@cratis/pi 7.62.0 → 7.63.0

package/package/corpus/skills/cratis-screenplay-model-authoring/SKILL.md

@@ -40,25 +40,18 @@ editing concept generation or `generated identifier`.
 
 ## When not to
 
-The same reference separates inputs, credentials and context/secret generation that is not available.
+For generation proofs/PLAY0688 repairs, read [generation details](references/mcp-tools.md#concept-generation):
+use `rules[]`, not parsed diagnostics (Requires Screenplay 4.173.0,
+`screenplay --version`; older servers omit proofs).
 
 ## Locate and connect
 
 Use the declared `screenplay` MCP server (for example `open-workspace`).
 
-Never ask the user which folder to use before trying. Call `open-workspace` with no
-arguments first: a server started without a fixed root binds the folder the host or
-launch directory offers (the client's single workspace root, else the working
-directory when it holds `.play` files). Only when it answers that no root was given,
-or that several roots are offered, pass `path`: the folder holding the project's `.play` files, otherwise the
-folder the user names. Without a project, the server works in `Documents/Screenplay`
-in the user's home folder, so do not invent a location. A root fixed at launch
-can switch only to the same model folder in a registered Git worktree of the
-same repository; rules and refusals are in [MCP loop](references/mcp-loop.md).
-
-Prefer a fixed root (dynamic-roots history: [MCP loop](references/mcp-loop.md)). Send `initialize` and
-`notifications/initialized` before any tool call, then discover `tools/list`
-schemas rather than relying on a remembered count.
+Never ask the user which folder to use before trying `open-workspace` without
+arguments; do not invent a root. Read [MCP loop](references/mcp-loop.md) when connecting or switching roots;
+it owns fallback discovery, fixed-root limits and the initialization protocol.
+Discover `tools/list` schemas rather than relying on a remembered count.
 
 
 Look first for the project's existing `.play` files: their folder is the model.
@@ -71,20 +64,12 @@ explanatory Markdown belongs in repository documentation.
 `mcp-servers.json` declares the Screenplay server; supported client registration
 is owned by the Cratis CLI, which preserves other servers and user configuration.
 
-The CLI entry point is:
-
-```shell
-cratis screenplay mcp <model-folder>
-```
+The CLI-bundled MCP can be older than the standalone tool: discover schemas.
+Read [MCP loop](references/mcp-loop.md) for launch options. Use the supported
+channel, not another global tool, Docker or copied managed configuration.
 
-The CLI-bundled MCP can be older than the standalone tool and lack newer capabilities, such as the generation summary and entropy repairs.
-Discover installed capabilities. Do not ask for a second global .NET tool, Docker
-or hand-copied managed MCP configuration. Installation/status must confirm adapter
-support and no conflicts.
-
-If the MCP is unavailable, report that gap. Do not claim compiler-validated AST
-editing while falling back to regex. Existing standalone `screenplay mcp` users
-can keep that entry point; use the project's supported installation channel.
+If MCP is unavailable, report it; regex edits are not compiler-validated AST
+editing. Existing standalone `screenplay mcp` users may retain that entry point.
 
 ## Understand before editing
 
@@ -96,7 +81,9 @@ can keep that entry point; use the project's supported installation channel.
    `kind: "Property"`, `Owner.member` / `Owner.generationN.member`, direct mappings.
    `complete: false` is incomplete evidence, never a successful empty list.
    Edit through MCP proposals, not hand-edited text; [generation](references/mcp-tools.md#concept-generation).
-3. Read diagnostics and coverage limitations. Use `dependency-graph` for container
+3. Read diagnostics and coverage limitations. Identify subjects by code and typed
+   `arguments`, never by parsing message text. Read [diagnostic arguments](../cratis-screenplay-toolchain/references/diagnostic-arguments.md)
+   for kinds, PLAY0524 step paths/indices, unknown fields and older responses. Use `dependency-graph` for container
    edges, declared-dependency coverage, cycles and advisory order; the board's
    dependency-map toggle exposes this evidence visually. Unknown or ambiguous
    bindings are not an empty, successful dependency graph.
@@ -114,6 +101,13 @@ Keep reads scoped to the relevant module, feature, slice or document. Do not
 request a whole merged AST when a bounded declaration/property query answers the
 question. Size-limit refusals require narrower reads, not truncation.
 
+## Application modes and described handler intent
+
+Start new models with `reaction batches atomic`; preserve it through proposals.
+Read [language admission](../cratis-screenplay-toolchain/references/language-admission.md)
+for atomic/protected modes and Stage refusals. Read [intent inventories](references/mcp-tools.md#dependencies-and-intent-inventories)
+for handler views: `executableReady` means binding, not an implemented body.
+
 ## Compare models
 
 For a `main` comparison, pass a worktree `path` to `semantic-diff`, not two

package/package/corpus/skills/cratis-screenplay-model-authoring/references/choosing-generation.md

@@ -7,14 +7,21 @@
 
 Follow the [threaded shop model](../../cratis-screenplay-command-surface/references/shop-generation.md):
 CustomerId (`cus_` + ULID), OrderId (TypeID) and InviteCode (NanoID) are released
-strategies. ApiKey stays secret without executable generation. Neither the
-OrderId's Arc received-time/tenant context nor ApiKey's .NET Bytes(32) secret
-factory can be promised as Screenplay generation today.
+strategies. InvoiceNumber uses a readable pattern/checksum and TicketNumber an
+Int pickup-ticket range. ApiKey stays secret without executable generation.
+An attached generation rule can use Now/Tenant, but the reference runner consumes
+pinned Strings rather than executing its implementation.
 
