@cratis/pi 7.65.0 → 7.67.0

package/package/corpus/skills/cratis-screenplay-toolchain/references/screenplay-contract.version

@@ -1 +1 @@
-4.199.0
+4.204.0

package/package/corpus/skills/cratis-screenplay-toolchain/references/traps.md

@@ -13,7 +13,7 @@ Compiler syntax: `cheat-sheet.md`. Negative capability claims depend on the tool
 9. Authorization (module AND feature AND construct) runs before validation; unauthorized is `then denied`, never `then error`.
 10. Without a declared actor an invocation is caller-less. Declare reaction `runs as system role "<Role>"` (ESM v10), keep its gate, and reference-test the trusted path. Stage renders role and authenticated reaction identity; claim-reading or opaque system gates refuse STAGE-ESM-034. Arc gap-fill uses `[ExecuteCommandsAsSystem]` for returned commands, not a fictional `given caller`.
 11. A reaction `produces` without `for` lands on the trigger's event source; clock and application triggers need an explicit `for`.
-12. Explicit trailing `key` marks replace inference (never `identifier`); multipart read-model keys remain PLAY0268. Without marks, single-instance queries in the owning slice must agree on `by xId XId`, where `xId` is a read-model property. Only with no such identifier and an admitted list query does `*Id` inference run (collection-key exclusions: read-surface `references/named-keys.md`); queryless views need explicit `key`. The identifier equals the projection's effective key (table in slice-design `references/read-model-design.md`; full rule, including Stage's narrower admission and `STAGE-ESM-017`, in `cratis-stage-rendering-and-sandbox` `references/admission.md`). Never mark a read-model property `identifier`. (Without explicit `key`, PLAY0268 when identity inference is ambiguous or absent; PLAY0351 when a `given`/`then` readmodel block omits that property.)
+12. Explicit trailing `key` marks replace inference (never `identifier`); several parts bind as v27 with an untyped projection `key` block per root `from` and `remove with`. Without marks, single-instance queries in the owning slice must agree on `by xId XId`, where `xId` is a read-model property. Only with no such identifier and an admitted list query does `*Id` inference run (collection-key exclusions: read-surface `references/named-keys.md`); queryless views need explicit `key`. The identifier equals the projection's effective key (table in slice-design `references/read-model-design.md`; full rule, including Stage's narrower admission and `STAGE-ESM-017`, in `cratis-stage-rendering-and-sandbox` `references/admission.md`). Never mark a read-model property `identifier`. (Without explicit `key`, PLAY0268 when identity inference is ambiguous or absent; PLAY0351 when a `given`/`then` readmodel block omits that property.)
 13. Projection `key` routes only on `from` (projection-level: PLAY0381). `all` is per event source. Joins never create instances and match the joined event's source id.
 14. AutoMap is on by default: same-named event properties fill read-model properties silently (scoped: case-insensitive, same type only; flat-bound: exact name, no type check, so a type mismatch invalidates the model). Use `no automap` for control.
 15. `given readmodel` bypasses the projection; prove a projection with `given` events + `when append`/command + `then readmodel`/`then query`.
@@ -40,7 +40,7 @@ Compiler syntax: `cheat-sheet.md`. Negative capability claims depend on the tool
 
