@cratis/pi 7.32.0 → 7.34.0

package/package/corpus/skills/cratis-stage-rendering-and-sandbox/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: cratis-stage-rendering-and-sandbox
-description: "What Cratis Stage and `cratis render` actually do with a Screenplay `.play` model today: the model shape Stage 4.67 admits and refuses (`STAGE-ESM-*`, `PLAY0268` render refusals), what it emits (C# Arc/Chronicle backend, React/Vite scaffold with Arc `CommandForm` shell emission over Scene 4.12 typed bindings, Debug specifications), managed publication, `--force` and recovery, authored-UI omission/parity checks, the unmanaged `Customizations/` seam, and the `cratis/stage` sandbox and `cratis/stage-specrunner` job. Use when deciding whether Stage can render a model, reading a blocked render, re-rendering safely, checking generated/runtime screen parity, or running the sandbox. Not for: authoring the model (use `cratis-screenplay-model-authoring`) or the render and gap-fill workflow (use `cratis-screenplay-render-and-gap-fill`)."
+description: "What Cratis Stage and `cratis render` actually do with a Screenplay `.play` model today: the model shape the current Stage admits and refuses (`STAGE-ESM-*`, `PLAY0268` render refusals), what it emits (C# Arc/Chronicle backend, React/Vite scaffold with Arc `CommandForm` shell emission over Scene typed bindings, Debug specifications), managed publication, `--force`, recovery, scoped renders (`--scope`) and `--check`, authored-UI omission/parity checks, the unmanaged `Customizations/` seam, and the `cratis/stage` sandbox and `cratis/stage-specrunner` job. Use when deciding whether Stage can render a model, reading a blocked render, re-rendering safely, checking generated/runtime screen parity, or running the sandbox. Not for: authoring the model (use `cratis-screenplay-model-authoring`) or the render and gap-fill workflow (use `cratis-screenplay-render-and-gap-fill`)."
 license: MIT
 ---
 
@@ -16,7 +16,7 @@ exactly produces **no artifacts at all**, never thinner ones. Read the admission
 before promising that a model can be rendered, and render it to find out: the source
 reading in this skill is not a render result.
 
-Authored UI has its own parity hazard. Stage 4.24 rendered a default React/Vite
+Authored UI has its own parity hazard. Historically (Stage 4.24) Stage rendered a default React/Vite
 scaffold and did not prove that modeled screens, templates, forms, toolbars,
 components, outlets, package icons or routes were implemented. The first fully
 passing public browser vector was CLI 3.40.7 with `cratis/stage:4.51.1`: 51
@@ -40,29 +40,27 @@ argument or an invalid semantic option.
 
 ## Verified product sources
 
-| Source | Pin | Notes |
-| --- | --- | --- |
-| Stage | `4.67.0` as CLI 3.50.0's renderer and default sandbox image | Source-checked, not a new executed vector. Case tables (4.59.0+) and whole numbers as `long` from ESM v8 (4.61.0+) apply to this default. Previous CLI 3.46.1 used Stage 4.52.0 (`0e4fd87`) and applied neither. Stage 4.52.0 defines `STAGE-SCENE-ACTION-001`/`STAGE-SCENE-INTERACTION-001` and was executed on CLI 3.43.0. Earlier executed baselines: 4.51.3, 4.51.1, 4.49.5 and `v4.24.2` (`32dcac4`) |
-| cratis CLI | `3.50.0` (`546dea12`) | `v3.50.0:Directory.Packages.props` pins Stage 4.67.0, Screenplay 4.131.0, Arc.Screenplay 22.54.0, Chronicle 19.32.0, Fundamentals 7.22.8. `cratis run --tag` changes only the sandbox image. Executed render/browser/MCP baseline remains 3.43.0 (Stage 4.52.0, Screenplay 4.127.0), not a 3.50.0 probe; UI-profile refusal and rendered recovery shipped in Cratis/cli#301. Older baselines: 3.41.0, 3.40.7, `v3.28.2` (`141c499`, Cratis/cli#253) |
-| Screenplay | bundled `4.131.0`; standalone pin `4.135.0` | Name the compiler: bundled 4.131.0 lacks v11 literal lowering; `semantic-diff` source objects are in both current tools |
-| Rendered applications | Arc, Chronicle, Scene 4.15.0, .NET 10 | CLI 3.43.0 renders the canonical corpus to `.cratis-render.json`, backend artifacts, `.frontend/**`, `scene.json`, `src/bindings.ts`. Verify the generated package set for each render before claiming exact Scene runtime parity |
-
-The retained admission and runtime evidence below was read at its named tags (`Source/Rendering.Cratis/**`, `README.md`,
-`Documentation/**` in Stage; `Source/Cli/Commands/Render/**` and
-`Documentation/reference/screenplay.md` in the CLI), and the vertical in
-[references/render-example.md](references/render-example.md) was rendered, built and
-tested with cratis 3.28.2 (re-run on 3.28.3). Read `references/render-example.md` when you need a complete renderable model and the observed render, build, and test results. The full version table (Screenplay 4.66.0, Arc 22.50.5,
-Chronicle 19.32.0 and the tool split) is in the `cratis-screenplay-toolchain` skill,
-`references/versions.md`. Stage 4.51.3 scaffolds Arc `22.50.5` and Chronicle
-`19.32.0`, with `CratisEmbeddedScreenplayEnabled=false`. `[ProtectedDecision]` and
-`DecisionRead<T>` are available to gap-fill code, not automatically emitted or
-protected by Stage; admission and unit-of-work enrollment still matter. See
-[rendered application](references/rendered-application.md) for the source checks. Screen render
-publication and browser behavior for the canonical corpus are verified on public
-CLI 3.43.0 / `cratis/stage:4.52.0`. Studio 0.144.4 is released, but production
-answers every unauthenticated request with 401 and the production UI automation
-needs a
-test-account decision, so Studio production Play proof is not claimed.
+Current pins and the tool split: `cratis-screenplay-toolchain/references/versions.md`. Facts here
+were read at Stage `v4.73.1` (`Source/Rendering.Cratis/**`, `Documentation/guides/build-renderer-target.md`,
+`Documentation/reference/render-plans.md`, `Documentation/docker/**`) and cli `v3.53.1`
+(`Documentation/reference/screenplay.md`, `Source/Cli/Commands/Render/**`), not by a render run
+unless a line says *observed*. CLI 3.53.1 bundles Screenplay 4.137.0 and Stage 4.73.1, so its
+binder is behind the standalone 4.139.0 compiler. Stage 4.73.1's scaffold pins Arc 22.68.0, Chronicle 19.45.0, Components 4.26.2, Scene 4.21.0 and
+Fundamentals 7.22.8. These are **not** the latest releases; do not bump them in managed files
+([rendered application](references/rendered-application.md)).
+
+Historical executed baselines (history, not current claims): Stage `v4.24.2` and cli
+`v3.28.2`/`v3.28.3` (Cratis/cli#253; the example in [render-example.md](references/render-example.md)),
+cli 3.40.7 with Stage 4.51.1 (first fully passing browser vector, Cratis/Screenplay#605) and
+CLI 3.43.0 (bundled Screenplay 4.127.0) with Stage 4.52.0. UI-profile refusal and rendered recovery
+shipped in Cratis/cli#301. Case tables (Stage 4.59.0+) and whole numbers as `long` from ESM v8
+(4.61.0+) apply to the current default; the pinned Stage default applies both rules. The Stage
+4.52.0 renderer applies neither new rule.
+
+`[ProtectedDecision]` and `DecisionRead<T>` are available to gap-fill code, not automatically
+emitted or protected by Stage; admission and unit-of-work enrollment still matter. Studio 0.144.4 is
+released, but production answers every unauthenticated request with 401 and the production UI
+automation needs a test-account decision, so Studio production Play proof is not claimed.
 
