Arc.Go parity

Baseline v1

Arc.Go implements foundation contracts, backend pipelines and running snapshot HTTP hosting with identity, protected discovery, observable SSE/WebSocket transports and explicit graceful lifecycle. Ledger and fixture format version: 1. Descriptor format: metadata.Version == 1. Work is tracked in foundation issue 3.

Profile	Reference	Coverage
Current C# authority	Arc commit `7c1e78075b737df64f69fddfaae83374f75e3612`	Source-derived foundation fixtures, behavioral tests and the bounded paired snapshot HTTP checkpoint below
Historical Kotlin comparison	C# Arc 22.14.0; Kotlin commit `23c93a3f70008f20d99c28868010b08e3123ea97`	Task-board assertions consulted; paired HTTP suite not run
Historical TypeScript comparison	C# Arc 22.45.0; TypeScript commit `cbb421aa1fb6e5f65deec746911ee3046dfb1af6`	Full-envelope expectations consulted; paired HTTP suite not run

C# paths in the ledger are relative to Source/DotNET/Arc.Core/ at the authority revision above. Scalar naming/converter sources additionally pin Fundamentals d2accc4a79b6bcf2708213c97093ab5ba6c06381. Fixture provenance identifies exact files, versions and normalization. Those foundation fixtures are not live .NET captures; the separate HTTP checkpoint below executes both hosts.

Paired snapshot HTTP checkpoint

Issue 38 remains Partial. ContractTests/httpconformance compares real Go and generated C# GET/QUERY endpoints at the authority revision above, using SDK 10.0.401, runtime 10.0.12, seven locked projects and exact Git-derived source membership. TestReferenceActivation requires all four fixture performers and eight routes; TestPairedSnapshotHTTP executes 36 requests across 14 fixed groups.

The recorded pair has 34 strict matches and two exact allowances. Coverage includes scalar/default binding, missing/empty/null inputs, count-before-window sorting and paging, empty/out-of-range selections, malformed controls and failed performers. Status, relevant headers, correlation, full envelopes, array order and missing-versus-null values are compared. Only object order and JSON whitespace are normalized; raw exchanges and differences remain separate from allowances.

Both allowances are limited to successful plain-paging-control/page/GET and plain-paging-control/page/QUERY: only $.paging.page (C# 1, Go 0) and $.paging.size (C# 2, Go 0) differ. Totals remain zero and all four rows remain in the same order. Ordinary Go lists stay unpaged; use an explicit renderer for paging rather than relying on request metadata being echoed. These allowances never apply to failures or other requests.

The checkpoint corrects query failure envelopes: malformed QUERY integer input retains its actual decoder cause without adding synthetic diagnostic causes; invalid direction text reports the reference message; paging findings use Page/Size members. TestQueryReaderParityFailureEnvelopes separately verifies Go-side rejection before performer, renderer and business-factory activation, including denial. That native denial test is not paired authentication evidence.

See the corpus, exact allowances and run instructions. Preparation and native tests reject changed or incomplete provenance; the dedicated workflow retains bounded captures and source/provenance manifests, not source caches or binaries. Commands, authentication, HEAD, CSV, renderer failures, provider databases, streams and browser clients remain outside this paired profile. It does not establish the full CI matrix or whole-product parity.

TypeScript proxy implementation boundaries

Work is tracked by Arc.Go issue 20. The frontend authority is Source/DotNET/Tools/ProxyGenerator and Source/JavaScript at 7c1e78075b737df64f69fddfaae83374f75e3612 (Arc npm/NuGet 22.48.2, Fundamentals npm 7.22.0).

Approved deviation: sorting helpers use declared sortable result (read-model) wire fields, not query arguments, per Arc issue 2998. Captured C# evidence must retain its argument-based helpers unchanged.
Scope: portable validation-rule descriptors and declared derived-wire-model support are prerequisites, not optional reductions to a Go-only frontend API.
Portable rule foundation: validation.RuleDescriptor, ParseRules and NewPortable[T] share explicit field-tag rules with the compiler without running application validators. UTF-16 length and JavaScript whitespace are used; unsupported rules, nonportable regex, unsafe numbers and dynamic severity fail explicitly. validation/portable_test.go characterizes the bounded foundation. Register the compiled validator explicitly for manual registrations; a rules tag alone does not activate runtime validation. TypeScript-enabled generated adapters register NewPortable for the supported command rules. The independent Go/locked-JavaScript rule corpus and production server rejection provide bounded paired evidence; query validation and other rule forms remain unsupported.
Declared derivatives: serialization.RegisterDerivedTypes supplies a concurrency-safe process-wide discriminator contract for named interface bases and assignable concrete structs/pointers. Exact repetitions are idempotent; conflicts, reserved fields, custom codecs, absent/unknown discriminators and undeclared implementations fail. serialization/derived_test.go covers round trips and failure atomicity. An explicit default concrete model preserves ordinary base payloads without a discriminator; unknown IDs never fall back to that default. Go embedding alone does not declare inheritance.
Shared field selection: reflection and compiler adapters use internal/modelshape.Select, keeping wire visibility and dominance in one kernel. The existing reflection corpus remains executable; compiler corpus parity is covered by TestCompilerAndReflectAdaptersUseTheSameFieldCorpus.
Descriptor graph and wire analysis: tools coordinate the whole selected catalog before resolving routes and preserve adapter-only generation. The serialization-ready graph separates client fields, responses, cardinality, defaults, roles, HTTP preference and output selection from compiler attachments. tools/internal/artifacts/graph_test.go covers rich shared scalars, constants, argument presence, pages, result-field sorting declarations and conservative rejection boundaries. The actual CLI now emits supported model, command, snapshot-query, and declared observable-query families together with Go adapters. Rich dictionaries, non-string keys, and unsupported import/codec mappings fail rather than becoming an unhydrated or any surface. Precision warnings are deterministic.
Shared concept compiler analysis: tools pin released Fundamentals.Go v0.2.0 (including the classifier delivered at 24d60f07b6090f195cd07b9f1045fb540ff49fd7) and use concepts/conceptstypes.Underlying, switching only on shared ScalarKind values. Valid concepts map to scalar constructors rather than wrappers; invalid declarations retain shared ErrInvalidConcept, TypeError and reason values. TestConceptProjectionUsesTheSharedDeclarationCorpus loads the pinned shared declaration corpus, including aliases, pointer layers and conservative failures. This replaces the former rejection-only seam from Fundamentals.Go issue 15. Enum member names use the shared acronym-friendly naming.CamelCase; field selection still uses Arc’s authoritative shared kernel, not preservation of all Go field spelling. The root runtime remains on Fundamentals.Go v0.1.0. Emitted proxies have strict locked-TypeScript and Node runtime evidence; the generated observable hooks have the bounded mounted evidence below, not browser or complete React parity.
Pinned reference baseline: ContractTests/ProxyComparison retains historical 22.45.0 captures and fresh 22.48.2 executable captures, locked NuGet/npm dependencies, strict untouched-proxy compilation and real-runtime characterization tests. Captures remain untouched reference evidence. Separate Go-generated Models/Commands/Queries fixtures and the actual CLI Publication fixture provide emitted-proxy evidence. Mounted generated observable hooks have their separate bounded lane below; command/snapshot hooks and paired .NET execution of these generated proxies remain unverified.
Adapter defaults: narrow command/model name and namespace options preserve the actual composition namespace without the removed Builder.CommandNamespace accessor. TestGeneratedRegistrationOptionsPreserveNamespaceDefaults covers the supported runtime options. The independent tools consumer regression TestNamespaceLessAdaptersUseSupportedRegistrationDefaults covers both global and configured composition namespaces, renamed artifacts and excluded queries; existing stale-output bootstrap coverage remains executable.
Profile agreement: Builder.ExpectGeneratedEndpoints checks owned endpoints against the final complete catalog at Build, including manual artifacts and /validate. generated_contract_test.go covers copied inputs, overlap rejection, namespace/path drift, additional manual commands changing conventional routes, and terminal frozen registration. TypeScript-enabled adapters now emit these expectations and a fingerprint; the production CLI consumer accepts the agreed profile and rejects mismatched routes without a new root API.
Published families (Partial): emit_typescript_models_test.go, emit_typescript_commands_test.go, and emit_typescript_queries_test.go cover deterministic model/scalar/concept/enum, command, snapshot, and barrel plans; emit_typescript_observable_test.go and observable_publication_test.go add declared observable emissions, hook tuples, mixed publication, and source identity rejection without any output mutation. Strict real declarations and Node fixtures exercise rich hydration, portable command rules, signatures, defaults, and complete envelopes. The actual CLI Publication/runtime.test.mjs executes generated adapters over loopback HTTP, including command validation/execution, GET/QUERY snapshots, and independent server rejection. Nullable-element/default-grammar regressions and the pinned regex-key rejection (Arc#3014) remain explicit boundaries. Enumerable command response annotations retain the pinned C# element generic; runtime arrays and pinned null-write/numeric/temporal limits are characterized, not repaired.
Mixed publication (Go-specific): output_test.go and production_cli_test.go prove manifest owner/scope/hash checks, zero-write check mode, complete physical-path preflight, stale ownership, and interrupted write/rename/delete/manifest recovery. Empty files differ from absent files; no unmanifested file is automatically adopted, even with identical marked bytes. Publication is per-file atomic in a trusted single-writer workspace, not a durable cross-root transaction or ownership migration.
Generated observables (Partial): tools pin pushed Arc 78ebbf8 and released Fundamentals.Go v0.2.0. Exact Source/CurrentSource/State/Subject declarations unwrap owning-model emissions, including value Page/ObservedCollection, without generated workers or eager activation. Independent generated Go consumers prove admission/laziness, snapshots, failures, cancellation, and join-before-disposal. Observable collection proxies require one selected direct nonnullable ID/Id serialized as id, or no identity at all (C# JSON fallback); competing conventional members, including hidden/embedded ones, and a serialized id without ID/Id fail before publication. No arbitrary identity/provider inference. ContractTests/observables/frontend/generated.test.mjs executes actual CLI output with default WebSocket hub/Delta, shared socket, date/model hydration, exact envelopes/callback counts, argument replacement, independent cancellation, terminal Unauthorized, and cumulative joined-source/host counters. Its final collection is an independent test consumer, not React.
Mounted generated observables (Partial): frontend/react.test.mjs under ContractTests/observables executes actual generated use, useChangeStream and useWithPaging with Arc.React 22.48.2, React and react-test-renderer 18.3.1. Real providers explicitly select WebSocket hub/Delta, not the complete <Arc> wrapper’s default SSE. Shared cache listeners reconstruct rich collections and hydrate change sets from real deltas; raw frames are asserted separately. Equal arguments do not reopen; alpha-to-beta replacement preserves the pinned cross-baseline change-stream diff. Zero-retention unmount awaits source closure and resource disposal before fallback cleanup. Default retention proves reuse followed by explicit disposal, not 30-second expiry. The separate paged mount proves tuple/request shape, reconstruction and replacement, not server-side windowing or totals. Same-key paging/sorting setter retention reproduces open Arc issue 2869, without compensating cache eviction or a Go server change. Joined socket/host cleanup is bounded.
Remaining frontend gaps: proxy-only generation, query validation beyond the bounded snapshot-query string rules (see the generated snapshot-query validation row), unsupported model/rule/default/provider forms, custom import, interface/grouping/library modes, OpenAPI publication, browser hosts beyond the bounded Chromium coverage in the Real-browser observable conformance row, broader mounted-hook families, and full paired .NET parity. Opaque MongoDB Source[Find] generation requires explicit emission metadata; manual runtime support does not imply generation. The Node manual lane covers a wider transport matrix than the generated default case. The separate mounted lane adds named hook/cache reconstruction cases, not browser credentials/origins, DOM/StrictMode, suspense, network-failure reconnect, or every C# rich nullable/provider layout. The Real-browser observable conformance row adds Chromium cookie ownership, DOM/StrictMode and first-back-off reconnect; other browsers, cross-origin credentials and longer outages remain unverified. The pinned null-write issue remains Fundamentals#1148.

Status vocabulary

Implemented: the named, bounded contract has executable regression evidence.
Partial: the stated subset works; identified gaps remain.
Not implemented: no working Go surface, even if the contract is understood.
Go-specific: deliberate construction or behavior differences, described below.

