@cratis/pi 7.66.0 → 7.68.0

package/package/corpus/skills/cratis-screenplay-toolchain/references/screenplay-contract.version

@@ -1 +1 @@
-4.201.0
+4.204.0

package/package/corpus/skills/cratis-screenplay-toolchain/references/traps.md

@@ -13,7 +13,7 @@ Compiler syntax: `cheat-sheet.md`. Negative capability claims depend on the tool
 9. Authorization (module AND feature AND construct) runs before validation; unauthorized is `then denied`, never `then error`.
 10. Without a declared actor an invocation is caller-less. Declare reaction `runs as system role "<Role>"` (ESM v10), keep its gate, and reference-test the trusted path. Stage renders role and authenticated reaction identity; claim-reading or opaque system gates refuse STAGE-ESM-034. Arc gap-fill uses `[ExecuteCommandsAsSystem]` for returned commands, not a fictional `given caller`.
 11. A reaction `produces` without `for` lands on the trigger's event source; clock and application triggers need an explicit `for`.
-12. Explicit trailing `key` marks replace inference (never `identifier`); multipart read-model keys remain PLAY0268. Without marks, single-instance queries in the owning slice must agree on `by xId XId`, where `xId` is a read-model property. Only with no such identifier and an admitted list query does `*Id` inference run (collection-key exclusions: read-surface `references/named-keys.md`); queryless views need explicit `key`. The identifier equals the projection's effective key (table in slice-design `references/read-model-design.md`; full rule, including Stage's narrower admission and `STAGE-ESM-017`, in `cratis-stage-rendering-and-sandbox` `references/admission.md`). Never mark a read-model property `identifier`. (Without explicit `key`, PLAY0268 when identity inference is ambiguous or absent; PLAY0351 when a `given`/`then` readmodel block omits that property.)
+12. Explicit trailing `key` marks replace inference (never `identifier`); several parts bind as v27 with an untyped projection `key` block per root `from` and `remove with`. Without marks, single-instance queries in the owning slice must agree on `by xId XId`, where `xId` is a read-model property. Only with no such identifier and an admitted list query does `*Id` inference run (collection-key exclusions: read-surface `references/named-keys.md`); queryless views need explicit `key`. The identifier equals the projection's effective key (table in slice-design `references/read-model-design.md`; full rule, including Stage's narrower admission and `STAGE-ESM-017`, in `cratis-stage-rendering-and-sandbox` `references/admission.md`). Never mark a read-model property `identifier`. (Without explicit `key`, PLAY0268 when identity inference is ambiguous or absent; PLAY0351 when a `given`/`then` readmodel block omits that property.)
 13. Projection `key` routes only on `from` (projection-level: PLAY0381). `all` is per event source. Joins never create instances and match the joined event's source id.
 14. AutoMap is on by default: same-named event properties fill read-model properties silently (scoped: case-insensitive, same type only; flat-bound: exact name, no type check, so a type mismatch invalidates the model). Use `no automap` for control.
 15. `given readmodel` bypasses the projection; prove a projection with `given` events + `when append`/command + `then readmodel`/`then query`.
@@ -40,7 +40,7 @@ Compiler syntax: `cheat-sheet.md`. Negative capability claims depend on the tool
 
