@cratis/pi 7.118.0 → 7.119.1

package/package/corpus/agents/screenplay-modeler.md

@@ -35,6 +35,7 @@ After reading these instructions, read each file listed under `process.agents.sc
 
 - Reuse existing model/workspace roots. Code-only `Source/` or `src/` is not a model root; absent model/workspace state, use repository-root `Screenplay/`, never `.cratis/`. Read model-authoring's MCP root-selection/version guidance before switching roots.
 - Load `cratis-screenplay-modeling-lifecycle`, then exactly one phase skill per step: discovery, slice design, streams and consistency, automations and translations, scenario coverage. A legacy system enters through `cratis-screenplay-legacy-extraction` instead of discovery and modeling; later runs re-enter by recorded source identity, widen the candidate in layered passes, and promote locators, decisions and open questions into notes and `documentation` before acceptance (`references/re-entry-and-passes.md` there). Syntax, versions and verdict commands: `cratis-screenplay-toolchain`. Load the phase skill before authoring a construct family.
+- A new model starts its application root with `command reads protected`; leave the preamble out only when the model's reads are not admissible (PLAY0781/PLAY0786, `cratis-screenplay-command-surface` `references/protected-reads.md`).
 - For a change to an existing model, start from an impact walkthrough (`cratis-screenplay-model-review` `references/walkthrough.md`) so the brief names every affected slice.
 - Write declarations in story order, one slice after another, never batched by kind. After each batch read `PLAY0516` and `PLAY0517` and repair, or record why the order stays (`cratis-screenplay-slice-design` `references/slicing.md`).
 - Slices under delivery: where a delivery plan exists (`cratis-screenplay-delivery-planning`), a slice that is `in progress`, `blocked` or `done` is read-only unless the request names it; naming it approves exactly those declarations. Do the rest of the request, return an edit request naming the slice, its status and the intended change, and open the report with that part as NOT done. Changing a `done` slice reopens its delivery: tell the plan owner (`cratis-screenplay-modeling-lifecycle` `references/phases.md`).

package/package/corpus/harnesses/copilot/instructions/profiles.instructions.md

@@ -99,7 +99,7 @@ profile includes neither Screenplay nor Stage.
 | `cratis/engineering/go` | Go framework parity and immutable module releases | `cratis/engineering/core`, `cratis/language/go` |
 | `cratis/engineering/typescript` | TypeScript engineering conventions | `cratis/engineering/core` |
 | `cratis/engineering/react` | React engineering conventions | `cratis/engineering/core` |
-| `cratis/orchestration` | Multi-session lane coordination: `cratis-orchestration-lanes` | `cratis/engineering/core` |
+| `cratis/orchestration` | Multi-session lane coordination: `cratis-orchestration-lanes`, `cratis-orchestration-merge-gates` | `cratis/engineering/core` |
 
 The `cratis/orchestration` profile is opt-in: select it explicitly for work with two or more autonomous lanes; `cratis/engineering` and `cratis` do not include it.
 

package/package/corpus/harnesses/pi/agents/screenplay-modeler.md

@@ -30,6 +30,7 @@ After reading these instructions, read each file listed under `process.agents.sc
 
 - Reuse existing model/workspace roots. Code-only `Source/` or `src/` is not a model root; absent model/workspace state, use repository-root `Screenplay/`, never `.cratis/`. Read model-authoring's MCP root-selection/version guidance before switching roots.
 - Load `cratis-screenplay-modeling-lifecycle`, then exactly one phase skill per step: discovery, slice design, streams and consistency, automations and translations, scenario coverage. A legacy system enters through `cratis-screenplay-legacy-extraction` instead of discovery and modeling; later runs re-enter by recorded source identity, widen the candidate in layered passes, and promote locators, decisions and open questions into notes and `documentation` before acceptance (`references/re-entry-and-passes.md` there). Syntax, versions and verdict commands: `cratis-screenplay-toolchain`. Load the phase skill before authoring a construct family.
+- A new model starts its application root with `command reads protected`; leave the preamble out only when the model's reads are not admissible (PLAY0781/PLAY0786, `cratis-screenplay-command-surface` `references/protected-reads.md`).
 - For a change to an existing model, start from an impact walkthrough (`cratis-screenplay-model-review` `references/walkthrough.md`) so the brief names every affected slice.
 - Write declarations in story order, one slice after another, never batched by kind. After each batch read `PLAY0516` and `PLAY0517` and repair, or record why the order stays (`cratis-screenplay-slice-design` `references/slicing.md`).
 - Slices under delivery: where a delivery plan exists (`cratis-screenplay-delivery-planning`), a slice that is `in progress`, `blocked` or `done` is read-only unless the request names it; naming it approves exactly those declarations. Do the rest of the request, return an edit request naming the slice, its status and the intended change, and open the report with that part as NOT done. Changing a `done` slice reopens its delivery: tell the plan owner (`cratis-screenplay-modeling-lifecycle` `references/phases.md`).

package/package/corpus/hooks/scripts/cratis-cleanup-worktrees.sh

@@ -98,16 +98,16 @@ if [ "$SELFTEST" = 1 ]; then
     chk "fresh worktree kept"          '[ -d "$t/wt-fresh" ]'
     chk "fresh branch kept"            'git rev-parse -q --verify refs/heads/fresh >/dev/null'
     chk "main kept"                    'git rev-parse -q --verify refs/heads/main >/dev/null'
-    chk "report names the removal"     'printf "%s" "$out" | grep -q "removed worktree"'
+    chk "report names the removal"     'grep -q "removed worktree" <<<"$out"'
     chk "work records kept"            '[ -f "$t/wt-records/.ai-work/.handoff" ]'
     chk "work records branch kept"     'git rev-parse -q --verify refs/heads/records >/dev/null'
-    chk "work records reason reported" 'printf "%s" "$out" | grep -Fq "has untracked work records (.ai-work/)"'
+    chk "work records reason reported" 'grep -Fq "has untracked work records (.ai-work/)" <<<"$out"'
     chk "empty work records removed"   '[ ! -d "$t/wt-empty-records" ]'
     chk "locked worktree kept"         '[ -d "$t/wt-locked" ]'
     chk "locked branch kept"           'git rev-parse -q --verify refs/heads/locked >/dev/null'
-    chk "locked reason reported"       'printf "%s" "$out" | grep -Fq "worktree $t/wt-locked (locked): locked"'
+    chk "locked reason reported"       'grep -Fq "worktree $t/wt-locked (locked): locked" <<<"$out"'
     chk "locked detached kept"         '[ -d "$t/wt-locked-detached" ]'
-    chk "locked detached reported"     'printf "%s" "$out" | grep -Fq "worktree $t/wt-locked-detached (detached): locked"'
+    chk "locked detached reported"     'grep -Fq "worktree $t/wt-locked-detached (detached): locked" <<<"$out"'
     out=$(printf '%s' '{"hook_event_name":"SessionStart"}' | "$self" --no-fetch --include-work-records --hook 2>&1) || { echo "FAIL: hook exit $?"; echo "$out"; exit 1; }
     chk "hook ignores opt-in"          '[ -f "$t/wt-records/.ai-work/.handoff" ]'
     out=$("$self" --no-fetch --include-work-records 2>&1) || { echo "FAIL: opt-in exit $?"; echo "$out"; exit 1; }

