@cratis/pi 7.75.0 → 7.77.0

package/package/corpus/harnesses/copilot/instructions/authoring-skills.instructions.md

@@ -30,6 +30,8 @@ Use portable fields: `name`, `description`, `license`, `compatibility`, `metadat
 
 An explicit trigger clause (`Use when`, `Load when`, `Read when` or an equivalent) and neutral voice are required even with `SKILL_AUTHORING_MODE=warn`. Negative routing and meta-language findings follow that switch; the 700-character target is guidance, not a gate.
 
+The overlap lint warns when positive trigger token sets have Jaccard similarity (intersection / union) **>= 0.4**, compared before rounding. It lowercases ASCII word tokens, deduplicates them and removes routing boilerplate and common function words. Only the explicit `Use when` (or equivalent) clause counts, stopping at negative routing; empty triggers never match. The warning stays advisory even in strict mode: shared vocabulary is a review signal, not proof of competing scope. Sharpen the trigger and add a sibling pointer rather than padding it with unrelated words.
+
 ## 3. Budget and progressive disclosure
 
 Target at most 400 body lines and 16,000 characters; the hard limits remain 500 lines and 20,000 characters. A warning starts above the 16,000-character target, so a body that outgrows it is split before it nears the hard limit; characters only approximate tokens.

package/package/corpus/harnesses/copilot/instructions/capability-is-not-authority.instructions.md

@@ -41,5 +41,9 @@ Levels of Authority in [`general.md`](../../../rules/general.md).
 - **[contract] Absent authority for a consequential effect, stop and ask about that
   effect in plain language.** State the exact target, action, consequence, and recovery;
   a missing answer is a blocker for that effect, not for unrelated in-scope work.
+- **[contract] Never copy secrets or personal values into models, notes, state,
+  packets or briefs.** Never use real credentials or personal data in examples.
+- **[contract] Legacy extraction uses Git read-only:** never checkout, reset or stash
+  the legacy repository; do not touch a live checkout the brief excludes.
 - **[convention] Prefer the narrowest capability that does the job.** Reaching for the
   broadest available grant makes the next reader assume it was authorized.

package/package/corpus/harnesses/copilot/instructions/efcore.instructions.md

@@ -68,6 +68,8 @@ Migrations are created and applied with the **standard EF Core tooling** (`dotne
 | `table.JsonColumn<TProperty>(migrationBuilder, …)` | a `[Json]`-mapped property |
 | `migrationBuilder.Add{String,Guid,Number,Bool,DateTimeOffset,AutoIncrement,Json,Point,LineString,Polygon}Column(…)` | adding a column to an existing table |
 
+A migration that is committed or applied to any database is append-only: never edit or delete it. Correct mistakes with a new migration. Only an unapplied, uncommitted migration may be removed with `dotnet ef migrations remove` and regenerated.
+
 Where a repository organizes its migrations (a dedicated project, a versioned file naming scheme, a table-name constants class) is its own convention: follow what the repository already does, and do not introduce one as if Arc required it.
 
 ## Concepts and JSON **[contract]**

package/package/corpus/harnesses/copilot/instructions/vertical-slices.instructions.md

@@ -257,15 +257,17 @@ public record AuthorRegistered(AuthorName Name);
 
 ## Read Models and Queries
 
-**[contract]** `[ReadModel]` records expose queries as `public static` methods; dependencies are plain method parameters (no `[FromServices]`). For application code, start with model-bound mappings, use fluent when the definition needs structure, and choose reducer code when transitions read better as code. For step-by-step creation, invoke the **cratis-chronicle-read-model** skill.
+**[contract]** `[ReadModel]` records expose eligible public and internal static methods as queries; internal visibility does not hide an endpoint. Dependencies are plain method parameters (no `[FromServices]`). For application code, start with model-bound mappings, use fluent when the definition needs structure, and choose reducer code when transitions read better as code. For step-by-step creation, invoke the **cratis-chronicle-read-model** skill.
 
 Use `[ReadModel(RequireQueryAttribute = true)]` with `[Query]` on intended
-endpoints when public folds/helpers exist (ARC0026/ARCCHR0019). `[Query]` alone
-does not hide siblings; private/compiler-generated statics are never queries.
+endpoints when folds exist (ARC0026/ARCCHR0019). `[Query]` alone does not hide
+siblings. Keep helpers outside the read model regardless of visibility.
+Requires Arc 22.27.1 for private/protected/compiler-generated methods to be
+excluded; older versions can expose private statics too. Check `dotnet list package`.
 A `CancellationToken` is supplied by Arc; concept arguments come from the caller,
 not DI. Bad GET/QUERY argument conversions return 400. Single-instance MongoDB/EF
 observations emit `default` on absence/deletion/filter exit: guard `hasData` and
-`isReady` in React. Verified at Arc v22.75.0; see the read-model query reference.
+`isReady` in React; see the read-model query reference.
 
