@cratis/pi 7.75.0 → 7.76.0

package/package/corpus/skills/cratis-arc-react-page/references/queries-and-commands.md

@@ -43,6 +43,18 @@ function**:
 The underlying hooks live in `@cratis/arc.react/queries` if you need them
 directly.
 
+Requires Arc 22.112.1 for optional-argument changes to refetch snapshot queries
+and for concurrent same-key readers to settle together. Requires Arc 22.113.1
+for cancellation/unmount scope cleanup. Requires Arc 22.116.1 for observable
+page/size/sort changes to resubscribe and for query hooks to stop showing the
+previous key's data or status after arguments, paging or sorting change. Check
+`npm ls @cratis/arc.react`; upgrade older clients rather than relying on these
+state transitions.
+
+Each key includes arguments, page, size and sorting. A changed key shows that
+key's cached result, or an initial not-ready result, never the old key's rows.
+Two different pages must not share one request or subscription.
+
 ### The result object
 
 Every query hook returns a result carrying:
@@ -69,7 +81,8 @@ states separately instead of collapsing them into "loaded or not":
 | Converged, empty | `hasData` with an empty `data` and no recent command | the designed empty state |
 | Converged, populated | `hasData` with items | the content |
 | Failed | `!isSuccess` / `hasExceptions` / `!isAuthorized` | the matching error affordance |
-| Stale refresh | `isPerforming` while `data` still holds the previous result | keep the old content, indicate refresh |
+| Same-key refresh | `isPerforming` while `data` still holds that key's previous result | keep that content, indicate refresh |
+| Changed arguments/page/sort | new key's cached result, or initial not-ready state | show only the new key's content or a skeleton |
 
 Two consequences. After a create command, take the **window action on the
 command's success** (close the dialog, navigate to the new id) and let the list

package/package/corpus/skills/cratis-chronicle-client-dotnet/SKILL.md

@@ -28,6 +28,11 @@ Source: `Cratis/Chronicle`.
 
 Take the version from nuget.org, not the placeholder version in the source.
 
+Read references/occurrences.md when recording durable triggers, implementing
+occurrence handlers, or choosing startup/shutdown activation and retry semantics.
+Read references/immediate-append-refusal.md when a unit must prevent immediate
+appends from escaping its atomic receipt boundary before transport.
+
 ## Lifecycle
 
 Read [references/lifecycle.md](references/lifecycle.md) when waiting for registration (`WaitForRegistration`, not polling `IsConnected`), diagnosing quiet observers (keepalive loss fails silently, not with an exception), or disposing the client.

package/package/corpus/skills/cratis-chronicle-client-dotnet/references/immediate-append-refusal.md

@@ -0,0 +1,40 @@
+<!-- Copyright (c) Cratis. All rights reserved. -->
+<!-- Licensed under the MIT license. See LICENSE file in the project root for full license information. -->
+
+# Refuse immediate appends before transport
+
+Requires Chronicle 19.81.0. Check with `dotnet list package`; older clients cannot
+prevent an escaped immediate append with this API. Return events or stage them
+transactionally instead; detecting an immediate append after it committed is
+not a retry-safe boundary.
+
+`IUnitOfWork.RefuseImmediateAppends()` returns a disposable frame. While its first
+frame is alive, native immediate append entry points in the current flow throw
+before transport, including captured sequence references and references to a
+different store. Transactional appends still enroll in the unit. This does not
+enable read protection or change read admission.
+
+## Who completes
+
+- With no existing completion owner and no enforced read protection, the first
+  frame owns completion. Use that frame's asynchronous `Commit` or `Rollback`.
+- Inside an ASP.NET-owned unit, or an enforcing read-protected unit, the frame is
+  refusal-only. Its `Commit` and `Rollback` throw
+  `ImmediateAppendRefusalRequiresOwner`; completion stays with the existing owner.
+- Nested frames borrow the refusal scope; they do not acquire completion rights.
+  Refusal lasts until the first frame is disposed, even if it already committed.
+- Replacing the ambient unit with `Begin` or `SetCurrent` while the frame lives
+  is refused. Dispose the frame at the boundary rather than trying to escape it.
+
+This prevents immediate Chronicle writes, not external I/O. Use it around a
+custom unit that must commit atomically with a receipt, and handle the ordinary
+commit result. Do not assume Arc's occurrence executor installs this frame.
+
+## Verify
+
+In a spec, attempt an immediate append through both the current event log and a
+previously captured reference; assert that neither reaches transport. Assert
+that transactional work commits with its receipt, that an unsupported kernel
+fails closed, and that borrowed frames cannot complete another owner's unit.
+Run `dotnet test` on the owning project. In-process proof is not a substitute for
+integration coverage of the storage provider's transaction boundary.

