seeding.Seeder`. **Copy from `Documentation/client-snippets/`
-> instead** — those are CI-validated and correct at every version.
+> **The real modules are namespaced** — `Chronicle.Events.EventType`,
+> `Chronicle.ReadModels.ReadModel`, `Chronicle.Reactors.Reactor`,
+> `Chronicle.Reducers.Reducer`, `Chronicle.Seeding.Seeder`. The `v2.2.0` root
+> `README.md` used unnamespaced names that do not exist (`use Chronicle.EventType`,
+> …); the `3.x` README is correct. When in doubt, copy from
+> `Documentation/client-snippets/` — those are CI-validated at every version.
 
-> `Documentation/get-started.md:12` pins `{:cratis_chronicle, "~> 0.1"}`, which
+> `Documentation/get-started.md:13` pins `{:cratis_chronicle, "~> 0.1"}`, which
 > does not match the published `2.2.0`. Use a `2.x` requirement.
 
 ## Adding it
@@ -211,7 +215,7 @@ the outcome.
 | `get_from_sequence_number/2` | | `:369` |
 | `get_tail_sequence_number/2` | | `:408` |
 
-Append options (`event_log.ex:79-94`): `:client`, `:namespace`,
+Append options (`event_log.ex:79-94`, plus `:occurred` read at `:720`): `:client`, `:namespace`,
 `:event_sequence_id` (default `"event-log"`), `:event_source_type` (default
 `"Default"`), `:event_stream_type` (default **`"All"`**), `:event_stream_id`
 (default `"Default"`), `:tags`, `:subject`, `:correlation_id`, `:identity`,
@@ -398,9 +402,9 @@ attempt.
 
 | Pitfall | Why it bites |
 | --- | --- |
-| Copying the root `README.md` | Its module names do not exist at `v2.2.0` |
-| Using `Chronicle.Concept` | It exists only in the unpublished `v2.3.0` tag |
-| `{:cratis_chronicle, "~> 0.1"}` from the docs | Does not match the published `2.2.0` |
+| Copying the `v2.2.0` root `README.md` | Its module names do not exist; the `3.x` README is correct |
+| Using `Chronicle.Concept` on `2.2.0` | It ships from `3.0.0`; on `2.2.0` annotate fields with `pii/1,2` instead |
+| Copying the dependency line from the README | It lags the published version; take the version from hex.pm |
 | Quoting the `VERSION` file | It is a `0.0.5` build-time placeholder |
 | Putting configuration in `config.exs` | The client reads no application env; options are child-spec keywords |
 | Omitting `:otp_app` | Discovery falls back to scanning every loaded module |

package/package/corpus/skills/cratis-chronicle-client-kotlin/SKILL.md

@@ -13,14 +13,20 @@ you construct a client, ask it for an event store, and append or observe.
 
 ## Verified product sources
 
-This skill is verified against this exact source:
+This skill was written against `Chronicle.Kotlin` at tag `v4.0.0` (commit
+`63ff629`) and re-verified at **`v5.1.0`**: every class, function, option and
+Spring bean this skill names exists there. The `4→5` major is the Chronicle 17/18
+wire migration (gRPC request/response shapes and `ensureSuccess` result
+envelopes — internal to the client); `5.0.0` also adds a `ChronicleCommandRejected`
+exception for a rejected server-side command. The `file:line` citations below
+were taken at `v4.0.0` and may have shifted.
 
 | Artifact | Version | Verified from |
 | --- | --- | --- |
-| `io.cratis:chronicle` | `4.0.0` | `Chronicle.Kotlin` at tag `v4.0.0` (commit `63ff629`) |
-| `io.cratis:chronicle-spring-boot-starter` | `4.0.0` | same tag, `Integrations/SpringBoot` |
-| `io.cratis:chronicle-testing` | `4.0.0` | same tag, `Testing` |
-| `io.cratis:chronicle-contracts` | `16.44.1` | `Source/build.gradle.kts:11` |
+| `io.cratis:chronicle` | `5.1.0` | `Chronicle.Kotlin` at tag `v5.1.0` |
+| `io.cratis:chronicle-spring-boot-starter` | `5.1.0` | same tag, `Integrations/SpringBoot` |
+| `io.cratis:chronicle-testing` | `5.1.0` | same tag, `Testing` |
+| `io.cratis:chronicle-contracts` | `18.2.0` | `Source/build.gradle.kts` (`chronicleContractsVersion`) |
 
 All three artifacts are published to Maven Central under `io.cratis`
 (`Source/build.gradle.kts:54`, `Testing/build.gradle.kts:32`,
@@ -35,9 +41,10 @@ All three artifacts are published to Maven Central under `io.cratis`
 > the checked-in source never carries the real number. Take it from Maven
 > Central.
 