 For a server-owned new value, choose implicit UUID for an ordinary identity,
 UUIDv7 for time-ordered UUIDs, ULID for compact time-ordered text, TypeID for
 recognizable typed text, NanoID for opaque text, or bytes for an exact random-bit
-budget. Inspect entropy separately from executable admission; prefixes add no
+budget. Choose `pattern` for readable references (dates/check digits add no
+entropy), `random` for bounded Int values, `rule` only when an opaque implementation
+is needed.
+
+Requires Screenplay 4.172.0 (`screenplay --version`) for these v21 constructs; older compilers refuse PLAY0268.
+
+Inspect entropy separately from executable admission; prefixes add no
 random bits and identifiers need at least 64. Time-ordered is not strict
 millisecond ordering. Use the existing [strategy and MCP reference](../../cratis-screenplay-command-surface/references/generated-values-and-responses.md),
 not a per-property strategy: the concept owns `generate`, the command property
@@ -23,7 +30,13 @@ says `generated identifier` or `generated`.
 ## When not to
 
 Do not replace client-minted inputs, authorization, idempotency keys or a gapless
-invoice allocator with generation. Secret generation, pattern/random/rule execution
-and generated-concept rule consistency are not released capabilities. Preserve
-refused rules instead of deleting them or inventing a repair.
+invoice allocator with generation. Patterns are not sequential/gapless allocators
+or secrets; check digits detect typos, not forgery. Use a unique constraint for
+short payload codes, and retain whole-source freshness for generated destinations.
+Secret generation and sequence allocation remain refused. Inspect authored-order
+MCP `rules[]` and `derivedPattern` for rule proofs and reviewed PLAY0688 repair;
+never delete a business invariant to silence PLAY0689. Read
+[Stage admission](../../cratis-stage-rendering-and-sandbox/references/admission.md)
+for checksum validation and pattern/random rendering prerequisites.
+`generate rule` remains STAGE-ESM-028, so model admission does not promise rendering.
 Sources: `Documentation/screenplay/generated-values/choosing.md` and `Documentation/screenplay/generated-values.md` in `Cratis/Screenplay`.

package/package/corpus/skills/cratis-screenplay-model-authoring/references/language-reference.md

@@ -260,16 +260,21 @@ See read-surface `references/named-keys.md` for the collection-key exclusion alg
 | Information only, never blocks | `persona` (report-only: `PLAY0270`, the policies it lists must exist), `authentication`, `domain`, `seed`, descriptions and `file` provenance. A persona does not block binding and does not change behavior, so state persona scope in a description or a policy the model uses |
 | Binds as ESM v7 (`PLAY0268` on a compiler that stops before v7) | `generated` properties and `returns` responses, generated fixtures and `then returns`: bound and executed by the reference runner; a policy, rule or requirement that references a generated value is `PLAY0273`, and generated-concept rules select v20 with PLAY0688/0689 proof diagnostics. Stage renders supported UUID/String strategies, scalar/named responses and fixtures; unsupported types/result combinations remain `-028`/`-038` |
 | Authorable, not executable (PLAY0268) | Systems/operations, the `numbers exact` source mode (PLAY0268; exact lowering of qualifying Double literals is the admitted v11) remain unadmitted |
-| Concept generation strategies (ESM v15) | Required scalar generatable Uuid/String concepts; concept-owned uuid/uuidv7/ulid/typeid/nanoid/bytes strategies and admitted modifiers. Strict fixture encoding; Guarded whole-source freshness rejects Concurrency with no append/retry. Generated secrets, pattern/random/rule and sequence remain refused; generated-concept rules select v20. Stage renders supported strategies: command-surface `references/generated-values-and-responses.md` |
+| Concept generation strategies (ESM v15) | Required scalar generatable Uuid/String concepts; concept-owned uuid/uuidv7/ulid/typeid/nanoid/bytes strategies and admitted modifiers. Strict fixture encoding; Guarded whole-source freshness rejects Concurrency with no append/retry. Generated secrets and sequence remain refused; generated-concept rules select v20, pattern/random/rule and checksum validation select v21. Stage renders supported strategies: command-surface `references/generated-values-and-responses.md` |
 | Response-name UI continuations (no ESM change) | Form submit and execute-success scopes, own failure PLAY0685, nested shadowing and outer success in inner failure; field/parameter precedence. An older bundled compiler lacks resolution; Scene runtime binding remains downstream. UI composition `references/response-continuations.md` |
 | Collection equality filters (ESM v14) | Caller-supplied `filter name Type [optional]`, no `from`, matching a same-named scalar primitive/concept/enum read-model property with the same nominal type. AND with `by`; optional omission does not narrow, supplied null is refused. PLAY0468 covers unknown/repeated/missing required spec arguments; result rows compare by read-model/key regardless of order. Read read-surface `references/equality-filters.md` for the compiled example and renderer ceilings |
 | Recovery and no-event assertions (ESM v17) | `when redelivered` delivers one given occurrence to one reaction without append; `then no events` checks no new facts, excluding append input. Requires Screenplay 4.157.0 or later (`screenplay --version`); older compilers report PLAY0268. |
 | Query Validation rejection (ESM v18) | Exactly one queried call plus one `then error`, no other action/result/denial. Concept key/supplied filters validate after authorization in every version. Requires Screenplay 4.161.0 or later (`screenplay --version`); older runners may answer absence. |
 | Invocation refusal branches (ESM v19) | Ordered first-match `on refused` productions or acknowledgement, `$refusal` values; bare refusal excludes authorization. Requires Screenplay 4.160.0 or later (`screenplay --version`); older compilers report PLAY0268. |
-| Generated-concept rules (ESM v20) | Proven rules bind, Refuted PLAY0688 errors, Unproven PLAY0689 warnings; fixtures obey shape and rules. Requires Screenplay 4.164.0 or later (`screenplay --version`); older compilers report PLAY0268. |
+| Generated-concept rules (ESM v20) | Proven rules bind silently, Refuted PLAY0688 errors include a witness, Unproven PLAY0689 warnings include a reason; deterministic regex containment only, not passing samples. Fixtures obey shape and rules. Requires Screenplay 4.164.0 or later (`screenplay --version`); older compilers report PLAY0268. |
+| Finite generation and attachments (ESM v21) | String pattern with optional Luhn/Mod11/Mod97 checksum, inclusive Int random range, attached String generation rule with language-neutral Now/Tenant context and String result, String checksum validation. Requires Screenplay 4.172.0 (`screenplay --version`); older compilers report PLAY0268. PLAY0691 is support-budget exhaustion, PLAY0692 empty support on a scanned date. Pin date fixtures with given clock. Requires Stage 4.118.0 for checksum validation and 4.119.0 for pattern/random rendering; older renderers refuse them. `generate rule` remains STAGE-ESM-028; see command-surface `references/generated-values-and-responses.md`. |
+| Atomic reaction batches (ESM v22) | Root `reaction batches atomic`; direct productions per occurrence and selected refusal branches are separate batches, commands independent; Stage refuses v22 and atomic mode |
+| Described handlers (ESM v23) | Pending implementation beside unconditional produces; payload-only contract, reached body Unsupported ImplementationBody; Stage STAGE-IMPL-002 even Stub mode |
+| Ordinal text rules (ESM v24) | contains/not contains/starts with/ends with on scalar non-enum text properties; quoted literals, not conditions; Stage semantic engines execute/render |
+| Protected command reads (ESM v25) | Root `command reads protected`; eligible read paths in requirements and production mappings, absence Validation, concurrent matching facts Conflict; Stage admits v25 but refuses protected reads STAGE-ESM-044 |
 | Current routing and actor admission | Sources/streams and command/specification routes bind and reference-execute as v8; reaction `runs as system role` supplies the invocation actor as v10. Whole-workspace binding determines executable availability; CLI/Stage realization remains separate |
-| Blocks binding (`PLAY0268`) | enum/identity compliance and events combining personal or explicitly subject-scoped secret values with explicit subject marks; a compiler that stops before v13 refuses all `pii`/`secret` concepts ("compliance attributes require portable data-subject semantics"), while v13 binds them and Stage renders protection; command `handler` (never binds; a command cannot declare both `produces` and `handler`, `PLAY0035`), bare `rule <Name>`, `require` or conditions over read-model paths, dates and `today` in comparisons, `$context.tenant`/claims/roles/causation in `produces`, `$env` conditions, `file` constraints, unquoted `import` of an external contract, a read model with neither explicit `key` nor unambiguous query-based identity as described above (composite keys remain unadmitted), queries with context `from` sources (typed query context is unadmitted), single-result filters (collections only), `scoped to` (opaque scope), `performer` (opaque implementation) or composite `by` blocks; optional keyed and collection queries, including caller-supplied equality filters and observable delivery, bind, `$causedBy` and templates in projections |
-| Blocks binding (`PLAY0271`, legacy meaning) | Command `reads` and `concurrency` |
+| Blocks binding (`PLAY0268`) | enum/identity compliance and events combining personal or explicitly subject-scoped secret values with explicit subject marks; a compiler that stops before v13 refuses all `pii`/`secret` concepts ("compliance attributes require portable data-subject semantics"), while v13 binds them and Stage renders protection; attached command `handler` (PLAY0035 beside productions; pending described intent instead binds v23), bare `rule <Name>`, read paths without protected opt-in or in unsupported positions such as `produces when`, dates and `today` in comparisons, `$context.tenant`/claims/roles/causation in `produces`, `$env` conditions, `file` constraints, unquoted `import` of an external contract, a read model with neither explicit `key` nor unambiguous query-based identity as described above (composite keys remain unadmitted), queries with context `from` sources (typed query context is unadmitted), single-result filters (collections only), `scoped to` (opaque scope), `performer` (opaque implementation) or composite `by` blocks; optional keyed and collection queries, including caller-supplied equality filters and observable delivery, bind, `$causedBy` and templates in projections |
+| Blocks binding (`PLAY0271`, legacy meaning) | Command reads without protected opt-in and `concurrency`; combined protected reads/concurrency is PLAY0783 |
 | Deferred (`PLAY0269`, information) | Screens, layouts, templates, forms, contributions, UI profiles, themes, behaviors and `on`/`uses` |
 | Metadata only (`PLAY0270`, information) | `domain`, `seed`, `persona`, trigger and other descriptions, and `file` provenance on declarations |
 