 ## Model-first rule
 
@@ -92,8 +90,9 @@ backups). Never stage `.cratis-render/` in git; commit the manifest with the out
 - An unchanged re-render writes nothing (`unchanged` equals the artifact count).
 - Use exclusive access to the destination; a receipt is a filesystem result, not a Git
   commit, and the command creates no branch, commit or PR.
-- Drift: compare successive manifests' `semanticRevision` for renders with the same
-  `--name` and inputs. Do not compare the MCP `modelRevision` with the manifest: their
+- Drift: `cratis render ... --check` (CLI 3.44.0 or later) is the first probe; exit `6` means
+  pending changes. Otherwise compare successive manifests' `semanticRevision` for renders with the
+  same `--name` and inputs. Do not compare the MCP `modelRevision` with the manifest: their
   application identities can differ.
 
 ## Rendering with `cratis render`
@@ -111,8 +110,22 @@ cratis render --workspace ./application.workspace.json --destination ./out
 | `--destination <DIR>` | Publication directory, default `./out`. It never defines identity |
 | `--target` | Only `cratis` is bundled |
 | `--project-name`, `--root-namespace` | Rendering overrides (dot-separated C# identifiers); do not change identity |
+| `--scope <ADDRESS>` | Render only a module, feature or slice (`Module[.Feature…][.Slice]`, exact case); repeatable. See "Scoped renders" |
+| `--check` | Plan against the real destination without writing: exit `0` current, `6` changes pending, `5` planning, refusal or pending recovery. Combine with `--scope` and `--force` |
+| `--package-set <FILE>` | Approved package set (JSON) of custom runtime packages the `ui profile` may use; the frontend installs exactly these |
 | `--force` | See "Publication and recovery" |
 
+### Scoped renders
+
+`--scope` (CLI 3.49.0 or later) renders an admitted part while other slices wait for hand-written
+code or renderer support. The whole model must still compile and bind, so a `PLAY0268`, `pii`/`secret`,
+handler or ESM v11+ problem anywhere blocks even a scoped render. `PLAN-*` problems in unselected
+slices become warnings and `STAGE-ESM-*` refusals in unselected slices do not block. A scoped plan
+has no application scaffold or default Scene (with no manifest in the destination the plain scaffold
+is added). A dependency in another slice must be rendered first or listed too (`CLI-RENDER-014`);
+unknown scope `-011`, ambiguous `-012`, aggregate policy layout `-013` (render the whole application
+once first). Unselected managed files are preserved. A scoped result is evidence for that scope only.
+
 Order of events: recover any interrupted earlier publication, compile, bind, build the
 execution plan, plan the target (Stage admission), validate artifacts, then publish.
 Exit `0` is a published render, `5` is a refusal with nothing published (diagnostics are
@@ -121,13 +134,10 @@ receipt.
 
 Facts that surprise:
 
-- **Binding uses the CLI's bundled Screenplay** (4.66.0 in cratis 3.28.2, the same compiler
-  as the standalone tool, ESM up to v6). A v6 model (Automation, Translate, reactions,
-  captures, application triggers, clock specifications) binds and is then refused whole by
-  Stage with `STAGE-ESM-016` (probed on 3.28.2); on cratis before 3.28.2 the bundled
-  4.60.1 binder stopped it first with `PLAY0268`. A model that binds is not necessarily
-  renderable: Stage admits ESM v1 to v4, and a v4 model renders only while no selected
-  event has evolved (`STAGE-ESM-026`, Stage 4.24.2).
+- **Binding uses the CLI's bundled Screenplay** (4.137.0 in cratis 3.53.1; the standalone tool is
+  newer). A model that binds is not necessarily renderable: Stage 4.73.1 admits ESM v1 to v10 by
+  version, then refuses each construct it does not render with its own code (below). v11 or newer is
+  `CLI-RENDER-004`; direct Stage reports `STAGE-ESM-016`.
 - **Render never builds, tests or runs** the output. A published render is admission and
   publication only; build and tests are separate results (see "Verify"). Admission can be
   green while a rendered Debug test fails (the example hit this with a query assertion).
@@ -138,48 +148,43 @@ Facts that surprise:
 - `cratis render` and `cratis screenplay validate` are different gates: a model can
   validate and still refuse here.
 
