@cratis/pi 7.74.0 → 7.76.0

package/package/corpus/skills/cratis-arc-command-validation/references/input-binding.md

@@ -0,0 +1,49 @@
+<!-- Copyright (c) Cratis. All rights reserved. -->
+<!-- Licensed under the MIT license. See LICENSE file in the project root for full license information. -->
+
+# Command input binding and member paths
+
+## Explicit offsets
+
+Requires Arc 22.110.0. Check with `dotnet list package`; older Arc has no
+`[ExplicitOffset]` binding contract. Require an explicit offset at the input
+boundary instead of accepting a server-local interpretation.
+
+Use `[property: ExplicitOffset]` on a `DateTimeOffset` or `DateTime` command
+property, nullable or not. It refuses date-time text without an offset or `Z`
+with `DateTime command property '<member>' requires an explicit offset or Z.`
+`DateTimeOffset` retains the input offset; `DateTime` becomes UTC. The attribute
+is in `Cratis.Arc.Commands`.
+
+## Malformed bodies still authorize
+
+Requires Arc 22.110.0 for authorization-before-binding-failure handling on
+execute and `/validate`. An unauthorized caller gets 403 even if the body is
+malformed; an authorized caller gets a `malformedRequest` validation result.
+Its message is generic, and its member is a normalized field path such as
+`from` or `items[2].when`, not parser or CLR type details.
+
+A resource-dependent policy cannot run without a bound command; those policies
+still produce a binding validation failure for an unbindable body. Requirements
+that never read the resource may implement
+`Cratis.Arc.Authorization.IResourceFreeRequirement` so their
+policies can run; built-in role, claim, name and authenticated-user requirements
+are already resource-free. Do not mark a requirement resource-free if it reads
+the command.
+
+## Validation members are field paths
+
+Requires Arc 22.115.0 for **all** `ValidationResult.Members` paths to be
+camelCase, including data annotations and errors returned by `Provide()` or
+`Handle()`. Use `name`, `address.street` and `items[0].name` in server assertions,
+not `nameof(Property)` or PascalCase paths. Authors may still construct a result
+with `[nameof(Property)]`; Arc normalizes it before clients receive it. Older
+Arc can fail to bind such results to the matching form field.
+
+## Verify
+
+Add specs for offset-less rejection, an accepted offset, malformed input under
+both authorized and denied callers, and nested/indexed member paths. Assert
+server `Members` using camelCase and run `dotnet test` on the owning spec project.
+For form behavior, assert the rejection appears on its intended field, not only
+in a command-wide error list.

package/package/corpus/skills/cratis-arc-command-validation/references/read-model-resolution.md

@@ -0,0 +1,25 @@
+<!-- Copyright (c) Cratis. All rights reserved. -->
+<!-- Licensed under the MIT license. See LICENSE file in the project root for full license information. -->
+
+# Read-model resolution for validation
+
+Resolution does not key off `[ReadModel]`: a model becomes injectable because a
+Chronicle projection or reducer, an EF Core `DbSet<T>`, or a MongoDB collection
+backs it. Registration is global by type; keeping a model in the slice is a
+convention, not a resolver restriction.
+
+The default lookup uses the command's resolved event-source id. It does not
+infer a key from the read-model type or an arbitrary similarly named property.
+Use `[LookUpBy(nameof(Command.Property))]` for a command-property key; for a
+computed key use `IDecisionReads.Get` in `Provide()` under read protection `On`.
+An ordinary `IReadModels.GetInstanceById` there is refused under `On`; outside
+protected work it is an advisory read, not a consistency guard.
+
+A missing instance resolves to `null`, not a default object. A nullable parameter
+receives that null; a non-nullable one produces a validation failure (400).
+`ARC0006` warns on a non-nullable command-scoped read-model parameter. Reject a
+missing nullable model through a validator, `Provide()` or
+`Result<TEvent, ValidationResult>`; do not return a nullable event.
+
+Read **cratis-arc-command** for the full resolution and nullability reference,
+including passive projections where absence is not null.

package/package/corpus/skills/cratis-arc-command-validation/references/validation-severity.md

