@cratis/pi 7.34.0 → 7.35.0

package/package/corpus/prompts/add-business-rule.prompt.md

@@ -16,7 +16,7 @@ Enforce a new rule on an existing command. Invoke the **cratis-arc-command-valid
 - Reusable value invariant → `ConceptValidator<T>`.
 - Command-input / cross-field / pre-handler rule → `CommandValidator<T>`.
 - Handler needs fetched data first → `Provide()`.
-- State rule that must hold **under concurrency** → inject the read model into `Handle()`, return `Result<TEvent, ValidationResult>`.
+- State rule that must hold **under concurrency** → enroll a stream decision with `IStreamReads`/`StreamDecision`, or use `[ProtectedDecision]` with an admitted `DecisionRead<T>`; plain read-model injection and `Result<TEvent, ValidationResult>` alone add no guard. Specify the race with `UseDecisionReads()` and seeded events, not pinned models.
 - Uniqueness → `[Unique]` / `IConstraint`.
 
 > **Never throw for normal business rejection** — a throw is HTTP 500, not a validation error. Recoverable rejection is a `ValidationResult` / `Result<,>`. Add a spec for the failure case (assert both not-successful and has-validation-errors). The skill carries the detail; don't duplicate it here.

package/package/corpus/prompts/ship-changes.prompt.md

@@ -45,8 +45,8 @@ The description is published verbatim as the release notes, so it follows the co
   - No development write-up: no Overview/Verification/Test plan headings (only a first `## Summary`
     is allowed), no review, testing or provenance notes. Those go in a PR comment.
   - `(#n)` ends the bullet that delivers an issue and `(part of #n)` marks anything that stays open;
-    never `Closes`/`Fixes`/`Refs` before a number, and never an issue reference inside an HTML comment,
-    which still closes the issue.
+    never `Closes`/`Fixes`/`Refs` before a number, and never an issue reference inside an HTML comment
+    (release-action removes comments, so it would close nothing).
   - Links are absolute `https://` URLs, never relative paths.
 - Post reviewer notes (checks run, what was not verified, review provenance, stacking, merge or
   deploy order) right after creating the PR with `gh pr comment <n> --body-file .ai-work/pr-notes.md`.

package/package/corpus/rules/ai-distribution.md

@@ -15,7 +15,7 @@ Do not copy or synchronize shared `.cratis/ai`, `.agents`, `.claude`, `.github`,
 never become an accidental source that republishes its local AI corpus.
 
 Shared Cratis capabilities are authored and reviewed in `Cratis/AI` and reach a
-repository through one of three channels, each with its own version semantics:
+repository through these channels, each with its own version semantics:
 
 - **`cratis ai install` / `cratis ai update`** copy the corpus into `.cratis/ai/`
   from the current `main` of `Cratis/AI` (or an explicit `--source` path), record
@@ -25,11 +25,32 @@ repository through one of three channels, each with its own version semantics:
   prompts, and hooks are always installed; rules are filtered by profile and
   language; skills by the profile catalog; `harnesses/<harness>/` only for the
   harnesses selected.
-- **`@cratis/pi`** is the one versioned channel: an npm package cut per release,
+- **`@cratis/pi`** is a versioned channel: an npm package cut per release,
   pinned and rolled back by package version. It yields to a managed install when
   `.cratis/ai.manifest.json` exists.
 - **Native plugin marketplaces** (Claude Code, Codex, Copilot, Cursor) expose the
-  skills only, from the unpinned GitHub source.
+  skills only, from the unpinned `Cratis/AI` GitHub source.
+- **`Cratis/AI.Distribution`** is a separate tag-versioned, deny-by-default public
+  evaluation marketplace. At **v0.3.0** it contains 29 skills and is explicitly
+  unsupported `0.x`, not a supported installation channel. Codex and Gemini
+  accept `--ref v0.3.0`; Pi accepts
+  `git:github.com/Cratis/AI.Distribution@v0.3.0`. Its documented Claude Code and
+  Copilot marketplace-add commands carry no ref. Live Chronicle CLI operations
+  (`cratis-chronicle-cli-operations`) and both Chronicle/Studio MCP skills remain
+  excluded, as do command execution, EF Core/event-type migration and reactors.
+  Sources: [v0.3.0 README](https://github.com/Cratis/AI.Distribution/blob/v0.3.0/README.md),
+  [release manifest](https://github.com/Cratis/AI.Distribution/blob/v0.3.0/marketplace-release.json)
+  and [exclusions](https://github.com/Cratis/AI.Distribution/blob/v0.3.0/provenance.json).
+
+At CLI **v3.53.1**, install/update/uninstall support `--dry-run`; `--source`
+or `CRATIS_AI_SOURCE` supplies a local corpus. Otherwise the CLI shallow-clones
+Cratis/AI's default branch and deletes the download after the run. `status`
+exits non-zero on local modifications; `--force` does not remove changed owned
+MCP entries on uninstall. Consumer extension sections in `.cratis/ai.json` and
+hook shebang/execute bits are preserved. Installation creates no model folder.
+Sources: [AiCorpusSource.cs](https://github.com/Cratis/cli/blob/v3.53.1/Source/Cli/Commands/Ai/AiCorpusSource.cs)
+and [AI commands](https://github.com/Cratis/cli/blob/v3.53.1/Documentation/ai/index.md)
+(the latter's older model-directory claim does not override current behavior).
 
 ## Profile-selected MCP servers
 
@@ -44,6 +65,13 @@ servers, settings and comments, detect conflicts, support dry-run/status, and
 remove only unchanged owned entries on uninstall. Unsupported adapters must be
 reported explicitly rather than presented as configured.
 
