@cratis/pi 7.112.0 → 7.114.0

package/package/corpus/skills/cratis-application-slice-specifications/references/query-and-decision-scenarios.md

@@ -1,5 +1,11 @@
 # Query and decision scenarios
 
+## Contents
+
+- Query pipeline
+- Guarded decisions
+- Sources
+
 <!-- Copyright (c) Cratis. All rights reserved. -->
 <!-- Licensed under the MIT license. See LICENSE file in the project root for full license information. -->
 
@@ -52,6 +58,13 @@ not a caller-supplied tenant filter. Compare whole returned items when the contr
 value; otherwise assert each named value. A query backed by a database still needs that provider's
 integration setup: scenario pins do not replace arbitrary stores.
 
+`QueryScenario` owns and disposes its provider. Dispose the scenario (prefer
+`DisposeAsync` for async-owned resources) as well as individual observations.
+Register dependencies in `Services` before the first execution. Scenario
+execution runs the query through Arc's hosted query pipeline and establishes context
+before `Provide`/`Handle` on the command path. A direct static query call does not
+cover those pipeline hooks.
+
 ## Guarded decisions
 
 Create `new CommandScenario<TCommand>()`. It selects Chronicle's in-process decision
@@ -87,6 +100,12 @@ read-model dictionary is the only backing are **legacy-mode** warnings, not a
 reason to fake protected decision readers. Keep non-key enumeration/provider
 boundaries explicit in either mode; decision mode is not a MongoDB substitute.
 
+The default Chronicle-backed `CommandScenario` discovers constraints
+automatically. Assert real constraint refusals instead of disabling them. Do not
+subclass or substitute Chronicle's `EventScenario`; use its public
+seeding/assertion surface or explicit `UseDecisionReads` mode, not a synthetic
+EventScenario facade.
+
 ## Sources
 
 - [Query scenarios](https://github.com/Cratis/Arc/blob/main/Documentation/backend/csharp/testing/query-scenario.md)

package/package/corpus/skills/cratis-arc-authentication-authorization-and-identity/SKILL.md

@@ -179,6 +179,14 @@ filters, and system-execution.
 `Task<AuthenticationResult> HandleAuthentication(IHttpRequestContext context)`.
 Implement it and it is discovered — there is **no** `IArcBuilder` extension and
 **no** options type for authentication.
+Requires Arc 22.139.0 for handlers to opt out of anonymous endpoints through
+`AppliesToAnonymousEndpoints => false`. The default is `true`: existing handlers
+keep running and may establish an identity even when no credential is required.
+Opt out when a handler only rejects credentials and contributes no identity on
+those endpoints. A handler that still runs can inspect the endpoint's anonymous
+metadata and return `AuthenticationResult.Anonymous` instead of rejecting a
+credential the endpoint never required. Specify anonymous and protected requests;
+anonymous access does not bypass other authorization boundaries.
 
 Arc ships `MicrosoftIdentityPlatformAuthenticationHandler` in `Arc.Core`, which
 reads the forwarded principal. See

package/package/corpus/skills/cratis-arc-authentication-authorization-and-identity/references/authproxy.md

@@ -23,6 +23,32 @@ The headers are **not signed**. A backend cannot tell a request that came throug
 
 `IdentityVerification` on an AuthProxy service defaults to `Required` (fail closed). Only a `2xx` with `"isAuthorized": true` admits the caller. A `404`, an unreachable backend, a timeout (default ten seconds), any other non-`2xx`, an empty or unparseable body, a missing verdict, or `isAuthorized: false` all deny. The earlier `BestEffort` mode denied only on `403`. Consequently your `IProvideIdentityDetails` result is the admission verdict at the proxy, not only display data: return `IsUserAuthorized = false` deliberately, and keep the endpoint reachable and fast. A service can opt back into `BestEffort` explicitly; do not do that to hide a broken identity endpoint.
 
+## Multi-host sessions are opt-in
+
+Requires AuthProxy 2.32.4 for the multi-host/crawler/invitation contract below; check the deployed version, or retain host-only sessions and the older error-page contract.
+
+Defaults stay host-only with cookie name
+`.Cratis.AuthProxy.Auth.v2`, per-host handshakes and relative return URLs.
+`Session:CookieDomain` shares sessions beneath a parent domain;
+`Session:CookieName` isolates independent deployments. `SignIn:CallbackHost`
+centralizes OAuth/OIDC handshakes and requires the cookie domain. Restrict
+`AllowedHosts`; never broaden hosts merely to make shared cookies work.
+
+The callback and declared service hosts must lie inside the cookie domain;
+`SubHost` tenant resolution cannot be combined with it. Absolute returns require
+the callback host and an allowed origin inside that domain on the request's
+scheme; otherwise they reduce to a local path. Invitations, credential links and
+registration still start on their original host and need provider callbacks
+there. Use the product's one-proxy/several-hosts migration guide, not an inferred
+cross-domain cookie recipe.
+
+`AuthProxy:SearchIndexing:Exclude` optionally serves anonymous
+`robots.txt` and adds `X-Robots-Tag: noindex, nofollow`. It is off by default and
+is a crawler policy, not authorization. Invitation error-page tokens
+`{{invitedEmail}}` and `{{assertedEmail}}` are blank for addresses outside ASCII
+letters, digits and `._+-@`; do not assume these placeholders always contain text.
+Signed-in `/register` forwarding needs no host workaround.
+
 ## Tenants and services
 
