@cratis/pi 7.62.0 → 7.64.0

package/package/corpus/skills/cratis-screenplay-toolchain/references/screenplay-contract.version

@@ -1 +1 @@
-4.188.0
+4.199.0

package/package/corpus/skills/cratis-screenplay-toolchain/references/traps.md

@@ -20,7 +20,7 @@ Compiler syntax: `cheat-sheet.md`. Negative capability claims depend on the tool
 16. PLAY0285/0286/0287 are static spec checks: do not edit expectations blindly. An older bundled compiler can report PLAY0285 falsely on reaction cascades; confirm with the standalone tool before changing a `then`.
 17. `null` in specs only for optional read-model properties (PLAY0350); omit the property or record a gap; whether an optional detail is really a separate fact is a review question, not the fix for this code.
 18. `then` events are exhaustive and ordered (use `then events in any order` for order only). From ESM v6 they include reaction cascades; after `when append` they list only what followed the append.
-19. `reads` without `by` means a singleton view; `reads` never binds (PLAY0271), and neither does a command `concurrency` block (PLAY0271, error).
+19. Under `command reads protected`, omitted `by` uses the command identifier; absent identifier is PLAY0782. Eligible reads bind v25; legacy reads and `concurrency` retain PLAY0271. Combining reads/concurrency under opt-in is PLAY0783.
 20. Declare each event once, in its producing slice; renaming a persisted event needs `id "OldName"`; renaming a constraint discards its index.
 21. Quoted `import "x/*.play"` = my files; unquoted `import Ctx.Event` = another context's contract (does not bind: PLAY0268).
 22. Construct keywords are closed (`aggregate`, `saga`, `workflow` do not exist): PLAY0029 or PLAY0001/0022/0024.
@@ -29,6 +29,8 @@ Compiler syntax: `cheat-sheet.md`. Negative capability claims depend on the tool
 25. MCP writes: propose, review, approval, apply by the identity owner (the session that owns the MCP connection); other subagents return edit requests; proposals are connection-local, at most 16 (`cratis-screenplay-model-authoring`).
 26. Operations/systems and `numbers exact` source mode remain unadmitted. Qualifying retained non-route Double literals select ESM v11. Sources/streams/routes bind as v8, public/direction forms v9, identity/overrides/filters v10. Stage construct checks run through the CLI's newest admitted version; supported equality filters and strategies render (`renderable-subset.md`).
 27. Translate crosses the public boundary: inbound foreign/data to private local facts; outbound private facts to one local public type. Public metadata needs explicit direction; a quoted origin is an unverified store name, not a path. Commands never publish public events. In-app private follow-up is Automation; see public-events-and-direction in the method skill.
+- PLAY0694: a directionless Translate's unrouted reaction to its own capture's append (including children/nested) warns and fails `--warnaserror`. Keep the capture here, move the reaction/specs to Automation; no automatic split. Explicit inbound already refuses local consumption (PLAY0616). Older compilers do not report it; see the cheat sheet for the minimum version.
+- PLAY0700/0701: event-capture keys must be required content properties of every `from` event, not `$eventSourceId`. Supply typed `given <Event>` / `when append <Event>`, not capture records. PLAY0701 repairs only a single-source-event capture; no PLAY0700 repair. Older runners do not deliver events to captures; see the cheat sheet for the minimum version. See automations-and-translations `references/public-events-and-direction.md`.
 28. Personas drive the board: a persona must list every policy on the path, including module-level `IsAuthenticated`.
 29. A sample's source check is not execution. Run selected admitted specifications through `screenplay test`/MCP; given==when clock still fires no scheduled occurrence.
 30. Claims compare with `matches` (`claim "dept" matches "Finance"`); `==` is PLAY0120. Conditions with `contains`/`starts with` compile but do not bind.
@@ -40,7 +42,7 @@ Compiler syntax: `cheat-sheet.md`. Negative capability claims depend on the tool
 35. `description`/`documentation` are authoring metadata: board, MCP and Prologue show them; `cratis render` emits them only as XML doc comments (invalid XML characters are CLI-RENDER-005), never as behavior. A rule only in prose is unenforced in rendered code; make it a rule layer, a spec or a recorded target requirement.
 36. One unadmitted construct (operations, `numbers exact`, composite view keys) blocks whole-model binding. Routing is admitted (v8), unlike composite view keys. Overrides replace the whole route, filters never match unrouted facts. Do not remove routing or authorization to render a model.
 37. Personas remain outside ESM bytes, but specifications accept `given caller as <Persona>`: one authenticated deterministic policy witness, not every matching caller. Inspect the chosen `or` branch; use explicit callers when synthesis is refused.
-38. A rule that depends on stored state is `reads <View>` + `require <expr> message "..."` (stated intent; PLAY0268/0271 at binding are expected in design mode). The slice `description` must mark it NOT enforced in the model today and name the target: Arc `[ProtectedDecision]` + `DecisionRead<T>` (available to gap-fill, not emitted protection), Chronicle DCB (`concurrency` scope), or a constraint where one fits. Forbidden: caller-supplied copies of state in `require`, boolean attestation inputs (`confirmsX == true`), rules hidden in `handler`/implementation-hint prose. An unguarded materialized read is unsafe for a protected decision.
+38. A stored-state rule uses `reads <View>` and `require` with an indented message. Opt into `command reads protected` for eligible v25 views; absence rejects and matching decide/commit changes conflict. Legacy reads remain unprotected. Stage refuses protected reads (STAGE-ESM-044), not the v25 pair: hand-written Arc `[ProtectedDecision]` + `DecisionRead<T>` or Chronicle consistency enforcement needs separate target verification; use a constraint for uniqueness. Forbidden: caller-supplied copies of state in `require`, boolean attestation inputs (`confirmsX == true`), rules hidden in `handler`/implementation-hint prose. An unguarded materialized read is unsafe for a protected decision.
     Requires Arc 22.39.0 or later for `[ProtectedDecision]`.
 