@@ -301,8 +306,9 @@ and routes bind and reference-execute as v8; reaction identity as v10.
 Use standalone `screenplay test` or MCP `run-specifications` for a reference
 verdict, and independently check CLI/Stage admission. Never drop a contract to bind.
 Generated values and `returns` are not in this group: they bind as ESM v7.
-Protected reads and `derive`/`provide` (not admitted by any supported ESM version) have no documented
-syntax: do not teach or invent one. Affected-instance declarations and query paging/sorting/change-set delivery
+Protected command reads have documented v25 opt-in; see command-surface
+`references/protected-reads.md`. `derive`/`provide` remain undocumented and
+unadmitted: do not invent syntax. Affected-instance declarations and query paging/sorting/change-set delivery
 remain unavailable here. Event `subject` is report-only authoring metadata;
 public events/origin are admitted as ESM v9 (not provider realization).
 Purpose declarations, references and processing records are authoring metadata,

package/package/corpus/skills/cratis-screenplay-model-authoring/references/mcp-loop.md

@@ -24,6 +24,14 @@ defined by `cratis-screenplay-modeling-lifecycle`. Discover the installed tool s
 
 ## Connect
 
+Never ask which folder to use before trying `open-workspace` with no arguments.
+Without a fixed root, it binds the client's single workspace root, else a launch
+directory holding `.play` files. Only after a no-root or multiple-roots response,
+pass `path`: the folder holding the project's models, otherwise the folder the
+user names. Without a project the server uses `Documents/Screenplay` in the user's
+home; do not invent a location. A fixed root can switch only to the same model
+folder in a registered Git worktree of the same repository.
+
 1. Launch with a **fixed root**: `screenplay mcp <model-folder>`, or
    `cratis screenplay mcp <model-folder>`, or `cratis screenplay mcp` inside a
    project, where the CLI locates the model (the project's `.play` files, else `Source/`
@@ -210,7 +218,7 @@ connection. Passing `open-workspace.path` does **not** avoid it, because the err
 | --- | --- | --- |
 | Address-preserving | descriptions; bodies of rules and expressions; mappings between members that already exist; any edit that adds, removes or renames no addressed element. Also every edit in a model with no `.screenplay/identities.json` except persisted names | bounded text edit of the `.play` file, then compile the folder; or `propose-ast` |
 | Catalog-changing (identity file present) | add, remove or rename a declaration (slice, command, event, read model, projection, ...), a property of a command, event, read model, composite type or trigger, a query, a query argument or a specification; create, delete, rename or move a mapped `.play` document (McpState refuses reopening with `IdentityMappingConflict`; use document operations in `propose-ast`); rename, remove or move an event, command, read model, constraint, module, feature or slice; move declarations between files (slices and features across logical parents: `propose-move`); contract evolution of a persisted event (new generation, property added, removed or retyped) | `propose-rename` or a reviewed `propose-ast`; never a blind text rename. Renaming a constraint resets its uniqueness index: ask first unless the request names it, then report the reset. A persisted event rename needs `id "OldName"` (added by default) |
-| Concept `generate` | set/change/remove strategy and modifiers | `propose-ast` replaces `ConceptSyntax.generation` (`GenerationSyntax`; omit/null to remove), or reviewed `propose-source`; never hand-edit `generate` text. Preserve other concept members and inspect executable diagnostics: sequence PLAY0682, preview strategies PLAY0268, generated-rule proofs PLAY0688/0689. |
+| Concept `generate` | set/change/remove strategy and modifiers | `propose-ast` replaces `ConceptSyntax.generation` (`GenerationSyntax`; omit/null to remove), or reviewed `propose-source`; never hand-edit `generate` text. Preserve other concept members and inspect executable diagnostics: sequence PLAY0682, generated secrets PLAY0268, generated-rule proofs PLAY0688/0689, finite-support failures PLAY0691/0692. Pattern/random/rule and checksum validation bind as ESM v21 (Requires Screenplay 4.172.0, `screenplay --version`; older compilers refuse PLAY0268). Read `mcp-tools.md#concept-generation` for `arguments`, exact support and `rules[]`, not parsed diagnostic prose. |
 | Repair | `PLAY0166`, `0478`, `0469`, `0471`, `0479`, `0516`, `0563`, `0564`, `0565`, `0614`, `0653`, `0683`, `0684` (and recipe-only `0397`) | `propose-repair` with `formatting`; PLAY0166/0478 may pin attachment evidence (`pinRepairEvidence` and `expectedRepairEvidenceRevision`), never fix-all PLAY0478 |
 | Inline event extraction | `produces event ...` to a declared event | `propose-extract-inline-event` |
 | Parser-invalid document | no editable handles | `propose-source` `replace-document` with corrected source, or typed `propose-ast` document replacement |