Feature ledger

Feature	C# source	Go surface	Status	Behavioral/wire evidence and remaining scope
Explicit artifact descriptors v1	`Commands/ICommandHandler.cs`, `Queries/IQueryPerformer.cs`	`metadata.Catalog`, `Command`, `Query`, `TypeName`	Go-specific	`metadata/routes_test.go`; logical identities do not depend on Go package names. Handler/type-schema graphs await their owning slices; optional authorization metadata extends format 1, with keyed literals required for v0 struct compatibility
Stable query identity	`Queries/ModelBound/ModelBoundQueryPerformer.cs`	`Query.Identity`	Implemented	`TestQueryIdentityAndPathPrecedence`; includes model name independently of route
Literal route resolution	`Http/EndpointRouteHelper.cs`, `StringExtensions.cs`, endpoint mappers	`metadata.Resolve`, `DefaultOptions`	Implemented	`TestConventionalRoutes`, `TestNamespaceConflictsRestoreNames`; API prefix, skips, acronym/underscore casing, name fallback and GET/QUERY/POST/validate
Explicit path precedence	`Commands/CommandRoute.cs`, `Queries/ModelBound/ModelBoundQueryPerformer.cs`	`Command.Path`, `Query.Path`, `ReadModelPath`	Implemented	`TestQueryIdentityAndPathPrecedence`, `TestDerivedCommandPathsAreValidated`; exact casing and query trailing slash; command paths must also yield a valid `/validate` path; empty method override disables model override
Collision/configuration diagnosis	`Queries/QueryEndpointMapper.cs`	`CollisionError`, `Resolve`	Go-specific	`TestCollisionsAreDeterministicAndInspectable`, `TestInvalidMetadataFailsExplicitly`; no first-performer-wins behavior
UUID wire value	Guid and concept converter	`concepts.UUID`, alias of `github.com/cratis/fundamentals.go/concepts.UUID` at `v0.0.0-20261002203106-9d83ef2578a5`	Partial	`ContractTests/scalars_test.go`, `concepts/scalars_test.go`, `concepts/aliases_test.go`; unchanged golden bytes, RFC order and shared-type identity/round trips; dashed input only, not every Guid.Parse spelling
Calendar/duration output	Fundamentals DateOnly/TimeOnly converters; System.Text.Json TimeSpan	`DateOnly`, `TimeOnly`, `TimeSpan`, aliases provided by `github.com/cratis/fundamentals.go/concepts` at `v0.0.0-20261002203106-9d83ef2578a5`	Implemented	`ContractTests/scalars_test.go`, `concepts/scalars_test.go`, `concepts/aliases_test.go`; unchanged canonical strings, zero values, full signed tick range and shared-type identity/round trips
Calendar input	Same converters	`ParseDateOnly`, `ParseTimeOnly`, `ParseTimeSpan`, forwarding to `github.com/cratis/fundamentals.go/concepts` at `v0.0.0-20261002203106-9d83ef2578a5`	Partial	Boundary and failure-atomicity tests; invariant input only, no culture-dependent parsing or DateOnly timestamp coercion
DateTime/DateTimeOffset	`JsonSerializerOptionsConfiguration.cs` (default System.Text.Json timestamp codecs)	`time.Time` through `serialization.Marshal`, `Unmarshal`	Partial	`TestTimestampWirePolicy` pins RFC3339Nano output: UTC `Z`, up to nine fractional digits, explicit offsets. C# DateTimeOffset emits `+00:00` for UTC and at most seven digits; DateTime suffix depends on kind. Not all C# timestamp input forms are accepted; no DateTimeOffset-specific codec
`ConceptAs<T>` → `Concept[T]` recognition	Fundamentals `Concepts/ConceptAs.cs`, `Json/ConceptAsJsonConverter.cs` at `d2accc4`; Arc `JsonSerializerOptionsConfiguration.cs` at `7c1e780`	`concepts.Concept[T]` alias; `serialization.ValidateType`, cached shared `Underlying` metadata	Partial	`ContractTests/concepts_test.go`: UUID forwarding, string/int, pointers, slices/map values, inspectable marker-only/nested rejection before encoding/binding, metadata-only concurrent plans, encoded fields checked with `CheckJSON`. Codecs remain application-owned; bounded GET/QUERY text binding is available through typed argument models; decimal/enum concepts and generated schema/proxy recognition remain incomplete
Model naming/nulls/numbers	`JsonSerializerOptionsConfiguration.cs`	`serialization.Marshal`, `Unmarshal`	Partial	`serialization/serialization_test.go`, `codec_regression_test.go`; acronym-preserving naming, exact case-sensitive binding, tags, null omission, numeric enums, nonfinite floats, JSON/text codecs, embedded-field promotion and standard Go omission tags. Complex dictionary keys, polymorphism and descriptor-generated codecs await later slices
Int32 enum JSON profile	Arc `JsonSerializerOptionsConfiguration.cs` (`7c1e780`); Fundamentals `Json/EnumConverter.cs` (`14037b1`, package 7.19.6 consumed by Arc 22.48.2)	Opt-in `serialization.NewInt32Enum`, `Int32Enum.ParseJSON`, `ErrInvalidEnumValue`; generator-owned `//arc:enum parse=int32` declarations	Implemented	`serialization/enum_test.go`, `ExampleInt32Enum`; `ContractTests/EnumContract` compares 65 Int32 reads and 8 writes with captured C# output and hydrates the numeric results through TypeScript Fundamentals 7.22.0. Declared-only numeric input, case-insensitive original names, comma-separated names combined by OR even without Flags, any-Int32 decimal strings, an open output domain and scalar-null rejection are pinned parity; ASCII and case-unique declaration admission is a Go restriction. Opt-in `//arc:enum parse=int32` emits a parser declaration and failure-atomic `UnmarshalJSON`; `TestEnumGeneratedConsumerAndStableTypeScript` runs all 65 State/Access reads and 8 writes through generated parsers and ordinary Arc serialization, checks enum-only output and imported generated codec admission, and checks unchanged TS output. `TestEnumOnlyParserOptOutRemovesOwnedAdapter` pins owned cleanup; `TestEnumOnlyParserDoesNotEmitRegistrationSurface` compiles application-owned registration names without root runtime imports; `TestImportedEnumParserRejectsStaleMembersBeforePublication` refuses drifted imported parse maps when generating/checking TypeScript proxies; `TestImportedEnumParserGoOnlyCheckRequiresSelectingEnumPackage` pins Go-only checking through the enum package or `./...`, not its root-only consumer; `TestImportedEnumDoesNotAdmitHandWrittenCodec` rejects opaque imported application codecs. `TestEnumParserOpenAPICommandInputRefusesLocalAndImportedProfiles` pins parser behavior and explicit whole-document OpenAPI refusal for local/imported command inputs; directional OpenAPI schemas for this parser are not implemented. `TestEnumGeneratorRejectsInvalidDeclarationsBeforePublication` covers backing width, missing/case-colliding/non-ASCII names and conflicting hand-written codecs. The status covers only the pinned Int32 family; other backing widths, query-string binding and later Fundamentals flags behavior are unsupported. See Int32 enums (#32)
Complex-key dictionary codec	Arc `JsonSerializerOptionsConfiguration.cs` (`7c1e780`), Fundamentals dictionary converters	No generated codec	Not implemented	Generator rejects `arc:codec` with an explicit unsupported-family diagnostic; arbitrary complex-key dictionaries require an application-owned wire representation. `TestEnumGeneratorRejectsInvalidDeclarationsBeforePublication` verifies no output on an unsupported codec directive. Ordinary supported string-key maps are unchanged (#32)
Geospatial codec	Arc `JsonSerializerOptionsConfiguration.cs` (`7c1e780`), Fundamentals geospatial converters	No generated codec	Not implemented	`arc:codec` reports this unsupported family before output; no automatic C# coordinate representation is inferred. Supply an explicit application codec and wire mapping instead (#32)
Type/Uri codec	Arc `JsonSerializerOptionsConfiguration.cs` (`7c1e780`), Fundamentals Type/Uri converters	No generated codec	Not implemented	`arc:codec` reports this unsupported family before output; Go reflection types and URLs do not establish the CLR wire contract. Use an explicit wire value and mapping (#32)
Enumerable model-to-concept codec	Arc `JsonSerializerOptionsConfiguration.cs` (`7c1e780`), Fundamentals enumerable/concept converters	No generated codec	Not implemented	`arc:codec` reports this unsupported family before output; ordinary slices and scalar concept forwarding are unchanged, not evidence for enumerable model-to-concept conversion (#32)
Input presence and duplicates	`ArcOptions.cs`, `JsonSerializerOptionsConfiguration.cs`, command and query request readers	`serialization.Optional[T]`, `Some`, `Null`	Go-specific	`TestExactWireNames`, `TestNullStringPolicyAndOptionalOutput`, presence and atomic-binding tests; unknown properties including case variants ignored, exact duplicate declared names rejected. Present-null Optionals emit null; plain Go strings reject null unlike C# strings. GET/QUERY binding is covered separately below
Framework recursion safety	`JsonSerializerOptionsConfiguration.cs` (System.Text.Json traversal)	Model and envelope encoders	Go-specific	`TestFrameworkCyclesAndNestingUseSharedBudget`; one 64-level budget across validation State, command responses, query data/findings/change sets and Optional values. Application custom codecs own their recursion safety
Command result envelope/flags	`Commands/CommandResult.cs`	`commands.Result[R]`, `Details`, `Success`, `WithResponse`	Implemented	Nine command goldens plus exhaustive status/response-presence tests; pipeline exception conversion/redaction is covered separately below
Failed scalar response omission	`CommandResult<T>.ClearResponse`	`commands.NewResult`	Go-specific	`TestStatusPrecedenceAndFailedResponseOmission`; removes failed zero-valued responses rather than emitting C# default(T)
Query result envelope/flags	`Queries/QueryResult.cs`	`queries.Result[T]`, `Details`, `Success`, `NotReady`	Implemented	Eight query goldens, readiness and precedence tests; ready null is not pending
Paging response metadata	`Queries/PagingInfo.cs`	`queries.PagingInfo`	Partial	`TestPagingInfo` and page golden cover in-range semantics; out-of-range page counts return MinInt32 deterministically, without a runtime-specific C# overflow claim. request readers, active paging validation and opt-in rendering are covered below
Change-set envelope	`Queries/ChangeSet.cs`	`queries.ChangeSet`	Implemented	Delta golden, independent array copies and item encoding failures; diff and delivered transfer evidence have separate rows below
Validation findings	`Validation/ValidationResult*.cs`	`validation.Result`, `Severity`, `Reason`	Implemented	Four standalone goldens plus findings in results; open reasons, nil state omission and required members array
Standard status precedence	`Http/EndpointRouteHelper.cs`	Result `StatusCode` methods	Implemented	All constructed flag combinations; hosting tests add ingress 401, QUERY reader 400 and observable first-result wait 408
Command/query shared lifecycle	`Commands/CommandPipeline.cs`, `Queries/QueryPipeline.cs`	`commands.Pipeline`, `queries.Pipeline`	Implemented	`ContractTests/pipelines_test.go`, `pipeline_failures_test.go`, `model_bound_test.go`; combined evaluator, query-from-command resource reuse, security continuity, correlation, distinct receipts, lazy dependencies, cleanup suppression and unchanged existing goldens. Backend execution only; no HTTP claim
Principal/context	`Authorization/CurrentPrincipalAccessor.cs` (`7c1e780`)	`identity.Principal`, `WithPrincipal`, `PrincipalFrom`	Go-specific	`identity/TestPrincipalSnapshot`, `TestPrincipalContexts`; immutable explicit contexts replace ambient accessors, preserving explicit anonymous shadowing; no authentication or authorization
System actor	`Authorization/SystemPrincipal.cs` (`7c1e780`)	`identity.System`	Implemented	`identity/TestSystemRoles`; C# subject/name/role claims, supplied roles only, no privileged bypass
Tenant context	`Tenancy/TenantIdAccessor.cs` (`7c1e780`)	`tenancy.WithTenant`, `TenantFrom`	Go-specific	`tenancy/TestTenantContexts`; nested/concurrent explicit contexts replace disposable ambient overrides; NotSet shadows parents
Tenant sentinel semantics	`Tenancy/TenantId.cs` (`7c1e780`)	`tenancy.ID`, `ParseID`, `Default`	Partial	`tenancy/TestTenantSentinelsAndCodecs`, `FuzzTenantText`, `FuzzTenantJSON`; zero internally represents `[NotSet]`, named Default remains distinct; Go maps `""` to NotSet whereas C# keeps `""` as a distinct tenant. Go also rejects controls, invalid UTF-8 and surrounding whitespace and accepts JSON strings only
Correlation	`Execution/CorrelationIdResolver.cs` (`7c1e780`)	`correlation.ID`, `Parse`, `Normalize`, `Resolve`; `WithID`/`FromContext` delegate to Fundamentals.Go at `66acfed`	Partial	`correlation/TestCorrelationParsingAndReplacement`, `TestCorrelationContextPrecedence`, `FuzzCorrelationParse`, `TestSharedCorrelationContext`, `TestSharedCorrelationNilContextPanics`; UUID alias, bidirectional shared context, read-only access, zero shadowing, cancellation and nil-context semantics unchanged; dashed input subset, no other Guid spellings
Receipt metadata	`OperationContextScope.cs` (`7c1e780`)	`execution.WithReceivedAt`, `ReceivedAt`, `Capture`, `NewContext`	Go-specific	`execution/TestReceiptNormalizationAndOverrides`, `TestExplicitMetadata`; UTC value contexts replace ambient leases; pipeline receipts/correlation are covered by `ContractTests/TestCommandQuerySharedScopeCompositionEquivalence`; HTTP forwarding is covered by `TestHTTPReceiptPrecedesAuthenticationAndNestedReceiptIsFresh`
Fundamentals DI/scopes	`HostBuilderExtensions.cs` (`7c1e780`)	Fundamentals.Go `dependencyinjection` and optional `container` at `0fd6b51`; `execution.ResourcesFrom`, `Resolve`, `ContextGuard`	Go-specific	`execution/background_test.go`, `dependencies_test.go`: lazy exact-key resolution, fresh scopes, security guards including factory-internal resolution, joined errors and synchronous cleanup. Arc’s guarded resolver passes Fundamentals `ditest.RunResolver`; no root resolve or implicit command completion. Container lifetimes/graph implementation is Fundamentals-owned, not duplicated in Arc
Startup graph checks	`ArcApplicationBuilder.cs` (`7c1e780`)	Fundamentals.Go `dependencyinjection/container.Registry.Build` at `0fd6b51`	Go-specific	Optional declared-edge validation without activation belongs to Fundamentals (its `container` tests and `ditest.RunDeclaredGraph`). Arc does not import the container at runtime or reproduce its test suite; hidden closure captures cannot be checked
Typed invocation/failure	`Validation/ValidatorInvoker.cs`, `IValidationFailure.cs` (`7c1e780`)	`validation.Validator[T]`, `Invoke`, `Failure`, `Reject`	Partial	`validation/TestInvokeCopiesAndPreservesRejection`, `TestInvokeRedactsAndPreservesCancellation`; synchronous typed callbacks, wrapped rejection preservation, redacted infrastructure failures and cancellation; no FluentValidation discovery, declarative rule IR or generator projection; bounded graph support is recorded below
Command severity policy	`Commands/CommandValidationResults.cs` (`7c1e780`)	`validation.Policy`, `NewPolicy`, `Filter`	Implemented	`validation/TestSeverityMatrix`; default Error-only, strict allowances, inclusive floors, Unknown blocking with floors; unsupported Go numeric findings conservatively block
Header allowance	`Commands/CommandEndpointMapper.cs` (`7c1e780`)	`validation.AllowedFromHeader`	Go-specific	`validation/TestAllowedHeader`, `FuzzAllowedFromHeader`; one supported signed decimal int32 only; untrusted Error capped at Warning, unsupported enum bypass closed; caller must use default policy for ignored input; HTTP forwarding is covered by `TestAllowedSeverityHeaderFiltering`
