@cratis/pi 7.34.1 → 7.35.0

package/package/corpus/skills/cratis-chronicle-event-constraints/references/closing-streams.md

@@ -0,0 +1,73 @@
+<!-- Copyright (c) Cratis. All rights reserved. -->
+<!-- Licensed under the MIT license. See LICENSE file in the project root for full license information. -->
+
+# Closing scope and recovery
+
+Verified at **Cratis/Chronicle v19.50.0**:
+`Source/Clients/DotNET/EventSequences/{IEventSequence,ClosedStreamScope,CompleteStreamError}.cs`,
+`Events/Constraints/ClosesStreamAttribute.cs`,
+`Documentation/closing-streams/` and `Documentation/scenarios/close-the-books.mdx`.
+
+## Choose the scope before closing
+
+`ClosedStreamScope` has optional `EventSourceId`, `EventSourceType`,
+`EventStreamType`, `EventStreamId`. Unset dimensions are wildcards. All set
+values must match for an append to be refused.
+
+- Source id alone closes **all** its streams.
+- Stream type/id alone closes that pair for **all** sources.
+- Source id plus type/id closes just that source's stream.
+- Source type alone closes every source of that type.
+
+`ForEventSource(id)` and `ForStream(type, id)` are convenience factories.
+`All` / `Default` are real stream values, not unset dimensions. Closing the
+catch-all default without a specific source or other specific dimension returns
+`DefaultStreamCannotBeCompleted`. Empty scope returns `EmptyScope`.
+
+Pass `expectedTailSequenceNumber` when a manual close must refuse if another
+event landed after the last fact you read. Mismatch returns `ExpectedTailMismatch`.
+Manual coverage returns `AlreadyCompleted`, before the expected-tail check:
+retrying does not duplicate the closure. Coverage by an event-owned closure
+alone still writes a manual closure; a later reopening event cannot undo it.
+Use a kernel that supports scoped closing; an older server must not be allowed
+to ignore dimensions and close a wider scope.
+
+## Close the books with a fact
+
+For a completed accounting period, carry the period identifier in the closing
+fact and bind it with `ClosesStreamAttribute.EventStreamIdFrom`. Explicitly
+choose `Dimensions`: decide whether the closure is one account's period or all
+accounts' period. Route normal appends to that same period stream. The closing
+event is accepted; later matching appends get `StreamClosed`. Continue new work
+in the next period, rather than blindly retrying into the closed one.
+
+`ReopenedBy` names domain events that remove **that constraint's exact closure**.
+They never remove manual closures. Closing/reopening run in the append's grain
+turn, not crash-atomically with durable append. Constraint reindex repairs
+missing event-owned closures and never changes manual ones. Registration or
+removal of a declaration does not automatically reindex historical facts.
+Redacted property-sourced closing/reopening facts can leave the owning index
+untouched because their scope is unrecoverable; inspect the warning rather than
+assuming a complete rebuild. Read the appended generation when evolving a
+property-sourced scope.
+
+## Inspect and repair
+
+`IsStreamCompleted(scope)` checks coverage; `GetClosedStreams(within)` lists
+matching persisted scopes. Workbench's namespace **Closed streams** view shows
+source/type/stream, origin, closing owner, sequence number and time; it is
+read-only, not a reopen button.
+
+Kernel `ReopenStreamScope` is an administrator repair path for a mistaken manual
+close, not a normal business transition. Name exact scope, reason and target;
+get authorization, re-read, then act. It appends `StreamScopeReopened` before
+removing the manual closure; failed audit append leaves it closed. It refuses
+an event-owned closure (`ClosedByEvent`); use the modeled reopening event there.
+
+## Specify both sides
+
+Use `EventScenario` for completing a scope and asserting a later append's
+`StreamClosed` constraint violation. Include an unrelated source/period still
+open, expected-tail mismatch, repeated completion and, where declared, reopening.
+Keep integration proof for client/kernel compatibility and recovery. Closing
+preserves history: observers and projection replay still consume prior events.

package/package/corpus/skills/cratis-chronicle-event-modeling/SKILL.md

@@ -37,8 +37,11 @@ and the request is wiring or a narrow fix.
 
