@cratis/pi 7.34.1 → 7.35.0

package/package/corpus/skills/cratis-chronicle-client-typescript/references/testing.md

@@ -0,0 +1,126 @@
+<!-- Copyright (c) Cratis. All rights reserved. -->
+<!-- Licensed under the MIT license. See LICENSE file in the project root for full license information. -->
+
+# Testing without a kernel
+
+## Contents
+
+- Appends — EventScenario
+- Deliveries — ReactorScenario
+- Materialization — ReadModelScenario
+- Use kernel-backed tests outside the boundary
+
+Verified at `Cratis/Chronicle.TypeScript` **v6.51.0**:
+`Source/testing/index.ts`, `EventScenario.ts`, `ReactorScenario.ts`,
+`ReadModelScenario.ts`, and `Documentation/testing.md`.
+Import the three scenarios from `@cratis/chronicle/testing`. They share
+production dispatch/definition code within a **fixture-bounded** evaluator;
+a green scenario is not proof of kernel storage, scheduling or compliance.
+
+The examples below share these standard-decorator artifacts:
+
+```typescript
+// Copyright (c) Cratis. All rights reserved.
+// Licensed under the MIT license. See LICENSE file in the project root for full license information.
+
+import 'reflect-metadata';
+import { field } from '@cratis/fundamentals';
+import { eventType, fromEvent, reactor } from '@cratis/chronicle';
+import { EventScenario, ReactorScenario, ReadModelScenario } from '@cratis/chronicle/testing';
+
+@eventType()
+class MessageRecorded {
+    @field(String) text: string;
+    constructor(text: string) { this.text = text; }
+}
+
+@fromEvent(MessageRecorded)
+class Message {
+    @field(String) id = '';
+    @field(String) text = '';
+}
+
+@eventType()
+class MessageCopied {
+    @field(String) text: string;
+    constructor(text: string) { this.text = text; }
+}
+
+@reactor()
+class CopyMessage {
+    messageRecorded(event: MessageRecorded): MessageCopied {
+        return new MessageCopied(event.text);
+    }
+}
+```
+
+## Appends — EventScenario
+
+```typescript
+const events = new EventScenario({
+    artifacts: { eventTypes: [MessageRecorded] }, constraints: 'disabled'
+});
+await events.given.forEventSource('message-1').events(new MessageRecorded('seed'));
+const result = await events.when.forEventSource('message-2').event(new MessageRecorded('act'));
+if (!result.isSuccess) throw new Error('Expected the append to succeed');
+```
+
+`given...events` seeds sequential single appends; `when.event` is a single
+append and `when.events` an atomic batch. `forEventSource(id, options?)` accepts
+fixture-backed routing. Omitted routes resolve to `Default`/`All`/`Default`.
+`constraints: 'disabled'` is explicit opt-out, never a silent fallback.
+Selected `@unique`/fluent constraints support fixture-proven key domains,
+removal cycles and scopes; unproven shapes throw.
+
+## Deliveries — ReactorScenario
+
+```typescript
+const deliveries = new ReactorScenario(CopyMessage, {
+    artifacts: { eventTypes: [MessageRecorded, MessageCopied] }, constraints: 'disabled'
+});
+await deliveries.when.forEventSource('message-3').events(new MessageRecorded('copy'));
+deliveries.shouldHaveProduced(MessageCopied, event => event.text === 'copy');
+```
+
+Returned events are **recorded, not appended or recursively delivered**. A
+production reactor returning its own subscribed type may loop; the scenario
+does not test termination. `produced`, `sideEffects` and `results`
+expose observations. Failed deliveries reject the call and prevent subsequent
+deliveries; retries/checkpoints are not simulated. Content is client-serialized
+JSON, not necessarily kernel-normalized content. Explicit non-subscribed
+service appends enter history but are not delivered to observers.
+
+## Materialization — ReadModelScenario
+
+```typescript
+const models = new ReadModelScenario(Message);
+models.given.forEventSource('message-4').events(new MessageRecorded('read'));
+const message = await models.instanceForEventSourceId('message-4');
+if (message?.text !== 'read') throw new Error('Expected the materialized message');
+```
+
+`instance` requires a sole model; `instanceForEventSourceId` returns null when
+absent, and `wasDeletedForEventSourceId` distinguishes deletion. For composition,
+use `new ReadModelScenario(Message).observe(events)` (or a ReactorScenario).
+Every read replays the source's accepted history; returned reactor effects do
+not reach it. Do not mix observing and seeding or observe twice.
+
+Reducers and fixture-backed projections work: scalar root mappings/AutoMap,
+removal/recreation, bounded root arithmetic, one level of typed string-keyed
+children, and one string-keyed root join. The **whole** definition is validated
+before replay, even for events you never seed.
+
+## Use kernel-backed tests outside the boundary
+
+`UnsupportedEventSequenceOperation`, `UnsupportedReactorOperation`, and
+`UnsupportedProjectionOperation` name the operation/artifact and require a
+kernel-backed test. Do not catch them and call the scenario green.
+
+Unsupported examples include non-fixture-backed constraints, concurrency,
+transactions, compliance, named tags on input appends, tag-filtered reactors,
+replay/redelivery, nested children, child/nested joins, `removedWithJoin`,
+variants and custom/composite keys. Named tags on returned reactor effects can
+be recorded, but are not proof of persisted named-tag behavior. Nondefault
+routes cannot be evaluated by ReadModelScenario. Read the tagged
+`Documentation/testing.md` capability tables before claiming an advanced shape
+is covered; use a live kernel for storage and observer fidelity.