-> **The client and the kernel version independently.** Client `4.0.0` is built
-> against `chronicle-contracts` `16.44.1`; the Chronicle server has since moved
-> to a `17.x` line. Confirm the client/server pair you intend to run is
+> **The client and the kernel version independently.** Client `5.1.0` is built
+> against `chronicle-contracts` `18.2.0` (the `4.x` line was built against
+> `16.44.1` and does not speak the 17/18 wire shapes); the Chronicle server is
+> on `18.x`. Confirm the client/server pair you intend to run is
 > supported before relying on it — do not infer compatibility from the fact that
 > both are "latest".
 
@@ -82,11 +89,11 @@ fun main() = runBlocking {
 | `fun evictEventStores()` | `:36` | drops the local cache, keeps the client |
 | `fun dispose()` | `:39` | `IChronicleClient : AutoCloseable`, `close()` delegates to it (`:41`) |
 
-**The client connects in its constructor.** `ChronicleClient.kt:13` is
+**The client connects in its constructor.** `ChronicleClient.kt:12` is
 `ChronicleConnection(options.connectionString).also { it.connect() }` — there is
 no separate `connect()` step to call, and constructing the client is the
 connecting act. Event stores are cached per `"$name/$namespace"`
-(`ChronicleClient.kt:22`), so repeated `getEventStore` calls return the same
+(`ChronicleClient.kt:21`), so repeated `getEventStore` calls return the same
 instance.
 
 The default namespace is the literal `"Default"` —
@@ -355,13 +362,15 @@ A model-bound projection puts the projection on the read model with `@FromEvent`
 (`projections/SetFrom.kt:22`); the full family also includes `SetValue`,
 `SetFromContext`, `AddFrom`, `SubtractFrom`, `Increment`, `Decrement`, `Count`,
 `Join`, `RemovedWith`, `RemovedWithJoin`, `ChildrenFrom`, `ClearWith`,
-`FromAll`, `FromEvery`, `Nested`, `NoAutoMap`, `NotRewindable`. The declarative
+`FromAll`, `FromEvery`, `FromEventSourceId`, `CountFromAll`, `IncrementFromAll`,
+`DecrementFromAll`, `Nested`, `NoAutoMap`, `NoAutoMapProperties`,
+`NotRewindable`. The declarative
 alternative is a class implementing `IProjectionFor<TReadModel>`.
 
 ## Discovery and registration
 
 `ClientArtifacts` scans the classpath with ClassGraph
-(`artifacts/ClientArtifacts.kt:44-48`), and `ClientArtifacts.default` is a
+(`artifacts/ClientArtifacts.kt:66-98`), and `ClientArtifacts.default` is a
 process-wide lazy singleton (`:156`). What it looks for (`:66-98`):
 
 | Kind | Rule |
@@ -377,6 +386,8 @@ process-wide lazy singleton (`:156`). What it looks for (`:66-98`):
 | seeders | implements `ICanSeedEvents` |
 | webhooks | implements `IWebhookDefiner` |
 | captures | implements `ICapture` |
+| reactor middlewares | implements `IReactorMiddleware` or `BlockingReactorMiddleware` |
+| reactor argument resolvers | implements `IReactorMethodArgumentResolver` or `BlockingReactorMethodArgumentResolver` |
 
 > The `FromEvent$Container` entry is not incidental: Kotlin's `@Repeatable`
 > replaces repeated annotations with a synthetic container, so a class carrying
@@ -464,7 +475,7 @@ In Spring Boot, Java injects the `Chronicle` bean instead — it already takes
 folds a reducer through the same handler-shape rules as production
 (`ReadModelScenario.kt:139-150`). Its scope is small — appends and reducer folds
 only; there is no in-process reactor, projection, or constraint scenario
-(`Testing/api/Testing.api` is 56 lines).
+(`Testing/api/Testing.api` is 57 lines).
 