-## Historical Stage 4.24 admission
-
-CLI 3.50.0/Stage 4.67.0 reaches construct checks through v10; v11 gets
-CLI-RENDER-004 (direct Stage: STAGE-ESM-016). Public/foreign events, reaction
-identity/filters and production overrides still refuse. Reducer filters render.
-Read [admission](references/admission.md) for STAGE-ESM-032–036 and previous
-CLI/version boundaries. Source acceptance is not V5; keep contracts for gap-fill.
-
-The following detailed 4.24.x probes are historical, not current pin claims.
-
-Whole-model admission needs ESM schema v1 to v4; v5 and v6 are `STAGE-ESM-016`. Stage 4.24.2 admits ESM v4 (Screenplay compiles a model with evolved events to v4): an event at its initial revision renders exactly as before, but any selected event above the initial revision, and every scope depending on it (a command producing it, a projection or reducer observing it, a specification using it), is refused with `STAGE-ESM-026` and nothing is emitted. A typed-context reference to a historical revision or property identity is refused with `STAGE-ESM-025`. Stage cannot render Chronicle event-type migrations yet (Cratis/Stage#204, which depends on Cratis/Screenplay#71), and Stage's runtime (`cratis run`, the Host) still refuses evolved events, so deliver evolved events as gap-fill. Stage 4.24.1 also lists the ESM v6 members (reactions, captures, application triggers, clock and capture specifications) as rejected `STAGE-ESM-024` in its surface ledger, but the version gate refuses the model first, so a v6 model reports `STAGE-ESM-016` only. The bundled Stage 4.24.2 (cratis 3.28.3) reports an evolved event with `STAGE-ESM-026` only (probed); cratis 3.28.2 bundled Stage 4.24.1 (3.28.1 and earlier: 4.24.0), refused a v4 model with `STAGE-ESM-016` and also reported `CLI-RENDER-003`. The admitted vertical:
-
-- concepts, composite types, collections and optional values;
-- `StateChange` slices with exactly one command and an unconditional `produces` whose
-  `for` is the command identifier, with portable validation;
-- `StateView` slices with exactly one projection (or reducer) per read model: a flat
-  `from` block, or a scoped projection (several `from`, `remove with`, root `join`,
-  one-level `children`, `nested`), keyed by the event source or an event property; and
-  any number of optional snapshot queries by the read-model identifier;
-- declarative authorization (including query authorization) that requires authentication;
-- unique constraints, and modeled specifications that fit the shapes in the reference;
-- reducers whose bodies pass the **pure** allowlist (Roslyn analysis).
-
-Not rendered: `Automation` and `Translate` slices (Stage#79, open: the whole automation
-is gap-fill), reactions and captures, list, observable, filtered and scoped queries,
-`produces when`, command `handler`s, code validation and opaque policies (they refuse),
-composite-key projections, `all`, and compliance attributes (`@pii`, `@sensitive`, which
-already fail binding with `PLAY0268`). Any one blocking diagnostic fails the whole plan.
-A refusal is not a licence to weaken the model: drop no specification, event generation
-or protection to get a render; keep the model, record the capability gap and gap-fill.
-The code table, the projection and specification rules and three refusals reproduced while
-building the example are in [references/admission.md](references/admission.md); the exhaustive ledger
-is `references/renderable-subset.md` in `cratis-screenplay-toolchain`.
-Read `cratis-screenplay-toolchain/references/renderable-subset.md` when you need the exhaustive surface ledger beyond the admission summary.
-
-Descriptions and documentation are never rendered, so a rule that exists only in prose
-is not enforced in the generated code.
+## Current admission (Stage 4.73.1)
+
+Source reading, not a render run. One blocking diagnostic fails the whole selected scope and
+publishes nothing. Codes and fixes: [references/admission.md](references/admission.md); the
+exhaustive ledger is `cratis-screenplay-toolchain/references/renderable-subset.md`.
+
+- **Renders:** concepts, composite types, collections, optionals; `StateChange` slices (one command,
+  unconditional `produces`, portable validation); `StateView` slices with flat or scoped
+  projections and pure reducers (reducer `from` filters render); keyed optional snapshot queries and
+  **observable** list queries (keyed or unkeyed); authorization (role-only, authenticated, opaque
+  pure policies, claim conditions, `not`/and/or; roles read through the identity's `RoleClaimType`);
+  unique constraints; named event sources, streams and routes (ESM v8); case tables; whole numbers
+  as `long`; modeled specifications as Debug xunit classes; authored UI through Scene.
+- **Refused with a code:** `Automation` and `Translate` slices, reactions, captures, triggers and clock
+  specifications (`STAGE-ESM-024`); a reaction that both produces events and invokes commands
+  (`STAGE-ESM-037`); generated command values (`-028`) and responses (`-029`); `then no readmodel` (`-027`);
+  evolved events (`-026`); public events and event-target projections (`-032`); foreign origins and
+  event-source captures (`-033`); reaction `runsAs`, `from` filters and per-production route overrides
+  (`-034`, `-035`, `-036`); code validation (`-005`); a non-observable list query (`-010`);
+  `produces when`, composite-key projections, `all`. Reducer filters render. The CLI/Stage pair reaches
+  construct checks through v10; a bound v11 model is `CLI-RENDER-004`.
+- **Refused at binding (`PLAY0268`/`PLAY0271`):** `reads`, `concurrency`, command `handler`s,
+  `filter`, `scoped to`, `performer` and composite `by` queries, `pii`/`secret` compliance markers.
+
+A refusal is not a licence to weaken the model: drop no specification, event generation or
+protection to get a render; keep the model, record the capability gap and gap-fill. The 4.24-era
+admission (ESM v1 to v4, keyed optional queries only) is kept as history in `references/admission.md`.
+
+**Descriptions and documentation render only as XML documentation comments** (`<summary>`,
+`<remarks>`; Stage#178 closed), never as validation, authorization or behavior, so a rule that exists
+only in prose is not enforced. A documentation edit changes managed-file hashes (a `--check` exit
+`6`), and characters invalid in XML block rendering with `CLI-RENDER-005`.
 
 ## What it emits
 
 At application scope the plan holds the scaffold plus the modeled artifacts, for the
-example 30 files: a `.csproj` and `.slnx`, `Program.cs`, `appsettings.json`,
+example 30 files on cratis 3.28.2 (56 observed on 3.53.1): a `.csproj` and `.slnx`, `Program.cs`, `appsettings.json`,
 `docker-compose.yml`, the Directory props files, a policy registration and generated
 policies, `Common/<Concept>.cs`, one `<Module>/<Feature>/<Slice>/` folder per slice with
 the `[Command]` record and `Handle()`, the `[EventType]` event, the validator and the
@@ -198,14 +203,14 @@ Stage 4.59.0+ expands a case table to effective `<Specification>_<Case>` names
 and one generated class per case; normalized path collisions refuse the plan
 with `STAGE-CRATIS-004`. Failed case results include the case and effective fixtures.
 Stage 4.61.0+ renders whole numbers as `long` from ESM v8, retains `int` below
-v8 and refuses out-of-`int` literals there with `STAGE-ESM-031`. CLI 3.50.0's
-Stage 4.67.0 default applies both rules. Previous CLI 3.46.1's
+v8 and refuses out-of-`int` literals there with `STAGE-ESM-031`. The pinned Stage default applies both rules;
+pins: toolchain `references/versions.md`. Previous CLI 3.46.1's
 Stage 4.52.0 renderer applies neither new rule. Read
 [case tables and whole numbers](references/case-tables-and-whole-numbers.md)
 for complete examples, stored-schema consequences and the sandbox-only `--tag` override.
 
