@cratis/pi 7.112.0 → 7.114.0

package/package/corpus/harnesses/copilot/instructions/application-profile.instructions.md

@@ -67,7 +67,7 @@ Tagged **[contract]** (framework-enforced) or **[convention]** (house default).
 
 ## Implementation Workflow
 
-- **Starting a brand-new application:** scaffold it instead of hand-writing the skeleton: `dotnet new install Cratis.Templates`, then `dotnet new cratis -n MyApp -o MyApp` (`--language Kotlin|Java`, `--Database MongoDB|PostgreSQL|MsSql|SQLite`; `cratis-aspire` for Aspire; `cratis-chronicle-console` or `cratis-chronicle-web` for a Chronicle client only). Non-interactive runs need `--allow-scripts yes`; the .NET templates target `net10.0`. The template writes `.cratis/ai.json`; run `cratis ai update` afterwards. Its `SomeModule/SomeFeature/Registration/` slice is the house shape. There is no Go, Python or Elixir template (verified at Cratis.Templates `v1.7.4`).
+- **Starting a brand-new application:** scaffold it instead of hand-writing the skeleton: `dotnet new install Cratis.Templates`, then `dotnet new cratis -n MyApp -o MyApp` (`--language Kotlin|Java`, `--Database MongoDB|PostgreSQL|MsSql|SQLite`; `cratis-aspire` for Aspire; `cratis-chronicle-console` or `cratis-chronicle-web` for a Chronicle client only). Non-interactive runs need `--allow-scripts yes`; the .NET templates target `net10.0`. The template writes `.cratis/ai.json`; run `cratis ai update` afterwards. Its `SomeModule/SomeFeature/Registration/` slice is the house shape. There is no Go, Python or Elixir template (verified at Cratis.Templates `v1.8.1`). Since 1.8.0 the `cratis` and `cratis-aspire` .NET app projects emit `<CratisReadProtection>On</CratisReadProtection>`: read models supplied to commands and validators guard the append. Existing apps are not changed by reinstalling the templates.
 - **Phase 0 — Find the contract / choose the level.** Before writing slice code, find what the code must match, and choose the level once for the whole scope.
   1. **Look for a Screenplay model** under the model root (opted in per `general.md` "Model first"; where `cratis-screenplay-modeling-lifecycle` is installed, run its `scripts/model-first-status.mjs` for the decision, root and drafts) for the slice, command, event and read-model names.
   2. **Model level** — an accepted model under the root covers the scope, or the repository is opted in and this scope has no model yet. The `.play` slice and its specs are the contract: change the model first (new behavior starts in discovery), verify it (V1–V3), get an independent review, then render with Stage or gap-fill by hand only what the renderer rejects. Hand-written code stays checked against the model (**cratis-application-slice-conformance**). Never edit Stage-managed output, never implement behavior the model does not state, never change the model to match existing code, never weaken protection to make it compile or render. Start with **cratis-screenplay-event-modeling** (decision rule), then **cratis-screenplay-modeling-lifecycle**. If the Screenplay skills are not installed, say so; do not author `.play` from memory.

package/package/corpus/harnesses/copilot/instructions/orleans.instructions.md

@@ -11,7 +11,7 @@ paths:
 > **⚠️ APPLIES ONLY TO PROJECTS USING MICROSOFT ORLEANS**
 > If your project does not reference `Microsoft.Orleans` or any Orleans packages, **ignore this entire file**. These rules are irrelevant outside of Orleans contexts.
 
-In the Cratis organization, Orleans is the Chronicle kernel's actor runtime (`Source/Kernel/`). The kernel conventions below are verified against `Cratis/Chronicle` **v19.50.0**. Shared hosting and jobs come from `Cratis/Orleans` **v1.16.3**; use its setup for other services that co-host a silo.
+In the Cratis organization, Orleans is the Chronicle kernel's actor runtime (`Source/Kernel/`). The kernel conventions below are verified against `Cratis/Chronicle` **v19.50.0**. Shared hosting and jobs come from `Cratis/Orleans` **v1.30.0**; use its setup for other services that co-host a silo.
 
 ## General
 
@@ -50,7 +50,7 @@ framework/service guidance; they do not impose application slice architecture.
 