 AuthProxy resolves the tenant through ordered strategies under `Cratis:AuthProxy:TenantResolutions` (`Host`, `Claim`, `Route`, `Specified`, `Default`, `SubHost`, `Selection`). The result reaches the backend as `x-cratis-tenant-id`, which is Arc's default tenant header, so an Arc application behind AuthProxy needs no tenancy configuration and the `UseHeaderTenancy("Tenant-ID")` workaround seen in older applications can be removed.

package/package/corpus/skills/cratis-arc-command/references/proxy-generation.md

@@ -16,7 +16,7 @@ Reference the build package from the project that contains the commands,
 queries and read models, and set an output path:
 
 ```xml
-<PackageReference Include="Cratis.Arc.ProxyGenerator.Build" Version="22.75.0" />
+<PackageReference Include="Cratis.Arc.ProxyGenerator.Build" Version="22.139.0" />
 
 <PropertyGroup>
   <CratisProxiesOutputPath>$(MSBuildThisFileDirectory)../<Web>/src/api</CratisProxiesOutputPath>
@@ -47,6 +47,8 @@ switches without a declared default are off when absent.
 | --- | --- | --- |
 | `CratisProxiesOutputPath` | empty | Where to write. Empty disables generation entirely |
 | `CratisProxiesInputAssembly` | empty | Overrides the assembly to read |
+| `CratisProxiesIncremental` | `true` | Requires Arc 22.138.0; reuse unchanged owned output; set `false` to regenerate every build |
+| `CratisProxiesFileHeader` | project setting | Requires Arc 22.123.0; otherwise uses `.editorconfig` `file_header_template`, or no header; `none` disables it |
 | `CratisProxiesSegmentsToSkip` | empty | Leading namespace segments to drop from the output path |
 | `CratisProxiesLibraryMode` | `false` | Generates for a library rather than an application |
 | `CratisProxiesSkipOutputDeletion` | **`true`** | Already the default — the generator does not wipe the output folder |
@@ -70,6 +72,13 @@ are optional. Sources:
 `Tools/ProxyGenerator.Build/build/Cratis.Arc.ProxyGenerator.Build.targets` under
 `Source/DotNET`.
 
+Incremental generation fingerprints assemblies, generator/configuration, validation metadata
+and owned output. A changed or missing generated file forces regeneration, as
+does a previous warning so diagnostics remain visible. It does not make a
+hand-edited generated file an input. Configure `file_header_template` explicitly
+if you previously relied on the built-in Cratis MIT header; it is no longer
+inserted without configuration.
+
 Item groups the target also forwards: `AssemblyToPackageMapping`,
 `ExcludeType`, `ExcludeNamespace`, `NamespaceRoot`, and `TypeToTsType`.
 

package/package/corpus/skills/cratis-arc-command-execution/SKILL.md

@@ -101,8 +101,9 @@ if (result.IsSuccess)
 }
 ```
 
-⚠️ `Execute<TResult>` throws `InvalidCastException` when the handler returned a
-response of a different type. When the handler returns no response, or the
+`Execute<TResult>` accepts an assignable response, such as an array requested
+as `IEnumerable<T>` or a concrete value requested as an interface/base type.
+⚠️ An incompatible non-null response still throws `InvalidCastException`. When the handler returns no response, or the
 command failed for any reason, `Response` is `default` — a failed result never
 carries a response, because the pipeline clears it once the execution scopes
 have completed.

package/package/corpus/skills/cratis-arc-command-execution/references/occurrence-commands.md

@@ -61,12 +61,13 @@ key where that service supports it; otherwise an external effect can repeat.
 Return events from the command, or use transactional appends. Do not complete a
 stream or commit an aggregate early inside the executor's command.
 