package/package/corpus/skills/cratis-chronicle-client-dotnet/references/lifecycle.md

@@ -31,6 +31,10 @@ This reference holds registration wiring, the registration wait, keepalive and w
   falls more than 5 seconds behind is treated as a lost connection, with
   reconnect backoff capped at 30 seconds. **The failure mode is silence, not an
   exception** — appends keep working while observers go quiet.
+- Requires Chronicle 19.72.1 for reactor/reducer `ClientIsNotConnected` stream
+  failures to reconnect the whole client with a fresh connection id and register
+  all observers again. Older clients can retry a stale registration indefinitely;
+  check `dotnet list package` before diagnosing that as a quiet handler.
 - `Dispose()` disposes read model reactors for created stores, cancels the owned
   connection, and disposes the connection
   (`Source/Clients/DotNET/ChronicleClient.cs`, `Dispose`).

package/package/corpus/skills/cratis-chronicle-client-dotnet/references/occurrences.md

@@ -0,0 +1,89 @@
+<!-- Copyright (c) Cratis. All rights reserved. -->
+<!-- Licensed under the MIT license. See LICENSE file in the project root for full license information. -->
+
+# Durable application occurrences
+
+Requires Chronicle 19.77.0 for the .NET occurrence client and testing surface.
+Check with `dotnet list package`; older clients need an upgrade, not an event
+appended just to wake a reactor. The kernel must advertise `occurrences` and,
+for receipted effects, `effect-receipts`; absent or unknown support fails closed.
+
+## Record and handle
+
+Occurrences are a durable work queue, not domain events or a compliance store.
+Trigger payloads are plaintext: never put personal data or operational secrets
+in them. Compliance-marked trigger schemas are refused. Keep a stable reference
+and resolve protected information through its owning service instead.
+
+```csharp
+using Cratis.Chronicle.Occurrences;
+
+[Trigger("refresh-catalog")]
+public record RefreshCatalog(string Catalog);
+```
+
+Implement `IOccurrenceHandler<RefreshCatalog>` with the signature
+`Task Handle(RefreshCatalog trigger, OccurrenceContext context,
+CancellationToken cancellationToken)`. Handlers are discovered like reactors. Record
+with `eventStore.Occurrences.Record(trigger, idempotencyId)` using a stable
+idempotency id. Inspect `Recorded`, `AlreadyRecorded`, `OccurrenceIdConflict`
+and `OccurrencePayloadInvalid`; a reused id with different content is not a
+successful retry.
+
+The client claims due work and renews its fenced lease while the handler runs.
+Failure backs off and eventually quarantines that occurrence without blocking
+later work. A stale lease epoch cannot renew, complete or fail another worker's
+lease. Delivery can repeat after a crash: a lease is not exactly-once execution.
+
+## Receipt boundary
+
+Use `context.EffectKey(effectName)` for one stable effect name within an
+occurrence. `IUnitOfWork.UseEffectReceipt(key, response)` commits the receipt
+atomically with transactional events. Zero-event units can also be receipted;
+protected reads still have to validate. A repeated effect returns its stored
+outcome instead of appending again. Unknown commit results are settled by receipt
+lookup, or fail retryably rather than inventing success.
+
+Do not put secrets in a receipt response: it is stored data. An external system
+must accept the effect key as its own idempotency key if its effect must survive
+redelivery. A Chronicle receipt cannot make arbitrary network I/O atomic.
+
+Read references/immediate-append-refusal.md when a custom receipt boundary must
+prevent immediate appends before transport. In Arc, use the
+**cratis-arc-command-execution** occurrence executor instead of hand-building the
+command's authorization and receipt boundary.
+
+## Startup and shutdown
+
+`Startup` and `Shutdown` are built-in triggers. Set `ChronicleOptions.ActivationId`
+to the stable logical deployment activation, not a random id on every restart.
+`ActivationScope.PerProcess` instead selects one activation per process.
+`LifecycleScope.Application` is the default; `AllNamespaces` durably fans out
+over a fixed namespace snapshot, so a crash resumes that fan-out without duplicates.
+
+A logical shutdown is recorded by `IOccurrences.EndActivation(id)`; stopping one
+pod is not a logical activation ending. Per-process host shutdown is bounded,
+not guaranteed to run during a kill or crash. ASP.NET Core and generic hosts wire
+the lifecycle service automatically; standalone clients own their lifecycle.
+
+## Specify retries explicitly
+
+`OccurrenceScenario<THandler>` in `Cratis.Chronicle.Testing.Occurrences` drives
+a handler through in-process ingress, claims, receipts and completion:
+
+- `Record(trigger, idempotencyId)` records without delivering.
+- `DeliverNext()` claims and invokes; advancing `Time` alone delivers nothing.
+- `DeliverWithoutCompleting()` simulates loss after work but before acknowledgement.
+- `Replies` can drop a committed append's reply; `Capabilities` on the testing
+  store can model current, old or unknown kernel support.
+- Register real constructor dependencies in `Services` before the first operation.
+  Assert durable events and receipts as well as the delivery outcome.
+
+There are no background workers, automatic lease renewals or reminders in this
+scenario; it does not prove behavior in a real multi-node cluster. Run
+`dotnet test` on the owning spec project and assert duplicate ingress, redelivery,
+terminal refusal, lost reply and unsupported-capability paths.
+
+Requires Chronicle 19.78.0 for `Defaults` and `EventStoreForTesting` constructors
+accepting an `EventStoreName` and `EventStoreNamespaceName`. Scenarios built from
+such defaults inherit that identity; old constructors retain `testing`/`default`.