+At CLI v3.53.1 only Screenplay is registered: `.mcp.json` for Claude (with
+`--project-root-env CLAUDE_PROJECT_DIR`), `.vscode/mcp.json` for Copilot,
+`.cursor/mcp.json`, `.codex/config.toml` and OpenCode's config. Pi uses the
+`cratis-mcp` harness extension rather than a config file. CodeScene's `cs-mcp`
+is never registered by the CLI; neither Chronicle nor Studio MCP is registered
+by the corpus. Source: [AiMcpHarnesses.cs](https://github.com/Cratis/cli/blob/v3.53.1/Source/Cli/Commands/Ai/AiMcpHarnesses.cs).
+
 Project model roots and opt-outs are consumer-owned configuration. Guidance
 installation never creates or manages a model directory: the Screenplay MCP locates the model
 itself (existing `.play` files, else `Source/` or `src/`, else a new `Screenplay/` folder). Ordinary

package/package/corpus/rules/application-profile.md

@@ -31,7 +31,7 @@ Commands are imperative intents (`Register`, `Create`); the slice folder is the
 Tagged **[contract]** (framework-enforced) or **[convention]** (house default). Mechanics and examples live in `vertical-slices.md`.
 
 1. **[contract] Model-bound — no controllers.** Commands are `[Command]` records with a public instance `Handle()` (Arc analyzers enforce this); queries are `static` methods on `[ReadModel]` records; projections/constraints/authorization use attributes. Arc generates the HTTP surface. Drop to fluent (`IProjectionFor<T>`, `IConstraint`) only when model-bound can't express the rule.
-2. **[contract] Command validation & data flow.** Put command rejection in `CommandValidator<T>`, global value invariants in `ConceptValidator<T>`, and fetched/computed handler data in **`Provide()`** (runs after validation/authorization; may short-circuit with `ValidationResult.Error` / `Result<TProvided, ValidationResult>`). Keep `Handle()` focused on event construction. For a state-dependent rule that must hold **under concurrency**, inject the read model into `Handle()` and return a typed error via `Result<TEvent, ValidationResult>`. **Throwing from `Provide()`/`Handle()` is an exception (HTTP 500), not a validation rejection** — throw only for genuinely exceptional conditions, never for normal business rejection.
+2. **[contract] Command validation & data flow.** Put command rejection in `CommandValidator<T>`, global value invariants in `ConceptValidator<T>`, and fetched/computed handler data in **`Provide()`** (runs after validation/authorization; may short-circuit with `ValidationResult.Error` / `Result<TProvided, ValidationResult>`). Keep `Handle()` focused on event construction. For a state-dependent rule that must hold **under concurrency**, enroll a guarded stream decision (`IStreamReads`/`StreamDecision`) or use `[ProtectedDecision]` with an admitted `DecisionRead<T>`; plain injected models remain advisory. Return a typed rejection via `Result<TEvent, ValidationResult>` where needed; the result alone adds no guard. **Throwing from `Provide()`/`Handle()` is an exception (HTTP 500), not a validation rejection** — throw only for genuinely exceptional conditions, never for normal business rejection.
 3. **[contract] Event-source id resolution:** `ICanProvideEventSourceId` first; else the first qualifying property in declaration order — an `EventSourceId`/`EventSourceId<T>`-derived value *or* a `[Key]` property (no priority between them; two candidates is `ARCCHR0002`); else Arc generates one. A value actually used as a Chronicle stream identity derives from `EventSourceId<T>` with the underlying `IComparable` primitive — never `ConceptAs<Guid>` for that stream identity. `NotSet`, `New()`, and primitive→derived-id operators are optional domain/API conveniences, not Chronicle requirements; typed empty/zero values are real specified stream IDs, not `EventSourceId.Unspecified`.
 4. **[contract] Events never carry the event-source id** — it is implicit in the event context.
 5. **[contract] `[Key]` / `[Subject]` are distinct.** `[Key]` is for event-source/read-model/projection key resolution; `[Subject]` is compliance identity only. Don't put either on an `EventSourceId<T>` value (it already is both); use them only for non-`EventSourceId<T>` values.
@@ -52,6 +52,7 @@ Tagged **[contract]** (framework-enforced) or **[convention]** (house default).
 
 ## Implementation Workflow
 
+- **Starting a brand-new application:** scaffold it instead of hand-writing the skeleton: `dotnet new install Cratis.Templates`, then `dotnet new cratis -n MyApp -o MyApp` (`--language Kotlin|Java`, `--Database MongoDB|PostgreSQL|MsSql|SQLite`; `cratis-aspire` for Aspire; `cratis-chronicle-console` or `cratis-chronicle-web` for a Chronicle client only). Non-interactive runs need `--allow-scripts yes`; the .NET templates target `net10.0`. The template writes `.cratis/ai.json`; run `cratis ai update` afterwards. Its `SomeModule/SomeFeature/Registration/` slice is the house shape. There is no Go, Python or Elixir template (verified at Cratis.Templates `v1.7.4`).
 - **Phase 0 — Find the contract / choose the level.** Before writing slice code, find what the code must match, and choose the level once for the whole scope.
   1. **Look for a Screenplay model** under the model root (the folder holding the project's `.play` files, or the root set by `mcpServers.screenplay.root` in `.cratis/ai.json`; search `**/*.play`) for the slice, command, event and read-model names. A `.play` file outside the root, an untracked or uncommitted draft, an empty directory, or an installed profile or skill is not opt-in; the repository is opted in only when the root holds a committed `.play` file (`git ls-tree -r --name-only HEAD` lists a `.play` file there, narrowed to `-- <root>` when a root is configured) or the project set that root explicitly (master definition: **cratis-screenplay-modeling-lifecycle**, "Decide the level first").
   2. **Model level** — an accepted model under the root covers the scope, or the repository is opted in and this scope has no model yet. The `.play` slice and its specs are the contract: change the model first (new behavior starts in discovery), verify it (V1–V3), get an independent review, then render with Stage or gap-fill by hand only what the renderer rejects. Hand-written code stays checked against the model (**cratis-application-slice-conformance**). Never edit Stage-managed output, never implement behavior the model does not state, never change the model to match existing code, never weaken protection to make it compile or render. Start with **cratis-screenplay-event-modeling** (decision rule), then **cratis-screenplay-modeling-lifecycle**. If the Screenplay skills are not installed, say so; do not author `.play` from memory.