 Identity and compliance traps (`identity.md`, `concepts.md`, `events.md`, `purposes.md`, `diagnostics.md` in the Screenplay documentation):
@@ -60,7 +62,7 @@ Identity and compliance traps (`identity.md`, `concepts.md`, `events.md`, `purpo
   unknown, not safe. Arc needs `[ExecuteCommandsAsSystem]` to supply a principal.
 
 Traps 39 to 44 are tool traps.
-39. A handler never binds: PLAY0268 "Command '<n>' handler requires a constrained implementation attachment", with a file, a fence, `implementation` or `hint` alike. `implementation` and `hint` are accepted on a command handler, an operation execute/compensate phase and a command property named rule, and are rejected on concept rules, built-in property rules and whole-command `require`/`validate` bodies; on a handler they are authoring intent only (no execution, lock or confirmation). A handler slice is gap-fill, not a customization of a rendered slice.
+39. Attached handlers remain PLAY0268; pending `handler implementation` beside unconditional productions binds as a described v23 command (PLAY0695). Body-reaching specs are Unsupported ImplementationBody; Stage refuses STAGE-IMPL-002, including Stub mode. `implementation` and `hint` are accepted on a command handler, an operation execute/compensate phase and a command property named rule, and are rejected on concept rules, built-in property rules and whole-command `require`/`validate` bodies; hints do not execute, lock or confirm a body. A handler slice is gap-fill, not a customization of a rendered slice.
 40. `numbers exact` (the source mode) parses but never binds (PLAY0268; "not admitted by any supported executable model (ESM) version yet") and is PLAY0001 on older compilers; it is absent from `grammar.md`. Exact lowering of qualifying Double-mode literals is separate (v11). Never use it in a model or example meant to execute.
 41. MCP roots bug: a dynamic-root server on an old tool answers the roots request with an `id: null` error right after `notifications/initialized`; hosts treat it as fatal, and `open-workspace.path` does not help. Start with a fixed root (`screenplay mcp <folder>`, `cratis screenplay mcp` in a project with `.cratis/ai.json`).
     Requires Screenplay 4.63.2 or later (`screenplay --version`) for a dynamic-root server; the compiler bundled in older cratis releases lacks it.

package/package/corpus/skills/cratis-screenplay-toolchain/verification.json

@@ -41,7 +41,12 @@
     { "kind": "skill-contains", "value": "cratis screenplay validate" },
     { "kind": "skill-contains", "value": "validating one file with `cratis screenplay validate file.play`", "file": "references/traps.md" },
     { "kind": "skill-contains", "value": "`notifications/initialized`" },
-    { "kind": "skill-contains", "value": "A handler never binds" },
+    { "kind": "skill-contains", "value": "Pending described handlers bind but do not execute their bodies" },
+    { "kind": "skill-contains", "value": "STAGE-ESM-043", "file": "references/language-admission.md" },
+    { "kind": "skill-contains", "value": "v25", "file": "references/language-admission.md" },
+    { "kind": "skill-contains", "value": "PLAY0787", "file": "references/diagnostics.md" },
+    { "kind": "skill-contains", "value": "stepIndex", "file": "references/diagnostic-arguments.md" },
+    { "kind": "skill-contains", "value": "never parse message text", "file": "references/diagnostic-arguments.md" },
     { "kind": "skill-contains", "value": "references/sources-and-streams.md" },
     { "kind": "skill-contains", "value": "CLI-RENDER-004" },
     { "kind": "skill-contains", "value": "Concept strategies (v15)" },

package/package/corpus/skills/cratis-screenplay-ui-composition/SKILL.md

@@ -230,66 +230,23 @@ and the review checklist. `contribute to Navigation` stays the flat contribution
 
 ## Interactions — what a click does
 
-A screen can say what it shows; an interaction says what happens when someone
-acts. Three words carry it:
-
-| Word | What it is |
-| --- | --- |
-| **Interaction trigger** | the `on <thing>` clause: `click`, `double click`, `select`, `submit`, `change`, `load`/`unload`, `enter`/`leave`, `event <Event>`, `interval <n> <unit>`, or a declared application trigger |
-| **Action** | a closed set: `execute`, `navigate to`/`navigate back`, `open dialog`/`close dialog`, `refresh`, `set … to`, `notify`, `confirm`, `raise` |
-| **Behavior** | a bundle of trigger-to-action bindings; inline (`on …`) or named (`behavior` + `uses`) |
+An interaction wires an `on <thing>` trigger to actions, inline or through named
+`behavior` + `uses`. This is closed UI wiring, not scripting; validation stays on
+the command. Trigger/action syntax is in [interaction example](references/interaction-example.md)
+and [guarded interactions](references/guarded-interactions.md).
 
 Guarded alternatives and `where` deprecation:
 [guarded interactions](references/guarded-interactions.md).
 