package/package/corpus/skills/cratis-chronicle-client-dotnet/references/pinned-generation-delivery.md

@@ -3,6 +3,14 @@
 
 # Pin event generations before connecting
 
+## Contents
+
+- Standalone client
+- Host integration
+- Scope and registration
+- Event-store subscription pins
+- Product sources
+
 Requires Chronicle **19.41.0+** for client reactors/reducers and **19.48.0+** for
 typed materialized projections. Upgrade every kernel silo before enabling the
 option. `Compatibility` remains the default; adding a generation alone does not
@@ -72,13 +80,35 @@ builder.AddCratisChronicle(options =>
   submitted as both wildcard and `Pinned` is unsupported and rejected by the
   kernel with `EventGenerationDeliveryNotSupported`; the option does not make
   wildcard pinning work.
-- Ad-hoc queries/event reads are not opted in. Neither are webhooks, captures,
-  or event-store subscriptions. Do not generalize this option to every read
-  path, or to unreleased generation-delivery work.
+- Ad-hoc queries/event reads, webhooks and captures are not opted in. Event-store
+  subscriptions have their own builder opt-in below; the client-wide setting
+  does not enable it.
 
 For delivery-time migration, persisted PDL pins, and testing limits, read
 [the migration reference](../../cratis-chronicle-event-type-migration/references/pinned-generations.md).
 
+## Event-store subscription pins
+
+Requires Chronicle 19.66.0 on client and kernel. Check `dotnet list package`
+and the deployed kernel tag; older builders may throw
+`EventStoreSubscriptionGenerationDeliveryNotSupported`. Compatibility remains
+the default.
+
+On `eventStore.Subscriptions.Subscribe(id, sourceStore, configure)`, configure
+`WithGenerationDelivery(EventGenerationDelivery.Pinned)` and either
+`WithEventType<TEvent>()` for that CLR type's declared generation or
+`WithEventType(eventTypeId, generation)` for an explicit pin. This selects the
+generation forwarded into the target inbox during live delivery, catch-up,
+replay and partition retries; it is separate from the inbox observer's own pin.
+
+Both stores must register the generation. Registration refuses a missing
+source/target generation or two generations of the same identifier. If the
+target loses its pin at forwarding time, the failing batch appends nothing and
+does not advance past the failing event; earlier acknowledged events stay
+acknowledged. Changing only a pin or delivery mode rebinds the subscription in
+place, without an unsubscribe. Verify migration and protected-value release
+through real-client integration, not just a handler fed the desired CLR type.
+
 ## Product sources
 