package/package/corpus/skills/cratis-screenplay-model-authoring/references/mcp-tools.md

@@ -166,8 +166,12 @@ exists only for authored `generate`; an implicit UUID default has no block.
 | --- | --- |
 | `strategy` | Authored strategy name |
 | `modifiers` | Only set `prefix`, `case`, `size`, `alphabet`, `count`, `encoding`; omitted defaults are not filled in |
-| `previewArguments` | Present only for authored `pattern`, `checksum`, `range`, `rule`; each is `{value, executable: false}` |
-| `entropyBits` | Exact random bits, or null for unknown strategy/invalid entropy inputs |
+| `arguments` | Authored `pattern`, `checksum`, `rule` strings and `range: {text, minimum, maximum}` with exact Int64 endpoints; malformed range retains text only. Replaces `previewArguments`. |
+| `supportCount` | Exact JSON integer for assessed pattern/random distinct support; preserve large numbers without floating-point rounding. Dates use minimum conditioned support over the compiler's 100-year UTC horizon. |
+| `entropyBits` | Built-in random bits; pattern/random use log2(supportCount). Null for opaque rule implementations or invalid/unsupported inputs. |
+| `derivedPattern` | Anchored strategy-derived regex, or null; pattern expressions are deterministic and bounded, but date/checksum digit runs describe shape, not arithmetic containment. |
+| `derivedPatternUnknownReason` | Reason when derivedPattern is null; never invent a regex from it. |
+| `rules` | Authored-order entries: rule kind, line/column, status proven/refuted/unproven; witness for refuted, reason for unproven. diagnosticCode only for reported PLAY0688/0689; repair PLAY0688 only for a reported refuted declarative rule. |
 | `entropyUnknownReason` | Present only when entropy is unknown |
 | `valuesAtOnePercentCollision` | JSON number estimating the 1% birthday collision count, or null; scientific notation can exceed client floating-point range |
 | `executable` | `status`, `diagnosticCodes`, and `reason` only for `notAssessed` |
@@ -178,7 +182,10 @@ and no such error exists; otherwise `notAssessed`, with a reason that whole-mode
 binding failed. `diagnosticCodes` contains only errors at these declaration locations.
 An empty list is not admission; low-entropy property diagnostics require workspace
 inspection. Invalid alphabets/non-positive sizes or counts yield null estimates
-with `entropyUnknownReason`, preserving compiler diagnostics. Time, prefixes,
+with `entropyUnknownReason`, preserving compiler diagnostics. Pattern support
+budget exhaustion (PLAY0691) or empty support on a scanned date (PLAY0692) also
+leaves estimates null with the compiler's reason; an opaque `rule` has unknown,
+not zero, entropy. Time, prefixes,
 case and encoding add no randomness; the compiler, details and repairs share
 `GenerationEntropy`, not an agent's parallel estimate.
 
@@ -191,8 +198,9 @@ source document under the same revision/review contract. Canonical printing
 retains `generate`. Review `read-proposal` changes and `view: "executable-diagnostics"`,
 run candidate specifications where executable, then explicitly `apply`.
 Authoring acceptance does not imply executable readiness: `sequence` reports
-PLAY0682; `pattern`/`random`/`rule` and generated-concept validation rules report
-PLAY0268. Do not retype a refused proposal to bypass those diagnostics.
+PLAY0682; generated secrets still report PLAY0268, rule proofs PLAY0688/0689,
+and finite-support failures PLAY0691/0692. Pattern/random/rule and checksum
+validation bind as ESM v21. Do not retype a refused proposal to bypass diagnostics.
 
 `screenplay_repair_capabilities` advertises PLAY0683/PLAY0684. Discover concrete
 verified actions with `read-workspace view: "repairs"` at the diagnostic revision:
@@ -211,10 +219,40 @@ concept; uniqueness changes append-time behavior. Review every changed document
 before applying; discovery/proposal write nothing. The saved-file VS Code repair
 picker does not expose these entropy actions.
 