 34. A `from <Event> key <property>` routes only if every such event carries that property: an event that frees or updates a row keyed by another stream's id must carry that id in its payload, or the row never changes. The compiler may not report a missing key property; check by hand.
 35. `description`/`documentation` are authoring metadata: board, MCP and Prologue show them; `cratis render` emits them only as XML doc comments (invalid XML characters are CLI-RENDER-005), never as behavior. A rule only in prose is unenforced in rendered code; make it a rule layer, a spec or a recorded target requirement.
-36. One unadmitted construct (operations, `numbers exact`, composite view keys) blocks whole-model binding. Routing is admitted (v8), unlike composite view keys. Overrides replace the whole route, filters never match unrouted facts. Do not remove routing or authorization to render a model.
+36. One unadmitted construct (operations, `numbers exact`) blocks whole-model binding. Routing is admitted (v8), as are flat composite view keys (v27). Overrides replace the whole route, filters never match unrouted facts. Do not remove routing or authorization to render a model.
 37. Personas remain outside ESM bytes, but specifications accept `given caller as <Persona>`: one authenticated deterministic policy witness, not every matching caller. Inspect the chosen `or` branch; use explicit callers when synthesis is refused.
 38. A stored-state rule uses `reads <View>` and `require` with an indented message. Opt into `command reads protected` for eligible v25 views; absence rejects and matching decide/commit changes conflict. Legacy reads remain unprotected. The Cratis C# renderer refuses protected reads (STAGE-ESM-044), not the v25 pair; semantic Host/executor support is separate: hand-written Arc `[ProtectedDecision]` + `DecisionRead<T>` or Chronicle consistency enforcement needs separate target verification; use a constraint for uniqueness. Forbidden: caller-supplied copies of state in `require`, boolean attestation inputs (`confirmsX == true`), rules hidden in `handler`/implementation-hint prose. An unguarded materialized read is unsafe for a protected decision.
     Requires Arc 22.39.0 or later for `[ProtectedDecision]`.

package/package/corpus/skills/cratis-screenplay-toolchain/verification.json

@@ -12,7 +12,7 @@
     { "kind": "skill-contains", "value": "PLAY0666", "file": "references/diagnostics.md" },
     { "kind": "skill-contains", "value": "bind/reference-execute as v11", "file": "references/executable-subset.md" },
     { "kind": "skill-contains", "value": "A consumer admitting v10 must include all three", "file": "references/production-routes-and-filters.md" },
-    { "kind": "skill-contains", "value": "Composite view keys remain authoring-only (PLAY0268)" },
+    { "kind": "skill-contains", "value": "Flat composite read-model keys select v27" },
     { "kind": "skill-contains", "value": "the **whole source, stream and stream id**", "file": "references/production-routes-and-filters.md" },
     { "kind": "play-compiles" },
     { "kind": "skill-contains", "value": "Requires Screenplay 4.144.0", "file": "references/verdicts.md" },

package/package/corpus/skills/cratis-screenplay-ui-composition/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: cratis-screenplay-ui-composition
-description: Compose the user interface of a Cratis Screenplay `.play` model — `layout` and responsive `arrangement`, screen/dialog templates, component data-context bindings, exposed template configuration, command forms and columns, navigation contributions, application navigation regions (topbar/sidebar, module inherit/extend/override), toolbar slice buttons, blueprint template references, sample data packs, hierarchical outlets/routes, toolbar dialogs, package/icon selection, interaction `behavior`/`on`/`uses` wiring, `ui profile`, `theme`, localized `$strings`, and `file` references. Use when declaring the application shell, reusable screen shapes, component/package configuration, command forms, navigation/toolbars, click or submit behavior, or theming. Do not use for a screen's own data and actions.
+description: Compose the user interface of a Cratis Screenplay `.play` model — `layout` and responsive `arrangement`, screen/dialog templates, component data-context bindings, exposed template configuration, command forms and columns, navigation contributions, application navigation regions (topbar/sidebar, module inherit/extend/override), toolbar slice buttons, blueprint template references, sample data packs, hierarchical outlets/routes, toolbar dialogs, package/icon selection, interaction `behavior`/`on`/`uses` wiring, `ui profile` (root template, shell options, appearance, new screens default), `theme`, localized `$strings`, and `file` references. Use when declaring the application shell, reusable screen shapes, component/package configuration, command forms, navigation/toolbars, click or submit behavior, or theming. Do not use for a screen's own data and actions.
 license: MIT
 ---
 
@@ -81,7 +81,7 @@ Read `references/worked-flow.md` when a complete example is needed before compos
 