package/package/corpus/rules/components.md

@@ -16,7 +16,7 @@ The package root exports **only** setup (`CratisComponentsProvider`, configurati
 | Need | Use | Subpath |
 |---|---|---|
 | App root | `CratisComponentsProvider` | `@cratis/components` |
-| Page chrome, buttons, basic controls | `Page`, `Button`, `IconButton`, `TextInput`, `TextArea`, `NumberInput`, `Checkbox`, `Radio`, `Switch`, `Tooltip`, `ErrorBoundary`, `FormElement`, `ComboBox` (≥ 4.6.0 — single-selection, text-searching entity picker) | `@cratis/components/Common` |
+| Page chrome, buttons, basic controls | `Page`, `Button`, `IconButton`, `TextInput`, `TextArea`, `NumberInput`, `Checkbox`, `Radio`, `Switch`, `Tooltip`, `ErrorBoundary`, `FormElement`, `ComboBox`, `ToggleGroup`, `Tabs`, `TagGroup`, `Breadcrumbs`, `DatePickerInput`, `ActionMenubar`, `ToolbarFocusMode`, `Surface` | `@cratis/components/Common` |
 | Icon | `Icon` (type) / `IconDisplay` | `@cratis/components/Common` |
 | Query list page | `DataPage`, `MenuItem`, `Column` | `@cratis/components/DataPage` |
 | Standalone query table | `DataTableForQuery` / `DataTableForObservableQuery`, `Column` | `@cratis/components/DataTables` |
@@ -28,8 +28,35 @@ The package root exports **only** setup (`CratisComponentsProvider`, configurati
 | Notifications | `Toaster`, `toast`, `toastCommandResult` | `@cratis/components/Notifications` |
 | Status & display | `Tag`, `Badge`, `Chip`, `Skeleton`, `Avatar`, `ProgressBar`, `ProgressSpinner`, `Message` | `@cratis/components/Display` |
 | Canvas tool palette | `Toolbar`, `ToolbarButton`, … | `@cratis/components/Toolbar` |
+| Schema structure / object content | `SchemaEditor` / `ObjectContentEditor` / `ObjectNavigationalBar` | `@cratis/components/SchemaEditor`, `/ObjectContentEditor`, `/ObjectNavigationalBar` |
+| Spatial canvas / pivot data | `Canvas` / `PivotViewer` | `@cratis/components/Canvas`, `/PivotViewer` |
+| Chat | `Chat` | `@cratis/components/Chat` |
+| Ordered configuration | `OrderedItemEditor`, `PropertyControls` | `@cratis/components/ConfigurationEditor` |
+| Filter panel | `FilterPanel` | `@cratis/components/Filter` |
+| Icon / Markdown editing | `IconPicker` / `MarkdownEditor` | `@cratis/components/IconPicker`, `/MarkdownEditor` |
+| Time navigation | `TimeMachine` | `@cratis/components/TimeMachine` |
+| Renderer contracts / built-in | renderer exports | `@cratis/components/renderer`, `/renderer/builtin` |
+| CSS foundation / area sheets | layer order / structural CSS | `@cratis/components/styles/base`, `<subpath>/styles` |
 | Shared types | `JsonSchema`, `Json`, … | `@cratis/components/types` |
 
+At Components 4.26.4, React and React DOM are `^19.0.0`, Arc and Arc React are
+`>=20.3.1 <23`, Fundamentals is `^7.10.3`, and `reflect-metadata` `0.2.2` is required
+(import it at the entry point). `tsyringe` `4.10.0` is optional for Components;
+Arc React installs it. `Canvas` and `PivotViewer` need the optional `pixi.js ^8.20.0`
+peer; ordinary pages do not. No `motion-dom` or `motion-utils` resolution pin is needed.
+
+### Common controls
+
+All import from `@cratis/components/Common`:
+
+| Control | Main props / choice |
+| --- | --- |
+| `ComboBox` | `options`, `value: string \| null`, `onChange(key)`, `filter`, `openOnFocus`, `loading`, `emptyMessage`, `failure`, `action`, `optionLayout` — a single-select entity picker |
+| `ToggleGroup` | `options`, `value`, `onChange` — choose a value; radiogroup semantics with one Tab stop |
+| `Tabs` | `tabs`, `value`, `onChange` — choose a panel, not a domain value |
+| `TagGroup` | `value: string[]`, `onChange`, `editable`, `separators`, `allowDuplicates`, `removeIcon` |
+| `Breadcrumbs` | `items`, `separator` — last item is `aria-current='page'` |
+
 Use `Dropdown` from `@cratis/components/Dropdown`, never a vendor select: it renders through the Components overlay environment, so it stacks correctly above dialogs, and it follows the WAI-ARIA button/listbox (or combobox, when `filter` is on) pattern. Its `onChange` receives the **value**, not an event — as do every CommandForm field's.
 
 ### Notifications — feedback for commands run outside a dialog
@@ -46,6 +73,14 @@ const result = await command.execute();
 if (toastCommandResult(result, { successTitle: 'Author registered' })) refresh();
 ```
 
+Without a mounted toaster, neither `toast` nor `toastCommandResult` displays anything.
+Mount **one**, not both: two toasters show every toast twice. The provider has no
+Arc dependency; its position relative to `<Arc>` is not what enables notifications.
+
+`ErrorBoundary` (`Common`) contains a failing section with a neutral message, never
+exception text. Supply `fallback` (a node or `(reset) => node`), `onError`, and
+`onReset` when needed; retry remounts only the protected section.
+
 For ad-hoc notifications, call the imperative `toast.success/info/warn/error(...)` — each takes an
 **options object**, not a bare string: `toast.info({ title: 'Saved', description: '…' })`.
 
@@ -65,7 +100,12 @@ Required props: `title`, `query` (`Constructor<TQuery>`; snapshot and observable
 auto-detected), `emptyMessage`, and `children`. Other props: `queryArguments`, `dataKey` (pass
 whenever the read model has an identity), `selection` / `onSelectionChange`, `globalFilterFields` /
 `defaultFilters`, `detailsComponent` (`React.FC<IDetailsComponentProps<T>>` = `{ item, onRefresh? }`),
-`onRefresh`, and the Cratis part props `tablePt: DataTableParts` / `paginatorPt: TablePaginatorParts`
+`onRefresh` (forwarded unchanged to the details component; it never refetches the list),
+`selectionMode='multiple'` with `selectedItems` / `onSelectedItemsChange`, and
+`loadingMessage` / `failureMessage` / `unauthorizedMessage` for query-state rows.
+Use an observable query for a live list; DataPage exposes no snapshot refresh handle.
+Global search uses `globalSearchPlaceholder` / `globalSearchAriaLabel`; paginator
+styling and labels use `paginatorClassName` / `paginatorAriaLabels`. The Cratis part props are `tablePt: DataTableParts` / `paginatorPt: TablePaginatorParts`
 / `menubarPt: ButtonParts` (plus `tableClassName` / `menubarClassName`).
 
 Columns and toolbar actions are compositional children:
@@ -123,15 +163,28 @@ An app does three things, once, at its root — or the components render unstyle
 
 1. **Import the stylesheets, in this order** — components do not import their own CSS:
 