-Complete named/inline behavior example:
-
-```screenplay
-concept InvoiceId : Uuid
-
-behavior ConfirmThenExecute
-  parameter command
-  parameter message
-  on click
-    confirm message
-      on success
-        execute command
-
-module Invoicing
-  feature InvoiceManagement
-    slice StateChange CancelInvoice
-      command CancelInvoice
-        invoiceId InvoiceId identifier
-        produces event InvoiceCancelled
-      screen CancelInvoiceScreen
-        data InvoiceStatusView via query InvoiceStatusById by invoiceId
-        uses ConfirmThenExecute
-          command CancelInvoice
-          message "Cancel this invoice?"
-        on enter
-          refresh InvoiceStatusById
-            on failure
-              notify error "The invoice could not be loaded"
-    slice StateView InvoiceStatus
-      readmodel InvoiceStatusView
-        invoiceId InvoiceId
-        cancelled Bool
-      projection InvoiceStatuses => InvoiceStatusView
-        from InvoiceCancelled
-          invoiceId = $eventSourceId
-          cancelled = true
-      query InvoiceStatusById => InvoiceStatusView optional
-        by invoiceId InvoiceId
-```
-
-The inline event targets `invoiceId`; the projection gets it from event context.
+Read [interaction example](references/interaction-example.md) when wiring a
+named confirmation behavior and an inline refresh to the same screen.
 Scalar/named `returns` bind and reference-execute (ESM v7).
 Renderer generation/response limits: command-surface `references/generated-values-and-responses.md`.
 Screenplay resolves response names in form submit and execute success (Requires Screenplay 4.148.0 or later);
 own failure use is PLAY0685. No ESM change; Scene runtime binding remains downstream.
 An existing success continuation does not imply a response contract.
-Read [response continuations](references/response-continuations.md) for precedence,
-nested/failure scopes, PLAY0485, examples and tagged evidence.
+Read [response continuations](references/response-continuations.md) for scope,
+precedence, PLAY0485 and examples.
 
 - Write the one-off case inline; name it with `behavior` when several places need
   the same wiring. A `uses` site must supply exactly the declared parameters
@@ -307,8 +264,6 @@ nested/failure scopes, PLAY0485, examples and tagged evidence.
 - **A declared `trigger` is not a UI event.** Use `on click`, not `trigger`, for a
   button. `on <Trigger>` observes an application trigger and `raise <Trigger>`
   fires one; that is where the two meet.
-- Interactions are a closed vocabulary, not a scripting language. Validation stays
-  on the command; the UI surfaces it.
 
 ## `ui profile` and `theme`
 

package/package/corpus/skills/cratis-screenplay-ui-composition/references/file-references.md

@@ -6,8 +6,8 @@ This reference holds the three meanings of `file` and the rules for paths and lo
 
 Three meanings, one word:
 
-- **Backend implementation attachment.** On a command `handler` (which never
-  binds, `PLAY0268`), a validation
+- **Backend implementation attachment.** On an attached command `handler` (still
+  PLAY0268; pending described handlers instead bind v23 without a file), a validation
   rule predicate, a query `performer`, a reducer rule, a reaction trigger, a
   `constraint` and a `policy`, `file` stands in for the inline body: the
   implementation lives there. These are the files a host inventories.

package/package/corpus/skills/cratis-screenplay-ui-composition/references/interaction-example.md

@@ -0,0 +1,54 @@
+<!-- Copyright (c) Cratis. All rights reserved. -->
+<!-- Licensed under the MIT license. See LICENSE file in the project root for full license information. -->
+
+# Named and inline interaction example
+
+Interaction triggers are `click`, `double click`, `select`, `submit`, `change`,
+`load`/`unload`, `enter`/`leave`, `event <Event>`, `interval <n> <unit>` or a declared
+application trigger. Actions are `execute`, `navigate to`/`navigate back`,
+`open dialog`/`close dialog`, `refresh`, `set … to`, `notify`, `confirm` and `raise`.
+A behavior bundles trigger-to-action bindings, inline (`on …`) or named
+(`behavior` + `uses`); these closed vocabularies are not scripting.
+
+The named behavior confirms before executing; the screen also refreshes on enter.
+The inline event targets `invoiceId`, which the projection reads from event context.
+Validate the complete model with `screenplay <root> --warnaserror`; that validates
+source, not Scene runtime wiring.
+
+```screenplay
+concept InvoiceId : Uuid
+
+behavior ConfirmThenExecute
+  parameter command
+  parameter message
+  on click
+    confirm message
+      on success
+        execute command
+
+module Invoicing
+  feature InvoiceManagement
+    slice StateChange CancelInvoice
+      command CancelInvoice
+        invoiceId InvoiceId identifier
+        produces event InvoiceCancelled
+      screen CancelInvoiceScreen
+        data InvoiceStatusView via query InvoiceStatusById by invoiceId
+        uses ConfirmThenExecute
+          command CancelInvoice
+          message "Cancel this invoice?"
+        on enter
+          refresh InvoiceStatusById
+            on failure
+              notify error "The invoice could not be loaded"
+    slice StateView InvoiceStatus
+      readmodel InvoiceStatusView
+        invoiceId InvoiceId
+        cancelled Bool
+      projection InvoiceStatuses => InvoiceStatusView
+        from InvoiceCancelled
+          invoiceId = $eventSourceId
+          cancelled = true
+      query InvoiceStatusById => InvoiceStatusView optional
+        by invoiceId InvoiceId
+```

package/package/corpus/skills/cratis-screenplay-ui-composition/verification.json

@@ -33,15 +33,18 @@
     },
     {
       "kind": "skill-contains",
-      "value": "produces event InvoiceCancelled"
+      "value": "produces event InvoiceCancelled",
+      "file": "references/interaction-example.md"
     },
     {
       "kind": "skill-contains",
-      "value": "invoiceId = $eventSourceId"
+      "value": "invoiceId = $eventSourceId",
+      "file": "references/interaction-example.md"
     },
     {
       "kind": "skill-contains",
-      "value": "InvoiceStatusView optional"
+      "value": "InvoiceStatusView optional",
+      "file": "references/interaction-example.md"
     },
     {
       "kind": "skill-contains",

package/package/corpus/skills/cratis-stage-rendering-and-sandbox/SKILL.md

@@ -17,6 +17,12 @@ whether it is admitted; reading the admission rules is not a render result.
 