 ## `layout` — the application shell
 
-One per application, declared at the top level and selected by a `ui profile`.
+One or more per application, declared at the top level; a `ui profile` selects the shell with `root template <Name>`.
 A complete example:
 
 ```screenplay
@@ -267,7 +267,7 @@ precedence, PLAY0485 and examples.
 
 ## `ui profile` and `theme`
 
-A `ui profile` selects the layout, theme and `packages`, listed in override-priority order (a later package shadows an earlier one); `target platform` and `target size` accept any identifier, so a typo is silent. Read [references/ui-profile-and-theme.md](references/ui-profile-and-theme.md) when writing a profile or theme.
+A `ui profile` selects the application shell with `root template` (an own layout or application-scope screen template, or `blueprint <B> <Name>` with an optional `version` pin), its shell `option` lines, an `appearance` block (`color scheme`, `accent`), the template new screens start from (`new screens use template`), the theme and the `packages`, listed in override-priority order (a later package shadows an earlier one); `target platform` and `target size` accept any identifier, so a typo is silent. The legacy `layout <Name>` line inside a profile still reads but warns `PLAY0791`: write `root template`. `PLAY0790` to `PLAY0799` check the shell. Read [references/ui-profile-and-theme.md](references/ui-profile-and-theme.md) when writing a profile or theme, or fixing a shell diagnostic.
 
 ## Localized strings
 
@@ -288,6 +288,7 @@ Localized text lives in companion `.strings` files and is referenced unquoted as
 - [ ] Every slot a `contribute` targets is declared `contributes <Point>` somewhere
       that encloses it.
 - [ ] No `dialog template` declares `fits slot`.
+- [ ] Each `ui profile` names its shell with `root template`, not the legacy `layout` line (`PLAY0791`); a blueprint shell is listed under `packages` and its `version` pin is deliberate.
 - [ ] `packages` are ordered deliberately — later shadows earlier.
 - [ ] Every theme a profile selects is `compatible with` one of its packages.
 - [ ] `target platform` and `target size` values are spelled correctly; nothing

package/package/corpus/skills/cratis-screenplay-ui-composition/references/application-shell.md

@@ -41,7 +41,7 @@ layout AppShell
 
 ui profile Desktop
   target platform web
-  layout AppShell
+  root template AppShell
 
   packages
     core

package/package/corpus/skills/cratis-screenplay-ui-composition/references/screen-composition-contract.md

@@ -200,7 +200,7 @@ field.
 ```screenplay excerpt
 ui profile Desktop
   target platform web
-  layout AppShell
+  root template AppShell
   packages
     Product.DesignSystem
     Cratis.Components

package/package/corpus/skills/cratis-screenplay-ui-composition/references/ui-profile-and-theme.md