 For service authors, `Cratis.Orleans` supplies hosting, grain serializers, and the
 shared job system without requiring Chronicle. With `Cratis.Orleans` and
-`Cratis.Orleans.Storage.MongoDB` 1.16.3, this host uses durable MongoDB membership
+`Cratis.Orleans.Storage.MongoDB` 1.30.0, this host uses durable MongoDB membership
 and jobs storage (a local MongoDB server is required):
 
 ```csharp
@@ -81,6 +81,14 @@ app.Run();
 - Register jobs storage separately: `AddCratisOrleansMongoDBJobsStorage`,
   `AddCratisOrleansSqlJobsStorage` (`Cratis.Orleans.Setup`), or
   `AddCratisOrleansInMemoryJobsStorage` (`Cratis.Orleans.Storage`).
+- Use the local `IJobs` service to start/stop/delete typed jobs during rolling
+  upgrades; generic manager calls can land on a release that does not know the
+  type. Provide singleton `IJobsManagerKeys` on every silo for all host-owned
+  scope/namespace pairs; process-local discovery is not a recovery catalog.
+- Controller and worker placement are separate opt-ins through `AddJobPlacement`
+  and `AddJobStepPlacement`. Enable them only after every silo supports the
+  strategies and register them identically. Worker throttling is not admission;
+  see **cratis-orleans-jobs** for drain-before-replacement and metadata limits.
 - Give grain implementations a unique `[GrainType("unique-name")]`. Orleans'
   default type name derives from the class name alone; a collision across
   assemblies prevents silo startup.

package/package/corpus/harnesses/copilot/instructions/pull-requests.instructions.md

@@ -155,6 +155,13 @@ The test is **outward-facing effect, not file location**. A change under `Source
 
 A non-release pull request must satisfy the relevant required checks like any other. Confirm label acceptance and publication suppression against the current workflow contract; do not assume external CI or API state.
 
+### Release-action windows and workflow drift
+
+Batching is opt-in; success with `batched` or `nothing-pending` is not publication.
+Read **cratis-release-notes** before configuring windows, handling a pending-major
+hotfix, or recovering a workflow-drift 403. Major confirmation remains required;
+a workflow-drift recovery differs from the concurrent-tag retry above.
+
 ### Group small related changes into one pull request
 
 Do not open a pull request per task when the tasks belong to the same body of work. Several small merged PRs become several releases, and a stream of near-empty patch releases makes the release history useless for the people it is written for. Collect related work — a set of CI gates, a group of fixes in one area, the steps of one refactor — onto **one branch, as separate commits**, and open **one** pull request. Commits stay one-logical-unit-each; the pull request is the release boundary, and the release boundary should be a coherent, describable change. Joining an open candidate, folding superseded PRs and the cut are in `cratis-engineering-release-trains`.

package/package/corpus/harnesses/copilot/instructions/specs.csharp.instructions.md

@@ -46,13 +46,13 @@ public class when_combining_parts : Specification
 | `void Establish()` | setup, before `Because()` | each class in the chain has its own, run base-first — never call `base.Establish()` |
 | `void Because()` | the single action under test | only in concrete spec files, never in a reusable context |
 | `[Fact] void should_*()` | one assertion per fact | use the `ShouldXxx()` extension methods |
-| `void Destroy()` | teardown after each fact by default | once per eligible class with shared lifecycle opt-in |
+| `void Destroy()` | teardown once per eligible class by default | after each fact when per-fact lifecycle is selected |
 
-The shared lifecycle is the default on xUnit v2 and v3 since 5.0; the package registers the framework, so delete any hand-written `[assembly: Xunit.TestFramework(...)]` (it fails with `CS0579`). Eligible classes derive from `Specification`, have one public parameterless constructor and contain only plain facts. Construction, Establish/Because and Destroy run once; all facts share the instance and must not mutate it. `IDisposable` specifications also share the lifecycle since Cratis.Specifications 4.4.0: one construction and one `Dispose` after the last fact. Initialization failure fails every fact. Theories and `ITestOutputHelper` constructors keep per-fact execution; `[PerFactSpecificationLifecycle]` opts a class out. `CRSPEC0008` (a fact modifies the shared context) is an error by default: move the change into `Establish` or `Because`. See the **cratis-specifications-csharp** skill's shared-lifecycle reference.