-   ```ts
-   import '@cratis/components/tokens';   // the semantic --cratis-* variables every component reads
-   import '@cratis/components/styles';   // structural rules for every component, in low-priority Cratis layers
-   import '@cratis/components/theme';    // optional: the baseline light/dark look (auto, or `cratis-dark`/`cratis-light`)
+   In `index.css`, imported once by the entry point with `import './index.css'`:
+
+   ```css
+   @import '@cratis/components/tokens';
+   @import '@cratis/components/styles';
+   @import '@cratis/components/theme'; /* optional baseline light/dark look */
    ```
 
+   Direct CSS subpath imports from TypeScript need ambient declarations on TypeScript 6
+   (otherwise TS2882). To reduce the roughly 32 KiB gzip aggregate, replace `styles`
+   with `styles/base` plus the needed `<subpath>/styles` sheets. Area order does not matter.
+
    A product with its own design system omits `theme`, defines the `--cratis-*` variables itself, and imports those values *after* the two Components entries so they win the cascade.
 
-2. **Mount `CratisComponentsProvider`** (from the package root) around the app. Its `value` carries `locale` (BCP 47 — drives dates, numbers, keyboard behavior and announcements) and `messages` (the Components-owned labels for `paginator`, `datePicker`, `dropdown`, `dialog`, `stepper`, `notifications`, `dataTable`, `columnFilter`, `toolbar`); `toaster` mounts the toast region. Renderer keys from Components 3 — `license`, `theme`, `pt`, `ripple`, `unstyled`, z-index — are a **type error**, on purpose. Keep the `value` object stable when it carries a large message catalog.
+2. **Mount `CratisComponentsProvider`** (from the package root) around the app. Its `value` carries `locale` (BCP 47 — drives dates, numbers, keyboard behavior and announcements) and `messages` (the Components-owned labels for `paginator`, `datePicker`, `dropdown`, `dialog`, `stepper`, `notifications`, `dataTable`, `filter`, `columnFilter`, `toolbar`); `icons` replaces the
+   product-wide glyphs (`close`, `remove`, `expand`, `sortAscending`, `sortDescending`,
+   `previous`, `next`, `clear`). Resolution is component prop → provider → built-in;
+   `null` hides only the glyph. `useCratisIcon()` (package root) resolves this vocabulary.
+   `locales` is deprecated; use `messages`. `toaster` accepts `boolean | ToasterProps`
+   and mounts the toast region. Provider props also include `overlayEnvironment`,
+   `rendererSetup` (non-secret booleans), experimental `libraryMode` (`strict` / `degrade`)
+   and `rendererFallback` (`core` / `throw`). Renderer keys from Components 3 — `license`, `theme`, `pt`, `ripple`, `unstyled`, z-index — are a **type error**, on purpose. Keep the `value` object stable when it carries a large message catalog.
 
    ```tsx
    import { CratisComponentsProvider } from '@cratis/components';
@@ -143,6 +196,9 @@ An app does three things, once, at its root — or the components render unstyle
    );
    ```
 
+   Components 4.22.1+ with `theme` imported maps Arc's `--color-error` and
+   `--color-error-bg` in dark schemes; a product theme omitting it must define both.
+
 3. **Install nothing else.** No PrimeReact, no PrimeIcons, no theme preset, no vendor provider. Only if the product wants a vendor's *look* on the nine primitive slots does it install one adapter package and pass its manifest to the provider's `library` prop — and the vendor's own provider, theme and license then stay the application's, outside Components.
 
 ### Writing styles
@@ -178,6 +234,9 @@ See [dialogs.md](./dialogs.md) for the full dialog guide.
 
 Components accepts an **`Icon`** (`@cratis/components/Common`) wherever a control takes an icon: either a React node — preferred — or a complete, consumer-owned icon-font class string. Components installs **no icon font**: a string is rendered on an `<i>` unchanged, so the product must load that stylesheet itself. `react-icons` is a Components dependency and the natural source of React icon nodes (`<FaHouse aria-hidden="true" />`). Not every `icon` prop has that shape — `DataPage.MenuItem.icon` is a React component *type* because the page instantiates it; follow the exported prop type.
 
+Use provider `value.icons` for Components' own glyphs across the product;
+`Dialog.closeIcon`, `TagGroup.removeIcon`, and other component props still win at one site.
+
 For the application's own SVG icons:
 
 - **Distinguish icons from status/interactive components.** A pure SVG icon is a simple presentational element. A component that wraps an icon with interactive behavior (e.g. a dropdown, tooltip, or complex state) is a _component_, not an icon — name it accordingly (e.g. `SliceStatus`, not `SliceStatusIcon`).

package/package/corpus/rules/concepts.md

@@ -84,8 +84,11 @@ public record AuthorId(Guid Value) : EventSourceId<Guid>(Value), IGeneratable<Au
 - The exact `EventSourceId<T>` base supports conversions among its underlying
   `T`, string, typed ID, and untyped `EventSourceId`, but those operators do not
   construct your derived domain record from every source form.
-- String and Guid are the safest round-trip primitives. Other comparable values
-  rely on Chronicle conversion behavior and require focused verification.
+- String and Guid remain the safest stream-id primitives. Chronicle v19.50.0
+  uses invariant numeric conversion, `"O"` for date/time values and `"c"` for
+  TimeSpan (since 19.37.3; `Source/Clients/DotNET/Events/EventSourceId.cs:148-174`).
+  Preserve the old untyped id for streams written under legacy date/time or
+  decimal-comma culture formats; the new conversion can otherwise open a new stream.
 - Pass the identity explicitly to Chronicle append/read operations. Declaring an
   `EventSourceId<T>` property does not select the stream.
 - Do not put `[Key]` or `[Subject]` on an `EventSourceId<T>`-derived member;
@@ -126,4 +129,9 @@ Use GeoJSON types from `Cratis.Geospatial`: `Point` for a location,
 `LineString` for a route, and `Polygon` for an area. Do not use the removed
 experimental `Coordinate` type. Model geospatial absence according to the
 owning domain contract; do not invent a nullable event payload that conflicts
-with Chronicle event rules.
+with Chronicle event rules. TypeScript imports `Point`, `LineString`, `LinearRing`,