@@ -1,6 +1,124 @@
 # UI profile and theme
 
-This reference holds the `ui profile` and `theme` excerpt and its rules for platforms, sizes, package order and theme compatibility.
+## Contents
+
+- The shell: `root template`
+- `ui profile` and `theme`
+- Reading and editing the shell
+
+This reference holds the `ui profile` and `theme` excerpts and their rules: the root template that names the application shell, shell options, appearance, the new screens default, platforms, sizes, package order and theme compatibility. Requires Screenplay 4.200.0 or later (`screenplay --version`) for the diagnostics `PLAY0790` to `PLAY0799`; 4.197.0 reads the syntax.
+
+## The shell: `root template`
+
+A `ui profile` names the template the whole application is drawn in with `root template`. Every screen's template chain is placed in the
+shell's primary outlet (`content`). The reference is the one a `template` assignment uses: an own `layout` or application-scope
+screen template by name, or a template a blueprint ships, `blueprint <Blueprint> <Name>`, with an optional `version "<range>"` pin.
+`ui profile` is the only place that selects the shell; a screen never names it.
+
+```screenplay
+layout AppShell
+  category application
+  topbar
+  side
+  content
+
+exposure for AppShell
+  property topbar.showFooter label "Footer"
+
+module Workspaces
+  screen template Sheet
+    category Page
+    scopes feature
+    content
+
+ui profile Desktop
+  target platform web
+  target size regular
+  theme Nordic
+
+  root template AppShell
+    option showFooter true
+
+  appearance
+    color scheme dark
+    accent "#4F46E5"
+
+  new screens use template Sheet
+
+  packages
+    Cratis.Components
+
+theme Nordic
+  compatible with Cratis.Components
+```
+
+A shell from a blueprint lists the blueprint under `packages` (the blueprint's name is a package) and may pin a version:
+
+```screenplay
+ui profile Web
+  packages
+    Cratis.Blueprint.Default
+
+  root template blueprint Cratis.Blueprint.Default AppShell version "^4.5"
+  new screens use template blueprint Cratis.Blueprint.Default Detail
+```
+
+- `root template`: at most one per profile. The shell is a `layout`, or a screen template that declares `scopes application` and fits no slot. It
+  needs a `content` slot, or no screen has a place in it.
+- `option <name> <value>`: a configurable item the shell exposes (an own shell exposes the properties of its `exposure for <Shell>`).
+  The value is a bare word, a quoted string, a number, `true` or `false`. Set each name once.
+- `appearance`: `color scheme` is `light`, `dark` or `system`; `accent` is a quoted `#RGB`, `#RRGGBB` or `#RRGGBBAA`. One block per profile.
+- `new screens use template`: the template a new screen starts from in a designer. It is an authoring default, it changes no existing
+  screen, and it has to be able to start a screen in a feature (not a layout or an application-scope root; a `scopes` list that leaves
+  out `feature` is refused).
+- A version range only applies to a blueprint template; `*`, an exact version or a `^`, `~`, `>=`, `>`, `<=` or `<` range.
+
+### Errors and fixes
+
+| Code | Severity | Cause | Fix |
+| --- | --- | --- | --- |
+| `PLAY0788` | Error | A `root template` or `new screens use template` line is malformed, or it pins a version on an own template | Write `[blueprint <B>] <Name> [version "<range>"]`; drop the version on an own template |
+| `PLAY0789` | Error | A malformed `appearance` line, a repeated line, or two `appearance` blocks | `color scheme <word>` / `accent "<colour>"`, each once, one block |
+| `PLAY0790` | Error | The template is not declared in the document (or the blueprint does not ship it) | Declare `layout <Name>` or `screen template <Name>`, or take it from a blueprint |
+| `PLAY0791` | Warning | The profile still selects its shell with the legacy `layout <Name>` line | Write `root template <Name>`; remove the `layout` line when a `root template` is present (the quick fix does either) |
+| `PLAY0792` | Error | The blueprint is not listed in the profile's `packages` (or not installed) | Add it under `packages` |
+| `PLAY0793` | Warning | The pinned `version` range is not satisfied by the installed blueprint | Move the pin or update the blueprint |
+| `PLAY0794` | Error | The root template cannot be the shell: a dialog or ordinary screen template, a slot-fitting template, `scopes` without `application` | Choose a layout or an application-scope template |
+| `PLAY0795` | Error | The root template has no `content` slot | Add the line `content` to it |
+| `PLAY0796` | Warning | An `option` the shell does not expose | Use a name the shell exposes, or add the property to its `exposure` |
+| `PLAY0797` | Error | An invalid color scheme or accent | `light`, `dark` or `system`; a quoted hex colour |
+| `PLAY0798` | Error | More than one `root template` in one profile | Keep one |
+| `PLAY0799` | Error | The `new screens use template` default cannot start a screen in a feature | Name a feature-scope screen template |
+
+What a blueprint ships is only known where the blueprint is installed, so its checks (`PLAY0790` for a template it lacks, `PLAY0793`,
+the options and outlets of its templates) come from the host that has the catalog (Stage, the `cratis` CLI, the MCP server); the compiler
+decides everything the document alone decides.
+
+### Negative example: the legacy `layout` line
+
+`layout <Name>` inside a profile still reads, but it is the old way to name the shell. Do not write it in a new model:
+
+```screenplay excerpt
+layout AppShell
+  category application
+  topbar
+  content
+
+ui profile Desktop
+  layout AppShell
+```
+
+The canonical form is `root template AppShell`:
+
+```screenplay
+layout AppShell
+  category application
+  topbar
+  content
+
+ui profile Desktop
+  root template AppShell
+```
 