 For UI, record what the generated output claims separately from what the model
-authored. On Stage 4.24 the generated scaffold is not screen parity evidence.
+authored. Before CLI 3.40.7 the generated scaffold was not screen parity evidence.
 On public CLI 3.43.0 / `cratis/stage:4.52.0` the canonical corpus publishes,
 `scene.json` contains Arc `commandForm` components, `src/bindings.ts` registers
 the modeled commands and queries, and the browser acceptance run passes. That is
@@ -221,7 +226,9 @@ API on `9090`, Chronicle Workbench on `https://localhost:35000`. It is a **parti
 disposable runtime**, not a generated application. The default engine appends modeled
 `produces` facts and echoes the payload but enforces no modeled validation or
 authorization and no query authorization; `Stage__Runtime__Engine=semantic` opts in to
-an engine that does, and refuses what it cannot execute (HTTP 501). Callers are built
+an engine that does, and refuses what it cannot execute (HTTP 501). At Stage 4.73.1 the default
+engine also refuses routed models (`STAGE-ESM-030`) and the structural runner is deprecated (details:
+the sandbox reference). Callers are built
 from unsigned headers, so authorization there is not a security boundary.
 
 `cratis/stage-specrunner` checks modeled specifications and writes a results file. The
@@ -234,7 +241,8 @@ Read `references/sandbox-and-specrunner.md` before launching either container or
 ## Verify
 
 - `cratis render` exits 0 and reports `recovered: false`, with `written + unchanged`
-  equal to the artifact count; otherwise the render is not a result.
+  equal to the artifact count (for `--scope`, the scope's artifacts); otherwise the render is not a
+  result. State the scope in the V5 report.
 - Report V5 as separate results, each a result or "not run": admission, publication,
   Debug build (`dotnet build <destination>/<Project>.csproj -c Debug`), Debug tests
   (`dotnet test` on the same project) and runtime. Render alone is the first two.

package/package/corpus/skills/cratis-stage-rendering-and-sandbox/references/admission.md

@@ -1,4 +1,4 @@
-# Historical Stage 4.24 admission: codes, specification rules and observed refusals
+# Stage admission: codes, specification rules and observed refusals
 
 ## Contents
 
@@ -8,12 +8,17 @@
 - Specification rules (`STAGE-ESM-011`)
 - Observed refusals
 - Source disagreements (trust the code)
+- Historical Stage 4.24 admission
 
-Current pins are in `cratis-screenplay-toolchain` `references/versions.md`:
-Standalone Screenplay is 4.135.0; CLI 3.50.0 bundles Stage 4.67.0 / Screenplay
-4.131.0 / Arc.Screenplay 22.54.0 / Chronicle 19.32.0 / Fundamentals 7.22.8.
-It admits through ESM v10 to construct planning; above v10 is CLI-RENDER-004.
-Stage 4.67.0 `SemanticVersionFeatures`/`SemanticVersionFeatureAdmission` refuse
+Current pins: `cratis-screenplay-toolchain/references/versions.md`. The current statements here
+were read at Stage `v4.73.1` (`Documentation/guides/build-renderer-target.md`,
+`SemanticVersionFeatures.cs`, `SemanticCratisAdmission*.cs`) and cli `v3.53.1`; the rows and
+sections marked *historical* or naming Stage 4.24 or cratis 3.27/3.28 are earlier probes kept as
+history. Stage 4.73.1 admits ESM v1 to v10 by version, and the CLI 3.53.1 bundle (Screenplay
+4.137.0) binds through v10 for rendering.
+The pinned CLI admits through ESM v10 to construct planning; a bound newer model
+gets CLI-RENDER-004. Binding with the bundled compiler is a separate prerequisite.
+The pinned Stage's `SemanticVersionFeatures`/`SemanticVersionFeatureAdmission` refuse
 public publication (STAGE-ESM-032), foreign events/events-source captures (033),
 reaction identity (034), reaction filters (035) and production overrides (036).
 Reducer filters render. ESM v8 routes have construct checks including refusal of
@@ -26,8 +31,8 @@ checks are CLI `RenderedSemanticVersions.Newest` and Stage
 parser rejected `runs as` with PLAY0137; that is not a current parser refusal.
 The historical CLI 3.41.0 v7 canonical-corpus planning spec received
 STAGE-ESM-028/029 for generated values/responses.
-The detailed 4.24.x source/probe rows below have not been relabeled as current
-runtime verification; run admission on the actual bundled renderer.
+The detailed 4.24.x source/probe rows below are historical unless a row says 4.73.1; run
+admission on the actual bundled renderer.
 