-PLAY0688 repair replaces a refuted generated-concept rule with the strategy-derived
-`matches` pattern. Review it as a validation change for input/stored values too.
-PLAY0689 is an unproven warning, not proof; checksum repairs remain unadmitted.
-MCP does not generate values.
+Read `generation.rules[]` instead of parsing diagnostic prose: `refuted` names
+the violating `witness`; `unproven` explains its `reason`; `proven` needs no diagnostic.
+A refuted result without `diagnosticCode` means the compiler did not check that
+rule (for example, a UUID concept unused by generated command properties), so
+there is no reported repair. Proof status is not executable admission, and
+passing samples do not prove containment.
+
+To add a rule the strategy satisfies, put `derivedPattern` into a typed `matches`
+proposal preserving other concept members. If null, read
+`derivedPatternUnknownReason` and keep the intended invariant; do not fabricate
+an expression. PLAY0688 repair replaces a refuted generated-concept rule with
+the strategy-derived matches pattern. Discover its subject through
+`read-workspace view: "repairs"`, then `propose-repair` with both revisions and
+canonical formatting. Review input/stored-value effects, not just generation.
+For a checksum pattern the same proposal explicitly adds the declared checksum
+validation if absent. Ambiguous/unbounded derived regexes have no repair.
+PLAY0689 is an Unproven warning, not proof; MCP never generates values.
+For an opaque generation rule, inspect `read-workspace view:
+"implementation-requirements"` for its ValueGeneration requirement; the reference
+runner consumes a pinned String and never executes its attached body.
+Requires Screenplay 4.181.1 (`screenplay --version`) for the language-neutral
+version-1 ValueGeneration context contract (Now instant, Tenant portable ID,
+String result); older Cratis C# bindings cannot compile all context-aware bodies.
+The provider selects the binding, not the fence tag: Cratis C# uses Fundamentals'
+`Cratis.Concepts.GenerationContext`; BCL-only C# hosts can use Screenplay's record.
+Portable bodies use Now, tenant interpolation/string assignment and BCL types.
+Passing context to `GenerateValue.*`, constructing/naming the context type or
+reading `Tenant.Value` is target-bound, not a shared language contract. See
+[context reference](https://github.com/Cratis/Screenplay/blob/main/Documentation/screenplay/context.md).
+
+Requires Screenplay 4.173.0 or later (`screenplay --version`) for `arguments`,
+exact support, derived patterns and `rules[]`; older servers can expose
+`previewArguments` and omit proofs. Discover schemas and diagnostics instead of
+assuming these fields. Reference: [generation details](https://github.com/Cratis/Screenplay/blob/main/Documentation/screenplay/mcp/reference.md#generated-values-and-responses).
 
 Requires Screenplay 4.164.0 or later (`screenplay --version`) for generated-rule proofs and PLAY0688 repair; older servers lack this action. The CLI-bundled MCP can lack
 this generation summary and the entropy repairs. Existing typed concept proposals predate the
@@ -453,6 +491,11 @@ inspect authored links, not code execution or a transitive runtime graph.
 
 ## Dependencies and intent inventories
 
+Diagnostic subjects use code plus typed `arguments`, not parsed messages. This applies
+to `diagnostics`, executable diagnostics and proposal introducedExecutableErrors.
+Read [diagnostic arguments](../../cratis-screenplay-toolchain/references/diagnostic-arguments.md)
+for optional subjects, declaration paths and PLAY0524 step indices.
+
 `dependency-graph` edges point consumer → producer. Views: `edges`, `cycles`,
 `order`, `unresolved`, `declarations`; `from`/`to` select slice/feature/module
 aggregation (`to` also accepts context). `scope`, `direction`, `kinds` and
@@ -479,7 +522,12 @@ Workspace views `named-rule-intents`/`named-rule-intent-details` cover CommandNa
 only, including pending hints without a requirement ID. Details select either
 `subject` or attached `requirementId`, not both. `handler-intents` and
 `handler-intent-details` cover CommandHandler only; handler details select
-`requirementId`. All page ordered hints, not implementation correctness. Continue
+`requirementId`. A handler entry's `executableReady` means successful v23 binding
+with a matching Pending requirement, not a supplied body; `admission` is described,
+refused or authoring-only. `implementation-requirements` exposes ordered hints and
+provisional/ambiguous flags. Edit HandlerSyntax/ImplementationSyntax/ImplementationHintSyntax
+through `propose-ast` with Authoring validation, preview then apply; unwrapping
+pending metadata is refused. All page ordered hints, not implementation correctness. Continue
 with `expectedRevision` and `expectedCatalogRevision`; provisional owner IDs are
 not authoritative. Edit hints through reviewed `propose-ast`.
 

package/package/corpus/skills/cratis-screenplay-model-authoring/verification.json

@@ -137,7 +137,8 @@
     },
     {
       "kind": "skill-contains",
-      "value": "cratis screenplay mcp <model-folder>"
+      "value": "cratis screenplay mcp <model-folder>",
+      "file": "references/mcp-loop.md"
     },
     {
       "kind": "skill-contains",
@@ -174,7 +175,8 @@
     },
     {
       "kind": "skill-contains",
-      "value": "registered Git worktree"
+      "value": "registered Git worktree",
+      "file": "references/mcp-loop.md"
     },
     {
       "kind": "skill-contains",

package/package/corpus/skills/cratis-screenplay-model-review/SKILL.md

@@ -127,11 +127,8 @@ rejected state and its evidence.
 Optional, on request, all read-only and yielding edit requests: a subject's information journey (`references/model-inventory-report.md`), a resilience pass (`references/stressor-analysis.md`) and a slice-by-slice walkthrough (`references/walkthrough.md`).
 
 ## Quick self-check (modeler, P4; about ten minutes)
-Eleven yes/no checks the modeler runs on its own work before P5 (V1 clean, no dropped constructs,
-every event production has `for`, every field has an origin, every command a reachable authorized
-origin, NOT-enforced rules marked, coverage matrix filled, personas with their denials, rationale in
-`documentation`, open questions as anchored notes, every Automation with pending work). Any "no" is
-fixed or explained before P5. The list: [quick self-check](references/quick-self-check.md).
+Read [quick self-check](references/quick-self-check.md) before P5 for the eleven
+modeler checks. Fix or explain every "no"; this is not the independent review.
 
 ## Business-question pass (explain brief)
 Be a sharp business analyst seeing the domain fresh: walk each persona's journey and ask only what a domain person must decide, in plain language with no engineering words (could a non-technical product owner read it and immediately understand what is being asked?), anchored to a place in the model, at most 12 questions (zero is valid). Method, element prompts and the model-word translation table: `references/business-questions.md`. A behavior walk in the Stage sandbox (`cratis-stage-rendering-and-sandbox`) is a separate, optional check; its findings arrive here as review findings.

package/package/corpus/skills/cratis-screenplay-model-review/references/anti-patterns.md