@@ -0,0 +1,21 @@
+<!-- Copyright (c) Cratis. All rights reserved. -->
+<!-- Licensed under the MIT license. See LICENSE file in the project root for full license information. -->
+
+# Choose which severities block
+
+Model-bound commands accept `X-Allowed-Severity` (`allowedSeverity`). Under
+read protection `Off` and `Measure`, a caller sending `3` (Error) removes Error
+results from validators, command filters and `Provide()`, so `Handle()` runs
+and a validator's state rule can be skipped unless the command declares
+`[BlockOnValidationSeverity(ValidationResultSeverity.Error)]`
+(`Cratis.Arc.Commands.ModelBound`). Severity is not authorization.
+
+Requires Arc 22.108.0 for the `On` floor: a command declared `On` blocks `Error`
+and `Unknown` whatever the caller sends; the caller can relax only `Warning`
+and `Information`. Lowering `ReadProtection:MaximumMode` at runtime does not
+remove the floor, and an explicit attribute wins. Check with
+`dotnet list package`; on older Arc declare the blocking severity explicitly.
+
+Specify both the default refusal and a caller sending a permissive severity.
+Assert the command did not write events; a displayed message alone is not proof
+that validation blocked execution. Run `dotnet test` on the owning spec project.

package/package/corpus/skills/cratis-arc-ef-core-migration/SKILL.md

@@ -70,7 +70,13 @@ observation services and then, **only when `AutoDiscoverDbContexts` is true and
 the connection string is non-empty**, discovers and registers every public
 `BaseDbContext` subtype that is not marked `[IgnoreAutoRegistration]`.
 
-⚠️ `WithEntityFrameworkCore()` with no arguments discovers **nothing**.
+Requires Arc 22.109.0 for options bound from `Cratis:EntityFrameworkCore` before
+`configureOptions` runs; that callback wins over configuration. Read
+../cratis-arc-hosting/references/connection-resolution.md when resolving tenant or schema-purpose
+connections, including pooled contexts.
+
+⚠️ Without a connection string from configuration or the callback,
+`WithEntityFrameworkCore()` discovers **nothing**.
 `EntityFrameworkCoreOptions.ConnectionString` defaults to the empty string, and
 both discovery gates test it. A setup that looks wired and registers no context
 is almost always this.

package/package/corpus/skills/cratis-arc-hosting/SKILL.md

@@ -13,6 +13,9 @@ Choose the host and integrations before copying a bootstrap. Arc is standalone
 CQRS; Chronicle is optional and its client connects to a separate event store.
 Nothing in `AddCratis()` runs the Chronicle engine in your application.
 
+Read references/connection-resolution.md when MongoDB or EF Core connections
+must resolve per tenant or use separate runtime and schema identities.
+
 ## Verified product sources
 
 | Package | Purpose |

package/package/corpus/skills/cratis-arc-hosting/references/connection-resolution.md