Authentication chain	`Authentication/Authentication.cs`, `AuthenticationResult.cs` (`7c1e780`)	`authentication.Chain`, `Handler`, `HostPrincipal`	Implemented	`authentication/TestTerminalOrderAndCopies`, `TestInvalidAndCancellation`, `TestTrustedHostAndConcurrentContexts`; terminal success/failure and no rescue, copied handlers and trusted typed host identity only; authenticated result requires an authenticated principal, unlike C#‘s nonnull-only result check; `TestAuthenticationClonesRequestContextHeadersAndURL` pins caller-isolated context/headers/URL; Body is shared and handlers must not read it; no auto credential/header/cookie adapter
Authentication ingress	`Http/AuthenticationMiddleware.cs` (`7c1e780`)	Application ingress	Go-specific	`TestTerminalCredentialsAndCorrelation`, `TestAnonymousAuthorizationDenialIs403AndCredentialFailureIs401`; explicit credential failure 401 including public operations, anonymous exhaustion proceeds to authorization, ordinary denial 403; differs from C# blanket credential requirement and anonymous failure exemption
Declaration compilation	`Authorization/AuthorizationDeclarations.cs` (`7c1e780`)	`metadata.Authorization`, `authorization.Registry.Build`	Partial	`metadata/TestAuthorizationDescriptorRoundTripAndRoutes`, `authorization/TestBuildValidationAndFreeze`, `TestPrecedenceAndFallback`, `TestRolesAndPolicyOrdering`; all levels validated, method replacement, role OR/requirement AND and copied graph; frozen explicit fallback replaces dynamic discovery; `TestReadModelDeclarationsMustAgree` rejects conflicting declarations across queries of one read model (including nil vs explicit); named schemes rejected
Native policies	`Authorization/ArcAuthorizationPolicyRuntime.cs` (`7c1e780`)	Direct `Registry.Register`, `PolicyFunc`	Partial	`authorization/TestGuestConjunction`, `TestPolicyFailureCancellationAndConcurrency`; guest opt-in requires policy-only conjunction, errors fail closed; borrowed concurrently-callable values/closures are primary. `RegisterPolicy[P]` now accepts lazy operation-scoped factories (see below); policy factories may call execution.Resolve with a DI-backed scope. optional exact dependency manifests are checked by pipeline Build without activation; direct authorization Build remains provider-independent
Staged evaluation	`Authorization/AuthorizationEvaluation.cs` (`7c1e780`)	`Evaluator.Prepare`, `Prepared.Evaluate(ctx, resource)`, `Check`	Partial	`authorization/TestPreparedSecurityAndZero`, `TestRecheckAfterPolicyCallback`, `TestPolicyPanicRemainsBoundaryOwned`; principal/tenant continuity, no policy invocation at Prepare or after role denial, cancellation and fresh concurrent tenant evaluations. `TestGuestPolicyReceivesEmptyPrincipalAndRetainsCallerContinuity`, `TestGuestIdentityChangeDuringPolicyInvalidatesVerdict` pin empty anonymous policy input with original-caller continuity; `TestUnknownRuntimeTargetIsRedactedAndNotConfiguration` pins non-disclosing runtime lookup errors distinct from configuration errors. Container-neutral: `EvaluateScoped` guards operation-scope lifetime/security; borrowed DI scopes can be checked with execution.Scope.CheckOwner; pipeline enforcement is covered by the command/query rows below
Tenant selectors/membership	`Tenancy/SubdomainTenantIdResolver.cs`, `TenantHost.cs`, Header/Query/Claim/Fixed resolvers (`7c1e780`)	`tenancy.NewResolver`, `ResolverFunc`, `Membership`, `Require`	Partial	`tenancy/TestSelectorDefaultsAndInputs`, `TestSubdomainHostMatrix`, `TestInvalidOptionsAndMembershipSeparation`, `FuzzResolveHost`; ASCII/punycode only, Unicode explicitly rejected rather than IDNA-normalized; ambiguous header/query values rejected, malformed query encoding fails, DNS/port lengths validated; optional independent membership callback is a Go-specific seam, not a C# membership catalog; `TestClaimSelectorIgnoresUnauthenticatedIdentity` requires authentication for claim tenancy, stricter than C# `ClaimTenantIdResolver.cs`, which reads a claim without checking authentication; no development override or routing
Identity details/view	`Identity/IdentityProvider.cs`, `IdentityProviderContext.cs`, `IProvideIdentityDetails.cs` (`7c1e780`)	`identity.DetailsProvider[T]`, `ProvideDetails`, `View[T]`	Partial	`identity/TestDetailsFreshSnapshotAndNonAuthority`, `TestDetailsDenialErrorsAndCancellation`, `TestViewNilDetailsAndBoundedRecursion`; anonymous suppression, fresh callback, safe view with trusted roles, copied claims, unwrapped details and bounded wire encoding. Explicit adapter subject instead of C# sub-claim inference; display fallbacks only; no forwarded-name fallback, endpoint, schema or provider discovery/registration
Security seam composition	Same authentication/authorization/validation/tenancy/identity sources (`7c1e780`)	Explicit foundation composition	Go-specific	`ContractTests/TestSecuritySeamsRemainIndependent`; failed credentials terminal, public declarations do not bypass membership, nonblocking warnings do not imply authorization, malicious details remain display-only; no HTTP or pipeline conformance claim
HTTP hosting/discovery	Endpoint mappers and hosting (`7c1e780`)	Root Builder/Application	Partial	Hosting ledger below records snapshot endpoints, identity, discovery and lifecycle. Direct SSE, direct WebSocket and collection-transfer hubs are recorded below; locked Node client evidence is recorded below; browser execution is partially covered in the Real-browser observable conformance row (Chromium only); full schema generation remains unverified
Observable sources and declaration	`Queries/ObservableQueryHandler.cs`, `ObservableQueryElementOperations.cs` (`7c1e780`)	`observable.Source`, `Stream`, `Subject`, `State`; `queries.RegisterObservable`	Go-specific	`observable` lifecycle tests and `queries/TestObservableRegistrationAndPendingCurrentSnapshots`; explicit source registration and bounded independently owned handles instead of runtime observable discovery
Observable current/pending/wait execution	`Queries/ObservableQueryHttp.cs` (`7c1e780`)	`queries.Request.WithWait`, `ObservablePipeline`, observable HTTP snapshots	Implemented	`queries/TestObservableRegistrationAndPendingCurrentSnapshots`, suppression/wait/reader tests and root `TestObservableHTTPPendingWaitAndHEADDoNotActivateSource`, `TestObservableHTTPEnumerableMessageAndHEAD`; 202 pending, 408 bounded waits, completion diagnostics, QUERY no-store, enumerable 400 and nonactivating HEAD; streaming transport evidence is recorded separately below
Uniform observable interception and guards	`Queries/ObservableQueryElementOperations.cs`, `QueryPipeline.cs` (`7c1e780`)	`AddEmissionGuard`, `Invocation.SetSubscriptionScope`	Go-specific	Guard isolation, denial, masking, subscriber-tenant, callback-failure and terminal-frame tests in `queries/observation_test.go`; every source candidate uses authorization and detached interception; JSON-round-trippable scope data, bounded wait and retained failed-opening cleanup are deliberate hardening. Channel factories return an owned cleanup-capable handle even with a startup error or invalid channel, rather than losing cleanup on a canceled opening context
Hub revision operation semantics	`Queries/ObservableQuerySubscriptionStates.cs`, `ObservableQuerySubscriptionRevision.cs` (`7c1e780`)	`internal/streaming.Subscriptions`, `Revision`, `ConnectionOwner`	Implemented	`internal/streaming/subscriptions_test.go` covers equal-revision unsubscribe, delayed controls, legacy upgrade, token-owned termination, capacity, drain and lexical parsing; real SSE hub controls additionally prove duplicate/stale subscribe and equal-revision unsubscribe without reactivation
Revision tombstone retention and owner security	Same subscription state sources (`7c1e780`)	Connection-lifetime high-water marks and verified ownership snapshots	Go-specific	Tombstones are never evicted while a connection lives; new IDs reject at capacity rather than C# two-minute/1024-entry eviction. Retired workers count until joined. Stable verified subject, authentication state, tenant presence and independent anonymous evidence replace display-name/anonymous equivalence; real-listener SSE tests prove independent per-connection HttpOnly ownership cookies, exact tenant/subject matching, same-origin controls and an explicit origin allowlist. Anonymous connections are additionally capped by actual peer IP; forwarded peer headers are ignored. Cookies and connections expire after a bounded lifetime, with closed cookies removed on later eligible hub responses
Observable application lifetime	Hosting lifetime and observable subscription operation (`7c1e780`)	`Options.Observable`, admitted `ObservablePipeline`, `Application.Shutdown`	Go-specific	Root observable lifetime tests prove observations are canceled/joined before unary drain and user hooks, and failed admission after source activation retains timed-out cleanup for later Shutdown. Limits count opening and retired operations; callback cancellation is never treated as a join. `TestShutdownCanResumeResourceJoinWithoutRepeatingDisposal` and `TestShutdownJoinsChannelFactoryCleanupRetainedAfterFailedStartup` prove explicit resource-join and partial channel startup retries; `queries/TestFailedChannelStartupRetainsCleanupPanicUntilProducerJoins` proves unknown cleanup completion retains producer ownership, resources and capacity, and later shutdown preserves panic diagnostics without repeating disposal
Direct observable SSE	`Queries/ClientObservableSSE.cs`, `ClientEnumerableObservableSSE.cs`; JavaScript `ServerSentEventQueryConnection.ts` (`7c1e780`)	Observable endpoint negotiation, `internal/streaming.SSEWriter`	Implemented	Real-listener direct SSE tests match independent frame bytes and prove flush visibility, pending-without-synthetic-data, HTTP/2 headers, QUERY no-store, null profiles, terminal denial and disconnect/shutdown. Bounded writes, safe source-error frames and never failing an application-owned subject harden the reference; locked Node client direct SSE snapshots, model hydration, cancellation and terminal denial run in `ContractTests/observables/frontend`
Acknowledged connection writer and retained bytes	`Queries/ObservableQueryDemultiplexer.cs` serialized sends (`7c1e780`)	`internal/streaming.Writer`, `Budget`	Partial	Deterministic writer tests prove immutable copies, write acknowledgement, legacy fences, obsolete-job suppression, terminal retirement, byte/job overload and timed-out close retaining in-flight reservations. Connection/global byte budgets deliberately harden the reference. The SSE hub integrates one acknowledged writer with application/connection byte and job budgets, serialized JSON Ping keepalives and legacy replacement fences. Direct SSE uses its synchronous writer without a queue. `queries/TestCancellationAfterCandidateReservationRestoresBothBudgets` proves candidate release when cancellation follows reservation
Observable SSE hub and controls	`Queries/ObservableQueryDemultiplexer.cs`, `ObservableQuerySSESubscribeRequest.cs`; JavaScript `ServerSentEventHubConnection.ts` (`7c1e780`)	Fixed SSE GET/HEAD and subscribe/unsubscribe POST routes	Implemented	Real-listener hub tests prove Connected-before-data, full QueryResult envelopes, empty control bodies, creation-time 401/Unauthorized, live denial isolated to its subscription, HTTP/2, origin/owner rejection, capacity/tombstones, POST-independent resources and truthful shutdown after failed opening cleanup. Duplicate JSON keys and malformed controls explicitly return 400. Both hubs deliver full/delta/legacy collection transfers; `ContractTests/observables/frontend` executes the pinned SSE hub client for all three modes, replacement and equal-revision unsubscribe using an explicit fixture session owner, not browser cookies
Direct observable WebSocket	`Queries/WebSocketConnectionHandler.cs`, `ClientObservable.cs`; JavaScript direct connection (`7c1e780`)	Observable GET upgrade, `internal/websockettransport`	Implemented	Real-listener `TestDirectWebSocketDataFragmentedPingAndOrderlyCompletion` pins Data wrapping, WebSocket-before-SSE negotiation, fragmented application Ping, echoed millisecond Pong and orderly completion. Pre-upgrade denial/origin rejection and nonactivating HEAD are tested. Compression is disabled; local bounded writes acknowledge delivery, not browser receipt
Observable WebSocket hub	`Queries/ObservableQueryDemultiplexer.cs`; JavaScript `WebSocketHubConnection.ts` (`7c1e780`)	Fixed GET/HEAD `/.cratis/queries/ws`	Implemented	Real-listener tests cover Connected, two subscriptions, legacy-to-revision upgrade, duplicate/stale controls, equal-revision unsubscribe, isolated Error/Unauthorized, Ping/Pong and joining hijacked sockets on Shutdown. Shared writer/owner/byte budgets apply. JSON controls use payload and string/null arguments; invalid/binary controls close the physical connection. Full/delta/legacy transfer and replacement baseline resets are tested on real connections; `ContractTests/observables/frontend` also executes the pinned default WebSocket/delta client, all three hub modes, same-ID replacement and equal-revision unsubscribe
Observable collection differences	`Queries/ChangeSetComputor.cs`, `ObservedCollection.cs` (`7c1e780`)	`queries.ComputeChanges`, `ObservedCollection`, `WithCollectionIdentity`	Implemented	Collection tests pin first-added-all, last duplicate value/encounter order, null IDs, reordered/empty collections, immutable removals and JSON-set fallback. Registration compiles exported ID/Id extraction, independently of command key tags. Known hints are verified against the complete intercepted diff and fall back on incomplete hints or broken generation/version continuity; no comparison-speed optimization is claimed. The custom extractor does not make differently named JSON identity fields stock-client compatible
Observable collection transfer	`Queries/ObservableQueryDemultiplexer.cs` (`7c1e780`)	`Observation.Run`, full/delta/legacy hub transfers	Implemented	`TestHubCollectionTransferModesOnBothRealTransports`, query transfer/observation tests and streaming baseline-budget tests: first delta full, subsequent delta without data, legacy full plus changes, full without changes, identity-less full fallback, fresh replacement baselines, masked removals and suppression continuity. Candidate state commits only after callback/write acknowledgement, never queue admission; failed delivery and cancellation discard reservations. Serialized baselines do not alias source/callback values and share connection/application limits with frames. Delivery means local write/flush, not browser acknowledgement. Known hints are fully verified rather than trusted shortcuts
Observable known-change hints	`Queries/ObservedCollection.cs`, `ChangeSetComputor.cs` (`7c1e780`)	Value `ObservedCollection[T]` and continuity fallback	Go-specific	`queries/observed_collection_test.go` and collection tests verify suppressed-middle, generation/predecessor and malformed/incomplete hint fallback against complete intercepted snapshots. Conservative verification, not a claimed comparison-speed optimization; hints never authorize omitting detected changes