@@ -64,8 +64,8 @@ the problem, the checks it violates, the fix, all pinned to one declaration.
 | Undeclared removal/append event | `remove with` or capture `append` names an undeclared event | V1 warns (PLAY0166, a failure under warnings as errors); binding fails PLAY0273 | C (executable) / D | declare or fix the name; run V3 |
 | Gated command invoked by a reaction without a declared actor | reaction `invokes` a command under a caller policy and has no `runs as system role "<Role>"` that satisfies the gate | the invocation carries no caller: rejected at run time | D (major) | declare `runs as system role "<Role>"` with the least-privilege role the gate admits (ESM v10, Screenplay 4.125.0; Stage 4.89.1 renders role/authenticated trusted actors, but claim-reading/opaque gates still refuse STAGE-ESM-034 and need gap-fill) or record another trusted-path decision - never just delete the gate. A matching `runs as system role` is the admitted trusted path, not a defect |
 | `reads` + `produces` reaction | reaction both reads a view and produces | fails binding | C (executable) | invoke a command, or produce without reads |
-| `reads` treated as protection | rule "checked" because the command or reaction `reads` a view | `reads` enforces nothing | D (major) | keep or introduce `reads <View>` + `require ... message` as stated intent, mark it NOT enforced in the slice `description`, name the target (`[ProtectedDecision]` + `DecisionRead<T>`, Chronicle DCB, or a constraint where it fits); checklist E3 |
-| Caller-supplied state rule | `require currentStatus == "open"` where the caller sends `currentStatus` | the caller decides its own permission | D (major) | read the stored state with `reads`; keep or introduce `reads <View>` + `require ... message` as stated intent, mark it NOT enforced in the slice `description`, name the target (`[ProtectedDecision]` + `DecisionRead<T>`, Chronicle DCB, or a constraint where it fits); checklist E3 |
+| Unadmitted read claimed protected | rule "checked" by legacy command or trigger reads | no protected contract or target realization | D (major) | opt eligible command reads into `command reads protected` (v25); inspect shape, absence and conflict cases. Stage refuses protected reads (STAGE-ESM-044); distinguish reference protection from target evidence; checklist E3 |
+| Caller-supplied state rule | `require currentStatus == "open"` where the caller sends `currentStatus` | the caller decides its own permission | D (major) | read authoritative stored state through admitted protected reads and `require`; mark legacy/refused shapes and target realization as gaps; checklist E3 |
 | `severity warning` as soft rule | rule meant to warn but still rejects | blocks valid requests | C semantics | remove or make it a real rule |
 | Relay events | `*Synced`, `*Forwarded` events that only move data | noise, not facts | D | translate once into a business fact |
 | External event driving a worker directly | captured external record invokes commands with no local fact | no audit of what was learned | D | append a local fact in `Translate`; automate from it |

package/package/corpus/skills/cratis-screenplay-model-review/references/checklist.md

@@ -123,7 +123,7 @@ the format in `worked-example.md`.
 |---|---|---|---|
 | E1 | Value formats on `concept`s; input rules on the command; uniqueness as `constraint`; access as `authorize` | declarations | D |
 | E2 | Every refusal has a message a person understands; constraint messages copied verbatim in specs | `message`, specs | D |
-| E3 | A state-dependent rule is `reads <View>` + `require <expr> message "..."` as stated intent, and the slice `description` marks it NOT enforced in the model today (PLAY0268/0271 at binding expected in design mode) with its target named (`[ProtectedDecision]` + `DecisionRead<T>`, Chronicle DCB / `concurrency` scope, or a constraint). Not: caller-supplied copies of state, attestation booleans (`confirmsX == true`), rules in `handler` / `implementation hint` prose, or `reads` treated as protection | slice `description`, `require`, `handler` | D (faking or hiding = major) |
+| E3 | A state-dependent rule uses `reads` + `require` over authoritative state: eligible reads opt into `command reads protected` (v25), with required absence and decide/commit conflict cases. Legacy/refused reads are marked unenforced with a named target. Stage refuses protected reads (STAGE-ESM-044); reference protection is not target realization. Not: caller-supplied copies of state, attestation booleans (`confirmsX == true`), rules in `handler` / `implementation hint` prose, or `reads` treated as protection | slice `description`, `require`, `handler` | D (faking or hiding = major) |
 | E4 | `severity warning` is not used as "soft" validation (it still rejects) | validate lines | C semantics |
 | E5 | Preconditions are explicit; nothing relies on "obviously you can't" | descriptions, specs | Q |
 | E6 | Each invariant has an atomic enforcement point (name the storage provider where constraint admission matters); the race loser's outcome is specified | constraints, specs | D |
@@ -147,7 +147,7 @@ PLAY0516 moves preserve executable bytes/identities. Source: Screenplay
 | F2 | No impossible sequence (a fact that requires one that can never precede it) | constraints, specs | D |
 | F3 | Cancellation, failure and correction paths exist where the business has them | slices | Q |
 | F4 | Automations: trigger, todo/work item if work can be pending, a closing fact, retry and once-only story | reactions, views | D (`cratis-screenplay-automations-and-translations`) |
-| F5 | External facts enter through `Translate`; in-app follow-ups through `Automation` | slice kinds | C semantics |
+| F5 | External facts enter through `Translate`; in-app follow-ups through separate `Automation` slices. Keep a capture in Translate, move reactions to its local appends out (PLAY0694 for directionless/unrouted co-location, including child/nested appends; PLAY0616 for explicit inbound). PLAY0694 is a warning that fails `--warnaserror`, with no automatic split | slice kinds, capture appends and reaction triggers | C semantics |
 | F6 | No cycle where fact A's reaction needs fact B and B's needs A, or two features each wait on the other | reactions, MCP `dependencies` | D (redesign the boundary) |
 | F7 | Each slice's consumed events and their producing slices are known; a slice calls another's command only through `invokes` | reactions, `reads` | Q |
 | F8 | Every Automation has a pending-work view (a todo list: membership is the pending work), or a written reason a direct effect needs none (immediate, internal, cannot fail). A "simple relay" is not exempt from the question | reactions, `reads`, views | D |

package/package/corpus/skills/cratis-screenplay-model-review/references/quick-self-check.md

@@ -8,7 +8,8 @@ About ten minutes, before the independent review.
 4. Every read-model field has an origin; every event has a consumer or terminal reason.
 5. Every command has a reachable, authorized origin (screen or form action, or a reaction to an event, clock or application trigger; a capture appends facts and a command after it is reached through a reaction).
 6. No gated command is invoked by a reaction without a recorded trusted-path decision.
-7. State-dependent rules are `reads` + `require ... message` marked NOT enforced; no
+7. State-dependent rules use admitted protected command reads plus `require`, or
+   record the legacy/refused shape and target gap; no
    caller-supplied state, attestation boolean (`confirmsX == true`) or handler/hint prose.
 8. Coverage matrix filled; every `n/a` has a domain reason.
 9. Persona text says what each role cannot do, each line backed by a gate and a `then denied`

package/package/corpus/skills/cratis-screenplay-model-review/references/review-questions.md

@@ -37,8 +37,9 @@ needs; a "no" is a finding only when it has a business consequence.
 