 Read at Stage `v4.24.0`, re-read at `v4.24.1` and `v4.24.2` (`SemanticCratisAdmission.EventRevisions.cs`, `SemanticEventLineageAdmission.cs`, ESM v4 section of `Documentation/guides/build-renderer-target.md`) (`Source/Rendering.Cratis/Semantics/SemanticSurfaceLedger.cs`, `Documentation/guides/build-renderer-target.md`; 4.24.1 changed only the ledger, dependency pins and the Dockerfile) (`Source/Rendering.Cratis/CratisArtifactRenderPlanner.cs`,
 `Semantics/SemanticCratisAdmission*.cs`, `SemanticSpecificationAdmission*.cs`,
@@ -63,25 +68,38 @@ model owner's decision.
 | `STAGE-ESM-005` | Code validation or rule predicate bodies; or a command beyond the first capability (optional event property, event revision other than the first, validation or requirement that cannot be rendered, no `produces`) | Use declarative validation; non-initial event generations are not rendered |
 | `STAGE-ESM-006` | `produces` that cannot render without changing its destination or mappings (`produces when`, literal or computed mappings, `for` not a command identifier, mappings not one-to-one with event properties, duplicate tags) | Map properties one to one; conditional outcomes (`produces when`) are a different behavior, so gap-fill unless the owner accepts splitting them into commands |
 | `STAGE-ESM-007`, `-008`, `-009` | Projection count per read model (exactly one projection or reducer each); unresolvable properties or no single read-model transition (**flat** projections only); affected instance not one, not keyed by an event property, or not the event-source identity (flat projections only) | One projection per read model; see "Projections" below |
-| `STAGE-ESM-010` | A query is not an optional snapshot lookup by the read-model identifier (or its argument concept has validation); each query is checked on its own, so several such queries are admitted | Keyed `XById => X optional` queries; lists, observable and filtered queries are gap-fill |
+| `STAGE-ESM-010` | A query is neither an optional snapshot lookup by the read-model identifier nor an observable collection query (a snapshot list, or an argument concept with validation); each query is checked on its own. Observable list queries (keyed or unkeyed) render since Stage 4.49.0 | Keyed `XById => X optional` queries or `observable` lists; a snapshot list is gap-fill. `filter`, `scoped to`, `performer` queries do not bind (`PLAY0268`) |
 | `STAGE-ESM-011` | A specification cannot render (see the rules below) | Reshape it only if the assertion keeps its meaning; otherwise keep the specification, record the gap, and gap-fill with the specification as the oracle. Never weaken or delete it to get a render |
 | `STAGE-ESM-012` | Generated C# names collide (properties, types, namespaces, constraints) | Rename |
 | `STAGE-ESM-013` | An event-context value other than `$context.occurred` mapped in `produces` | Map a command property when that preserves the meaning; otherwise gap-fill |
 | `STAGE-ESM-014` | A constraint Chronicle cannot reproduce (kind, scope, message; multi-claim in one command; optional or composite targets) | A different constraint is a requirement change for the model owner; otherwise gap-fill |
-| `STAGE-ESM-015` | Authorization Stage cannot render exactly: opaque (code) policy, role-claim URI, expression not requiring authentication, claim compared with a non-text value, authorized command without exactly one identifier | `require authenticated and ...`; text-backed claim targets |
-| `STAGE-ESM-016` | Model language or semantic version is not ESM v1 to v4 (Stage 4.24.2; 4.24.1 and earlier: v1 to v3, so a v4 model was refused here); v5 and later constructs raise the version (v6 reactions and clocks; v7 generated values and responses, tracked in Stage#201) | Not fixable by editing: the model needs a newer renderer. Keep the model, record the gap, gap-fill |
+| `STAGE-ESM-015` | Authorization Stage cannot render exactly (4.73.1): a role-claim URI, an opaque policy nested inside a condition, an unresolved or non-portable policy, no single identifier, an opaque-policy subject that is not text, Uuid, Date or DateTime (Stage 4.73.1 `IsTextualSubject`; a restriction on opaque-policy subjects, separate from declarative claim targets), an unsupported claim artifact. Role-only, authenticated, opaque pure policies, claim conditions with Uuid, Date, DateTime or text targets (numeric and Boolean claim matches render as always false; Stage 4.73.1 `IsSupportedClaimPath`) and `not`/and/or render; roles are read through the identity's `RoleClaimType` | Reshape the policy to a portable condition; otherwise gap-fill. *Historical (4.24/3.27.1):* a role alone, an opaque policy or a Uuid-backed claim were refused here |
+| `STAGE-ESM-016` | Model language or semantic version is above ESM v10 (Stage 4.73.1 admits v1 to v10 by version; the CLI reports `CLI-RENDER-004` for v11 or newer first). *Historical:* Stage 4.24.2 admitted v1 to v4 and 4.24.1 and earlier v1 to v3 | Not fixable by editing: the model needs a newer renderer. Keep the model, record the gap, gap-fill |
 | `STAGE-ESM-017` | Read model or projection cannot render (property names that collide with Chronicle paths or expression syntax, mappings that overwrite the key or child identity, composite keys, `all`, the refused scope shapes below) | Reshape the projection without changing what it records, or record the gap |
 | `STAGE-ESM-018` | `$strings.` key missing in the default locale or containing formatting characters | Fix the strings |
 | `STAGE-ESM-019` | Reducer structure or body not admitted (outside a `StateView`, impure, does not compile) | An equivalent pure body, or gap-fill |
 | `STAGE-ESM-020` | Implementation body missing, changed (hash differs) or refused by the loader | Provide the body inside the model root |
 | `STAGE-ESM-021`, `-022` | Reducer typed-context or analysis failure; a construct outside the pure allowlist, or a generated name shadowing a reducer type | An equivalent pure body, or gap-fill |
 | `STAGE-ESM-025` | Typed context references a historical event revision or a historical property identity (Stage 4.24.2); checked before `-026` | Reference the current revision; a historical reference is not renderable, so gap-fill |
-| `STAGE-ESM-026` | A selected event, or an event a selected slice depends on (producing command, observing projection or reducer, specification, constraint target), is above its initial revision (Stage 4.24.2): `Event 'X' has evolved to revision N; Stage does not render event migrations yet.` The whole selection is refused, nothing is emitted | Not fixable by editing without dropping the evolution. Stage#204 (needs Screenplay#71) tracks migration rendering; gap-fill the evolved events and hand-write the migrations (`cratis-chronicle-event-type-migration`). A scoped slice of initial events that depends on no evolved event still renders |
-| `STAGE-ESM-024` | Ledger-only (4.24.1): every ESM v6 surface member is dispositioned Rejected. Not emitted on its own: the version gate raises `STAGE-ESM-016` first and refuses the whole v6 model | As `STAGE-ESM-016`: keep the model, record the gap, gap-fill |
+| `STAGE-ESM-026` | A selected event, or an event a selected slice depends on (producing command, observing projection or reducer, specification, constraint target), is above its initial revision (still refused at Stage 4.73.1): `Event 'X' has evolved to revision N; Stage does not render event migrations yet.` The whole selection is refused, nothing is emitted | Not fixable by editing without dropping the evolution. Stage#204 (needs Screenplay#71) tracks migration rendering; gap-fill the evolved events and hand-write the migrations (`cratis-chronicle-event-type-migration`). A scoped slice of initial events that depends on no evolved event still renders |
+| `STAGE-ESM-024` | ESM v6 and v9 constructs Stage 4.73.1 does not render: application triggers, interval, schedule, application, startup and shutdown triggers, opaque reaction bodies, every event-triggered reaction, captures, `Automation` and `Translate` slices (including directed Translate), and specifications with a clock, trigger or capture. The renderer, Host and specification executor refuse every reaction model | Keep the model; hand-write the automation or translation (gap-fill) with the model as the contract |
+| `STAGE-ESM-027` | A specification asserting a read model is absent (`then no readmodel`, ESM v5) is not rendered by the renderer (the semantic specification engine executes keyed absence) | Keep the specification; verify absence another way and record the gap |
+| `STAGE-ESM-028`, `-029` | Generated command property values and generation fixtures (ESM v7); command responses and `then returns` expectations (ESM v7) (Stage#175, also reached by `cratis screenplay generate` output from Arc 22.52.0) | Keep the model; gap-fill |
+| `STAGE-ESM-030` | Named event-source or stream definition with a reserved stored name; unformattable routed fixtures; routed read-model or query replay in an unsupported shape. The default sandbox engine also reports it for every routed model | Rename the reserved name; render the model with `cratis render`, not `cratis run` |
+| `STAGE-ESM-031` | Whole-number literal outside the C# `int` range below ESM v8 (v8 and later render `long`) | Raise the model to v8 constructs or gap-fill |
+| `STAGE-ESM-032`, `-033` | Public events and event-target projections or reducers (ESM v9); foreign event origins and event-source captures | Gap-fill |
+| `STAGE-ESM-034`, `-035`, `-036` | Reaction `runsAs` (ESM v10), reaction observer `from` filters, per-production route overrides (reducer `from` filters render) | Gap-fill |
+| `STAGE-ESM-037` | A reaction trigger that both produces events and invokes commands (ESM v6). A Stage refusal (Stage#207), not an Arc or language limit: Arc 22.72.0 and later run one reactor that returns events and commands (events appended first as one batch, then commands in order, no cross-effect transaction) | **Do not split the modeled reaction or drop `produces`/`invokes`.** Keep it and gap-fill it as one reactor on Arc 22.72.0 or later (the scaffold pins 22.68.0, whose command handler accepts a collection only when every element is a command; a rendered app needs a proven dependency override; see `rendered-application.md`) |
 | `STAGE-ESM-023` | Information: transition bodies analysed | none |
 | `STAGE-CRATIS-001` to `-005` | Profile or `scene.json` not the package-owned shape; unrecognized or missing scaffold input; artifact path collision; a modeled module or feature that would render into the reserved `Customizations/` | Rename the module or feature (005) |
 | `STAGE-AUTH-001` | Authorization cannot be rendered faithfully | As `STAGE-ESM-015` |
 | `CLI-RENDER-001`, `-002` | Unknown target; invalid rendering name (`CLI-RENDER-003`, event generations, was reported by cratis 3.28.2 only) | Fix the option, or the model |
+| `CLI-RENDER-004` | The bound model is ESM v11 or newer | Not fixable by editing: keep the model, gap-fill |
+| `CLI-RENDER-005`, `-006` | Authored metadata with characters invalid in XML blocks rendering of XML doc comments; a document set that cannot be read as a workspace renders without comments (warning) | Remove the invalid characters |
+| `CLI-RENDER-007` to `-010` | `ui profile` refusals (package set, profile shape) | See `--package-set` |
+| `CLI-RENDER-011` to `-014` | `--scope`: unknown address; ambiguous feature and slice name; aggregate or unrecognized policy layout (render the whole application once); a dependency not in the manifest or the scope | Fix the address or add the owning scope |
+
+`CLI-RENDER-015` (navigation properties) is retired since Stage 4.73.1.
 