Generated observable adapters	Model-bound observable discovery (`7c1e780`)	Separate tools module, `RegisterArtifacts` and typed `RegisterObservable` performer	Partial	`observable_analysis_test.go`, independent `testdata/observable_consumer_test.go`, and `TestProductionCLIRealClientFixtureIndependentConsumption` consume pushed Arc `78ebbf8` without workspace/replace. Exact Source/CurrentSource/State/Subject declarations and aliases normalize owning-model single/pointer/list/array/value Page/value ObservedCollection emissions. Manual/generated metadata and lazy admission, current/pending, failure, cancellation and join-before-disposal are executable. No arbitrary provider/nested-source inference, pointer wrappers, or generated lifecycle workers
JavaScript/browser observable compatibility	JavaScript `Globals.ts`, `ObservableQueryFor.ts`, connection factory/hub connections; `Arc.React/queries/useObservableQuery.ts` (`7c1e780`)	Real Arc registration/pipelines/subjects/Serve plus locked Node client	Partial	`ContractTests/observables/frontend/run.mjs` executes @cratis/arc 22.48.2 with Fundamentals 7.22.0, Node 26.8.1/npm 12.0.2 and pinned ws/EventSource polyfills. Default one-connection WS/delta, SSE hub, Full/Delta/Legacy hub results, class hydration, both direct full transports, equal-revision unsubscribe, same-ID fresh-baseline replacement, stale captured-control rejection, nil-ready/pending perform, pending WS argument replacement, cancellation and all-four terminal denial/cleanup pass. Delta final collection uses an explicitly independent test-consumer reducer, not an Arc React hook. The separate production-generated default WS/Delta case adds exact callback counts, argument replacement, date/model hydration and cumulative source/host joins using the same fixture; strict hook compilation covers both decorator modes. The separate mounted React lane is recorded below. Real-browser cookie ownership, StrictMode and failure reconnect are recorded in the browser row below; cross-origin browsers and Guid hydration remain unverified; see `ContractTests/observables/README.md` for exact cases and gaps
Mounted generated observable React hooks	`Arc.React/queries/useObservableQuery.ts`, `useChangeStream.ts`; JavaScript `QueryInstanceCache.ts` (`7c1e780`, npm 22.48.2)	Production-generated proxies and Go fixture, real providers, React/test-renderer 18.3.1	Partial	`ContractTests/observables/frontend/react.test.mjs` executes non-StrictMode explicit WS hub/Delta: shared `use`/`useChangeStream` cache, initial/delta rich hydration and actual collection reconstruction, equal/changed arguments with cross-baseline diff, separate paged tuple/requests/reconstruction, zero-retention unmount joins before fallback, default-retention reuse plus explicit disposal, and joined socket/host cleanup. Plain source slices do not prove paging windows/totals. Same-key setter retention characterizes Arc#2869, not a fix. No complete Arc wrapper, browser/DOM/StrictMode, suspense, 30s expiry, reconnection or broader transport/hook claim
Real-browser observable conformance	JavaScript `ServerSentEventHubConnection.ts`, `WebSocketHubConnection.ts`, `ReconnectPolicy.ts`; `Arc.React/Arc.tsx`, `queries/useObservableQuery.ts`; `Queries/ObservableQueryDemultiplexer.cs` (`7c1e780`, npm 22.48.2)	Real Arc host `clientfixture.NewBrowser`/`ServeBrowser`, production-generated `All.use` under the exported `<Arc>` wrapper in headless Chromium	Partial	`ContractTests/browser/run.mjs` (locked playwright-core 1.63.0, Chromium only, React/React DOM 18.3.1 development build) runs seven cases against `ContractTests/internal/browser/host`: default `<Arc>` SSE hub with one `EventSource`, an `HttpOnly`/`SameSite=Strict` path-scoped owner cookie unreadable by page script and attached by the browser, and 404 without lifecycle effects for a second profile’s controls; WebSocket hub over one socket without a cookie; `StrictMode` double mount with default and zero retention keeping one live source, with unmount joining it; reconnect after a real joined server close through the pinned `ReconnectPolicy` with a new connection, owner and fresh baseline; terminal `Unauthorized` remaining mounted and unauthorized across a real host restart and a bounded 2500ms reconnect/retry window, with no new subscribe POST or source; and `SIGTERM` joined shutdown observed by both transports. `clientfixture/TestBrowserHost*` prove the restart/join host contract; `ContractTests/browser/host.test.mjs` proves joined startup-failure cleanup and forced-termination fallback. Separate Linux `browser.yml` workflow, not a required local gate. No Firefox/WebKit, TLS `Secure` cookies, cross-origin/credentialed CORS, authenticated principals, HTTP/2 connection limits, suspense, paging hooks, direct per-query transports or `ReconnectPolicy` exhaustion (#21)
Chronicle watches	Chronicle read-model watches (`7c1e780`)	Future optional SDK source adapter	Not implemented	Keyed reads and Arc sources do not implement an authoritative Chronicle watch; no append-notification substitute
MongoDB bindings and BSON materialization	`MongoDB/DefaultMongoDatabaseNameResolver.cs`, `MongoCollectionAdapter.cs`, `ConceptSerializer.cs`, `MongoDBDefaults.cs`, `DateOnlySerializer.cs`, `TimeOnlySerializer.cs`, `TimeSpanSerializer.cs` (`7c1e780`, under `Source/DotNET`)	Optional `integrations/mongodb`: `Collection`, `NewCollection`, `DatabaseName`, `NewRegistry`	Partial	Module unit/race tests and independent literal BSON fixtures cover tenant defaults/case/Unicode, borrowed client/config snapshots, private registries, UUID subtype 4/RFC bytes, legacy concepts, checked numbers, null/zero/empty and failure-atomic decoding. Go uses required JSON names with optional BSON storage overrides, explicit collection names, UTC-noon DateOnly and checked rather than rounded numeric reads. Binding/registry construction performs no provider reads or publication; snapshot execution and the mandatory application-owned release callback are covered by the adjacent Partial MongoDB snapshot-rendering row. No reflection-invoked ConceptValue, global registry mutation or Optional/decimal/polymorphic mapping; real Chronicle sink layout/release remains unproved. See storage profile
MongoDB snapshot rendering	`Arc.Core/Queries/QueryableQueryRenderer.cs`, MongoDB collection operations (`7c1e780`, under `Source/DotNET`)	Optional `integrations/mongodb`: `Find`, `RendererOptions`, `NewRenderer`, `Renderer.Execute`	Partial	`renderer_test.go` records frozen authorized count/find predicates, server sort/window, bounds, failures, detached cleanup and raw release-before-interception. `snapshot_example_test.go` executes external manual namespace registration through the real Arc pipeline and pinned driver’s no-database wire mock. Primary/majority with simple collation is an explicit Go profile, not atomic count+find; retry configuration stays application-owned. Chronicle release mapping is application-owned, requires unchanged count/order/identity and unique decoded identities, and never decodes protected sink fields before release. `provider_*_integration_test.go` adds MongoDB 8.0.15 task-owned replica-set evidence through actual registered Arc renderer/HTTP: two tenants and forbidden rows, matching serialized count/find coordinates/predicates/collation, server sorting/windowing, multi-batch getMore, refetch insert/update/delete/filter entry/exit/reorder/refill, codec round trip/decode retraction, synthetic raw release, integer/string and UUID representation collisions, isolated count/find/getMore failpoints, canceled-request killCursors, empty/bounded pages, denied no-I/O ingress, borrowed-client reuse and outer resource-close failure and HTTP encoding/paging retraction against pushed root `d4fec76`. Count overflow remains bounded fake evidence, not billions of live rows. Independent no-database and Linux Go 1.27 live CI lanes; see MongoDB guide. Still no real Chronicle sink/compliance or sharded/multi-member/failover claim; bounded watch evidence is recorded separately below
MongoDB watches	`MongoDB/MongoDBWatcher.cs`, `MongoCollectionExtensions.cs`, `MongoDBJoinedObserveBuilder.cs` (`7c1e780`, under `Source/DotNET`)	Optional `integrations/mongodb`: `Watcher`, `Observe[T]`, `Source[Find[T]]` and manual existing-renderer registration	Partial	`filter_guard_test.go` covers pre-encoding cycle/depth guards (including nil/self-referential recursive pointer types), bounded byte production and hook-free failure. `filter_zeroer_test.go` and `discovery_regression_test.go` reject application `bson.Zeroer` before encoding/discovery across pointer method sets, named containers, nested fields and concepts without invoking `IsZero`; required JSON/text concept codecs remain supported. `filter_raw_test.go` covers recursive raw document/array/code-with-scope validation, canonical array keys, failure-atomic malformed envelopes and a lossless valid BSON corpus with duplicate ordered document keys. `filter_inline_test.go` rejects exported BSON inline fields before nil pointers or empty typed containers can bypass static inspection, including nested inline types and the driver’s exact/legacy tag tokens. Ordinary recursive structs and BSON byte-preservation cases remain supported. All instruction paths use Go-specific 64-level/16-MiB graph, static-type and BSON bounds; filters with application encoding hooks, exported inline fields or opaque vectors fail diagnostically. `stream_context_test.go` verifies that streams retain only Open’s cancellation channel/copied deadline, not performer metadata/context methods, and release that state after continued/concurrent Next joins. Go-specific cancellation classification is fixed on first observation: at/after the copied deadline means DeadlineExceeded, otherwise Canceled. Earlier cancellation observed late and custom causes cannot be reconstructed; Next’s supplied context preserves its actual error. `find_snapshot_test.go`, `watcher_test.go`, `observe_test.go` and compiled observation example cover lossless BSON instruction detachment, bounded database-owned fanout, initial handoff ordering, tenant/client/query identity, admission/overflow, cancellation and continued joins, terminal resnapshot recovery, and fresh renderer scope views. `observation*_integration_test.go` adds MongoDB 8.0.15 task-owned ordinary Aggregate change-stream evidence through actual Arc Open/Run and the existing registered renderer: cursor-before-baseline and blocked-render/delivery barriers; every full candidate compared with authorized unary count/find/release/interception; insert/update/replace/delete/filter entry/exit/off-page/reorder/refill/totals; independent principals/tenants/models/collections and same versus distinct clients; fresh row filters and revoked membership/policy denial before render I/O; metadata projection/batch64/no UpdateLookup; local overflow, startup cancellation, continued cleanup joining and cleanup timeout; terminal CursorNotFound/injected history loss without resume aggregate; cleanup-joined same-owner fresh Open with first-full Delta baseline then unary-compared changes; drop/rename termination. Natural small-oplog expiry remains unverified, as do sharding/multi-member/failover and real Chronicle sink/compliance. The existing tagged Linux provider CI lane includes these contracts. Source-only non-wait snapshots remain pending; no C# current/replay, single/null, joins, resume tokens, transparent reset, browser recovery or generated opaque-provider proxies. Explicit reopen creates the new baseline; no root driver/API change. Module README records lifecycle and differences
Multiple application instances	`Queries/ObservableQueryDemultiplexer.cs`, `MongoDB/MongoDBWatcher.cs` (`7c1e780`, under `Source/DotNET`)	Independent Applications, each owning its client, `mongodb.Watcher`, pipeline and hub registry; no distributed registry or broker	Partial	`integrations/mongodb/two_instance_integration_test.go` in the tagged Linux MongoDB 8.0.15 lane runs two Arc applications behind a real loopback HTTP router. Each instance holds its own per-tenant-database cursors and delivers the same database change with per-principal and per-tenant row isolation. SSE hub controls for a connection on the other instance, or from a wrong subject, tenant or anonymous owner, return 404 without opening resources. Transport loss ends that instance’s streams while the survivor continues; recovery is an explicit new connection and subscription with a full baseline, and unsubscribe/resubscribe resets the delta baseline. Shutdown joins invocation resources exactly once, issues one killCursors per observed database and leaves the borrowed client usable. Owner affinity for SSE hub controls is a deployment requirement and all limits are per instance. Not multi-process, crash, real load-balancer, browser, WebSocket-hub, failover or sharding evidence; no transparent resume. See multiple instances (#27)
Proxy generation/OpenAPI	ProxyGenerator/OpenAPI	Route descriptors, generated Go adapters and generated-contract prerequisites	Partial	The generation ledger below records Go adapters, actual CLI model/command/snapshot/observable-query publication, locked TypeScript/Node execution, and untouched C# captures; bounded mounted observable reconstruction is recorded above. Opaque provider-source/proxy-only generation, OpenAPI publication, browser and broader hook conformance remain unsupported or unverified; the internal OpenAPI renderer checkpoint is recorded in the generation ledger
Chronicle integration	Arc Chronicle integration (`7c1e780`)	Optional `integrations/chronicle` module and `sdk` adapter	Partial	Returned events, command transactions, keyed models, aggregates, reactor command effects and append observation are covered in the Chronicle ledger below. No root Chronicle dependency; no protected decisions, watches or snapshots
Operation resources and admission	`Authorization/AuthorizationEvaluation.cs`, `OperationContextScope.cs` (`7c1e780`)	`execution.Scope`, `OpenScope`, `BorrowScope`, `RunWithResources`, `Resolver`, `CheckOwner`	Go-specific	`execution/scope_test.go`, `resources_test.go`, `panic_test.go`, `dependencies_test.go`: owned/borrowed disposal, close-once forwarding, joined admitted resolutions, expiring non-closing resolver views, principal/tenant presence; `execution/resource_join_test.go` preserves at-most-once Close and explicitly retryable ResourcesJoiner.Join, caches ordinary failures including context errors, retains non-context Join failures and typed/panic diagnostics across resumptions, and exposes ErrScopeJoinPending only for incomplete joins; `execution/scope_startup_join_test.go` and root `TestShutdownRetainsExplicitJoinAfterPartialResourceStartup` retain pending resource-opening cleanup through PendingScopeError.Scope; every pending owned Scope.Close result exposes the same capability, including successful unary opening (`TestRunWithResourcesRetainsPendingScopeAfterSuccessfulOpening`), with automatic reclaim by observable admission and explicit caller ownership elsewhere; optional DI ContextChecker/ScopeOwner checks. Arc owns structural Resources/OpenResources; Fundamentals deliberately has no lifecycle package. Unreleased `Run` and `services` are removed; migrate to RunWithResources and optional ResourcesFrom
Model declaration and field metadata	Model-bound command/read-model attributes and `Authorization/AuthorizationDeclarations.cs` (`7c1e780`)	`metadata.InspectModel`, `Model`, `ParseQueryTags`, descriptor additions	Go-specific	`metadata/model_test.go`, `internal/modelshape/fields_test.go`; optional blank-field declarations, explicit wire keys/identity, strict tag grammar, method selection and unchanged default routes. No runtime source-comment discovery or projections; build-time adapter generation is recorded below