 ## Common pitfalls
 
@@ -474,9 +485,9 @@ only; there is no in-process reactor, projection, or constraint scenario
 | Two `@EventType` classes sharing a simple name | The id defaults to the simple name, so they collide on the wire (`EventTypesService.kt:67`) |
 | Shipping the default connection string to production | `skipTlsValidation` defaults to **true**; certificate validation is off (`ChronicleConnectionString.kt:28`) |
 | Copying a version from the README or docs | Both are stale at `v4.0.0`; the real version comes from the release, not the source |
-| Expecting `getEventStore` to suspend | It does not — the client already connected in its constructor (`ChronicleClient.kt:13`) |
+| Expecting `getEventStore` to suspend | It does not — the client already connected in its constructor (`ChronicleClient.kt:12`) |
 | Expecting `awaitRegistration()` to mean "registered" | It completes in a `finally`, so it also returns after a failed pass (`ArtifactRegistrations.kt:47-57`) |
-| Expecting a registration failure to throw | Failures are printed to `System.err`, not raised (`EventStore.kt:236`) |
+| Expecting a registration failure to throw | Failures are printed to `System.err`, not raised (`EventStore.kt:244`) |
 | Expecting read model reactors to be discovered | `IReadModelReactor` is absent from the scan and from `IEventStore`; construct `ReadModelReactors(...)` yourself |
 | Leaving the default classpath scan on in a large app | Use `withArtifactsFrom(...)` or `artifact-packages` to narrow it (`ChronicleOptions.kt:58`) |
 | Expecting WebFlux support from the starter | The web auto-configuration is `SERVLET`-only (`ChronicleWebAutoConfiguration.kt:29`) |

package/package/corpus/skills/cratis-chronicle-client-typescript/SKILL.md

@@ -13,13 +13,17 @@ HTTP and never sees this package.
 
 ## Verified product sources
 
-This skill is verified against `Cratis/Chronicle.TypeScript` at tag `v4.0.0`
-(commit `bed0b86`), which is the version published on npm.
+This skill was written against `Cratis/Chronicle.TypeScript` at tag `v4.0.0`
+(commit `bed0b86`) and re-verified at **`v5.1.0`** (published on npm as
+`5.1.0`): every class, function and option this skill names exists there. The
+`4→5` major is the Chronicle 17/18 wire migration (internal gRPC shapes; it adds
+`ensureCommandResponse` for server-side command results). The `file:line`
+citations below were taken at `v4.0.0` and may have shifted.
 
 | Package | Version | Where |
 | --- | --- | --- |
-| `@cratis/chronicle` | `4.0.0` | `Source/package.json:2` |
-| `@cratis/chronicle.contracts` | `17.0.0` | `Source/package.json` dependency |
+| `@cratis/chronicle` | `5.1.0` | npm; `Source/package.json` carries a `1.0.0` placeholder |
+| `@cratis/chronicle.contracts` | `18.2.0` | `Source/package.json` dependency at `v5.1.0` |
 | `@cratis/fundamentals` | `^7.14.0` | **peer dependency** — you install it |
 