@@ -0,0 +1,61 @@
+<!-- Copyright (c) Cratis. All rights reserved. -->
+<!-- Licensed under the MIT license. See LICENSE file in the project root for full license information. -->
+
+# Resolve application storage connections
+
+Requires Arc 22.109.0. Check with `dotnet list package`; older Arc has no shared
+connection resolver. Tenant resolution alone does not change the database.
+
+## Select the resolution
+
+`ArcOptions.ConnectionResolution`, bound under `Cratis:Arc:ConnectionResolution`,
+is the shared default for MongoDB and Entity Framework Core. An integration's
+own `ConnectionResolution` replaces that entire default for that integration;
+it is not merged field by field.
+
+Resolution has two slots, `Connection` then `Identity`, using the same shape.
+Choose `Default` for configured values, `Template` for scope-derived values,
+`Http` for a trusted platform endpoint, or `Custom` for `IConnectionResolver`.
+`ConnectionRequest`, `ResolvedConnection`, `ConnectionIdentity` and
+`ConnectionPurpose` live in `Cratis.Arc.Connections`. A result can supply only
+the connection string, database, schema or identity it owns; fields are optional.
+
+Results are cached in memory per request key, honor `expiresAt`, and are
+invalidated on login failure. This is credential resolution, not permission to
+move data. Changing the resolved destination does not migrate an existing database.
+Keep resolver endpoints and templates within the approved tenant/storage boundary;
+never log resolved passwords or tokens.
+
+## MongoDB
+
+`MongoDBOptions.ConnectionResolution` can be bound from
+`Cratis:MongoDB:ConnectionResolution`. A resolved username/password becomes a
+SCRAM credential. An access token becomes a MONGODB-OIDC credential refreshed
+through the resolver. Clients on the same server with different credentials
+are not shared as one identity.
+
+## Entity Framework Core
+
+`EntityFrameworkCoreOptions` binds `ConnectionString`, `AutoDiscoverDbContexts`
+and `ConnectionResolution` from `Cratis:EntityFrameworkCore`; the options callback
+runs afterward and wins. Automatic discovery still needs a nonempty configured
+connection string to select the provider, even if the resolver supplies a tenant
+destination later.
+
+Arc-registered contexts resolve for the current tenant and purpose whenever a
+connection opens, including pooled contexts. A SQL Server access token becomes
+`SqlConnection.AccessToken`; PostgreSQL uses it as the password. Do not capture
+one tenant's resolved connection into singleton options or manually reuse it
+across tenants.
+
+`ConnectionPurposeScope.Begin(ConnectionPurpose.Schema)` selects schema-purpose
+resolution for migrations; runtime data access uses `Runtime`. Dispose the scope
+after the schema operation. Different purposes may use different identities,
+but they must resolve the intended destination consistently.
+
+## Verify
+
+Run the application's database integration specs. Open connections for two
+tenants through the same pool and assert each reaches only its own database;
+exercise a schema-purpose open, credential expiry and login-failure invalidation.
+Compilation alone cannot prove tenant isolation or resolver authorization.

package/package/corpus/skills/cratis-arc-query-paging/SKILL.md

@@ -56,8 +56,10 @@ Sources: `Arc.Core/Queries/QueryStringQueryRequestReader.cs`,
 
 ## Which return shapes page
 
-A query is a public static method on the `[ReadModel]` type, discovered by its
-return type.
+A query is an eligible public or internal static method on the `[ReadModel]`
+type, discovered by its return type. Internal visibility does not hide an
+endpoint; keep helpers outside that type. Read **cratis-chronicle-read-model**'s
+query reference for explicit `[Query]` discovery and older-version limits.
 
 | Return | Paged? | How |
 | --- | --- | --- |

package/package/corpus/skills/cratis-arc-react-page/references/queries-and-commands.md

@@ -43,6 +43,18 @@ function**:
 The underlying hooks live in `@cratis/arc.react/queries` if you need them
 directly.
 
+Requires Arc 22.112.1 for optional-argument changes to refetch snapshot queries
+and for concurrent same-key readers to settle together. Requires Arc 22.113.1
+for cancellation/unmount scope cleanup. Requires Arc 22.116.1 for observable
+page/size/sort changes to resubscribe and for query hooks to stop showing the
+previous key's data or status after arguments, paging or sorting change. Check
+`npm ls @cratis/arc.react`; upgrade older clients rather than relying on these
+state transitions.
+
+Each key includes arguments, page, size and sorting. A changed key shows that
+key's cached result, or an initial not-ready result, never the old key's rows.
+Two different pages must not share one request or subscription.
+
 ### The result object
 
 Every query hook returns a result carrying:
@@ -69,7 +81,8 @@ states separately instead of collapsing them into "loaded or not":
 | Converged, empty | `hasData` with an empty `data` and no recent command | the designed empty state |
 | Converged, populated | `hasData` with items | the content |
 | Failed | `!isSuccess` / `hasExceptions` / `!isAuthorized` | the matching error affordance |
-| Stale refresh | `isPerforming` while `data` still holds the previous result | keep the old content, indicate refresh |
+| Same-key refresh | `isPerforming` while `data` still holds that key's previous result | keep that content, indicate refresh |
+| Changed arguments/page/sort | new key's cached result, or initial not-ready state | show only the new key's content or a skeleton |
 
 Two consequences. After a create command, take the **window action on the
 command's success** (close the dialog, navigate to the new id) and let the list

package/package/corpus/skills/cratis-chronicle-client-dotnet/SKILL.md

@@ -28,6 +28,11 @@ Source: `Cratis/Chronicle`.
 
 Take the version from nuget.org, not the placeholder version in the source.
 