package/package/corpus/skills/cratis-chronicle-client-typescript/references/variants.md

@@ -1,8 +1,8 @@
 ## Variants — mutually exclusive read models for one entity's lifecycle
 
-> Requires `@cratis/chronicle` `6.2.0` or later — newer than this skill's
-> `5.1.0` baseline (`Source/projections/VariantReclassifier.ts` and siblings).
-> Reverify before claiming support; take the version from npm.
+> Available since `@cratis/chronicle` 6.2.0; verified at **v6.51.0**
+> (`Source/projections/VariantReclassifier.ts` and model-bound decorators).
+> Read models are inferred; use `static readModelId` for a custom id.
 
 Some entities do not have one shape for their whole lifetime — a work item is a
 backlog entry until a pull request exists for it, then it is a pull request
@@ -16,7 +16,6 @@ class WorkItem {}   // anchors the group; not itself a read model
 @variantOf(WorkItem, 'id')
 @entersOn(IssueCreated)
 @fromEvent(IssueCreated)
-@readModel()
 class BacklogItem {
     id = '';
     @setFrom(IssueCreated, 'title') title = '';
@@ -26,7 +25,6 @@ class BacklogItem {
 @entersOn(PullRequestCreated)
 @fromEvent(PullRequestCreated)
 @fromEvent(BuildCompleted)          // not the entering event -> update-only join
-@readModel()
 class PullRequestItem {
     id = '';
     @setFrom(PullRequestCreated, 'pullRequestUrl') pullRequestUrl = '';

package/package/corpus/skills/cratis-chronicle-client-typescript/verification.json

@@ -0,0 +1,19 @@
+{
+  "skill": "cratis-chronicle-client-typescript",
+  "input": "Append a routed event and specify a TypeScript Chronicle reactor without a kernel.",
+  "fixtures": [],
+  "assertions": [
+    { "kind": "skill-contains", "value": "tag **`v6.51.0`**" },
+    { "kind": "skill-contains", "value": "**Single `append()` supports routing and subject options.**" },
+    { "kind": "skill-contains", "value": "Standard TC39 decorators" },
+    { "kind": "skill-contains", "value": "**A compiled-JS entry defaults to `[]`.**" },
+    { "kind": "skill-contains", "value": "IncompatibleChronicleServer" },
+    { "kind": "skill-contains", "value": "installed package version" },
+    { "kind": "skill-contains", "value": "**Reactors replay by default since 6.9.0.**" },
+    { "kind": "skill-contains", "value": "@handles(EventType)" },
+    { "kind": "skill-contains", "value": "Returns **null when absent**", "file": "references/read-models-and-projections.md" },
+    { "kind": "skill-contains", "value": "`@unique()`", "file": "references/read-models-and-projections.md" },
+    { "kind": "skill-contains", "value": "**recorded, not appended or recursively delivered**", "file": "references/testing.md" },
+    { "kind": "skill-contains", "value": "UnsupportedProjectionOperation", "file": "references/testing.md" }
+  ]
+}