 Requires cratis CLI ≥ 3.57 (`cratis --version`) to render ESM v14 and v15 models; an older CLI refuses newer ESM versions with `CLI-RENDER-004` (or `STAGE-ESM-016` from Stage directly).
 
+## Batches, described handlers, text rules and protected reads
+
+Read [language admission](../cratis-screenplay-toolchain/references/language-admission.md)
+for v22–v25: text rules render, atomic batches/protected reads/described bodies do
+not. Stub mode emits no described-body stubs. Keep protection and report refusal.
+
 ## When to use
 
 - Deciding whether a model can be rendered, or reading a blocked render.
@@ -66,7 +72,14 @@ printed), `1` is a missing input. Add `-o json` for the counts and the publicati
 
 Facts that surprise:
 
-- **Binding uses the CLI's bundled Screenplay compiler**, which differs from a standalone one. A model that binds is not necessarily renderable: Stage admits exact ESM v1–v17 and v19 pairs (not v18/v20), then checks constructs; CLI admission can stop at v16. A newer model reports `CLI-RENDER-004` (direct Stage: `STAGE-ESM-016`). Supported generation strategies, freshness scopes, responses, equality filters, enum numbers and concept compliance render.
+- **Binding uses the CLI's bundled compiler**, not the standalone one. Version admission
+  does not imply construct support: exact ESM v1–v21 and v23–v25 pairs are admitted,
+  while v22/v26 and mixed pairs refuse `STAGE-ESM-016`. Pattern/random generation and checksum validation
+  render with an admitting renderer; `generate rule` still refuses `STAGE-ESM-028`.
+  Read [references/admission.md](references/admission.md) for the introducing-release
+  prerequisites, all-Proven unpinned specifications and construct/pin checks (-011/-038).
+  An older CLI bundle can refuse `CLI-RENDER-004` (direct Stage: `STAGE-ESM-016`);
+  keep refused models for gap-fill.
 - **Render never builds, tests or runs** the output. A published render is admission and
   publication only; build and tests are separate results (see "Verify"). Admission can be
   green while a rendered Debug test fails (for example a query assertion on the key).
@@ -81,7 +94,7 @@ Facts that surprise:
 
 `--scope` renders an admitted part while other slices wait for hand-written code or
 renderer support. The whole model must still compile and bind, so a `PLAY0268`, protected
-identity/enum, handler or newer-than-v15 problem anywhere blocks even a scoped render.
+identity/enum, attached handler or unsupported ESM version anywhere blocks even a scoped render.
 `PLAN-*` problems in unselected slices become warnings and `STAGE-ESM-*` refusals in
 unselected slices do not block. A scoped plan has no application scaffold or default Scene
 (with no manifest in the destination the plain scaffold is added). A dependency in another
@@ -91,27 +104,11 @@ first). Unselected managed files are preserved. A scoped result is evidence for
 
 ## Publication and recovery
 
-Ownership is the destination's **`.cratis-render.json`** manifest (semantic revision,
-identity, path and SHA-256 per artifact); there are no in-file markers. Interrupted
-commits are journaled in the **`.cratis-render/`** control directory (journal, staging,
-backups). Never stage `.cratis-render/` in git; commit the manifest with the output.
-
-- An unmanaged file at a planned path is refused, even with `--force`.
-- A user-modified managed file is refused unless it is still active **and** `--force` is
-  given; `--force` replaces it. It never overwrites unmanaged files and never deletes a
-  modified stale file. A stale managed file is removed only if its bytes still match.
-- Recovery runs before planning, even when planning then fails. **`recovered: true` in the
-  result means stop and reconcile**: the receipt does not describe what recovery changed.
-- An unchanged re-render writes nothing (`unchanged` equals the artifact count).
-- Use exclusive access to the destination; a receipt is a filesystem result, not a Git commit, and the command creates no branch, commit or PR.
-- Drift: `cratis render ... --check` is the first probe; exit `6` means pending changes.
-  Otherwise compare successive manifests' `semanticRevision` for renders with the same
-  `--name` and inputs. Do not compare the MCP `modelRevision` with the manifest: their
-  application identities can differ.
-
-A modified managed file reports `Managed artifact 'Program.cs' was modified by the user; pass --force to replace it.`
-Find out why it was edited, move the intent into the model or `Customizations/`, then
-re-render; use `--force` only to discard the edit on purpose.
+Read [publication and recovery](references/publication-and-recovery.md) before
+publishing or using `--force`. Commit `.cratis-render.json`, never the
+`.cratis-render/` control directory. Force never overwrites unmanaged files or
+modified stale artifacts. Recovery runs before planning:
+`recovered: true` means stop and reconcile. Use `--check` for drift, not MCP-to-manifest revision comparisons.
 
 ## Admission
 
@@ -126,14 +123,18 @@ One blocker publishes nothing. Codes, limits and fixes: [references/admission.md
   single-hop reaction append specifications, Debug specifications and authored UI through Scene.
 - **Refused:** Translate/captures, non-event triggers, opaque bodies and clock specs (`STAGE-ESM-024`);
   mixed effects (`STAGE-ESM-037`, redelivery duplicates events); unsupported reaction mappings (`-039`),
-  protected identities/enums (`-040`), non-text secrets (`-041`); generated types/results (`-028`/`-038`);
+  protected identities/enums (`-040`); unsupported generated types/results (`-028`/`-038`);
   appends beyond single-hop/cascade specs (`-011`), absence (`-027`), evolution (`STAGE-ESM-026`), public/foreign events
   (`-032`/`-033`), claim-reading/opaque `runs as` gates (`-034`), legacy filters (`-035`), production
-  overrides (`-036`), code validation (`-005`), snapshot lists/DateTime filters (`-010`), conditional
-  productions, composite projection keys and `all`. Through v15 is construct admission.
-- **Binding refusals (`PLAY0268`/`PLAY0271`):** `reads`, `concurrency`, handlers,
-  context/single-result filters, opaque scope/performer, composite `by`, enum/identity
-  compliance and subject lineage. Never drop protection.
+  overrides (`-036`), code validation (`-005`), DateTime filters (`-010`),
+  unsupported conditional productions, composite projection keys and unsupported `all` shapes.
+  Protected reads refuse `STAGE-ESM-044`, described handlers `STAGE-IMPL-002`
+  (even Stub mode), and atomic mode in admitted pairs `STAGE-ESM-043`.
+- **Binding refusals (`PLAY0268`/`PLAY0271`):** legacy reads, `concurrency`, attached
+  handlers, context/single-result filters, opaque scope/performer, composite `by`,
+  enum/identity compliance and subject lineage. Eligible protected reads bind v25;
+  pending handlers with unconditional productions bind v23, but neither renders.
+  Never drop protection.
 