 ## Verified product sources
 
-This skill was originally verified against Chronicle 18.3.0 and re-read against Chronicle 19.50.0
-(`Source/Clients/DotNET.CodeAnalysis/DiagnosticIds.cs`, `ProtectedValues/EncryptedAttribute.cs`).
+Verified against **Cratis/Chronicle v19.50.1**:
+`Source/Clients/DotNET.CodeAnalysis/DiagnosticIds.cs`,
+`ProtectedValues/EncryptedAttribute.cs`, `EventSources/`, `Events/PublicAttribute.cs`,
+`Sinks/PublishToAttribute.cs`, and `Events/Constraints/ClosesStreamAttribute.cs`
+(paths under `Source/Clients/DotNET/` unless otherwise stated).
 Current version pins: `cratis-screenplay-toolchain` `references/versions.md`.
 
 | Package | Purpose |
@@ -90,6 +93,29 @@ Do not append an event for derived or aggregate state. Project it from the sourc
 events instead; an event that records a total is a fact that can disagree with
 its own inputs.
 
+## Public facts and streams that end
+
+Declare source vocabulary with `IEventSource`, `[EventSource]` and `[EventStream]`;
+use **cratis-chronicle-client-dotnet** for append routing and
+**cratis-chronicle-reactor** for `[FromEventSource<T>]` filters. A stream that
+ends needs an explicit lifetime and scope: does closing cover one source, a
+period across sources, or every stream of a source type? Prefer a past-tense
+closing fact with `[ClosesStream]`; use **cratis-chronicle-event-constraints** for
+manual scope completion, reopening and its crash/reindex limits. Closing refuses
+new appends; it does not erase history or stop projection replay. Specify a
+late append refusal and an unrelated scope remaining open.
+
+`[Public]` permits an event type to leave the event log; `[PublishTo("sequence")]`
+selects publication for projection/reducer output. Private types cannot go to
+outbox, and the event log is not a publication target. Translate inbox facts
+into local facts at the boundary rather than treating external contracts as
+local commands. Named tags are plaintext, indexed metadata: never personal data.
+
+State-dependent decisions need **cratis-chronicle-decision-reads** when their
+read facts must remain valid at append; an ordinary passive read alone does not
+close the read/append race. Arc command integration belongs to
+**cratis-arc-command-validation**.
+
 ## Information completeness — trace every field to an event
 
 This is the check that pays for itself, and it belongs at modeling time rather
@@ -109,7 +135,10 @@ Chronicle is allowed where the rule needs it (an injected read model read by
 explicit key, or a `[Passive]` projection for a command-side decision); see
 Cross-slice patterns in `rules/vertical-slices.md`. Make such a read deliberate
 and name it in the brief, with the consistency it needs: a rule that must hold
-under concurrency uses the DCB pattern rather than a stale materialized read.
+under concurrency needs enrolled guarded reads, not plain injection or a stale
+materialized snapshot. In Arc v22.75.0 use `IStreamReads`/`StreamDecision` for one
+stream or `[ProtectedDecision]` + admitted `DecisionRead<T>` for projected state;
+`Result<,>` alone supplies rejection, not a concurrency guard.
 