 > **Do not read the version out of the repository.** `Source/package.json` says
@@ -75,7 +79,7 @@ try {
 }
 ```
 
-`IChronicleClient` is three members — `Source/IChronicleClient.ts:16-39`:
+`IChronicleClient` is four members — `Source/IChronicleClient.ts:16-39`:
 
 | Member | Line |
 | --- | --- |
@@ -125,7 +129,7 @@ Two facts to carry into production guidance:
   is not validated, because a development kernel serves a self-signed
   certificate. Set `?skipTlsValidation=false` against a real server.
 - **A connection string with no credentials silently falls back to the
-  development client credentials** (`Source/connection/ChronicleConnection.ts`).
+  development client credentials** (`Source/connection/ChronicleConnection.ts:319-326`; the constants live in `ChronicleConnectionString.ts:453-454`).
   An anonymous-looking connection string is not anonymous; it is
   `chronicle-dev-client`.
 
@@ -208,13 +212,13 @@ if (!result.isSuccess) {
   `EventContext.sequenceNumber` is a `bigint` too.
 - `AppendOptions` — `Source/eventSequences/AppendOptions.ts`: `correlationId?`,
   `eventSourceId?`, `concurrencyScope?`, `concurrencyScopes?`, and **`tags?`**
-  (`:22-29`, new in `4.0.0`).
+  (`:22-29`, since `4.0.0`; unchanged at `5.1.0`).
 
 > **Single `append()` cannot target a stream or a subject.** It hardcodes
 > `EventSourceType: 'Default'`, `EventStreamType: 'Default'`,
 > `EventStreamId: eventSourceId`, and `Subject: eventSourceId`
-> (`Source/eventSequences/EventSequence.ts:100-119`). Only `tags` became a real
-> option in `4.0.0` (`:117`). To target a different stream or subject, use the
+> (`Source/eventSequences/EventSequence.ts:100-120`). Only `tags` became a real
+> option in `4.0.0` (`:118`). To target a different stream or subject, use the
 > `EventForEventSourceId[]` overload, whose entries carry `eventStreamType`,
 > `eventStreamId`, `eventSourceType`, `subject`, and `tags`.
 
@@ -252,7 +256,7 @@ Reducers do the same (`Source/reducers/Reducers.ts:454-460`). A handler whose
 method name does not match is simply never called — **there is no error**.
 
 > The docstring at `Source/reactors/reactor.ts:28-29` claims dispatch is by the
-> first parameter's type. **It is wrong**, and it is still wrong at `4.0.0`. The
+> first parameter's type. **It is wrong**, and it is still wrong at `5.1.0`. The
 > code is the authority; so are the client snippets under `Documentation/`, which
 > state the name rule explicitly.
 
@@ -281,7 +285,7 @@ a failed side-effect append fails the partition.
 
 `@reducer(id?, eventSequenceId?, readModel?, isActive?)` —
 `Source/reducers/reducer.ts:58`. Passing `readModel` also registers that type as a
-read model. **The reducer handler takes three arguments at `4.0.0`** —
+read model. **The reducer handler takes three arguments (`4.0.0` through `5.1.0`)** —
 `reducerInstance[methodName](content, currentState, context)`
 (`Source/reducers/Reducers.ts:400`). The third is optional by arity, and a handler
 may be sync or async.

package/package/corpus/skills/cratis-chronicle-compliance/SKILL.md

@@ -17,8 +17,8 @@ This skill is verified against this exact public release:
 
 | Package | Version | Purpose |
 | --- | --- | --- |
-| `Cratis.Chronicle` | `16.45.3` | `Cratis.Chronicle.Compliance.GDPR`, `Cratis.Chronicle.SubjectAttribute`, `IEventSequence.Redact`, `IReadModels.Release` |
-| `Cratis.Chronicle.CodeAnalysis` | `16.45.3` | `CHR0026`, `CHR0034`, `CHR0035`, `CHR0043`, `CHR0046` |
+| `Cratis.Chronicle` | `18.3.0` | `Cratis.Chronicle.Compliance.GDPR`, `Cratis.Chronicle.SubjectAttribute`, `IEventSequence.Redact`, `IReadModels.Release` |
+| `Cratis.Chronicle.CodeAnalysis` | `18.3.0` | `CHR0026`, `CHR0034`, `CHR0035`, `CHR0043`, `CHR0046` |
 
 Reverify product sources before claiming support for another version.
 
@@ -224,7 +224,18 @@ storage, configured under `Cratis:Chronicle:Compliance:Encryption`.
   noise: which person owns the resulting document?
 - Bearer tokens, magic links, and signed URLs are secrets, not durable facts.
   Store a keyed hash or an opaque reference. Chronicle has no attribute that
-  withholds a secret from the log.
+  withholds a secret from the log (Arc's `[NotAudited]` keeps a *command
+  property* out of the causation chain — see **cratis-arc-command** — but a
+  secret placed in an event payload is in the log for good).
+- **Erasure is wider than the event log.** Crypto-shredding removes readability
+  of `[PII]` values in events and read models. It does nothing for a copy that
+  left Chronicle: an exported CSV, a generated PDF, a search index, an email
+  body, a blob the command uploaded, a database backup, or a restored
+  encryption-key backup that makes shredded ciphertext readable again. Model the
+  erasure request as a flow that covers those destinations too — and decide,