-An immediate append can commit **before** the executor detects it and reports
-`OccurrenceCommandAppendedImmediately`. No receipt is recorded for that failed
-attempt, so retry can duplicate the escaped append. The executor does not
-implicitly provide Chronicle's `RefuseImmediateAppends()` guard. Read
-**cratis-chronicle-client-dotnet**'s immediate-append refusal reference when
-building a custom boundary that needs prevention before transport.
+Requires Arc 22.118.0 for the keyed executor to refuse immediate appends
+**before transport**, with neither appended events nor an effect receipt. Arc
+22.117.x detected `OccurrenceCommandAppendedImmediately` only after an append
+could escape; upgrade rather than treating that detection as retry safety.
+Use `.Transactional` or returned events, and assert that a forbidden direct
+append writes nothing. For a custom non-executor boundary, read
+**cratis-chronicle-client-dotnet**'s immediate-append refusal reference.
 
 ## Verify
 

package/package/corpus/skills/cratis-arc-command-validation/SKILL.md

@@ -142,6 +142,11 @@ public class TransferFundsValidator : CommandValidator<TransferFunds>
 - A validator that itself throws does not become a 500 — Arc catches it and
   emits a validation error with reason `ValidatorFailed`, returning 400.
 
+Read [protected validator construction](references/protected-validator-construction.md)
+for plain read-model constructor inputs under `On`, the separate untrimmed-JIT
+provider opt-in for decision tokens outside `On`, and generated composite-key
+metadata. Do not conflate metadata coverage with validator certification.
+
 ## Step 4 — Data the handler needs: `Provide()`
 
 `Provide()` runs after authorization and validation and before `Handle()`. Its

package/package/corpus/skills/cratis-arc-command-validation/references/input-binding.md

@@ -15,6 +15,14 @@ with `DateTime command property '<member>' requires an explicit offset or Z.`
 `DateTimeOffset` retains the input offset; `DateTime` becomes UTC. The attribute
 is in `Cratis.Arc.Commands`.
 
+Requires Arc 22.120.0 for concepts over `DateTime` or `DateTimeOffset` with
+Arc's default JSON options. Concepts over `DateOnly` are refused as a
+configuration error: calendar dates have no offset. The marker affects
+JSON-bound properties, including nested collection elements, not query strings
+or route scalars. Use reflection-based JSON metadata for these properties;
+System.Text.Json source-generated metadata does not support derived
+`JsonConverterAttribute` markers.
+
 ## Malformed bodies still authorize
 
 Requires Arc 22.110.0 for authorization-before-binding-failure handling on
@@ -31,6 +39,15 @@ policies can run; built-in role, claim, name and authenticated-user requirements
 are already resource-free. Do not mark a requirement resource-free if it reads
 the command.
 
+## Annotations on concepts
+
+Requires Arc 22.121.2 for data annotations on command properties and model-bound
+query parameters to validate a concept's wrapped value: `[Required]` rejects an
+empty wrapped string, `[Range]` checks the primitive, and `[StringLength]` does
+not throw on the wrapper. This uses generated validation metadata; types without
+that metadata (including external assemblies) keep the previous behavior. Do
+not assume annotations replace a concept's reusable validator.
+
 ## Validation members are field paths
 
 Requires Arc 22.115.0 for **all** `ValidationResult.Members` paths to be

package/package/corpus/skills/cratis-arc-command-validation/references/protected-validator-construction.md