package/package/corpus/skills/cratis-chronicle-compliance/SKILL.md

@@ -17,8 +17,8 @@ This skill is verified against this exact public release:
 
 | Package | Version | Purpose |
 | --- | --- | --- |
-| `Cratis.Chronicle` | `18.3.0` | `Cratis.Chronicle.Compliance.GDPR`, `Cratis.Chronicle.SubjectAttribute`, `IEventSequence.Redact`, `IReadModels.Release` |
-| `Cratis.Chronicle.CodeAnalysis` | `18.3.0` | `CHR0026`, `CHR0034`, `CHR0035`, `CHR0043`, `CHR0046` |
+| `Cratis.Chronicle` | `19.50.1` | `Cratis.Chronicle.Compliance.GDPR`, `Cratis.Chronicle.SubjectAttribute`, `IEventSequence.Redact`, `IReadModels.Release` |
+| `Cratis.Chronicle.CodeAnalysis` | `19.50.1` | `CHR0026`, `CHR0034`, `CHR0035`, `CHR0043`, `CHR0046` |
 
 Reverify product sources before claiming support for another version.
 
@@ -58,10 +58,10 @@ it.** The rationale that actually reaches the event schema comes from
 marker and `[ComplianceDetails("...")]` for the reason; do not write
 `[PII("reason")]` and expect the reason to be recorded.
 
-`PII` is the only compliance category Chronicle defines — there is exactly one
-well-known `ComplianceMetadataType`. Chronicle has no `[Redact]`, `[Erase]`,
-`[Anonymize]`, `[Encrypt]`, or `[NotAudited]` attribute; do not write one into
-an example. Redaction is an API call, not an annotation.
+`PII` is the only compliance category Chronicle defines. The protection markers
+are `[PII]` for personal data and `[Encrypted]` for retained operational secrets;
+there is no `[Redact]`, `[Erase]`, `[Anonymize]`, or `[Encrypt]` annotation.
+Redaction is an API call. `[NotAudited]` belongs to Arc, not Chronicle.
 
 `[Encrypted]` (`Cratis.Chronicle.ProtectedValues`, Chronicle 19.32.0+) is a
 security marker, not a compliance category: it encrypts an operational secret
@@ -70,6 +70,11 @@ and no erasure. Never put it on a value that is also `[PII]` (analyzer
 **CHR0053**, which `[PII]` alone already covers), nor on an event source id
 (**CHR0052**). Arc's `[NotAudited]` is not a Chronicle attribute either; a secret
 that is also a command property takes both `[Encrypted]` and `[NotAudited]`.
+`EncryptedAttribute.Scope` supports `EncryptionScope.Subject` (default),
+`Namespace`, and `Global`; these are security-key scopes, not PII erasure.
+`PIIManager` refuses to delete security keys. Custom security metadata providers
+live in `Cratis.Chronicle.Confidentiality` (`ICanProvideSecurityMetadataForType`
+and `ICanProvideSecurityMetadataForProperty`).
 
 Mark only genuinely personal values. Business metadata, identifiers of
 non-persons, and amounts stay unmarked — every marked value costs an encryption
@@ -152,9 +157,11 @@ What this does and does not do:
   recorded before any key is deleted.
 - The events stay in the log. Their `[PII]` values remain as unreadable
   ciphertext — this is crypto-shredding, not deletion.
-- Reading an erased value yields an **empty string** rather than an exception,
-  so queries and read models over an erased subject keep working. An erased
-  container value comes back as an empty object or array.
+- Released values depend on the schema: string → empty string; non-nullable
+  number/boolean → `0`/`false`; nullable number/boolean → `null`; collection →
+  empty collection; object/value object → empty object. An erased `0`, `false`
+  or empty string is indistinguishable from a genuinely recorded one.
+  Source at v19.50.0: `Documentation/compliance/erasing-a-subject.mdx`.
 - Appending a new `[PII]` value for an erased subject **fails** with
   `EncryptionKeyErased`. It does not quietly mint a new key. Call
   `AllowNewEncryptionKeyFor` deliberately if the subject must be re-enrolled.
@@ -162,9 +169,10 @@ What this does and does not do:
   carries the individual failures. Treat it as unfinished and retry — the fence
   is already in place, so retrying is safe.
 