+  with the product owner, what happens when a backup is restored (re-erase on
+  restore, or a fence that refuses to restore keys). Those are product and legal
+  decisions; this skill only insists they are made, not left implicit.
 - If a subject boundary cannot be made person-level without changing product
   behavior, stop and surface the trade-off before implementing.
 

package/package/corpus/skills/cratis-chronicle-event-constraints/SKILL.md

@@ -17,9 +17,11 @@ Constraints are discovered automatically. There is no registration call.
 
 | Package | Version | Purpose |
 | --- | --- | --- |
-| `Cratis.Chronicle` (client) | `16.45.2` | `[Unique]`, `[RemoveConstraint]`, `IConstraint`, `IConstraintBuilder`, `IUniqueConstraintBuilder`, `ConstraintViolation`, `IAppendResult` |
-| `Cratis.Chronicle` code analysis | `16.45.2` | `CHR0017`, `CHR0018`, `CHR0020` |
-| `Cratis.Chronicle.Testing` | `16.45.2` | `EventScenario` and the `IAppendResult` `Should*` assertions |
+| `Cratis.Chronicle` (client) | `18.3.0` | `[Unique]`, `[RemoveConstraint]`, `IConstraint`, `IConstraintBuilder`, `IUniqueConstraintBuilder`, `ConstraintViolation`, `IAppendResult` |
+| `Cratis.Chronicle` code analysis | `18.3.0` | `CHR0017`, `CHR0018`, `CHR0020` |
+| `Cratis.Chronicle.Testing` | `18.3.0` | `EventScenario` and the `IAppendResult` `Should*` assertions |
+
+> Re-verified at the versions above by **symbol and signature**: every type, attribute and member this skill names exists at that tag, and the public surface it describes is unchanged since the previous verification (Chronicle 16.45.x / Arc 22.10.4 — the Chronicle 16→18 client diff is converters, options and doc comments; no type was removed or renamed). Behavior claims were verified at the earlier tag unless a section says otherwise.
 
 Reverify against the Chronicle repository before claiming support for another
 version. Never translate an attribute argument order or an assertion name from
@@ -150,9 +152,14 @@ Note the asymmetry: `AppendResult` exposes a singular nullable
 `ConcurrencyViolations`. Only the `HasConcurrencyViolations` flag is on the
 interface.
 
-⚠️ A `[PII]` property's value is encrypted before the constraint index sees it,
-so the claimed value and the violation details hold the encrypted form.
-Uniqueness still works; a human reading the index will not see the plaintext.
+⚠️ Constraints are evaluated and indexed against the **plaintext** of a `[PII]`
+property, not its ciphertext — PII encryption is non-deterministic (a fresh key
+and nonce per value), so hashing the encrypted form would never detect a
+collision. The kernel builds a plaintext copy for the constraint check and
+persists only the encrypted event; on reindex it releases (decrypts) stored
+content to recompute the hashes, and skips subjects whose key has been erased so
+they do not all collide on the hash of an empty value. The index therefore holds
+plaintext-derived hashes, not the personal value itself.
 
 ## Step 6 — Specify the violation
 

package/package/corpus/skills/cratis-chronicle-event-modeling/SKILL.md

@@ -25,8 +25,8 @@ This skill is verified against these exact sources:
 
 | Package | Version | Purpose |
 | --- | --- | --- |
-| `Cratis.Chronicle` | `16.45.2` | event types, event-source identities, subjects, `[PII]` |
-| `Cratis.Chronicle.CodeAnalysis` | `16.45.2` | `CHR0012`, `CHR0026`, `CHR0034`, `CHR0035` |
+| `Cratis.Chronicle` | `18.3.0` | event types, event-source identities, subjects, `[PII]` |
+| `Cratis.Chronicle.CodeAnalysis` | `18.3.0` | `CHR0012`, `CHR0026`, `CHR0034`, `CHR0035` |
 
 Reverify product sources before claiming support for another version.
 

package/package/corpus/skills/cratis-chronicle-event-specifications/SKILL.md

@@ -14,8 +14,10 @@ application's constraints discovered and active.
 
 | Package | Version | Purpose |
 | --- | --- | --- |
-| `Cratis.Chronicle.Testing` | `16.45.2` | `EventScenario`, its `Given`/`When` builders, the `IAppendResult` `Should*` assertions |
-| `Cratis.Chronicle` | `16.45.2` | `IEventSequence.Append`/`AppendMany`, `IAppendResult`, `ConstraintViolation` |
+| `Cratis.Chronicle.Testing` | `18.3.0` | `EventScenario`, its `Given`/`When` builders, the `IAppendResult` `Should*` assertions |
+| `Cratis.Chronicle` | `18.3.0` | `IEventSequence.Append`/`AppendMany`, `IAppendResult`, `ConstraintViolation` |
+
+> Re-verified at the versions above by **symbol and signature**: every type, attribute and member this skill names exists at that tag, and the public surface it describes is unchanged since the previous verification (Chronicle 16.45.x / Arc 22.10.4 — the Chronicle 16→18 client diff is converters, options and doc comments; no type was removed or renamed). Behavior claims were verified at the earlier tag unless a section says otherwise.
 