+Read references/occurrences.md when recording durable triggers, implementing
+occurrence handlers, or choosing startup/shutdown activation and retry semantics.
+Read references/immediate-append-refusal.md when a unit must prevent immediate
+appends from escaping its atomic receipt boundary before transport.
+
 ## Lifecycle
 
 Read [references/lifecycle.md](references/lifecycle.md) when waiting for registration (`WaitForRegistration`, not polling `IsConnected`), diagnosing quiet observers (keepalive loss fails silently, not with an exception), or disposing the client.

package/package/corpus/skills/cratis-chronicle-client-dotnet/references/immediate-append-refusal.md

@@ -0,0 +1,40 @@
+<!-- Copyright (c) Cratis. All rights reserved. -->
+<!-- Licensed under the MIT license. See LICENSE file in the project root for full license information. -->
+
+# Refuse immediate appends before transport
+
+Requires Chronicle 19.81.0. Check with `dotnet list package`; older clients cannot
+prevent an escaped immediate append with this API. Return events or stage them
+transactionally instead; detecting an immediate append after it committed is
+not a retry-safe boundary.
+
+`IUnitOfWork.RefuseImmediateAppends()` returns a disposable frame. While its first
+frame is alive, native immediate append entry points in the current flow throw
+before transport, including captured sequence references and references to a
+different store. Transactional appends still enroll in the unit. This does not
+enable read protection or change read admission.
+
+## Who completes
+
+- With no existing completion owner and no enforced read protection, the first
+  frame owns completion. Use that frame's asynchronous `Commit` or `Rollback`.
+- Inside an ASP.NET-owned unit, or an enforcing read-protected unit, the frame is
+  refusal-only. Its `Commit` and `Rollback` throw
+  `ImmediateAppendRefusalRequiresOwner`; completion stays with the existing owner.
+- Nested frames borrow the refusal scope; they do not acquire completion rights.
+  Refusal lasts until the first frame is disposed, even if it already committed.
+- Replacing the ambient unit with `Begin` or `SetCurrent` while the frame lives
+  is refused. Dispose the frame at the boundary rather than trying to escape it.
+
+This prevents immediate Chronicle writes, not external I/O. Use it around a
+custom unit that must commit atomically with a receipt, and handle the ordinary
+commit result. Do not assume Arc's occurrence executor installs this frame.
+
+## Verify
+
+In a spec, attempt an immediate append through both the current event log and a
+previously captured reference; assert that neither reaches transport. Assert
+that transactional work commits with its receipt, that an unsupported kernel
+fails closed, and that borrowed frames cannot complete another owner's unit.
+Run `dotnet test` on the owning project. In-process proof is not a substitute for
+integration coverage of the storage provider's transaction boundary.

package/package/corpus/skills/cratis-chronicle-client-dotnet/references/lifecycle.md

@@ -31,6 +31,10 @@ This reference holds registration wiring, the registration wait, keepalive and w
   falls more than 5 seconds behind is treated as a lost connection, with
   reconnect backoff capped at 30 seconds. **The failure mode is silence, not an
   exception** — appends keep working while observers go quiet.
+- Requires Chronicle 19.72.1 for reactor/reducer `ClientIsNotConnected` stream
+  failures to reconnect the whole client with a fresh connection id and register
+  all observers again. Older clients can retry a stale registration indefinitely;
+  check `dotnet list package` before diagnosing that as a quiet handler.
 - `Dispose()` disposes read model reactors for created stores, cancels the owned
   connection, and disposes the connection
   (`Source/Clients/DotNET/ChronicleClient.cs`, `Dispose`).

package/package/corpus/skills/cratis-chronicle-client-dotnet/references/occurrences.md