package/package/corpus/hooks/scripts/cratis-slice-scope-report.sh

@@ -32,7 +32,8 @@ while IFS= read -r slice; do
     done <<EOF
 $changed
 EOF
-    if printf '%s\n' "$changed" | LC_ALL=C grep -Fxq "$anchor"; then
+    # A here-string, never `printf … | grep -q`: under `pipefail` the early-exiting `grep -q` can SIGPIPE `printf`.
+    if LC_ALL=C grep -Fxq "$anchor" <<<"$changed"; then
         spec_paths="$(printf '%s\n' "$paths" | CRATIS_SLICE="$slice/" awk '
             index($0, ENVIRON["CRATIS_SLICE"]) == 1 && /\/when_[^\/]+(\/|\.cs$)/ { print }
         ')"

package/package/corpus/hooks/scripts/validate-type-references.sh

@@ -270,9 +270,9 @@ AWK
 
 if [[ "$self_test" == 1 ]]; then
     flags="$(grep '^FLAG' "$tmp/out.txt" 2>/dev/null || true)"
-    printf '%s\n' "$flags" | grep -q $'\tReactorSideEffect\t' \
+    grep -q $'\tReactorSideEffect\t' <<<"$flags" \
         || { printf 'ai-corpus type-references self-test: FAILED - the seeded ReactorSideEffect fabrication was not flagged\n' >&2; exit 1; }
-    if printf '%s\n' "$flags" | grep -qE $'\t(EventForEventSourceId|IReactor|ReactorSideEffectFailure)\t'; then
+    if grep -qE $'\t(EventForEventSourceId|IReactor|ReactorSideEffectFailure)\t' <<<"$flags"; then
         printf 'ai-corpus type-references self-test: FAILED - a real Cratis type was flagged as unresolved\n' >&2; exit 1
     fi
     printf 'ai-corpus type-references self-test: passed - the seeded fabrication is named and the real types stay silent\n' >&2

package/package/corpus/rules/profiles.md

@@ -98,7 +98,7 @@ profile includes neither Screenplay nor Stage.
 | `cratis/engineering/go` | Go framework parity and immutable module releases | `cratis/engineering/core`, `cratis/language/go` |
 | `cratis/engineering/typescript` | TypeScript engineering conventions | `cratis/engineering/core` |
 | `cratis/engineering/react` | React engineering conventions | `cratis/engineering/core` |
-| `cratis/orchestration` | Multi-session lane coordination: `cratis-orchestration-lanes` | `cratis/engineering/core` |
+| `cratis/orchestration` | Multi-session lane coordination: `cratis-orchestration-lanes`, `cratis-orchestration-merge-gates` | `cratis/engineering/core` |
 
 The `cratis/orchestration` profile is opt-in: select it explicitly for work with two or more autonomous lanes; `cratis/engineering` and `cratis` do not include it.
 

package/package/corpus/skills/cratis-engineering-review-rounds/SKILL.md

@@ -94,6 +94,28 @@ change addressing the failure class or ask the user about the approach. Use
 A structural change does not authorize an automatic fourth round or waive any
 required review; report the remaining blocker or required decision.
 
+## Contract
+
+A caller that schedules a round supplies these inputs. Resolve every SHA with
+`git rev-parse`; never expand a short prefix by hand.
+
+| Input | Meaning | Required |
+| --- | --- | --- |
+| `target` | The pull request, branch or work item under review | Always |
+| `round` | Round number within the work item's cap of 3 | Always |
+| `baseSha` | Full SHA of the original base | Always |
+| `headSha` | Full SHA of the head being reviewed | Always |
+| `since` | Full SHA of the head last reviewed | Delta rounds |
+| `prior` | The complete previous report, with dismissals and limits | Delta rounds |
+| `cachedReview` | An earlier review to reuse | Only for the exact same SHAs and scope |
+| `mode` | `whole-change` or `delta`; quick, ordinary or deep depth | Always |
+| `deepReason` | One named risk class and a one-line justification | Required when the depth is deep |
+
+The result is one verdict from the canonical vocabulary in `review-reports.md`:
+**Approved**, **Approved with suggestions**, **Changes requested** or
+**Incomplete**. A provider or tool error yields **Incomplete**, never an
+approval and never an invented verdict.
+
 ## What breaks
 
 - **A whole-change restart after every correction:** repeats work while losing

package/package/corpus/skills/cratis-engineering-review-rounds/verification.json

@@ -11,6 +11,7 @@
     { "kind": "skill-contains", "value": "3 rounds per work item" },
     { "kind": "skill-contains", "value": "Never file an issue merely to dispose of advisory feedback" },
     { "kind": "skill-contains", "value": "single-provider" },
-    { "kind": "skill-contains", "value": "**cross-cutting**" }
+    { "kind": "skill-contains", "value": "**cross-cutting**" },
+    { "kind": "skill-contains", "value": "A provider or tool error yields **Incomplete**" }
   ]
 }

package/package/corpus/skills/cratis-orchestration-merge-gates/LICENSE

@@ -0,0 +1,2 @@
+Copyright (c) Cratis. All rights reserved.
+Licensed under the MIT license. See LICENSE file in the canonical Cratis/AI repository for the full license text.