 ```bash
 dotnet add package Cratis.Chronicle.Testing
@@ -43,9 +45,13 @@ version. Never translate an assertion name from memory.
 
 ## When you do not
 
-- **Concurrency violations cannot be provoked here.** `EventScenario` wires a
-  no-op concurrency-scope strategy, so `HasConcurrencyViolations` is never true
-  inside the scenario however the append is shaped. Specify concurrency against
+- **Concurrency violations are not what the scenario's defaults exercise.**
+  `EventScenario` wires a strategy that always answers `ConcurrencyScope.None`,
+  which the validator skips, so an append that lets the strategy pick the scope
+  (`When`, or `EventLog.Append` without a `concurrencyScope`) can never report
+  `HasConcurrencyViolations`. Only an append that passes an explicit scope on
+  `scenario.EventLog.Append(...)` reaches the in-process validator at all — and
+  that is a spec of the scope you hand-built, not of the application's strategy. Specify concurrency against
   the real kernel with an out-of-process integration specification, and do not
   write a scenario specification that looks like it covers it — it would pass
   vacuously, which is worse than not having one.

package/package/corpus/skills/cratis-chronicle-event-type-migration/SKILL.md

@@ -22,8 +22,8 @@ This skill is verified against these exact sources:
 
 | Package | Version | Purpose |
 | --- | --- | --- |
-| `Cratis.Chronicle` | `16.45.2` | `Cratis.Chronicle.Events` and `Cratis.Chronicle.Events.Migrations` |
-| `Cratis.Chronicle.CodeAnalysis` | `16.45.2` | `CHR0012`, `CHR0037`, `CHR0049`, `CHR0050` |
+| `Cratis.Chronicle` | `18.3.0` | `Cratis.Chronicle.Events` and `Cratis.Chronicle.Events.Migrations` |
+| `Cratis.Chronicle.CodeAnalysis` | `18.3.0` | `CHR0012`, `CHR0037`, `CHR0049`, `CHR0050` |
 
 Reverify product sources before claiming support for another version.
 

package/package/corpus/skills/cratis-chronicle-multi-tenancy/SKILL.md

@@ -23,8 +23,8 @@ This skill is verified against this exact source:
 
 | Package | Version | Purpose |
 | --- | --- | --- |
-| `Cratis.Chronicle` | `16.45.2` | `EventStoreNamespaceName`, `IEventStoreNamespaceResolver`, `IChronicleClient.GetEventStore` |
-| `Cratis.Chronicle.AspNetCore` | `16.45.2` | the header and subdomain namespace resolvers |
+| `Cratis.Chronicle` | `18.3.0` | `EventStoreNamespaceName`, `IEventStoreNamespaceResolver`, `IChronicleClient.GetEventStore` |
+| `Cratis.Chronicle.AspNetCore` | `18.3.0` | the header and subdomain namespace resolvers |
 
 Reverify product sources before claiming support for another version.
 

package/package/corpus/skills/cratis-chronicle-projection/SKILL.md

@@ -17,7 +17,7 @@ This skill is verified against this exact source:
 
 | Package | Version | Purpose |
 | --- | --- | --- |
-| `Cratis.Chronicle` | `16.45.2` | `Cratis.Chronicle.Projections`, `Cratis.Chronicle.Projections.ModelBound`, `Cratis.Chronicle.Keys`, `Cratis.Chronicle.EventSequences` |
+| `Cratis.Chronicle` | `18.3.0` | `Cratis.Chronicle.Projections`, `Cratis.Chronicle.Projections.ModelBound`, `Cratis.Chronicle.Keys`, `Cratis.Chronicle.EventSequences` |
 
 Reverify product sources before claiming support for another version.
 
@@ -90,6 +90,20 @@ a read model type is not supported and is not what the API means. If a read mode
 needs a field that only another read model has, the model is missing an event —
 fix the event model rather than cross-reading at runtime.
 
+### A joined property always wins — do not latch on it
+
+A projection re-resolves its joins every time it handles one of the read model's
+own events and applies the joined values **after** the local mappings, so a
+property written both by a `From`/`[SetFrom]` and by a `Join` ends up with the
+joined value regardless of the order the events arrived. A local write can
+therefore never reset or clear a joined property. The natural latch shape — a
+local event sets `IsBlocked = false`, a joined event sets it `true` — compiles,
+reads correctly and silently sticks on the joined value. Give each fact its own
+property (`BlockedAt`, `UnblockedAt`) and derive the outcome from both at the
+query edge. Chronicle's analyzer **`CHR0042` (`JoinOverridesLocalWrite`)** reports
+the overlap; suppress it only when the join is deliberately keeping that property
+fresh.
+
 ## Selecting the source
 