 ## `ui profile` and `theme`
 
@@ -10,7 +128,7 @@ Excerpt: `AppShell` is the layout above.
 ui profile Desktop
   target platform web
   target size regular
-  layout AppShell
+  root template AppShell
   theme Nordic
   packages
     Cratis.Components
@@ -32,3 +150,7 @@ theme Nordic
 - `compatible with` lists the packages a theme actually supports, each at most
   once. A profile selecting a theme not declared compatible with one of its own
   packages gets a compile-time **warning**.
+
+## Reading and editing the shell
+
+`ui-profiles` (MCP, Screenplay 4.201.0 or later) returns every profile's root template, options, appearance and new screens default with the shell diagnostics, and the own templates that could be the root template or the new screens default. Edit with `propose-ast` on `RootTemplateSyntax`, `ShellOptionSyntax` (`syntaxKind` is the value's kind), `ProfileAppearanceSyntax` and `NewScreenTemplateSyntax`; an invalid reference is refused with its code.

package/package/corpus/skills/cratis-screenplay-ui-composition/verification.json

@@ -146,6 +146,31 @@
       "kind": "skill-contains",
       "value": "references/application-shell.md"
     },
+    {
+      "kind": "skill-contains",
+      "value": "`ui profile` is the only place that selects the shell",
+      "file": "references/ui-profile-and-theme.md"
+    },
+    {
+      "kind": "skill-contains",
+      "value": "| `PLAY0791` | Warning |",
+      "file": "references/ui-profile-and-theme.md"
+    },
+    {
+      "kind": "skill-contains",
+      "value": "| `PLAY0799` | Error |",
+      "file": "references/ui-profile-and-theme.md"
+    },
+    {
+      "kind": "skill-contains",
+      "value": "`layout <Name>` inside a profile still reads",
+      "file": "references/ui-profile-and-theme.md"
+    },
+    {
+      "kind": "skill-contains",
+      "value": "`root template` (an own layout or application-scope screen template",
+      "file": "SKILL.md"
+    },
     {
       "kind": "skill-contains",
       "value": "A module's own items may only target that module",

package/package/corpus/skills/cratis-stage-rendering-and-sandbox/SKILL.md

@@ -74,8 +74,9 @@ printed), `1` is a missing input. Add `-o json` for the counts and the publicati
 Facts that surprise:
 
 - **Binding uses the CLI's bundled compiler**, not the standalone one. Version admission
-  does not imply construct support: exact ESM v1–v21 and v23–v25 pairs are admitted,
-  while v22/v26 and mixed pairs refuse `STAGE-ESM-016`. Pattern/random generation and checksum validation
+  does not imply construct support: exact ESM v1–v21 and v23–v26 pairs are admitted,
+  while v22/v27 and mixed pairs refuse `STAGE-ESM-016`. Date/DateTime command comparisons (v26)
+  execute in the semantic Host and executor but refuse `STAGE-ESM-046` in the renderer. Pattern/random generation and checksum validation
   render with an admitting renderer; `generate rule` still refuses `STAGE-ESM-028`.
   Read [references/admission.md](references/admission.md) for the introducing-release
   prerequisites, all-Proven unpinned specifications and construct/pin checks (-011/-038).
@@ -132,9 +133,9 @@ One blocker publishes nothing. Codes, limits and fixes: [references/admission.md
   The Cratis C# renderer refuses protected reads with `STAGE-ESM-044`, described handlers `STAGE-IMPL-002`
   (even Stub mode), and atomic mode in admitted pairs `STAGE-ESM-043`.
 - **Binding refusals (`PLAY0268`/`PLAY0271`):** legacy reads, `concurrency`, attached
-  handlers, context/single-result filters, opaque scope/performer, composite `by`,
+  handlers, context/single-result filters, opaque scope/performer, a list-query `by` block,
   enum/identity compliance and subject lineage. Eligible protected reads bind v25;
-  pending handlers with unconditional productions bind v23, but neither renders.
+  pending handlers with unconditional productions bind v23, but neither renders. A read model with several key parts (v27) refuses `STAGE-ESM-016`.
   Never drop protection.
 