 `STAGE-CRATIS-FILE-001`, `-INLINE-001`, `-QUERY-001`, `-KEY-001`, `-KEY-002`,
 `-PROJECTION-001` and `STAGE-EVENT-001` come from the legacy syntax renderer and the direct
@@ -163,7 +181,7 @@ context, no directives, no writes to statics, `throw` limited to
 pure expressions, and no generated type shadowing a referenced one. Anything else is
 `STAGE-ESM-019`, `-021` or `-022`. A reducer needs a `StateView` slice, its read model in the
 same slice, a required Guid or text identifier and a matching keyed query. Code validation
-(`STAGE-ESM-005`) and opaque policies (`STAGE-ESM-015`) are refused outright, and a command
+(`STAGE-ESM-005`) is refused outright (opaque pure policies render at 4.73.1), and a command
 `handler` never binds (`PLAY0268`). Reducer rendering was read, not run, for this skill.
 
 ## Specification rules (`STAGE-ESM-011`)
@@ -181,13 +199,13 @@ From `SemanticSpecificationAdmission*.cs`; the first rule was also observed.
   when a read-model or reducer expectation must replay them, which needs distinct
   contracts), `then readmodel`, `then query` (one result, scalar key), `then error` naming a
   rendered constraint or an authored message, `then denied`.
-- Refused: `then no readmodel`, `when append`, composite values, `given readmodel` beside a
+- Refused: `then no readmodel` (`STAGE-ESM-027`), an unauthenticated caller carrying roles or claims (`STAGE-ESM-011`), `when append`, composite values, `given readmodel` beside a
   command, error codes that name no rendered constraint, a `$context.occurred` mapping
   asserted without a supplied time, a query on a reducer-built read model, a protected
   query whose fixtures use streams other than the queried key.
 - A when-less specification is admitted only as `then denied` on an authorized keyed
   query, or `given readmodel` plus `then query` on an unprotected query.
-- Descriptions, comments and prose are never rendered.
+- Descriptions and event documentation render only as XML doc comments (Stage 4.73.1); comments are never rendered; neither is behavior.
 