 Source: `Cratis/Chronicle`:

package/package/corpus/skills/cratis-chronicle-decision-reads/SKILL.md

@@ -143,8 +143,11 @@ command protection, caching and enrollment; older Arc refuses them.
 Enroll the read **before** staging its decision's events through
 `EventLog.Transactional` and let the owning unit of work commit. Inspect
 `IsSuccess`, append errors/constraint violations/concurrency violations and
-`GetDecisionConflicts()`; the latter reports decision conflicts without exposing
-sequence numbers. On a kernel whose append validators accept an empty batch
+`GetDecisionConflicts()`. Requires Chronicle 19.76.0 for the nullable
+`ConflictingEventTypeId` and `ConflictingEventSequenceNumber` on decision conflicts
+and concurrency violations. They name the first event matching the failed guard;
+older kernels leave both null. Conflict JSON contains the read-model identifier,
+not its CLR type. Check with `dotnet list package` before asserting these fields. On a kernel whose append validators accept an empty batch
 (a kernel that does so when a scope carries an actual boundary or expects no matching event), a checked empty
 append validates its scope and writes nothing; a kernel that rejects it surfaces
 `DecisionReadValidateOnlyNotSupported`, which fails closed. Do not mistake "no

package/package/corpus/skills/cratis-chronicle-decision-reads/references/admission-and-ownership.md

@@ -21,7 +21,7 @@ an adapter for arbitrary read-model storage:
 | OpenEndedEventTypes / Derivatives / FromEventProperty | all-events, FromEvery, or event-property routing |
 | NotEventSourceKeyed / KeyConversion | keys not convertible to the admitted raw source key |
 | NoEventTypes / UnsupportedEventTypeId | no finite guarded type set or unsupported encoded type ids |
-| InvalidKey / FoldIncomplete / DefinitionMismatch | runtime key, fold or client/kernel definition disagreement |
+| InvalidKey / FoldIncomplete / DefinitionMissing / DefinitionMismatch | runtime key, fold, missing kernel definition or client/kernel definition disagreement |
 | StreamKeyRequiresStreamScope | stream-keyed model read without a stream scope |
 | StreamScopeNotSupported / AllStreamsNotSupported / StreamKeyRequiresExplicitStreamId | unsupported stream reader or incomplete stream selection |
 
@@ -35,6 +35,12 @@ Do not silently replace a refused decision read with a materialized sink read.
 Redesign the decision model as a focused admitted projection only when the
 contract permits it, or surface the missing capability.
 
+Requires Chronicle 19.75.0 for `DefinitionMissing` to be distinct from
+`DefinitionMismatch`. Refusals are not cached, a read checks definitions once
+more before refusing, and agreement is invalidated on connect/disconnect. A
+matching definition can therefore recover after restart without restarting the
+application. Check `dotnet list package`; older clients can retain a refusal.
+
 ## Completion is owned
 
 `IUnitOfWork.HasEnrolledDecisionReads` is sticky: it remains true after commit,
@@ -53,6 +59,17 @@ all late staging. Protected work and owner completion checks remain enforced;
 `UnitOfWorkIsCompleting` must not be caught and interpreted as success. An
 in-flight commit cannot be undone by a competing rollback.
 
+Requires Chronicle 19.76.0 for `IUnitOfWork.SuspendReadRegions()`: nested hosts
+can suspend inherited regions and restore them by disposing the scope. This is
+not permission to bypass a guarded decision. Arc uses it from 22.113.0;
+read-model injection outside the command decision under `On` is refused unless
+the model is deliberately `[Unprotected("why")]`.
+
+Requires Chronicle 19.81.0 for `RefuseImmediateAppends()`, which changes immediate
+write admission, not read admission. Read
+**cratis-chronicle-client-dotnet**'s immediate-append refusal reference before
+claiming completion rights for its returned frame.
+
 Keep read, decision, enrollment and completion inside one ambient async context.
 If a commit rejects the read, start a new read/decision attempt rather than
 reusing the stale protected instance or appending its events without the guard.

package/package/corpus/skills/cratis-chronicle-event-type-migration/references/pinned-generations.md

@@ -51,6 +51,12 @@ client and kernel registration exception names. Changing a reactor/reducer's
 pin or delivery mode does not itself trigger replay; request replay when prior
 state needs rebuilding.
 