Model/concept graph validation	`Validation/ModelGraphValidator.cs`, `ValidatorInvoker.cs`, `ConceptValidator.cs` (`7c1e780`)	`validation.Registry`, `Graph`, `ModelValidator`, `RegisterScoped`, `RegisterScopedConcept`, `ValidateTags`	Partial	`validation/graph_test.go`, `registry_test.go`, `tags_test.go`; exact runtime types, pointer identity, owning collection paths without indices, concept suppression and safe failures. Model Validate methods are a Go addition. Required tags are top-level only; maps are opaque, depth is capped at 64, rich rule IR remains ARC-GO-28; optional scoped manifests are checked without activation by `Graph.CheckDependencies`
Scoped policies and catalog compatibility	`Authorization/AuthorizationEvaluation.cs`, `AuthorizationConfigurationValidator.cs` (`7c1e780`)	`authorization.RegisterPolicy`, `Prepared.EvaluateScoped`, `Evaluator.CheckCatalog`	Partial	`authorization/scoped_test.go`; no factory during Build or before role denial, guest opt-in, explicit failure without a required scope, expiring views and copied declaration comparison. Policies remain borrowed; `ContractTests/TestBothPipelineBuildsCheckSharedDependencyManifests` verifies optional exact keys at pipeline Build. `authorization/dependencies_test.go` checks copied manifests and effective catalog subsets; `validation/dependencies_test.go` checks graph manifests. Hidden closure dependencies cannot be checked
Model-bound command registration	`Commands/ModelBound/ModelBoundCommandHandler.cs`	`commands.Register`, `Handle`, `Void`, `Invoke`	Go-specific	`commands/TestComposableRegistration`, executable Examples and `ContractTests/model_bound_test.go`; exact method sets and direct adapters replace reflective invocation. Type-only registration supports the dependency-free void signature; arbitrary signatures need a handwritten or generated typed adapter (see the generation ledger below)
Command ownership and metadata	`Commands/CommandHandlerProviders.cs`	Command registration and descriptors; `Registry.AddBuildCheck`, `BuildView.ContainsCommandType`	Go-specific	`commands/registration_test.go`, `build_checks_test.go`; exact pointer/value types, immutable snapshots, deterministic duplicate rejection and integration checks before freezing (including late registration and failed-build retries); pin public identities explicitly when renaming a type
Execute/Validate and stage suppression	`Commands/CommandPipeline.cs`	`Execute`, `Validate`, scoped variants	Implemented	`commands/pipeline_test.go`, `validate_test.go`, `ContractTests/model_bound_test.go`; Validate excludes preparation, handling, consumers and completion participants; validation success is advisory
Pipeline resources	`Commands/CommandPipeline.cs`, `Queries/QueryPipeline.cs`	`OpenResources`, `ScopeFactory`, scoped execution	Go-specific	`ContractTests/TestCommandQuerySharedScopeCompositionEquivalence`; manual, resource and guarded Fundamentals container paths emit identical envelopes. Borrowed queries never dispose command resources or enlist in command completion; expiring Go views replace service-provider overloads
Pipeline model/concept validation	`Validation/ModelGraphValidator.cs`, `ValidatorInvoker.cs`, `Queries/QueryValidator.cs`, `QueryArgumentsModels.cs`	Shared `validation.Graph`, model methods and typed validators	Partial	`commands/validate_test.go`, `queries/pipeline_test.go`, `ContractTests/TestSharedGraphAndModelConventionsBlockBothPipelines`; bounded graph/required-tag subset; model Validate is a Go convention, not CLR discovery or full DataAnnotations
Command stage-specific severity	`Commands/CommandValidationResults.cs`	Command policy boundaries	Implemented	`commands/validate_test.go`, `outcome_test.go`; input-stage findings use severity floors; warning-only rejection errors filtered out at input stages no longer accompany successful results (`TestFilteredWarningErrorsNeverAccompanySuccessfulResults`); returned Handle warnings remain blocking
Provide payload/control distinction	`Commands/CommandProvideInvoker.cs`, `CommandHandlerArgumentResolver.cs`	`WithProvide`, `WithPreparation`, `Prepare`	Go-specific	`commands/preparation_test.go`; exact typed payloads replace assignability/tuple searches; no fallback to DI for a missing payload
Protected decision-read root seam (#31)	`Chronicle/ReadModels/CommandDecisionReads.cs`, `DecisionDependencySafety.cs` (`7c1e78075b737df64f69fddfaae83374f75e3612`)	`WithProtectedDecisions`, `WithUnprotectedDecisions`, `AddDecisionProvider`, `DecisionSource`, `ReadDecision`, `VerifyDecision`, `DecisionEvidence`	Partial	`commands/decision_pipeline_test.go`, `decision_reads_test.go`, `decision_expiry_test.go`, `decision_failure_test.go` and `ExampleWithProtectedDecisions` cover callback-free profile admission, target-local shared acquisition, repeated enrollment, separate validation provenance and foreign/nil/expired/overwritten read refusal before Handle, including nil-interface evidence and overwritten cached rereads before enrollment and return. Go admits no model/custom validators or operations; only Provide payloads implementing DecisionEvidence and explicit verification are inspected. No root Chronicle dependency. Provider transaction conflicts, release/compliance and lost acknowledgements are provider responsibilities, covered for Chronicle by the protected decision-read row in the Chronicle ledger; this seam alone makes no persistence or authenticated server-proof guarantee
Raw versus response metadata	`Commands/CommandPipeline.cs`	Return type, `ResponseKind`, explicit response contracts	Go-specific	`commands/registration_test.go`, `outcome_test.go`; raw returns and client responses are distinct; dynamic consumers may leave response metadata unknown; typed Execute checks the actual response rather than rejecting unknown metadata; unrelated typed consumers preserve known response metadata (`TestTypedUnrelatedEventHandlerPreservesKnownOrderIDResponse`)
Additive consumers and outcomes	`Commands/CommandResponseValueHandlers.cs`	Response handlers, `Outcome`, `Respond`, `Effects`, `Values`	Partial	`commands/outcome_test.go`; bounded explicit graphs, additive consumers (exact concrete keys or implemented interface keys) and control-before-effect preflight instead of automatic tuple inspection; manual flat operations are recorded below
Flat command operations and recovery	`Arc.Core/Commands/CommandOperationExecution.cs`, `CommandOperationBoundary.cs`, `Arc.Core.Specs/Commands/for_CommandOperationExecution` (`7c1e78075b737df64f69fddfaae83374f75e3612`)	`Operation`, `Operations`, `RegisterOperation`, `WithOperations`, compatible scope registration, backend `Recovery`/`OperationOutcomes`	Partial	`commands/operations_test.go`, `operation_execution_test.go`, `operation_boundaries_test.go`, `operation_example_test.go` cover exact declarations, copied membership, whole dependency preflight, sequential entry/reverse recovery, all five existing dispositions, cancellation/panic, sticky nesting, resource lifetime and HTTP privacy. Operation reference records manual registration, unified typed dependency bundles, explicit erased Outcome participation, no arbitrary container discovery, generated operation adapters, receipts or durable workflows. The Chronicle integration supplies the operation-classified terminal; see the Chronicle operation commit row below (#30)
Nested execution and completion	`Commands/CommandPipeline.cs`	Bound executor and entered execution participants	Go-specific	`commands/execution_test.go`, `concurrency_test.go`; sticky per-frame execution failures, advisory nested Validate during Execute, expiring executors and reverse completion of entered participants (`TestNestedValidateFailureIsAdvisoryDuringExecute`). No automatic rollback or commit guarantee
Guarded integration state	`Chronicle/Commands/CommandTransaction.cs`, `CommandCausationScope.cs` (`7c1e780`, under `Source/DotNET`)	`NewStateKey`, root/frame state, `ParentCommandContext`	Go-specific	`commands/state_test.go`; only bound children share root state, frame membership is isolated, expired callbacks and security/correlation changes fail. Private typed keys replace ambient ownership; borrowed mutation capabilities must still check admission
Terminal completion ordering	`Chronicle/Commands/TransactionalCommandScope.cs`, `Arc.Core/Commands/CommandPipeline.cs` (`7c1e780`, under `Source/DotNET`)	`DeferredCommitParticipant`, `AddDeferredCommitParticipant`	Go-specific	`commands/completion_test.go`; begins first, completes after ordinary participants independent of registration order; failures/cancellation prevent commit, validation-only execution skips activation. One provider only; concrete persistence is supplied by the optional Chronicle module
Persistence observation	`Chronicle/Commands/TransactionalCommandScope.cs` (`7c1e780`, under `Source/DotNET`)	`CompletionReport`, `ReportCommit`, `CompletionError`, `Result.Completion`	Go-specific	`commands/completion_test.go`; committed/unknown evidence survives failure, early completion and disposal; every failed scalar/object response is removed; no HTTP fields or automatic retry. Provider-reported facts, not interception of immediate SDK appends
Return admission before nil flattening	`Chronicle/Commands/SingleEventCommandResponseValueHandler.cs` (`7c1e780`, under `Source/DotNET`)	`ReturnAdmission`, static exact types and dynamic checks	Go-specific	`commands/return_admission_test.go`; opt-in typed-nil rejection, static no-response metadata, all-leaf preflight, additive consumers, explicit Respond preserved. No inferred event registration or slice classification
Command read-model ownership and presence	`Arc.Core/Queries/ReadModelForCommandServiceCollectionExtensions.cs`, `Chronicle/ReadModels/ReadModelServiceCollectionExtensions.cs` (`7c1e780`, under `Source/DotNET`)	`RegisterReadModelProvider`, `ResolveReadModel`, `RequireReadModel`, `ReadModelOrNil`	Partial	`commands/read_models_test.go`, `ExampleRegisterReadModelProvider`; exact-type declared/fallback/override ownership, optional absence versus present zero, invalid keys and release errors. Duplicate owners fail instead of C# replacement ordering. Providers own coordinate-aware caching/release; the optional Chronicle module supplies typed materialization
Errors, redaction and cancellation	`Commands/CommandResult.cs`, `Queries/QueryResult.cs`, `ExceptionDetailRedactor.cs`	Result helpers and pipeline finalizers	Implemented	Command/query pipeline tests and `ContractTests/pipeline_failures_test.go`; original local errors remain inspectable, failed response/data/change sets are suppressed, production messages are redacted
Namespace queries and directed functions	`Queries/ModelBound/ReadModelExtensions.cs`, `ModelBoundQueryPerformer.cs`	`queries.Register`, `Function`, `Invoke`	Go-specific	Namespace/function Examples and `ContractTests/TestModelBoundPipelinesMatchExistingGoldens`; unnamed value-receiver namespace methods and explicit functions use direct composition; build-time discovery is recorded in the generation ledger below
Model/query metadata inheritance	`Queries/ModelBound/QueryPerformerProvider.cs`, `Queries/QueryEndpointMapper.cs`	Read-model registration and query options	Go-specific	`queries/registration_test.go`; method replacement, pinned identity, logical namespaces, exact types and deterministic conflicts; no package-path identity inference
GET/QUERY argument binding	`Queries/QueryStringQueryRequestReader.cs`, `BodyQueryRequestReader.cs`, `ModelBound/ModelBoundQueryPerformer.cs`	Typed argument models, request readers and custom bindings	Partial	`queries/binding_test.go`, `request_test.go` and three fuzz targets; explicit requiredness, bounded scalar grammar, transport omission and custom JSON-node bindings; direct empty nonstring input uses missing/default rules, and boolean text accepts only trimmed case-insensitive true/false. HTTP mapping/no-store is covered by `TestGETHEADQUERYReadersAndSnapshotNegotiation`
Paging, sorting and ordinary lists	`Queries/Paging.cs`, `QueryableQueryRenderer.cs`	Parameters, `Page`, `SliceRenderer`	Partial	`queries/request_test.go`, `renderer_test.go`; active paging validation with `Page`/`Size` findings, safe wire-field sort columns, count-before-page and no double paging. The paired snapshot checkpoint covers bounded GET/QUERY cases; plain lists remain unpaged with zero page/size metadata, unlike C# request-metadata echo in the two exact allowances above
Exact rendering and interception	`Queries/QueryRenderers.cs`, `ReadModelInterceptors.cs`	Typed renderers and read-model interceptors	Go-specific	`queries/renderer_test.go`, `interceptors_test.go`; exact renderer keys, ordered sequential items and explicit pointer/value interceptor types; register supported wire-field comparers instead of reflected property guessing
Authorized snapshot execution	`Queries/QueryPipeline.cs`, `QueryFilters.cs`	`Perform`, `PerformScoped`	Implemented	`queries/pipeline_test.go`, `concurrency_test.go`, cross-lane contracts; dependency construction delayed through validation; declaration recheck before invocation; no hosting or streaming claim
Safe failures and ready-null	`Queries/QueryResult.cs`, `QueryPipeline.cs`	Query finalizer and snapshot results	Implemented	`queries/TestNilProviderOutputSkipsRendererAndInterceptors`, `TestTypedPerformFailuresAreReadyCorrelatedAndFailed`, ready-null/panic/cancellation/cleanup tests and cross-lane contracts; successful null is ready, never pending; nil provider outputs skip rendering/interception; typed failures retain correlation and suppress data/change sets
Shared Chronicle read-model seam	`Queries/ModelBound/ReadModelAttribute.cs`	Ordinary tagged read-model structs	Go-specific	`integrations/chronicle/examples/sharedmodel/model_test.go` proves separate offline registration, concept wire names and namespace-query HTTP serving; `internal/integration/shared_model_test.go` appends events, materializes the same model and serves Arc direct/HTTP queries across namespaces. No embedded Arc base, shared registry or Arc projection ownership
Later integrations	Observable queries and Chronicle operations/recovery	Snapshot adapters and first-slice Chronicle integration	Partial	Generated command/query adapters and Chronicle support are recorded in their ledgers; observable transports and bounded source-only MongoDB watches are covered above; Chronicle watches, protected decisions and durable operation recovery remain unsupported
Command/query test scenarios	Arc `Source/DotNET/Testing` CommandScenario/QueryScenario (`7c1e780`)	`arctest` package	Go-specific	`arctest` tests and examples; explicit builder configuration instead of discovery; results returned rather than stored in LastResult; `NewObservableQuery` adds synchronous full-result capture with result/byte/time limits, real admission/interception/guards and explicit cancellation/cleanup join. Tests prove producer joining, pending timeout, typed preflight and cleanup failure preservation at the capture limit. HTTP/hub/browser behavior, Chronicle seeding and operation-recovery assertions remain separate or unsupported
Full product compatibility	All C# surfaces	None	Not implemented	Foundation tests do not certify whole-product or HTTP conformance

