@cratis/pi 7.69.1 → 7.70.1

package/package/corpus/hooks/scripts/cratis-check-pr.mjs

@@ -79,16 +79,23 @@ function originRepository(cwd) {
     return repositoryName(git(['remote', 'get-url', 'origin'], cwd));
 }
 
-function targetCallers(repository, cwd) {
+function targetCallers(repository, cwd, warn) {
     if (cwd && repository?.toLowerCase() === originRepository(cwd)?.toLowerCase()) return callers(cwd);
-    let files;
-    try { files = JSON.parse(gh(['api', `repos/${repository}/contents/.github/workflows`])); }
-    catch (error) {
-        if (/HTTP 404/.test(error.message)) return [];
+    let listed = false;
+    try {
+        const files = JSON.parse(gh(['api', `repos/${repository}/contents/.github/workflows`]));
+        listed = true;
+        return files.filter(file => file.type === 'file' && /\.ya?ml$/.test(file.name)).flatMap(file =>
+            workflowCallers(gh(['api', '-H', 'Accept: application/vnd.github.raw', `repos/${repository}/contents/${file.path}`])));
+    } catch (error) {
+        // Only a missing workflows directory means no opt-in; a failed file fetch is an unknown.
+        if (!listed && /HTTP 404/.test(error.message)) return [];
+        if (/^Cratis\/[^/]+$/i.test(repository)) {
+            warn(`Could not determine release-workflow opt-in for ${repository} (${error.message}); checking against bundled reviewed rules`);
+            return [{ name: 'verify-release-notes', ref: reviewedRulesRef }];
+        }
         throw new Error(`Could not determine release-workflow opt-in for ${repository}: ${error.message}`);
     }
-    return files.filter(file => file.type === 'file' && /\.ya?ml$/.test(file.name)).flatMap(file =>
-        workflowCallers(gh(['api', '-H', 'Accept: application/vnd.github.raw', `repos/${repository}/contents/${file.path}`])));
 }
 
 function optedIn(cwd) {
@@ -126,7 +133,7 @@ function rules(warn, repositoryCallers) {
         renameSync(temporary, file);
         return file;
     } catch (error) {
-        if (floating) {
+        if (floating || ref === reviewedRulesRef) {
             const bundled = fileURLToPath(new URL('./cratis-release-notes-reviewed.cjs', import.meta.url));
             new Script(readFileSync(bundled, 'utf8'));
             warn(`Could not fetch release-note rules at ${ref}; using bundled reviewed ${reviewedRulesRef}. ${error.message}`);
@@ -193,7 +200,7 @@ function check(argv, repositoryCallers, lookupOptions) {
     // The release-intent check above still applies to bot-authored pull requests.
     if (author === 'dependabot[bot]') return 0;
     const base = values.base || pull?.baseRefName || defaultBranch;
-    const file = rules(warn, repositoryCallers || targetCallers(repository, process.cwd()));
+    const file = rules(warn, repositoryCallers || targetCallers(repository, process.cwd(), warn));
     if (!file) return 3;
     const env = { PATH: process.env.PATH, HOME: homedir(), LANG: 'C.UTF-8',
         PR_BODY: body, PR_LABELS: JSON.stringify([...labels]),
@@ -369,7 +376,7 @@ function hook() {
             throw new Error('Use a literal directory before gh pr create/edit.');
         }
         if (!/^Cratis\/[^/]+$/i.test(repository)) continue;
-        const repositoryCallers = targetCallers(repository, knownDirectory ? cwd : undefined);
+        const repositoryCallers = targetCallers(repository, knownDirectory ? cwd : undefined, message => warning(`Warning: ${message}`));
         if (!repositoryCallers.length) continue;
         if (!knownDirectory) throw new Error('Use a literal directory before gh pr create/edit.');
         const args = [];

package/package/corpus/product-sync.json

@@ -27,9 +27,9 @@
       "repository": "Cratis/Stage",
       "packages": [],
       "synced": {
-        "version": "4.103.0",
-        "date": "2026-10-14",
-        "by": "Cratis/AI#681"
+        "version": "4.138.0",
+        "date": "2026-10-17",
+        "by": "Cratis/AI#752"
       },
       "covers": {
         "skills": [
@@ -125,9 +125,9 @@
         }
       ],
       "synced": {
-        "version": "3.74.0",
+        "version": "3.75.0",
         "date": "2026-10-17",
-        "by": "Cratis/AI#746"
+        "by": "Cratis/AI#752"
       },
       "covers": {
         "skills": [
@@ -171,9 +171,9 @@
         }
       ],
       "synced": {
-        "version": "4.205.0",
+        "version": "4.207.0",
         "date": "2026-10-17",
-        "by": "Cratis/AI#746"
+        "by": "Cratis/AI#752"
       },
       "covers": {
         "skills": [

package/package/corpus/skills/cratis-arc-command/references/generated-values.md

@@ -141,7 +141,9 @@ Arc resolves these through the concept's generation interface, not strategy-spec
 `[GeneratedValue]` options. Requires Arc.Screenplay 22.107.0 for pattern/random,
 checksum and self-contained String-rule recovery; older adapters keep them in code.
 Requires Stage 4.118.0 for checksum validation and 4.119.0 for pattern/random
-rendering; older renderers refuse them. `generate rule` remains STAGE-ESM-028.
+rendering; older renderers refuse them. Requires Stage 4.136.0 to render `generate rule` as an
+`IGeneratableInContext<T>.New(GenerationContext)` factory (body errors STAGE-ESM-019, shadowing -022, missing
+attachment -020); the Host and legacy syntax engine still refuse a command generating its value with STAGE-ESM-028.
 Screenplay separately admits concept `generate` strategies and freshness; see `cratis-screenplay-command-surface/references/generated-values-and-responses.md`
 for that language contract and Stage's explicit scopes. Native Arc freshness is a
 separate policy; a factory alone is not a storage guard.