@@ -0,0 +1,94 @@
+<!-- Copyright (c) Cratis. All rights reserved. -->
+<!-- Licensed under the MIT license. See LICENSE file in the project root for full license information. -->
+
+# Protected validator construction and key metadata
+
+## Plain read models under On
+
+Requires Arc 22.106.0 for plain Chronicle read-model dependencies in
+`CommandValidator<T>` constructors under read protection `On`. Those reads share
+the command's fold cache and append guard with `Provide`/`Handle`. Let convention
+discovery register a transient validator. Scoped/singleton/factory/instance
+registrations are refused; a plain transient self-binding is also allowed.
+Ineligible construction fails closed; never fall back to unguarded reads. Use
+`[LookUpBy(nameof(Command.Property))]` on each constructor read for multiple
+keys. Another source/stream can instead be read explicitly in `Provide`.
+
+## Explicit decision tokens outside On
+
+Requires Arc 22.126.0 for the opt-in construction of validators taking
+`DecisionRead<T>` or command-aware `IDecisionReads` on `[ProtectedDecision]`
+commands outside `On`. This is **untrimmed JIT only**, not trimmed JIT or
+NativeAOT, and not a switch making every DI container trusted.
+
+Install `ProtectedDecisionServiceProviderFactory` from
+`Cratis.Arc.DependencyInjection` as the host's actual Microsoft DI factory
+**after** `AddCratisArc`, passing the desired `ServiceProviderOptions` explicitly.
+Without them both `ValidateScopes` and `ValidateOnBuild` default to false; host
+Development settings are not inherited. `BuildProtectedDecisionServiceProvider`
+is for independently owned service collections, not a second root inside the
+running host. Execute in a native child scope (or the pipeline's scope-owning
+overload), never directly on that root. Default `CommandScenario` does not opt in.
+
+Register Chronicle through Arc's `WithChronicle`. Do not replace readers or
+re-register tokens. Arc records origins at root construction; copied descriptors,
+a wrapper provider, custom container or later collection mutation cannot acquire
+that evidence.
+
+Every validator/collaborator needs exactly one public constructor and a fully
+inspectable transient graph. Arc constructs fresh instances for the invocation.
+It refuses scoped/singleton validators or collaborators, application validator
+bindings, factory/instance dependencies, cycles, keyed/open generic/deferred or
+optional dependencies, provider/scope accessors and collections (including token
+collections). Plain models and raw `IReadModels`, `IEventStore` or `IEventLog`
+are refused on this path: use tokens or choose `On`.
+
+Requires Arc 22.126.0 for
+`services.AddProtectedDecisionValidator<TValidator>(configure)`. Use it instead
+of an application DI factory when adding rules. The callback runs once on the
+actual fresh instance before validation; thrown callbacks fail the command and
+callback denials are not bypassed. It can replace one Arc convention binding,
+not an explicit application registration. Extra explicit bindings refuse the
+protected path. Ordinary commands still use normal constructor resolution.
+
+Arc checks rule/component identities before invocation and refuses changed or
+cross-scope/reused instances. Construction and cleanup failures block before
+commit even with allowed-severity overrides. Arc disposes owned validators and
+collaborators in reverse order; DI owns read leaves. This is not a sandbox for
+trusted constructor/callback code, mutable captures, static reads or nested-child
+rule changes. `Validate` stays advisory and creates a separate invocation; only
+Execute enrolls its decision for append-time checking. Under `Off`, choose the
+blocking severity needed for business denials.
+
+## Generated key metadata is not validator certification
+
+`CommandReadModelKeys` registers command property/model-key metadata.
+Requires Arc 22.125.0 for generated composite-key descriptors and
+`ProtectedReadModelKeyAccessors`, which registers exact-type composite members.
+These optimize matching; they do not authorize a read or certify a validator's
+dependency graph.
+
+Known concrete composite keys receive generated complete descriptors. For an
+external/runtime key, register `ProtectedReadModelKeyAccessors.Register<T>` with
+every public readable non-indexed instance property, including inherited ones,
+before commands run. Generated metadata uses `DeclareKeyTypes` for startup
+coverage checks; that is not a replacement for registering member accessors.
+Duplicate registration fails. Do not omit a member or treat a
+base descriptor as covering a derived runtime type. Missing declared metadata
+fails with `ProtectedReadModelKeyAccessorMissing`.
+
+Requires Arc 22.134.0 for `ReadProtection:RequireGeneratedMetadata` (false by
+default). Enabling it rejects missing command/model metadata instead of using
+reflection. `ProtectedReadModelKeyOptions.Strict` is also false by default;
+strict composite matching or a restricted runtime requires exact accessors.
+Untrimmed JIT can use the compatibility reflection path when strict mode is off.
+ARC0030 is the composite coverage warning. Do not suppress it or promise
+NativeAOT support for the unrelated dynamic validator opt-in.
+
+## Specify the boundary
+
+Cover a fresh allowed/denied validator, callback-added denial and exception,
+refused DI graphs and cleanup failure, and repeated validation/execution without
+reusing an instance. For keys, cover inherited/flattened members, exact derived
+types, missing metadata under strict settings and generated versus compatibility
+matching. An advisory Validate success is not proof that Execute commits.

package/package/corpus/skills/cratis-arc-ef-core-migration/SKILL.md

@@ -187,6 +187,24 @@ Mark the corresponding property `[Json]`.
 `migrationBuilder.GetDatabaseType()` is available when a migration genuinely has
 to branch per provider.
 
