Release v22.30.0

Added

• IFallbackAuthorizationEvaluator supplies baseline authorization requirements for commands and queries that declare none of their own. It is consulted only when neither the method nor the type has an explicit declaration, so [AllowAnonymous] members are no longer ambiguous with a baseline. Commands consult only the Type overload. MVC controller actions, including direct HTTP and WebSocket requests to controller-based queries, stay on ASP.NET Core authorization: use AuthorizationOptions.FallbackPolicy there (#2751)
• ReceivedAt on CommandContext, QueryContext and AuthorizationPolicyContext, plus an injectable IOperationContextAccessor, expose the time Arc received the operation. It is captured with TimeProvider at Arc's transport dispatch, before binding, or at pipeline entry for programmatic calls, and per subscribe operation for streams. It is Arc's receipt time, not network arrival. ReceivedAt takes part in record equality, so contexts from different receipts compare unequal (#2767)
• Query filters can set SubscriptionScope on the query context. Arc snapshots it after filtering and before the query runs, and gives each emission guard an independent copy, so guards can base decisions on membership that the arguments don't carry. Only state that Arc's JSON options serialize is kept, and a scope that cannot be represented is rejected with InvalidSubscriptionScope. The scope is always null for controller-based observable queries (#2768)

Fixed

• An authentication scheme or policy supplied by a fallback evaluator is applied before command context values and execution scopes are built, instead of failing every such command (#2751)
• The ambiguity error for conflicting authorization declarations names the conflicting evaluators (#2751)
• Observable queries over collections whose items have no Id send complete snapshots instead of unreliable change sets, and log one warning per subscription explaining that deltas need a stable identity. Collections with an Id are unchanged (#2428)
• The manual query pipeline composition recipe registers AuthorizationDeclarations, which the pipeline needs to authorize queries (#2753)