 34. A `from <Event> key <property>` routes only if every such event carries that property: an event that frees or updates a row keyed by another stream's id must carry that id in its payload, or the row never changes. The compiler may not report a missing key property; check by hand.
 35. `description`/`documentation` are authoring metadata: board, MCP and Prologue show them; `cratis render` emits them only as XML doc comments (invalid XML characters are CLI-RENDER-005), never as behavior. A rule only in prose is unenforced in rendered code; make it a rule layer, a spec or a recorded target requirement.
-36. One unadmitted construct (operations, `numbers exact`, composite view keys) blocks whole-model binding. Routing is admitted (v8), unlike composite view keys. Overrides replace the whole route, filters never match unrouted facts. Do not remove routing or authorization to render a model.
+36. One unadmitted construct (operations, `numbers exact`) blocks whole-model binding. Routing is admitted (v8), as are flat composite view keys (v27). Overrides replace the whole route, filters never match unrouted facts. Do not remove routing or authorization to render a model.
 37. Personas remain outside ESM bytes, but specifications accept `given caller as <Persona>`: one authenticated deterministic policy witness, not every matching caller. Inspect the chosen `or` branch; use explicit callers when synthesis is refused.
 38. A stored-state rule uses `reads <View>` and `require` with an indented message. Opt into `command reads protected` for eligible v25 views; absence rejects and matching decide/commit changes conflict. Legacy reads remain unprotected. The Cratis C# renderer refuses protected reads (STAGE-ESM-044), not the v25 pair; semantic Host/executor support is separate: hand-written Arc `[ProtectedDecision]` + `DecisionRead<T>` or Chronicle consistency enforcement needs separate target verification; use a constraint for uniqueness. Forbidden: caller-supplied copies of state in `require`, boolean attestation inputs (`confirmsX == true`), rules hidden in `handler`/implementation-hint prose. An unguarded materialized read is unsafe for a protected decision.
     Requires Arc 22.39.0 or later for `[ProtectedDecision]`.
@@ -69,3 +69,4 @@ Traps 39 to 44 are tool traps.
 42. A symlinked model path is refused by the MCP server (macOS `/tmp` is a symlink); pass the physical path. Proposals are connection-local (at most 16); `apply` persists identities to `.screenplay/identities.json` and is not crash-atomic across files; never retry `apply` after `ApplyOutcomeUnknown`.
 43. `modelRevision` is canonical semantic (line positions and descriptions do not change it; a file move only if it changes logical placement or application identity) and, without `identities.json`, changes with the root folder name; it is not comparable with a render's `semanticRevision`. Source identity for verdicts is the commit plus the digest from the source-identity helper (`cratis-screenplay-modeling-lifecycle` `references/verdicts-and-modes.md` "Source identity").
 44. `cratis render` neither builds nor tests; `--name` is required for plain source; `.cratis-render/` is control state and is never staged; rendered apps pin their own Arc and Chronicle versions (`[ProtectedDecision]` is available to gap-fill, not automatically emitted). `cratis` file mode versus folder mode (trap 6) and a stale `cratis` on `PATH` (`which -a cratis`) both silently change what a verdict means.
+45. A reducer cannot be re-keyed: its instances follow the event-source id, so a query `by` another identity type warns PLAY0690 (`--warnaserror` fails it; editors only show it when the host supplies native findings). Aggregate by a payload value with a projection keyed on each `from`, or a join: projections [reducer identity](../../cratis-screenplay-projections/references/reducer-identity.md).

package/package/corpus/skills/cratis-screenplay-toolchain/references/verdicts.md

@@ -3,6 +3,7 @@
 ## Contents
 
 - V1: authorable
+- Declared validation gate (`screenplay.json`)
 - Release-baseline gate (independent of V1–V5)
 - V2: executable diagnostics
 - V3: binding-ready
@@ -51,8 +52,67 @@ render, V1 and V5 from the CLIs. Read installed versions with `screenplay --vers
 - Warnings are failures here. PLAY0029 (a construct dropped silently) and the unresolved-name
   warnings are the defects this verdict exists to catch.
 - Syntax and consistency checks (PLAY0282 to PLAY0294) run; binding does not.
+- A `screenplay.json` at the model root supplies checks, warnings-as-errors, scope and open-questions
+  mode to both commands above, so they need not repeat those flags; drop `--warnaserror` only when
+  `--print-gate` shows `warningsAsErrors: true`. Read the effective gate before
+  reporting (next section).
 - Report: `V1 pass (screenplay <version>, 3 files)`, `V1 fail: PLAY0029 in a.play, line 12`.
 
