Release v19.4.8

Cratis.Chronicle.CodeAnalysis has been published for as long as it has existed, and delivered to nobody. Every CHR analyzer has been inert in every application that consumes Chronicle.

Fixed

• Cratis.Chronicle now carries Cratis.Chronicle.CodeAnalysis as a package dependency, so a consumer actually receives the CHR analyzers. The analyzer project packed itself while setting DevelopmentDependency, which NuGet reads as "never emit me as a dependency" — so the client's nuspec never mentioned it and a consumer had to know the package existed and reference it by hand. The package identity moves into a package-only project the client can depend on, the same shape Cratis.Arc.Chronicle already uses for its ARCCHR analyzers.

How it was found

An application had 306 specification facts that asserted nothing: void-bodied, discarding the Task the assertion throws on. CHR0039 exists precisely for that shape and had never once run. Planting a deliberately false predicate in one of them confirmed it still passed.

Verified by packing and consuming from a local feed — CHR0039 fires on the discarded-assertion shape with this change, and does not fire on published 19.4.7.

Known follow-up

Chronicle does not yet run these analyzers over its own source. CHR0001 and CHR0002 ask whether a type carries [EventType], which cannot be answered about the open generic parameters the client's own plumbing is written in — they are questions about application code, asked of the library that defines the attribute. Making the client assembly analyzer-clean is its own piece of work.