-**Erasure is scoped to one namespace.** There is no cross-namespace erasure. In
-a multi-tenant deployment, an erasure request that spans tenants is one call per
-tenant namespace, and completing only some of them is an incomplete erasure.
+**Erasure covers every event store in one namespace**, not just the store from
+which `PII` was resolved: forwarding copies subject keys within that namespace.
+There is no cross-namespace erasure. A request spanning tenants is one call per
+tenant namespace; completing only some is an incomplete erasure.
 
 ## Redact a stored event
 
@@ -184,6 +192,21 @@ Use redaction for content that should never have been appended. Use key erasure
 for a subject exercising a right to erasure. They are different mechanisms and
 one does not imply the other.
 
+Since 19.11.0, redaction also drops retained causation property values, revision
+history and content hashes. It does not reach backups, oplogs or events already
+forwarded elsewhere. Subject erasure does **not** erase causation values: these
+are not encrypted under the subject key. Kernel configuration
+`events.causationPropertyRetention = Omit`
+(`Cratis__Chronicle__Events__CausationPropertyRetention`) prevents **new** retention
+on appends, forwarding, revisions and redactions; it does not rewrite history.
+Source at v19.50.0: `Documentation/hosting/configuration/events.md` and
+`Documentation/compliance/erasing-a-subject.mdx`.
+
+Adding `[PII]` / `[Encrypted]` to an existing generation is accepted with a warning
+and protects **later events only**. Revision and migration fail rather than
+persist empty substitutes when key lookup/decryption fails; an erased subject
+migrates as erased. Do not confuse that fail-closed write path with read release.
+
 ## Read personal data back
 
 The kernel decrypts on the paths it owns, so projections and observers see plain
@@ -211,7 +234,7 @@ compliance setup — `AddCompliance()` is already called for you, and the raw
 client path discovers the metadata providers by convention. The developer-facing
 requirement is only to annotate the types.
 
-Key storage is a hosting decision, not an application one. Chronicle ships
+Key storage is per namespace and is a hosting decision, not an application one. Chronicle ships
 MongoDB (the default), SQL, in-memory, HashiCorp Vault, and Azure Key Vault key
 storage, configured under `Cratis:Chronicle:Compliance:Encryption`.
 