+## Declared validation gate (`screenplay.json`)
+
+A repository declares its V1 gate once, in an authored `screenplay.json` at the model root,
+beside the tool-owned `.screenplay/`. Prefer it to repeating `--check`, `--warnaserror`,
+`--scope` and `--open-questions` in every script: every run then enforces the same gate.
+`screenplay.json` is the only file there people write; no tool creates or edits it.
+
+```json
+{
+  "$schema": "https://raw.githubusercontent.com/Cratis/Screenplay/main/Documentation/screenplay/screenplay-v1.schema.json",
+  "validation": {
+    "checks": ["field-origins", "query-keys", "navigation"],
+    "warningsAsErrors": true,
+    "scope": "Workspaces.Tracking",
+    "openQuestions": "fail"
+  }
+}
+```
+
+- Every member is optional. A `checks` item is one check name, diagnostic code or `all`
+  (never a comma list); `all` expands to every check the running tool supports, so an upgrade can
+  strengthen the gate, while an explicit list pins it. `openQuestions` is `report` or `fail`;
+  omitted means notes are not evaluated.
+- The model root is the nearest folder at or above the target (a file's parent) that holds
+  `screenplay.json` or `.screenplay/`. The search includes but never crosses the first folder with
+  `.git`; with no match the target folder is the root and the defaults apply. Nested models keep
+  their own gates; imports never affect the search.
+- A command-line option replaces only its own setting. Omitting `--warnaserror` keeps
+  `warningsAsErrors: true`, and any `--check` replaces the file's whole list. `--no-gate-file`
+  ignores the file, even an invalid one; a relaxed run is not the repository's gate, so say so.
+
+| Need | Standalone | `cratis screenplay validate` |
+| --- | --- | --- |
+| Effective gate and the source of each value, no compile (exit 0 unless the file is refused) | `screenplay <root> --print-gate` (text) | `--print-gate` (text, or the gate object under `-o json`) |
+| Machine-readable verdict | `--format json`: one document with `diagnostics`, `openQuestions`, `refusal`, `exitCode`, `gate` | `-o json-compact`: the summary carries `gate` |
+| Ignore the file | `--no-gate-file` | `--no-gate-file` |
+
+Each gate value reports `commandLine`, `file` or `default` as its source. Report the gate with
+the verdict: `V1 pass (screenplay <version>, gate screenplay.json: field-origins, query-keys,
+warnings as errors, 3 files)`.
+
+**A refused gate file is "could not run", never a pass or a fail.** Malformed JSON, a duplicate
+member, an unknown key, an unknown check name or a wrong type is refused as invalid, and a
+directory, symlink or unreadable file is refused as unreadable; neither is ignored or repaired. The
+standalone tool exits **2** and the CLI exits **1**, each with `path:line:column`. Report
+`V1 not run: gate file refused (<path:line:column>)`, fix the file and rerun.
+A scope declared in the file combined with `cratis screenplay validate --executable` also exits 1:
+check binding separately or pass `--no-gate-file` and name it.
+
+Requires Screenplay 4.165.0 or later (`screenplay --version`) for `screenplay.json`, `--format`,
+`--print-gate` and `--no-gate-file`; an older tool does not read the file and runs without the
+gate, so a clean result there says nothing about it. `cratis screenplay validate` reads the file
+from Cratis CLI 3.65.0 or later (`cratis --version`); an older CLI ignores it, so use the standalone
+tool for the gate.
+
 ## Release-baseline gate (independent of V1–V5)
 
 Run `screenplay baseline check <model-root>` before accepting edits to released event
@@ -180,9 +240,10 @@ What Stage admits: `renderable-subset.md`.
 
 | Layer | Route | Result |
 | --- | --- | --- |
-| Source validation | `screenplay <root> --warnaserror --no-color` | 0 clean; 1 reported defects; 2 could not run or invalid arguments or input. `--scope` limits the reported set, not compilation |
+| Source validation | `screenplay <root> --warnaserror --no-color` | 0 clean; 1 reported defects; 2 could not run or invalid arguments or input, including a refused `screenplay.json`. `--scope` limits the reported set, not compilation |
+| Declared gate | `screenplay <root> --print-gate`; `--format json`; `--no-gate-file` | Reads `screenplay.json`; `--print-gate` exits 0 without compiling unless the file is refused; a gate-promoted warning or an open question in `fail` mode exits 1 |
 | Completeness | add `--check <name>[,<name>]` (repeatable) or `--check all` | Opt-in warnings; whole-source errors skip checks, not pass them |
-| CLI source validation | `cratis screenplay validate <root> --warnings-as-errors -o json-compact` | Read the producer exit and the JSON errors, warnings and file count |
+| CLI source validation | `cratis screenplay validate <root> --warnings-as-errors -o json-compact` | Read the producer exit and the JSON errors, warnings and file count; 5 validation error (including gate-promoted warnings), 1 invalid input (including a refused `screenplay.json`) |
 | Binding | MCP workspace readiness and `executable-diagnostics` | V2 reads diagnostics; V3 requires binding with no blocking diagnostics |
 | Reference specifications | `screenplay test <root> [--filter <address>] [--format text\|json]`, or MCP `run-specifications` (`specification`, `scope`, `offset`, `limit`, `expectedSourceRevision`, `proposalId`) | 0 all selected passed; 1 failed; 2 invalid arguments, input, selection or IO; 3 unsupported or unbound. Counts of zero do not prove coverage |
 | Release baseline | `screenplay baseline admit <root> --release <label>`; `screenplay baseline check <root>` | 0 success; 1 changed or missing revision; 2 unavailable, unreadable or invalid input or write failure |
@@ -221,7 +282,7 @@ change ESM or V1–V5 verdicts. Read model-authoring
 [model notes](../../cratis-screenplay-model-authoring/references/model-notes.md) when
 recording, resolving, paging or reviewing orphan impact.
 