+## Tracked and native upserts
+
+Requires Arc 22.135.0 for `DbSet<TEntity>.UpsertAsync(item, cancellationToken)`.
+On supported SQL Server, PostgreSQL and SQLite mappings it executes an immediate,
+parameterized native upsert matching the complete primary key, including composite
+keys and value converters. Native key matching and writing are atomic. It uses
+the context's connection/current transaction, bypasses tracking and does not
+refresh generated values or already tracked instances. It adds no retry policy.
+
+Use application-assigned keys and single-table scalar mappings. Unsupported
+providers or mappings (including unset generated keys, SQL Server identity
+columns, navigations, owned entities, shadow properties, inheritance and multiple
+tables) fall back to tracked persistence and require `SaveChangesAsync`. The
+existing `Upsert(item)` always uses tracked read-then-write persistence and also
+requires saving; that path is not an atomic database upsert. Choose it explicitly
+when deferred persistence is required. Do not rely on fallback for concurrency
+protection or assume the native path flushes pending tracked changes.
+
 ## Observing an EF Core read model
 
 `DbSet<T>` gains `Observe(filter?, configure?)`, `ObserveSingle(filter?, configure?)`

package/package/corpus/skills/cratis-arc-query-paging/SKILL.md

@@ -56,10 +56,12 @@ Sources: `Arc.Core/Queries/QueryStringQueryRequestReader.cs`,
 
 ## Which return shapes page
 
-A query is an eligible public or internal static method on the `[ReadModel]`
-type, discovered by its return type. Internal visibility does not hide an
-endpoint; keep helpers outside that type. Read **cratis-chronicle-read-model**'s
-query reference for explicit `[Query]` discovery and older-version limits.
+A query is an eligible public static method on the `[ReadModel]` type,
+discovered by its return type.
+Requires Arc 22.121.0 for non-public statics to be
+excluded even with `[Query]` (ARC0029 warns); older Arc exposes internal methods
+as endpoints too. Read **cratis-chronicle-read-model**'s query reference for
+explicit `[Query]` discovery and older-version limits.
 
 | Return | Paged? | How |
 | --- | --- | --- |
@@ -174,6 +176,11 @@ For composed MongoDB/EF observations, pass `ignoreQueryContext: true` to
 auxiliary sources so only the primary consumes client paging/sorting and writes
 totals. Single-instance observations emit `default` when absent, deleted or
 outside the filter; guard `hasData`/`isReady` in React.
+Requires Arc 22.117.1 for
+`ObserveSingle`/`ObserveById` never to page or count; their retained
+`ignoreQueryContext` argument has no effect. Use collection results for paging.
+Read [live query processing](references/live-query-processing.md) for shared
+MongoDB watches, emitted-value interception and calendar-bound answers.
 Source: [MongoDB observations](https://github.com/Cratis/Arc/blob/main/Documentation/backend/csharp/mongodb/observing-collections.md).
 
 ## Consume it from the frontend

package/package/corpus/skills/cratis-arc-query-paging/references/live-query-processing.md

@@ -0,0 +1,71 @@
+<!-- Copyright (c) Cratis. All rights reserved. -->
+<!-- Licensed under the MIT license. See LICENSE file in the project root for full license information. -->
+
+# Live query processing
+
+## Shared MongoDB watches
+
+Requires Arc 22.136.0. MongoDB `Observe()` uses a shared database-level watch keyed by deployment and
+database rather than opening a collection watch for every observer. Each
+observation keeps its filter, paging and tenant context.
+Requires Arc 22.137.0 for observations of collections created by the caller's
+own `MongoClient` to receive changes. The watcher derives the deployment key
+from the database client instead of requiring prior registration. Joined observations coalesce refresh notifications into one pending
+refresh and re-read every joined source. Snapshot read failures receive a
+bounded retry burst; exhaustion waits for a later notification rather than
+spinning or buffering unbounded work.
+
+Watch reconnects resume from the token when possible and request a new snapshot
+when the token cannot resume. The watch reopens before asking for snapshots so
+writes during the read are still observed. Disposing one observer does not stop
+the shared watch; disposing its subject or losing the last subscriber stops that
+observation's refresh work and prevents a late emission. Shared watches do not
+replace each subscription's cancellation and disposal.
+
+## Intercept the emitted model, not its wrapper
+
+Implement `Cratis.Arc.Queries.IInterceptReadModel<T>` with
+`Task<T> Intercept(T readModel)`. Return a copy when transforming data that another
+subscriber could share. A non-abstract open generic `IInterceptReadModel<T>`
+implementation must target exactly its own type parameter; closed
+implementations also work.
+
+Interception runs for supported direct/hub streaming emissions and observable
+HTTP snapshot/wait results in the requesting subscriber's scope and identity. Interceptors run before emission guards; a thrown interceptor
+fails the result rather than exposing the untransformed value. Ordinary model
+queries and Arc-wrapped MVC GETs also intercept results; `[AspNetResult]` opts
+out of that result processing. Interceptors are transformations, **not access
+control**. Filter rows/fields and authorize independently on every exposed path,
+and specify snapshot, SSE/WebSocket and hub paths separately.
+
+## Date-sensitive answers without data changes
+
+Requires Arc 22.138.0 for `Cratis.Arc.Calendar`. Inject `IApplicationCalendar` and
+pass an instant to `Read`; it does not read the clock. Zone precedence is an
+operation-declared zone, then the first non-null `ICanProvideTenantCalendar`
+answer, then `Cratis:Arc:Calendar:TimeZone` (default `UTC`). Headers and query
+arguments cannot choose it. Configured and tenant-provider ids must be usable
+IANA ids: unknown, Windows-only and nonzero fixed-offset ids fail with
+`TimeZoneIsNotAnIanaZone`,
+never a silent UTC fallback. Containers need time-zone data (`tzdata`).
+
+A live "due today" answer needs candidates observed **without a clock-dependent
+store filter**, or tomorrow's members will never enter the source. Use
+`IClockBoundaries.Begin(tenant, operationZone, token)` to obtain a
+`ClockBoundaryContext`, then `candidates.ReevaluateAtBoundaries(context,
+(candidates, reading) => new ClockEvaluation<TAnswer>(answer, nextBoundary))`.
+`LocalDateChanges.NextLocalDateChange(reading.Zone, reading.Instant)` handles
+midnight, skipped dates and backwards date transitions. `reading.Today.AddDays`
+steps calendar days; subtracting elapsed hours from the instant is different
+across daylight-saving changes.
+
+Every next boundary must be strictly after the evaluated instant or null;
+otherwise the stream fails with `ClockBoundaryIsNotInTheFuture`. The first result
+always emits; equal subsequent answers do not (collections compare in order).
+Evaluation is serialized in the context's tenant. The zone is fixed at Begin;
+application changes require restart and tenant-zone changes affect new
+subscriptions. The operator connects on first subscription and disposes timer
+and candidates on last unsubscribe, cancellation, error or completion. It does
+not accept `OnNext`. Use the registered `TimeProvider` and a `FakeTimeProvider`
+with `Advance` to specify boundary changes without sleeps. This is not a
+continuously ticking `now` or an advanceable clock in query scenarios.