+The shared lifecycle is the default on xUnit v2 and v3 since 5.0; the package registers the framework, so delete any hand-written `[assembly: Xunit.TestFramework(...)]` (it fails with `CS0579`). Eligible classes derive from `Specification`, have one public constructor with no arguments or only framework-managed fixture arguments, and contain only plain facts. Construction, Establish/Because and Destroy run once; all facts share the instance and must not mutate it. `IDisposable` specifications also share the lifecycle since Cratis.Specifications 4.4.0: one construction and one `Dispose` after the last fact. Initialization failure fails every fact. Theories and `ITestOutputHelper` constructors keep per-fact execution; `[PerFactSpecificationLifecycle]` opts a class out. `CRSPEC0008` (a fact modifies the shared context) is an error by default: move the change into `Establish` or `Because`. See the **cratis-specifications-csharp** skill's shared-lifecycle reference.
 
 Run specifications as the built executable, not `dotnet test`: restore and build once, then run `bin/<Config>/net10.0/<Project>.Specs`. In a solution that mixes Microsoft.Testing.Platform and VSTest projects, run each project on its own; `dotnet test` on the whole solution does not work there. Filters and the 4.x → 5.0 checklist are in the **cratis-specifications-csharp** skill's [running-specs reference](../../../skills/cratis-specifications-csharp/references/running-specs.md).
 
-CRSPEC0001–CRSPEC0007 are warnings bundled in `.Specifications`, `.XUnit`, `.XUnit.v3`, and `.NUnit`. With warnings as errors, a non-`should_` fact, multiple specs per file (given contexts exempt), a fact on a given context, a `should_` without a test attribute, explicit base lifecycle calls, non-public specs with facts, or `Because` on a given context fail the build. Follow **cratis-specification-by-example**; do not suppress these diagnostics.
+CRSPEC0001–CRSPEC0007 are warnings. Since 4.5 the analyzers ship only in `Cratis.Specifications`, transitively used by the framework packages; excluding analyzers on a framework package does not remove them. Derived xUnit/NUnit test attributes are recognized since 4.1.2. `Given`/`When` are aliases since 4.4 (declaring both aliases for one phase is CRSPEC0009), but house style stays `Establish`/`Because`. With warnings as errors, a non-`should_` fact, multiple specs per file (given contexts exempt), a fact on a given context, a `should_` without a test attribute, explicit base lifecycle calls, non-public specs with facts, or `Because` on a given context fail the build. Follow **cratis-specification-by-example**; do not suppress these diagnostics.
 
 ## Reusable layered contexts
 
@@ -95,7 +95,7 @@ async Task Because() => _error = await Catch.Exception(_sut.DoSomething);
 
 ## Assertion extension methods
 
-From the `Cratis.Specifications.XUnit` package (namespace `Cratis.Specifications`): `.ShouldEqual(expected)`, `.ShouldBeTrue()`, `.ShouldBeFalse()`, `.ShouldBeNull()`, `.ShouldNotBeNull()`, `.ShouldBeEmpty()`, `.ShouldNotBeEmpty()`, `.ShouldContain(item)`, `.ShouldNotContain(item)`, `.ShouldContainOnly(items)`, `.ShouldBeOfExactType<T>()`, `.ShouldBeGreaterThan(n)`, `.ShouldBeLessThan(n)`.
+Since 5.0 assertions live in `Cratis.Specifications`, with types forwarded by each framework package (namespace `Cratis.Specifications`); recompile and keep core/framework packages on the same version: `.ShouldEqual(expected)`, `.ShouldBeTrue()`, `.ShouldBeFalse()`, `.ShouldBeNull()`, `.ShouldNotBeNull()`, `.ShouldBeEmpty()`, `.ShouldNotBeEmpty()`, `.ShouldContain(item)`, `.ShouldNotContain(item)`, `.ShouldContainOnly(items)`, `.ShouldBeOfExactType<T>()`, `.ShouldBeGreaterThan(n)`, `.ShouldBeLessThan(n)`.
 
 Additional helpers include `ShouldNotEqual`, `ShouldBeSame`/`ShouldNotBeSame`, `ShouldMatch(Func<T, bool>)`, `ShouldBeInRange`, inclusive comparisons `ShouldBeGreaterThanOrEqual`/`ShouldBeLessThanOrEqual`, `ShouldContainSingleItem`, `ShouldEachConformTo`, ordered collection `ShouldEqual(IEnumerable<T>)`, collection `ShouldContain(Predicate<T>)`, `ShouldBeAssignableFrom<T>`, and string `ShouldContain(substring, StringComparison)`. `Catch.Exception` accepts `Action` or `Func<Task>`; `Catch.Exception<T>(Action)` catches only T.
 