 A refusal is not a licence to weaken the model: drop no specification, event generation or
 protection to get a render; keep the model, record the capability gap and gap-fill.

package/package/corpus/skills/cratis-stage-rendering-and-sandbox/references/admission.md

@@ -11,12 +11,31 @@
 - Specification rules (`STAGE-ESM-011`)
 - Refusals seen while drafting a model
 
-Stage admits exact ESM v1–v17 and v19 language/semantic pairs to construct planning,
-not v18 or v20; unknown pairs report `STAGE-ESM-016`. The CLI's bundled renderer
+Stage admits exact ESM v1–v21 and v23–v25 language/semantic pairs, then checks
+constructs. V22, v26 and mixed or unknown pairs report `STAGE-ESM-016`. The CLI's bundled renderer
 may stop at v16 and refuse newer models with `CLI-RENDER-004`.
 
-Requires Stage 4.96.0 for v16, 4.101.0 for v17, 4.102.0 for v19, and 4.103.0 for rendered redelivery; older renderers refuse the respective shapes.
+Requires Stage 4.96.0 for v16, 4.101.0 for v17, 4.102.0 for v19, 4.106.0 for v18, and 4.103.0 for rendered redelivery; older renderers refuse the respective shapes.
 Requires Cratis CLI 3.60.0 (`cratis --version`) for v16 rendering.
+Requires Stage 4.109.0 for v20 generated-concept rules; older renderers refuse v20.
+It renders New() plus ConceptValidator and refuses invalid pins with STAGE-ESM-011.
+Requires Stage 4.115.0 for v21 admission and all-Proven unpinned rendered specs;
+older renderers refuse v21 or require rule-bearing pins even when Proven.
+Requires Stage 4.117.0 for warning/info-severity generated-concept rules; older
+renderers refuse them with STAGE-ESM-038. All severities are enforced at runtime.
+Requires Stage 4.118.0 for semantic checksum validation; older renderers refuse it with STAGE-ESM-042.
+Requires Stage 4.119.0 for pattern/random rendering, Host generation and independent executor fixture checks; older renderers refuse those strategies with STAGE-ESM-028.
+`generate rule` still refuses -028. Any Unproven/Refuted rule needs a pin (-038);
+opaque/unsupported rules refuse -005 before pin evaluation. Independent execution
+always needs pins.
+Requires Stage 4.124.0 for v24 text-rule admission (`cratis --version` identifies the CLI bundle); older renderers refuse v24 with STAGE-ESM-016.
+Requires Stage 4.127.0 for v25 version admission; older renderers refuse v25 with STAGE-ESM-016. Protected reads still refuse STAGE-ESM-044.
+Described handlers refuse STAGE-IMPL-002, even Stub mode; atomic mode in an
+admitted pair refuses STAGE-ESM-043. Version admission never implements a body,
+batch or protected decision. Chronological Date/DateTime command comparisons
+select v26 in Screenplay but still refuse STAGE-ESM-016 here; standalone reference
+success is not rendering or Host/executor admission. Keep the date rule and use
+authorized gap-fill rather than downgrading to ordinal text or millisecond precision.
 