+Requires Chronicle 19.66.0 for generation-pinned event-store subscriptions.
+Their builder opts in separately with `WithGenerationDelivery(Pinned)` and
+explicit or typed event pins; the global observer option does not opt them in.
+Both source and target stores must register the generation. Read the client
+reference above for registration and forwarding failure behavior.
+
 ## PDL pins are resolved once, when saved
 
 For a PDL definition saved with `GenerationDelivery = Pinned`, a bare reference

package/package/corpus/skills/cratis-chronicle-hosting/SKILL.md

@@ -48,6 +48,9 @@ operator/kernel surface, not an application-profile layout rule.
   development database ports on loopback only; a host application needing MongoDB
   must be able to reach port 27017. Do not expose unauthenticated MongoDB.
 
+Read references/storage-resolution.md when choosing per-namespace destinations,
+separate schema/runtime identities, SQL schemas, or disabling automatic creation.
+
 ## Supply certificates before starting production
 
 Default TLS needs a PFX certificate with a private key:

package/package/corpus/skills/cratis-chronicle-hosting/references/operations.md

@@ -65,6 +65,32 @@ on every silo and resume from the last durable position after a failed window.
 Check the kernel version and shutdown logs; neither guarantee makes an interrupted
 external effect exactly once.
 
+Requires Chronicle 19.77.4 for an observer replaced by a newer connected client
+to hand over to a still-connected older client when the newer one disconnects.
+The newest registration wins while both are connected; the older handler does
+not receive event types only the departed client handled. Check the kernel tag;
+older kernels can leave that observer stopped.
+
+### Job acceptance and bounded recovery
+
+Requires Chronicle 19.80.0 for `IJobs.Stop` and `IJobs.Resume` to return
+`JobCommandResult` with `Accepted` and a refusal reason. A completed RPC is not
+an accepted operation: inspect the result. `RetryFailedPartitions` retries
+partitions through bounded per-partition jobs without reopening a concluded
+replay. Do not invent a CLI flag for this contract operation.
+
+Timed-out job steps retry up to five attempts. Replay work has at most 16
+partition steps active, but projection replay/catch-up still use the single
+ordered step above; do not generalize partition parallelism to projections.
+Running jobs whose steps concluded over two minutes ago are reconciled, and
+replay-complete notifications retry. These recovery paths do not clear quarantine or
+prove historical completeness. Check the kernel/client version before relying
+on acceptance results; older clients do not expose them.
+
+Requires Chronicle 19.77.2 for stopped/deactivated catch-up and replay steps to
+drain within the job-step stop timeout and resume from their durable checkpoint.
+This does not make external effects exactly once.
+
 ### Next-event lookup failures
 
 Routing keeps the saved position and defers observation when

package/package/corpus/skills/cratis-chronicle-hosting/references/storage-resolution.md

@@ -0,0 +1,55 @@
+<!-- Copyright (c) Cratis. All rights reserved. -->
+<!-- Licensed under the MIT license. See LICENSE file in the project root for full license information. -->
+
+# Resolve kernel storage destinations and identities
+
+Requires Chronicle 19.74.0 for storage connection resolution.
+Requires Chronicle 19.74.2 for the kernel startup fix; the first two patches
+of this feature fail startup. Check the deployed image tag before changing configuration. Without resolution, configured storage
+behavior stays unchanged.
+
+## Scope and purpose
+
+`storage.connectionResolution` uses Arc's connection contract with `Connection`
+then `Identity` slots. Choose `Default`, `Template`, `Http`, or `Custom` for an
+in-process kernel. The HTTP request scope includes `kind`, `eventStore` and
+`namespace`. A resolver may supply connection string, database, schema or
+identity independently. Supply credentials through approved configuration or
+the trusted resolver, never source files or logs.
+
+Resolution covers event-store, namespace and read-model databases on SQL and
+MongoDB. A resolved connection string or database is used as given, without
+name derivation or a `DatabaseNames` binding. Moving the resolved destination
+is not a data migration. Existing data, schema and permissions must be prepared
+at the intended location before traffic is moved.
+
+The cluster database's location stays on `storage.connectionDetails`; its
+identity can resolve for `Schema` work. Schema creation, migrations, table
+migrations and replay swaps use `Schema`; data access uses `Runtime`. Do not
+assume namespace job storage and cluster storage use the same purpose or scope.
+
+## Schema and provisioning
+
+`storage.createIfMissing = false` makes a missing database or schema fail with
+`DatabaseDoesNotExist` or `SchemaDoesNotExist` instead of creating it.
+`storage.schema` selects Chronicle's SQL schema. PostgreSQL puts it first on
+the search path; SQL Server requires the database user's default schema to
+match or migration fails with `DefaultSchemaMismatch`. Schema discovery only
+considers that schema, not a same-named table elsewhere in a shared database.
+
+## Identity rotation
+
+SQL resolves identities each time a connection opens, including refreshed
+passwords or tokens. A failed login drops the cached resolution before retry.
+MongoDB separates clients with different credentials and supports MONGODB-OIDC
+access tokens refreshed through resolution. Password-based MongoDB clients do
+not acquire a new password merely because configuration changes; restart them
+when rotating that credential.
+
+## Verify
+
+Use the real target provider in integration specs: resolve two namespace
+destinations, verify data isolation, run schema-purpose migration with its own
+identity, and assert missing schema/database failure when creation is disabled.
+Exercise expiry and failed-login invalidation without printing the resolved
+credentials. A healthy process alone does not prove the selected destination.