-Requires Screenplay 4.144.0 or later (`screenplay --version`) for `--open-questions`; `cratis screenplay validate` has no such option, so use the standalone tool for this gate.
+Requires Screenplay 4.144.0 or later (`screenplay --version`) for `--open-questions`. `cratis screenplay validate` accepts the same option from Cratis CLI 3.60.0 or later (exit 5 when a question remains in `fail` mode, 1 when notes are unreadable); with an older CLI use the standalone tool. `validation.openQuestions` in `screenplay.json` selects the mode without the flag.
 
 ## Revisions and descriptions
 

package/package/corpus/skills/cratis-screenplay-toolchain/verification.json

@@ -12,11 +12,17 @@
     { "kind": "skill-contains", "value": "PLAY0666", "file": "references/diagnostics.md" },
     { "kind": "skill-contains", "value": "bind/reference-execute as v11", "file": "references/executable-subset.md" },
     { "kind": "skill-contains", "value": "A consumer admitting v10 must include all three", "file": "references/production-routes-and-filters.md" },
-    { "kind": "skill-contains", "value": "Composite view keys remain authoring-only (PLAY0268)" },
+    { "kind": "skill-contains", "value": "Flat composite read-model keys select v27" },
     { "kind": "skill-contains", "value": "the **whole source, stream and stream id**", "file": "references/production-routes-and-filters.md" },
     { "kind": "play-compiles" },
     { "kind": "skill-contains", "value": "Requires Screenplay 4.144.0", "file": "references/verdicts.md" },
-    { "kind": "skill-contains", "value": "`cratis screenplay validate` has no such option", "file": "references/verdicts.md" },
+    { "kind": "skill-contains", "value": "accepts the same option from Cratis CLI 3.60.0", "file": "references/verdicts.md" },
+    { "kind": "skill-contains", "value": "A refused gate file is \"could not run\"", "file": "references/verdicts.md" },
+    { "kind": "skill-contains", "value": "Requires Screenplay 4.165.0 or later", "file": "references/verdicts.md" },
+    { "kind": "skill-contains", "value": "Cratis CLI 3.65.0 or later", "file": "references/verdicts.md" },
+    { "kind": "skill-contains", "value": "--print-gate", "file": "references/cheat-sheet.md" },
+    { "kind": "skill-contains", "value": "PLAY0690", "file": "references/diagnostics.md" },
+    { "kind": "skill-contains", "value": "Requires Screenplay 4.170.0 or later", "file": "references/diagnostics.md" },
     { "kind": "skill-contains", "value": "--open-questions fail", "file": "references/verdicts.md" },
     { "kind": "skill-contains", "value": "unreadable notes exit **2**", "file": "references/verdicts.md" },
     { "kind": "skill-contains", "value": "MCP/CLI only, **no PLAY code**", "file": "references/verdicts.md" },

package/package/corpus/skills/cratis-stage-rendering-and-sandbox/SKILL.md

@@ -74,8 +74,9 @@ printed), `1` is a missing input. Add `-o json` for the counts and the publicati
 Facts that surprise:
 