@@ -0,0 +1,89 @@
+<!-- Copyright (c) Cratis. All rights reserved. -->
+<!-- Licensed under the MIT license. See LICENSE file in the project root for full license information. -->
+
+# Durable application occurrences
+
+Requires Chronicle 19.77.0 for the .NET occurrence client and testing surface.
+Check with `dotnet list package`; older clients need an upgrade, not an event
+appended just to wake a reactor. The kernel must advertise `occurrences` and,
+for receipted effects, `effect-receipts`; absent or unknown support fails closed.
+
+## Record and handle
+
+Occurrences are a durable work queue, not domain events or a compliance store.
+Trigger payloads are plaintext: never put personal data or operational secrets
+in them. Compliance-marked trigger schemas are refused. Keep a stable reference
+and resolve protected information through its owning service instead.
+
+```csharp
+using Cratis.Chronicle.Occurrences;
+
+[Trigger("refresh-catalog")]
+public record RefreshCatalog(string Catalog);
+```
+
+Implement `IOccurrenceHandler<RefreshCatalog>` with the signature
+`Task Handle(RefreshCatalog trigger, OccurrenceContext context,
+CancellationToken cancellationToken)`. Handlers are discovered like reactors. Record
+with `eventStore.Occurrences.Record(trigger, idempotencyId)` using a stable
+idempotency id. Inspect `Recorded`, `AlreadyRecorded`, `OccurrenceIdConflict`
+and `OccurrencePayloadInvalid`; a reused id with different content is not a
+successful retry.
+
+The client claims due work and renews its fenced lease while the handler runs.
+Failure backs off and eventually quarantines that occurrence without blocking
+later work. A stale lease epoch cannot renew, complete or fail another worker's
+lease. Delivery can repeat after a crash: a lease is not exactly-once execution.
+
+## Receipt boundary
+
+Use `context.EffectKey(effectName)` for one stable effect name within an
+occurrence. `IUnitOfWork.UseEffectReceipt(key, response)` commits the receipt
+atomically with transactional events. Zero-event units can also be receipted;
+protected reads still have to validate. A repeated effect returns its stored
+outcome instead of appending again. Unknown commit results are settled by receipt
+lookup, or fail retryably rather than inventing success.
+
+Do not put secrets in a receipt response: it is stored data. An external system
+must accept the effect key as its own idempotency key if its effect must survive
+redelivery. A Chronicle receipt cannot make arbitrary network I/O atomic.
+
+Read references/immediate-append-refusal.md when a custom receipt boundary must
+prevent immediate appends before transport. In Arc, use the
+**cratis-arc-command-execution** occurrence executor instead of hand-building the
+command's authorization and receipt boundary.
+
+## Startup and shutdown
+
+`Startup` and `Shutdown` are built-in triggers. Set `ChronicleOptions.ActivationId`
+to the stable logical deployment activation, not a random id on every restart.
+`ActivationScope.PerProcess` instead selects one activation per process.
+`LifecycleScope.Application` is the default; `AllNamespaces` durably fans out
+over a fixed namespace snapshot, so a crash resumes that fan-out without duplicates.
+
+A logical shutdown is recorded by `IOccurrences.EndActivation(id)`; stopping one
+pod is not a logical activation ending. Per-process host shutdown is bounded,
+not guaranteed to run during a kill or crash. ASP.NET Core and generic hosts wire
+the lifecycle service automatically; standalone clients own their lifecycle.
+
+## Specify retries explicitly
+
+`OccurrenceScenario<THandler>` in `Cratis.Chronicle.Testing.Occurrences` drives
+a handler through in-process ingress, claims, receipts and completion:
+
+- `Record(trigger, idempotencyId)` records without delivering.
+- `DeliverNext()` claims and invokes; advancing `Time` alone delivers nothing.
+- `DeliverWithoutCompleting()` simulates loss after work but before acknowledgement.
+- `Replies` can drop a committed append's reply; `Capabilities` on the testing
+  store can model current, old or unknown kernel support.
+- Register real constructor dependencies in `Services` before the first operation.
+  Assert durable events and receipts as well as the delivery outcome.
+
+There are no background workers, automatic lease renewals or reminders in this
+scenario; it does not prove behavior in a real multi-node cluster. Run
+`dotnet test` on the owning spec project and assert duplicate ingress, redelivery,
+terminal refusal, lost reply and unsupported-capability paths.
+
+Requires Chronicle 19.78.0 for `Defaults` and `EventStoreForTesting` constructors
+accepting an `EventStoreName` and `EventStoreNamespaceName`. Scenarios built from
+such defaults inherit that identity; old constructors retain `testing`/`default`.

package/package/corpus/skills/cratis-chronicle-client-dotnet/references/pinned-generation-delivery.md