 ### Query return shapes **[contract]**
 

package/package/corpus/product-sync.json

@@ -27,9 +27,9 @@
       "repository": "Cratis/Stage",
       "packages": [],
       "synced": {
-        "version": "4.138.0",
+        "version": "4.146.0",
         "date": "2026-10-17",
-        "by": "Cratis/AI#752"
+        "by": "Cratis/AI#773"
       },
       "covers": {
         "skills": [
@@ -46,7 +46,7 @@
         ],
         "rules": []
       },
-      "notes": "Source-checked Stage v4.103.0: exact ESM v1-v17 and v19, not v18 or v20 (v18 admitted from 4.106.0 and v20 from 4.109.0, taught with Requires lines; 4.104-4.108 not otherwise reviewed). Snapshot/live collection queries, identity-mapping all projections, stored event names, event-id publication checks, release-baseline warnings, command clock/receipt-time generation, conditional and multi-command slices, generated text constraints, no-event and bounded redelivery specs, refusal branches. Query concept validation still uses primitive workaround; Stage#370 released in 4.106.0. CLI v3.62.0 bundles Stage 4.99.0, not 4.103.0. Generated-values-only delta checked at v4.127.0: v21/all-Proven unpinned specs from 4.115.0, warning/info generated rules 4.117.0, checksum validation 4.118.0, pattern/random factories/Host/executor 4.119.0; generate rule still STAGE-ESM-028. Language admission reconciled at the same v4.127.0 tag: exact v1-v21 and v23-v25 pairs; v22/v26 and mixed pairs -016, protected reads -044, atomic mode -043, described bodies STAGE-IMPL-002 even Stub mode; v24 first admitted 4.124.0 (absent 4.123.0). Reviewed v4.128.0-v4.130.0 deltas for Cratis/AI#739: v4.128.0 new-application self-reducing Cratis C# profile (CreateNewApplicationProfile, ReducerConventionInput.Read, WithReducerConvention; existing callers classic); shared SemanticValidationRules.Check confirmed (already present in v4.127.1, so no new 4.128.0 minimum claimed); v4.129.0 semantic Host/executor protected reads, presence before requirements/generation, read-backed requirements/mappings, non-Error requirements STAGE-ESM-045 including reaction invocations, Host fault on any outside append (stricter than reference scoped conflict). Renderer/legacy Host/structural runner retain STAGE-ESM-044. v4.130.0 root-template shell, options/appearance and fail-closed startup/planning findings reviewed in stage-rendering.md, RootShell.cs and stageShell.ts. Exact pairs remain v1-v21 and v23-v25; v26 refused STAGE-ESM-016 and Stage#473 still open. Earlier unreviewed deltas remain as noted above, so synced stays at the last fully reviewed release. No new render/browser/Docker probe."
+      "notes": "Cratis/AI#773: release/tag delta v4.139.0-v4.146.0 (including v4.141.1). Exact ESM v1-v27 pairs admitted; v22 from 4.139.0, atomic mode still -043. Date comparisons render from 4.141.0 with remaining -046 shapes and named-policy binding differences. 4.141.1 supplies authored occurrence in independent event-reaction specs, not clock triggers or generated append/redelivery clock fixtures. 4.142.0 Host decide/commit absorbs unrelated outside facts, with dependency conflicts, guarded batch retries only without invocations and fail-closed unknown writes. 4.143.0 shared STAGE-PROFILE-001 through -006 findings; 4.144.0 scaffold pins follow Stage package inputs. 4.145.0 reached reducer/validation bodies use STAGE-IMPL-003 without refusing unrelated behavior; described handlers retain -002. 4.146.0 collects independent render refusals, preserving profile/version early exits. Scene template verification changes classified as internal; no new render/browser/Docker probe. Prior focused checks remain; v4.104-v4.108 were not otherwise fully reviewed."
     },
     {
       "id": "arc",
@@ -63,9 +63,9 @@
         }
       ],
       "synced": {
-        "version": "22.100.0",
-        "date": "2026-10-15",
-        "by": "Cratis/AI#710"
+        "version": "22.117.0",
+        "date": "2026-10-17",
+        "by": "Cratis/AI#773"
       },
       "covers": {
         "skills": [
@@ -99,7 +99,7 @@
           "vertical-slices.md"
         ]
       },
-      "notes": "Whole-product floor unchanged at 22.100.0. Focused read-protection coverage, Arc 22.106.0-22.108.0: ReadProtectionMode Off, Measure and On (MSBuild property, assembly and command attributes, runtime MaximumMode cap), read-model parameters of Handle and validator constructors guarded under On, [LookUpBy], [Unprotected(\"why\")], per-stream read models on routed commands, Measure report, ReadChanged and ReadIncomplete refusals, and CommandScenario selecting decision mode automatically. the caller severity threshold (X-Allowed-Severity, [BlockOnValidationSeverity]) and the Error floor for commands declared On (22.108.0). [ProtectedDecision] and DecisionRead<T> retained as the per-command opt-in. The other 22.101.0-22.108.0 changes were not reviewed. Prior notes: scoped completion and routing validation, generated-target freshness, observable scenarios, asynchronous execution scopes, read-model diagnostics, ordered reactor refusal handling and ICommandExceptionMapper. Generated-values-only delta checked at v22.107.1: 22.104.0 enforces every concept-rule severity and carries Fundamentals 7.25.0; 22.107.0 recovers pattern/random/checksum and self-contained String generation rules, with v21 caps and fixture validation. No new runtime probe."
+      "notes": "Reviewed releases 22.100.1-22.117.0 at tags: occurrence command receipts and retry classification, tenant/purpose storage resolution, explicit-offset binding and authorization of malformed bodies, camelCase validation members, conflict event details, hub fallback authorization and snapshot guards, and React query-key isolation/resubscription. Existing read-protection and generated-value guidance retained. Query discovery includes internal statics; public-only discovery in Arc#3368 is unreleased. Screenplay-generator deltas classified for the owning lane, not changed here. No new runtime probe."
     },
     {
       "id": "ai",
@@ -171,9 +171,9 @@
         }
       ],
       "synced": {
-        "version": "4.211.1",
+        "version": "4.212.4",
         "date": "2026-10-17",
-        "by": "Cratis/AI#762"
+        "by": "Cratis/AI#772"
       },
       "covers": {
         "skills": [
@@ -201,7 +201,7 @@
         ],
         "rules": []
       },
-      "notes": "Cratis/AI#762 and #761: source-checked v4.210.0 and v4.211.0 contracts for PLAY0800 CommandHandlerRequiresAttachment (required typed subject, permanent code-attachment requirement, other PLAY0268 families unchanged), independent reference remove/add batches, located same-text ambiguity conflicts and string MCP conflict/move-report document fields. v4.211.1 mapping changes inspected but excluded from this guidance update at the user's request; no typed PLAY0273 property/type arguments are claimed. Standalone Screenplay 4.211.1 and its compiler contract pinned; the contract is a byte-identical copy of the v4.211.1 release asset. No new render/runtime probe. Prior: Standalone 4.205.0 and byte-identical compiler contract pinned. Cratis/AI#746: Uuid ==/!= in command require and produces when (ESM v28): same-concept rule, bare Uuid against a concept, canonical literals, protected read paths in require only; PLAY0268 (different concepts, ordering, Uuid validation and concept rules, read paths in produces when) and PLAY0273 (non-canonical literal) checked against the 4.205.0 compiler, v28 selection read from the MCP executable-model view; Stage admits exact v1-v21 and v23-v26 pairs so v28 is refused STAGE-ESM-016, not probed against a Stage image; CLI 3.74.0 renders through v26. Prior: Standalone 4.204.0 and byte-identical compiler contract pinned. Cratis/AI#702 and #691: PLAY0690 reducer identity (Screenplay 4.170.0, native compiler only) and the screenplay.json validation gate (Screenplay 4.165.0; cratis screenplay validate reads it from CLI 3.65.0) are taught and probed against the 4.204.0 compiler. Cratis/AI#743: flat composite read-model keys (ESM v27): untyped projection key blocks on root from and remove with, equality-filter lists, single-instance by blocks and per-part fixtures, with PLAY0661/PLAY0662/PLAY0268 refusals checked against the 4.204.0 compiler; Stage origin/main still refuses v27 with STAGE-ESM-016 (stage-rendering.md); Stage v4.135.0 v26 admission (Host and executor run date comparisons; renderer STAGE-ESM-046) was source-checked for this sync; no render or runtime probe. Prior: Standalone 4.201.0 and byte-identical compiler contract pinned. Cratis/AI#733: the ui profile root template, shell options, appearance and new screens default (PLAY0788-PLAY0799, quick fix for the legacy layout line, ui-profiles MCP tool, 44 tools). Cratis/AI#735: chronological Date/DateTime ordering in command conditions and command/property literal validation (ESM v26), UTC tick precision and pre-rule offset validation; then matching remains ordinal. Source-checked Screenplay v4.199.0 commands, diagnostics, interoperability and specifications documentation plus decision 0087. Stage v4.127.1 still refuses v26 with STAGE-ESM-016 (stage-rendering.md and SemanticVersionFeatures.Supports); no render/runtime probe. Cratis/AI#576: prior mechanical compiler catch-up. Language batch #717/#722/#723/#724/#720/#728/#734 teaches atomic reaction batches (v22), described payload handlers (v23), portable linear matching, ordinal text rules (v24), protected command reads (v25), diagnostic arguments and event-source invokes mappings. Facts read at Screenplay v4.198.0 and