+and `Polygon` from `@cratis/fundamentals/geospatial` (verified at 7.23.0).
+The wire shape is GeoJSON, for example
+`{ "type": "Point", "coordinates": [longitude, latitude] }`: longitude first.
+The removal of `Coordinate` in 7.15.1 is a stored-data compatibility break;
+plan a migration rather than assuming the old shape deserializes as GeoJSON.

package/package/corpus/rules/csharp.md

@@ -53,6 +53,8 @@ Every rule here reduces noise. `var` avoids redundant type repetition. Expressio
 - Prefer LINQ (`.Where`, `.Any`, `.Select`, `.FirstOrDefault`) over a `foreach` that filters inside its body with an `if`/`continue` or an early `return` — put the filter in the query so the intent is explicit (`items.Where(predicate)`, `return items.Any(predicate);`). Reserve `foreach` for genuine iteration with side effects. (Filtering inside a loop is what the analyzers flag as a "missed opportunity to use Where".)
 - Don't use regions — they hide code instead of organizing it. If a file needs regions, it needs refactoring.
 - Never add postfixes like `Async`, `Impl`, `Service` to class names — they add noise without information.
+- Name a method without the `Async` suffix unless a synchronous method of the same name also exists, never write an explicit `private` modifier (property setters excepted), and never put a `.Features.` segment in a namespace.
+- The `Cratis.Architecture.CodeAnalysis` analyzer package (26 diagnostics, `CRARCH0001`–`CRARCH0026`; verified at `v1.0.2`) enforces these and others: `CRARCH0003` postfixes, `0004` `.Features.` namespaces, `0005` regions, `0006`/`0024` `LoggerMessage`, `0007` `IServiceProvider` injection, `0008` `is null`, `0017` namespace matches folder, `0019` `Async` suffix, `0022` explicit `private`, `0023` typed logger category; `0012` (`async void`) and `0014` (test types in production) are errors. When a repository has the package, a `CRARCH` warning is the house convention, not noise.
 - For types with no implementation body, omit the braces (e.g. `public interface IMyInterface;`).
 - Prefer `record` types for immutable data structures (events, commands, read models, concepts) — they give you value equality, immutability, and concise syntax for free.
 
@@ -306,7 +308,7 @@ public class ReactorSideEffectHandlers(IInstancesOf<IReactorSideEffectHandler> h
 
 - Never inject `IEnumerable<TInterface>` to enumerate implementations of an abstraction. That signature only works if every implementation is hand-registered, which defeats convention-based discovery. Use `IInstancesOf<TInterface>` instead.
 - Never write `services.AddSingleton<TInterface, Impl>()` or `services.AddTransient<TInterface, Impl>()` for a type that exists to be discovered. Mark the implementation with `[Singleton]` (for singletons) or rely on the `IFoo → Foo` convention (for transients) and remove the registration line.
-- `IInstancesOf<T>` resolves at the point of access — implementations added later in the assembly become available without touching the consumer or any composition root.
+- `IInstancesOf<T>` fixes its type set at construction and resolves instances on each enumeration through the consumer's service provider (Fundamentals 7.23.0). It does not discover late-loaded implementations on access. A singleton consumer captures the root provider; it must not enumerate scoped implementations. Resolve a scoped or transient consumer inside a scope when any implementation is scoped.
 - `IEnumerable<T>` is still the right type to **return** from a method that yields a sequence of values. The rule applies only when the goal is to enumerate **implementations** of an abstraction.
 
 ## Logging

package/package/corpus/rules/dialogs.md

@@ -250,6 +250,9 @@ Use `buttons={null}` for dialogs that contain their own internal actions (e.g. a
 | Prop | Type | Notes |
 |---|---|---|
 | `title` | `string` | Header text |
+| `subtitle` | `ReactNode` | Secondary header content |
+| `placement` | `'center' \| 'start' \| 'end'` | Defaults to center; start/end are RTL-aware side sheets |
+| `closeIcon` | `ReactNode` | Header dismissal glyph; `null` hides only the glyph |
 | `visible` | `boolean` | Controlled open state; defaults to `true` |
 | `buttons` | `DialogButtons \| ReactNode \| null` | Prefer `DialogButtons` enum; `null` for no footer |
 | `isValid` | `boolean` | Disables the confirm button when `false` |
@@ -265,4 +268,10 @@ Use `buttons={null}` for dialogs that contain their own internal actions (e.g. a
 | `style` / `contentStyle` / `className` | | Modal-root and content-region styling |
 | `pt` | `DialogParts` | Per-part attributes: `backdrop`, `positioner`, `root`, `header`, `title`, `close`, `content`, `footer`, `confirm`, `cancel` |
 
+`CommandDialog` forwards these Dialog presentation props (since Components 4.14.1).
+It also accepts `confirmBeforeExecute(values) => boolean | Promise<boolean>`:
+after validation and `onBeforeExecute`, only `true` executes. Fields are disabled
+while confirmation is pending; changed command values discard approval without executing.
+This is a pre-execution gate, unlike the post-success `onConfirm` close gate.
+
 `resizable`, `ptOptions` and `unstyled` are accepted for source compatibility and do nothing. There is no `modal`, `draggable`, `footer` or `onHide` — the dialog is always modal, the footer comes from `buttons`, and closing is reported through `onCancel`/`onClose`. Style the dialog through its parts (`pt`, or `[data-cratis-part='root']` selectors), never through React Aria class names.

package/package/corpus/rules/efcore.md

@@ -75,7 +75,7 @@ Where a repository organizes its migrations (a dedicated project, a versioned fi
 
 ## Observation **[contract]**
 
-An EF Core read model can back an observable query: `dbSet.Observe(...)`, `ObserveById(...)` and `ObserveSingle(...)` (extension methods declared in the `Microsoft.EntityFrameworkCore` namespace, so they are in scope wherever the `DbSet` is) push changes through the provider's change notifier — see the skill for what each provider supports.