 ## Observed refusals
 
@@ -207,3 +225,34 @@ Each came from the first draft of the example model, rendered with cratis 3.27.1
 | cli reference: bodied reducers are unsupported (`STAGE-ESM-019`) | `PureTransitionAdmission` admits pure allowlisted bodies |
 | Stage customization guide: an Automation slice blocks with `STAGE-ESM-001`; Stage pins Screenplay 4.35.0 | With cli 3.27.1 an Automation or Translate slice failed binding (`PLAY0268`) first; with cli 3.28.2 it binds and Stage refuses the whole model with `STAGE-ESM-016` (probed). Stage 4.24.0 pinned Screenplay 4.60.0 (4.24.1: 4.66.0) |
 | An earlier version of this skill: Stage has no authorization contract for queries | Query authorization is admitted and rendered; an unauthorized query renders `[AllowAnonymous]` (observed) |
+
+## Historical Stage 4.24 admission
+
+Kept as history. Not a statement about the current Stage (see the 4.73.1 summary in `SKILL.md` and the diagnostic codes above).
+
+Whole-model admission needs ESM schema v1 to v4; v5 and v6 are `STAGE-ESM-016`. Stage 4.24.2 admits ESM v4 (Screenplay compiles a model with evolved events to v4): an event at its initial revision renders exactly as before, but any selected event above the initial revision, and every scope depending on it (a command producing it, a projection or reducer observing it, a specification using it), is refused with `STAGE-ESM-026` and nothing is emitted. A typed-context reference to a historical revision or property identity is refused with `STAGE-ESM-025`. Stage cannot render Chronicle event-type migrations yet (Cratis/Stage#204, which depends on Cratis/Screenplay#71), and Stage's runtime (`cratis run`, the Host) still refuses evolved events, so deliver evolved events as gap-fill. Stage 4.24.1 also lists the ESM v6 members (reactions, captures, application triggers, clock and capture specifications) as rejected `STAGE-ESM-024` in its surface ledger, but the version gate refuses the model first, so a v6 model reports `STAGE-ESM-016` only. The bundled Stage 4.24.2 (cratis 3.28.3) reports an evolved event with `STAGE-ESM-026` only (probed); cratis 3.28.2 bundled Stage 4.24.1 (3.28.1 and earlier: 4.24.0), refused a v4 model with `STAGE-ESM-016` and also reported `CLI-RENDER-003`. The admitted vertical:
+
+- concepts, composite types, collections and optional values;
+- `StateChange` slices with exactly one command and an unconditional `produces` whose
+  `for` is the command identifier, with portable validation;
+- `StateView` slices with exactly one projection (or reducer) per read model: a flat
+  `from` block, or a scoped projection (several `from`, `remove with`, root `join`,
+  one-level `children`, `nested`), keyed by the event source or an event property; and
+  any number of optional snapshot queries by the read-model identifier;
+- declarative authorization (including query authorization) that requires authentication;
+- unique constraints, and modeled specifications that fit the shapes in the reference;
+- reducers whose bodies pass the **pure** allowlist (Roslyn analysis).
+
+Not rendered: `Automation` and `Translate` slices (Stage#79, open: the whole automation
+is gap-fill), reactions and captures, list, observable, filtered and scoped queries,
+`produces when`, command `handler`s, code validation and opaque policies (they refuse),
+composite-key projections, `all`, and compliance attributes (`@pii`, `@sensitive`, which
+already fail binding with `PLAY0268`). Any one blocking diagnostic fails the whole plan.
+A refusal is not a licence to weaken the model: drop no specification, event generation
+or protection to get a render; keep the model, record the capability gap and gap-fill.
+The code table, the projection and specification rules and the refusals reproduced while
+building the example are in the sections above; the exhaustive ledger
+is `references/renderable-subset.md` in `cratis-screenplay-toolchain`.
+Read `cratis-screenplay-toolchain/references/renderable-subset.md` when you need the exhaustive surface ledger beyond the admission summary.
+
+(At 4.24 descriptions and documentation were not rendered at all; since Stage#178 they render as XML doc comments only. Prose is still never enforced behavior.)

package/package/corpus/skills/cratis-stage-rendering-and-sandbox/references/case-tables-and-whole-numbers.md

@@ -12,8 +12,8 @@
 
 ## CLI default versus Stage release
 
-CLI 3.50.0 bundles Screenplay 4.131.0 and Stage 4.67.0. Its default renderer
-applies case-table support introduced in Stage 4.59.0 and the whole-number rule
+Current CLI/compiler/Stage pins: `cratis-screenplay-toolchain/references/versions.md`.
+The pinned default renderer applies case-table support introduced in Stage 4.59.0 and the whole-number rule
 introduced in 4.61.0: v8+ whole numbers use `long`, earlier versions keep `int`.
 CLI and Stage admit through v10 to construct checks; newer versions receive
 CLI-RENDER-004 before planning (direct Stage: STAGE-ESM-016).

package/package/corpus/skills/cratis-stage-rendering-and-sandbox/references/render-example.md

@@ -98,7 +98,7 @@ module Berths
 Why it is shaped this way:
 
 - Each command has one unconditional `produces`, with a typed `for` on the identifier.
-- The policy requires authentication as well as the role; a role alone is `STAGE-ESM-015`.
+- The policy requires authentication as well as the role. (On cratis 3.27.1 a role alone was refused with `STAGE-ESM-015`; Stage 4.73.1 renders a role-only policy, reading roles through the identity's `RoleClaimType`. The authenticated form still renders.)
 - The projection has a `from` and a `remove with`, so Stage renders it as a scoped
   projection keyed by the event source. The identifier is never mapped: the key
   establishes it, and mapping it is `STAGE-ESM-017`.
@@ -110,6 +110,8 @@ Why it is shaped this way:
 
 ## What was run
 
+**Re-probed on cratis 3.53.1 (Stage 4.73.1; admission and publication only, build and tests not re-run):** the model compiles with the standalone 4.139.0 tool, its 3 specifications pass in the reference runner, and `cratis render` exits 0 with 56 artifacts written to a scratch destination (the plan grew with the scaffold). The counts and results in the table below are the cratis 3.28.2 observations.
+
 All with cratis 3.28.2 (re-run end to end from 3.27.1: same counts; admission and publication re-run on 3.28.3 with Stage 4.24.2: the same 30 artifacts) on a folder holding only `berths.play`:
 
 | Step | Command | Result |

package/package/corpus/skills/cratis-stage-rendering-and-sandbox/references/rendered-application.md

@@ -1,25 +1,36 @@
 # The rendered application: scaffold, managed files and `Customizations/`
 
-Read at Stage `v4.24.0` (`Scaffolding/CratisBackendApplicationScaffold*.cs`,
+## Contents
+
+- Scaffold pins
+- What is managed
+- `Customizations/` (unmanaged)
+- Re-render checklist
+
+Read at Stage `v4.24.0`, with the scaffold pins re-read at `v4.73.1` (`Scaffolding/CratisBackendApplicationScaffold*.cs`,
 `CratisFrontendApplicationScaffold.cs`, `README.md`,
 `Documentation/guides/customize-rendered-application.md`) and checked against a real
 render (see [render-example.md](render-example.md)).
 
 ## Scaffold pins
 
-The pin rows below are source-checked at Stage `v4.51.3`,
-`Source/Rendering.Cratis/Scaffolding/CratisBackendApplicationScaffoldProfile.cs`,
-`CratisBackendApplicationScaffold.cs` and `CratisFrontendPackageSet.cs`.
-Earlier runtime/customization probes above keep their original labels.
+The pin rows below are source-checked at Stage `v4.73.1` (the Stage in CLI 3.53.1),
+`Source/Rendering.Cratis/Scaffolding/CratisBackendApplicationScaffoldProfile.cs` (`Current`),
+`CratisBackendApplicationScaffold.cs` and `CratisFrontendPackageSet.cs` (`Current`; read the
+`Current` argument list, because the class summary still quotes older Scene and Components
+versions). The scaffold pins an exact release per package and lags the latest releases by design
+(Arc 22.72.0 and Chronicle 19.50.0 were current when this was checked); moving them is a Stage
+change, so a re-render under a newer Stage is how they change. Earlier runtime/customization
+probes above keep their original labels.
 