Generation ledger

C# sources below use Arc 7c1e78075b737df64f69fddfaae83374f75e3612, relative to Source/DotNET/Arc.Core/. The experimental generator provides Go adapters and bounded TypeScript model/command/snapshot/observable-query proxies. Frontend sources additionally use Source/DotNET/Tools/ProxyGenerator and Source/JavaScript at the same revision. OpenAPI and Screenplay publication, opaque provider-source generation, and proxy-only output remain unsupported; their internal checkpoints are recorded below.

Feature	C# source	Go surface	Status	Evidence and intentional boundary
Command discovery and stage adapters	`Commands/ModelBound/ModelBoundCommandHandler.cs`, `Commands/CommandProvideInvoker.cs`, `CommandHandlerArgumentResolver.cs`	`tools/cmd/arc-gen`, `RegisterArtifacts`, `ArcBindings`	Go-specific	`ContractTests/TestGeneratedAndManualAdaptersHaveEquivalentStaging`, `TestGeneratedPreparationControlsAndPointerCommands`, tools `TestBootstrapRegenerationAndExecutableConsumer`; opted-in source directives and typed adapters replace CLR discovery. Exact Provide payload and stage-specific dependencies; no service construction during generation or registration
Read-model query discovery and metadata	`Queries/ModelBound/QueryPerformerProvider.cs`, `ModelBoundQueryPerformer.cs`, `Authorization/AuthorizationDeclarations.cs`	Generated namespace-method/function adapters and public registration options	Go-specific	`ContractTests/TestGeneratedMetadataMatchesManualMetadata`, `TestGeneratedAndManualAdaptersHaveEquivalentStaging`; command/query identity, authorization replacement, argument binding and runtime validation preserved. Unnamed value receivers or explicitly directed functions replace static CLR methods; supported snapshot shapes and exact declared observable source emissions, with independent observable consumer evidence above
Dependency binding	`Commands/CommandHandlerArgumentResolver.cs`, `Queries/ModelBound/ModelBoundQueryPerformer.cs`	Generated exact dependency manifests, optional `ArcBindings`, `execution.Resolve`	Go-specific	`ContractTests/TestGeneratedDefaultBindingsRequireDependencyCatalog`, `TestGeneratedAndManualAdaptersHaveEquivalentStaging`; plain callbacks and Fundamentals container paths, denial/Validate-only suppression. Validator/policy constructor dependencies use the same exact keys and callbacks (see the directive row below); no standalone validator/policy-only package generation or Chronicle-specific parameter injection
Constructor service authoring	`HostBuilderExtensions.cs`, `Commands/CommandHandlerArgumentResolver.cs`, `Queries/ModelBound/ModelBoundQueryPerformer.cs` (`7c1e780`)	Opt-in `-bindings-config`, shared Fundamentals `bindingtypes` planner, separate `RegisterServices(di.Registrar)`	Partial	Tools `service_bindings_test.go`, `service_bindings_publication_test.go`, and compiled external `testdata/servicebindings` consumers cover exact keys/directives, lazy constructors, stage suppression, borrowed interface forwarding, failed-result disposal, strict duplicates and explicit Existing lifetime attestations. Production CLI consumers resolve immutable Arc `78ebbf8` and Fundamentals.Go `v0.2.0` without workspace/replace. Symbol/import-cycle/main/internal preflight leaves all outputs unchanged on analysis failure; existing writer and manifest ownership remain authoritative. Manual closures and `ArcBindings` remain supported. Foreign-owner tests model one-owner composition, not an actual Chronicle generator integration. No implicit import discovery or operation-adapter parity; validator/policy directives are recorded separately below. See constructor services (#13)
Validator and policy directives	`Validation/ValidatorInvoker.cs`, `Validation/ModelGraphValidator.cs`, `Authorization/ArcAuthorizationPolicyRuntime.cs` (`7c1e780`)	`//arc:validator`, `//arc:policy name=`, shared zero instances and lazy constructor factories in `RegisterArtifacts`	Go-specific	Tools `TestValidatorAndPolicyDirectivesMatchManualRegistrationInAnExternalConsumer` compiles and executes a workspace-free consumer against the tools runtime pin, comparing manual and generated validation/authorization outcomes with explicit callbacks and optional DI scopes. `TestValidatorModelsCanUseExportedAliasesInAnExternalConsumer` compares generated and manual validation for exported aliases of private model types, including generic aliases. `TestValidatorAndPolicyDirectiveDiagnostics` rejects lookalike types, wrong signatures and duplicate registrations with source positions, including aliased duplicates separated by another model. The compiled consumer’s `TestGeneratedScopedRegistrationsDeclareDependencyKeys` isolates missing validator and policy dependencies, checks their runtime error identities, and accepts both explicit callbacks. Typed model/concept validators, scoped dependency keys and anonymous-policy opt-in use the existing public registrars; directives replace CLR discovery, not FluentValidation rule translation. A validator/policy-only package is explicitly rejected; see validator and policy generation (#13)
Source diagnostics and regeneration	Model-bound discovery and configuration validation	`arc-gen -check`, source-position diagnostics, owned output	Go-specific	tools `TestDiagnostics`, `TestBuildTagsAndDeletedMethods`, `TestStaleOutputCleanupIsOwnedAndScoped`, `TestFailedPackageDoesNotPublishOtherOutputs`, `TestSymlinkOutputIsNeverFollowed`; selected packages/configuration only, no init execution, atomic per-file writes but no multi-file transaction. Unsupported signatures fail explicitly; tools tags remain deferred
TypeScript proxy golden comparison (#20)	ProxyGenerator and JavaScript at `7c1e78075b737df64f69fddfaae83374f75e3612`, pinned C# generator/client `22.48.2`; imported `ProxyComparison/Fixtures.cs` at Arc.TypeScript `2f546a89c35d49726b78ed2bf573fff8d77b056e`	Production arc-gen CLI, matched Go source, file-by-file named-fragment comparison	Implemented	`ContractTests/ProxyComparison/comparison.test.mjs` generates and checks all nine files of the pinned fixture (models, enum, command, snapshot and observable queries, barrel) against unchanged C# captures, strictly compiles live output against the locked client packages, and rejects changed fragments, extra fields/files and missing/stale allowances. Exact file/fragment/token allowances document syntax, metadata and the approved result-field sorting correction (Arc#2998); the barrel matches without allowance. Identity-less observable collections (no `ID`/`Id`, no serialized `id`) are admitted like the C# `ChangeSetComputor` JSON fallback and client JSON/position reconciliation; tools `TestIdentityLessObservableCollectionsPublishLikeCSharp`. Evidence is limited to this fixture; HTTP and rendered-hook behavior are in their own rows; see the comparison boundary
TypeScript models and command proxies	ProxyGenerator model/command templates and JavaScript Fields/Command (`7c1e780`)	CLI TypeScript profile, shared wire graph, portable generated validators	Partial	Tools fixture/renderer tests and strict locked Models/Commands fixtures cover rich constructors, concepts, numeric enums, declared derivatives, response cardinality, portable rules and exact wire names. Production CLI loopback tests execute actual generated adapters; no mounted React or browser claim
TypeScript snapshot-query proxies	ProxyGenerator query template and JavaScript QueryFor (`7c1e780`)	Model-owned single/list/array/Page proxies, endpoint expectations, result-field sorting helpers	Partial	Tools query/analyzer regressions and strict Queries/Publication fixtures cover GET/QUERY exposure, required arguments, original-Go defaults, signatures and rich hydration. Sorting is the approved result-field allowlist deviation; no provider paging/sorting or nullable collection elements; generated string query validation has its own row below; observable output has its separate bounded row below
TypeScript observable-query proxies	ProxyGenerator `Templates/ObservableQuery.hbs`, JavaScript ObservableQueryFor and Arc.React hooks (`7c1e780`)	Mixed-family CLI, observable sorting/hook planner and shared publication lane	Partial	Production CLI/independent consumers, strict locked Observables and generated frontend fixtures cover emission cardinality, hook tuples, inherited perform, required arguments, rich hydration, and conservative identity validation. Actual generated default WS hub/Delta executes sharing, exact changes/callbacks, argument replacement, cancellation, terminal denial and joined shutdown. The separate mounted lane executes generated `use`, `useChangeStream` and `useWithPaging` with actual rich reconstruction, argument/cache behavior and joins; see the mounted ledger for setter/paging limits. Wider manual transports are separate; no browser, all-provider-layout or full nullable-shape claim
Shared wire-contract analysis	ProxyGenerator/OpenAPI type mapping, query readers and result contracts (`7c1e780`)	Internal contract graph v2, explicit server/codec assertions and separate TypeScript admission	Partial	Tools `wire_contract_test.go`, `contract_edges_test.go`, `wire_regressions_test.go` and independently compiled `testdata/wire-contract` witnesses cover input/output presence, numeric widths, temporal string codecs, nil omission versus codec-produced null, typed validation state and encoded-null envelope omission. Resolved endpoints remain shared with adapters; unknown custom contracts require explicit assertions. Existing TypeScript consumers remain checked. The internal OpenAPI renderer checkpoint is recorded below; no CLI publication or hosting is implied and Generate still refuses OpenAPI requests
Mixed output ownership and recovery	ProxyGenerator publication boundary; Go-specific safety contract	Manifest, pending journal and zero-write `-check`	Go-specific	Actual CLI and publisher negative cases preserve user/recovery evidence on unsupported input, physical path collisions, intervening empty files and unmanifested identical output. Per-file atomicity/process recovery only; no durable cross-root transaction, automatic legacy adoption or concurrent-writer claim
Generated snapshot-query validation	`Queries/QueryValidator.cs`, `Queries/Filters/FluentValidationFilter.cs` and its `and_the_member_names_are_compared_with_the_client` specification; JavaScript `Arc/queries/QueryFor.ts`, `QueryValidator.ts` (`7c1e780`)	arc-gen registers `validation.NewPortable[A]` through `queries.WithValidator` and emits matching TypeScript validators	Partial	Tools `TestQueryValidationProductionConsumer`, `TestQueryValidationRefusesUnprovedContractsWithoutMutation`, `TestQueryValidationAliasesRuntimeNameAndReservesValidator`; `ContractTests/ProxyComparison/QueryValidation` executes Arc client 22.48.2. `notNull`, `notEmpty`, `minLength`, `maxLength` and `length` on snapshot query strings reject GET/QUERY before the business method and before `fetch`, with exact member names, messages, severities and UTF-16 boundaries; Warning and Info findings also block. Empty HTTP strings count as missing, matching the built-in reader. Unproved rules, observable validation, server defaults and optional nonnullable rule-bearing strings are refused without changing existing output. The pinned client lets descriptor instance fields override transported arguments after client validation, so client validation is not a security boundary; no browser or mounted-hook claim
Declaration diagnostics (ARC0001-0006, ARC0014, ARC0019)	`Arc.Core.CodeAnalysis/ReadModelAnalyzer.cs` (0001, 0014), `CommandAnalyzer.cs` (0002-0004), `CommandProvideAnalyzer.cs` (0005), `InjectedReadModelAnalyzer.cs` (0006), `AuthorizationAttributeAnalyzer.cs` (0019), under `Source/DotNET` at `7c1e780`	`arc-vet` declaration analyzer, directive identities and imported Go analysis facts	Go-specific	`tools/internal/artifacts/TestDeclarationDiagnostics` checks exact source positions/spans for every rule, positive/negative, build-tag, alias, generated and lookalike fixtures; `tools/cmd/arc-vet/TestArcVetCommandContracts` checks driver output, imported command/read-model aliases and admission errors alongside findings. Exact payload identity replaces C# assignability; implicit owning-model snapshot shapes diagnose missing/incorrect error results, while unrelated implicit helpers stay outside discovery. Go 1.27 generic methods have version-gated coverage. ARC0002 requires package-level artifact opt-in and exempts same-package typed manual registrations (including aliases/inference), response-value handlers and other selected artifact kinds; negative CLI fixtures cover the supported manual command path. `TestDeclarationDiagnosticsManualRegistrationLimits` and CLI fixtures cover cross-package and generic-wrapper registrations: these still warn unless the command type has `arc:ignore`, the documented suppression. Pointer read models still require an absence-aware resolver. No arbitrary registration callback, blank-field metadata or Chronicle projection inference. Rule meanings and pinned analyzer mapping (#34)
ARC0007 command record preference	`Arc.Core.CodeAnalysis/ModelBoundRecordAnalyzer.cs` (`7c1e780`)	Not applicable to Go	Go-specific	Commands use structs; Go has no class-versus-record declaration choice. See language differences
ARC0008 read-model record preference	`Arc.Core.CodeAnalysis/ModelBoundRecordAnalyzer.cs` (`7c1e780`)	Not applicable to Go	Go-specific	Read models use structs; no CLR record equality/immutability declaration
ARC0009 concept record preference	`Arc.Core.CodeAnalysis/ConceptRecordAnalyzer.cs` (`7c1e780`)	Not applicable to Go	Go-specific	Named Go concepts and codecs do not inherit `ConceptAs<T>` and have no class-versus-record choice
ARC0010 synchronous Task wrapping	`Arc.Core.CodeAnalysis/CommandHandleTaskWrappingAnalyzer.cs` (`7c1e780`)	Not applicable to Go	Go-specific	Handlers return synchronous values/errors; Go has no Task/async/await return wrapping
ARC0011 role nameof preference	`Arc.Core.CodeAnalysis/RolesLiteralAnalyzer.cs` (`7c1e780`)	Not applicable to Go	Go-specific	No nameof or attribute arguments; role directives use explicit strings rather than compiler-linked enum-member names
ARC0012 built-in exception preference	`Arc.Core.CodeAnalysis/ArcArtifactBuiltInExceptionAnalyzer.cs` (`7c1e780`)	Not applicable to Go	Go-specific	Returned Go errors are not a CLR built-in exception hierarchy; domain error design and panic safety remain caller responsibilities
ARC0013 FluentValidation concept dereference	`Arc.Core.CodeAnalysis/ValidatorConceptDereferenceAnalyzer.cs` (`7c1e780`)	Not applicable to Go	Go-specific	Go validation has no FluentValidation expression-tree selectors over nullable ConceptAs references; ordinary pointer safety is still required
ARC0020 unenforced ASP.NET attributes	`Arc.Core.CodeAnalysis/AuthorizationAttributeAnalyzer.cs` (`7c1e780`)	Not applicable to Go	Go-specific	No ASP.NET attribute family or host integration assembly exists in Go
ARC0021 ASP.NET authentication schemes	`Arc.Core.CodeAnalysis/AuthorizationAttributeAnalyzer.cs` (`7c1e780`)	Not applicable to Go	Go-specific	No ASP.NET AuthenticationSchemes attribute setting exists; unsupported generator directive options fail admission
Authoring diagnostics (ARC0015)	`Arc.Core.CodeAnalysis/QueryParameterConceptTypeAnalyzer.cs` (`7c1e780`, under `Source/DotNET`)	`tools/cmd/arc-vet`, sharing arc-gen declaration admission and the Fundamentals concept classifier	Partial	Tools `TestAuthoringDiagnostics`, `TestAuthoringDiagnosticsRespectBuildTags` and `cmd/arc-vet` `TestArcVetCommandContracts`: reports a direct conversion of an exported top-level primitive argument field to a concept inside admitted `arc:readmodel`/`arc:query` bodies, including aliases and build-tag selection, skipping generated files, with text exit status 3 and standard `-json` reports. A syntax check, not dataflow: no local copies, closures, pointers, nested or promoted fields, fixes or suppressions. Declaration diagnostics and non-applicable C# rules are recorded separately above; operation and decision analyzers remain outside this scope. See the arc-vet README (#34)
OpenAPI 3.1 document	`Source/DotNET/OpenApi` transformers, for example `OpenApi/ModelBound/CommandOperationTransformer.cs` (`7c1e780`)	`arc-gen -openapi-out` and profile `openapi.out`: a deterministic OpenAPI 3.1.1 `.json` file rendered from the finalized v2 wire graph, owned through the arc-gen manifest and verified by `-check`	Partial	tools `output_artifacts_test.go` covers CLI publication, `-check` drift and hand-edit refusal, stale-file removal, manifest ownership with and without TypeScript, identical bytes for reordered packages and whole-document refusal without writing; `openapi_document_test.go`, `openapi_codec_test.go`, `openapi_codec_refusal_test.go`, `openapi_query_test.go`, `openapi_query_boundary_test.go` and `openapi_query_arguments_test.go` cover exact graph projection, injective component names, exact integer bounds, query arguments as GET parameters and paging/sorting parameters, and QUERY carried in an `x-cratis-query` extension with a JSON body schema (`arguments`, `paging`, `sorting`) rather than aliased to GET or POST. Opt-in offline `//go:build ignore` proofs (`openapi_arguments_consumer_test.go` and siblings) load the document with kin-openapi v0.149.0 through an alternate manifest not admitted to the tools module and validate GET/HEAD requests while QUERY stays unrouted. C# evidence is the existing pinned HTTP response captures for the envelopes plus source-derived witnesses of `CommandOperationTransformer.cs` and `QueryOperationTransformer.cs` in `openapi_document_test.go`; the document is not a byte port of the C# OpenAPI 3.0 route catalog. Refuses observable queries and streams, authorization and identity customizations, validation rules, opaque/UUID/date/float codecs, derived models and model/map/presence/validated arguments. Deliberately not implemented: HTTP exposure (`MapOpenApi()`), an embedded explorer and security schemes; the document is a file only (#24)
Screenplay metadata export	`Source/DotNET/Screenplay/IScreenplayGenerator.cs`, `Emission/ApplicationSyntaxBuilder.cs`, `Emission/Queries/QuerySyntaxBuilder.cs`, `Emission/Types/ScreenplayPrimitiveTypes.cs` (`7c1e780`); Cratis.Screenplay 4.48.1 grammar (`e5b5698`)	`arc-gen -screenplay-out` and profile `screenplay.out` (formatVersion 2): a partial `.play` file from the shared Graph, owned through the arc-gen manifest and verified by `-check`	Partial	tools `output_artifacts_test.go` covers CLI publication, `-check` drift, stale-file removal, manifest ownership and identical bytes for reordered packages; `screenplay_test.go` and `screenplay_grouping_test.go` byte-compare `testdata/screenplay/metadata.play`, preserve input, group interleaved namespaces deterministically and refuse ambiguous or unrepresentable shapes without document bytes. `testdata/screenplay/contract.md` records compilation by the pinned Screenplay compiler fixture. Descriptive metadata only (commands, read models, snapshot and observable queries; String, Bool, Uuid, Int, Decimal and DateTime), with SPG diagnostics stating that events, projections, reactions, validation and authorization are not modeled. Deliberately not implemented: the embedded event-model viewer and any HTTP route; the export is a file only (#37)

Chronicle integration ledger

The C# source below is Source/DotNET/Chronicle at Arc 7c1e78075b737df64f69fddfaae83374f75e3612, unless an Arc.Core path is stated. Go evidence lives under integrations/chronicle; kernel tests use cratis/chronicle:19.29.4-development. The adapter pins Chronicle.Go 9e0c8d5ba5f1 and root Arc.Go 3e2a69270f46, without workspace replacements. This deliberate SDK baseline includes captured-client preparation and fail-closed profile corrections; it does not establish classified decision, watch, replay or general compliance support.