 Binding with the CLI's bundled compiler is a separate
 prerequisite. The exhaustive construct table is `references/renderable-subset.md` in
@@ -115,13 +134,13 @@ Requires Stage 4.90.0 for snapshot/live lists, 4.96.0 for non-text secrets and 4
 | `STAGE-ESM-005` | Code validation or rule predicate bodies; or a command beyond the first capability (optional event property, event revision other than the first, validation or requirement that cannot be rendered, neither `produces` nor a response) | Use declarative validation; non-initial event generations are not rendered |
 | `STAGE-ESM-006` | `produces` that cannot render without changing its destination or mappings (expression/enum conditions, literal or computed mappings, `for` not a command identifier, mappings not one-to-one with event properties, duplicate tags) | Map properties one to one; supported conditional productions render as guarded events, not separate commands |
 | `STAGE-ESM-007`, `-008`, `-009` | Projection count per read model (exactly one projection or reducer each); unresolvable properties or no single read-model transition (**flat** projections only); affected instance not one, not keyed by an event property, or not the event-source identity (flat projections only) | One projection per read model; see "Projections" below |
-| `STAGE-ESM-010` | A query is neither an optional snapshot lookup by the read-model identifier nor a supported snapshot/observable collection query; each query is checked on its own. Both collection modes render. A scalar validated key renders as its primitive and is converted inside the query, so an out-of-rule key finds no instance instead of failing validation; a validated concept inside a composite or collection argument is refused | Keyed `XById => X optional` queries or snapshot/observable lists. Equality filters render on both collections; DateTime filters, required filters after optional ones and nested validated arguments refuse 010. Filter-name collisions refuse 012. Context/single-result filters, opaque scope/performer and composite `by` remain PLAY0268 |
+| `STAGE-ESM-010` | A query is neither an optional snapshot lookup by the read-model identifier nor a supported snapshot/observable collection query; each query is checked on its own. Both collection modes render. Concept-typed keys and filters retain Arc validation, including composite members and collection elements; nullable concept keys or optional concept filters with `not empty` cannot preserve null semantics | Keyed `XById => X optional` queries or snapshot/observable lists. Equality filters render on both collections; DateTime filters, required filters after optional ones and unsupported null-validation shapes refuse 010. Filter-name collisions refuse 012. Context/single-result filters, opaque scope/performer and composite `by` remain PLAY0268 |
 | `STAGE-ESM-011` | A specification cannot render (see the rules below) | Reshape it only if the assertion keeps its meaning; otherwise keep the specification, record the gap, and gap-fill with the specification as the oracle. Never weaken or delete it to get a render |
 | `STAGE-ESM-012` | Generated C# names collide (properties, types, namespaces, constraints) | Rename |
 | `STAGE-ESM-013` | An event-context value other than `$context.occurred` mapped in `produces` | Map a command property when that preserves the meaning; otherwise gap-fill |
 | `STAGE-ESM-014` | A constraint Chronicle cannot reproduce (kind, scope, message; multi-claim in one command; optional or composite targets) | A different constraint is a requirement change for the model owner; otherwise gap-fill |
 | `STAGE-ESM-015` | Authorization Stage cannot render exactly: a role-claim URI, an opaque policy nested inside a condition, an unresolved or non-portable policy, no single identifier, an opaque-policy subject that is not text, Uuid, Date or DateTime (a restriction on opaque-policy subjects, separate from declarative claim targets), an unsupported claim artifact. Role-only, authenticated, opaque pure policies, claim conditions with Uuid, Date, DateTime or text targets (numeric and Boolean claim matches render as always false) and `not`/and/or render; roles are read through the identity's `RoleClaimType` | Reshape the policy to a portable condition; otherwise gap-fill |
-| `STAGE-ESM-016` | Model language/semantic pair is not an audited ESM v1–v17 or v19 pair; v18 and v20 remain refused. A CLI bundle stopping at v16 reports `CLI-RENDER-004` above v16 first. v14 filters and v15 generation join v11 numbers, v12 enum numbers and v13 compliance as supported constructs, not blanket construct support | Not fixable by editing: the model needs a newer renderer. Keep the model, record the gap, gap-fill |
+| `STAGE-ESM-016` | Model language/semantic pair is not admitted by the installed Stage; exact v1–v21 and v23–v25 pairs are admitted, v22/v26 and mixed pairs refused; older Stage also refuses the versions listed in the minimums above. A CLI bundle stopping at v16 reports `CLI-RENDER-004` above v16 first. v14 filters and v15 generation join v11 numbers, v12 enum numbers and v13 compliance as supported constructs, not blanket construct support | Not fixable by editing: the model needs a newer renderer. Keep the model, record the gap, gap-fill |
 | `STAGE-ESM-017` | Read model or projection cannot render (property names that collide with Chronicle paths or expression syntax, mappings that overwrite the key or child identity, composite keys, unsupported `all` mappings, the refused scope shapes below) | Reshape the projection without changing what it records, or record the gap |
 | `STAGE-ESM-018` | `$strings.` key missing in the default locale or containing formatting characters | Fix the strings |
 | `STAGE-ESM-019` | Reducer structure or body not admitted (outside a `StateView`, impure, does not compile) | An equivalent pure body, or gap-fill |
@@ -131,8 +150,8 @@ Requires Stage 4.90.0 for snapshot/live lists, 4.96.0 for non-text secrets and 4
 | `STAGE-ESM-026` | A selected event, or an event a selected slice depends on (producing command, observing projection or reducer, specification, constraint target), is above its initial revision: `Event 'X' has evolved to revision N; Stage does not render event migrations yet.` The whole selection is refused, nothing is emitted | Not fixable by editing without dropping the evolution. Gap-fill the evolved events and hand-write the migrations (`cratis-chronicle-event-type-migration`). A scoped slice of initial events that depends on no evolved event still renders |
 | `STAGE-ESM-024` | Interval, schedule, application, startup and shutdown triggers, opaque reaction bodies, captures, Translate (including directed Translate), and clock/trigger/capture specifications. Event-triggered Automation slices render as Chronicle reactors, subject to `-013` and `-034` to `-040` below | Keep refused scope as gap-fill; do not confuse semantic Host settlement with live reactor delivery |
 | `STAGE-ESM-027` | A specification asserting a read model is absent (`then no readmodel`) is not rendered (the semantic specification engine executes keyed absence) | Keep the specification; verify absence another way and record the gap |
-| `STAGE-ESM-028`, `-029` | Generated values or responses Stage cannot render. Supported scalar UUID/String-concept strategies, v15 freshness, generation fixtures, scalar/named responses and `then returns` render; unsupported generated types report `-028` | Probe the supported form; preserve refused combinations as gap-fill |
-| `STAGE-ESM-038` | Generated/response results combined with routes, generated-property/concept rules, legacy allocation, non-scalar/non-command response sources or generated-name collisions | Keep the model; gap-fill that command |
+| `STAGE-ESM-028`, `-029` | Generated values or responses Stage cannot render. Supported scalar UUID/String-concept strategies and Int random, v15 freshness, generation fixtures, scalar/named responses and `then returns` render; `generate rule`, unknown strategies and unsupported generated types report `-028` | Probe the supported form; preserve refused combinations as gap-fill |
+| `STAGE-ESM-038` | Generated/response results combined with routes, generated-property rules, legacy allocation, non-scalar/non-command response sources or generated-name collisions | Keep the model; gap-fill that command |
 | `STAGE-ESM-039`, `-040` | Reaction conditions, destinations or mappings outside the faithful target subset; protected identity uses (including reaction destinations) and protected enum concepts | See the event-reaction boundary above; never declassify protected values |
 | `STAGE-ESM-030` | Named event-source or stream definition with a reserved stored name; unformattable routed fixtures or command replay routes. The default sandbox engine also reports it for every routed model | Rename the reserved name; render the model with `cratis render`, not `cratis run` |
 | `STAGE-ESM-031` | Whole-number literal outside the C# `int` range below ESM v8 (v8 and later render `long`) | Raise the model to v8 constructs or gap-fill |
@@ -141,6 +160,10 @@ Requires Stage 4.90.0 for snapshot/live lists, 4.96.0 for non-text secrets and 4
 | `STAGE-ESM-035` | Observer filters on legacy syntax paths; semantic reaction/reducer filters render | Use semantic admission |
 | `STAGE-ESM-036` | Per-production route overrides | Gap-fill |
 | `STAGE-ESM-041` | Older renderers refuse non-text secrets; supported renderers keep their original types | Keep classification; upgrade the renderer, never declassify |
+| `STAGE-ESM-042` | Unknown validation rule kinds; checksum on the legacy syntax path (semantic checksum renders) | Keep the rule; use an admitting semantic renderer or gap-fill |
+| `STAGE-ESM-043` | `reaction batches atomic` in an admitted version pair | Keep the batch boundary; gap-fill without splitting it |
+| `STAGE-ESM-044` | Protected-read preamble, command reads or read-backed conditions/mappings in renderer, Host or specification executor | Keep protection; gap-fill with independently verified target enforcement |
+| `STAGE-IMPL-002` | Described command handler, naming command and RequirementId; also refused in Stub mode | Supply authorized implementation outside rendering; no generated stub is emitted |
 | `STAGE-ESM-037` | Events and commands from one handler, even across separate triggers on the same event in one reaction. The scaffold's Arc supports mixed results, but appends events before commands; a refused command causes redelivery and duplicate events | **Do not split the modeled reaction or drop an effect.** Gap-fill only with a proven retry-safe implementation; `[OnceOnly]` excludes replay, not retry |
 | `STAGE-ESM-023` | Information: transition bodies analysed | none |
 | `STAGE-CRATIS-001` to `-005` | Profile or `scene.json` not the package-owned shape; unrecognized or missing scaffold input; artifact path collision (`-004`, for example case names that normalize to one path); a modeled module or feature that would render into the reserved `Customizations/` (`-005`) | Rename the module, feature or case |
@@ -222,8 +245,10 @@ context, no directives, no writes to statics, `throw` limited to
 pure expressions, and no generated type shadowing a referenced one. Anything else is
 `STAGE-ESM-019`, `-021` or `-022`. A reducer needs a `StateView` slice, its read model in the
 same slice, a required Guid or text identifier and a matching keyed query. Code validation
-(`STAGE-ESM-005`) is refused outright (opaque pure policies render), and a command
-`handler` never binds (`PLAY0268`).
+(`STAGE-ESM-005`) is refused outright (opaque pure policies render). Attached
+command handlers remain `PLAY0268`; a pending handler beside unconditional
+productions binds as a described v23 command, but Stage refuses it with
+`STAGE-IMPL-002`, even in Stub mode.
 