 | Item | Value |
 | --- | --- |
 | Target framework | .NET 10 (`net10.0`), `Microsoft.NET.Sdk.Web` |
-| Arc packages (`Cratis`, `Cratis.Arc.MongoDB`, Arc testing) | `22.50.5` |
-| Chronicle client | `Cratis.Chronicle`, `.AspNetCore` and `.Testing` `19.32.0`, matched to the `cratis/chronicle:19.32.0-development` image in the compose file |
+| Arc packages (`Cratis`, `Cratis.Arc.MongoDB`, `Cratis.Arc.Chronicle.Testing`) | `22.68.0` (below Arc 22.70, so reverse-generator compliance diagnostics and the like are not in the scaffold; reactors returning events and commands need Arc 22.72.0 or later, so a hand-written mixed reactor in a rendered app needs a proven dependency override; Arc 22.68.0's handler accepts a collection only when every element is a command) |
+| Chronicle client | `Cratis.Chronicle`, `.AspNetCore` and `.Testing` `19.45.0`, matched to the `cratis/chronicle:19.45.0-development` image in the compose file |
 | Embedded reverse extraction | `CratisEmbeddedScreenplayEnabled=false`: the source `.play` is authoritative |
-| Test packages | xunit, NSubstitute, Cratis.Specifications; **Debug configuration only** (`IsTestProject` when Debug) |
-| Frontend | Vite and React, Components `4.14.0`, Scene `4.10.0`, Fundamentals `7.19.8` |
+| Test packages | `Cratis.Specifications` and `.XUnit` 4.1.1, Microsoft.NET.Test.Sdk 18.10.1, NSubstitute 6.2.0, xunit 2.9.3, xunit runner 4.0.0; **Debug configuration only** (`IsTestProject` when Debug) |
+| Frontend | Vite 8.3.0 and React 19.3.0; `@cratis/arc`, `arc.react`, `arc.vite` 22.58.2; `@cratis/components` 4.26.2; `@cratis/scene` 4.21.0; `@cratis/fundamentals` 7.22.8 |
 | Package management | central package management **off**; `Directory.Packages.props` is managed, do not edit it |
 
 Consequences: `[ProtectedDecision]` (`Cratis.Arc.Chronicle.ReadModels`) and
@@ -27,10 +38,13 @@ Consequences: `[ProtectedDecision]` (`Cratis.Arc.Chronicle.ReadModels`) and
 in this scaffold's package set, as is `[ExecuteCommandsAsSystem]`. This is API
 availability, not Stage emission or runtime protection: gap-fill must opt into
 the protected command profile and enroll an admitted projection/key read in the
-active unit of work. Source-checked at Arc v22.50.5 `ProtectedDecisionAttribute.cs`
-and `CommandDecisionReads.cs`, Chronicle v19.32.0 `DecisionRead.cs`/`IDecisionReads.cs`.
+active unit of work. Source-checked at Arc v22.72.0 `ProtectedDecisionAttribute.cs`
+and `CommandDecisionReads.cs`, Chronicle v19.50.0 `DecisionRead.cs`/`IDecisionReads.cs`.
 Stage does not turn `.play` `reads`/`require` into protected decisions. Upgrading Arc or Chronicle inside a rendered application is a re-render under a newer
-Stage, not an edit of the managed files. The compose file binds local ports `27017` and
+Stage, not an edit of the managed files. Hand-written scope that needs a newer Arc (for example a
+reactor returning events and commands) can raise the version through `Customizations/Dependencies.props`
+(explicit `Version`, imported last; central management is off), but whether that override restores
+cleanly beside the managed 22.68.0 reference is **unverified**: prove it with a restore and build. The compose file binds local ports `27017` and
 `35000`, keeps data in the named volumes `chronicle-data` and `chronicle-config`, and
 `docker compose down --volumes` is the only thing that deletes them.
 
@@ -45,9 +59,10 @@ refused on the next render. The application identity from `--name` becomes the
 Chronicle event-store name in `appsettings.json` and the default project name and root
 namespace.
 
-Whether modeled `screen` declarations become faithful screens in the frontend was not
-verified. The scaffold is a working shell, and the customization guide says screens stay
-managed; do not claim UI fidelity from a published render.
+Whether modeled `screen` declarations become faithful screens is a runtime question, not a
+publication result: the Stage 4.73.1 scaffold emits Arc `CommandForm` shells over Scene typed
+bindings and navigation contributions, but claim UI fidelity only from a browser run
+(`SKILL.md`, UI parity). Screens stay managed.
 
 ## `Customizations/` (unmanaged)
 

package/package/corpus/skills/cratis-stage-rendering-and-sandbox/references/sandbox-and-specrunner.md

@@ -1,10 +1,30 @@
 # The `cratis/stage` sandbox and the `cratis/stage-specrunner` job
 
-Read at Stage `v4.24.0` (`README.md`, `Documentation/docker/index.md`,
+## Contents
+
+- Current behavior at Stage 4.73.1 (source reading; Docker not run)
+- The sandbox: a partial, disposable runtime
+- The specification runner
+- Choosing between them
+
+Read at Stage `v4.24.0`, then re-read for the current paragraph below at `v4.73.1` (`README.md`, `Documentation/docker/index.md`,
 `Documentation/docker/spec-runner.md`, `Documentation/reference/urls.md`) and cli
 `v3.28.2` (`Commands/Run/*`, unchanged since `v3.27.1`). Docker was **not run** for this skill: every behaviour here
 is documented behaviour, not an observed result. Both images are still shipped.
 
+## Current behavior at Stage 4.73.1 (source reading; Docker not run)
+
+Read from `Documentation/docker/index.md` and `docker/spec-runner.md` at `v4.73.1` and the CLI
+3.53.1 reference. The default EventModel engine refuses named event sources, streams and routes
+with `STAGE-ESM-030` (`/stage/status` reports `state: "unsupported"` and `/api/**` answers 501),
+so `cratis run` does not run a routed model: render it with `cratis render`. Both engines refuse
+public events (`-032`), foreign or source-event captures (`-033`) and reaction identity, filters
+and overrides (`-034` to `-036`); reactions are refused (`-024`, `-037`). The semantic engine admits
+ESM v1 to v10 version pairs and executes routes. The structural specification runner is deprecated:
+it prints a deprecation notice, refuses routes with exit 1 and writes no results file. Exit codes
+`0`/`1`/`2` are as in `SKILL.md`. The sections below describe the 4.24-era behavior and remain the
+engine comparison.
+
 ## The sandbox: a partial, disposable runtime
 
 `cratis/stage` is the Stage host plus an in-memory Chronicle kernel. Each session starts