 A refusal is not a licence to weaken the model: drop no specification, event generation or

package/package/corpus/skills/cratis-stage-rendering-and-sandbox/references/admission.md

@@ -11,8 +11,8 @@
 - Specification rules (`STAGE-ESM-011`)
 - Refusals seen while drafting a model
 
-Stage admits exact ESM v1–v21 and v23–v25 language/semantic pairs, then checks
-constructs. V22, v26 and mixed or unknown pairs report `STAGE-ESM-016`. The CLI's bundled renderer
+Stage admits exact ESM v1–v21 and v23–v26 language/semantic pairs, then checks
+constructs. V22, v27 and mixed or unknown pairs report `STAGE-ESM-016`. The CLI's bundled renderer
 may stop at v16 and refuse newer models with `CLI-RENDER-004`.
 
 Requires Stage 4.96.0 for v16, 4.101.0 for v17, 4.102.0 for v19, 4.106.0 for v18, and 4.103.0 for rendered redelivery; older renderers refuse the respective shapes.
@@ -34,9 +34,13 @@ Requires Stage 4.129.0 for semantic Host/executor protected reads; older engines
 Described handlers refuse STAGE-IMPL-002, even Stub mode; atomic mode in an
 admitted pair refuses STAGE-ESM-043. Version admission never implements a body,
 batch or rendered protected decision. Chronological Date/DateTime command comparisons
-select v26 in Screenplay but still refuse STAGE-ESM-016 here; standalone reference
-success is not rendering or Host/executor admission. Keep the date rule and use
-authorized gap-fill rather than downgrading to ordinal text or millisecond precision.
+select v26. The semantic Host and specification executor run them; the renderer,
+legacy engines and default sandbox engine refuse them with STAGE-ESM-046, naming the
+property, and emit no artifacts. Standalone reference success is not rendering. Keep
+the date rule and use authorized gap-fill rather than downgrading to ordinal text or
+millisecond precision.
+
+Requires Stage 4.135.0 for v26 admission; older Stage refuses v26 with STAGE-ESM-016.
 
