Release v16.6.0

Added

• Configuration options for previously-hardcoded operational timeouts — connected-client intervals, the webhook HTTP resilience pipeline, the SQL live-query polling interval, the event-queue depletion wait, and the subscription-ready timeout — each defaulting to its current value (#1417)
• The ability to rename an identity's display name, from kernel storage through gRPC to the client SDK, keyed by subject so it never affects the PII encryption key (#1684)
• React to read model changes with IReadModelReactor: methods named Added, Modified or Removed are invoked by convention with the changed read model (a single instance or a collection), an optional EventContext, and services, and may return events as side effects (#3359)
• [Materialized] opts a read model into materialized change tracking, deducing the change type by comparing successive materialized windows (#3359)
• OpenTelemetry tracing spans for client unit-of-work commit and rollback, tagged with the correlation id (#1396)

Changed

• Read model change notifications now carry the change type and the causing event's sequence number, occurred time and correlation id (#3359)
• Faster reactor, reducer and event-type dispatch on the .NET client (#1309)

Fixed

• Releasing a coarse [PII] collection for an erased subject no longer crashes — it reads as an empty collection instead of throwing and potentially quarantining an observer after right-to-erasure
• Projection-backed observable read-model queries keep emitting after a connection drop, instead of silently freezing on stale data after the first reconnect
• Appending a batch of events no longer risks an infinite retry loop that permanently wedges an event sequence, or a sequence-number gap and phantom tail when the storage append throws
• The SQL event-store backend no longer risks an infinite retry loop when appending at a sequence number that is already taken
• Username and email lookups on the SQL backend are now case-insensitive, matching the in-memory and MongoDB backends
• Waiting for observers to catch up no longer reports success against an observer that has never handled any events; event and read-model read cursors are now disposed when an enumeration error occurs
• Event seeding no longer permanently loses events when applying them to an event store's namespaces fails partway through, and no longer silently skips events when an append fails
• Adding a new generation to an existing event type now works on the MongoDB backend, and resolving an event type by a specific generation from the SQL database on a cold cache returns that generation's schema
• Job monitoring surfaces backend failures instead of returning an empty result
• A unit of work whose commit fails is no longer leaked; optimistic concurrency is no longer silently disabled when a later same-source event carries no scope; and completing one unit no longer clears the current-unit reference of a different unit
• Paging a read-model query with a skip that is not a multiple of the take now returns the full requested window instead of a short page, and no longer throws on a zero take
• Child-level [RemovedWith] (and [RemovedWithJoin]) on a [ChildrenFrom] collection now removes only the targeted keyed child — including nested grandchild collections — instead of removing the whole read-model document or the parent item
• Removed a per-event blocking schema lookup on the Orleans serialization hot path, improving throughput when events cross silo boundaries (#3168)
• Process-level unhandled and unobserved-task exceptions in the server and API hosts now reach the logging pipeline and OpenTelemetry exporter instead of only the console (#1343)
• The Workbench event details view now shows a vertical scrollbar when the Context or Content payload overflows, instead of clipping (#1437)
• Corrected the Aspire hosting guide: Chronicle's MongoDB storage requires a replica set with directConnection=true; the previous guidance used a standalone mongod that silently breaks change streams (#3400)

Security

• Token revocation now actually revokes. Previously every bulk revocation operation returned success without revoking anything, so rotating a leaked client secret, removing an application, or signing a user out everywhere left issued tokens valid until natural expiry; token pruning also no longer deletes still-valid tokens
• A unique constraint on a [PII] property is now enforced. The constraint index previously hashed the encrypted value, which differs on every append, so two subjects sharing the same value never collided and the constraint silently did nothing; values are now hashed from the decrypted content and existing indexes are rebuilt on upgrade (#3430)