Release v19.32.2

Changed

• PII identifiers that start with Chronicle's reserved encrypted-value marker are now rejected before any key is provisioned or value encrypted. (#4553)
• Revising an event and migrating stored events to a new generation now fail, rather than store empty values, when a protected value cannot be released because a key lookup or decryption fails. Values whose subject has been erased are migrated as erased. That includes ciphertext that no longer decrypts after a recorded erasure followed by a new key for the subject. (part of #4456) (part of #4525)

Fixed

• Global encrypted values can provision their keys with MongoDB; the reserved global key store no longer produces an invalid MongoDB database name. (#4549)
• Protected numbers and booleans are released with the type their schema declares instead of as JSON strings, including inside arrays, for erased values and for enums stored by name. (#4550)
• Compliance metadata declared on a dictionary's value schema (additionalProperties) is now applied to every dictionary value: values are encrypted, erased with their subject and refused after erasure. (#4551)
• Array elements that are themselves classified collections are encrypted, released and erased as a whole, while objects with declared properties keep per-member protection, so data already stored that way still releases. (#4552)
• Event-type migrations transform plaintext instead of ciphertext, so split, combine and map work on [PII] values, and each target generation is protected for the original subject. (#4456)
• Revised event content and the revision request are protected with the original event's subject before they are stored. (#4525)
• Projection folds, immediate projections and GetInstanceById keep the subject each protected value was written under, so values whose subject differs from the read-model key are released correctly. (#4561)