 Binding with the CLI's bundled compiler is a separate
 prerequisite. The exhaustive construct table is `references/renderable-subset.md` in
@@ -135,13 +139,13 @@ Requires Stage 4.90.0 for snapshot/live lists, 4.96.0 for non-text secrets and 4
 | `STAGE-ESM-005` | Code validation or rule predicate bodies; or a command beyond the first capability (optional event property, event revision other than the first, validation or requirement that cannot be rendered, neither `produces` nor a response) | Use declarative validation; non-initial event generations are not rendered |
 | `STAGE-ESM-006` | `produces` that cannot render without changing its destination or mappings (expression/enum conditions, literal or computed mappings, `for` not a command identifier, mappings not one-to-one with event properties, duplicate tags) | Map properties one to one; supported conditional productions render as guarded events, not separate commands |
 | `STAGE-ESM-007`, `-008`, `-009` | Projection count per read model (exactly one projection or reducer each); unresolvable properties or no single read-model transition (**flat** projections only); affected instance not one, not keyed by an event property, or not the event-source identity (flat projections only) | One projection per read model; see "Projections" below |
-| `STAGE-ESM-010` | A query is neither an optional snapshot lookup by the read-model identifier nor a supported snapshot/observable collection query; each query is checked on its own. Both collection modes render. Concept-typed keys and filters retain Arc validation, including composite members and collection elements; nullable concept keys or optional concept filters with `not empty` cannot preserve null semantics | Keyed `XById => X optional` queries or snapshot/observable lists. Equality filters render on both collections; DateTime filters, required filters after optional ones and unsupported null-validation shapes refuse 010. Filter-name collisions refuse 012. Context/single-result filters, opaque scope/performer and composite `by` remain PLAY0268 |
+| `STAGE-ESM-010` | A query is neither an optional snapshot lookup by the read-model identifier nor a supported snapshot/observable collection query; each query is checked on its own. Both collection modes render. Concept-typed keys and filters retain Arc validation, including composite members and collection elements; nullable concept keys or optional concept filters with `not empty` cannot preserve null semantics | Keyed `XById => X optional` queries or snapshot/observable lists. Equality filters render on both collections; DateTime filters, required filters after optional ones and unsupported null-validation shapes refuse 010. Filter-name collisions refuse 012. Context/single-result filters, opaque scope/performer and a list-query `by` block remain PLAY0268; a read model with several key parts (v27) refuses `STAGE-ESM-016` |
 | `STAGE-ESM-011` | A specification cannot render (see the rules below) | Reshape it only if the assertion keeps its meaning; otherwise keep the specification, record the gap, and gap-fill with the specification as the oracle. Never weaken or delete it to get a render |
 | `STAGE-ESM-012` | Generated C# names collide (properties, types, namespaces, constraints) | Rename |
 | `STAGE-ESM-013` | An event-context value other than `$context.occurred` mapped in `produces` | Map a command property when that preserves the meaning; otherwise gap-fill |
 | `STAGE-ESM-014` | A constraint Chronicle cannot reproduce (kind, scope, message; multi-claim in one command; optional or composite targets) | A different constraint is a requirement change for the model owner; otherwise gap-fill |
 | `STAGE-ESM-015` | Authorization Stage cannot render exactly: a role-claim URI, an opaque policy nested inside a condition, an unresolved or non-portable policy, no single identifier, an opaque-policy subject that is not text, Uuid, Date or DateTime (a restriction on opaque-policy subjects, separate from declarative claim targets), an unsupported claim artifact. Role-only, authenticated, opaque pure policies, claim conditions with Uuid, Date, DateTime or text targets (numeric and Boolean claim matches render as always false) and `not`/and/or render; roles are read through the identity's `RoleClaimType` | Reshape the policy to a portable condition; otherwise gap-fill |
-| `STAGE-ESM-016` | Model language/semantic pair is not admitted by the installed Stage; exact v1–v21 and v23–v25 pairs are admitted, v22/v26 and mixed pairs refused; older Stage also refuses the versions listed in the minimums above. A CLI bundle stopping at v16 reports `CLI-RENDER-004` above v16 first. v14 filters and v15 generation join v11 numbers, v12 enum numbers and v13 compliance as supported constructs, not blanket construct support | Not fixable by editing: the model needs a newer renderer. Keep the model, record the gap, gap-fill |
+| `STAGE-ESM-016` | Model language/semantic pair is not admitted by the installed Stage; exact v1–v21 and v23–v26 pairs are admitted, v22/v27 and mixed pairs refused; older Stage also refuses the versions listed in the minimums above. A CLI bundle stopping at v16 reports `CLI-RENDER-004` above v16 first. v14 filters and v15 generation join v11 numbers, v12 enum numbers and v13 compliance as supported constructs, not blanket construct support | Not fixable by editing: the model needs a newer renderer. Keep the model, record the gap, gap-fill |
 | `STAGE-ESM-017` | Read model or projection cannot render (property names that collide with Chronicle paths or expression syntax, mappings that overwrite the key or child identity, composite keys, unsupported `all` mappings, the refused scope shapes below) | Reshape the projection without changing what it records, or record the gap |
 | `STAGE-ESM-018` | `$strings.` key missing in the default locale or containing formatting characters | Fix the strings |
 | `STAGE-ESM-019` | Reducer structure or body not admitted (outside a `StateView`, impure, does not compile) | An equivalent pure body, or gap-fill |
@@ -164,6 +168,7 @@ Requires Stage 4.90.0 for snapshot/live lists, 4.96.0 for non-text secrets and 4
 | `STAGE-ESM-042` | Unknown validation rule kinds; checksum on the legacy syntax path (semantic checksum renders) | Keep the rule; use an admitting semantic renderer or gap-fill |
 | `STAGE-ESM-043` | `reaction batches atomic` in an admitted version pair | Keep the batch boundary; gap-fill without splitting it |
 | `STAGE-ESM-044` | Protected-read preamble, command reads or read-backed conditions/mappings in the Cratis C# renderer; legacy Host/structural runner also refuse the preamble | Keep protection; semantic Host/executor support is separate from generated-app enforcement |
+| `STAGE-ESM-046` | Date/DateTime comparison in `require`, `produces when` or a validation rule (including through concepts) in the renderer, legacy engines or default sandbox engine; names the property | Keep the date rule; the semantic Host/executor run it; deliver rendering through gap-fill that compares exact calendar dates and UTC ticks |
 | `STAGE-ESM-045` | Non-Error requirement on a protected command, including reaction-invoked commands; semantic admission refuses before reads, requirements or facts | Keep the severity contract; record the execution gap, never silently promote or drop the requirement |
 | `STAGE-IMPL-002` | Described command handler, naming command and RequirementId; also refused in Stub mode | Supply authorized implementation outside rendering; no generated stub is emitted |
 | `STAGE-ESM-037` | Events and commands from one handler, even across separate triggers on the same event in one reaction. The scaffold's Arc supports mixed results, but appends events before commands; a refused command causes redelivery and duplicate events | **Do not split the modeled reaction or drop an effect.** Gap-fill only with a proven retry-safe implementation; `[OnceOnly]` excludes replay, not retry |