 - **Binding uses the CLI's bundled compiler**, not the standalone one. Version admission
-  does not imply construct support: exact ESM v1–v21 and v23–v25 pairs are admitted,
-  while v22/v26 and mixed pairs refuse `STAGE-ESM-016`. Pattern/random generation and checksum validation
+  does not imply construct support: exact ESM v1–v21 and v23–v26 pairs are admitted,
+  while v22/v27 and mixed pairs refuse `STAGE-ESM-016`. Date/DateTime command comparisons (v26)
+  execute in the semantic Host and executor but refuse `STAGE-ESM-046` in the renderer. Pattern/random generation and checksum validation
   render with an admitting renderer; `generate rule` still refuses `STAGE-ESM-028`.
   Read [references/admission.md](references/admission.md) for the introducing-release
   prerequisites, all-Proven unpinned specifications and construct/pin checks (-011/-038).
@@ -132,9 +133,9 @@ One blocker publishes nothing. Codes, limits and fixes: [references/admission.md
   The Cratis C# renderer refuses protected reads with `STAGE-ESM-044`, described handlers `STAGE-IMPL-002`
   (even Stub mode), and atomic mode in admitted pairs `STAGE-ESM-043`.
 - **Binding refusals (`PLAY0268`/`PLAY0271`):** legacy reads, `concurrency`, attached
-  handlers, context/single-result filters, opaque scope/performer, composite `by`,
+  handlers, context/single-result filters, opaque scope/performer, a list-query `by` block,
   enum/identity compliance and subject lineage. Eligible protected reads bind v25;
-  pending handlers with unconditional productions bind v23, but neither renders.
+  pending handlers with unconditional productions bind v23, but neither renders. A read model with several key parts (v27) refuses `STAGE-ESM-016`.
   Never drop protection.
 
 A refusal is not a licence to weaken the model: drop no specification, event generation or

package/package/corpus/skills/cratis-stage-rendering-and-sandbox/references/admission.md

@@ -11,8 +11,8 @@
 - Specification rules (`STAGE-ESM-011`)
 - Refusals seen while drafting a model
 
-Stage admits exact ESM v1–v21 and v23–v25 language/semantic pairs, then checks
-constructs. V22, v26 and mixed or unknown pairs report `STAGE-ESM-016`. The CLI's bundled renderer
+Stage admits exact ESM v1–v21 and v23–v26 language/semantic pairs, then checks
+constructs. V22, v27 and mixed or unknown pairs report `STAGE-ESM-016`. The CLI's bundled renderer
 may stop at v16 and refuse newer models with `CLI-RENDER-004`.
 
 Requires Stage 4.96.0 for v16, 4.101.0 for v17, 4.102.0 for v19, 4.106.0 for v18, and 4.103.0 for rendered redelivery; older renderers refuse the respective shapes.
@@ -34,9 +34,13 @@ Requires Stage 4.129.0 for semantic Host/executor protected reads; older engines
 Described handlers refuse STAGE-IMPL-002, even Stub mode; atomic mode in an
 admitted pair refuses STAGE-ESM-043. Version admission never implements a body,
 batch or rendered protected decision. Chronological Date/DateTime command comparisons
-select v26 in Screenplay but still refuse STAGE-ESM-016 here; standalone reference
-success is not rendering or Host/executor admission. Keep the date rule and use
-authorized gap-fill rather than downgrading to ordinal text or millisecond precision.
+select v26. The semantic Host and specification executor run them; the renderer,
+legacy engines and default sandbox engine refuse them with STAGE-ESM-046, naming the
+property, and emit no artifacts. Standalone reference success is not rendering. Keep
+the date rule and use authorized gap-fill rather than downgrading to ordinal text or
+millisecond precision.
+
+Requires Stage 4.135.0 for v26 admission; older Stage refuses v26 with STAGE-ESM-016.
 