package/package/corpus/skills/cratis-arc-react-page/SKILL.md

@@ -45,6 +45,17 @@ import { Dialog } from '@cratis/components/Dialogs';
 import { DialogProps, DialogResult, useDialog } from '@cratis/arc.react/dialogs';
 ```
 
+## Guid command fields
+
+Requires Components 4.31.0 and matching Arc/Arc React 22.19.1 for GuidField invalid-draft execution blocking; check `yarn why @cratis/components` and `yarn why @cratis/arc.react`, or keep a host-validated field.
+
+Opt into `GuidField` from `@cratis/components/CommandForm`. It binds native
+Fundamentals `Guid` values, accepts partial text drafts and never generates an
+identifier. Register it once through `registerFieldTypeProvider` for
+`AutoCommandForm`; it is not a built-in provider. Invalid drafts clear the bound
+value. Preserve host-set errors and use `resetKey` to discard an unchanged empty
+value's draft.
+
 ## Initial focus
 
 `DialogInitialFocus.Confirm` is the default and arms the confirm button, so a destructive dialog uses `DialogInitialFocus.Cancel`. Read [dialogs.md](references/dialogs.md) for the three options.

package/package/corpus/skills/cratis-arc-validation-kotlin/SKILL.md

@@ -183,6 +183,21 @@ when omission is invalid for the selected query.
 
 ### `ConceptValidator<TConcept>`
 
+Requires Arc.Kotlin 7.8.0 for shared Fundamentals concepts and their validators; check `./gradlew dependencies`, or retain the legacy Arc concepts and validators until upgrading.
+
+Prefer `io.cratis.fundamentals.concepts.ConceptAs` for new concepts and
+`FundamentalsConceptValidator<TConcept>` for their rules. It implements
+`ModelValidator<TConcept>` and exposes `conceptType` plus
+`validate(concept): List<ValidationResult>`; read the primitive via `value()`.
+JSON, validation, proxy generation, Spring conversion, Chronicle bridging and
+testing recognize the shared concept type. The old Arc `ConceptAs` extends it
+and is deprecated, as is `ArcCamelCase` (use Fundamentals `toCamelCase`).
+Existing Arc concepts/validators keep compiling and linking unchanged.
+
+The legacy Arc concept example below remains valid with `ConceptValidator` and
+its `value` property; do not copy that property shape to a new Fundamentals-only
+concept, whose interface method is `value()`.
+
 A reusable invariant on a `ConceptAs<T>` concept type, walked automatically
 wherever that concept type appears — command, nested model, collection,
 array, or map — without each owner repeating the rule. Matching uses
@@ -206,9 +221,11 @@ Jakarta `Validator` bean. Exclude one direct edge deliberately with
 Java record component/field) whose *declared* type implements `ConceptAs`. A
 scalar root, a collection element, or a nested path cannot be excluded this
 way — register the nested owner type and its direct member instead. Excluding
-an edge suppresses only `ConceptValidator` execution there; owner rules, exact
-`ModelValidator` rules, Jakarta constraints, and root typed validators still
-run.
+an edge suppresses concept-rule execution there, including
+`FundamentalsConceptValidator`; owner rules, exact `ModelValidator` rules,
+Jakarta constraints, and root typed validators still run.
+
+Requires Arc.Kotlin 7.8.1 for exclusions to suppress FundamentalsConceptValidator; check `./gradlew dependencies`, or upgrade before relying on a shared-concept exclusion.
 
 ### `ModelValidator<T>`
 

package/package/corpus/skills/cratis-chronicle-cli-operations/SKILL.md

@@ -60,6 +60,10 @@ Two things worth knowing before running it:
   connection guidance in a repository-owned project context file; never patch
   packaged or generated bytes.
 
+Read [project tooling](references/project-tooling.md) for embedded release notes,
+cached templates, managed MCP registration and install-only versus harness AI
+conformance checks. Updating instructions does not run those behavior checks.
+
 ## Reach the right server
 
 The connection string resolves in this exact order:
@@ -180,6 +184,10 @@ needs Chronicle 19.29.0 or later, resets the retry budget and retries unless `--
   is given; handler side effects may repeat. `retry-partition` exits non-zero
   when quarantined or not failed. `jobs resume` resumes Stopped jobs, not Failed.
 