package/package/corpus/skills/cratis-arc-command/references/shop-generation.md

@@ -106,8 +106,8 @@ and captured-time semantics, never one exact random suffix.
   as `.play`. Read [generated-value recovery](../../cratis-screenplay-legacy-extraction/references/generated-recovery.md)
   for Arc.Screenplay prerequisites and refusal boundaries, and
   [Stage admission](../../cratis-stage-rendering-and-sandbox/references/admission.md)
-  for checksum and pattern/random rendering prerequisites. `generate rule`
-  remains STAGE-ESM-028.
+  for checksum, pattern/random and `generate rule` rendering prerequisites (Stage 4.136.0 renders
+  `generate rule`; the Host and legacy engine still refuse it with STAGE-ESM-028).
 
 ## Sources
 

package/package/corpus/skills/cratis-screenplay-automations-and-translations/SKILL.md

@@ -171,7 +171,7 @@ or actor that nobody confirmed. Read `references/worked-integration.md` when you
   separate binder check.
 - A trigger with `reads` that `produces` directly fails binding: decide in a command.
   Command reads can protect with `command reads protected` and admitted shapes (v25);
-  trigger reads cannot. The Cratis C# renderer refuses protected reads (STAGE-ESM-044);
+  trigger reads cannot. Stage 4.138.0 renders protected reads as Arc read protection (`cratis render` gets it from the first CLI that bundles it; CLI 3.75.0 refuses them with STAGE-ESM-044);
   semantic execution is separate from generated-app protection.
 - An authorized command exercised in a spec without `given caller` is PLAY0389 at binding.
 - A list query (`=> Item[]`) binds (a snapshot list is not rendered, `STAGE-ESM-010`);

package/package/corpus/skills/cratis-screenplay-automations-and-translations/references/audit-format.md

@@ -12,7 +12,7 @@ technique: partial work stays visible and nothing is skipped because it looked r
 Result is `complete` only when every column is filled or says why it does not apply (for example
 "direct effect: immediate, internal, cannot fail"). `open` names the unresolved decision and who
 answers. `blocked` names the actual capability gap with intended behavior. For example,
-the CLI/Stage pair (toolchain `references/renderable-subset.md`) admits through ESM v26 to construct checks; role/authenticated reaction identity
+the CLI/Stage pair (toolchain `references/renderable-subset.md`) admits through ESM v27 to construct checks; role/authenticated reaction identity
 renders, while claim-reading/opaque system gates still refuse STAGE-ESM-034. Previous CLI 3.46.1 refused v10 at the version gate
 with CLI-RENDER-004; do not report that historical refusal as the current gap.
 

package/package/corpus/skills/cratis-screenplay-automations-and-translations/references/realization-and-gap-fill.md

@@ -23,7 +23,7 @@ rejected model renderable, and never claim a whole-application V5 from a subset.
 with `cratis-screenplay-render-and-gap-fill`.
 
 Application-root `reaction batches atomic` also blocks Stage delivery: v22
-refuses STAGE-ESM-016; mode in admitted v23–v26 refuses STAGE-ESM-043. Preserve the
+refuses STAGE-ESM-016; mode in admitted v23–v27 refuses STAGE-ESM-043. Preserve the
 per-occurrence/selected-branch batch boundary and independent invoked commands.
 Atomic appends do not prove redelivery deduplication or external exactly-once effects.
 

package/package/corpus/skills/cratis-screenplay-captures-and-reactions/SKILL.md

@@ -104,7 +104,7 @@ binding, because its decision dependency cannot be protected. A reaction that on
 command's own reads. Eligible command reads protect under application-root
 `command reads protected` (ESM v25); legacy reads retain PLAY0271. Read command-surface
 [protected reads](../cratis-screenplay-command-surface/references/protected-reads.md)
-for admission and absence/conflict behavior. Stage admits v25; the Cratis C# renderer refuses protected reads with STAGE-ESM-044.
+for admission and absence/conflict behavior. Stage admits v25 and, from 4.138.0, renders protected reads as Arc read protection (CLI 3.75.0 refuses them with STAGE-ESM-044).
 Semantic Host/executor support is separate; non-Error protected requirements refuse -045,
 including reaction-invoked commands.
 `where` over read paths out of scope, and `where` needs

package/package/corpus/skills/cratis-screenplay-captures-and-reactions/references/atomic-batches-and-source-mappings.md

@@ -36,7 +36,7 @@ batch and unchanged read models with evaluator world/read-model assertions; earl
 accepted work can remain. `then no events` means accepted zero outcomes and cannot
 accompany `then error`. Do not invent a mixed success/error specification form.
 