 ## Specification rules (`STAGE-ESM-011`)
 
@@ -247,6 +272,11 @@ same slice, a required Guid or text identifier and a matching keyed query. Code
   query whose fixtures use streams other than the queried key.
 - A when-less specification is admitted only as `then denied` on an authorized keyed
   query, or `given readmodel` plus `then query` on an unprotected query.
+- Generated pins must satisfy shape and concept rules; failing pins refuse -011,
+  not an input-validation or exception assertion. Unpinned generation with any
+  Unproven/Refuted rule refuses -038; all-Proven rules permit unpinned rendered
+  specs within the admitted expectation shapes. Independent execution still
+  requires pins; see the introducing-release prerequisites above.
 - Descriptions and event documentation render only as XML doc comments; comments are never rendered, and neither is behavior.
 
 ## Refusals seen while drafting a model

package/package/corpus/skills/cratis-stage-rendering-and-sandbox/references/choosing-generation.md

@@ -9,20 +9,40 @@ Render only the supported part of the [shared shop model](../../cratis-screenpla
 CustomerId (`cus_` + ULID), TypeID OrderId and NanoID InviteCode. ApiKey remains
 secret with no generated property; do not turn .NET Bytes(32) credential generation
 into a promise of Stage secret generation. The Arc context-aware OrderId is not
-Stage's wall-clock TypeID factory or tenant isolation.
+tenant isolation: Stage's TypeID factory uses the command receipt time, not the
+tenant. InvoiceNumber pattern/checksum and random Int TicketNumber render as
+Fundamentals Pattern/Integer factories; dated patterns use receipt-time context.
+Read [admission.md](admission.md) for checksum validation and pattern/random
+rendering prerequisites and their STAGE-ESM-042/-028 refusals on older renderers.
 