 Binding with the CLI's bundled compiler is a separate
 prerequisite. The exhaustive construct table is `references/renderable-subset.md` in
@@ -135,13 +139,13 @@ Requires Stage 4.90.0 for snapshot/live lists, 4.96.0 for non-text secrets and 4
 | `STAGE-ESM-005` | Code validation or rule predicate bodies; or a command beyond the first capability (optional event property, event revision other than the first, validation or requirement that cannot be rendered, neither `produces` nor a response) | Use declarative validation; non-initial event generations are not rendered |
 | `STAGE-ESM-006` | `produces` that cannot render without changing its destination or mappings (expression/enum conditions, literal or computed mappings, `for` not a command identifier, mappings not one-to-one with event properties, duplicate tags) | Map properties one to one; supported conditional productions render as guarded events, not separate commands |
 | `STAGE-ESM-007`, `-008`, `-009` | Projection count per read model (exactly one projection or reducer each); unresolvable properties or no single read-model transition (**flat** projections only); affected instance not one, not keyed by an event property, or not the event-source identity (flat projections only) | One projection per read model; see "Projections" below |
-| `STAGE-ESM-010` | A query is neither an optional snapshot lookup by the read-model identifier nor a supported snapshot/observable collection query; each query is checked on its own. Both collection modes render. Concept-typed keys and filters retain Arc validation, including composite members and collection elements; nullable concept keys or optional concept filters with `not empty` cannot preserve null semantics | Keyed `XById => X optional` queries or snapshot/observable lists. Equality filters render on both collections; DateTime filters, required filters after optional ones and unsupported null-validation shapes refuse 010. Filter-name collisions refuse 012. Context/single-result filters, opaque scope/performer and composite `by` remain PLAY0268 |
+| `STAGE-ESM-010` | A query is neither an optional snapshot lookup by the read-model identifier nor a supported snapshot/observable collection query; each query is checked on its own. Both collection modes render. Concept-typed keys and filters retain Arc validation, including composite members and collection elements; nullable concept keys or optional concept filters with `not empty` cannot preserve null semantics | Keyed `XById => X optional` queries or snapshot/observable lists. Equality filters render on both collections; DateTime filters, required filters after optional ones and unsupported null-validation shapes refuse 010. Filter-name collisions refuse 012. Context/single-result filters, opaque scope/performer and a list-query `by` block remain PLAY0268; a read model with several key parts (v27) refuses `STAGE-ESM-016` |
 | `STAGE-ESM-011` | A specification cannot render (see the rules below) | Reshape it only if the assertion keeps its meaning; otherwise keep the specification, record the gap, and gap-fill with the specification as the oracle. Never weaken or delete it to get a render |
 | `STAGE-ESM-012` | Generated C# names collide (properties, types, namespaces, constraints) | Rename |
 | `STAGE-ESM-013` | An event-context value other than `$context.occurred` mapped in `produces` | Map a command property when that preserves the meaning; otherwise gap-fill |
 | `STAGE-ESM-014` | A constraint Chronicle cannot reproduce (kind, scope, message; multi-claim in one command; optional or composite targets) | A different constraint is a requirement change for the model owner; otherwise gap-fill |
 | `STAGE-ESM-015` | Authorization Stage cannot render exactly: a role-claim URI, an opaque policy nested inside a condition, an unresolved or non-portable policy, no single identifier, an opaque-policy subject that is not text, Uuid, Date or DateTime (a restriction on opaque-policy subjects, separate from declarative claim targets), an unsupported claim artifact. Role-only, authenticated, opaque pure policies, claim conditions with Uuid, Date, DateTime or text targets (numeric and Boolean claim matches render as always false) and `not`/and/or render; roles are read through the identity's `RoleClaimType` | Reshape the policy to a portable condition; otherwise gap-fill |
-| `STAGE-ESM-016` | Model language/semantic pair is not admitted by the installed Stage; exact v1–v21 and v23–v25 pairs are admitted, v22/v26 and mixed pairs refused; older Stage also refuses the versions listed in the minimums above. A CLI bundle stopping at v16 reports `CLI-RENDER-004` above v16 first. v14 filters and v15 generation join v11 numbers, v12 enum numbers and v13 compliance as supported constructs, not blanket construct support | Not fixable by editing: the model needs a newer renderer. Keep the model, record the gap, gap-fill |
+| `STAGE-ESM-016` | Model language/semantic pair is not admitted by the installed Stage; exact v1–v21 and v23–v26 pairs are admitted, v22/v27 and mixed pairs refused; older Stage also refuses the versions listed in the minimums above. A CLI bundle stopping at v16 reports `CLI-RENDER-004` above v16 first. v14 filters and v15 generation join v11 numbers, v12 enum numbers and v13 compliance as supported constructs, not blanket construct support | Not fixable by editing: the model needs a newer renderer. Keep the model, record the gap, gap-fill |
 | `STAGE-ESM-017` | Read model or projection cannot render (property names that collide with Chronicle paths or expression syntax, mappings that overwrite the key or child identity, composite keys, unsupported `all` mappings, the refused scope shapes below) | Reshape the projection without changing what it records, or record the gap |
 | `STAGE-ESM-018` | `$strings.` key missing in the default locale or containing formatting characters | Fix the strings |
 | `STAGE-ESM-019` | Reducer structure or body not admitted (outside a `StateView`, impure, does not compile) | An equivalent pure body, or gap-fill |
@@ -164,6 +168,7 @@ Requires Stage 4.90.0 for snapshot/live lists, 4.96.0 for non-text secrets and 4
 | `STAGE-ESM-042` | Unknown validation rule kinds; checksum on the legacy syntax path (semantic checksum renders) | Keep the rule; use an admitting semantic renderer or gap-fill |
 | `STAGE-ESM-043` | `reaction batches atomic` in an admitted version pair | Keep the batch boundary; gap-fill without splitting it |
 | `STAGE-ESM-044` | Protected-read preamble, command reads or read-backed conditions/mappings in the Cratis C# renderer; legacy Host/structural runner also refuse the preamble | Keep protection; semantic Host/executor support is separate from generated-app enforcement |
+| `STAGE-ESM-046` | Date/DateTime comparison in `require`, `produces when` or a validation rule (including through concepts) in the renderer, legacy engines or default sandbox engine; names the property | Keep the date rule; the semantic Host/executor run it; deliver rendering through gap-fill that compares exact calendar dates and UTC ticks |
 | `STAGE-ESM-045` | Non-Error requirement on a protected command, including reaction-invoked commands; semantic admission refuses before reads, requirements or facts | Keep the severity contract; record the execution gap, never silently promote or drop the requirement |
 | `STAGE-IMPL-002` | Described command handler, naming command and RequirementId; also refused in Stub mode | Supply authorized implementation outside rendering; no generated stub is emitted |
 | `STAGE-ESM-037` | Events and commands from one handler, even across separate triggers on the same event in one reaction. The scaffold's Arc supports mixed results, but appends events before commands; a refused command causes redelivery and duplicate events | **Do not split the modeled reaction or drop an effect.** Gap-fill only with a proven retry-safe implementation; `[OnceOnly]` excludes replay, not retry |