package/package/corpus/skills/cratis-orchestration-merge-gates/SKILL.md

@@ -0,0 +1,100 @@
+---
+name: cratis-orchestration-merge-gates
+description: Decide when an assembled candidate may merge during multi-lane work, using tier names, GitHub state for serial merge turns, a stale-head check, the review budget and an unattended no-prompt contract. Use when naming the gate tier for a lane, deciding whether it is this pull request's turn to merge, checking that a green run belongs to the current head, bounding review rounds for a lane, or making a command safe to run unattended. Not for ordinary single-session merging (use cratis-engineering-ci-gates), lane claims and briefs (use cratis-orchestration-lanes), review rounds themselves (use cratis-engineering-review-rounds), or grouping a release candidate (use cratis-engineering-release-trains).
+license: LICENSE
+compatibility: Requires git and the GitHub CLI (gh).
+---
+
+<!-- Copyright (c) Cratis. All rights reserved. -->
+<!-- Licensed under the MIT license. See LICENSE file in the project root for full license information. -->
+
+# Merge in turn, on evidence
+
+This skill applies to multi-lane work where several pull requests merge into
+one repository. A single session follows `cratis-engineering-ci-gates`.
+Merging, like any external effect, needs the user's request or brief to
+authorize it: read
+[capability-is-not-authority.md](../../rules/capability-is-not-authority.md).
+Placeholders such as `<coordinator>` and the default time boxes come from
+`cratis-orchestration-lanes` and its
+[placeholders.md](../cratis-orchestration-lanes/references/placeholders.md);
+they are not redefined here.
+
+## Tier names
+
+Lanes use short names for the gates already defined in
+`cratis-engineering-ci-gates`. That skill owns the gate content; this table only
+maps names.
+
+| Lane term | Gate | When |
+|---|---|---|
+| Iteration | Affected checks | While editing, per lane |
+| Ready to merge | Tier 1 on the assembled candidate | Before asking for a merge turn |
+| Integration | Tier 2 or CI | On the pushed head, before merge |
+
+A lane's own green iteration result is never ready-to-merge evidence for the
+assembled candidate.
+
+## Serial merge is decided by GitHub state
+
+Merge turns are decided by GitHub state, never by a chat or inbox message
+saying "go". Merge only when all three hold, each read from GitHub or git just
+before the merge:
+
+1. **Predecessors are merged.** Every predecessor pull request the candidate
+   depends on is `MERGED`, not merely approved or green.
+2. **No publish is running.** No publish run of the repository is queued or
+   in progress. A merge during a publish can race the release or be released
+   under an unexpected version.
+3. **No overlap since CI ran.** Main has no changes touching the candidate's
+   paths since the commit its CI ran on:
+   `git log <ci-sha>..origin/main -- <paths>` prints nothing.
+
+If any check fails, do not merge and do not wait in a loop: report which check
+failed and the evidence, then hand the turn back to `<coordinator>`. Read
+[references/merge-queue.md](references/merge-queue.md) for the `gh api`
+commands and a worked example.
+
+## Green but stale
+
+A green run on an older head is not evidence for the current head. Before
+merging, compare the full SHA of the pull request head with the head SHA of the
+run you rely on. Different SHAs mean the run proves nothing: wait for or start
+the run for the current head, following `cratis-engineering-ci-gates`. The same
+applies after a base update: a run on the pre-update head is stale.
+
+## Review budget
+
+Review rounds follow `cratis-engineering-review-rounds`, including its
+**Contract** table of round inputs and result states. The cap is 3 rounds per
+work item; a brief may lower it, never raise it. A review that fails on a
+provider or tool error is Incomplete, not approval, and does not open an extra
+round.
+
+## Unattended contract
+
+Unattended lanes have nobody to answer a question. No hook or tool may wait for
+interactive input.
+
+- Make every command non-interactive: pass explicit flags, close stdin, and
+  provide values rather than prompting for them.
+- Time boxes for a targeted check, a build or test phase and the detach
+  threshold are the defaults in the lanes skill's
+  [placeholders.md](../cratis-orchestration-lanes/references/placeholders.md);
+  the queue wait is set by the brief.
+- A silent command is diagnosed, not given more time: check the process, its
+  output and what it waits on, then fix or report.
+- Work beyond the detach threshold runs detached and reports through a
+  completion notification; the lane does not poll it.
+- Never loosen a hook, allowlist or guard to get past a prompt. A prompt that
+  cannot be answered is a blocker: send a `blocked` message and stop.
+
+Read [references/unattended-guards.md](references/unattended-guards.md) for the
+checkable form of this contract.
+
+## Verify
+
+- Each merge records the three state checks with the commands and results.
+- The run relied on names the same full SHA as the pull request head.
+- The ready-to-merge gate ran on the assembled candidate, not a lane branch.
+- No command in the lane's brief waits for input or runs without a time box.

package/package/corpus/skills/cratis-orchestration-merge-gates/references/merge-queue.md