package/package/corpus/skills/cratis-chronicle-multi-tenancy/SKILL.md

@@ -28,6 +28,9 @@ Sources:
 
 Reverify product sources before claiming support for another version.
 
+Read references/remove-namespace.md when removing a tenant: provider-owned data,
+application read models, reminders and reconnect behavior have different boundaries.
+
 ## The concept
 
 | Term | Meaning |

package/package/corpus/skills/cratis-chronicle-multi-tenancy/references/remove-namespace.md

@@ -0,0 +1,38 @@
+<!-- Copyright (c) Cratis. All rights reserved. -->
+<!-- Licensed under the MIT license. See LICENSE file in the project root for full license information. -->
+
+# Remove a namespace
+
+Requires Chronicle 19.73.0 for `IEventStore.RemoveNamespace`.
+Requires Chronicle 19.75.1 for reminder cleanup.
+Requires Chronicle 19.76.1 for concurrent re-subscription recovery.
+Requires client 19.77.1 for forgetting a removed namespace on reconnect. Check
+with `dotnet list package` and the kernel image tag; older pairs can recreate
+an apparently removed namespace.
+
+This is destructive tenant removal, not a way to hide a tenant in the UI.
+Before calling it, confirm the named event store and namespace, the authorized
+scope, backups and application-owned storage disposition. Never target the
+default namespace: its removal is refused. Removing an unknown namespace is a
+no-op, and an interrupted removal can be repeated.
+
+Removal first stops listing the namespace, unsubscribes and removes its
+observers and their persistent reminders, then drops provider-owned namespace
+storage and forgets the namespace. Forwarding and pattern observers with no
+saved state are included through their reminders. Re-subscriptions already in
+flight are handled by bounded unsubscribe/remove retries.
+
+MongoDB drops its namespace database. SQL and in-memory providers retain their
+namespace data; do not claim removal is erasure in those providers. Application
+read-model databases are not dropped: the application owns that data and its
+separately authorized cleanup.
+
+On reconnect a non-default store asks whether its namespace still exists. If
+absent, it releases that store instead of re-registering it; if the kernel
+cannot answer, registration follows the older behavior. Explicitly using the
+namespace again can create it anew. Stop or reroute writers when removal must
+remain final.
+
+Verify removal with a matching kernel and provider, including restart and
+reconnect, and separately inspect the disposition of application-owned data.
+Do not create or delete a live tenant merely to test this workflow.

package/package/corpus/skills/cratis-chronicle-projection/references/definition-changes.md

@@ -23,5 +23,31 @@ history. Sources: `Documentation/projections/registration-lifecycle.md`,
 `Documentation/concepts/observers.mdx`, `Observation/Jobs/{CatchUpObserver,ReplayObserver}.cs`
 and `Observation/States/Routing.cs` (under `Source/Kernel/Core/`).
 