 ## Compliance modeling
 

package/package/corpus/skills/cratis-chronicle-event-specifications/SKILL.md

@@ -14,10 +14,11 @@ application's constraints discovered and active.
 
 | Package | Version | Purpose |
 | --- | --- | --- |
-| `Cratis.Chronicle.Testing` | `18.3.0` | `EventScenario`, its `Given`/`When` builders, the `IAppendResult` `Should*` assertions |
-| `Cratis.Chronicle` | `18.3.0` | `IEventSequence.Append`/`AppendMany`, `IAppendResult`, `ConstraintViolation` |
+| `Cratis.Chronicle.Testing` | `19.50.1` | `EventScenario`, its `Given`/`When` builders, the `IAppendResult` `Should*` assertions |
+| `Cratis.Chronicle` | `19.50.1` | `IEventSequence.Append`/`AppendMany`, `IAppendResult`, `ConstraintViolation` |
 
-> Re-verified at the versions above by **symbol and signature**: every type, attribute and member this skill names exists at that tag, and the public surface it describes is unchanged since the previous verification (Chronicle 16.45.x / Arc 22.10.4 — the Chronicle 16→18 client diff is converters, options and doc comments; no type was removed or renamed). Behavior claims were verified at the earlier tag unless a section says otherwise.
+Sources: `Source/Clients/Testing/EventSequences/`, `TestingEventStore.cs`,
+and `Source/Clients/DotNET/EventSequences/` at **v19.50.0**.
 
 ```bash
 dotnet add package Cratis.Chronicle.Testing
@@ -70,6 +71,16 @@ in the loaded assemblies — which is what makes a constraint specification work
 without wiring. Pass an `ICanProvideConstraints` to the single-argument
 constructor when the specification needs a narrower set.
 
+At v19.50.0 it implements `IDisposable`: dispose in `Destroy()`.
+`new EventScenario(sequenceId, eventStore, @namespace)` selects identifiers;
+constructors also accept per-run `Defaults`. One scenario shares production
+in-memory storage across its sequences and uses the kernel append grain,
+serialization, migrations and compliance. Older-generation appends migrate;
+undiscovered schemas fail with `EventSchemaNotDiscovered`. Appends to one
+sequence serialize, so racing claims of the same unique value cannot both win.
+Seeding can specify source/stream routing through the `ForEventSource`,
+`For<TEvent>` and `ForEvents` overloads.
+
 ## Step 2 — Seed prior state through `Given`
 
 ```csharp
@@ -195,8 +206,10 @@ assert the value can be claimed again.
 - **`ShouldHaveConstraintViolationFor` fails with an empty violation list on a
   batch append.** `When…Events` short-circuits, so the conflict may be on an
   event the append never reached.
-- **A concurrency specification is always green.** It is vacuous — the scenario
-  disables the check. Delete it or move it out-of-process.
+- **A concurrency specification is always green.** Without an explicit checked
+  scope, the default client strategy answers `ConcurrencyScope.None` and proves
+  nothing. The kernel validator is present; explicit-scope violations have not
+  been proven end to end here. Prove the application's strategy with integration.
 - **The specification passes alone and fails in the suite.** A hard-coded unique
   value collided with another specification's claim.
 

package/package/corpus/skills/cratis-chronicle-event-type-migration/SKILL.md

@@ -35,8 +35,8 @@ This skill is verified against these exact sources:
 
 | Package | Version | Purpose |
 | --- | --- | --- |
-| `Cratis.Chronicle` | `18.3.0` | `Cratis.Chronicle.Events` and `Cratis.Chronicle.Events.Migrations` |
-| `Cratis.Chronicle.CodeAnalysis` | `18.3.0` | `CHR0012`, `CHR0037`, `CHR0049`, `CHR0050` |
+| `Cratis.Chronicle` | `19.50.1` | `Cratis.Chronicle.Events` and `Cratis.Chronicle.Events.Migrations` |
+| `Cratis.Chronicle.CodeAnalysis` | `19.50.1` | `CHR0012`, `CHR0037`, `CHR0049`, `CHR0050` |
 
 Reverify product sources before claiming support for another version.
 