package/package/corpus/skills/cratis-chronicle-decision-reads/SKILL.md

@@ -0,0 +1,110 @@
+---
+name: cratis-chronicle-decision-reads
+description: Guard a state-dependent Chronicle decision with IDecisionReads, projection admission, ambient unit-of-work enrollment and commit conflict handling. Use when an append must remain valid for the facts read, when choosing whole-source versus stream-scoped reads, or diagnosing DecisionReadRefused and scope conflicts. Do not use for ordinary query reads, append-time uniqueness alone, or defining an Arc command's ProtectedDecision API.
+license: MIT
+---
+
+<!-- Copyright (c) Cratis. All rights reserved. -->
+<!-- Licensed under the MIT license. See LICENSE file in the project root for full license information. -->
+
+# Guard the facts a decision used
+
+A fresh read is not enough: another writer can change its facts between reading
+and appending. A decision read folds an admitted projection from events and
+carries a guard to commit. The append is rejected when a later event inside that
+guard could change the decision. This is the Chronicle side of a dynamic
+consistency boundary (DCB), not authorization or a replacement for unique constraints.
+
+## Verified product sources
+
+| Product | Version | Sources |
+| --- | --- | --- |
+| `Cratis.Chronicle` | `19.50.1` | `Source/Clients/DotNET/ReadModels/{IDecisionReads,DecisionReads,DecisionRead,DecisionReadRefusalReason}.cs` |
+| `Cratis.Chronicle` transactions | `19.50.1` | `Source/Clients/DotNET/Transactions/{IUnitOfWork,UnitOfWork,DecisionReadCommitOwner,UnitOfWorkLifecyclePolicy}.cs` |
+| `Cratis.Chronicle` scope resolution | `19.50.1` | `Source/Clients/DotNET/EventSequences/Concurrency/DefinitionConcurrencyScopeResolver.cs` |
+
+The client surface began in 19.9.0; stream-scoped reads require the newer kernel
+surface added in 19.39.0. Reverify a client/kernel pair rather than disabling
+compatibility checking to force a read through.
+
+## Route the work
+
+- For Arc `[ProtectedDecision]`, Arc command/handler shapes and Arc `IStreamReads`,
+  use **cratis-arc-command** and **cratis-arc-command-validation**; do not recreate
+  their unit-of-work ownership in a handler. The Chronicle `DecisionRead<T>`
+  below is not a license to invent an Arc wrapper shape.
+- For a unique value claimed atomically or a closed stream, use
+  **cratis-chronicle-event-constraints**.
+- For read-model declarations, use **cratis-chronicle-read-model** and
+  **cratis-chronicle-projection**. Ordinary `IReadModels` reads do not enroll guards.
+- In model-first scope, settle the rule and its refusal/concurrency specifications
+  in the accepted model using **cratis-screenplay-event-modeling** before gap-fill.
+  Never broaden a projection or bypass model protection just to make admission pass.
+
+## Check admission, then read
+
+`IDecisionReads` is in `Cratis.Chronicle.ReadModels`; obtain the reader with
+`eventStore.GetDecisionReads()` (`ReadModels/DecisionReadExtensions.cs`).
+`Admit<T>()` / `AdmitForStream<T>()` check shape **without I/O**, returning
+`DecisionReadAdmission(IsAdmitted, Reason)`. A successful shape check is not
+runtime read success: definitions, key conversion and fold completion are also
+checked while reading.
+
+`Get<T>(ReadModelKey key, cancellationToken)` requires an ambient unit of work
+and enrolls the protected read into it. Without one it throws
+`DecisionReadRequiresUnitOfWork`. `GetDetached<T>` reads without enrollment:
+explicitly add it with `IUnitOfWork.AddDecisionRead(read)` or carry it to a guarded
+append; dropping its guard makes the decision unprotected.
+
+`DecisionRead<T>` exposes `Instance` (nullable), `Exists`, `Key`, `IsProtected`,
+and store/namespace/sequence/stream routing. An absent instance is still a fact
+to guard, not permission to return a fabricated default model. Decide the
+business rejection or creation behavior explicitly.
+
+Read [admission and ownership](references/admission-and-ownership.md) when a
+shape is refused, a read crosses a stream boundary, or nested work tries to
+complete a protected transaction.
+
+## Read one stream instead of the whole source
+
+The stream overload takes `eventSourceId`, `eventStreamType`, `eventStreamId`,
+optional `eventSourceType`, and cancellation; it has both `Get<T>` and
+`GetDetached<T>` forms. It folds only that stream and guards it independently of
+the model's key. It still admits **projections only**, not reducers or arbitrary
+queries. Select one stream type, not `EventStreamType.All`; a stream-keyed
+projection also needs an explicit stream id, not the default wildcard.
+`AdmitForStream<T>()` checks this shape; unsupported readers/kernels refuse with
+`StreamScopeNotSupported`. Do not fall back to an unguarded query on refusal.
+
+## Commit and inspect conflicts
+
+Enroll the read **before** staging its decision's events through
+`EventLog.Transactional` and let the owning unit of work commit. Inspect
+`IsSuccess`, append errors/constraint violations/concurrency violations and
+`GetDecisionConflicts()`; the latter reports decision conflicts without exposing
+sequence numbers. A checked empty append validates its scope without writing
+an event. Do not mistake "no event" for "no consistency check".
+
+Do not attach a separate explicit concurrency scope to a source already guarded
+by a decision read: `DecisionReadConflictsWithConcurrencyScope` rejects that
+combination. A batch needing incompatible scopes for one event source throws
+`IncompatibleConcurrencyScopesForEventSource`. These are configuration/enrollment
+errors, not an ordinary business rejection. Choose one coherent scope; do not
+catch them and append without protection.
+
+On a real conflict, reread and **re-decide** with the same authorization and
+business rule; never resend stale events as if a retry fixed the decision. A
+DCB guard protects event facts, not external side effects. Durable follow-up
+belongs in a reactor/outbox; use **cratis-chronicle-reactor**.
+
+## Verify
+
+- The model is admitted and the read is protected and enrolled in the intended
+  store, namespace and stream before staging events.
+- Refusal is surfaced, never replaced by a materialized/unprotected read.
+- One owner completes or rolls back; nested code does neither behind it.
+- Competing relevant events cause rejection; unrelated events outside the guard
+  do not. Absence, empty checked append and stream isolation have specifications.
+- Scope conflicts, lifecycle violations and failed commit remain visible.
+- Real-client/kernel integration proves the concurrency boundary; a default
+  `EventScenario` scope strategy returning `None` is not concurrency evidence.