 Class-level `[EventSequence("<name>")]`, `[EventLog]`, or `[EventStore("<name>")]`
@@ -121,9 +135,14 @@ or a reactor rather than annotating the projection.
   `key:` on **both** a parent and a nested or child type for the **same** event
   throws a duplicate-key exception at startup. Keep `[FromEvent<T>]` on the
   nested type only, or switch the nested type to property-level `[SetFrom<T>]`.
-- **Duplicate `[SetFromContext<T>]`.** Two properties with
-  `[SetFromContext<SameEvent>]` on one read model crash at startup. Merge them,
-  or use `[FromEvery]`.
+- **Setting the same read-model property twice for one event.** The per-event
+  builder refuses a second `Set`/`Increment`/`Decrement`/`Add`/`Subtract` on a
+  property it already wrote for that event (`DuplicatePropertyInProjection`,
+  thrown while the projection is built at startup). Model-bound, that is two
+  attributes for the same `<TEvent>` on one property that both target it — for
+  example `[SetFrom<E>]` and `[Count<E>]` together. Several `[SetFromContext<E>]`
+  on one member is a different case: it is accepted and **all but the last are
+  discarded** — analyzer `CHR0040` reports it.
 - **Chaining after `AutoMap()`/`NoAutoMap()`.** Those two return the base builder
   interface, so `.NotRewindable()`, `.Passive()`, `.ContainerName()`, and
   `.FromEventSequence()` will not compile after them. Put them last.

package/package/corpus/skills/cratis-chronicle-projection/references/fluent-builder.md

@@ -1,6 +1,6 @@
 # The fluent projection builder
 
-Verified against `Cratis.Chronicle` `16.45.2`, namespace
+Verified against `Cratis.Chronicle` `18.3.0`, namespace
 `Cratis.Chronicle.Projections`.
 
 ## The interfaces

package/package/corpus/skills/cratis-chronicle-projection/references/model-bound-attributes.md

@@ -1,6 +1,6 @@
 # Model-bound projection attributes
 
-Verified against `Cratis.Chronicle` `16.45.2`.
+Verified against `Cratis.Chronicle` `18.3.0`.
 
 Unless noted, every attribute below lives in
 `Cratis.Chronicle.Projections.ModelBound`. Generic arity is stated exactly:
@@ -27,7 +27,7 @@ attribute takes no generic parameter at all.
 | --- | --- | --- | --- |
 | `[FromEvent<T>]` | `<T>` | `(string? key = default, string? parentKey = default)`, plus `ConstantKey { get; init; }` | class, struct; repeatable |
 | `[RemovedWith<T>]` | `<T>` | `(string? key = default, string? parentKey = default)` | class, struct, property, parameter; repeatable |
-| `[RemovedWithJoin<T>]` | `<T>` | `(string? key = default)` | property, parameter; repeatable |
+| `[RemovedWithJoin<T>]` | `<T>` | `(string? key = default)` | class, struct, property, parameter; repeatable |
 | `[Nested]` | non-generic | none | property, parameter; single |
 | `[FromAll]` | non-generic | `(string? contextProperty = default, string? property = default)` | **property only**; single |
 | `[FromEvery]` | non-generic | `(string? property = default, string? contextProperty = default)` | property, parameter; single |

package/package/corpus/skills/cratis-chronicle-reactor/SKILL.md

@@ -24,8 +24,8 @@ This skill is verified against these exact sources:
 
 | Package | Version | Purpose |
 | --- | --- | --- |
-| `Cratis.Chronicle` | `16.45.2` | `Cratis.Chronicle.Reactors`, `Cratis.Chronicle.Reactors.SideEffects`, `Cratis.Chronicle.EventSequences`, `Cratis.Chronicle.Events` |
-| `Cratis.Chronicle.CodeAnalysis` | `16.45.2` | `CHR0004`, `CHR0005`, `CHR0008`, `CHR0013`, `CHR0022`, `CHR0031`, `CHR0032` |
+| `Cratis.Chronicle` | `18.3.0` | `Cratis.Chronicle.Reactors`, `Cratis.Chronicle.Reactors.SideEffects`, `Cratis.Chronicle.EventSequences`, `Cratis.Chronicle.Events` |
+| `Cratis.Chronicle.CodeAnalysis` | `18.3.0` | `CHR0004`, `CHR0005`, `CHR0008`, `CHR0013`, `CHR0022`, `CHR0031`, `CHR0032` |
 
 Reverify product sources before claiming support for another version.
 