package/package/corpus/skills/cratis-stage-rendering-and-sandbox/references/sandbox-and-specrunner.md

@@ -4,6 +4,7 @@
 
 - The sandbox: a partial, disposable runtime
 - Protected command reads
+- Date comparisons (v26)
 - Refusals shared by both engines
 - The specification runner
 - Choosing between them
@@ -128,6 +129,22 @@ even an unrelated one, before committing an accepted command. This interim guard
 is stricter than the reference's dependency-scoped decide/commit conflicts; do not
 claim full reference conflict parity or generated-application protection.
 
+## Date comparisons (v26)
+
+Requires Stage 4.135.0 for v26 admission; older Stage refuses v26 with `STAGE-ESM-016`.
+The semantic Host and specification executor compare `Date` as calendar days and
+`DateTime` as UTC ticks in `require`, `produces when` and validation rules, including
+through concepts. A participating `DateTime` input without an offset or `Z` rejects
+with Validation after authorization and before any rule. `then` stays ordinal. The
+renderer, legacy engines and default sandbox engine refuse these comparisons with
+`STAGE-ESM-046`, naming the property; no date validators or artifacts are emitted.
+
+One ordering differs from the reference: the reference checks authorization, then
+offsets, then opaque C# validation, so an offset-less DateTime beside opaque
+validation is a Validation rejection there. The specification executor refuses opaque
+validation at run admission and the Host refuses it before authorization, so both Stage
+paths report `Unsupported`, which never counts as a pass.
+
 ## Refusals shared by both engines
 
 Both engines refuse public events (`STAGE-ESM-032`), foreign or source-event captures

package/package/corpus/skills/cratis-stage-rendering-and-sandbox/verification.json

@@ -24,7 +24,7 @@
     { "kind": "skill-contains", "value": "`cratis run` has no `--engine` option", "file": "references/sandbox-and-specrunner.md" },
     { "kind": "skill-contains", "value": "the environment setting below", "file": "references/sandbox-and-specrunner.md" },
     { "kind": "skill-contains", "value": "fresh in-memory Chronicle log per specification", "file": "references/sandbox-and-specrunner.md" },
-    { "kind": "skill-contains", "value": "exact ESM v1–v21 and v23–v25 pairs" },
+    { "kind": "skill-contains", "value": "exact ESM v1–v21 and v23–v26 pairs" },
     { "kind": "skill-contains", "value": "STAGE-ESM-044" },
     { "kind": "skill-contains", "value": "STAGE-IMPL-002" },
     { "kind": "skill-contains", "value": "all-Proven rules permit unpinned rendered", "file": "references/admission.md" },

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cratis/pi",
-  "version": "7.65.0",
+  "version": "7.67.0",
   "description": "Configuration-aware Cratis AI integration for Pi",
   "type": "module",
   "files": [