 ## For each slice and the model as a whole
 1. Does each slice depend on other slices only through event contracts, `invokes` and explicitly
-   recorded cross-slice `reads` of another slice's view (F7)? A `reads` is unprotected (a
-   stored-state rule over it stays not enforced) and couples the slice to that view's interface:
+   recorded cross-slice `reads` of another slice's view (F7)? Check protected-command
+   opt-in/admission and absence/conflict cases separately from target realization;
+   legacy and trigger reads remain unprotected. The view interface is a dependency:
    check that it is recorded, not implied.
 2. Could two people work on two slices at the same time without reading each other's
    declarations, given only the events' fields (A8)?

package/package/corpus/skills/cratis-screenplay-modeling-lifecycle/references/principles.md

@@ -11,7 +11,7 @@ instruction for the work, not background reading. Skills that restate one cite i
 6. **Keep semantic identity independent of names, paths, layout and generated symbols.** Commit the identity catalog with the model.
 7. **Keep unsupported intent visible.** Return a precise gap and its owning issue; never weaken the model so rendering passes.
 8. **Write specifications with intent, including rejection and denial.** Never report an unexecuted or unsupported scenario as passed.
-9. **Treat state reads as a correctness boundary.** Do not claim protection until the opted-in contract and the target support exist.
+9. **Treat state reads as a correctness boundary.** Eligible command reads opt into `command reads protected` (v25); legacy/trigger reads remain unprotected. Stage refuses protected reads (STAGE-ESM-044), not the v25 pair: reference absence/conflict guarantees and verified target realization are different claims.
 10. **Separate event-source identity from event payload and choose destinations explicitly.**
 11. **Persisted event shape changes are evolution, never cleanup.** Keep historical generations.
 12. **Model external work as business intent.** Provider interfaces and transport mechanics stay out of the language.

package/package/corpus/skills/cratis-screenplay-modeling-lifecycle/references/vocabulary-map.md

@@ -21,7 +21,7 @@ speaks in them; never model board mechanics (lanes, node ids, positions).
 | Storyline (ordered beats) | a **family** of specifications sharing example data, each one transition (no storyline syntax) | several spec classes | specifications |
 | Field validation | concept `validate` (every use) / command `validate`, `require` | `ConceptValidator<T>` / `CommandValidator<T>` | command validation |
 | Role permission ("Cannot") | `policy` + `authorize` + `then denied` spec; ownership via `claim ... matches subject` | `[Authorize(Policy)]`, generated policies | authorization |
-| Precondition on stream state | `reads` + `require` as stated intent, not enforced (target: Arc `[ProtectedDecision]` + `DecisionRead<T>`, or Chronicle DCB; APIs available to gap-fill in the Arc and Chronicle the Stage scaffold pins, not emitted protection) | decision over a guarded read | command validation |
+| Precondition on stream state | `command reads protected` + eligible `reads`/`require` (v25 reference protection); legacy/refused reads remain stated intent. Stage refuses protected reads (STAGE-ESM-044); target Arc `[ProtectedDecision]` + `DecisionRead<T>` or Chronicle DCB needs separate verification | decision over a guarded read | command validation |
 | Generated id (`derived:uuid4()`) | `generated` (authorable, not executable) | id supplied before `Handle()` | commands |
 | External system / outbound call | `Translate` slice (inbound); `system`/`operation` (authorable, not executable) or Automation (outbound) | `ICommandOperation` / reactor | operations, reactors |
 | HTML mockup | `screen` Level 1 + board (`visualize-model`) | default Scene composition | ui composition |

package/package/corpus/skills/cratis-screenplay-read-surface/SKILL.md

@@ -263,9 +263,8 @@ choosing a whole action list rather than one labeled command, use block-form
 **Inside out:** the slice, then the enclosing feature, then the module, then the
 document. The innermost match wins.
 
-That rule exists because a generated document cannot make every name unique — one
-real application declares 76 queries under 37 distinct names, with `All` appearing
-21 times. Two sibling slices can each declare `All`, and each screen gets its own.
+Sibling slices may each declare `All`; each screen resolves its own query.
+Read `references/named-keys.md` when query scope affects identity inference.
 
 Reach across slices by qualifying with **any trailing part** of the scope.
 Excerpt: `Queue` and `Deviations` are sibling slices that each declare `All`.

package/package/corpus/skills/cratis-screenplay-read-surface/references/named-keys.md

@@ -100,7 +100,9 @@ Composite read-model keys, query `by` blocks and fixtures
 over those views remain authoring-only: binding reports PLAY0268 citing
 Screenplay#599 (still open). They do not reference-execute or render. This is not
 ESM v10 admission; v10 covers reaction identity, production routes and observer
-filters. Command reads independently remain unprotected/unadmitted (PLAY0271).
+filters. Eligible command reads separately opt into v25 with `command reads protected`;
+legacy reads remain PLAY0271, and composite keys are still refused (PLAY0781 ByParts).
+See command-surface [protected reads](../../cratis-screenplay-command-surface/references/protected-reads.md).
 A single explicit key does bind; Stage admission still depends on the complete
 model and projection/query shape, not just the key modifier.
 

package/package/corpus/skills/cratis-screenplay-render-and-gap-fill/SKILL.md

@@ -32,6 +32,12 @@ Tool versions are covered in `cratis-screenplay-toolchain` `SKILL.md`; read it b
   (the user); Stage internals and the sandbox (`cratis-stage-rendering-and-sandbox`); judging
   hand-written code against its slice (`cratis-application-slice-conformance`).
 
+## Language modes that block target delivery
+
+Read [language admission](../cratis-screenplay-toolchain/references/language-admission.md)
+for v22–v25: Stage refuses atomic batches, described bodies (even Stub mode) and
+protected reads. Preserve contracts; reference success is not target realization.
+
 ## Interview phase
 **Skip if** the request names the model root, the application name, the destination and the
 decision on non-renderable scope. Otherwise ask only what is missing:
@@ -143,9 +149,8 @@ Adapters and non-renderable scope follow the contract rules of `cratis-applicati
   the Arc/Chronicle set in `cratis-stage-rendering-and-sandbox` `references/rendered-application.md`; API availability alone is not verified enforcement.
 - Adapters that call outside systems follow `cratis-engineering-effect-boundaries`; slice
   specifications follow `cratis-application-slice-specifications`.
-- Realization notes are the explicit realization requirements stated in a slice `description` or `documentation`
-  (definition: `cratis-application-slice-conformance`, `references/contract-and-precedence.md`).
-  Executable parts (specifications, mappings, constraints) win over prose, and a contradicting description is a model defect to report.
+- Read conformance's `references/contract-and-precedence.md` for realization-note
+  authority. Executable contract wins over prose; report contradictions.
 