@@ -161,6 +161,26 @@ public override void Downcast(IEventMigrationBuilder<<EventName>V1, <EventName>>
             source => source.<FirstPart>, source => source.<SecondPart>));
 ```
 
+## Nested paths and compatible schema metadata
+
+Property expressions traverse nested CLR members:
+`DefaultValue(m => m.Price.Description, "x")` and
+`RenamedFrom(m => m.Price.Amount, e => e.Amount)` address the nested target.
+`JsonPropertyName` wins over the client's naming policy; raw string paths are
+already JSON paths and are not renamed. An undeclared `DefaultValue` target in
+a nonempty target schema is rejected with `InvalidMigrationPropertyForEventType`
+(`Source/Kernel/Core/EventTypes/EventTypeRegistrar.cs`, `ValidatePropertyKeys`);
+an empty auto-generated target schema is the exception.
+
+Adding/removing an **optional** property at any depth still needs a migration
+class to complete the new generation chain, but no property operations: the
+target schema supplies absence/drops undeclared properties. That is a migration
+fact, not a reason to put nullable facts on newly authored events. Schema `title`
+is ignored, so renaming a CLR record with a pinned `[EventType("id")]` does not
+raise `EventTypeSchemaChanged`. A property described only by `default` may gain
+`type`/`format` without that error. Source at v19.50.0:
+`Documentation/migrations/dotnet-client.mdx` and the kernel event-type schema comparison.
+
 ## Step 3 — When the values changed meaning, declare a value map
 
 The operations above move values between properties. When a *value itself* means
@@ -213,6 +233,16 @@ Migrations are discovered by convention — nothing is registered. They are
 activated through the service provider, so a migration may take constructor
 dependencies.
 
+## Backfill scope and rollout
+
+At v19.50.0 (`Documentation/migrations/index.md:62-74`), registering a new
+generation starts **add-only** backfill in the **default namespace's event log
+only**. Other namespaces and sequences are not covered. Existing stored
+representations remain unchanged; changing a migration alone does not launch
+another backfill. Older backfills may already have overwritten originals:
+upgrading cannot recover those. Register new generations **only after every
+kernel silo is upgraded**; an old worker can still overwrite content mid-rollout.
+
 ## Choose the generation an observer receives
 
 `Compatibility` remains the default. With

package/package/corpus/skills/cratis-chronicle-hosting/SKILL.md

@@ -0,0 +1,134 @@
+---
+name: cratis-chronicle-hosting
+description: Run the Chronicle kernel with production storage, certificates, TLS or a private h2c proxy, health probes, clustering and observer recovery configuration. Use when deploying the kernel, moving from development images to production, configuring trusted proxies, or diagnosing kernel startup and topology. Do not use for wiring a .NET application client, implementing Orleans grains, or mutating a live store.
+license: MIT
+---
+
+<!-- Copyright (c) Cratis. All rights reserved. -->
+<!-- Licensed under the MIT license. See LICENSE file in the project root for full license information. -->
+
+# Host the Chronicle kernel
+
+A working development Compose file is not a production deployment. The kernel's
+build, storage, certificates and network topology determine whether it starts
+and whether several nodes actually form one cluster. Inspect configuration
+without exposing secrets; a hosting request does not authorize deleting data,
+rotating keys, clearing quarantine or deploying to an unnamed environment.
+
+## Verified product sources
+
+Verified at **Cratis/Chronicle v19.50.1**:
+
+| Source | Contract |
+| --- | --- |
+| `Documentation/hosting/production.md` | images, DEVELOPMENT, prerequisites, replica sets, ports, backup order, clustering |
+| `Documentation/hosting/configuration/tls.md` | TLS/h2c, authentication limits, immediate proxy trust |
+| `Documentation/hosting/configuration/health-endpoint.md` | dedicated probe port and exclusive routing |
+| `Documentation/hosting/configuration/observers.md` | retries, quarantine, definition evolution |