@@ -3,6 +3,14 @@
 
 # Pin event generations before connecting
 
+## Contents
+
+- Standalone client
+- Host integration
+- Scope and registration
+- Event-store subscription pins
+- Product sources
+
 Requires Chronicle **19.41.0+** for client reactors/reducers and **19.48.0+** for
 typed materialized projections. Upgrade every kernel silo before enabling the
 option. `Compatibility` remains the default; adding a generation alone does not
@@ -72,13 +80,35 @@ builder.AddCratisChronicle(options =>
   submitted as both wildcard and `Pinned` is unsupported and rejected by the
   kernel with `EventGenerationDeliveryNotSupported`; the option does not make
   wildcard pinning work.
-- Ad-hoc queries/event reads are not opted in. Neither are webhooks, captures,
-  or event-store subscriptions. Do not generalize this option to every read
-  path, or to unreleased generation-delivery work.
+- Ad-hoc queries/event reads, webhooks and captures are not opted in. Event-store
+  subscriptions have their own builder opt-in below; the client-wide setting
+  does not enable it.
 
 For delivery-time migration, persisted PDL pins, and testing limits, read
 [the migration reference](../../cratis-chronicle-event-type-migration/references/pinned-generations.md).
 
+## Event-store subscription pins
+
+Requires Chronicle 19.66.0 on client and kernel. Check `dotnet list package`
+and the deployed kernel tag; older builders may throw
+`EventStoreSubscriptionGenerationDeliveryNotSupported`. Compatibility remains
+the default.
+
+On `eventStore.Subscriptions.Subscribe(id, sourceStore, configure)`, configure
+`WithGenerationDelivery(EventGenerationDelivery.Pinned)` and either
+`WithEventType<TEvent>()` for that CLR type's declared generation or
+`WithEventType(eventTypeId, generation)` for an explicit pin. This selects the
+generation forwarded into the target inbox during live delivery, catch-up,
+replay and partition retries; it is separate from the inbox observer's own pin.
+
+Both stores must register the generation. Registration refuses a missing
+source/target generation or two generations of the same identifier. If the
+target loses its pin at forwarding time, the failing batch appends nothing and
+does not advance past the failing event; earlier acknowledged events stay
+acknowledged. Changing only a pin or delivery mode rebinds the subscription in
+place, without an unsubscribe. Verify migration and protected-value release
+through real-client integration, not just a handler fed the desired CLR type.
+
 ## Product sources
 
 Source: `Cratis/Chronicle`:

package/package/corpus/skills/cratis-chronicle-decision-reads/SKILL.md

@@ -143,8 +143,11 @@ command protection, caching and enrollment; older Arc refuses them.
 Enroll the read **before** staging its decision's events through
 `EventLog.Transactional` and let the owning unit of work commit. Inspect
 `IsSuccess`, append errors/constraint violations/concurrency violations and
-`GetDecisionConflicts()`; the latter reports decision conflicts without exposing
-sequence numbers. On a kernel whose append validators accept an empty batch
+`GetDecisionConflicts()`. Requires Chronicle 19.76.0 for the nullable
+`ConflictingEventTypeId` and `ConflictingEventSequenceNumber` on decision conflicts
+and concurrency violations. They name the first event matching the failed guard;
+older kernels leave both null. Conflict JSON contains the read-model identifier,
+not its CLR type. Check with `dotnet list package` before asserting these fields. On a kernel whose append validators accept an empty batch
 (a kernel that does so when a scope carries an actual boundary or expects no matching event), a checked empty
 append validates its scope and writes nothing; a kernel that rejects it surfaces
 `DecisionReadValidateOnlyNotSupported`, which fails closed. Do not mistake "no

package/package/corpus/skills/cratis-chronicle-decision-reads/references/admission-and-ownership.md