package/package/corpus/skills/cratis-chronicle-decision-reads/references/admission-and-ownership.md

@@ -0,0 +1,57 @@
+<!-- Copyright (c) Cratis. All rights reserved. -->
+<!-- Licensed under the MIT license. See LICENSE file in the project root for full license information. -->
+
+# Admission and commit ownership
+
+Verified at **Cratis/Chronicle v19.50.0**:
+`Source/Clients/DotNET/ReadModels/DecisionReads.cs`, `DecisionReadRefusalReason.cs`,
+`Source/Clients/DotNET/Transactions/UnitOfWork.cs`, `DecisionReadCommitOwner.cs`,
+and `UnitOfWorkLifecyclePolicy.cs`.
+
+## Why a shape is refused
+
+Admission requires exactly one supported projection on the event log. It is not
+an adapter for arbitrary read-model storage:
+
+| Reason | Shape to inspect |
+| --- | --- |
+| Reducer / AmbiguousProjection / NotEventLog | reduced model, several projections, or another sequence |
+| Join / Hierarchy | joins, children or nested projections |
+| OpenEndedEventTypes / Derivatives / FromEventProperty | all-events, FromEvery, or event-property routing |
+| NotEventSourceKeyed / KeyConversion | keys not convertible to the admitted raw source key |
+| NoEventTypes / UnsupportedEventTypeId | no finite guarded type set or unsupported encoded type ids |
+| InvalidKey / FoldIncomplete / DefinitionMismatch | runtime key, fold or client/kernel definition disagreement |
+| StreamKeyRequiresStreamScope | stream-keyed model read without a stream scope |
+| StreamScopeNotSupported / AllStreamsNotSupported / StreamKeyRequiresExplicitStreamId | unsupported stream reader or incomplete stream selection |
+
+Whole-source key admission supports string/Guid schemas, with canonical lowercase
+D-form Guid source ids assumed. A renamed or custom-converted key is not made
+safe by a cast in the caller. Runtime definition comparison is a diagnostic, not
+proof of equality with an executing projection. Keep integration specifications
+for the actual kernel pair and model shape.
+
+Do not silently replace a refused decision read with a materialized sink read.
+Redesign the decision model as a focused admitted projection only when the
+contract permits it, or surface the missing capability.
+
+## Completion is owned
+
+`IUnitOfWork.HasEnrolledDecisionReads` is sticky: it remains true after commit,
+rollback or disposal. It does not mean the transaction is still open.
+`UnitOfWork.ClaimDecisionReadCommitOwnership()` returns the opaque
+`DecisionReadCommitOwner` used by `CommitAsOwner` and `RollbackAsOwner`; these are concrete ownership capabilities, not methods on
+`IUnitOfWork`. Once ownership is claimed, nested work must not complete that
+protected transaction using ordinary commit/rollback. Arc's ownership wrapper
+belongs in **cratis-arc-command** / **cratis-arc-command-validation**, not custom
+application plumbing.
+
+`ChronicleOptions.UnitOfWorkLifecyclePolicy` defaults to `Compatibility` for major
+19; `Strict` opts in and is planned as the next-major default. Compatibility
+retains legacy late staging only for unprotected work and logs it. Strict rejects
+all late staging. Protected work and owner completion checks remain enforced;
+`UnitOfWorkIsCompleting` must not be caught and interpreted as success. An
+in-flight commit cannot be undone by a competing rollback.
+
+Keep read, decision, enrollment and completion inside one ambient async context.
+If a commit rejects the read, start a new read/decision attempt rather than
+reusing the stale protected instance or appending its events without the guard.