-Stage refuses ESM v22 with STAGE-ESM-016. Even an admitted v23–v26 model carrying
+Stage refuses ESM v22 with STAGE-ESM-016. Even an admitted v23–v27 model carrying
 atomic mode is refused with STAGE-ESM-043 by renderer, Host and specification executor.
 Keep the declaration and report authorized gap-fill; do not promise a render date or
 strip atomicity to lower the version.

package/package/corpus/skills/cratis-screenplay-command-surface/SKILL.md

@@ -151,12 +151,12 @@ view name when that view is read once.
 Opt eligible state reads into application-root `command reads protected` (v25).
 Absence rejects; matching intervening facts conflict. Read [protected reads](references/protected-reads.md)
 for strict admission, paths and PLAY0780–0786. Legacy reads stay unprotected;
-reads/concurrency cannot combine (PLAY0783). The Cratis C# renderer refuses protected reads (STAGE-ESM-044), not v25 itself;
-semantic Host/executor support is separate.
+reads/concurrency cannot combine (PLAY0783). Semantic Host/executor support is separate.
+Requires Stage 4.138.0 to render protected reads as Arc read protection (shapes it cannot preserve stay STAGE-ESM-044); `cratis render` gets it from the first CLI that bundles it, and CLI 3.75.0 refuses every protected read with STAGE-ESM-044.
 Uniqueness still uses a constraint; reference success is not target realization.
 
 Do not use `reads` to fetch data the caller could supply. A composite-key view's `by` block in a
-command read is `PLAY0271`, or `PLAY0781` ByParts under `command reads protected`
+command read is `PLAY0271`, or `PLAY0781` reason `by-parts` under `command reads protected`
 (read-surface `references/named-keys.md`).
 
 ## `validate`

package/package/corpus/skills/cratis-screenplay-command-surface/references/generated-values-and-responses.md

@@ -121,8 +121,7 @@ Do not insert a bridge to Screenplay's record or promise another provider accept
 Arc can recover such self-contained compound bodies under the adapter gate in
 [generated recovery](../../cratis-screenplay-legacy-extraction/references/generated-recovery.md).
 Recovery does not run the body; reference execution consumes a String pin, opaque
-entropy cannot supply an identifier, and Stage rendering still refuses `generate rule`
-with STAGE-ESM-028. A target binding contract is not released renderer support.
+entropy cannot supply an identifier. Requires Stage 4.136.0 to render `generate rule`: the attached C# body becomes the concept's `IGeneratableInContext<T>.New(GenerationContext)` factory; a body that does not compile or warns refuses STAGE-ESM-019, type or namespace shadowing STAGE-ESM-022 and a missing attachment STAGE-ESM-020. The Host and the legacy syntax engine still refuse a command that generates a `generate rule` value with STAGE-ESM-028. Rendering emits the attached body as written; it does not turn a portable body into another provider's contract.
 
 ## Inspect and edit generation through MCP
 
@@ -268,7 +267,8 @@ Requires Stage 4.94.0 or later for receipt-time generation; older factories use
 
 | Refusal | Still unsupported |
 | --- | --- |
-| STAGE-ESM-028 | `generate rule`, unknown strategies, non-concepts, optional/collection generation; every explicit strategy on the legacy syntax engine |
+| STAGE-ESM-028 | unknown strategies, non-concepts, optional/collection generation; a command generating a `generate rule` value in the Host; every explicit strategy and `generate rule` on the legacy syntax engine |
+| STAGE-ESM-019 / -022 / -020 | `generate rule` body that does not compile or warns / type or namespace shadowing / missing attachment (Requires Stage 4.136.0) |
 | STAGE-ESM-011 | A fixture that does not match its strategy shape or concept rules |
 | STAGE-ESM-038 | Routing combined with generation/responses; generated-property rules/requirements; occurrence parameter/response/factory name collisions; unsupported response sources/composites/collections; generated identifier plus destination-less plain production |
 | STAGE-ESM-038 | Unpinned generation with any Unproven/Refuted concept rule, production-condition reads, unordered event/read-model/query expectations or collision-sensitive generated constraints |
@@ -293,7 +293,7 @@ renderers refuse them with -038. Every severity is enforced as a generation defe
 Requires Stage 4.118.0 for semantic checksum validation and 4.119.0 for
 pattern/random factories, Host sampling and executor fixture checks; older
 renderers refuse those constructs with -042/-028. Dated patterns use receipt-time
-context; Int ranges render as `long`. `generate rule` still refuses -028.
+context; Int ranges render as `long`. `generate rule` renders from Stage 4.136.0 (see above).
 Requires Arc.Screenplay 22.107.0 for pattern/random/checksum and self-contained
 String-rule recovery; older adapters leave these factories in code. Recovery is
 not Stage rendering: keep refused rule contracts for gap-fill, never delete rules

package/package/corpus/skills/cratis-screenplay-command-surface/references/protected-reads.md