@@ -0,0 +1,69 @@
+<!-- Copyright (c) Cratis. All rights reserved. -->
+<!-- Licensed under the MIT license. See LICENSE file in the project root for full license information. -->
+
+# Merge queue state checks
+
+Each check reads GitHub or git state immediately before the merge. Use the REST
+API through `gh api`. `owner/repo` is the repository, `<n>` a pull request
+number, `<sha>` a full SHA from `git rev-parse`. Gate content and run watching
+stay in `cratis-engineering-ci-gates`.
+
+## 1. Predecessors are merged
+
+```bash
+gh api repos/owner/repo/pulls/<predecessor> --jq '{state: .state, merged: .merged}'
+```
+
+Proceed only when `merged` is `true`. A closed pull request with `merged:
+false` was abandoned, not delivered: stop and report it.
+
+## 2. No publish run is queued or in progress
+
+```bash
+gh api "repos/owner/repo/actions/workflows/<publish-workflow>.yml/runs?status=queued" --jq '.total_count'
+gh api "repos/owner/repo/actions/workflows/<publish-workflow>.yml/runs?status=in_progress" --jq '.total_count'
+```
+
+Proceed only when both print `0`. Use the repository's own publish workflow
+file name. A nonzero count is a stop: report the run ids, never cancel another
+owner's publish run (see `cratis-engineering-ci-gates`).
+
+## 3. No overlapping change on main since CI ran
+
+Find the commit the relied-on run used, then compare:
+
+```bash
+ci_sha=$(gh api repos/owner/repo/actions/runs/<run-id> --jq '.head_sha')
+git fetch origin main
+git log --oneline "$ci_sha"..origin/main -- <candidate paths>
+```
+
+Proceed only when `git log` prints nothing. If the CI sha is not an ancestor
+of the pull request head, the run is stale; see below.
+
+## 4. The run belongs to the current head
+
+```bash
+pr_head=$(gh api repos/owner/repo/pulls/<n> --jq '.head.sha')
+run_head=$(gh api repos/owner/repo/actions/runs/<run-id> --jq '.head_sha')
+test "$pr_head" = "$run_head"
+```
+
+A nonzero exit means the green run is stale.
+
+## Worked example
+
+Candidate pull request 12 depends on pull request 10. Its CI run 900 was green.
+
+1. Predecessor: `pulls/10` reports `merged: true`. Passes.
+2. Publish: both workflow queries print `0`. Passes.
+3. Overlap: run 900 used `aaa111…`; `git log aaa111…..origin/main -- Source/Api`
+   prints one commit, which changed `Source/Api`. Fails.
+
+The lane does not merge. It reports "turn blocked: main changed `Source/Api`
+after the CI commit" with the commit id, then hands the turn back to
+`<coordinator>`. After updating the branch it needs a new run on the new head;
+the old green run proves nothing for it. The merge proceeds only when the three
+state checks (predecessors merged, no publish running, no overlap since CI ran)
+all hold and the stale-head check confirms the run belongs to the current head.
+The lane records the commands and their results with the merge.

package/package/corpus/skills/cratis-orchestration-merge-gates/references/unattended-guards.md

@@ -0,0 +1,66 @@
+<!-- Copyright (c) Cratis. All rights reserved. -->
+<!-- Licensed under the MIT license. See LICENSE file in the project root for full license information. -->
+
+# Unattended guards
+
+An unattended lane has nobody to answer a question. The contract is checkable:
+no hook or tool may wait for interactive input, and every command has a time
+box.
+
+## The no-prompt contract
+
+- Every command runs without a terminal prompt: explicit flags, values passed
+  by argument or environment, stdin closed (`< /dev/null`).
+- Every command has a deadline. A hung command is killed by its box, not
+  waited on.
+- A hook that would ask is a blocker, not an obstacle. Never loosen a hook,
+  allowlist or guard to avoid a prompt; report it. See
+  [hooks/README.md](../../../hooks/README.md) for how denials behave when no human
+  is present.
+- Secrets are never typed into a prompt: see
+  [secrets.md](../../../rules/secrets.md).
+
+## Time boxes
+
+The values and override bounds for the first three boxes are the defaults in
+[placeholders.md](../../cratis-orchestration-lanes/references/placeholders.md);
+a brief may override within those bounds. The queue wait is set by the brief.
+
+| Box | Value from | Action at the limit |
+|---|---|---|
+| Targeted check | placeholders.md | Stop and diagnose |
+| Build or test phase | placeholders.md | Stop and diagnose; longer needs approval |
+| Detach threshold | placeholders.md | Run detached; do not wait |
+| Queue wait | the brief | Send a `blocked` message |
+
+## A silent command is diagnosed
+
+A command that prints nothing is not "still working". Inspect: is the process
+alive, what is it waiting on (a prompt, a lock, the network), what changed in
+its output directory. Fix the cause or report it; do not extend the box.
+
+## Detach rule
+
+Work expected to exceed the detach threshold runs detached, with output going
+to a file under `<work-root>`, and reports through a completion notification.
+The lane does not poll it by hand. Where the harness has no notification, the
+blocking watch described in `cratis-engineering-ci-gates` holds the wait.
+
+## Checkable example
+
+A command that would prompt, made non-interactive and boxed:
+
+```bash
+# Would prompt: gh pr merge <n>   (asks how to merge)
+# Non-interactive, explicit strategy, stdin closed, targeted-check box (120 seconds by default):
+timeout 120 gh pr merge <n> --repo owner/repo --merge < /dev/null
+echo "exit=$?"
+```
+
+Verify it behaves: the command must return within the box and the exit code
+must be explicit. Exit `124` means the box expired: diagnose, do not rerun
+with a longer box. Any other nonzero exit is the command's own failure.
+To prove that nothing waits on input, run the same command with stdin
+closed and confirm it fails fast rather than hanging.
+This example shows the form only; merging still needs the authorization and
+the three state checks in the skill.

package/package/corpus/skills/cratis-orchestration-merge-gates/verification.json

@@ -0,0 +1,17 @@
+{
+  "skill": "cratis-orchestration-merge-gates",
+  "input": "Decide whether a lane's pull request may merge now, given predecessors, a running publish and a green run.",
+  "fixtures": [],
+  "assertions": [
+    { "kind": "skill-contains", "value": "Merge turns are decided by GitHub state" },
+    { "kind": "skill-contains", "value": "Every predecessor pull request the candidate" },
+    { "kind": "skill-contains", "value": "No publish run of the repository is queued or" },
+    { "kind": "skill-contains", "value": "git log <ci-sha>..origin/main -- <paths>" },
+    { "kind": "skill-contains", "value": "A green run on an older head is not evidence for the current head" },
+    { "kind": "skill-contains", "value": "3 rounds per" },
+    { "kind": "skill-contains", "value": "No hook or tool may wait for" },
+    { "kind": "skill-contains", "value": "A silent command is diagnosed, not given more time" },
+    { "kind": "skill-contains", "value": "references/merge-queue.md" },
+    { "kind": "skill-contains", "value": "references/unattended-guards.md" }
+  ]
+}

package/package/corpus/skills/cratis-screenplay-captures-and-reactions/references/capture-map-and-example.md

@@ -63,6 +63,13 @@ reference is handed records (`given capture`, `when capture`) and never contacts
 (PLAY0700). Events append to the event source the key names, and
 `$context.occurred` is supplied by the scenario's `given clock`.
 