package/package/corpus/skills/cratis-stage-rendering-and-sandbox/references/sandbox-and-specrunner.md

@@ -4,6 +4,7 @@
 
 - The sandbox: a partial, disposable runtime
 - Protected command reads
+- Date comparisons (v26)
 - Refusals shared by both engines
 - The specification runner
 - Choosing between them
@@ -128,6 +129,22 @@ even an unrelated one, before committing an accepted command. This interim guard
 is stricter than the reference's dependency-scoped decide/commit conflicts; do not
 claim full reference conflict parity or generated-application protection.
 
+## Date comparisons (v26)
+
+Requires Stage 4.135.0 for v26 admission; older Stage refuses v26 with `STAGE-ESM-016`.
+The semantic Host and specification executor compare `Date` as calendar days and
+`DateTime` as UTC ticks in `require`, `produces when` and validation rules, including
+through concepts. A participating `DateTime` input without an offset or `Z` rejects
+with Validation after authorization and before any rule. `then` stays ordinal. The
+renderer, legacy engines and default sandbox engine refuse these comparisons with
+`STAGE-ESM-046`, naming the property; no date validators or artifacts are emitted.
+
+One ordering differs from the reference: the reference checks authorization, then
+offsets, then opaque C# validation, so an offset-less DateTime beside opaque
+validation is a Validation rejection there. The specification executor refuses opaque
+validation at run admission and the Host refuses it before authorization, so both Stage
+paths report `Unsupported`, which never counts as a pass.
+
 ## Refusals shared by both engines
 
 Both engines refuse public events (`STAGE-ESM-032`), foreign or source-event captures

package/package/corpus/skills/cratis-stage-rendering-and-sandbox/verification.json

@@ -24,7 +24,7 @@
     { "kind": "skill-contains", "value": "`cratis run` has no `--engine` option", "file": "references/sandbox-and-specrunner.md" },
     { "kind": "skill-contains", "value": "the environment setting below", "file": "references/sandbox-and-specrunner.md" },
     { "kind": "skill-contains", "value": "fresh in-memory Chronicle log per specification", "file": "references/sandbox-and-specrunner.md" },
-    { "kind": "skill-contains", "value": "exact ESM v1–v21 and v23–v25 pairs" },
+    { "kind": "skill-contains", "value": "exact ESM v1–v21 and v23–v26 pairs" },
     { "kind": "skill-contains", "value": "STAGE-ESM-044" },
     { "kind": "skill-contains", "value": "STAGE-IMPL-002" },
     { "kind": "skill-contains", "value": "all-Proven rules permit unpinned rendered", "file": "references/admission.md" },

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cratis/pi",
-  "version": "7.66.0",
+  "version": "7.68.0",
   "description": "Configuration-aware Cratis AI integration for Pi",
   "type": "module",
   "files": [