Release v22.108.0

Summary

Commands under read protection On now keep their validation errors whatever severity threshold a caller sends, and the read-protection analyzers, test helpers and docs say exactly what Arc does.

Added

• A documentation snippet of a protected command for the Cratis documentation site (#3324)

Changed

• ShouldAdmitDecisionReadsOf and ShouldAdmitDecisionReadsIn also check commands declared On, the read models their validators take, and per-stream read models (#3330)

Fixed

• ARCCHR0032 no longer reports [ReadProtection(ReadProtectionMode.On)] on a [ProtectedDecision] command as redundant: On changes how validators are built, protects plain read-model parameters and changes the ReadChanged refusal (#3330)
• A read through an unsupported reducer now names what made it unprotectable instead of telling you to wait for reducer support (#3330)
• The docs explain that refusal messages with status 500 reach clients only in Development or with ExposeExceptionDetails, show how a frontend handles ReadChanged and ReadIncomplete through reasonDetail, and correct the monthly-limit query and the overbooking repair examples (#3330)

Security

• A command declared with read protection On blocks on Error and Unknown validation results from validators, Provide() and Handle(), even when the caller sends a more permissive X-Allowed-Severity; callers can still accept warnings and information. An explicit [BlockOnValidationSeverity] still takes precedence, and Off and Measure are unchanged: under those modes, declare [BlockOnValidationSeverity(ValidationResultSeverity.Error)] on commands whose validators must not be skipped (#3332)