+## Rolling deployment versions
+
+Requires Chronicle 19.79.0 on client and kernel for projection registration's
+`ChronicleOptions.SoftwareVersion`. It defaults to the entry assembly's informational version;
+`Cratis:Chronicle:SoftwareVersion` overrides it, and startup warns on `1.0.0`.
+Check `dotnet list package` and the kernel image tag; older kernels ignore it.
+
+The kernel compares semantic-version precedence, including prerelease labels.
+An older definition cannot overwrite a newer stored version, and an older
+full-set registration cannot retire newer projections. Equal, missing or
+unparseable versions retain ordinary registration behavior. An intentional
+rollback must give the older code a software version higher than the stored
+one. Changing only software version does not request a replay; definition
+evolution policy still determines that.
+
+## Namespace reconciliation
+
+Requires Chronicle 19.81.1 for projections and captures to reconcile subscriptions
+in every namespace, including runtime-created namespaces. Explicit ensure waits
+for healthy subscriptions; implicit first-append creation is reconciled within
+a watchdog interval. A broken definition does not block healthy ones or creation.
+A lost subscription is repaired, but reconciliation never lifts quarantine,
+revives a retired observer, or restarts a stopped/deleted capture. A kernel
+restart or a newly added namespace still ends projection quarantine through a
+fresh subscription; do not interpret ordinary watchdog repair as operator clear.
+
 Closing a stream does not erase its events or prevent a projection replay.
 Keep the closing fact as history; see **cratis-chronicle-event-constraints**.

package/package/corpus/skills/cratis-chronicle-projection/references/model-bound-attributes.md

@@ -59,6 +59,14 @@ pair it with `[NotRewindable]`. `[NotProjected]` excludes a query-assembled memb
 from AutoMap and CHR0024. Sources: `Projections/ModelBound/NotProjectedAttribute.cs`,
 `Projections/FromEveryBuilder.cs`, and `Documentation/projections/model-bound/`.
 
+Requires Chronicle 19.78.1 for `[FromAll]`/`[FromEvery]` properties under
+`[ChildrenFrom<T>]` or `[Nested]` to be declared on the child itself, including
+the event creating it. Parent all-event mappings are not copied into children.
+Older client definitions with root-declared child mappings work only when the
+root has no property with the same name; otherwise the mapping stays on the
+root until the client is upgraded. Check client/kernel versions and replay
+affected projections to rebuild already materialized child values.
+
 ## Setting values
 
 | Attribute | Arity | Parameters | Targets |

package/package/corpus/skills/cratis-chronicle-reactor/SKILL.md

@@ -133,32 +133,15 @@ re-delivers the event as an ordinary observation, and a `[OnceOnly]` handler run
 again. Catch-up and crash redelivery are not replay either; every ordinary
 matching event can run, even on the same source. Keep effects idempotent.
 
-**A reactor new to a store catches up the whole history on first registration, and
-`[OnceOnly]` does not cover that.** For a side-effect reactor (jobs, AI or external
-calls), start the observer at the tail or have the handler ignore facts that
-predate its registration, and specify that history causes nothing. A
-reconciliation sweep that decides from a read model must not run while that model's
-observer is replaying or behind: a rebuilding model looks like "never processed".
-Decide from the events or a `[Passive]` model, and specify the replaying case.
+**A new reactor catches up history; `[OnceOnly]` does not stop that.**
+Requires Chronicle 19.70.0 for `[StartAtTail]` to start only its first registration
+at the tail; existing positions remain. Upgrade the server first: older kernels
+ignore it. Read references/starting-and-replaying.md when avoiding pre-registration
+side effects or choosing alternate replay behavior.
 
 Analyzer **CHR0022** (warning) requires `[OnceOnly]` on a handler that returns
 event side effects, because a replay would otherwise append duplicates.
 
-`Cratis.Chronicle.Reactors.ReplayAttribute` (`[Replay]`) is the other half, and
-targets a method only. Mark a **second** handler for the same event type with it
-when replay needs to do something *different* rather than nothing:
-
-```csharp
-public Task <MethodName>(<EventName> @event) => <serviceName>.<Operation>(@event.<Property>);
-
-[Replay]
-public Task <MethodName>DuringReplay(<EventName> @event) => Task.CompletedTask;
-```
-
-With a `[Replay]` handler present, only it runs during replay. Without one, the
-ordinary handler runs during replay as before. An event type handled *only* by a
-`[Replay]` handler is still subscribed to.
-
 ## Identity and event sequence
 
 `Cratis.Chronicle.Reactors.ReactorAttribute` takes two optional arguments:

package/package/corpus/skills/cratis-chronicle-reactor/references/starting-and-replaying.md