+Read [recovery outcomes and namespace comparison](references/recovery-and-comparison.md)
+for refusal-aware job actions, retained-job deletion, observer-wide failed-partition
+recovery, exact manual stream reopening and bounded metadata comparison.
+
 ## Before you change anything
 
 Default to read-only inspection. A request to diagnose a live store does not
@@ -188,12 +196,13 @@ authorize replay, retry, removal, quarantine clearing, or another mutation.
 These commands mutate the running store:
 
 - `chronicle observers replay`, `replay-partition`, `retry-partition`,
-  `clear-quarantine`
+  `retry-failed-partitions`, `clear-quarantine`
 - `chronicle observers remove` — destructive across every namespace of the event
   store: definition, state, handled counts, failures and projection definition;
   read model data stays. Refused while running or subscribed, no force flag.
 - `chronicle observers clear-partition-quarantine` — may retry the handler
-- `chronicle jobs stop`, `chronicle jobs resume`
+- `chronicle jobs stop`, `chronicle jobs resume`, `chronicle jobs delete`
+- `chronicle streams closed reopen` — exact manual scope repair with a reason
 - `chronicle recommendations perform`, `chronicle recommendations ignore`
 - `chronicle subscriptions add`, `chronicle subscriptions remove`
 - `chronicle users add`, `chronicle users remove`

package/package/corpus/skills/cratis-chronicle-cli-operations/references/command-effects.md

@@ -20,6 +20,7 @@ non-read-only commands.
 | `workbench` | destructive | false (its actions have their own dialogs) |
 | `applications add` | mutating | false |
 | `applications remove` | destructive | true |
+| `jobs delete` | destructive | true |
 | `jobs resume` | mutating | true |
 | `jobs stop` | mutating | true |
 | `observers clear-partition-quarantine` | mutating | true |
@@ -27,14 +28,20 @@ non-read-only commands.
 | `observers remove` | destructive | true |
 | `observers replay` | destructive | true |
 | `observers replay-partition` | destructive | true |
+| `observers retry-failed-partitions` | mutating | true |
 | `observers retry-partition` | mutating | true |
 | `recommendations ignore` | mutating | true |
 | `recommendations perform` | destructive | true |
+| `streams closed reopen` | mutating | true |
 | `subscriptions add` | mutating | false |
 | `subscriptions remove` | destructive | true |
 | `users add` | mutating | false |
 | `users remove` | destructive | true |
 
+See [recovery outcomes](recovery-and-comparison.md) for CLI/server floors and
+acceptance versus completed work. `jobs delete` exits nonzero on declined/unavailable
+confirmation; success means deletion requested, not completed removal.
+
 The remaining Chronicle commands are cataloged read-only, including
 `report-error`; the guard deliberately blocks that command because it opens an
 external browser issue form. `chronicle version` is not a command in this

package/package/corpus/skills/cratis-chronicle-cli-operations/references/project-tooling.md

@@ -0,0 +1,91 @@
+<!-- Copyright (c) Cratis. All rights reserved. -->
+<!-- Licensed under the MIT license. See LICENSE file in the project root for full license information. -->
+
+# CLI updates and project tooling
+
+This complements live-store operations; it does not grant permission to install
+servers, change a repository or run quota-consuming agent sessions. Inspect the
+installed version with `cratis --version` and its catalog before using a flag.
+
+## Inspect the upgrade, not a remembered bundle
+
+Requires CLI 3.87.0 for offline embedded release notes:
+
+```bash
+cratis release-notes --since <version> -o json
+cratis release-notes --version <version>
+```
+
+`cratis update` displays the skipped releases after its update results. Requires
+3.89.0 for `cratis new` to use the template set cached at `~/.cratis/templates`:
+first use downloads from NuGet; offline use can reuse a complete cached set.
+`cratis new cratis --language csharp --version <version>` selects a version for
+one run rather than replacing the installed choice. `cratis update` refreshes
+compatible templates without downgrading or failing the CLI update when refresh