 ## Rules
 

package/package/corpus/skills/cratis-screenplay-render-and-gap-fill/references/gap-fill-handoff.md

@@ -105,6 +105,14 @@ stable array or list. The Stage scaffold pins an older Arc, so raise the version
 `Customizations/Dependencies.props` only after a restore and build proves it. Never split the
 reaction or drop an effect to dodge rendering.
 
+Preserve declared `reaction batches atomic` boundaries: each trigger occurrence's
+direct productions and each selected refusal branch are separate batches, with
+invoked commands independent. Stage refuses v22 (STAGE-ESM-016) and atomic mode
+in admitted v23–v25 (STAGE-ESM-043); the declaration is not external-effect deduplication.
+For described handlers, hand off only payload computation under the v23 result
+contract; Stage STAGE-IMPL-002 means no stubs, even Stub mode. Protected v25 reads
+refuse STAGE-ESM-044 despite version admission and need target admission/enrollment tests; ordinary injection never supplies protection.
+
 ## Re-delivery
 The work list is the full in-scope contract delta since the fallback record's last verified source
 identity (specifications, rules, mappings, realization notes), then the whole contract is

package/package/corpus/skills/cratis-screenplay-render-and-gap-fill/references/renderability-gate.md

@@ -14,8 +14,10 @@ probe reports and choosing what to do. Do not copy the code table here.
 2. Execution planning builds the plan and can emit `PLAN-*` diagnostics before Stage runs.
 3. Stage plans the target and admits or rejects each member: `STAGE-ESM-0xx`; profile and path
    problems `STAGE-CRATIS-0xx`. An evolved event is reported with Stage's own `STAGE-ESM-026`
-   (still refused); the CLI adds nothing. Stage admits exact ESM v1–v17 and v19 pairs, not v18/v20; CLI admission remains bounded by its bundled renderer and
-   refuses each construct it does not render with its own code (see Stage's current code table, including `-024`, `-027`, `-028`, `-030` to `-041`).
+   (still refused); the CLI adds nothing. Read the owning Stage admission table and
+   toolchain `references/renderable-subset.md` for exact pairs and version minimums;
+   CLI admission remains bounded by its bundled renderer. Each unsupported construct
+   has its own code; version admission is not construct support.
 4. Any error in the selected scope publishes nothing: the run ends with exit 5 and the diagnostics.
    Without `--scope` the scope is the whole application. With `--scope`, `PLAN-*` problems in
    unselected slices are warnings and `STAGE-ESM-*` refusals in unselected slices do not block;
@@ -28,8 +30,8 @@ ESM). Only the probe answers renderability. `PLAY0270` entries are information,
 
 | Class | Meaning | Typical examples (each verified in `admission.md`) | Action |
 | --- | --- | --- | --- |
-| **Model fix (in mode)** | the model is in, or the user chose, renderable mode and breaks its own subset in a way that has a renderable equivalent with the same meaning | a `produces` whose `for` is not the command identifier; one `StateChange` slice with two commands (`STAGE-ESM-004`); two projections for one read model (`-007`); a policy Stage cannot express portably (`-015`; role-only and opaque pure policies render) | edit request to the modeler session with address, change and rationale |
-| **Capability gap** | the intended meaning needs a construct Stage does not render yet | a snapshot list query (`-010`; observable lists and keyed or unkeyed lists bind and observable lists render), DateTime equality filters and required parameters after optional filters (`-010`); context/single-result filters, opaque `scoped to`/`performer` and composite `by` remain PLAY0268; Translate, clocks, captures, non-event triggers and opaque reaction bodies (`-024`); claim-reading/opaque `runs as` gates (`-034`), legacy `from` (`-035`), mixed effects in one handler (`-037`, retries can duplicate events; keep it whole), unsupported reaction mappings (`-039`); unsupported generated types/result combinations (`-028`/`-038`); `then no readmodel` (`-027`); evolved events (`STAGE-ESM-026`); conditional `produces when` (`-006`); `reads` (`PLAY0271`); code validation (`-005`); protected identities/enums (`-040`), non-text secrets (`-041`) or unadmitted explicit subject lineage (`PLAY0268`); a command `handler` (`PLAY0268`) | keep the model; fallback record entry; options a to c in `SKILL.md`; link the Stage issue |
+| **Model fix (in mode)** | the model is in, or the user chose, renderable mode and breaks its own subset in a way that has a renderable equivalent with the same meaning | a `produces` whose `for` is not the command identifier; two projections for one read model (`-007`); a policy Stage cannot express portably (`-015`; role-only and opaque pure policies render) | edit request to the modeler session with address, change and rationale |
+| **Capability gap** | the intended meaning needs a construct Stage does not render yet | DateTime equality filters and required parameters after optional filters (`-010`); context/single-result filters, opaque `scoped to`/`performer` and composite `by` remain PLAY0268; Translate, clocks, captures, non-event triggers and opaque reaction bodies (`-024`); claim-reading/opaque `runs as` gates (`-034`), legacy `from` (`-035`), mixed effects in one handler (`-037`, retries can duplicate events; keep it whole), unsupported reaction mappings (`-039`); unsupported generated types/result combinations (`-028`/`-038`); `then no readmodel` (`-027`); evolved events (`STAGE-ESM-026`); unsupported expression/enum production conditions (`-006`; supported conditional productions render); legacy reads (`PLAY0271`), protected reads (STAGE-ESM-044 despite v25 admission); code validation (`-005`); protected identities/enums (`-040`) or unadmitted explicit subject lineage (`PLAY0268`); attached command handlers (PLAY0268), described handlers (v23, STAGE-IMPL-002 even Stub mode), atomic mode (STAGE-ESM-016 for v22, STAGE-ESM-043 in admitted v23–v25) | keep the model; fallback record entry; options a to c in `SKILL.md`; link the Stage issue |
 | **Tool skew** | the bundled compiler disagrees with documented semantics | the false `PLAY0285` on reaction cascades from an older bundle; codes the standalone compiler does not raise | record in the session state and the fallback record; never "fix" a correct model |
 | **Environment** | not the model | restore failures, missing SDK, a destination that is not writable | fix the environment or report blocked |