introducing tags; Stage v4.127.0 admits exact v1-v21 and v23-v25 pairs but refuses v22/v26 and mixed pairs (STAGE-ESM-016), protected reads (044), atomic mode (043) and described handlers (STAGE-IMPL-002), even Stub mode. Stage text rules execute/render; no new renderer/runtime probe or Stage pin uplift. Cratis/AI#706: application navigation regions (module inherit, extend or override), toolbar slice buttons, blueprint template references and sample data packs in cratis-screenplay-ui-composition (references/application-shell.md), with the canonical shell vector and the rejection codes PLAY0710-PLAY0722 and PLAY0740-PLAY0765. Examples moved to the executable-state rules since 4.164: translator reactions in an Automation slice beside the Translate slice (PLAY0694) and the first record of a capture key appended with `when added`. Earlier: Standalone 4.164.0 and byte-identical compiler contract pinned. Cratis/AI#663: one origin per capture (PLAY0687). #668: executable no-event/redelivery v17. #684: concept query-argument validation in every version and query-error assertions v18. #681: executable refusal branches and refusal values v19. #666: proposal summary/severity counts and exact structural source proposals. Generated-concept rules select v20 with PLAY0688/0689 proofs and derived-matches repair; generated secrets and preview strategies remain refused. Release-baseline from-esm admission reads storedName. Standalone binding is not renderer admission: Stage 4.103.0 admits v1-v17 and v19; CLI 3.62.0 bundles Screenplay 4.159.0 / Stage 4.99.0 and renders through v16. Prior evidence remains unless superseded; no new renderer, Docker or browser probe."
+      "notes": "Cratis/AI#772: standalone Screenplay 4.212.4 pinned; regenerated compiler contract is byte-identical to the v4.212.4 release asset. Source-checked joined-event automap/no automap overrides and level fallback in executable binding; PLAY0380 covers only all inside children/nested. No new render/runtime probe. Prior: Cratis/AI#769: standalone Screenplay 4.212.3 pinned; regenerated compiler contract is byte-identical to the v4.212.3 release asset. Source-checked both compilers and projection documentation for PLAY0801 DuplicateEventInProjectionScope: shared from/removal/clear set, separate join set, fresh sets per children/nested/variant level, and no two-row update through repeated from blocks with different keys. No new render/runtime probe. Prior: Cratis/AI#768: standalone Screenplay 4.212.2 pinned; regenerated compiler contract is byte-identical to the v4.212.2 release asset (unchanged from the previous contract). Source-checked v4.212.0 split-model dotted note targets, open-workspace applicationIdentity and complete add/reanchor substitutions; unbound container identities are not claimed. v4.212.1 aligns PLAY0535 collection fields, optional parameters and single-result identity inference. v4.212.2 counts read-only query denials for SPEC004, not SPEC006. No new render/runtime probe. Prior: Cratis/AI#762 and #761: source-checked v4.210.0 and v4.211.0 contracts for PLAY0800 CommandHandlerRequiresAttachment (required typed subject, permanent code-attachment requirement, other PLAY0268 families unchanged), independent reference remove/add batches, located same-text ambiguity conflicts and string MCP conflict/move-report document fields. v4.211.1 mapping changes inspected but excluded from this guidance update at the user's request; no typed PLAY0273 property/type arguments are claimed. Standalone Screenplay 4.211.1 and its compiler contract pinned; the contract is a byte-identical copy of the v4.211.1 release asset. No new render/runtime probe. Prior: Standalone 4.205.0 and byte-identical compiler contract pinned. Cratis/AI#746: Uuid ==/!= in command require and produces when (ESM v28): same-concept rule, bare Uuid against a concept, canonical literals, protected read paths in require only; PLAY0268 (different concepts, ordering, Uuid validation and concept rules, read paths in produces when) and PLAY0273 (non-canonical literal) checked against the 4.205.0 compiler, v28 selection read from the MCP executable-model view; Stage admits exact v1-v21 and v23-v26 pairs so v28 is refused STAGE-ESM-016, not probed against a Stage image; CLI 3.74.0 renders through v26. Prior: Standalone 4.204.0 and byte-identical compiler contract pinned. Cratis/AI#702 and #691: PLAY0690 reducer identity (Screenplay 4.170.0, native compiler only) and the screenplay.json validation gate (Screenplay 4.165.0; cratis screenplay validate reads it from CLI 3.65.0) are taught and probed against the 4.204.0 compiler. Cratis/AI#743: flat composite read-model keys (ESM v27): untyped projection key blocks on root from and remove with, equality-filter lists, single-instance by blocks and per-part fixtures, with PLAY0661/PLAY0662/PLAY0268 refusals checked against the 4.204.0 compiler; Stage origin/main still refuses v27 with STAGE-ESM-016 (stage-rendering.md); Stage v4.135.0 v26 admission (Host and executor run date comparisons; renderer STAGE-ESM-046) was source-checked for this sync; no render or runtime probe. Prior: Standalone 4.201.0 and byte-identical compiler contract pinned. Cratis/AI#733: the ui profile root template, shell options, appearance and new screens default (PLAY0788-PLAY0799, quick fix for the legacy layout line, ui-profiles MCP tool, 44 tools). Cratis/AI#735: chronological Date/DateTime ordering in command conditions and command/property literal validation (ESM v26), UTC tick precision and pre-rule offset validation; then matching remains ordinal. Source-checked Screenplay v4.199.0 commands, diagnostics, interoperability and specifications documentation plus decision 0087. Stage v4.127.1 still refuses v26 with STAGE-ESM-016 (stage-rendering.md and SemanticVersionFeatures.Supports); no render/runtime probe. Cratis/AI#576: prior mechanical compiler catch-up. Language batch #717/#722/#723/#724/#720/#728/#734 teaches atomic reaction batches (v22), described payload handlers (v23), portable linear matching, ordinal text rules (v24), protected command reads (v25), diagnostic arguments and event-source invokes mappings. Facts read at Screenplay v4.198.0 and introducing tags; Stage v4.127.0 admits exact v1-v21 and v23-v25 pairs but refuses v22/v26 and mixed pairs (STAGE-ESM-016), protected reads (044), atomic mode (043) and described handlers (STAGE-IMPL-002), even Stub mode. Stage text rules execute/render; no new renderer/runtime probe or Stage pin uplift. Cratis/AI#706: application navigation regions (module inherit, extend or override), toolbar slice buttons, blueprint template references and sample data packs in cratis-screenplay-ui-composition (references/application-shell.md), with the canonical shell vector and the rejection codes PLAY0710-PLAY0722 and PLAY0740-PLAY0765. Examples moved to the executable-state rules since 4.164: translator reactions in an Automation slice beside the Translate slice (PLAY0694) and the first record of a capture key appended with `when added`. Earlier: Standalone 4.164.0 and byte-identical compiler contract pinned. Cratis/AI#663: one origin per capture (PLAY0687). #668: executable no-event/redelivery v17. #684: concept query-argument validation in every version and query-error assertions v18. #681: executable refusal branches and refusal values v19. #666: proposal summary/severity counts and exact structural source proposals. Generated-concept rules select v20 with PLAY0688/0689 proofs and derived-matches repair; generated secrets and preview strategies remain refused. Release-baseline from-esm admission reads storedName. Standalone binding is not renderer admission: Stage 4.103.0 admits v1-v17 and v19; CLI 3.62.0 bundles Screenplay 4.159.0 / Stage 4.99.0 and renders through v16. Prior evidence remains unless superseded; no new renderer, Docker or browser probe."
     },
     {
       "id": "scene",
@@ -284,9 +284,9 @@
         }
       ],
       "synced": {
-        "version": "19.65.0",
-        "date": "2026-10-14",
-        "by": "Cratis/AI#695"
+        "version": "19.81.1",
+        "date": "2026-10-17",
+        "by": "Cratis/AI#773"
       },
       "covers": {
         "skills": [
@@ -323,7 +323,7 @@
         ],
         "rules": []
       },
-      "notes": "Whole-product floor unchanged at 19.65.0. Focused read-protection coverage, Chronicle 19.68.0-19.71.x: admitted reducers (unfiltered, no constructor dependencies, 19.68.0), per-stream read models with [EventStream<TSource>], IUnitOfWork.EnforceReadProtection, AllowReads and GetAppendConditions, CHR0062-CHR0064. The other 19.66.0-19.71.x changes were not reviewed. Prior notes: explicit artifacts, collection observation, redelivery scenarios, webhook generation pins, enrollment contributors, seed ownership, reconnect readiness and hosting/storage fixes. No new kernel/transport probe."
+      "notes": "Reviewed releases 19.65.1-19.81.1 at tags: subscription generation pins, StartAtTail, namespace removal/reconnect, storage connection resolution (deploy 19.74.2+), definition refusal recovery, conflict event fields, .NET occurrences/lifecycle/receipts and testing identities, full-history per-key reads, child all-event mapping repair, projection SoftwareVersion, bounded job acceptance/recovery, immediate-append refusal ownership and namespace subscription reconciliation. Existing protected-read guidance retained. Chronicle#5028 definition round-trip/restart-replay fix is unreleased and not taught as fixed. No new kernel/transport probe."
     },
     {
       "id": "arc-go",