package/package/corpus/skills/cratis-chronicle-decision-reads/verification.json

@@ -0,0 +1,12 @@
+{
+  "skill": "cratis-chronicle-decision-reads",
+  "input": "Guard a standalone Chronicle decision through its owning commit.",
+  "fixtures": [],
+  "assertions": [
+    { "kind": "skill-contains", "value": "DecisionReadRequiresUnitOfWork" },
+    { "kind": "skill-contains", "value": "AdmitForStream<T>()" },
+    { "kind": "skill-contains", "value": "DecisionReadConflictsWithConcurrencyScope" },
+    { "kind": "skill-contains", "value": "GetDecisionConflicts()" },
+    { "kind": "skill-contains", "value": "reread and **re-decide**" }
+  ]
+}

package/package/corpus/skills/cratis-chronicle-event-constraints/SKILL.md

@@ -17,11 +17,12 @@ Constraints are discovered automatically. There is no registration call.
 
 | Package | Version | Purpose |
 | --- | --- | --- |
-| `Cratis.Chronicle` (client) | `18.3.0` | `[Unique]`, `[RemoveConstraint]`, `IConstraint`, `IConstraintBuilder`, `IUniqueConstraintBuilder`, `ConstraintViolation`, `IAppendResult` |
-| `Cratis.Chronicle` code analysis | `18.3.0` | `CHR0017`, `CHR0018`, `CHR0020` |
-| `Cratis.Chronicle.Testing` | `18.3.0` | `EventScenario` and the `IAppendResult` `Should*` assertions |
+| `Cratis.Chronicle` (client) | `19.50.1` | uniqueness, stream closing, constraint builders and append results |
+| `Cratis.Chronicle` code analysis | `19.50.1` | `CHR0017`, `CHR0018`, `CHR0020` |
+| `Cratis.Chronicle.Testing` | `19.50.1` | `EventScenario` and the `IAppendResult` `Should*` assertions |
 
-> Re-verified at the versions above by **symbol and signature**: every type, attribute and member this skill names exists at that tag, and the public surface it describes is unchanged since the previous verification (Chronicle 16.45.x / Arc 22.10.4 — the Chronicle 16→18 client diff is converters, options and doc comments; no type was removed or renamed). Behavior claims were verified at the earlier tag unless a section says otherwise.
+Sources: `Source/Clients/DotNET/Events/Constraints/`,
+`EventSequences/IEventSequence.cs` and `Source/Clients/Testing/` at v19.50.0.
 
 Reverify against the Chronicle repository before claiming support for another
 version. Never translate an attribute argument order or an assertion name from
@@ -31,8 +32,9 @@ memory.
 
 - The rule rejects **command input** — a range, a format, a cross-field
   condition: use `cratis-arc-command-validation`.
-- The rule is state-dependent and belongs in the handler under concurrency (the
-  DCB pattern): also `cratis-arc-command-validation`.
+- The rule is state-dependent and needs concurrency protection: use enrolled
+  stream/projection decision reads with `cratis-arc-command-validation`.
+  Plain injected models and `Result<,>` alone remain advisory.
 - You are creating or changing a read model that the rule reads: use
   `cratis-chronicle-read-model`.
 - You are writing the specification and want the `EventScenario` mechanics in
@@ -58,12 +60,12 @@ memory.
 | The same value must be unique across **several** event types | `IConstraint` with one `[Unique(name: …)]` name, or a fluent `Unique(…)` |
 | Case-insensitive matching, composite keys, or a scoped constraint | `IConstraint` |
 
-**Per-event-source versus across-event-sources is the constraint *kind*, not a
-setting.** Class-level `[Unique]` (and the generic `Unique<TEvent>()` builder
-call) means "at most one such event per event source id". Property-level
-`[Unique]` (and `Unique(unique => unique.On<T>(…))`) means "this value is unique
-across event sources". Choosing the wrong one gives a constraint that never
-fires rather than a compile error.
+Class-level `[Unique]` (and `Unique<TEvent>()`) means "at most one such event
+per event source id". Property-level `[Unique]` (and `Unique(unique => unique.On<T>(…))`)
+means "this value is unique across event sources". `Mode` tunes **property-value
+retention**, not that distinction: `PerEventSource` (default) releases the old
+value when the source claims a new one; `PerValue` keeps every value reserved
+until a removal releases it. Reclaiming one's own value succeeds in either mode.
 