package/package/corpus/harnesses/copilot/instructions/vertical-slices.instructions.md

@@ -258,7 +258,7 @@ public record AuthorRegistered(AuthorName Name);
 
 ## Read Models and Queries
 
-**[contract]** `[ReadModel]` records expose eligible public and internal static methods as queries; internal visibility does not hide an endpoint. Dependencies are plain method parameters (no `[FromServices]`). For application code, start with model-bound mappings, use fluent when the definition needs structure, and choose reducer code when transitions read better as code. For step-by-step creation, invoke the **cratis-chronicle-read-model** skill.
+**[contract]** `[ReadModel]` records expose eligible public static methods as queries. Requires Arc 22.121.0 for non-public methods to be excluded even with `[Query]` (ARC0029 warns); older versions also expose eligible internal statics. Keep helpers outside the read model when supporting those versions. Dependencies are plain method parameters (no `[FromServices]`). For application code, start with model-bound mappings, use fluent when the definition needs structure, and choose reducer code when transitions read better as code. For step-by-step creation, invoke the **cratis-chronicle-read-model** skill.
 
 Use `[ReadModel(RequireQueryAttribute = true)]` with `[Query]` on intended
 endpoints when folds exist (ARC0026/ARCCHR0019). `[Query]` alone does not hide

package/package/corpus/hooks/scripts/cratis-store-mutations.json

@@ -61,6 +61,7 @@
         { "command": "read-models occurrences", "reason": "lists a read model's replay history" },
         { "command": "read-models snapshots", "reason": "reads snapshots of one read model instance" },
         { "command": "recommendations list", "reason": "lists active recommendations" },
+        { "command": "streams closed list", "reason": "lists closed stream scopes and their closure metadata without changing them" },
         { "command": "subscriptions list", "reason": "lists event store subscriptions" },
         { "command": "users list", "reason": "lists registered users" }
     ],
@@ -68,13 +69,16 @@
         { "command": "observers replay", "effect": "replays an observer from the beginning of the event log, resetting all state it has built" },
         { "command": "observers replay-partition", "effect": "replays one partition of an observer from the beginning, resetting that partition's state" },
         { "command": "observers retry-partition", "effect": "retries a failed partition from the sequence number where it failed" },
+        { "command": "observers retry-failed-partitions", "effect": "starts bounded-batch recovery of every failed partition of an observer; acceptance does not mean recovery finished" },
         { "command": "observers clear-quarantine", "effect": "clears observer-level quarantine only, not a partition's quarantine" },
         { "command": "observers clear-partition-quarantine", "effect": "clears a failed partition's quarantine and resets its retry budget; retries the handler unless --no-retry is given" },
         { "command": "observers remove", "effect": "deletes an observer's definition, state, handled counts, failed partitions and projection definition across every namespace of the event store; leaves read model data" },
         { "command": "jobs stop", "effect": "stops a running background job" },
         { "command": "jobs resume", "effect": "resumes a stopped background job" },
+        { "command": "jobs delete", "effect": "requests irreversible deletion of a job and its retained state; acceptance does not confirm completed removal" },
         { "command": "recommendations perform", "effect": "executes a server recommendation, such as a schema or replay maintenance action" },
         { "command": "recommendations ignore", "effect": "marks a recommendation as ignored so it no longer appears" },
+        { "command": "streams closed reopen", "effect": "reopens one exact manual stream closure and records the authenticated actor and repair reason in a StreamScopeReopened system event; event-driven closures are refused" },
         { "command": "subscriptions add", "effect": "adds an event store subscription to a target event store" },
         { "command": "subscriptions remove", "effect": "removes an event store subscription from a target event store" },
         { "command": "users add", "effect": "adds a user to the server's user store" },