Release v15.38.2

Caution

Known broken release — the Chronicle server Docker images in this release cannot start (missing executable bit on the server binary, exit code 126; #3446). Use v15.38.3 or later.

Fixed

• Read models keyed by a property other than their event source id (for example [FromEvent<T>(key: nameof(...))], or a re-keyed reducer) now decrypt their [PII] properties on read. Previously the value was encrypted under the source event's subject while the document was stored under a different key, so queries and command-side reads returned it as ciphertext. The read-model document now encrypts and releases its PII under its own resolved key, so it stays decryptable for the document's whole lifetime.