@@ -21,7 +21,7 @@ an adapter for arbitrary read-model storage:
 | OpenEndedEventTypes / Derivatives / FromEventProperty | all-events, FromEvery, or event-property routing |
 | NotEventSourceKeyed / KeyConversion | keys not convertible to the admitted raw source key |
 | NoEventTypes / UnsupportedEventTypeId | no finite guarded type set or unsupported encoded type ids |
-| InvalidKey / FoldIncomplete / DefinitionMismatch | runtime key, fold or client/kernel definition disagreement |
+| InvalidKey / FoldIncomplete / DefinitionMissing / DefinitionMismatch | runtime key, fold, missing kernel definition or client/kernel definition disagreement |
 | StreamKeyRequiresStreamScope | stream-keyed model read without a stream scope |
 | StreamScopeNotSupported / AllStreamsNotSupported / StreamKeyRequiresExplicitStreamId | unsupported stream reader or incomplete stream selection |
 
@@ -35,6 +35,12 @@ Do not silently replace a refused decision read with a materialized sink read.
 Redesign the decision model as a focused admitted projection only when the
 contract permits it, or surface the missing capability.
 
+Requires Chronicle 19.75.0 for `DefinitionMissing` to be distinct from
+`DefinitionMismatch`. Refusals are not cached, a read checks definitions once
+more before refusing, and agreement is invalidated on connect/disconnect. A
+matching definition can therefore recover after restart without restarting the
+application. Check `dotnet list package`; older clients can retain a refusal.
+
 ## Completion is owned
 
 `IUnitOfWork.HasEnrolledDecisionReads` is sticky: it remains true after commit,
@@ -53,6 +59,17 @@ all late staging. Protected work and owner completion checks remain enforced;
 `UnitOfWorkIsCompleting` must not be caught and interpreted as success. An
 in-flight commit cannot be undone by a competing rollback.
 
+Requires Chronicle 19.76.0 for `IUnitOfWork.SuspendReadRegions()`: nested hosts
+can suspend inherited regions and restore them by disposing the scope. This is
+not permission to bypass a guarded decision. Arc uses it from 22.113.0;
+read-model injection outside the command decision under `On` is refused unless
+the model is deliberately `[Unprotected("why")]`.
+
+Requires Chronicle 19.81.0 for `RefuseImmediateAppends()`, which changes immediate
+write admission, not read admission. Read
+**cratis-chronicle-client-dotnet**'s immediate-append refusal reference before
+claiming completion rights for its returned frame.
+
 Keep read, decision, enrollment and completion inside one ambient async context.
 If a commit rejects the read, start a new read/decision attempt rather than
 reusing the stale protected instance or appending its events without the guard.

package/package/corpus/skills/cratis-chronicle-event-type-migration/references/pinned-generations.md

@@ -51,6 +51,12 @@ client and kernel registration exception names. Changing a reactor/reducer's
 pin or delivery mode does not itself trigger replay; request replay when prior
 state needs rebuilding.
 
+Requires Chronicle 19.66.0 for generation-pinned event-store subscriptions.
+Their builder opts in separately with `WithGenerationDelivery(Pinned)` and
+explicit or typed event pins; the global observer option does not opt them in.
+Both source and target stores must register the generation. Read the client
+reference above for registration and forwarding failure behavior.
+
 ## PDL pins are resolved once, when saved
 
 For a PDL definition saved with `GenerationDelivery = Pinned`, a bare reference

package/package/corpus/skills/cratis-chronicle-hosting/SKILL.md

@@ -48,6 +48,9 @@ operator/kernel surface, not an application-profile layout rule.
   development database ports on loopback only; a host application needing MongoDB
   must be able to reach port 27017. Do not expose unauthenticated MongoDB.
 
+Read references/storage-resolution.md when choosing per-namespace destinations,
+separate schema/runtime identities, SQL schemas, or disabling automatic creation.
+
 ## Supply certificates before starting production
 
 Default TLS needs a PFX certificate with a private key:

package/package/corpus/skills/cratis-chronicle-hosting/references/operations.md

@@ -65,6 +65,32 @@ on every silo and resume from the last durable position after a failed window.
 Check the kernel version and shutdown logs; neither guarantee makes an interrupted
 external effect exactly once.
 