+| `Source/Kernel/Core/Configuration/{Events,Alerts}.cs` | causation retention and incident metrics |
+| `Source/Kernel/Core/Setup/Authentication/AuthenticationService.cs:170-208` | persisted development application |
+
+Reverify these sources before recommending another kernel version. This is the
+operator/kernel surface, not an application-profile layout rule.
+
+## Choose the build and storage
+
+- `cratis/chronicle:latest` is production; pin a tested release for deployment.
+  `latest-development` bundles MongoDB; `latest-development-slim` does not.
+- **`DEVELOPMENT` is a compile-time symbol defined for Debug builds**, not
+  `ASPNETCORE_ENVIRONMENT` or `DOTNET_ENVIRONMENT`. Environment variables cannot
+  turn the Release image into a development kernel.
+- Production storage defaults to MongoDB but its connection string is empty.
+  Set `Cratis__Chronicle__Storage__ConnectionDetails`, and `__Storage__Type` for
+  a different backend. Configuration mounts at `/app/chronicle.json`; environment
+  keys use the `Cratis__Chronicle__` prefix. `storage.databaseNamePrefix` changes
+  database naming; it is not a migration of existing data.
+- MongoDB **must be a replica set**, including single-node development: appends
+  use transactions. The current Compose/Aspire default is MongoDB 8.2. Publish
+  development database ports on loopback only; a host application needing MongoDB
+  must be able to reach port 27017. Do not expose unauthenticated MongoDB.
+
+## Supply certificates before starting production
+
+Default TLS needs a PFX certificate with a private key:
+`Tls__CertificatePath` / `Tls__CertificatePassword`. Missing/invalid certificates
+fail startup; there is no silent HTTP downgrade. Development generates an
+in-memory self-signed TLS certificate.
+
+`EncryptionCertificate__CertificatePath` / `__CertificatePassword` protect the
+internal OAuth authority's keys. Production requires this unless `oAuthAuthority`
+is disabled or an external authority replaces it. Value encryption is separate
+and still requires a certificate on first use. Development falls back to
+ephemeral OAuth keys. Supply passwords from the approved secret mechanism,
+never commit them. Every cluster node needs the same certificate ring.
+
+The .NET client uses known development credentials when ClientCredentials has
+both username and password absent (`ChronicleClient.cs:334-345`,
+`Connections/ServiceCollectionExtensions.cs:57-68` at **v19.50.0**). The development
+kernel creates the application **directly in persistent storage**
+(`AuthenticationService.cs:170-208` at **v19.50.0**). Changing to a production
+image does not revoke it. Remove the application and any configuration declaration
+that recreates it before reusing that storage. See **cratis-chronicle-client-dotnet**.
+
+## Pick a network topology
+
+Default main port **35000** serves gRPC HTTP/2 plus Workbench, REST, OAuth and
+health HTTP/1.1 over TLS using ALPN. Orleans silo **11111** and gateway **30000**
+are internal cluster ports, not public browser endpoints.
+
+Explicit `Tls.Enabled=false` is only for a **private HTTP/2-only h2c backend**
+behind an HTTPS-terminating proxy. The kernel warns at startup. Forward **all**
+traffic over h2c; HTTP/1.1 upstream fails. Restrict direct access. With auth enabled,
+use an external HTTPS `authentication.authority`: the internal authority and
+`/connect/token` are unavailable; .NET SDK ClientCredentials cannot use the
+external authority. Independently obtained bearer tokens and Workbench cookie
+login are supported. These claims are at **v19.50.0**,
+`Documentation/hosting/configuration/tls.md`, "Configuration file"/"TLS behavior".
+
+At **v19.50.0**, the same file's "Trusted reverse proxies" section specifies:
+
+- `X-Forwarded-For/Proto` is trusted from loopback only by default. Add the
+  **immediate proxy** IP to `forwardedHeaders.knownProxies` or a restricted
+  infrastructure CIDR to `knownNetworks`; env arrays use
+  `Cratis__Chronicle__ForwardedHeaders__KnownProxies__0` / `__KnownNetworks__0`.
+- `ASPNETCORE_FORWARDEDHEADERS_ENABLED=true` does **not** widen trust. Never
+  configure a wildcard CIDR or client networks as trusted proxy networks.