package/package/corpus/rules/authoring-skills.md

@@ -29,6 +29,8 @@ Use portable fields: `name`, `description`, `license`, `compatibility`, `metadat
 
 An explicit trigger clause (`Use when`, `Load when`, `Read when` or an equivalent) and neutral voice are required even with `SKILL_AUTHORING_MODE=warn`. Negative routing and meta-language findings follow that switch; the 700-character target is guidance, not a gate.
 
+The overlap lint warns when positive trigger token sets have Jaccard similarity (intersection / union) **>= 0.4**, compared before rounding. It lowercases ASCII word tokens, deduplicates them and removes routing boilerplate and common function words. Only the explicit `Use when` (or equivalent) clause counts, stopping at negative routing; empty triggers never match. The warning stays advisory even in strict mode: shared vocabulary is a review signal, not proof of competing scope. Sharpen the trigger and add a sibling pointer rather than padding it with unrelated words.
+
 ## 3. Budget and progressive disclosure
 
 Target at most 400 body lines and 16,000 characters; the hard limits remain 500 lines and 20,000 characters. A warning starts above the 16,000-character target, so a body that outgrows it is split before it nears the hard limit; characters only approximate tokens.

package/package/corpus/rules/capability-is-not-authority.md

@@ -40,5 +40,9 @@ Levels of Authority in [`general.md`](./general.md).
 - **[contract] Absent authority for a consequential effect, stop and ask about that
   effect in plain language.** State the exact target, action, consequence, and recovery;
   a missing answer is a blocker for that effect, not for unrelated in-scope work.
+- **[contract] Never copy secrets or personal values into models, notes, state,
+  packets or briefs.** Never use real credentials or personal data in examples.
+- **[contract] Legacy extraction uses Git read-only:** never checkout, reset or stash
+  the legacy repository; do not touch a live checkout the brief excludes.
 - **[convention] Prefer the narrowest capability that does the job.** Reaching for the
   broadest available grant makes the next reader assume it was authorized.