@@ -66,10 +66,24 @@ Every read must satisfy both boundaries:
 PLAY0781 refuses reducers, joins (including removal joins), children/nested scopes,
 `every`/`all`, payload/composite keys, missing removals, empty handled-event sets,
 named sources/streams, singleton views and unsupported/generated/optional/collection
-keys. Its closed reasons are Reducer, Join, Children, OpenSubscription, PayloadKey,
-ByParts, NoRemoval, EmptyHandledSet, NamedSourceOrStream, Singleton, KeyType,
-GeneratedKey, OptionalKey and CollectionKey. `optional`, `advisory` and `via query`
-remain refused; `via query` uses parser code PLAY0175. There is no unguarded fallback.
+keys. `optional`, `advisory` and `via query` remain refused; `via query` uses parser
+code PLAY0175. There is no unguarded fallback.
+
+Requires Screenplay 4.207.0 (`screenplay --version`) for typed diagnostic arguments;
+earlier compilers omit these arguments. Read the arguments, never the message:
+
+| Code | Arguments |
+| --- | --- |
+| PLAY0781 | `command`, `read` (the alias, else the read model name), `readModel`, `reason` |
+| PLAY0782 | `command`, `read` |
+| PLAY0783 | `command` |
+| PLAY0784, PLAY0785 | `command`, `read`, `path` |
+
+`reason` is one of `reducer`, `join`, `children`, `open-subscription`, `payload-key`,
+`by-parts`, `no-removal`, `empty-handled-set`, `named-source-or-stream`, `singleton`,
+`key-type`, `generated-key`, `optional-key` or `collection-key`. These lowercase,
+hyphenated values are published and stable; they are not C# enum names, and a tool must
+tolerate a value it does not know. Every refused read gets its own PLAY0781.
 
 Single-level `read.property` paths bind in `require` operands and produced-event
 mapping sources only. Deeper paths and read paths in `produces when`, response
@@ -105,9 +119,22 @@ explicit `apply`. The repair inserts into the domain document or sole document,
 refuses ambiguous roots and requires individual review, never fix-all. It changes
 absence/conflict behavior, not merely formatting.
 
-Stage admits ESM v25, but the Cratis C# renderer refuses protected reads with
-STAGE-ESM-044: no artifacts are emitted. Preserve protection and deliver authorized
-hand-written enforcement through render-and-gap-fill; never remove the preamble.
+Stage admits ESM v25.
+
+Requires Stage 4.138.0 for the Cratis renderer to render protected reads; `cratis render` gets it from the first CLI that bundles it, and CLI 3.75.0 (Stage 4.137.0) and older refuse every protected read with STAGE-ESM-044.
+
+Each command with `reads` becomes an Arc command with `[ReadProtection(On)]`, a
+nullable read-model `Handle` parameter per read looked up with `[LookUpBy]`, the
+`<View> '<key>' does not exist.` rejection, and every requirement evaluated in `Handle`
+after the reads. Generated specifications run protected commands in decision mode.
+Reads it cannot preserve faithfully (reads combined with constrained events, read paths
+in `produces when`, read-path mappings to optional, collection, composite or differently
+typed event properties, generated-value freshness scopes) refuse STAGE-ESM-044 naming the
+reason, and no artifacts are emitted. Where rendering refuses, preserve protection and deliver authorized
+hand-written enforcement through render-and-gap-fill; never remove the preamble. Read
+Stage's [protected reads rendering](https://github.com/Cratis/Stage/blob/main/Documentation/reference/protected-reads-rendering.md)
+for the rendered shape and where it differs from the reference (a race is an Arc
+validation failure, not `DecisionStateChanged`; only the first failing requirement is reported).
 
 Requires Stage 4.129.0 for semantic Host/specification-executor protected reads;
 older engines refuse STAGE-ESM-044. They require presence before requirements or

package/package/corpus/skills/cratis-screenplay-command-surface/references/shop-generation.md

@@ -116,8 +116,8 @@ example realizes that credential behavior. Never drop ApiKey's secret marker to
 make its generation bind/render. A pattern is not gapless/sequential numbering;
 check digits catch typos, not forgery. ESM v21 binds and reference-executes with
 pins. Requires Stage 4.118.0 for checksum validation and 4.119.0 for pattern/random
-rendering; older renderers refuse those constructs. `generate rule` still refuses
-STAGE-ESM-028. Sequence allocation and secret generation stay explicit gaps.
+rendering; older renderers refuse those constructs. `generate rule` renders from Stage 4.136.0 (the Host
+and legacy syntax engine still refuse it with STAGE-ESM-028). Sequence allocation and secret generation stay explicit gaps.
 
 ## Sources
 

package/package/corpus/skills/cratis-screenplay-event-modeling/SKILL.md

@@ -115,7 +115,8 @@ result are in [references/parsed-not-runnable.md](references/parsed-not-runnable
 and `cratis-screenplay-toolchain` (`references/executable-subset.md`). Read `references/parsed-not-runnable.md` when determining the required ESM version or interpreting binding dispositions. Read `cratis-screenplay-toolchain`'s `references/executable-subset.md` when checking binder admission or reference-execution limits. Model the wider
 language freely when the `.play` file **is** the deliverable - documentation,
 review, a shared description of a system. Never read a clean `screenplay` run as
-evidence a construct works downstream.
+evidence a construct works downstream. The language is frozen at ESM v1–v28 ([the freeze decision](https://github.com/Cratis/Screenplay/blob/main/decisions/0092-the-language-is-frozen-at-esm-v28.md)): model with it, and report a typed
+Stage, `cratis render` or Studio refusal as a platform gap rather than waiting for new constructs.
 