+fails; `--no-templates` skips it. CLI and template versions are separate. Do not
+silently enable scaffold scripts; preserve the template's `--allow-scripts`
+choice. Multi-service orchestration still needs explicit per-store settings.
+
+For `cratis render` / `run`, read **cratis-screenplay-render-and-gap-fill** and
+**cratis-stage-rendering-and-sandbox**. Their bundled renderer determines support;
+a CLI upgrade can change admission, generated output and the default container
+without changing the model. Never infer support from the ESM version alone or
+edit generated output to make an older CLI accept it.
+
+## Managed AI installation and MCP
+
+Requires CLI 3.77.1 for `.pi/agents` to link to Pi-native corpus adapters when
+available, falling back to canonical agents only for older corpora. Do not
+hand-edit generated adapters to restore missing tools; update the CLI/corpus.
+
+Requires 3.90.0 for profile-selected servers in the corpus's `mcp-servers.json` to
+be registered by `cratis ai install` / `update` in Claude Code, Copilot, Cursor,
+Codex and OpenCode. Installation registers configuration; it does not start the
+servers. Deselecting/uninstalling removes only unchanged owned entries. Foreign
+or modified entries remain conflicts, even with force. Resolve a conflict by
+intentionally renaming/removing your entry or disabling that server with
+`mcpServers.<id>.enabled = false` in the project configuration; do not overwrite
+it speculatively. Pi supports only Screenplay through its native extension and
+reports other servers unsupported. An invalid selected descriptor is reported
+and skipped; successful guidance installation does not prove MCP availability.
+Installing a server does not authorize its tools or commands.
+
+## Deterministic AI checks versus harness behavior
+
+Requires CLI 3.98.0 for opt-in `cratis ai test`. Each fixture × harness uses a
+fresh temporary workspace with the fixture's selected profiles/languages; the
+invoking repository is unchanged. It is **not** a security sandbox: fixture
+commands and harnesses still have host tools/authentication. Trust the source,
+request the intended session/budget, and keep transcripts off unless needed.
+The default fixture root is `Evaluations/conformance`; `--fixtures` overrides
+it, `--fixture` selects names, and `--harnesses claude,codex` narrows adapters.
+`--output json` is this command's structured format, not proof of a passing run.
+
+Requires 3.100.0 for install-only CI without a harness, credentials or model quota:
+
+```bash
+cratis ai test --source <corpus> --install-only --output json
+```
+
+This runs install-phase checks for declared harness ids (or the configured ids
+when a fixture declares none), narrowed by `--harnesses`. Result-phase checks
+stay `not_run`; no install checks means skipped, not behavioral conformance.
+Normal mode rejects missing/modified installations unless corpus-source mode is
+selected. `--source`/`CRATIS_AI_SOURCE` selects a trusted local corpus.
+
+Fixtures require a non-optional result check even in install-only mode. File
+checks choose one path/glob; an empty glob match fails. Install checks cannot be
+commands. A result command uses `run: ["executable", "argument"]` with no implicit
+shell and cannot also declare file path/glob/pattern fields. Invalid check shapes
+are errors. Paths and links cannot escape the workspace.
+
+A timeout kills the process tree; output is capped. Requested `--timeout` and
+`--max-budget-usd` can lower, not raise, fixture limits. Claude enforces a spending
+limit; Codex reports that bound `not_enforced`. Missing harnesses/credentials are
+skipped with a reason, never passed. Exit 0 can mean all skipped or no selected
+runs: inspect counts and `no fixtures ran successfully`. Exit 1 means fixture,
+harness or check failures/errors; exit 2 means usage/install errors. Installed
+file hashes, observed tool reads and check results are separate evidence levels;
+unknown reads remain unknown. `--keep-transcripts` retains best-effort-redacted
+temporary output; inspect it for secrets before sharing. Passing install checks
+is not proof that an agent read or obeyed the guidance.