package/package/corpus/rules/efcore.md

@@ -67,6 +67,8 @@ Migrations are created and applied with the **standard EF Core tooling** (`dotne
 | `table.JsonColumn<TProperty>(migrationBuilder, …)` | a `[Json]`-mapped property |
 | `migrationBuilder.Add{String,Guid,Number,Bool,DateTimeOffset,AutoIncrement,Json,Point,LineString,Polygon}Column(…)` | adding a column to an existing table |
 
+A migration that is committed or applied to any database is append-only: never edit or delete it. Correct mistakes with a new migration. Only an unapplied, uncommitted migration may be removed with `dotnet ef migrations remove` and regenerated.
+
 Where a repository organizes its migrations (a dedicated project, a versioned file naming scheme, a table-name constants class) is its own convention: follow what the repository already does, and do not introduce one as if Arc required it.
 
 ## Concepts and JSON **[contract]**

package/package/corpus/rules/general.md

@@ -167,6 +167,7 @@ A claim is only as good as the signal behind it — a build result, a test run,
 ## Source-of-Truth Discipline
 
 - **Rules define invariants; skills define workflows.** A skill may refine how to apply a rule but must not contradict it. On conflict, follow the stricter invariant and fix the stale artifact.
+- The user's instructions take precedence over guidelines provided in a skill. This does not override safety rules or hooks; skills must still follow rules.
 - **Skills and rules are the authoritative answer.** If not answered there, ask. Don't infer Cratis behavior from package internals.
 - Only make high-confidence suggestions.
 - When a user asks how to get help, has a question not answered by the docs, or wants to discuss design, point them to the [Cratis Discord](https://discord.gg/kt4AMpV8WV); direct confirmed bugs to GitHub issues.

package/package/corpus/rules/vertical-slices.md

@@ -256,15 +256,17 @@ public record AuthorRegistered(AuthorName Name);
 
 ## Read Models and Queries
 
-**[contract]** `[ReadModel]` records expose queries as `public static` methods; dependencies are plain method parameters (no `[FromServices]`). For application code, start with model-bound mappings, use fluent when the definition needs structure, and choose reducer code when transitions read better as code. For step-by-step creation, invoke the **cratis-chronicle-read-model** skill.
+**[contract]** `[ReadModel]` records expose eligible public and internal static methods as queries; internal visibility does not hide an endpoint. Dependencies are plain method parameters (no `[FromServices]`). For application code, start with model-bound mappings, use fluent when the definition needs structure, and choose reducer code when transitions read better as code. For step-by-step creation, invoke the **cratis-chronicle-read-model** skill.
 
 Use `[ReadModel(RequireQueryAttribute = true)]` with `[Query]` on intended
-endpoints when public folds/helpers exist (ARC0026/ARCCHR0019). `[Query]` alone
-does not hide siblings; private/compiler-generated statics are never queries.
+endpoints when folds exist (ARC0026/ARCCHR0019). `[Query]` alone does not hide
+siblings. Keep helpers outside the read model regardless of visibility.
+Requires Arc 22.27.1 for private/protected/compiler-generated methods to be
+excluded; older versions can expose private statics too. Check `dotnet list package`.
 A `CancellationToken` is supplied by Arc; concept arguments come from the caller,
 not DI. Bad GET/QUERY argument conversions return 400. Single-instance MongoDB/EF
 observations emit `default` on absence/deletion/filter exit: guard `hasData` and
-`isReady` in React. Verified at Arc v22.75.0; see the read-model query reference.
+`isReady` in React; see the read-model query reference.
 
 ### Query return shapes **[contract]**
 

package/package/corpus/skills/cratis-application-react-specifications/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: cratis-application-react-specifications
-description: Write specifications for the React and TypeScript surface of a Cratis application slice — view models, helpers, command orchestration, and narrow component behavior — using Vitest with Mocha-style describe/it, Sinon, and the Chai should interface. Use when adding or changing frontend behavior in an application that consumes Cratis. Do not use for backend scenarios or for specifications inside a Cratis framework package.
+description: Write specifications for the React and TypeScript surface of a Cratis application slice — view models, helpers, command orchestration, and narrow component behavior — using Vitest with Mocha-style describe/it, Sinon, and the Chai should interface. Use when specifying React view-model decisions, frontend command orchestration or narrow component interactions with Vitest, Sinon and Chai. Do not use for backend pipeline scenarios (use cratis-application-slice-specifications) or framework package specs (use cratis-specifications-typescript).
 license: MIT
 metadata:
   cratis-hint-paths: "**/for_*/**/*.ts **/for_*/**/*.tsx"
@@ -12,9 +12,9 @@ Frontend specifications are specifications, not tests. The `for_ / when_ / and_`
 shape is deliberately the same BDD language as the backend, so one subject, one
 context, clear setup, and small assertions read as sentences.
 
-This is the **application** frontend peer of the backend slice specification
-skill. Specifications for a Cratis framework package (`@cratis/*`) follow that
-repository's own TypeScript specification conventions instead.
+This is the **application** frontend peer of `cratis-application-slice-specifications`
+for backend pipeline scenarios. Framework package (`@cratis/*`) specifications
+use `cratis-specifications-typescript` and the repository's conventions instead.
 
 ## Stack
 

package/package/corpus/skills/cratis-application-slice-specifications/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: cratis-application-slice-specifications
-description: Specify the backend behavior of an event-sourced Cratis application slice — plain-call specs for pure decisions, plus CommandScenario, EventScenario, ReadModelScenario and ReactorScenario where the pipeline, validation, constraints or projections matter — including what to cover for each slice type and where the specification files live. Use when adding or changing backend behavior in an application built on Cratis. Do not use for framework library specifications and do not use for frontend behavior.
+description: Specify the backend behavior of an event-sourced Cratis application slice — plain-call specs for pure decisions, plus CommandScenario, EventScenario, ReadModelScenario and ReactorScenario where the pipeline, validation, constraints or projections matter — including what to cover for each slice type and where the specification files live. Use when choosing backend plain-call coverage versus CommandScenario, EventScenario, ReadModelScenario or ReactorScenario for an event-sourced slice. Do not use for frontend interactions (use cratis-application-react-specifications) or framework unit-spec mechanics (use cratis-specifications-csharp).
 license: MIT
 metadata:
   cratis-hint-paths: "**/when_*/**/*.cs **/for_*/**/*.cs"

package/package/corpus/skills/cratis-arc-authentication-authorization-and-identity/references/authorization.md

@@ -217,6 +217,15 @@ MVC actions). Configure both: the evaluator for the Arc pipeline, `FallbackPolic
 for MVC. Neither protects an endpoint that is mapped explicitly anonymous (see the
 discovery endpoints in the skill).
 