+When every consumed event declares the key as one required scalar property of the same
+type (for example a concept over Uuid), the appended event's identity carries that type
+instead of Text, and `for` in specifications binds as that type. A model that uses this
+selects ESM v32 (Requires Screenplay 4.241.0; `screenplay --version`); untyped, non-scalar or
+disagreeing keys keep Text and the earlier version. Rendering needs a Stage that admits v32:
+see toolchain [language admission](../../cratis-screenplay-toolchain/references/language-admission.md).
+
 For a producer that sources every event by this key, declare
 `key <property> is event source` (ESM v33, Screenplay 4.242.0).
 See [Keying by the event source](#keying-by-the-event-source) below for the promise, fixture `for`

package/package/corpus/skills/cratis-screenplay-command-surface/SKILL.md

@@ -212,6 +212,8 @@ comparisons; older binders report PLAY0268. Read [date comparisons](references/d
 when ordering a retention window with `require to >= from`, comparing instants
 across offsets, or rejecting offset-less inputs before rules. It covers admitted
 positions, PLAY0268/0273, ordinal `then` matching and Stage's STAGE-ESM-046 renderer refusal.
+The same file lists the parsed-but-not-runnable calendar and clock forms (`time zone`, `calendar`,
+`today - 7 days`, `date of occurred`; PLAY0812 to PLAY0814): do not author them into executable models.
 
 Requires Screenplay 4.205.0 (ESM v28; `screenplay --version`) for `==`/`!=` between Uuid
 values (properties, concepts, identities, canonical literals, and read paths in `require`);
@@ -220,7 +222,9 @@ rule, PLAY0268/0273 and the refused shapes (ordering, Uuid validation rules, Uui
 
 **Rules whose logic is code.** A bare `rule <Name>` has no portable meaning (`PLAY0268`) and a bodied rule binds only as
 opaque code. Read [references/validate-rules.md](references/validate-rules.md) when a rule's logic must live in a `file`
-or fenced code body.
+or fenced code body. Built-in inline languages are `csharp`, `typescript`, `react`, `html`, `sql` and `java`;
+the body is opaque and travels unchanged, and the Cratis render target refuses `java` bodies.
+Requires Screenplay 4.244.0 (`screenplay --version`) for that refusal.
 
 **Put format rules on the `concept`, not the command** (except date comparisons,
 which bind only on command properties, not as concept rules). A concept carries its own

package/package/corpus/skills/cratis-screenplay-command-surface/references/date-comparisons.md

@@ -7,6 +7,7 @@
 
 - Retention window and rejection specifications
 - Missing-offset input rejection
+- Clock operands and calendars (parsed, not runnable)
 
 Requires Screenplay 4.199.0 (ESM v26; `screenplay --version`); older binders refuse date comparisons with PLAY0268. Upgrade the compiler without weakening the rule.
 
@@ -109,3 +110,18 @@ Include a skipped-condition case where applicable. A typed `.play` fixture with
 that invalid value refuses binding with PLAY0273; `then error` does not turn it
 into an executed runtime rejection. Record the target test separately, not as a
 passing `.play` specification or a `given clock` workaround.
+
+## Clock operands and calendars (parsed, not runnable)
+
+Both compilers parse these forms, but executable binding refuses each with PLAY0268 and
+none selects an ESM version. Do not author them into an executable model:
+
+- application root: `time zone "<id>"` or `time zone configurable default "<id>"`;
+- command: `calendar "<id>"` or `calendar from $context.<member>`;
+- specification: `given time zone "<id>"`;
+- condition operands: clock offsets such as `today - 7 days` and `now + 2 hours`, and
+  `date of occurred` or `date of now`.
+
+Bare `today` and `now` stay ordinary property paths. PLAY0812, PLAY0813 and PLAY0814 report
+a repeated or malformed time zone, command calendar and specification time zone.
+Requires Screenplay 4.242.0 (`screenplay --version`) to parse them.

package/package/corpus/skills/cratis-screenplay-command-surface/references/protected-reads.md

@@ -154,6 +154,8 @@ Stage's [protected reads rendering](https://github.com/Cratis/Stage/blob/main/Do
 for the rendered shape and where it differs from the reference (a race is an Arc
 validation failure, not `DecisionStateChanged`; only the first failing requirement is reported).
 
+When the same commit also violates a uniqueness constraint, the constraint refusal is the one observed, not the concurrency conflict; see the concurrency scenarios section of [consistency and concurrency](../../cratis-screenplay-streams-and-consistency/references/consistency-and-concurrency.md).
+
 Requires Stage 4.129.0 for semantic Host/specification-executor protected reads;
 older engines refuse STAGE-ESM-044. They require presence before requirements or
 generation and use stored read properties in requirements and produced mappings,

package/package/corpus/skills/cratis-screenplay-event-modeling/SKILL.md

@@ -115,8 +115,8 @@ result are in [references/parsed-not-runnable.md](references/parsed-not-runnable
 and `cratis-screenplay-toolchain` (`references/executable-subset.md`). Read `references/parsed-not-runnable.md` when determining the required ESM version or interpreting binding dispositions. Read `cratis-screenplay-toolchain`'s `references/executable-subset.md` when checking binder admission or reference-execution limits. Model the wider
 language freely when the `.play` file **is** the deliverable - documentation,
 review, a shared description of a system. Never read a clean `screenplay` run as
-evidence a construct works downstream. The language is frozen at ESM v1–v28 ([the freeze decision](https://github.com/Cratis/Screenplay/blob/main/decisions/0092-the-language-is-frozen-at-esm-v28.md)): model with it, and report a typed
-Stage, `cratis render` or Studio refusal as a platform gap rather than waiting for new constructs.
+evidence a construct works downstream. New constructs can be admitted, each byte-changing one with its own ESM version, and count as delivered once Stage admits it or refuses it with a typed refusal. Model with what the installed compiler admits, and report a typed
+Stage, `cratis render` or Studio refusal as a platform gap.
 