+Requires Chronicle 19.77.4 for an observer replaced by a newer connected client
+to hand over to a still-connected older client when the newer one disconnects.
+The newest registration wins while both are connected; the older handler does
+not receive event types only the departed client handled. Check the kernel tag;
+older kernels can leave that observer stopped.
+
+### Job acceptance and bounded recovery
+
+Requires Chronicle 19.80.0 for `IJobs.Stop` and `IJobs.Resume` to return
+`JobCommandResult` with `Accepted` and a refusal reason. A completed RPC is not
+an accepted operation: inspect the result. `RetryFailedPartitions` retries
+partitions through bounded per-partition jobs without reopening a concluded
+replay. Do not invent a CLI flag for this contract operation.
+
+Timed-out job steps retry up to five attempts. Replay work has at most 16
+partition steps active, but projection replay/catch-up still use the single
+ordered step above; do not generalize partition parallelism to projections.
+Running jobs whose steps concluded over two minutes ago are reconciled, and
+replay-complete notifications retry. These recovery paths do not clear quarantine or
+prove historical completeness. Check the kernel/client version before relying
+on acceptance results; older clients do not expose them.
+
+Requires Chronicle 19.77.2 for stopped/deactivated catch-up and replay steps to
+drain within the job-step stop timeout and resume from their durable checkpoint.
+This does not make external effects exactly once.
+
 ### Next-event lookup failures
 
 Routing keeps the saved position and defers observation when

package/package/corpus/skills/cratis-chronicle-hosting/references/storage-resolution.md

@@ -0,0 +1,55 @@
+<!-- Copyright (c) Cratis. All rights reserved. -->
+<!-- Licensed under the MIT license. See LICENSE file in the project root for full license information. -->
+
+# Resolve kernel storage destinations and identities
+
+Requires Chronicle 19.74.0 for storage connection resolution.
+Requires Chronicle 19.74.2 for the kernel startup fix; the first two patches
+of this feature fail startup. Check the deployed image tag before changing configuration. Without resolution, configured storage
+behavior stays unchanged.
+
+## Scope and purpose
+
+`storage.connectionResolution` uses Arc's connection contract with `Connection`
+then `Identity` slots. Choose `Default`, `Template`, `Http`, or `Custom` for an
+in-process kernel. The HTTP request scope includes `kind`, `eventStore` and
+`namespace`. A resolver may supply connection string, database, schema or
+identity independently. Supply credentials through approved configuration or
+the trusted resolver, never source files or logs.
+
+Resolution covers event-store, namespace and read-model databases on SQL and
+MongoDB. A resolved connection string or database is used as given, without
+name derivation or a `DatabaseNames` binding. Moving the resolved destination
+is not a data migration. Existing data, schema and permissions must be prepared
+at the intended location before traffic is moved.
+
+The cluster database's location stays on `storage.connectionDetails`; its
+identity can resolve for `Schema` work. Schema creation, migrations, table
+migrations and replay swaps use `Schema`; data access uses `Runtime`. Do not
+assume namespace job storage and cluster storage use the same purpose or scope.
+
+## Schema and provisioning
+
+`storage.createIfMissing = false` makes a missing database or schema fail with
+`DatabaseDoesNotExist` or `SchemaDoesNotExist` instead of creating it.
+`storage.schema` selects Chronicle's SQL schema. PostgreSQL puts it first on
+the search path; SQL Server requires the database user's default schema to
+match or migration fails with `DefaultSchemaMismatch`. Schema discovery only
+considers that schema, not a same-named table elsewhere in a shared database.
+
+## Identity rotation
+
+SQL resolves identities each time a connection opens, including refreshed
+passwords or tokens. A failed login drops the cached resolution before retry.
+MongoDB separates clients with different credentials and supports MONGODB-OIDC
+access tokens refreshed through resolution. Password-based MongoDB clients do
+not acquire a new password merely because configuration changes; restart them
+when rotating that credential.
+
+## Verify
+
+Use the real target provider in integration specs: resolve two namespace
+destinations, verify data isolation, run schema-purpose migration with its own
+identity, and assert missing schema/database failure when creation is disabled.
+Exercise expiry and failed-login invalidation without printing the resolved
+credentials. A healthy process alone does not prove the selected destination.

package/package/corpus/skills/cratis-chronicle-multi-tenancy/SKILL.md

@@ -28,6 +28,9 @@ Sources:
 
 Reverify product sources before claiming support for another version.
 
+Read references/remove-namespace.md when removing a tenant: provider-owned data,
+application read models, reminders and reconnect behavior have different boundaries.
+
 ## The concept
 
 | Term | Meaning |