Feature	C# source	Go surface	Status	Evidence and remaining boundary
Optional integration and core independence	`ArcBuilderExtensions.cs`	`Integration.Install`, `sdk.New`, nested module	Go-specific	`scripts/check-boundaries.py`, root no-container gate; SDK imports confined to adapter/examples/tests, root manifests unchanged. Nested tags use `integrations/chronicle/vX.Y.Z`; publication deferred
Shared-provider captured client composition	`ArcBuilderExtensions.cs`, Chronicle registered-first generic-host resolution specs (`7c1e780`)	Public SDK Capture/PrepareClient, explicit `BindValue`, borrowed `sdk.New`, Arc `ScopeFactory`/`DependencyCatalog`	Go-specific	`sdk/composition_test.go`, executable `composition_example_test.go` and kernel `internal/integration/composition_test.go` verify exact shared client/collaborator identity, no setup transport or early factory activation, unprepared probes without poisoning preparation, callback/cleanup Close safety, joined preparation cleanup and borrowed-client survival through an actual transport probe. The kernel witness retains the configured resolver, excludes inherited origins, records confirmed immediate persistence despite handler failure, and joins command resources before provider disposal. Configure the resolver before Capture; prepare does not connect/register/attach/catch up. `OwnClient=false` and explicit client/provider shutdown remain application-owned; ordinary constructor/closure wiring stays supported. No operation-terminal compatibility or broader SDK safety claim
Semantic source selection and response override	`Commands/EventSourceExtensions.cs`, `CommandContextExtensions.cs`	`EventSourceID`, provider/value interfaces, `arc:"key"`, response selection	Implemented	`integration_test.go` covers named identity versus raw UUID fields, nil declaration, provider panic, wrapper targets and response retargeting. Explicit key tags replace CLR attributes; no Id-by-name convention
Returned events and ordered cross-source batches	`Commands/SingleEventCommandResponseValueHandler.cs`, `EventsForEventSourceIdCommandResponseValueHandler.cs`	Bare registered events, `Events`, `EventForSource`, `EventsWithScopes`	Go-specific	Unit ordering/preflight tests, SDK immutable snapshot test, kernel command tests; explicit collections rather than covariance, A1/B1/A2 order preserved. `sdk/adapter_test.go` verifies returned-event decoding preserves frozen SDK naming/codecs and propagates malformed-content failures. Rich Go wrappers can override route/subject/causation
Command-owned transaction and failed responses	`Commands/TransactionalCommandScope.cs`, `CommandTransaction.cs`	Terminal participant, private root state, SDK UnitOfWork/Owner	Implemented	`integration_test.go`, `sdk/transactions_test.go`, kernel `commands_test.go`; nested root ownership, atomic rejection, input validation, lost acknowledgement/no retry, scalar response retraction. No distributed transaction
Persistence disposition and immediate append observation	`Commands/TransactionalCommandScope.cs`	Completion reports, `sdk.ResolveAppendOrigin` and SDK `Sequence.OnAppend` subscription	Partial	Kernel `immediate_test.go` proves ignored rejection rolls back deferred work and confirmed immediate persistence survives later failure. Unit and kernel `shared_correlation_test.go` keep rejected/committed owner outcomes separate in both completion orders. `sdk/append_observation_test.go`, `origin_execution_test.go` and kernel `internal/integration/origin_test.go` cover exact nonzero typed-origin attribution, independent roots with the same correlation, nested inheritance, other coordinates, denied/validation masking and zero-origin refusal. Configure the SDK client with `chronicle.WithAppendOriginResolver(sdk.ResolveAppendOrigin)` before `sdk.New`; the adapter cannot retrofit an existing client. Correlation never determines ownership, and owner-unit commits use distinct SDK origins. Unsubscribe prevents new callbacks and joins admitted callbacks. Always check direct SDK results, including pre-dispatch errors, other sequences and low-level handles; this is not general interception of every external persistence path
Constraint/concurrency mapping	`Commands/ConstraintViolationExtensions.cs`, `ConcurrencyViolationExtensions.cs`	`CommitResult.Failure`, `CommitError`	Implemented	`validation_test.go` plus kernel unique/concurrency rejection/readback; mixed diagnostics retained, explicit JSON member names improve on C# casing-only fallback, BeforeFirst is described as no events
Per-target configured concurrency	`Commands/ConcurrencyScopeBuilder.cs`	`ConfigureCommand` flags and `ScopeResolver`	Implemented	`concurrency_test.go`; independent actual A/B targets and frame caching; `configuration_test.go` rejects unregistered and pointer/value-mismatched configuration at Build without activation, including Install before registration. SDK calls public `ResolveScope` from Chronicle.Go#43. Opaque resolved expectations are retained as provider tokens rather than guessed or reread
Keyed model injection and ownership	`ReadModels/ReadModelServiceCollectionExtensions.cs`, Arc.Core `Queries/ReadModelForCommandServiceCollectionExtensions.cs`	Typed `sdk.BindReadModel`, core Require/optional resolvers	Partial	`models_test.go`, kernel active/passive projection and namespace tests; typed SDK reads retain absence/progress, successful frame caching, failures never cached. Explicit bindings remain necessary because Go has no runtime generic registration; current generator needs handwritten injection adapters
Read-model release/compliance	`ReadModels/ReadModelServiceCollectionExtensions.cs`	Owning SDK Reader.Get and release contract	Partial	Unit unreleased-value refusal and kernel model reads; no duplicate release of kernel-owned reads. Full encrypted-value/compliance authoring is SDK capability-limited; model progress is not protected-decision evidence
Aggregate history, typed mutation and loaded checks	`Aggregates/AggregateRootFactory.cs`, `AggregateRootMutation.cs`, `AggregateRootEventHandlers.cs`	`DefineAggregate`, `OnAggregateEvent`, `AggregateRoot`	Partial	`aggregate_test.go`, kernel competing decisions with rejected-target absence; no-match versus position zero, fold ordering, callback expiry, ignored failures poison transaction. `TestIncompatibleAggregateRoutesOnSameSourceFailBeforeCommit` and kernel `TestIncompatibleAggregateRoutesOnSameSourceRejectWithoutPersistence` cover the source-label restriction: differing aggregate types/routes on one source fail closed. Chronicle C# 19.29.1 `Transactions/UnitOfWork.cs` rejects conflicting scopes in strict ordered mode but overwrites them in legacy aggregate mutation; Go never drops a loaded check. The pinned SDK binds labels to source IDs, so source+route labels require an upstream contract change. Buffered history and no snapshots; non-pointer event-struct callbacks replace reflective methods. `sdk/history_test.go` proves exact registered ID/generation decoding through frozen SDK naming/codecs, refusal of unknown/mismatched/malformed content and zero aggregate folds after any history decode failure; no alternate-generation substitution or automatic local migration
Early aggregate commitment	`Aggregates/AggregateRoot.cs`	Shared-owner `AggregateRoot.Commit`	Implemented	`aggregate_early_test.go`, `TestAggregateEarlyCommitCannotCreateSuccessor`, `TestEarlyAggregateCommitCannotIgnoreNestedLookupFailure`, kernel `TestGuardedEarlyAggregateCommitAgainstKernel`; root guard rejects ignored denied/validation/lookup and ancestor failures before persistence, successful nested work shares one owner, nested Validate remains advisory, no successor after commit, later failures retract responses but retain committed reports
Reactor command execution and returned effects	`Reactors/CommandSideEffectExecutor.cs`, `CommandResultHandler.cs`, `CommandsResultHandler.cs`	`ReactorCommands`, `sdk.CommandEffects`, `DeliveryFrom`	Implemented	Bridge unit tests and kernel `reactors_test.go`; real Arc commands before acknowledgement, stop-on-failure, earlier commits survive, failed observer partition, per-event metadata. SDK keeps per-batch reactor activation; each command owns a fresh Arc operation. Kernel `reactor_redelivery_test.go` keeps the delivery unacknowledged while commands run, commits earlier commands before a later one completes, records a failed partition at the original position after rejection, runs no later command before recovery, and joins reactor and command resources at shutdown (#14). No deduplication guarantee
Identity, tenant mapping and bounded causation	`Commands/CommandCausation.cs`, `CommandCausationValues.cs`, `Tenancy/TenantNamespaceResolver.cs`	Trusted actor mapper, exact namespace resolver, explicit Audit policy	Go-specific	Anonymous-actor tests, kernel tenant/reactor tests, asymmetric GUID SDK fixture. Unknown nested/PII properties are not reflected into audit data; explicit approved values only, bounded per-value/total metadata. Event actor metadata never grants roles
Frozen selected-store catalogs	`ArcBuilderExtensions.cs` and Chronicle client catalogs	SDK `Client.Catalogs`	Implemented	SDK adapter uses Chronicle.Go#42 without connection at construction; typed bindings still verify producer ownership
Chronicle operation commit and compensation	`Chronicle/Commands/TransactionalCommandScope.cs`, Arc `Commands/CommandOperationExecution.cs`, `CommandOperationBoundary.cs` (`7c1e780`, under `Source/DotNET`)	Installed integration’s sole `AddOperationCommitParticipant` terminal, read-only `ObserveCommit`, operation-frame `AggregateRoot.Commit` refusal	Partial	`operations_test.go` and executable `operation_example_test.go` cover observation recorded by the authorized filter and opened by the terminal Begin before Provide/Handle/operations, validation failure and validation-only without observation or Begin, every completion driving recovery, pre-entry Committed/Unknown/Mixed refusal, fail-closed `ErrUnsupported` without an `AppendObserver`, empty operation commands and explicit-commit refusal with unchanged ordinary commands. Kernel `internal/integration/operations_test.go` runs against `cratis/chronicle:19.29.4-development`: no persisted work, constraint-rejected NotCommitted, confirmed immediate Committed, Unknown through an injected lost append acknowledgement, handler-time confirmed/unknown immediate appends refusing operation entry with persisted readback, Mixed, committed deferred work, retained `*chronicle.EventStore` compensating writes after the terminal step, fresh-origin attempts, tenant isolation and refused explicit commits that persist nothing. `scripts/check-chronicle-snippet.py` gates the operation excerpt against its compiled example. Missing `sdk.ResolveAppendOrigin` on a client cannot be detected and is a documented precondition; direct application appends by filters/validators before terminal Begin are unattributed and outside observation (unit regression). A rejected handler append can still admit operations before rollback/compensation. No generated operation adapters, nested workflows, durable recovery or retries. See Chronicle guide (#30)
Protected decision reads (#31)	`ReadModels/CommandDecisionReads.cs`, `DecisionDependencySafety.cs`	`sdk.EnableDecisions`, `sdk.ReadDecision`, `sdk.Decision`, `Integration.EnrollDecision`, `DecisionParticipant`	Implemented	Kernel `internal/integration/decisions_test.go` against `cratis/chronicle:19.29.4-development`: an event-log fold sees a just-committed booking and refuses the stale decision; a competing append after enrollment rejects a two-source batch as `NotCommitted` with a concurrency violation and nothing of the batch persisted; a lost batch acknowledgement stays `OutcomeUnknown` with persisted readback and no retry; a validation-only filter read folds without beginning or enrolling and is never the identity execution reuses, while execution shares one read between filter and Provide; classified (`WithPII`) models fail with `DecisionReadRefused`/`protected-model`, unregistered models with both `ErrNotRegistered` and `ErrDecisionRead`, unmarked commands with `ErrDecisionProfile`, and unprotected commands receive an unenrolled advisory snapshot. `sdk/decisions_test.go` covers invalid arguments, unregistered models and frozen-routing failures preserving their cause plus `ErrDecisionRead` only in active protected invocations, without reaching Handle or acquisition; store mismatches retain both identities through root admission. Kernel `TestUnrelatedAppendDoesNotRejectTheDecisionBatchAgainstTheKernel` proves conflict guards cover dependency event types for the read key, not unrelated events on the same source. `decisions_test.go` covers one lazily begun transaction under serialized concurrent enrollment, refusal and unsupported participants poisoning ignored work into rollback, and validation-only refusal before Begin; `sdk/decision_reads_test.go` covers foreign evidence, typed Check, classified/unsupported refusal and participant state without RPC; `ExampleEnableDecisions` compiles the composition. Enrollment uses the command’s own SDK unit, never `transactions.FromContext`. Classified models are refused rather than released, so no admitted path releases twice. SDK tokens are opaque evidence, not authenticated server proof; the pinned protocol cannot atomically bind definitions or in-place history changes. The protected profile admits no validators (root seam row). See Chronicle decision reads
Watches, snapshots, automatic historical migration, durable operation recovery	Read-model watch and aggregate/operation surfaces	None	Not implemented	No protection or recovery promise from snapshot injection. Registered historical generations decode with their exact descriptors; unknown generations fail explicitly. No automatic migration, append or command retry

Chronicle.Go requests #42, #43, #44, and #45 are delivered in the pinned SDK. No fallback is retained for their missing APIs: catalogs, configured scope resolution, pre-ack command effects and append notifications are all used. Their issues remain open pending upstream release. The limitations above are integration or SDK contract boundaries, not silent substitutes for undelivered hooks.

Hosting and discovery ledger

All C# paths below use Arc 7c1e78075b737df64f69fddfaae83374f75e3612 and are relative to Source/DotNET/Arc.Core/. Hosting issue 17 tracks this slice. Evidence is Go-owned unless the bounded paired snapshot checkpoint is named explicitly; none establishes browser execution.