+- The proxy must **replace**, not relay, client-supplied forwarded headers.
+  Forward public HTTPS for HTTPS-sensitive middleware. Do not trust a public
+  HTTP scheme while fronting a TLS listener: cookie mutations fail antiforgery.
+
+## Probe without opening another API entrance
+
+Set `health.port` for a dedicated HTTP/1.1 probe listener. `health.tls=false`
+removes TLS only there; `health.exclusive=true` restricts it to the configured
+health path (`/health` by default). Exclusive is **false by default**, so an
+ordinary plaintext probe port also exposes other HTTP/1.1 endpoints. Keep it
+internal. `health.tls=true` needs the top-level TLS certificate even when main
+TLS is disabled. The production chiseled container has no shell/curl: use an
+orchestrator/external probe, not an in-container shell healthcheck.
+
+## Form one cluster, not several over shared data
+
+Every node must explicitly set `clustering.type=MongoDB` and share the cluster
+and service ids and MongoDB storage. Default `Localhost` forms isolated
+single-node clusters: sharing a database does not join them. Only MongoDB
+supports multi-node storage; PostgreSQL, SQL Server and SQLite are single-node.
+`Clustering:ResponseTimeout` bounds Orleans transport waiting; increasing observer
+subscriber timeout cannot exceed that transport deadline.
+
+Read [recovery and upgrades](references/operations.md) when changing observer
+retry/quarantine settings, definition evolution, retention, alerts, or restoring
+and upgrading a cluster. See **cratis-chronicle-web-workbench** for browser
+exposure and **cratis-chronicle-cli-operations** for authorized live operations.
+
+## Verify
+
+- The build/image and intended environment agree; no default development
+  application remains in reused production storage.
+- Storage is reachable and MongoDB is a replica set; multiple nodes share MongoDB
+  membership, cluster id, service id and certificate ring.
+- Certificates load; clients validate production TLS (`skipTlsValidation=false`).
+- A probe observes health without publishing a plaintext Workbench/API port.
+- Proxy upstream protocol and trust are tested from the actual immediate peer.
+- Registration, observer progress and known protected data are checked separately
+  from process startup. Report skipped runtime checks; a config review is not a deployment.

package/package/corpus/skills/cratis-chronicle-hosting/references/operations.md

@@ -0,0 +1,89 @@
+<!-- Copyright (c) Cratis. All rights reserved. -->
+<!-- Licensed under the MIT license. See LICENSE file in the project root for full license information. -->
+
+# Recovery, retention and upgrades
+
+Verified at **Cratis/Chronicle v19.50.1**:
+`Documentation/hosting/configuration/{observers,events,clustering}.md`,
+`Documentation/hosting/production.md`,
+`Source/Kernel/Core/Configuration/Alerts.cs`, and
+`Source/Kernel/Core/Alerts/`.
+
+## Observer behavior
+
+`observers.maxRetryAttempts` defaults to 10 per budget (0 is infinite).
+`backoffDelay`, `exponentialBackoffDelayFactor` and `maximumBackoffDelay` bound
+retries. Clearing a partition quarantine starts a new budget and preserves its
+attempt history. Observer quarantine and partition quarantine are separate;
+clearing one does not clear the other. Inspect the cause before authorizing clear
+or retry. Subscriber timeout abandons waiting, not subscriber work: redelivery
+can overlap work that still runs, so side effects must remain idempotent.
+
+Quarantine persists through grain deactivation. Watchdog ticks and catch-up/replay
+completion do not end it. An operator clear or a fresh subscription does;
+a kernel restart only helps observers that actually receive a fresh subscription.
+Event-store subscriptions remain quarantined until operator clear. Recovery can
+quarantine again if the cause remains.
+
+Projection replay and catch-up each use a **single globally ordered job step**;
+a new catch-up failure stops that step rather than letting other sources proceed.
+Full replay is inactive until completion, then routes to catch-up/live unless
+quarantined. Partition quarantine stops that partition's automatic retries;