+Requires Arc 22.116.0 for hub subscriptions to apply the host's endpoint fallback
+before running an unannotated query: ASP.NET Core evaluates `FallbackPolicy`,
+and Arc Core requires authentication when authentication handlers are registered.
+`IEndpointFallbackAuthorization` supplies this host check; it is separate from
+`IFallbackAuthorizationEvaluator`. `[AllowAnonymous]` and guest-policy queries
+remain exempt. Denial sends an Unauthorized frame; SSE subscribe returns 401.
+Check with `dotnet list package`; on older Arc do not rely on host fallback alone
+to secure the hub path.
+
 ## Default access by hosting model
 
 There is no `ArcOptions` switch for a default requirement. What you get depends

package/package/corpus/skills/cratis-arc-authentication-authorization-and-identity/references/observable-emission-guards.md

@@ -44,7 +44,15 @@ Arc API, and never an always-true stub.
 It runs on **every emission** of **every subscription**, on **every transport**:
 the multiplexed hub, WebSocket and SSE.
 
-Requires Arc 22.69.1 for guards and read-model interceptors on plain HTTP snapshots, waits and long polls; on an older Arc those requests are not guarded.
+Requires Arc 22.69.1 for guards and read-model interceptors on plain HTTP snapshots
+of observable queries, waits and long polls; on an older Arc those requests are not guarded.
+
+Requires Arc 22.116.0 for **non-observable** query results performed through the
+hub to run emission guards. Such a result has `IsSnapshot = true` and
+`IsFirstEmission = true`. `Suppress` withholds the result (SSE subscribe still
+returns 200); denial sends Unauthorized (SSE subscribe returns 401). Ordinary
+non-observable direct HTTP queries do not run these guards. Check with
+`dotnet list package`; on older Arc secure hub snapshots without relying on a guard.
 
 Source: [ObservableQueryHttp.cs](https://github.com/Cratis/Arc/blob/main/Source/DotNET/Arc.Core/Queries/ObservableQueryHttp.cs).
 
@@ -63,7 +71,7 @@ Several guards: every guard is asked, the **most restrictive** verdict wins
 ## The context
 
 `ObservableQueryEmissionContext` carries `QueryName`, `Arguments`,
-`SubscriptionScope`, `Principal`, `CorrelationId`, `IsFirstEmission`,
+`SubscriptionScope`, `Principal`, `CorrelationId`, `IsFirstEmission`, `IsSnapshot`,
 `CancellationToken` and the `ServiceProvider` to resolve from. Each guard gets its
 own copy of the scope and arguments.
 
@@ -108,7 +116,8 @@ a failure.
 
 ## What a guard does not protect
 
-- Plain HTTP **is** guarded (Requires Arc 22.69.1; older versions leave it unguarded): suppression returns 202 until an allowed
+- Plain HTTP **observable-query** snapshots are guarded (Requires Arc 22.69.1;
+  older versions leave them unguarded): suppression returns 202 until an allowed
   emission (or the wait deadline), denial returns unauthorized with no data.
   Keep safe data selection and initial
   authorization on every query regardless of transport.

package/package/corpus/skills/cratis-arc-command/references/decisions-and-routing.md

@@ -61,6 +61,17 @@ Requires Arc 22.106.0 for read protection. Older Arc has only the per-command
   `[Unprotected("why")]` (`Cratis.Arc.Chronicle.ReadModels`; on a method it covers
   the body, not injected parameters), or repair with a reactor.
 
+Requires Arc 22.113.0 with Chronicle 19.76.0 for `ReadChanged` validation state
+to include the conflicting event type/id and sequence number when the kernel
+reports them. Older kernels can leave those details absent. Outside-decision
+read-model injection (for example a custom command filter) is refused under
+`On`; explicitly unprotected models stay advisory. Check `dotnet list package`
+before asserting conflict detail fields.
+
+Requires Arc 22.116.2 for aggregate application, rehydration and append to resolve
+events from registrations, including explicitly registered types without an
+`[EventType]` attribute. Unregistered events still fail; do not omit registration.
+
 Under `On`, `IReadModels`, `IMongoCollection`, detached reads and immediate appends
 through an injected `IEventLog` are refused; take the model as a parameter and
 return the events. Admitted models: event-source-keyed model-bound or declarative

package/package/corpus/skills/cratis-arc-command-execution/SKILL.md

@@ -23,6 +23,9 @@ Operation execution,
 nesting restrictions, and backend recovery members below are described in
 `cratis-arc-command-operation`, which lists sources and limits.
 
+Read references/occurrence-commands.md when an occurrence handler must execute a
+command under a stable effect name with an atomic receipt and retry classification.
+
 ## When this is the wrong tool
 
 `ICommandPipeline` is for **command-shaped** work that needs authorization and

package/package/corpus/skills/cratis-arc-command-execution/references/occurrence-commands.md