 ## Locate the model
 
@@ -174,8 +175,7 @@ compile or will not be safe. Both are deliberate.
   rejects and matching decide/commit changes conflict. Read
   [protected reads](../cratis-screenplay-command-surface/references/protected-reads.md)
   for the strict shape and paths. Legacy reads remain PLAY0271; `concurrency` is
-  not protection and cannot combine with protected reads. The Cratis C# renderer refuses protected reads
-  (STAGE-ESM-044), not v25 itself: semantic Host/executor support is not generated-app protection.
+  not protection and cannot combine with protected reads. Stage 4.138.0 renders protected reads as Arc read protection (`cratis render` gets it from the first CLI that bundles it; CLI 3.75.0 refuses them with STAGE-ESM-044); semantic Host/executor support is not generated-app protection.
   Write state-dependent rules as `reads` plus `require` with an indented message;
   mark refused shapes as unenforced and name the intended target mechanism. Model uniqueness as a `unique` constraint. Never copy state into a
   command input, add an attestation flag, or hide the rule in `handler` prose. Do not

package/package/corpus/skills/cratis-screenplay-event-modeling/references/parsed-not-runnable.md

@@ -34,7 +34,7 @@ Tool versions and consumer boundaries: toolchain `SKILL.md`.
 | Compliance concepts | Bare `pii`/`personal` and `secret`, qualifiers and scope bind as v13; enum/identity compliance and events combining personal or explicitly subject-scoped secret values with an explicit `subject` mark refuse PLAY0268 at binding only. A CLI bundle that admits v13 binds markers; Stage renders v13 protection, not protected identities/enums or subject lineage. Never remove protection |
 | Identity details / processing purposes / event subject | Report-only metadata; executable detail reads refuse PLAY0268, not source declaration errors |
 | Composite stream ids | v8 routing; complete named parts/canonical comparisons, PLAY0515 refuses protected keys/sources; not a legacy text split |
-| Command reads/concurrency | Eligible reads opt into v25 with `command reads protected`; legacy reads/concurrency retain PLAY0271; the Cratis C# renderer refuses protected reads (STAGE-ESM-044), not the v25 pair; semantic Host/executor support is separate |
+| Command reads/concurrency | Eligible reads opt into v25 with `command reads protected`; legacy reads/concurrency retain PLAY0271; the Cratis renderer renders protected reads as Arc read protection in a new enough bundle (older bundles, and shapes it cannot preserve, refuse STAGE-ESM-044); semantic Host/executor support is separate |
 | Invokes-only trigger reads | Report-only, not protected state; direct production with reads refuses |
 | Generated values/responses | v7 binding/reference execution; v15 strategies/strict fixtures/freshness. Stage renders supported UUID/String strategies, responses and fixtures; unsupported types/combinations remain -028/-038 |
 | Sources/streams and command/specification routes | v8 binding/reference execution; the CLI (toolchain `references/renderable-subset.md`) reaches Stage checks through its bundled ceiling (v16 without v17 support) |

package/package/corpus/skills/cratis-screenplay-legacy-extraction/references/generated-recovery.md

@@ -74,7 +74,7 @@ protection and unrecovered code. A pattern is not a gapless/sequential allocator
 or secret; check digits detect typos, not forgery. Low-entropy payload codes need
 uniqueness separate from source freshness. Arc recovery does not imply rendering:
 Requires Stage 4.118.0 for checksum validation and 4.119.0 for pattern/random;
-older renderers refuse them. `generate rule` still refuses STAGE-ESM-028.
+older renderers refuse them. `generate rule` renders from Stage 4.136.0; the Host and legacy syntax engine still refuse it with STAGE-ESM-028.
 Report missing pins, withheld productions/scenarios and version caps
 as losses, not successful recovery. Sources: Arc
 `Documentation/backend/csharp/generating-a-screenplay.md`;

package/package/corpus/skills/cratis-screenplay-model-authoring/references/choosing-generation.md

@@ -38,5 +38,5 @@ MCP `rules[]` and `derivedPattern` for rule proofs and reviewed PLAY0688 repair;
 never delete a business invariant to silence PLAY0689. Read
 [Stage admission](../../cratis-stage-rendering-and-sandbox/references/admission.md)
 for checksum validation and pattern/random rendering prerequisites.
-`generate rule` remains STAGE-ESM-028, so model admission does not promise rendering.
+`generate rule` renders only from Stage 4.136.0 (STAGE-ESM-028 before it, and still in the Host), so model admission does not promise rendering.
 Sources: `Documentation/screenplay/generated-values/choosing.md` and `Documentation/screenplay/generated-values.md` in `Cratis/Screenplay`.

package/package/corpus/skills/cratis-screenplay-model-authoring/references/language-reference.md