+An EF Core read model can back an observable query: `dbSet.Observe(...)`, `ObserveById(...)` and `ObserveSingle(...)` (extension methods declared in the `Microsoft.EntityFrameworkCore` namespace, so they are in scope wherever the `DbSet` is) push changes through the provider's change notifier — see the skill for what each provider supports. At Arc v22.75.0 auxiliary sources support `ignoreQueryContext: true`; single-instance observations emit `default` on absence/deletion/filter exit. Indexer-property keys are supported; composite/shadow-only keys are refused at setup.
 
 ## See also
 

package/package/corpus/rules/elixir.md

@@ -0,0 +1,49 @@
+---
+applyTo: "**/*.ex,**/*.exs"
+paths:
+  - "**/*.ex"
+  - "**/*.exs"
+---
+
+<!-- Copyright (c) Cratis. All rights reserved. -->
+<!-- Licensed under the MIT license. See LICENSE file in the project root for full license information. -->
+
+# Elixir Conventions
+
+Use Elixir and OTP idioms, not translated C# or JVM shapes. These conventions
+are grounded in `Cratis/Chronicle.Elixir v3.10.2` (`Source/chronicle/mix.exs`,
+`.formatter.exs`, and `lib/chronicle/`). Client-specific APIs belong in the
+**cratis-chronicle-client-elixir** skill.
+
+## Build and format
+
+- For Chronicle 3.10.x use Elixir 1.18 or later (`~> 1.18`).
+- Run `mix compile --warnings-as-errors`, `mix test`, and
+  `mix format --check-formatted` with the project's formatter inputs.
+- Use two-space indentation and let `mix format` own layout.
+- Chronicle exports no `locals_without_parens` formatter configuration. Accept
+  parentheses around its DSL calls; do not assume `import_deps` supplies them.
+
+## Code shape
+
+- PascalCase module names; snake_case functions, variables and struct fields.
+- Use structs for event/read-model data and pattern-matching clauses for
+  dispatch. Schema-bearing structs need typed defaults; `nil` is not a type
+  declaration and registers as string in this client.
+- Preserve tagged results such as `:ok`, `{:ok, value}`, and `{:error, reason}`.
+  Handle expected remote failures explicitly rather than using a success-only
+  match in a long-lived process.
+- Put long-lived processes under the application's supervision tree. Wait for
+  actual client readiness, not merely a successful supervisor start.
+- Process-local context is not inherited by `Task` processes; pass required
+  context explicitly at that boundary.
+- Document public APIs with `@moduledoc`, `@doc`, and `@spec`; use `Logger` for
+  operational logging and keep credentials out of messages and crash reports.
+- Use American English in identifiers, comments and documentation.
+
+Every `.ex` and `.exs` source file starts with:
+
+```elixir
+# Copyright (c) Cratis. All rights reserved.
+# Licensed under the MIT license. See LICENSE file in the project root for full license information.
+```

package/package/corpus/rules/framework.md

@@ -21,9 +21,11 @@ Skip these `profile: application` rules entirely when in a framework repo: `vert
 
 Each framework repo is organized by what it builds, not by feature slices:
 
-- **Fundamentals** — the base library. `ConceptAs<T>`, type discovery (`IInstancesOf<T>` / `IImplementationsOf<T>`), serialization, common primitives. `Source/DotNET` (C#) + `Source/JavaScript` (`@cratis/fundamentals`) + the shared ESLint config.
+- **Fundamentals** — the base library. `ConceptAs<T>`, type discovery (`IInstancesOf<T>` / `IImplementationsOf<T>`), serialization, common primitives. `Source/DotNET` includes `Fundamentals.TypeDiscovery.Generator`, `Metrics.Roslyn` (`Cratis.Metrics.Roslyn`) and `OpenTelemetry` (`Cratis.OpenTelemetry`); `Source/JavaScript` publishes `@cratis/fundamentals`, and `Source/ESLintConfig` publishes `@cratis/eslint-config` (verified at v7.23.0).
+- **Specifications** — BDD lifecycle, assertions and analyzers. `Source/Specifications` supplies common helpers, `Source/XUnit` and `Source/NUnit` supply runner-specific bases/assertions, and `Source/CodeAnalysis` supplies the bundled analyzers (v4.1.1).
+- **Orleans** — shared silo hosting, grain serializers, jobs and jobs storage (MongoDB/SQL/in-memory), in `Cratis.Orleans*` packages (v1.16.3). The core does not require Chronicle; the optional `.Chronicle` adapter does.
 - **Arc** — the CQRS + model-binding + proxy-generation engine. `Source/DotNET` (the command/query pipeline, validation, authorization, identity, the Roslyn **proxy generator**) + `Source/JavaScript` (`@cratis/arc`, `@cratis/arc.react`, `@cratis/arc.react.mvvm`). Arc.Core does **not** depend on Chronicle.
-- **Chronicle** — the event-sourcing engine. `Source/Kernel` (the engine: **Orleans grains**, event sequences, observers/projections/reducers, storage providers — MongoDB and others), `Source/Clients` (the client SDKs incl. `DotNET` and `Testing`), `Infrastructure`, `Tools`, `Workbench`. The kernel is the deep, performance- and consistency-critical core.
+- **Chronicle** — the event-sourcing engine. `Source/Kernel` (the engine: **Orleans grains**, event sequences, observers/projections/reducers, storage providers — MongoDB and others), `Source/Clients` (the client SDKs incl. `DotNET` and `Testing`), `Infrastructure`, `Tools`, `Workbench`. The kernel is the deep, performance- and consistency-critical core. Its shared job engine, jobs storage, serializers and reusable silo hosting now come from the separate **Orleans** repo, not Chronicle-owned jobs code (Chronicle v19.50.0).
 - **Components** — the React component library (Components-owned markup and styling contract; React Aria internally; optional PrimeReact/MUI presentation adapters under `Adapters/`). `Source/<Component>/` folder per component (`CommandDialog`, `DataPage`, `DataTables`, …) with Storybook stories; published as `@cratis/components`. (Application rules *consume* these components; here you *build* them.)
 
 Repo conventions follow from this: `Source/DotNET` + `Source/JavaScript` for dual-stack libraries; `Kernel` vs `Clients` for Chronicle; a folder-per-component library layout for Components. Match the structure of the area you are editing — do not introduce app-style layouts.
@@ -32,7 +34,7 @@ Repo conventions follow from this: `Source/DotNET` + `Source/JavaScript` for dua
 
 - **Public API design is the product.** These libraries are consumed by every Cratis app, so the **Lovable APIs** value (`general.md`) is paramount: sane defaults, convention over configuration, extensible/overridable, minimal boilerplate. Design the API the app developer will love before the implementation.