Feature	C# source	Go surface	Status	Evidence and caller implications
Root composition and explicit registration	`ArcApplication.cs`, `ArcApplicationBuilder.cs`	NewBuilder, Build, registrar seams	Go-specific	`TestBuilderCombinedFrozenComposition`, `ExampleNewBuilder`; explicit typed adapters, no redundant AddArc/UseArc calls, no runtime package scanning; `TestBuilderNamespaceHintIsNotAnExportedMethod` pins root/child namespace defaults without exporting CommandNamespace (unreleased implementation hint removed)
Build without activation	`ArcApplicationBuilder.cs`	Single-attempt Build	Implemented	`TestBuilderFailedAttemptIsTerminal`, `TestOpaqueSchemaRequiresOverrideWithoutActivation`; failure is terminal at root, use a new builder to retry
POST Execute/Validate	`Commands/CommandEndpointMapper.cs`	Application command routes	Implemented	`TestCommandsExecuteValidateAndTransportFailures`, `TestNineTaskBoardConformanceCases`; validate invokes no business handler and emits no response
Traditional action handlers	`Arc/Commands/CommandActionFilter.cs`, `Arc.Specs/Commands/for_CommandActionFilter/when_executing` (`7c1e780`, under `Source/DotNET`)	`NewActionHandler`, `ActionOptions[T]`, `ActionResult`, mounted with `Builder.Handle`	Go-specific	`action_handler_test.go`, `action_severity_test.go`, `ExampleNewActionHandler`: a case-insensitive `/validate` path binds and validates but never invokes the action or Raw; findings reject before the action; errors, panics, blocking and invalid-severity findings suppress Response and Raw with production redaction; zero and false responses are retained and nil omitted; Raw keeps its own status, headers and body; body, query and media limits; Warning policy with `X-Ignore-Warnings`; canceled requests never run the action. An explicit adapter replaces the MVC action filter: no command registry, Provide, catalog authorization, scope, transaction, response handlers or event consumers, so protect routes with middleware. Source-derived witnesses, not paired MVC execution. See traditional actions (#35)
Request-value merge into action bodies	`Arc/ModelBinding/FromRequestModelBinder.cs` (`BindModelAsync`, `DefaultValueChecker<T>`), `Arc.Specs/ModelBinding/for_FromRequestModelBinder/when_model_is_provided_partially_by_both_binders.cs` (`7c1e780`, under `Source/DotNET`)	Opt-in `ActionOptions.FromRequest`	Partial	`TestActionRequestPinnedDefaultMerge`, `TestActionHandlerExplicitRequestMergeAndContext`: default body members (missing, zero, false, null) take nondefault request values; body nondefaults, explicit empty strings and non-nil scalar pointers, including zero, win; request values are cloned. Go-specific: a caller-written FromRequest replaces ASP.NET binder discovery, wire names match exactly, null plain strings count as missing, and only flat built-in scalars and scalar pointers are admitted, not concepts, codecs, collections or embedded fields (#35)
GET/QUERY snapshots	`Queries/QueryEndpointMapper.cs`	Application snapshot routes	Implemented	`TestGETHEADQUERYReadersAndSnapshotNegotiation`, task-board nine cases; no SSE negotiation or synthetic wait
Paired snapshot HTTP	`Queries/QueryEndpointMapper.cs`, `QueryableQueryRenderer.cs`, `BodyQueryRequestReader.cs`, `QueryStringQueryRequestReader.cs` (`7c1e780`)	`ContractTests/httpconformance`, real Application GET/QUERY endpoints	Partial	`TestPairedSnapshotHTTP`: 36 requests / 14 groups, 34 strict matches plus two exact ordinary-list page/size allowances described above. `TestReferenceActivation`, comparator, provenance and joined-lifecycle regressions fail closed. No command, authentication, HEAD, provider, streaming or browser parity claim
Task-board HTTP conformance	Kotlin nine-case suite, Arc 22.14.0 / Arc.Kotlin `23c93a3`	`ContractTests/TestTaskBoardHTTPConformance` (in-process and child process)	Implemented	Nine cases covered; no live .NET comparison
HEAD, routing and canonical paths	`Http/EndpointRouteHelper.cs`, endpoint mappers	Explicit HEAD and private ServeMux	Go-specific	`TestExactRoutingMethodsAndCanonicalPaths`, `TestRealListenerHEADAndGracefulShutdown`, `FuzzCanonicalRouting`; empty 404/405, lexical Allow, no path redirects, literal trailing slash; `TestRawCatchAllCannotStealFrameworkRoutes`, `TestRawExactOwnershipConflictsStillFailBuild`, `TestReservedUnknownRoutesBypassRawAuthentication` pin SPA/subtree fallbacks with Arc-table priority and reserved-prefix 404; reference `Http/HttpListenerEndpointMapper.cs` MapFallbackToFile
Static files and SPA fallback	`StaticFileExtensions.cs`, `Http/StaticFileOptions.cs`, `Http/StaticFilesMiddleware.cs`, `Http/FallbackMiddleware.cs`, `Http/HttpListenerEndpointMapper.cs`; `Arc.Core.Specs/Http/for_StaticFilesMiddleware` and `for_FallbackMiddleware` under `Source/DotNET`	Public `Builder.Handle`, standard `fs.Sub` and `http.ServeContent`; example-local unexported `newStaticSite`, not an importable Arc API	Partial — embedded static-site composition	`ExampleBuilder_Handle_staticFiles` in compiled example and `TestStaticSite...` in HTTP tests cover a public, nonpersonalized site using immutable embedded assets or trusted read-only regular, seekable files with prompt filesystem operations. GET/HEAD serves `/assets/<file>`; `/`, `/app` and extensionless `/app/...` select only the fixed `index.html`. Tests cover actual bytes/media/length and empty HEAD, missing asset/index, redacted filesystem errors, rejected methods, traversal/ambiguous paths, directories, known API success/error/denial/405, unknown API exclusion, mapped/unmapped/disabled/mixed-case reserved paths, terminal authentication rejection, no implicit raw-handler authorization, site-only header isolation, file closure, concurrent requests and joined host/application shutdown. Later read/close failures cannot retract publication and never append a shell. Deliberate Go differences are HEAD support, narrow fallback eligibility, reserved-route protection and site-only `no-store`, versus C# GET-only configurable roots/default files and broad first-root fallback. C# authority above is source/spec inspection, not new execution. See hosting profile: `fs.Sub`/`os.DirFS` are not symlink sandboxes; no writable/symlink filesystem confinement, browser, paired C#, broad-host or gap-free parity claim. The broader issue 36 profile remains Partial, not complete
Credentials and anonymous exhaustion	`Http/AuthenticationMiddleware.cs`	Authentication ingress	Go-specific	`TestAnonymousAuthorizationDenialIs403AndCredentialFailureIs401`; terminal failed credentials 401, operation denial 403 even anonymous
Tenant selection/membership	`Tenancy/*TenantIdResolver.cs`	Options.Tenancy/TenantResolver, pipeline membership	Implemented	`TestCommandsExecuteValidateAndTransportFailures`, `TestMiddlewareCompositionAndRawHandlerCapabilities`; header selection and borrowed raw metadata, membership stays pipeline-owned; `TestIngressErrorsAreLoggedWithoutRequestSecrets` pins invalid selectors as 400 malformedRequest findings (including queries), with original errors logged locally
Correlation and immediate receipt	`Execution/CorrelationIdResolver.cs`, `OperationContextScope.cs`	Ingress, internal one-use receipt marker	Implemented	`TestTerminalCredentialsAndCorrelation`, `TestHTTPReceiptPrecedesAuthenticationAndNestedReceiptIsFresh`, `TestHTTPReceiptForwardingIsPrivateToEndpointPipeline`; header/envelope equality, endpoint receipt captured before authentication, nested and repeated raw-handler commands get distinct fresh receipts; middleware/readers/identity/discovery providers never receive the pipeline forwarding marker
HTTP severity allowance	`Commands/CommandEndpointMapper.cs`	AllowedFromHeader forwarding	Go-specific	`TestAllowedSeverityHeaderFiltering`, `validation/TestAllowedHeader`; Error capped at Warning, repeats ignored, floors preserved
Redaction and atomic publication	`ExceptionDetailRedactor.cs`, HTTP writers	Bounded encode-before-commit publication	Implemented	`TestAtomicPublicationFailuresPreserveStatusPrecedence`; failed data/state removed, denial/validation precedence retained, no command retry or rollback promise
Fresh identity and legacy cookies	`Identity/IdentityProvider.cs` ExpireLegacyCookie, `Http/HttpListenerRequestContext.cs` RemoveCookie, `Identity/IdentityEndpointMapper.cs`	Typed/scoped details registration, me	Implemented	`TestIdentityFreshUnwrappedAndLegacyCookieExpired`, `TestLegacyCookieExpiryPreservesRemovalAttributesWithSecureDefault`, `TestLegacyCookieSecureExceptPlainHTTPLocalDevelopment`, `TestScopedIdentitySuppressesActivationAndCleanupSuppressesSuccess`; no cookie authentication, 401/403 stay empty, cleanup suppresses success; empty-value deletion at `/`, past expiry and no HttpOnly/SameSite/Max-Age. Go-specific security hardening: Secure by default (including remote HTTP behind HTTPS ingress); only plain-HTTP requests with a `localhost` or loopback `Host` and no direct or forwarded HTTPS signal omit Secure for development. `Forwarded`/`X-Forwarded-Proto` HTTPS only tightens the policy, including localhost backend Hosts; forwarded headers cannot relax it or establish identity. No new proxy-trust contract (#66)
Logging and SSE allocation hardening	`Queries/ClientObservableSSE.cs` diagnostics/framing (`7c1e780`); Go host logging boundary	`internal/logging.Sanitize`, builder and standalone command/query pipeline logger boundaries, `internal/streaming.SSEWriter`	Go-specific	`TestRequestCompletionSanitizesBeforeHostLogHandler`, `TestSnapshotFailureSanitizesBeforeHostLogHandler`, `queries/TestObservableFailureSanitizesBeforeHostLogHandler`, `commands/TestCallbackFailureSanitizesBeforeHostLogHandler`, `internal/logging/TestHandlerSanitizesGroupsAndPreservesErrorChains` remove CR/LF and other controls from strings, errors and Stringers, including grouped and derived attributes, before host handlers. `internal/logging/TestHandlerPreservesStringerJSONValues` preserves UUID correlation strings in JSON logs and sanitizes Stringer text before serialization. Printable text, error classification and `errors.Is`/`errors.As` traversal remain available; host level policy, record metadata and error returns are preserved. `internal/streaming/TestSSEFrameSizeValidatesBeforeAddingOverhead` checks the platform allocation ceiling before adding eight framing bytes; existing configured response/queue limits and frame bytes are unchanged. No caller migration beyond control-free diagnostic values and the Secure cookie policy above (#66)
Discovery exposure	`Introspection/DiscoveryExposure.cs`	IntrospectionOptions	Implemented	`TestDiscoveryExposureMatrix`, `TestDisabledCatalogsDoNotDisableIdentityDiscovery`; production unavailable without explicit capability, enabled controls only catalogs
Catalog DTOs/summaries/schemas	`Introspection/*IntrospectionMetadata.cs`	Compiled catalogs, RegisterSchema	Partial	`TestCatalogsSchemasAndRoles`, `TestOpaqueSchemaRequiresOverrideWithoutActivation`; schema bounds and opaque-codec overrides replace complete .NET exporter; recursion/rich rules/polymorphism remain unsupported
Development users/tenants	`Identity/IdentityEndpointMapper.cs`	AddUsersProvider/AddTenantsProvider	Implemented	`TestDiscoveryFixturesAreUnwrapped`, `TestDiscoveryProvidersAreLazyOrderedAndNotDeduplicated`; ordered lazy aggregation, empty arrays and no deduplication
Explicit forwarded identity	`Identity/MicrosoftIdentityPlatformAuthenticationHandler.cs`, `Identity/UntrustedForwardedIdentityHeaders.cs`	MicrosoftIdentityPlatform, optional slog Logger	Partial	`TestForwardedIdentityExplicitTrustAndReservedClaims`, `authentication/TestUntrustedForwardedIdentityWarnsOncePerProcess`; unsigned-header trust opt-in, repeated/oversized input rejection, trust-off headers ignored with one value-free Warn per process across adapter instances; nil logger disables diagnostics; no JWT/OIDC verification
Owned/embedded graceful lifecycle	`ArcApplication.cs`, `ArcApplicationExtensions.cs`	Start, Serve, Run, Shutdown, app pipelines	Go-specific	`TestStartRollbackIncludesFailingHook`, `TestShutdownCancelsThenJoinsDirectOperations`, real listener; explicit ownership, cooperative deadlines, no restart or detached disposal
Backend operation diagnostics	`Observability/PipelineMetrics.cs`, `Observability/OperationOutcomes.cs` (`7c1e780`)	Optional `Options.Diagnostics`, command/query `PipelineOptions.Diagnostics`, `observability.Recorder`	Partial	`observability/recorder_test.go`, `commands/diagnostics_test.go`, `queries/diagnostics_test.go`, root `diagnostics_test.go` and `observability/ExampleRecorder`: bounded recorder-wide registered labels (default/max 1000, unknown/overflow `_other`), command execute/validate and snapshot-query outcomes, typed/scoped preflight, admission, nested attempts, unchanged receipts/results and explicit synchronous export outside producer locks. Cumulative counts/seconds replace C# meter histograms; a bounded recent-event ring may drop events without losing metrics. No payload/error values enter observations. `diagnostics_http_test.go` adds matched HTTP pre-dispatch failures and independent nested authentication calls; command/query nil-context regressions preserve one logical rejection and unchanged results. `queries/diagnostics_observation_test.go`, `diagnostics_retained_test.go` and internal forwarding specs distinguish opening, consumption, acknowledged data and actual joined cleanup. EOF remains success after Close; suppression, denial, obsolete/canceled/failed delivery do not increment served data; timed-out/panicking/pending cleanup remains retained until native ownership releases. Delivered metrics do not fill the event ring. No exporter runs during execution; no tracing provider, histogram buckets or complete observability parity claim. See backend diagnostics (#33)
Protected aggregate query health	`Queries/QueryHealth.cs`, `QueryHealthTracker.cs` (`7c1e78075b737df64f69fddfaae83374f75e3612`)	`Options.QueryHealth`, `QueryHealthName`, `/.cratis/queries/health`, optional native `queries.HealthReporter`	Partial	`query_health_test.go` and `ExampleQueryHealth`: absent by default including Development and raw fallbacks; copied nonempty administrative roles guard HTTP, backend Perform/PerformScoped/Open and hub subscriptions before state/source access. A private ordinary observable pipeline excludes application resource/factory/filter/validator state and rechecks each emission. Current plus one-second cancellation-aware consumer sampling starts no publisher worker. Synchronized aggregate query-label and protocol/state counts omit IDs, principals, clients, arguments, cached data and exceptions; native observation counts exclude health itself and overlap hub operations, so totals are neither additive nor globally atomic. Deliberately protected, opt-in and aggregate-only rather than C# anonymous detailed topology; no ping/pong/client details, automatic exporter or complete #33 parity claim. See protected query health (#33)
Middleware and diagnostics	`Http/HttpListenerEndpointMapper.cs` HandleRequest, HTTP host middleware	Use, slog Logger, owned server ErrorLog	Go-specific	`TestMiddlewareCompositionAndRawHandlerCapabilities`, constructor-failure tests; first outermost, metadata before middleware, optional writer capabilities preserved; `TestIngressErrorsAreLoggedWithoutRequestSecrets` pins error-only logging at Warn for client selector faults and Error for server faults, with credential reasons/headers excluded
Admitted request panic recovery	`Http/HttpListenerEndpointMapper.cs` HandleRequest, `ExceptionDetailRedactor.cs`	Ingress recovery and owned server logging	Go-specific	`TestIngressRecoversMiddlewareAndRawPanics`, `TestIngressDoesNotRewriteCommittedResponsesAndPropagatesAbort`, `TestOwnedServerUsesConfiguredSlogErrorLogger`, `TestSwitchingProtocolsCommitsTheObservedResponse`; before commitment, command/query redacted 500 or empty 500 for endpoints without envelopes; after commitment/hijacking, log only; http.ErrAbortHandler retains net/http abort semantics; nil logger stays silent
Third-party host and middleware recipes	Hosting, command/query and validation contracts listed above (`7c1e780`); adapters are Go-specific	Single unpublished `recipes/` module; recipe guides	Go-specific	Chi/Gin/Echo and browser-origin mount tests preserve command/query envelopes, direct streaming, disconnect cleanup and coordinated HTTP/Arc shutdown with active SSE. Browser-origin regressions check trusted/attacker direct and hub WebSocket handshakes, hub SSE, warning preflight and correlation exposure. JWT tests verify credentials and access-token restrictions; OpenTelemetry tests bridge trace context and logs; playground validation tests cover portable-rule coexistence, wire names, anonymous embedding and memberless errors. Pinned dependencies remain outside runtime graphs; no browser execution, paired C# adapter run or arbitrary middleware/version claim (#23)
Default observable client, OpenAPI, browser parity	Observable handlers, OpenAPI, JavaScript clients (`7c1e780`)	Raw transport contracts and locked Node client lane	Partial	Default @cratis/arc WS/delta and explicit SSE/direct modes execute through `ContractTests/observables/frontend`; see the observable ledger for limits. The separate mounted observable hook lane has bounded explicit WS/Delta evidence. OpenAPI publication, browser and broader React parity remain unimplemented or unverified. Neither Node polyfills, independent class-test reduction nor mounted Node hooks prove browser behavior

Discovery deliberately applies no-store, private and merged Vary: Cookie to catalogs/schema as well as identity/development listings; current C# does not uniformly apply those headers. Raw handlers cannot steal reserved routes. Schema bounds fail explicitly, never publish empty placeholders for unsupported shapes. Framework recipes add no runtime dependencies; their installed-version adapter matrix remains application-owned. CI’s other OS/Go lanes and CodeQL are remote-only.

Intentional differences and migration

Plain constructors and closures remain first-class. Arc runtime packages import no Fundamentals container; the DI contracts may appear transitively through execution. examples/nocontainer imports no DI package and exercises the foundation flows; scripts/check-no-container.py enforces the dependency boundary.
Dependency keys are exact, with no assignability search or root resolve. Fundamentals owns the optional container and graph validation. Use borrowed interface forwarding for one owned concrete instance; Arc forwards operation cleanup at most once even for a non-idempotent adapter. The unreleased services and execution.Run APIs are removed rather than wrapped. Use RunWithResources, ResourcesFrom and guarded execution.Resolve, or plain ResourcesAs.
Supply explicit stable namespaces/type names instead of CLR discovery. Moving Go source does not change routes or subscription names. Full descriptors will grow with pipeline/generator work; v1 does not pretend to describe unsupported schema.
Resolve rejects duplicate identities and case-insensitive method/path collisions rather than silently skipping a performer. Give each conflicting artifact an explicit path. Wildcards, relative/escaped paths, whitespace, repeated explicit slashes and dot segments fail instead of adopting host-dependent behavior. Derived paths are also checked: root and trailing-slash command paths are rejected because C#‘s literal /validate concatenation yields repeated slashes. Use /create, not /create/; configure a non-root conventional command route.
A zero result fails closed (unauthorized); use success constructors or explicitly set Authorized and query Ready. C# default construction is authorized/ready.
A failed command never carries a response, even for a non-nullable scalar. This avoids C# ClearResponse retaining default(T) under null-only omission.
Binding is case-sensitive like C# Arc’s default body serializer; use the exact wire name. Only exact repeats of declared names are rejected rather than using C#‘s last-value-wins behavior. Case variants are unknown fields and do not fail.
Present-null Optional model properties are written as null to preserve presence through a round trip. C# WhenWritingNull omits ordinary null properties instead. Consumers must handle explicit null; use missing Optionals when omission is wanted.
Claim tenancy ignores unauthenticated principals and returns NotSet even if they carry tenant claims. C# ClaimTenantIdResolver.cs at 7c1e780 reads claims without checking authentication; Arc.Go requires an authenticated adapter before treating a claim as a selector. Membership remains a separate check.
Plain Go strings reject null, unlike C# reference-type strings under Arc’s default options (nullable-annotation enforcement is not enabled). Use *string or Optional[string] to accept null without confusing it with an empty string.
time.Time retains Go’s RFC3339Nano JSON codec: UTC Z, explicit offsets and up to nine fractional digits. C# DateTimeOffset uses +00:00 at UTC and tick precision (at most seven digits); C# DateTime also has kind-dependent suffixes. Normalize to common precision/forms or provide a codec for exact DateTimeOffset spelling; this slice does not implement the full C# timestamp input grammar.
Arc.Go’s UUID and calendar/duration scalars alias Fundamentals.Go’s shared types; existing imports, constructors, parsers and wire formats are unchanged. Concept[T] is the shared interface declaration, recognized through cached Underlying metadata without executing application methods. Supply all four text/JSON codecs; marker-only and nested concepts fail preflight with inspectable Fundamentals errors. Unlike C# inheritance and converter-created instances, Go uses explicit methods and constructors. HTTP text binding and bounded discovery schemas are implemented; generated schema and proxy metadata remain later work.
Use invariant calendar text and dashed UUIDs. Go deliberately does not guess a server culture. Input forms outside those documented codecs must be normalized by the caller or a custom codec.
Paging totals outside the int32 page-count range return MinInt32; avoid such metadata. C# uses an unchecked conversion whose overflow behavior is not certified by these fixtures. In-range calculations follow its double-precision ceiling.
Arc’s naming policy preserves leading acronyms (ID, URLValue). Add json:"id" explicitly where the wire name should be lowercase. Plain encoding/json does not implement Arc’s model policy; use serialization.Marshal/Unmarshal.
Foundation serialization is a bounded explicit-registration fallback, not the future generated descriptor codec. Exported embedded fields use standard Go promotion; nil unexported embedded pointers cannot be allocated during binding. Go omission tags honor IsZero and standard empty-kind rules. JSON/text codecs own their behavior; pointer-receiver marshalers require addressable values. Nil model slices/maps/pointers are omitted like C# null properties; initialize slices/maps when an empty collection must be present. Framework envelope arrays are separately normalized to []. Arbitrary Unicode escaping/property order is not a byte-identity promise; literal scalar fixtures and canonical envelope bytes are the tested boundary.

Next slices

ARC-GO-04 provides immutable execution metadata and explicit service scopes; 05 provides typed validation and container-neutral security foundations; 06/07 provide backend command/query execution through manual typed adapters; 08 adds hosting. Scoped policies and validators can resolve through guarded optional DI resources. Generated adapters and source diagnostics remain unfinished: issues 10 and 13 are partially delivered, and 12 is not complete until required generated examples pass. Historical paired HTTP and real browser consumers belong after those boundaries exist. Chronicle integration must use Chronicle.Go’s transaction participant/owner contract, not a second Arc UoW.