 ## Locate the model
 
@@ -168,7 +168,9 @@ Read [references/parsed-not-runnable.md](references/parsed-not-runnable.md) (sec
 Two divergences matter, and getting them wrong produces a model that will not
 compile or will not be safe. Both are deliberate.
 
-- **A command may read state.** The generic method forbids `ReadModel -> Command`
+- **A command may read state.** A newly scaffolded model starts its application root
+  with `command reads protected`; leave the preamble out only for a model whose reads are
+  not admissible (PLAY0781/PLAY0786). The generic method forbids `ReadModel -> Command`
   edges. Screenplay ships `reads <ReadModel> [as <alias>] [by <property>]` so the
   model shows what a state-dependent decision consulted. Application-root
   `command reads protected` admits eligible command reads as v25: absent state

package/package/corpus/skills/cratis-screenplay-event-modeling/verification.json

@@ -50,6 +50,10 @@
       "kind": "skill-contains",
       "value": "command reads protected"
     },
+    {
+      "kind": "skill-contains",
+      "value": "A newly scaffolded model starts its application root"
+    },
     {
       "kind": "skill-contains",
       "value": "Legacy reads remain PLAY0271"

package/package/corpus/skills/cratis-screenplay-model-authoring/references/mcp-tools.md

@@ -82,6 +82,7 @@ A declaration move follows these rules:
 
 - A specification that covers only the moved declaration moves with it. A specification covers a declaration when it is a matching specification of one of its `find-specification-obligations` obligations, or when its `when` step names it; a `given` or `then` reference alone is not coverage.
 - The move is refused when a specification also covers a declaration that stays, when an obligation the source slice met would no longer be met or the move would introduce an unmet obligation, on a name collision, for an inline declaration (such as an inline `produces event`), a declaration written in more than one fragment, a standalone specification, screen, constraint or module, and when an unqualified reference would resolve differently. Qualify that reference first.
+- The C# workspace API refuses the same cases as `propose-move`; a refusal in either surface reports the standard `ProposalRejected` failure kind with the usual rejection fields. Carried specifications are computed automatically; a supplied list must match them (Requires Screenplay 4.241.0, `screenplay --version`).
 - Screen `execute`, `refresh` and `navigate to` targets that name the declaration are repaired, not moved.
 - Slice-level events named by `produces` do not travel with a command, and a projection's `from` may name an event declared in another slice; move such an event with its own `propose-move` only when it should change slices. A command's inline events go with it.
 - Event names and pins stay untouched, and assigned identities follow the declaration.

package/package/corpus/skills/cratis-screenplay-modeling-lifecycle/SKILL.md

@@ -45,7 +45,7 @@ an unproven pass.
 | Situation | Level | Where the work goes |
 |---|---|---|
 | An accepted model covers the scope | **Model** | Change the `.play`, verify V1-V3, review, then render or gap-fill |
-| Opted in, but this scope has no model yet | **Model** | New behavior starts in discovery, then slice design |
+| Opted in, but this scope has no model yet | **Model** | New behavior starts in discovery, then slice design; a new model's application root starts with `command reads protected` (omit it only when the reads are not admissible, PLAY0781/PLAY0786) |
 | A computed rule inside a modeled slice | **Model + code attachment** | `csharp`/`file` block; it binds only as the construct allows (`cratis-screenplay-model-authoring`) |
 | Scope Stage cannot render yet (Stage renders supported event-triggered Automation and bounded source-event capture/outbound Translate paths; refused shapes remain gap-fill. Mixed effects stay one reaction, `STAGE-ESM-037`; a hand-written realization must prove retry safety) | **Gap-fill code** | Hand-written; the `.play` slice and specs are the contract. `cratis-screenplay-render-and-gap-fill` separates an authorized existing generated base from fully hand-written delivery |
 | Outside call, transport or credentials | **Adapter code** | `Customizations/` or the host, applying `cratis-engineering-effect-boundaries` |