 - **Backward compatibility is a contract.** A change to a public type, attribute, interface, or generated-proxy shape is a breaking change for every downstream app — label PRs by semver impact (`major`/`minor`/`patch`) and treat removals/renames of public surface as `major`.
-- **Convention discovery is built here.** `IInstancesOf<T>` / `IImplementationsOf<T>`, attribute-based discovery, and source generation are the mechanisms the framework *provides*; use them internally too rather than hand-registration where a convention fits.
+- **Convention discovery is built here.** `IInstancesOf<T>` / `IImplementationsOf<T>`, attribute-based discovery, and source generation are the mechanisms the framework *provides*; use them internally too rather than hand-registration where a convention fits. A Fundamentals project reference does not carry the type-discovery analyzer like its NuGet package does: reference `Fundamentals.TypeDiscovery.Generator` explicitly, or your project's types may be absent from the generated universe.
 - **Source generators / analyzers** (Arc's proxy generator, Fundamentals) follow Roslyn conventions; their output is consumed verbatim by apps, so treat generated shape as public API.
 - **Orleans grains** in the Chronicle kernel follow `orleans.md`.
 - **An alternate implementation of an interface must match the primary one's *semantics*, not just its signature.** Chronicle ships several implementations of the same storage interfaces (MongoDB, SQL, in-memory) and the in-memory ones exist precisely so the real kernel code paths can run without infrastructure. When you touch one, **diff it against the persistent implementations** — the signature tells you nothing about the contract. The specific trap: query criteria carry **sentinels meaning "do not narrow"** (`EventSourceId.Unspecified`, `EventSourceType.Unspecified`/`Default`, `EventStreamType.All`, `EventStreamId.Default`, an empty event-type set). Callers asking for "everything" pass those sentinels, never `null`, so a plain `is not null` check narrows every row away and the read silently returns nothing. A divergence here does not fail — it makes specs pass vacuously, which is worse.

package/package/corpus/rules/general.md

@@ -130,6 +130,7 @@ A claim is only as good as the signal behind it — a build result, a test run,
 | **Contributing to a Cratis framework repo** (framework profile) | `framework.md`; creating a repository in the Cratis organization: `new-repository-intake.md` |
 | Slice anatomy (commands, `Provide()`, validators, events, projections, read models, reactors, constraints, compliance, cross-slice) | `vertical-slices.md` |
 | C# / TypeScript style | `csharp.md`, `typescript.md` |
+| Go style, source and module files | `go.md`; framework contributors also read `go-engineering.md`; product APIs use `cratis-chronicle-client-go`, `cratis-arc-go` and `cratis-fundamentals-concept-go` |
 | Service lifetimes — why anything taking a scoped dependency is scoped or transient, never a singleton | `csharp.md` |
 | React + Arc + Cratis Components + MVVM + dialogs | `react.md`, `components.md`, `dialogs.md` |
 | Frontend engineering quality & testing | `frontend-quality.md`, `frontend-testing.md`, `storybook.md` |

package/package/corpus/rules/glossary.md

@@ -23,7 +23,7 @@ One precise line per load-bearing term, so the same word means the same thing ev
 - **Projection** — declares how a read model is built by consuming **events** (model-bound attributes, or fluent `IProjectionFor<T>`); pure events→state, no side effects, never reads other read models.
 - **Reducer** — `IReducerFor<T>`; a "current state + event → next state" read-model builder; the last-resort escape hatch when projections can't express the transition.
 - **Reactor** — `IReactor`; observes events and produces **side effects** (notifications, commands, follow-up events). The "if this then that".
-- **Observer** — Chronicle's umbrella for anything consuming an event sequence (projection, reducer, reactor); carries subscription / replay / **quarantine** state.
+- **Observer** — Chronicle's umbrella for anything consuming an event sequence (projection, reducer, reactor); carries subscription / replay / **quarantine** state. Projection replay and catch-up each walk the sequence in one globally ordered job step; a new catch-up failure stops that step. Full replay is inactive and completion does not resume a quarantined observer (Chronicle v19.50.1, `Documentation/concepts/observers.mdx`, `Observation/Jobs/{CatchUpObserver,ReplayObserver}.cs` under `Source/Kernel/Core/`).
 - **Sink** — where a read model is persisted (MongoDB, EF Core).
 - **AutoMap** — Chronicle's on-by-default mapping of matching event→read-model property names; **never call `.AutoMap()`**.
 - **Query** — a `static` method on a `[ReadModel]`; returns derived state, **snapshot** (one-shot) or **observable** (live).
@@ -34,8 +34,8 @@ One precise line per load-bearing term, so the same word means the same thing ev
 - **Provide()** — the command method that fetches/computes data after validation/authorization and before `Handle()`; may short-circuit with a `ValidationResult`.
 - **Causation chain** — the ordered links saying how an append came about (root process → command → …), each carrying properties. A command records its **name and its property values** there, so an event says what the command was asked to do; the chain lives in the event log and is as permanent as the events.
 - **Constraint** — `IConstraint`; an **append-time** invariant (uniqueness / concurrency) enforced at the event-store level.
-- **DCB (Dynamic Consistency Boundary)** — enforcing a state-dependent rule **under concurrency** by injecting the read model into `Handle()` and returning `Result<TEvent, ValidationResult>`.
-- **Consistency boundary** — the scope within which an invariant holds atomically (an event source, or the read model a DCB rule inspects).
+- **DCB (Dynamic Consistency Boundary)** — enforcing a state-dependent rule under concurrency over explicitly enrolled event-state reads: stream decisions/exact scopes or protected, admitted projection decision reads. Plain injected models and `Result<TEvent, ValidationResult>` alone are advisory, not a guard.