@@ -267,11 +267,11 @@ See read-surface `references/named-keys.md` for the collection-key exclusion alg
 | Query Validation rejection (ESM v18) | Exactly one queried call plus one `then error`, no other action/result/denial. Concept key/supplied filters validate after authorization in every version. Requires Screenplay 4.161.0 or later (`screenplay --version`); older runners may answer absence. |
 | Invocation refusal branches (ESM v19) | Ordered first-match `on refused` productions or acknowledgement, `$refusal` values; bare refusal excludes authorization. Requires Screenplay 4.160.0 or later (`screenplay --version`); older compilers report PLAY0268. |
 | Generated-concept rules (ESM v20) | Proven rules bind silently, Refuted PLAY0688 errors include a witness, Unproven PLAY0689 warnings include a reason; deterministic regex containment only, not passing samples. Fixtures obey shape and rules. Requires Screenplay 4.164.0 or later (`screenplay --version`); older compilers report PLAY0268. |
-| Finite generation and attachments (ESM v21) | String pattern with optional Luhn/Mod11/Mod97 checksum, inclusive Int random range, attached String generation rule with language-neutral Now/Tenant context and String result, String checksum validation. Requires Screenplay 4.172.0 (`screenplay --version`); older compilers report PLAY0268. PLAY0691 is support-budget exhaustion, PLAY0692 empty support on a scanned date. Pin date fixtures with given clock. Requires Stage 4.118.0 for checksum validation and 4.119.0 for pattern/random rendering; older renderers refuse them. `generate rule` remains STAGE-ESM-028; see command-surface `references/generated-values-and-responses.md`. |
+| Finite generation and attachments (ESM v21) | String pattern with optional Luhn/Mod11/Mod97 checksum, inclusive Int random range, attached String generation rule with language-neutral Now/Tenant context and String result, String checksum validation. Requires Screenplay 4.172.0 (`screenplay --version`); older compilers report PLAY0268. PLAY0691 is support-budget exhaustion, PLAY0692 empty support on a scanned date. Pin date fixtures with given clock. Requires Stage 4.118.0 for checksum validation and 4.119.0 for pattern/random rendering; older renderers refuse them. current renderers render `generate rule` (the Host and legacy syntax engine keep STAGE-ESM-028); see command-surface `references/generated-values-and-responses.md`. |
 | Atomic reaction batches (ESM v22) | Root `reaction batches atomic`; direct productions per occurrence and selected refusal branches are separate batches, commands independent; Stage refuses v22 and atomic mode |
 | Described handlers (ESM v23) | Pending implementation beside unconditional produces; payload-only contract, reached body Unsupported ImplementationBody; Stage STAGE-IMPL-002 even Stub mode |
 | Ordinal text rules (ESM v24) | contains/not contains/starts with/ends with on scalar non-enum text properties; quoted literals, not conditions; Stage semantic engines execute/render |
-| Protected command reads (ESM v25) | Root `command reads protected`; eligible read paths in requirements and production mappings, absence Validation, concurrent matching facts Conflict; Stage admits v25; Cratis C# rendering refuses STAGE-ESM-044, semantic Host/executor execute admitted reads with non-Error protected requirements refused STAGE-ESM-045 |
+| Protected command reads (ESM v25) | Root `command reads protected`; eligible read paths in requirements and production mappings, absence Validation, concurrent matching facts Conflict; Stage admits v25 and, in a new enough bundle, renders protected reads as Arc read protection, refusing unpreservable shapes and every older bundle with STAGE-ESM-044; semantic Host/executor execute admitted reads with non-Error protected requirements refused STAGE-ESM-045 |
 | Chronological command dates (ESM v26) | Same-primitive Date/DateTime `==`, `!=`, `>`, `>=`, `<`, `<=` in require/produces-when (property or literal RHS) and command/property rules (literal RHS only). DateTime uses UTC ticks, participating offset-less inputs reject Validation before rules; then matching stays ordinal. Requires Screenplay 4.199.0 (`screenplay --version`); older binders refuse PLAY0268. The Stage Host and executor run v26 (older Stage refuses STAGE-ESM-016); the renderer and legacy engines refuse STAGE-ESM-046 (toolchain `language-admission.md`). Read command-surface `references/date-comparisons.md`. |
 | Current routing and actor admission | Sources/streams and command/specification routes bind and reference-execute as v8; reaction `runs as system role` supplies the invocation actor as v10. Whole-workspace binding determines executable availability; CLI/Stage realization remains separate |
 | Blocks binding (`PLAY0268`) | enum/identity compliance and events combining personal or explicitly subject-scoped secret values with explicit subject marks; a compiler that stops before v13 refuses all `pii`/`secret` concepts ("compliance attributes require portable data-subject semantics"), while v13 binds them and Stage renders protection; attached command `handler` (PLAY0035 beside productions; pending described intent instead binds v23), bare `rule <Name>`, read paths without protected opt-in or in unsupported positions such as `produces when`, date comparisons with mixed primitives, optional condition operands, `$context`, protected read paths or `today`, date rules on concepts or reaction `where`, `$context.tenant`/claims/roles/causation in `produces`, `$env` conditions, `file` constraints, unquoted `import` of an external contract, a read model with neither explicit `key` nor unambiguous query-based identity as described above (several key marks bind as v27; older binders refuse PLAY0268; toolchain `language-admission.md`), queries with context `from` sources (typed query context is unadmitted), single-result filters (collections only), `scoped to` (opaque scope), `performer` (opaque implementation) or a `by` block on a list query or non-optional single result; optional keyed and collection queries, including caller-supplied equality filters and observable delivery, bind, `$causedBy` and templates in projections |

package/package/corpus/skills/cratis-screenplay-model-review/references/anti-patterns.md