package/package/corpus/skills/cratis-screenplay-projections/SKILL.md

@@ -255,7 +255,10 @@ reducer Balance => AccountBalance
 ````
 
 Inline code uses a tagged fence (` ```csharp `); a `csharp` line above a bare
-fence still parses but warns (`PLAY0397`). Reach for a reducer only when the next
+fence still parses but warns (`PLAY0397`). Built-in inline languages are `csharp`,
+`typescript`, `react`, `html`, `sql` and `java`; the body is opaque and travels unchanged
+to the target, and the Cratis render target refuses `java` bodies.
+Requires Screenplay 4.244.0 (`screenplay --version`) for that refusal. Reach for a reducer only when the next
 state depends on the current one — a running balance, a state machine.
 `context.State` is **null for the first event** and is the only nullable member;
 `Event`, `Key`, `Tenant`, `Occurred`, `SequenceNumber` and `IsFirst` are always

package/package/corpus/skills/cratis-screenplay-read-surface/SKILL.md

@@ -164,7 +164,7 @@ A query is **complete without a performer** — it is realization metadata, not
 precondition. It takes a `file` reference or an inline block in a tagged fence
 (` ```csharp `, ` ```sql `), and is the query's counterpart to a command's
 `handler`. The parser accepts any registered inline language and does not reject
-a nonsensical one, so the choice is yours to get right. Performer code is opaque:
+a nonsensical one, so the choice is yours to get right. Built-in inline languages are `csharp`, `typescript`, `react`, `html`, `sql` and `java`. A performer query refuses a `by` or `filter` argument sourced from `$context` with PLAY0810 (C# binding; Requires Screenplay 4.244.0, `screenplay --version`; older compilers silently drop it): take a caller-supplied argument instead. Performer code is opaque:
 Screenplay never runs it. It is reported as information `PLAY0270` and left out of the executable model; a specification that reads it is left out while every other specification still runs. Older compilers refuse it with PLAY0268: see the [version gate](../cratis-screenplay-toolchain/references/executable-subset.md#code-attachments-what-binds-what-never-does).
 
 A read model a performer composes needs no projection, and no event builds it.

package/package/corpus/skills/cratis-screenplay-render-and-gap-fill/SKILL.md

@@ -48,6 +48,11 @@ in code, not by waiting for ESM admission. Requires Screenplay 4.210.0
 older binders use PLAY0268. Read [renderability gate](references/renderability-gate.md)
 when classifying a handler or other binding refusal; never parse message text.
 
+Inline bodies (`csharp`, `typescript`, `react`, `html`, `sql`, `java`) are opaque and reach the target
+unchanged; each target decides which it realizes. The Cratis target refuses `java` bodies: gap-fill
+that scope in code and record the refusal.
+Requires Screenplay 4.244.0 (`screenplay --version`) for the `java` refusal.
+
 ## Interview phase
 Ask only for missing inputs: accepted model/root, stable `--name`, destination,
 non-renderable-scope decision and seams. Read [references/delivery-protocol.md](references/delivery-protocol.md)
@@ -176,6 +181,9 @@ Adapters and non-renderable scope follow the contract rules of `cratis-applicati
 - The `cratis run` sandbox's legacy EventModel engine (the default engine before CLI 3.73.0) enforces only simple literal validation rules and no
   authorization; it is no evidence for denial behaviour or for any other rule.
 - Never remove `pii`, `secret`, authorization or rules to get a render through; report the gap.
+- Generated .NET apps validate concept `matches` rules at runtime with the `Cratis.Screenplay.Matching` package (`PortableMatcher`),
+  the matcher the compiler admitted; reference it at the same version as the Screenplay compiler.
+  Requires Screenplay 4.241.0 (`screenplay --version`) for that package.
 - Stop and ask only on a genuine contradiction between model, specs, descriptions and declared
   contracts, after reading the slice fully (`cratis-screenplay-modeling-lifecycle` `references/stop-or-assume.md`).
 - Commit set after a delivery the user accepts: the destination's `.cratis-render.json`,

package/package/corpus/skills/cratis-screenplay-specifications/SKILL.md

@@ -141,6 +141,8 @@ Rules the binder enforces:
   needs one of them, `then denied` or a sole validation `then error` (`PLAY0465`). Each argument is a `by` or
   `filter` parameter of the query (`PLAY0468`).
 - **A clock instant is ISO 8601 with an offset or `Z`** (PLAY0461); one `given clock` maximum.
+- **`given time zone "<id>"` is parsed, not runnable.** Executable binding refuses it with PLAY0268;
+  a repeated or malformed line is PLAY0814. Do not author it into an executable model.
 - **`then` contains either events or an error — never both.** A rejection
   specification has exactly one rejection and no success outcome.
 - **`then denied` stands alone**: not with events, errors or state assertions

package/package/corpus/skills/cratis-screenplay-streams-and-consistency/references/consistency-and-concurrency.md

@@ -139,6 +139,11 @@ For each enforced or recorded rule write three short scenarios:
   checks uniqueness before the commit and updates the index after it; index update failures
   are logged, not rolled back (Screenplay `constraints.md`, Chronicle#4123, open). Do not call it an
   atomic index-and-append guarantee.
+  When a command's protected read changed and its uniqueness constraint is violated in the same
+  commit, the observable refusal is the constraint refusal, not the concurrency conflict: assert
+  the constraint's message in the `then` expectation.
+  Requires Screenplay 4.245.0 (`screenplay --version`);
+  older reference evaluators report the concurrency conflict.
 - **retry** (same request and operation identity, after a lost reply) -> must not record a
   second occurrence, without blocking a different legitimate operation. A once-only fact uses
   `unique event`; a repeatable operation needs an operation identity and target-side

package/package/corpus/skills/cratis-screenplay-toolchain/SKILL.md

@@ -149,6 +149,11 @@ with ordered imports means future files need explicit imports.
   `references/diagnostics.md` for proof/support failures. Binding is not rendering.
   Tool/renderer authors: read [references/generation-checks.md](references/generation-checks.md)
   when discovering strategy options, checking one concept or value, or consuming rule proofs.
+- **v32:** a `source events` capture with a typed scalar key carries the key's type onto
+  the appended event's identity.
+  Requires Screenplay 4.241.0 (`screenplay --version`);
+  older compilers keep the key as Text. Read
+  [language admission](references/language-admission.md) for the Stage boundary.
 - **v28:** `==`/`!=` between Uuid values in `require` and `produces when` select v28
   (Requires Screenplay 4.205.0; `screenplay --version`; older binders refuse PLAY0268).
   Read [language admission](references/language-admission.md) and command-surface

package/package/corpus/skills/cratis-screenplay-toolchain/references/executable-subset.md

@@ -13,6 +13,7 @@
 - Chronological command date comparisons (ESM v26)
 - Flat composite read-model keys (ESM v27)
 - Uuid equality in command conditions (ESM v28)
+- Parsed, not runnable: clocks, calendars and time zones
 - Code attachments (what binds, what never does)
 - Refused (code, reason): fix, or record as a mode gap
 - Not refused, but do not rely on it
@@ -45,7 +46,7 @@ Complete examples that bind live in `executable-example.md`, `pdl-example.md` (p
 For atomic batches (v22), described handlers (v23), ordinal text rules (v24) and
 protected reads (v25), chronological command dates (v26), composite keys (v27) and Uuid equality (v28), read
 [language admission](language-admission.md). A later