+- **Consistency boundary** — the scope within which an invariant holds atomically (an event source, a routed stream, or the event state enrolled by an admitted protected decision read).
 - **EventForEventSourceId** — self-describing wrapper to append an event to a **specific** (cross-stream) event source, from a command `Handle()` or from a reactor handler (reactor support has shipped since Chronicle 15.35). It carries the event stream type and id, source type, subject, occurred time, tags and causation, so it is also how a reactor sets those explicitly.
 - **ReactorDelivery** — the identity of one delivery of one event to one reactor partition; declare it as a handler parameter and Chronicle passes it in. Stable across a replay and across recovering a failed partition, so a receipt kept under its `Id` is what makes a side effect survive re-delivery. An identity, not a guarantee — Chronicle does not know whether the effect ran.
 
@@ -53,7 +53,7 @@ One precise line per load-bearing term, so the same word means the same thing ev
 - **`[PII]`** — marks an inherently personal value so Chronicle can manage/erase it.
 - **`[NotAudited]`** — an **Arc** marking (`Cratis.Arc.Chronicle.Commands`, not a Chronicle type) for a value that is secret but *not* personal data (password, token, API key), so it is never written to the causation chain. Withholds only; it does not encrypt the value, so pair it with `[Encrypted]` for an operational secret. It never enrolls a value in erasure the way Chronicle's `[PII]` does.
 - **`[Encrypted]`** — a Chronicle marking (`Cratis.Chronicle.ProtectedValues`, Chronicle 19.32.0+) that encrypts an **operational secret** (API key, token, a company's bank account number) at rest on the event, without erasure. It does not keep a command input off the causation chain, so a secret gets `[Encrypted]` **plus** `[NotAudited]`. Never combine it with `[PII]` (`CHR0053`); never put it on an event source id (`CHR0052`).
-- **`[OnceOnly]`** — marks a reactor handler (or the whole reactor class) as non-replayable: Chronicle skips it for every event arriving as part of a **replay** — observer rewind, redaction, revision. Replay-exclusion only, not exactly-once and not per-event-source deduplication; recovering a failed partition re-delivers the event as an ordinary observation and the handler runs again. Use a `ReactorDelivery` receipt for that case.
+- **`[OnceOnly]`** — marks a reactor handler (or the whole reactor class) as non-replayable: Chronicle skips it for every event arriving as part of a **replay** — observer rewind, redaction, revision. Replay-exclusion only, not exactly-once, not a per-event-source run limit or deduplication; ordinary catch-up, crash redelivery and failed-partition recovery can run the handler again (Chronicle v19.50.1, `Documentation/code-analysis/CHR0022.mdx`). Use a `ReactorDelivery` receipt for that case.
 - **Namespace / tenant** — Chronicle isolates tenants by **namespace**; each namespace has its own events, observers, and read models.
 
 ## Profiles

package/package/corpus/rules/go-engineering.md

@@ -0,0 +1,60 @@
+---
+profile: framework
+applyTo: "**/*.go,go.mod,go.sum,**/go.mod,**/go.sum"
+paths:
+  - "**/*.go"
+  - "go.mod"
+  - "go.sum"
+  - "**/go.mod"
+  - "**/go.sum"
+---
+
+<!-- Copyright (c) Cratis. All rights reserved. -->
+<!-- Licensed under the MIT license. See LICENSE file in the project root for full license information. -->
+
+# Go framework parity and module releases
+
+`cratis/engineering/go` composes the Go language profile. Repository-owned
+context, not this rule, defines module paths, layout, quality-gate commands,
+release configuration and the exact C# parity target.
+
+## Preserve the product contract
+
+Before changing a Go port, inspect its owning C# API, implementation and tests
+at the parity target revision. Translate concepts idiomatically, not literally:
+context plus errors, constructors/options, explicit registration, named values
+and deliberate stream lifetimes. Do not change sibling implementations to
+accommodate the port.
+
+Preserve routes, verbs, camelCase JSON where contracted, envelopes, UUID byte
+order/encoding, protobuf fields and RPCs, tenancy, event ordering, retry and
+checkpoint semantics. Record each deliberate divergence in repository-owned
+parity documentation with source path/revision, Go surface, status, executable
+evidence and caller migration implications. A compilation check is not wire,
+streaming or lifecycle parity. Unsupported behavior fails explicitly, never as
+no-op success. Keep a limited conformance result limited; do not claim whole-product parity.
+
+## Release compatibility
+
+- Review signatures, interface growth, public struct comparability, wrapped
+  errors, defaults and wire behavior. API-diff tools supplement consumer tests.
+- Experimental v0 breaking APIs require a **minor** bump and migration notes,
+  not a patch. From v1, incompatible APIs need a planned major version.
+- Apply exactly one release-intent label under the repository's PR policy.
+  Check how its configured `Cratis/release-action` maps v0 changes before release.
+- Root modules use immutable `vX.Y.Z` tags created through the configured
+  release-action workflow. Do not create duplicate manual releases or move tags.
+  Nested modules need their own explicitly reviewed tag policy.
+- Plan `/v2` migrations across the module directive, imports, examples, consumers
+  and parallel support. Neither v0 nor v1 gets a `/v0` or `/v1` suffix.
+- Correct a bad release with a new release and, when appropriate, documented
+  retractions in a newer published version. Retraction does not erase downloads
+  or prohibit an explicit request for the old version.
+- Verify release consumption without local workspace/replacement assistance.
+  Source/tag availability, module download, consumer compilation and proxy/pkg.go.dev
+  indexing are separate results. Indexing delay never justifies retagging.
+
+Adapted from the repository-owned
+[Chronicle.Go parity rule](https://github.com/Cratis/Chronicle.Go/blob/v0.9.1/.cratis/ai/rules/go-cratis-parity.md)
+and [repository-owned module release guidance](https://github.com/Cratis/Chronicle.Go/tree/v0.9.1/.cratis/ai/skills),
+with repository-specific paths and commands removed.