@@ -64,7 +64,7 @@ the problem, the checks it violates, the fix, all pinned to one declaration.
 | Undeclared removal/append event | `remove with` or capture `append` names an undeclared event | V1 warns (PLAY0166, a failure under warnings as errors); binding fails PLAY0273 | C (executable) / D | declare or fix the name; run V3 |
 | Gated command invoked by a reaction without a declared actor | reaction `invokes` a command under a caller policy and has no `runs as system role "<Role>"` that satisfies the gate | the invocation carries no caller: rejected at run time | D (major) | declare `runs as system role "<Role>"` with the least-privilege role the gate admits (ESM v10, Screenplay 4.125.0; Stage 4.89.1 renders role/authenticated trusted actors, but claim-reading/opaque gates still refuse STAGE-ESM-034 and need gap-fill) or record another trusted-path decision - never just delete the gate. A matching `runs as system role` is the admitted trusted path, not a defect |
 | `reads` + `produces` reaction | reaction both reads a view and produces | fails binding | C (executable) | invoke a command, or produce without reads |
-| Unadmitted read claimed protected | rule "checked" by legacy command or trigger reads | no protected contract or target realization | D (major) | opt eligible command reads into `command reads protected` (v25); inspect shape, absence and conflict cases. The Cratis C# renderer refuses protected reads (STAGE-ESM-044); distinguish reference/semantic-engine evidence from generated-app protection; checklist E3 |
+| Unadmitted read claimed protected | rule "checked" by legacy command or trigger reads | no protected contract or target realization | D (major) | opt eligible command reads into `command reads protected` (v25); inspect shape, absence and conflict cases. the Cratis renderer renders protected reads as Arc read protection once the CLI bundles a Stage that supports it (older bundles refuse them with STAGE-ESM-044; releases in command-surface `references/protected-reads.md`); distinguish reference/semantic-engine evidence from generated-app protection; checklist E3 |
 | Caller-supplied state rule | `require currentStatus == "open"` where the caller sends `currentStatus` | the caller decides its own permission | D (major) | read authoritative stored state through admitted protected reads and `require`; mark legacy/refused shapes and target realization as gaps; checklist E3. Uuid ownership compares the caller with the stored owner (`require caller == Document.owner`, v28) |
 | `severity warning` as soft rule | rule meant to warn but still rejects | blocks valid requests | C semantics | remove or make it a real rule |
 | Relay events | `*Synced`, `*Forwarded` events that only move data | noise, not facts | D | translate once into a business fact |

package/package/corpus/skills/cratis-screenplay-model-review/references/checklist.md

@@ -123,7 +123,7 @@ the format in `worked-example.md`.
 |---|---|---|---|
 | E1 | Value formats on `concept`s; input rules on the command; uniqueness as `constraint`; access as `authorize` | declarations | D |
 | E2 | Every refusal has a message a person understands; constraint messages copied verbatim in specs | `message`, specs | D |
-| E3 | A state-dependent rule uses `reads` + `require` over authoritative state: eligible reads opt into `command reads protected` (v25), with required absence and decide/commit conflict cases. Legacy/refused reads are marked unenforced with a named target. The Cratis C# renderer refuses protected reads (STAGE-ESM-044); reference/semantic-engine evidence is not generated-app protection. An ownership rule compares the caller with the stored owner (`require caller == Document.owner`, Uuid equality, same concept on both sides, Requires Screenplay 4.205.0, ESM v28; ordering and Uuid validation rules stay PLAY0268). Not: caller-supplied copies of state, attestation booleans (`confirmsX == true`), rules in `handler` / `implementation hint` prose, or `reads` treated as protection | slice `description`, `require`, `handler` | D (faking or hiding = major) |
+| E3 | A state-dependent rule uses `reads` + `require` over authoritative state: eligible reads opt into `command reads protected` (v25), with required absence and decide/commit conflict cases. Legacy/refused reads are marked unenforced with a named target. the Cratis renderer renders protected reads as Arc read protection once the CLI bundles a Stage that supports it (older bundles refuse them with STAGE-ESM-044; releases in command-surface `references/protected-reads.md`); reference/semantic-engine evidence is not generated-app protection. An ownership rule compares the caller with the stored owner (`require caller == Document.owner`, Uuid equality, same concept on both sides, Requires Screenplay 4.205.0, ESM v28; ordering and Uuid validation rules stay PLAY0268). Not: caller-supplied copies of state, attestation booleans (`confirmsX == true`), rules in `handler` / `implementation hint` prose, or `reads` treated as protection | slice `description`, `require`, `handler` | D (faking or hiding = major) |
 | E4 | `severity warning` is not used as "soft" validation (it still rejects) | validate lines | C semantics |
 | E5 | Preconditions are explicit; nothing relies on "obviously you can't" | descriptions, specs | Q |
 | E6 | Each invariant has an atomic enforcement point (name the storage provider where constraint admission matters); the race loser's outcome is specified | constraints, specs | D |

package/package/corpus/skills/cratis-screenplay-modeling-lifecycle/references/principles.md