+observer quarantine suppresses automatic recovery for the whole observer.
+Sources at v19.50.1: `Documentation/concepts/observers.mdx`,
+`Documentation/projections/registration-lifecycle.md`, and
+`Source/Kernel/Core/Observation/Jobs/{CatchUpObserver,ReplayObserver}.cs`.
+
+### Next-event lookup failures
+
+At **v19.50.1**, Routing keeps the saved position and defers observation when
+`GetNextSequenceNumberGreaterOrEqualTo` returns a storage error. A watchdog tick
+retries that deferred routing only while subscribed and not quarantined. Its
+active-observer lookup also leaves the cursor unchanged on error. Only
+`GetSequenceNumberError.NotFound` proves there is no relevant event and permits
+fast-forward. Read failures are not "nothing to handle"; preserve and investigate
+the warning. Sources: `Source/Kernel/Core/Observation/States/Routing.cs` and
+`Observer.Watchdog.cs`. This fixes #4770, not the proposed Ordered Lanes design
+or all historical delivery/completion limitations. Do not claim past omissions
+were repaired automatically.
+
+`observers.definitionEvolution` governs projection/reducer changes:
+
+| Policy | Result |
+| --- | --- |
+| Automatic (default) | applies no-action, partial or full replay classification |
+| PartialOnly | applies no-action/partial, recommends full replay |
+| Manual | recommends both replay kinds; no-action creates no recommendation |
+
+Changed mappings, key, join, children, filters or reducer fingerprints require
+full replay when independence cannot be proved. Deploying a corrected counter
+or join does not repair historical state without replay. Reactor/webhook replay
+uses `replayOnDefinitionChange` instead; do not confuse the policies.
+
+## Causation values and incidents
+
+`events.causationPropertyRetention` defaults to `Retain`. `Omit` keeps causation
+type/time but no property values on **new** appends, forwarded events, revisions
+and redactions. It does not rewrite earlier chains. Subject erasure does not
+remove those values: they are not encrypted under the subject key. Assess
+historical chains separately, with **cratis-chronicle-compliance**.
+
+Kernel `Alerts.IncidentMetricsEnabled` defaults to true. Open incidents and
+observer failure/quarantine counters support alerting without dumping event
+payloads. Inspect the configured metrics endpoint and incident queries; counters
+are operational evidence, not proof that a failed partition recovered. Do not
+reintroduce high-cardinality partition labels into exported failure metrics.
+
+## Upgrade and restore
+
+Upgrade every silo together before registering new event generations. Add-only
+generation backfill covers only the default namespace's event log; older workers
+can still overwrite content during rollout, and upgrading cannot recover content
+previously overwritten. See **cratis-chronicle-event-type-migration**.
+
+Restore the certificate ring first, then storage (including Data Protection keys),
+then the compliance key store at the storage's point in time. The erasure fence
+is inside the key store: an older key backup can resurrect erased data, or miss
+new keys. Retain retired certificates as long as a backup needs them. Confirm a
+known protected subject remains readable and an erased subject remains erased
+before reopening traffic; see **cratis-chronicle-compliance**.

package/package/corpus/skills/cratis-chronicle-hosting/verification.json

@@ -0,0 +1,14 @@
+{
+  "skill": "cratis-chronicle-hosting",
+  "input": "Review a Chronicle production kernel topology without deploying it.",
+  "fixtures": [],
+  "assertions": [
+    { "kind": "skill-contains", "value": "DEVELOPMENT" },
+    { "kind": "skill-contains", "value": "does **not** widen trust" },
+    { "kind": "skill-contains", "value": "health.exclusive=true" },
+    { "kind": "skill-contains", "value": "clustering.type=MongoDB" },
+    { "kind": "skill-contains", "value": "directly in persistent storage" },
+    { "kind": "skill-contains", "file": "references/operations.md", "value": "single globally ordered job step" },
+    { "kind": "skill-contains", "file": "references/operations.md", "value": "GetSequenceNumberError.NotFound" }
+  ]
+}