@@ -0,0 +1,78 @@
+<!-- Copyright (c) Cratis. All rights reserved. -->
+<!-- Licensed under the MIT license. See LICENSE file in the project root for full license information. -->
+
+# Execute a command for an occurrence
+
+Requires Arc 22.117.0 and Chronicle client 19.77.2, plus a kernel advertising
+`effect-receipts`. Check with `dotnet list package`; older Arc has no occurrence
+executor. Do not substitute an ordinary pipeline call and claim durable deduplication.
+
+## Choose the executor
+
+Inject `IOccurrenceCommandExecutor` from `Cratis.Arc.Chronicle.Occurrences` into
+an occurrence handler. Its overloads are:
+
+```csharp
+Task<OccurrenceCommandResult> Execute(
+    object command, OccurrenceContext occurrence, EffectName effectName,
+    CancellationToken cancellationToken = default);
+
+Task<OccurrenceCommandResult> Execute(
+    object command, OccurrenceContext occurrence, EffectName effectName,
+    IEnumerable<string> systemRoles, CancellationToken cancellationToken = default);
+```
+
+`OccurrenceContext` and `EffectName` are Chronicle occurrence types. Read
+**cratis-chronicle-client-dotnet** for recording triggers and handling lifecycle
+occurrences. Do not call the executor from inside another command.
+
+The executor supplies a system principal; no caller roles are inherited. Supply
+only the explicit roles the automation needs. The occurrence namespace must
+match the resolved command tenant; a mismatch throws. Authorization still runs.
+
+Give each logical effect a stable, unique name within the occurrence. Retrying
+uses the same name. Reusing it for a different command returns the earlier
+receipt, not the new command's result. A deliberately new attempt at a terminal
+business refusal needs a new effect name.
+
+## Outcomes and retry
+
+The executor checks for an existing receipt before running the pipeline. Its
+receipt is committed atomically with the command's transactional events.
+
+- `Recorded` and `AlreadyRecorded` are settled results. Their outcomes are
+  `Appended`, `NoEvents` or `Refused`.
+- Validation, business-rule and append-constraint refusals are terminal and
+  recorded. Redelivery does not re-run the handler to reconsider them.
+- Authorization failures, concurrency conflicts and exceptions are `Failed`
+  without a receipt, so a later delivery can retry. Reread and re-decide rather
+  than replaying stale events.
+- The stored response is a minimal result, not a raw command response. It does
+  not preserve command values or validation messages. Never depend on a receipt
+  returning secret data or the original response object.
+
+A receipt settles Chronicle effects, not arbitrary I/O. Two concurrent attempts
+can both reach the handler before one wins the atomic commit. Use
+`occurrence.EffectKey(effectName).Value` as the external service's idempotency
+key where that service supports it; otherwise an external effect can repeat.
+
+## Keep all appends inside the boundary
+
+Return events from the command, or use transactional appends. Do not complete a
+stream or commit an aggregate early inside the executor's command.
+
+An immediate append can commit **before** the executor detects it and reports
+`OccurrenceCommandAppendedImmediately`. No receipt is recorded for that failed
+attempt, so retry can duplicate the escaped append. The executor does not
+implicitly provide Chronicle's `RefuseImmediateAppends()` guard. Read
+**cratis-chronicle-client-dotnet**'s immediate-append refusal reference when
+building a custom boundary that needs prevention before transport.
+
+## Verify
+
+Use an in-process occurrence scenario with the command's real validation and
+append behavior. Deliver the same occurrence twice under the same effect name:
+assert one committed effect and a recorded result on the second delivery. Cover
+a terminal refusal, a retryable concurrency conflict, insufficient capability,
+and commit-then-lost-reply recovery. Run the owning specification project with
+`dotnet test`; passing means those assertions ran, not just that compilation succeeded.

package/package/corpus/skills/cratis-arc-command-validation/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: cratis-arc-command-validation
-description: Add a rejection rule to an existing Arc command — choosing between ConceptValidator, CommandValidator, a short-circuiting Provide, and a read-model-injected Handle returning a Result of either the event or a ValidationResult. Use when a command must refuse work under some condition. Do not use to define a new command, and do not use for append-time Chronicle constraints.
+description: Add a rejection rule to an existing Arc command — choosing between ConceptValidator, CommandValidator, a short-circuiting Provide, and a read-model-injected Handle returning a Result of either the event or a ValidationResult. Use when placing a C# business rejection in ConceptValidator, CommandValidator, Provide() or a Handle() result containing ValidationResult. Do not use for JVM validators (use cratis-arc-validation-kotlin), Node.js ruleFor (use cratis-arc-validation-typescript), new commands (use cratis-arc-command), or append-time uniqueness (use cratis-chronicle-event-constraints).
 license: MIT
 ---
 
@@ -130,17 +130,11 @@ public class TransferFundsValidator : CommandValidator<TransferFunds>
   instance validators are refused. Under `[ProtectedDecision]` without `On`, a
   discoverable validator needs exactly one public parameterless constructor
   (otherwise HTTP 500).
-- **The caller can lower the severity threshold.** Model-bound commands accept
-  `X-Allowed-Severity` (`allowedSeverity`). Under `Off` and `Measure`, a caller
-  sending `3` (Error) removes Error results from validators, command filters and
-  `Provide()`, so `Handle()` runs and a validator's state rule can be skipped
-  unless the command declares
-  `[BlockOnValidationSeverity(ValidationResultSeverity.Error)]`
-  (`Cratis.Arc.Commands.ModelBound`). Requires Arc 22.108.0 for the `On` floor: a
-  command declared `On` blocks `Error` and `Unknown` whatever the caller sends; the
-  caller can relax only `Warning` and `Information`. Lowering
-  `ReadProtection:MaximumMode` at runtime does not remove the floor, and an explicit
-  attribute wins. Severity is not authorization.
+- **The caller can lower the severity threshold.** Under `Off`/`Measure`, pin
+  `[BlockOnValidationSeverity(ValidationResultSeverity.Error)]` when Error rules
+  must block. Requires Arc 22.108.0 for commands declared `On` to keep an Error
+  floor. Read references/validation-severity.md when choosing that threshold;
+  severity is not authorization.
 - **Omit the validator entirely when there are no rules.** An empty subclass is
   noise the reader has to check.
 - Single-property intrinsic rules belong on `ConceptValidator<T>` instead, so
@@ -258,32 +252,12 @@ public Result<ItemAddedToCart, ValidationResult> Handle(CartSummary? cart) =>
 - Keep the fetch for a *computed* key in `Provide()` with `IDecisionReads.Get`;
   under `On`, `IReadModels` there is refused.
 
-⚠️ **Two things the resolution does *not* do.** It does not key off the
-`[ReadModel]` attribute — a read model becomes injectable because a Chronicle
-projection or reducer, an EF Core `DbSet<T>`, or a MongoDB collection backs it.
-And there is **no slice or feature restriction**: registration is global by
-type, so "the read model must be in the same slice" is a convention with nothing
-enforcing it.
+Read references/read-model-resolution.md when choosing lookup keys, handling a
+missing injected model, or distinguishing registration from slice conventions.
 