@@ -280,19 +280,33 @@ selection, a reactor or a reducer is where it happens.
 ## Translation via a command
 
 A translation that adapts one area's events into another's intent runs a command
-rather than appending directly. `ICommandPipeline` is an **Arc** type
-(`Cratis.Arc.Commands`), not a Chronicle one:
+rather than appending directly. With the Arc Chronicle integration the handler
+**returns** the command — the same shape as returning an event — and Arc executes
+it through validation and authorization; a denied, invalid or throwing result is a
+side-effect failure that fails the partition rather than being dropped:
 
 ```csharp
-using Cratis.Arc.Commands;
+using Cratis.Arc.Chronicle.Reactors;
 
-public class <ReactorName>(ICommandPipeline commandPipeline) : IReactor
+[ExecuteCommandsAsSystem("<role the command requires>")]   // only when the command is [Roles]/[Authorize]-gated
+public class <ReactorName> : IReactor
 {
-    public async Task <MethodName>(<EventName> @event, EventContext context) =>
-        await commandPipeline.Execute(new <CommandName>(@event.<Property>));
+    [OnceOnly]
+    public Task<<CommandName>> <MethodName>(<EventName> @event, EventContext context) =>
+        Task.FromResult(new <CommandName>(@event.<Property>));
 }
 ```
 
+A reactor runs with **no principal**; `[ExecuteCommandsAsSystem]` (class-level,
+`Cratis.Arc.Chronicle.Reactors`) supplies one for the **returned** commands only.
+A collection return is executed as commands when every element is a command.
+
+The imperative form — inject `ICommandPipeline` (`Cratis.Arc.Commands`) and call
+`Execute(command)` — is still supported and is the subject of the
+**cratis-arc-command-execution** skill. It needs `[OnceOnly]` as well (`ARCCHR0006`
+warns), the `CommandResult` must be inspected, and `[ExecuteCommandsAsSystem]`
+does not cover it.
+
 ## Failure behavior
 
 If a handler throws, or a returned side-effect event fails to append — a

package/package/corpus/skills/cratis-chronicle-read-model/SKILL.md

@@ -23,7 +23,7 @@ This skill is verified against these exact sources:
 
 | Package | Version | Purpose |
 | --- | --- | --- |
-| `Cratis.Chronicle` | `16.45.2` | `Cratis.Chronicle.Events`, `Cratis.Chronicle.Keys`, `Cratis.Chronicle.ReadModels` |
+| `Cratis.Chronicle` | `18.3.0` | `Cratis.Chronicle.Events`, `Cratis.Chronicle.Keys`, `Cratis.Chronicle.ReadModels` |
 | `Cratis.Arc.Core` | current | `Cratis.Arc.Queries.ModelBound.ReadModelAttribute` and `PathAttribute` |
 | `Cratis.Arc.MongoDB` | current | the `Observe` family of `IMongoCollection<T>` extensions |
 

package/package/corpus/skills/cratis-chronicle-read-model/references/queries.md

@@ -1,7 +1,7 @@
 # Read-model queries
 
 Verified against `Cratis.Arc.Core` and `Cratis.Arc.MongoDB` as checked out
-alongside `Cratis.Chronicle` `16.45.2`. Confirm the exact Arc package version in
+alongside `Cratis.Chronicle` `18.3.0`. Confirm the exact Arc package version in
 the consuming project before citing one.
 
 ## Where the pieces live

package/package/corpus/skills/cratis-chronicle-read-model-specifications/SKILL.md

@@ -17,9 +17,11 @@ separate `When`: seeding the events is what makes the projection run.
 
 | Package | Version | Purpose |
 | --- | --- | --- |
-| `Cratis.Chronicle.Testing` | `16.45.2` | `ReadModelScenario<TReadModel>` and its `Given` builder |
+| `Cratis.Chronicle.Testing` | `18.3.0` | `ReadModelScenario<TReadModel>` and its `Given` builder |
 | `Cratis.Specifications.XUnit` | `4.x` | The `Specification` base and the `ShouldXxx` assertions |
 
+> Re-verified at the versions above by **symbol and signature**: every type, attribute and member this skill names exists at that tag, and the public surface it describes is unchanged since the previous verification (Chronicle 16.45.x / Arc 22.10.4 — the Chronicle 16→18 client diff is converters, options and doc comments; no type was removed or renamed). Behavior claims were verified at the earlier tag unless a section says otherwise.
+
 ```bash
 dotnet add package Cratis.Chronicle.Testing
 ```

package/package/corpus/skills/cratis-chronicle-reducer/SKILL.md

@@ -17,7 +17,7 @@ This skill is verified against this exact source:
 
 | Package | Version | Purpose |
 | --- | --- | --- |
-| `Cratis.Chronicle` | `16.45.2` | `Cratis.Chronicle.Reducers`, `Cratis.Chronicle.ReadModels`, `Cratis.Chronicle.Events` |
+| `Cratis.Chronicle` | `18.3.0` | `Cratis.Chronicle.Reducers`, `Cratis.Chronicle.ReadModels`, `Cratis.Chronicle.Events` |
 
 Reverify product sources before claiming support for another version.