Release v16.20.0

Summary

Chronicle 16.20 makes projection removal, PII handling, and seeding reliable under production failure modes while keeping existing reactor and seeding contracts compatible.

Added

• Add result-aware seeding and a fresh buffer for retrying corrected definitions without changing existing IEventSeeding implementations. (#3612)
• Add [ReleaseUnder] support for composing a read model from PII owned by different subjects. (#3601)
• Add CHR0043 and CHR0044 diagnostics for key redirection and joins that can store PII under an unprovable subject. (#3640)
• Add event-store-aware reactor side-effect classification while retaining the previous handler contract. (#3629)

Changed

• Validate TLS certificates by default; the Development connection string remains the explicit self-signed-certificate opt-out. (#3606)
• Apply AutoMap and [NoAutoMap] consistently in root, child, and nested projection builders and diagnostics. (#3624)
• Scope client event serialization and side-effect classification to the executing event store. (#3629)

Fixed

• Keep removed immediate and passive read models absent across cached reads, previews, joins, no-op events, and testing; only a constructive later event can recreate them. (#3608)
• Preserve encrypted enum, nullable-enum, boolean, and numeric PII values through JSON and MongoDB storage and release. (#3603)
• Preserve failed seed batches for retry and retain repeated and tag-distinct events in author order. (#3612)
• Surface projection-processing failures instead of returning an empty model. (#3645)
• Honor [JsonPropertyName] when [ReleaseUnder] resolves a PII subject property. (#3601)
• Prevent root-level MongoDB joins from matching every document or throwing when a key is null or cannot be converted. (#3628)
• Make client testing artifact discovery deterministic and isolate fresh seeding buffers from previous failures. (#3646, #3612)

Security

• Avoid logging compliance-subject identifiers during cross-store key propagation and unmatched projection joins. (#3647)
• Diagnose cross-subject PII joins and key redirection before they make erasure incomplete. (#3640)
• Ensure omitted client TLS settings cannot silently disable certificate validation. (#3606)

Upgrading from 16.19.x

Four changes take effect without any change on your side. None is a signature break, so this release is labelled minor, but each can alter behaviour on upgrade.

• TLS certificate validation is now on by default. Tls.SkipCertificateValidation defaults to false. A client connecting to a self-signed or private-CA certificate outside the built-in Development connection string will stop connecting, with a TLS error rather than a Chronicle one. Set it explicitly if you relied on the previous default.
• CHR0044 warns on a [Join] of a [PII] value whose subject boundary cannot be proven from source — including a join that omits on, and a join naming the read model's own subject. Both are correct declarations. With TreatWarningsAsErrors this fails a Release build. Suppress with dotnet_diagnostic.CHR0044.severity = none or #pragma warning disable CHR0044 while you review the sites.
• IEventSerializer is now scoped rather than a process-lifetime service. Resolving it from the root provider throws under ValidateScopes, and otherwise returns a serializer bound to whichever event store resolved first. Resolve it from a scope.
• Development-time dependency-injection scope validation is active again for applications using Arc 21.1.0 or later. A singleton capturing a scoped service now fails at startup in Development instead of silently holding the first scope's instance. This surfaces existing captive dependencies rather than introducing them.

Two read-side contract changes also land here: ImmediateProjection.GetModelInstance surfaces a processing failure instead of returning an empty model, and IReadModels.GetInstanceByKey returns null for a removed model.

Fixed in v16.22.0: a rejected seed batch in 16.20.0 could fail the client's connection and, because seed rejections are deterministic, hold it offline across reconnects; and ReviseEvent in Cratis.Chronicle.XUnit.Integration resolved the now-scoped IEventSerializer from the root provider. Upgrade past 16.20.0 if you seed events or use that package.