 ## Step 2 — `[Unique]` — the default
 
@@ -94,8 +96,16 @@ public record UserRemoved;
   several on one removal event to release several claimed values at once.
 - To enforce the same property across **multiple** event types, give each its
   `[Unique(name: "UniqueEmail")]` with the **same name**.
-- Several removal events may declare the same name; **any one of them releases
-  the claim on its own**.
+- Several removal events may declare the same name; **any one releases the claim**.
+- `Mode = UniqueConstraintMode.PerValue` retains all values. A removal can use
+  `Properties = [nameof(RemovalEvent.Value)]` to release one value (composite
+  properties in constraint order); empty `Properties` releases all values held
+  by the source in the scope.
+- `EventSequences = [EventSequenceId.LogId]` limits validation/indexing to the
+  event log. Empty means every sequence; when declarations share a name, their
+  sequence sets combine and an unrestricted declaration wins.
+- Null/missing property values do not claim `""`; clearing a default-mode value
+  releases its claim. `IgnoreCasing` is honored by the kernel.
 
 ## Step 3 — `IConstraint` — the advanced form
 
@@ -116,7 +126,7 @@ public class UniqueProjectName : IConstraint
 ```
 
 `IUniqueConstraintBuilder` also carries `WithName(name)`, `WithMessage(message)`,
-and an `On(EventType, string[])` overload. `On<TEvent>` is **variadic** —
+`WithMode(UniqueConstraintMode)`, and an `On(EventType, string[])` overload. `On<TEvent>` is **variadic** —
 `On<T>(e => e.Tenant, e => e.Email)` constrains the composite of both
 properties, not two independent values.
 
@@ -130,6 +140,8 @@ Always pass them by name.
 
 `ConstraintScope` is a record of three optional dimensions, not an enum, and you
 never construct it — the three `Per…` calls select which dimensions participate.
+`ForEventSequences(...)` / `ForEventLog()` select the sequences to validate and
+index. Keep these separate from scope dimensions.
 
 ## Step 4 — Keep `Define` declarative
 
@@ -212,10 +224,37 @@ Use per-test unique values (`$"{Guid.NewGuid():N}"`) so specifications are not
 order-dependent. For a release, append the removal event and then assert the
 value can be claimed again.
 
-⚠️ **`EventScenario` disables concurrency checking.** It wires a no-op
-concurrency-scope strategy, so `ShouldHaveConcurrencyViolations()` can never
-become true through the in-process scenario. Constraint violations are fully
-exercisable there; concurrency violations need the real kernel.
+⚠️ **The default `EventScenario` client scope strategy answers `ConcurrencyScope.None`.**
+A scenario-only concurrency assertion without a checked scope is vacuous.
+The scenario runs the kernel grain/validator, but explicit-scope violations
+have not been proven end to end here; use real-client integration for that proof.
+Constraints are fully exercisable. Dispose the scenario in `Destroy()`.
+
+## Close a stream at its business end
+
+Choose the lifetime with **cratis-chronicle-event-modeling**, then enforce it at
+append time. `IEventSequence.CompleteStream(ClosedStreamScope,
+expectedTailSequenceNumber?)` returns `Result<EventSequenceNumber, CompleteStreamError>`:
+`EmptyScope`, `AlreadyCompleted`, or `ExpectedTailMismatch` are not successful
+new closures. An append matching a persisted closed scope is refused with
+`StreamClosed`. Unspecified dimensions are wildcards, so name the intended
+source/type/stream dimensions precisely.
+
+Prefer an event-owned declaration when closing is a business fact:
+`[ClosesStream]` / `IConstraintBuilder.ClosesStreamOn<TEvent>()`. The attribute
+has `Dimensions`, `EventStreamIdFrom`, `ReopenedBy`, `Name` and `EventSequences`;
+default dimensions are source id, stream type and stream id. Closing happens in
+the **same grain turn** as append, **not crash-atomically** with it. Registering
+the declaration is not retroactive; reindex rebuilds event-owned closures.
+Reopening events remove only their constraint's exact closure, never a manual
+operator closure.
+
+Read [closing scope and recovery](references/closing-streams.md) when implementing
+"close the books", choosing a scope, specifying the refusal, or repairing a
+mistaken manual close. `IsStreamCompleted` and `GetClosedStreams` inspect;
+Workbench's **Closed streams** page is read-only. Kernel `ReopenStreamScope`
+requires an authorized operator and records `StreamScopeReopened` before
+removing a manual closure. Closing does not erase history or prevent replay.
 
 ## What breaks