-version alone does not enable either application opt-in. The language is frozen at ESM v1–v28 ([the freeze decision](https://github.com/Cratis/Screenplay/blob/main/decisions/0092-the-language-is-frozen-at-esm-v28.md)): no new versions, constructs, keywords or grammar, except a construct for a real model that is blocked with no model-side alternative, accepted in its own record. Model with what v1–v28 offers; when Stage, `cratis render` or Studio does not support a construct yet, treat the typed refusal as a platform gap to report, since consumers are catching up to v28, not a reason to wait for new language.
+version alone does not enable either application opt-in. New constructs can be admitted, each byte-changing one with its own ESM version, and count as delivered once Stage admits it or refuses it with a typed refusal. Model with what the installed compiler admits; when Stage, `cratis render` or Studio does not support a construct yet, treat the typed refusal as a platform gap to report.
 
 ## Caller and compliance boundary
 
@@ -307,6 +308,16 @@ binding and reference execution. Read command-surface
 [Uuid equality](../../cratis-screenplay-command-surface/references/uuid-equality.md) for the
 complete example.
 
+## Parsed, not runnable: clocks, calendars and time zones
+
+Application-root `time zone` / `time zone configurable default`, command `calendar` /
+`calendar from $context.<member>`, specification `given time zone`, and the condition
+operands `today - 7 days`, `now + 2 hours`, `date of occurred` and `date of now` parse and
+print, but executable binding refuses them with PLAY0268 and they select no ESM version.
+Do not author them into executable models. PLAY0812, PLAY0813 and PLAY0814 are the
+syntax diagnostics (Requires Screenplay 4.242.0; `screenplay --version`). Bare `today` and
+`now` remain ordinary paths. Detail: command-surface `references/date-comparisons.md`.
+
 ## Code attachments (what binds, what never does)
 
 Pending `handler implementation` beside unconditional `produces` binds as a described
@@ -315,7 +326,7 @@ denial/validation specs still run. Read [language admission](language-admission.
 v22–v28 and [described handlers](../../cratis-screenplay-command-surface/references/described-handlers.md)
 for the result contract. Attached handlers remain unbound.
 
-Inline fences (`csharp`, `typescript`, `react`, `html`, `sql`) and `file <path>` attach
+Inline fences (`csharp`, `typescript`, `react`, `html`, `sql`, `java`) and `file <path>` attach
 code to an owner. Two kinds block binding (V3 blocked, no specification runs):
 the attached command `handler` (PLAY0800) and the `file` constraint (PLAY0268, see below).
 A query `performer` does not block: it is an opaque read, reported as information

package/package/corpus/skills/cratis-screenplay-toolchain/references/language-admission.md

@@ -28,6 +28,7 @@ exact language/semantic pairs; binding, reference execution and rendering are se
 | v29 | `decimals <= N`; `add`/`subtract` by `a * b`; a concept mapped to another concept over the same primitive (decision 0098) | Decimal-places rule on a Decimal concept or property; the exact decimal product; the conversion is admitted only when the target declares no rule or compliance the source does not, never for enums, composites or optional into required | Stage admits v29; numeric projection arithmetic and admitted decimal/concept validation have target-specific paths |
 | v30 | A command `produces ... for <required scalar property>` (several event sources); a specification `given generated <Command>.<property> = <value>` (decision 0098) | Several sources in one accepted command; pinned generated values for reaction-invoked commands, taken in authored order | Stage admits v30; generated backends preserve per-production destinations. CLI render admits v30 with an admitting bundle |
 | v31 | A policy `require anonymous` for a public command or query | A deliberately public surface; the policy is the whole effective authorization | v31 refused until Stage admits it |
+| v32 | A `source events` capture whose key is a typed scalar (for example a concept over Uuid) | The appended event's event-source identity keeps the key's type instead of Text (see the compiler minimums); other models keep their version and bytes | Stage admits v32 through a direct caller of the reviewed baseline; see [Stage admission](#stage-admission-and-execution) |
 | v33 | `key <property> is event source` on a single-property `source events` capture (Screenplay 4.242.0; PLAY0809) | Serializes `keyIsEventSource` beside `sourceEvents`. Promises every incoming event is sourced by that key; explicit fixture `for` must equal it, while omission takes the key before projections/reactions. Checks also run on givens without an action. Unmarked captures keep earlier behavior/version/bytes | An admitting renderer may narrow history reads by event source id; binding alone does not prove target realization |
 
 Constructs of decision 0098 with no executable-model content need no version: application-level toolbar buttons in the layout's `navigation topbar` region (`button <id> title "..." slice <Slice>` with an optional indented `authorize <Policy>`), a command specification that states the public event its outbound Translate slice publishes (no more false `PLAY0285`), and a capture over events that copies a list (`lines = $.lines`) or fans out with `children lines identified by sku`. Check `screenplay --version` against the release that admitted v29 and v30 before relying on them.
@@ -42,6 +43,8 @@ Requires Screenplay 4.184.0 or later (`screenplay --version`) for literal text r
 
 Requires Screenplay 4.193.0 or later (`screenplay --version`) for protected reads; older binders retain PLAY0271/PLAY0268.
 
+Requires Screenplay 4.241.0 or later (`screenplay --version`) for v32 typed scalar `source events` keys; older compilers keep the key as Text on the appended event's identity.
+
 Requires Screenplay 4.199.0 (ESM v26; `screenplay --version`) for date comparisons; older binders report PLAY0268.
 
 Requires Screenplay 4.204.0 (ESM v27; `screenplay --version`) for composite read-model keys; older binders report PLAY0268.

package/package/corpus/skills/cratis-screenplay-toolchain/references/renderable-subset.md

@@ -22,7 +22,7 @@ and concept compliance (v13) render.
 
 ## Current admission
 
-The language is frozen at ESM v1–v28 ([the freeze decision](https://github.com/Cratis/Screenplay/blob/main/decisions/0092-the-language-is-frozen-at-esm-v28.md)): no new versions, constructs, keywords or grammar, except a construct for a real model that is blocked with no model-side alternative, accepted in its own record. Model with what v1–v28 offers; when Stage, `cratis render` or Studio does not support a construct yet, treat the typed refusal as a platform gap to report, since consumers are catching up to v28, not a reason to wait for new language.
+New constructs can be admitted, each byte-changing one with its own ESM version, and count as delivered once Stage admits it or refuses it with a typed refusal. Model with what the installed compiler admits; when Stage, `cratis render` or Studio does not support a construct yet, treat the typed refusal as a platform gap to report.
 
 Stage v4.197.0 admits matched language/ESM **1.0–30.0 and 32.0**, not 31.0,
 mixed or unknown pairs (`STAGE-ESM-016`). CLI v3.100.0 render checks only the

package/package/profile-catalog.json

@@ -1162,7 +1162,8 @@
         "cratis/engineering/core"
       ],
       "availableTargets": [
-        "cratis-orchestration-lanes"
+        "cratis-orchestration-lanes",
+        "cratis-orchestration-merge-gates"
       ],
       "languages": [
         "language-agnostic"

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cratis/pi",
-  "version": "7.118.0",
+  "version": "7.119.1",
   "description": "Configuration-aware Cratis AI integration for Pi",
   "type": "module",
   "files": [