Summary

The embedded Screenplay board now shows models generated from C# even when their projections do not yet cover every read model field.

Fixed

• Documents generated from C# no longer fail to load on the embedded board because of incomplete projection coverage (PLAY0284); the coverage findings are shown as warnings instead, while hand-written embedded documents and any other compiler error are still refused (#3860)

Added

• CommandForm now reports validation metadata (pending, freshness, verdict and validated version, separately for client and server validation) through the form context, the form handle and onStateChange, so a form can tell a current verdict from one kept for earlier values or a validation that is still pending. A missing command handler is reported as an error verdict for now; see #3869 for distinguishing it (#3624)

Fixed

• Screenplay generation now recovers exact generated query specifications (a substituted read model set, one call to an application query and a whole expected read model) as then query scenarios instead of leaving them out; scenarios that cannot be stated exactly are left out with a warning that says why (part of #3547)

Fixed

• Restored the QueryResult.Unauthorized(CorrelationId) overload, so assemblies built against Arc 23.2 or earlier no longer fail with MissingMethodException when a query is refused as unauthorized (#3863)

Added

• [ProtocolOnly] for model-bound commands that run through the command pipeline in-process but are not exposed over HTTP (execute or validate routes), the command introspection catalog or generated TypeScript proxies. It is a routing control, not an authorization control: validation, authorization and filters still run. (#3774)

Fixed

• Generated TypeScript query proxies, both normal and observable, now keep the validation severity from the server instead of dropping it. (#3636)
• A query cache entry that has been released keeps its retention timer when the connection reconnects, so it no longer stays in the cache forever. (#3644)
• Suspense query resources are keyed by a stable query identity rather than the class name, so different queries whose classes share a name (for example after minification) no longer share results. (#3645)
• Mounted Suspense observable queries subscribe again after reconnectQueries on a shared hub, so they keep receiving updates. (#3646)
• A command created with useCommand is removed from its command scope when the component unmounts, so a surviving scope no longer tracks commands from editors that are gone. (#3647)

Fixed

• The Screenplay model generated from C# projections now keeps ToEventContextProperty(c => c.CausedBy.Subject) mappings, at the root and inside children, instead of dropping them (#3670)
• Joins declared inside Children(...) are now carried into the generated model, both with explicit Set mappings and with auto-mapping (#3670)
• Computed get-only properties on read models and child records are no longer emitted as stored fields in the generated model (#3670)

Read a Neo4j graph through typed graph views declared with Chronicle, from a model-bound query or a command.

Added

• Cratis.Arc.Neo4j.Chronicle runs Chronicle graph view queries against Neo4j: register with WithNeo4jGraphViews() or AddCratisNeo4jGraphViews(), inject IGraph and call Nodes<TView>() to get typed, nested records. Tenancy follows the existing graph session, and values are always sent as query parameters.
• Cratis.Arc.Neo4j.Chronicle.Testing adds UseGraph() and UseGraphSubstitute() to replace IGraph in specifications.
• Documentation and a sample that read the graph through a view.

Changed

• Cratis.Chronicle packages move to 19.162.0.

Added

• Availability now passes the calling system's client id to the audience source. For a system caller, AudienceSubject.SystemClientId is read from the client_id claim, or azp when client_id is absent, so an IAudienceSource can return the system-wide grants plus that client's own. Callers without a client id pass none, and person callers are unchanged. (#3851)

Changed

• Cratis.Arc.Availability requires Cratis.Choreography 2.9.0 or later.

Summary

Safer tenant resolution from repeated tenant headers, clearer configuration and MongoDB errors, and decision reads for untyped command scenarios.

Added

• Tenancy.RequireDuplicateHeaderPreservation refuses startup when header-based tenancy runs on a host that cannot preserve duplicate headers. (#3791)
• Untyped CommandScenario<object> can turn on decision reads with the new EnableDecisionReads() instead of the obsolete UseDecisionReads() (#3669)
• Read-protection configuration is accepted under Cratis:Arc:ReadProtection, with root-level keys still working. (part of #3778)
• Configuration key reference and minimal setup guides for Arc alone and Arc with Chronicle. (part of #3778)

Fixed

• Tenant resolution from the tenant header no longer accepts a comma-joined value; conflicting values resolve to no tenant. On the HttpListener host repeated header lines cannot be detected by default; trusted ingress must strip all incoming tenant headers and inject exactly one value. (#3791)
• Observable queries over SSE, WebSockets and streamed enumerables now authorize every update against the user admitted when the subscription started, instead of whichever identity is current when the update is sent (#3728)
• <Arc> accepts any React children (strings, null, conditional and mixed children) without a type error (#3801)
• MongoDB observable queries fail with a clear MongoDBChangeStreamsNotSupported error when the server has no change streams, instead of hanging or returning an unexplained 500 (#3668)
• Exception-detail defaults follow the host environment and explicit options. (part of #3778)
• Missing MongoDB connection settings name the configuration keys to supply. (part of #3778)
• Proxy generation explains when an unset output path skips generation. (part of #3778)

Deprecated

• Legacy tenant-id, introspection header-trust and redundant section-path aliases, in favor of their supported equivalents. (part of #3778)