 Select the strategy on the model's concept, not in managed C#: implicit UUID for
 ordinary identity, UUIDv7/ULID for time-ordered values, TypeID for typed text,
 NanoID for opaque text or bytes for an exact entropy budget. Read the shared
 [strategy, fixture and renderer reference](../../cratis-screenplay-command-surface/references/generated-values-and-responses.md)
-for exact shapes and refusals. Time-ordered factories use wall clock, not
-receipt-time `GenerationContext`; neither strict millisecond order nor `given clock`
-ID synthesis is promised.
+for exact shapes and refusals. Time-ordered factories use receipt-time
+`GenerationContext`.
+Neither strict millisecond order nor `given clock` ID synthesis is promised.
+Requires Stage 4.94.0 for receipt-time factories; older factories use wall clock.
+Requires Stage 4.109.0 for v20 rule-bearing generated concepts; older renderers
+refuse v20. It emits both New() and ConceptValidator; generated values failing
+rules are server defects after authorization/input validation, never redraws.
+Requires Stage 4.115.0 for all-Proven unpinned rendered specs; older renderers
+require pins even when Proven. Any Unproven/Refuted rule still needs a pin (-038).
+Invalid pins refuse STAGE-ESM-011; opaque/unsupported rules refuse -005 before
+pin evaluation. Every severity is enforced at runtime.
+Requires Stage 4.117.0 for warning/info-severity concept rules; older renderers refuse them with STAGE-ESM-038.
 
-## Pitfalls
+## When not to
 
 Do not generate client-owned inputs, idempotency keys, gapless invoice numbers or
 secrets. Generation is not authorization, projection readiness or external-effect
-success. Pattern/random/rule execution, sequences and clock specs remain unsupported.
-At ESM v15, Stage emits explicit whole-source concurrency scopes; below v15 it
-keeps unguarded handlers. This is not a general freshness API.
+success. Patterns are not gapless/sequential allocators or secrets; check digits
+catch typos, not forgery. Short codes need uniqueness separate from whole-source
+freshness. `generate rule` remains unsupported by Stage (STAGE-ESM-028), and
+sequence is refused by Screenplay. Admitted command clock specs render. Stage
+emits explicit whole-source scopes when the model serializes a strategy; models
+with only implicit UUID stay Unguarded even at v20. This is not a general freshness
+API. Unpinned rendered captures assert shape/range, rules and the fixed UTC date
+for dated patterns; the independent executor still requires deterministic pins.
+
+Requires Stage 4.95.0 for command clock specs; older renderers refuse them.

package/package/corpus/skills/cratis-stage-rendering-and-sandbox/references/publication-and-recovery.md

@@ -0,0 +1,31 @@
+<!-- Copyright (c) Cratis. All rights reserved. -->
+<!-- Licensed under the MIT license. See LICENSE file in the project root for full license information. -->
+
+# Managed publication and recovery
+
+Ownership is the destination's `.cratis-render.json` manifest: semantic revision,
+identity, path and SHA-256 per artifact, not in-file markers. Interrupted commits
+are journaled in `.cratis-render/` (journal, staging, backups). Never stage that
+control directory; commit the manifest with generated output.
+
+- An unmanaged file at a planned path is refused, even with `--force`.
+- A modified managed file is refused unless still active and `--force` is given.
+  Force replaces it, never overwrites unmanaged files and never deletes modified
+  stale files. Stale files are removed only when their bytes still match.
+- Recovery precedes planning. `recovered: true` means stop and reconcile: the
+  publication receipt does not describe what recovery changed.
+- An unchanged re-render writes nothing; `unchanged` equals the artifact count.
+- Use exclusive destination access. A receipt is a filesystem result, not a Git
+  commit; rendering creates no branch, commit or PR.
+- Probe drift with `cratis render ... --check` (exit 6 means pending changes).
+  Otherwise compare manifest `semanticRevision` for the same `--name` and inputs.
+  Do not compare MCP `modelRevision`: application identities can differ.
+
+A modified managed file reports:
+
+```text
+Managed artifact 'Program.cs' was modified by the user; pass --force to replace it.
+```
+
+Find why it changed, move intent into the model or `Customizations/`, then
+re-render. Use `--force` only to discard that edit deliberately.

package/package/corpus/skills/cratis-stage-rendering-and-sandbox/references/sandbox-and-specrunner.md

@@ -61,6 +61,14 @@ launch failure, nonzero exit or invalid report is 502. The timeout defaults to 1
 (1–600, including queue); specifications stay available after a later world-rebuild or
 registration failure if the model was admitted.
 
+### Semantic text rules versus the default syntax engine
+
+The semantic Host/specification executor admits v24 literal `contains`, `not contains`,
+`starts with` and `ends with` rules as ordinal UTF-16 comparisons; absence passes.
+Empty operands pass contains/starts/ends and fail not-contains for present text.
+The legacy EventModel default engine drops these rules: its list below is not evidence
+of semantic support. Generated applications render these comparisons without regex.
+
 ### What the default engine enforces
 
 When a command that declares at least one `produces` executes, the default engine

package/package/corpus/skills/cratis-stage-rendering-and-sandbox/verification.json

@@ -24,7 +24,10 @@
     { "kind": "skill-contains", "value": "`cratis run` has no `--engine` option", "file": "references/sandbox-and-specrunner.md" },
     { "kind": "skill-contains", "value": "the environment setting below", "file": "references/sandbox-and-specrunner.md" },
     { "kind": "skill-contains", "value": "fresh in-memory Chronicle log per specification", "file": "references/sandbox-and-specrunner.md" },
-    { "kind": "skill-contains", "value": "Through v15" },
+    { "kind": "skill-contains", "value": "exact ESM v1–v21 and v23–v25 pairs" },
+    { "kind": "skill-contains", "value": "STAGE-ESM-044" },
+    { "kind": "skill-contains", "value": "STAGE-IMPL-002" },
+    { "kind": "skill-contains", "value": "all-Proven rules permit unpinned rendered", "file": "references/admission.md" },
     { "kind": "skill-contains", "value": "CLI-RENDER-004" },
     { "kind": "skill-contains", "value": "STAGE-ESM-024" },
     { "kind": "skill-contains", "value": "STAGE-ESM-026" },

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cratis/pi",
-  "version": "7.62.0",
+  "version": "7.64.0",
   "description": "Configuration-aware Cratis AI integration for Pi",
   "type": "module",
   "files": [