@@ -0,0 +1,33 @@
+<!-- Copyright (c) Cratis. All rights reserved. -->
+<!-- Licensed under the MIT license. See LICENSE file in the project root for full license information. -->
+
+# Start at the tail and distinguish replay
+
+Requires Chronicle 19.70.0 for `[StartAtTail]` in
+`Cratis.Chronicle.Reactors`. Upgrade the server before the client: an older
+server ignores the field and catches up from the beginning. Check with
+`dotnet list package` and the kernel image tag.
+
+Put `[StartAtTail]` on a side-effect reactor that should observe only future
+events. It changes the **first registration**: an observer already holding a
+position keeps it. Leaving the attribute in place is safe, but adding it is not
+a command to fast-forward an existing observer. Specify that historical facts
+cause no effect on first registration.
+
+`[OnceOnly]` excludes replay, not initial catch-up, failed-partition recovery
+or crash redelivery. Keep side effects idempotent. A reconciliation sweep must
+not decide from a model that is replaying or behind: rebuilding state can look
+like "never processed". Decide from events or a passive model and cover that case.
+
+## Alternate replay behavior
+
+`Cratis.Chronicle.Reactors.ReplayAttribute` targets a method. Mark a second
+handler for the same event type when replay must do different work. With that
+handler present only it runs during replay; without one, the ordinary handler
+runs unless excluded by `[OnceOnly]`. An event type handled only by a `[Replay]`
+handler is still subscribed to.
+
+Verify first registration, restart with an existing position, replay and
+failed-partition redelivery separately. Assert the external effect count, not
+only that the handler was invoked. Run `dotnet test` on the owning spec project;
+server-first compatibility and durable positions also need kernel integration.

package/package/corpus/skills/cratis-chronicle-read-model/SKILL.md

@@ -215,8 +215,8 @@ current rather than eventually consistent.
 **Passive is fresher, not safer.** A materialized read may lag the log; a passive
 read is current when read. Neither captures a position or enrolls a guard, so
 neither makes a rule hold when two requests race. To guard a decision use a decision
-read over a flat, event-source-keyed projection with an `Id` property (reducers and
-self-reducing models are refused), a constraint for uniqueness, or an aggregate;
+read over an admitted projection or unfiltered dependency-free reducer, a
+constraint for uniqueness, or an aggregate;
 see [choosing how a rule holds](../cratis-chronicle-decision-reads/references/choosing-how-a-rule-holds.md).
 
 **`IMongoCollection<T>` reads only the sink.** It cannot compute passive state:
@@ -227,6 +227,13 @@ read-model parameter injection) when you need its computed state. Do not remove
 Keep secret-bearing state on the protected access path; project only safe
 metadata into a separate list/search model.
 
+Requires Chronicle 19.77.3 for strongly consistent per-key projections to fold
+from the start on every read: passive, stream-scoped, wildcard-key and session
+reads immediately reflect revisions, redactions and joined-subject erasure.
+Earlier warm reads can retain old content. Each read costs O(key history), not
+an incremental suffix; prefer materialization for frequent long-history reads.
+Check the deployed kernel tag before relying on this freshness.
+
 The number of passive types is not itself a performance smell. Review event
 history length, invocation frequency, and the consistency/security requirement;
 repeated reconstruction of large histories on a hot path is the concern.

package/package/corpus/skills/cratis-chronicle-read-model/references/queries.md

@@ -32,10 +32,15 @@ Chronicle extensions — Chronicle declares no `Observe` on `IMongoCollection<T>
 
 ## Discovery rules
 
-Arc discovers **public static** methods; private and compiler-generated methods
-are never queries. Use `[ReadModel(RequireQueryAttribute = true)]` and `[Query]`
-on intended endpoints when the type also has folds (`Create`/`Reduce`) or public
-helpers. `[Query]` alone does not hide siblings. ARC0026 checks invalid/ambiguous
+Arc discovers eligible **public and internal static** methods on `[ReadModel]`
+types. Internal visibility is not an endpoint privacy boundary. Keep helpers
+outside the read model, regardless of their visibility. Use
+`[ReadModel(RequireQueryAttribute = true)]` and `[Query]` on intended endpoints
+when the type also has folds (`Create`/`Reduce`); `[Query]` alone does not hide
+siblings. Requires Arc 22.27.1 for exclusion of private, protected, special-name
+and compiler-generated methods; older versions can expose private statics too.
+Check with `dotnet list package`; on older versions move helpers out rather
+than relying on visibility. ARC0026 checks invalid/ambiguous
 query declarations; ARCCHR0019 warns about fold-like statics exposed by convention.
 Requires Arc 22.90.0 for automatic exclusion of methods taking the model itself,
 including `Reduce(event, current)`; `[Query]` cannot force such a method into an