-The resolution is **by the command's resolved event-source id**, not by the
-read-model type and not by "the property that looks like its key". If the
-instance you need is keyed by anything else — a referenced other entity, a
-command with more than one candidate identity, or an id generated inside
-`Handle()` — direct injection hands you the wrong instance or none. Read by
-explicit key in `Provide()` instead:
-
-```csharp
-var other = await readModels.GetInstanceById<Other>((EventSourceId)otherId);
-```
-
-A missing instance resolves to `null`, never to a default object. A nullable
-parameter receives that `null`; a non-nullable one is **rejected as a validation
-failure (400)**, not crashed. `ARC0006` warns on a non-nullable command-scoped
-read-model parameter for exactly this reason. Handle a nullable parameter by rejecting (a validator,
-`Provide()`, or `Result<TEvent, ValidationResult>`), never by returning a
-nullable event from `Handle()`. `cratis-arc-command` carries the
-full resolution and nullability reference, including the passive-projection case
-where absence is *not* `null`.
+Read references/input-binding.md when accepting date-time input or returning
+member-bound validation results: offset requirements, malformed-body
+authorization and camelCase member paths are separate contracts.
 
 ## Step 6 — Specify the rejection
 

package/package/corpus/skills/cratis-arc-command-validation/references/input-binding.md

@@ -0,0 +1,49 @@
+<!-- Copyright (c) Cratis. All rights reserved. -->
+<!-- Licensed under the MIT license. See LICENSE file in the project root for full license information. -->
+
+# Command input binding and member paths
+
+## Explicit offsets
+
+Requires Arc 22.110.0. Check with `dotnet list package`; older Arc has no
+`[ExplicitOffset]` binding contract. Require an explicit offset at the input
+boundary instead of accepting a server-local interpretation.
+
+Use `[property: ExplicitOffset]` on a `DateTimeOffset` or `DateTime` command
+property, nullable or not. It refuses date-time text without an offset or `Z`
+with `DateTime command property '<member>' requires an explicit offset or Z.`
+`DateTimeOffset` retains the input offset; `DateTime` becomes UTC. The attribute
+is in `Cratis.Arc.Commands`.
+
+## Malformed bodies still authorize
+
+Requires Arc 22.110.0 for authorization-before-binding-failure handling on
+execute and `/validate`. An unauthorized caller gets 403 even if the body is
+malformed; an authorized caller gets a `malformedRequest` validation result.
+Its message is generic, and its member is a normalized field path such as
+`from` or `items[2].when`, not parser or CLR type details.
+
+A resource-dependent policy cannot run without a bound command; those policies
+still produce a binding validation failure for an unbindable body. Requirements
+that never read the resource may implement
+`Cratis.Arc.Authorization.IResourceFreeRequirement` so their
+policies can run; built-in role, claim, name and authenticated-user requirements
+are already resource-free. Do not mark a requirement resource-free if it reads
+the command.
+
+## Validation members are field paths
+
+Requires Arc 22.115.0 for **all** `ValidationResult.Members` paths to be
+camelCase, including data annotations and errors returned by `Provide()` or
+`Handle()`. Use `name`, `address.street` and `items[0].name` in server assertions,
+not `nameof(Property)` or PascalCase paths. Authors may still construct a result
+with `[nameof(Property)]`; Arc normalizes it before clients receive it. Older
+Arc can fail to bind such results to the matching form field.
+
+## Verify
+
+Add specs for offset-less rejection, an accepted offset, malformed input under
+both authorized and denied callers, and nested/indexed member paths. Assert
+server `Members` using camelCase and run `dotnet test` on the owning spec project.
+For form behavior, assert the rejection appears on its intended field, not only
+in a command-wide error list.

package/package/corpus/skills/cratis-arc-command-validation/references/read-model-resolution.md

@@ -0,0 +1,25 @@
+<!-- Copyright (c) Cratis. All rights reserved. -->
+<!-- Licensed under the MIT license. See LICENSE file in the project root for full license information. -->
+
+# Read-model resolution for validation
+
+Resolution does not key off `[ReadModel]`: a model becomes injectable because a
+Chronicle projection or reducer, an EF Core `DbSet<T>`, or a MongoDB collection
+backs it. Registration is global by type; keeping a model in the slice is a
+convention, not a resolver restriction.
+
+The default lookup uses the command's resolved event-source id. It does not
+infer a key from the read-model type or an arbitrary similarly named property.
+Use `[LookUpBy(nameof(Command.Property))]` for a command-property key; for a
+computed key use `IDecisionReads.Get` in `Provide()` under read protection `On`.
+An ordinary `IReadModels.GetInstanceById` there is refused under `On`; outside
+protected work it is an advisory read, not a consistency guard.
+
+A missing instance resolves to `null`, not a default object. A nullable parameter
+receives that null; a non-nullable one produces a validation failure (400).
+`ARC0006` warns on a non-nullable command-scoped read-model parameter. Reject a
+missing nullable model through a validator, `Provide()` or
+`Result<TEvent, ValidationResult>`; do not return a nullable event.
+
+Read **cratis-arc-command** for the full resolution and nullability reference,
+including passive projections where absence is not null.

package/package/corpus/skills/cratis-arc-command-validation/references/validation-severity.md

@@ -0,0 +1,21 @@
+<!-- Copyright (c) Cratis. All rights reserved. -->
+<!-- Licensed under the MIT license. See LICENSE file in the project root for full license information. -->
+
+# Choose which severities block
+
+Model-bound commands accept `X-Allowed-Severity` (`allowedSeverity`). Under
+read protection `Off` and `Measure`, a caller sending `3` (Error) removes Error
+results from validators, command filters and `Provide()`, so `Handle()` runs
+and a validator's state rule can be skipped unless the command declares
+`[BlockOnValidationSeverity(ValidationResultSeverity.Error)]`
+(`Cratis.Arc.Commands.ModelBound`). Severity is not authorization.
+
+Requires Arc 22.108.0 for the `On` floor: a command declared `On` blocks `Error`
+and `Unknown` whatever the caller sends; the caller can relax only `Warning`
+and `Information`. Lowering `ReadProtection:MaximumMode` at runtime does not
+remove the floor, and an explicit attribute wins. Check with
+`dotnet list package`; on older Arc declare the blocking severity explicitly.
+
+Specify both the default refusal and a caller sending a permissive severity.
+Assert the command did not write events; a displayed message alone is not proof
+that validation blocked execution. Run `dotnet test` on the owning spec project.