@@ -11,7 +11,7 @@ instruction for the work, not background reading. Skills that restate one cite i
 6. **Keep semantic identity independent of names, paths, layout and generated symbols.** Commit the identity catalog with the model.
 7. **Keep unsupported intent visible.** Return a precise gap and its owning issue; never weaken the model so rendering passes.
 8. **Write specifications with intent, including rejection and denial.** Never report an unexecuted or unsupported scenario as passed.
-9. **Treat state reads as a correctness boundary.** Eligible command reads opt into `command reads protected` (v25); legacy/trigger reads remain unprotected. The Cratis C# renderer refuses protected reads (STAGE-ESM-044), not the v25 pair: reference absence/conflict guarantees, semantic-engine execution and generated-app protection are different claims.
+9. **Treat state reads as a correctness boundary.** Eligible command reads opt into `command reads protected` (v25); legacy/trigger reads remain unprotected. the Cratis renderer renders protected reads as Arc read protection once the CLI bundles a Stage that supports it (older bundles refuse them with STAGE-ESM-044; releases in command-surface `references/protected-reads.md`), and the v25 pair is a separate admission: reference absence/conflict guarantees, semantic-engine execution and generated-app protection are different claims.
 10. **Separate event-source identity from event payload and choose destinations explicitly.**
 11. **Persisted event shape changes are evolution, never cleanup.** Keep historical generations.
 12. **Model external work as business intent.** Provider interfaces and transport mechanics stay out of the language.

package/package/corpus/skills/cratis-screenplay-modeling-lifecycle/references/vocabulary-map.md

@@ -21,7 +21,7 @@ speaks in them; never model board mechanics (lanes, node ids, positions).
 | Storyline (ordered beats) | a **family** of specifications sharing example data, each one transition (no storyline syntax) | several spec classes | specifications |
 | Field validation | concept `validate` (every use) / command `validate`, `require` | `ConceptValidator<T>` / `CommandValidator<T>` | command validation |
 | Role permission ("Cannot") | `policy` + `authorize` + `then denied` spec; ownership via `claim ... matches subject` | `[Authorize(Policy)]`, generated policies | authorization |
-| Precondition on stream state | `command reads protected` + eligible `reads`/`require` (v25 reference protection); legacy/refused reads remain stated intent. The Cratis C# renderer refuses protected reads (STAGE-ESM-044); semantic-engine execution is separate from generated-app protection. Target Arc `[ProtectedDecision]` + `DecisionRead<T>` or Chronicle DCB needs separate verification | decision over a guarded read | command validation |
+| Precondition on stream state | `command reads protected` + eligible `reads`/`require` (v25 reference protection); legacy/refused reads remain stated intent. the Cratis renderer renders protected reads as Arc read protection once the CLI bundles a Stage that supports it (older bundles refuse them with STAGE-ESM-044; releases in command-surface `references/protected-reads.md`); semantic-engine execution is separate from generated-app protection. Target Arc `[ProtectedDecision]` + `DecisionRead<T>` or Chronicle DCB needs separate verification | decision over a guarded read | command validation |
 | Generated id (`derived:uuid4()`) | `generated` (authorable, not executable) | id supplied before `Handle()` | commands |
 | External system / outbound call | `Translate` slice (inbound); `system`/`operation` (authorable, not executable) or Automation (outbound) | `ICommandOperation` / reactor | operations, reactors |
 | HTML mockup | `screen` Level 1 + board (`visualize-model`) | default Scene composition | ui composition |

package/package/corpus/skills/cratis-screenplay-read-surface/references/named-keys.md

@@ -76,7 +76,7 @@ noncollection sources of compatible nominal types, not literals. Neither execute
 over a composite view in the usual way:
 
 - A command `reads … by` without the application-root `command reads protected`
-  preamble is PLAY0271. With the preamble it is PLAY0781 (reason ByParts), PLAY0782
+  preamble is PLAY0271. With the preamble it is PLAY0781 (reason `by-parts`), PLAY0782
   first when the command has no `identifier`, and PLAY0273 when the key is not an
   input property.
 - A trigger `reads … by` binds when the reaction only invokes commands (information
@@ -214,12 +214,17 @@ Projections on a composite-keyed read model admit only root `from` and `remove w
 Joins, `children`, `remove via join`, `every`, `all`, `nested`, `clear with`,
 `variant` and reducers are PLAY0268. This is not ESM v10 admission.
 
-Stage does not admit v27: it refuses the whole model with `STAGE-ESM-016`, so
-`cratis render` cannot deliver it. Verify and reference-test the model with the
+Requires Stage 4.137.0 for v27 admission (older Stage refuses the whole model with
+`STAGE-ESM-016`). The semantic Host runs composite-keyed read models and the CLI's `cratis run`
+default engine runs them (Requires Cratis CLI 3.75.0); the legacy `eventmodel` engine and the specification
+executor refuse them. Rendering refuses a read model with several key parts or a projection keyed by
+parts (`STAGE-ESM-048`) and a single-instance query by parts (`STAGE-ESM-047`, pending Chronicle#4265),
+and publishes nothing, so `cratis render` cannot deliver it. Verify and reference-test the model with the
 standalone compiler, then hand the delivery to gap-fill
-(`cratis-screenplay-render-and-gap-fill`) with the model as the contract.
+(`cratis-screenplay-render-and-gap-fill`) with the model as the contract. Composite-keyed read models get
+no conventional `Get<ReadModel>ById` query.
 Eligible command reads separately opt into v25 with `command reads protected`;
-a composite lookup there is still refused (PLAY0781 ByParts). See command-surface
+a composite lookup there is still refused (PLAY0781 reason `by-parts`). See command-surface
 [protected reads](../../cratis-screenplay-command-surface/references/protected-reads.md).
 
 ## Repairs and evidence

package/package/corpus/skills/cratis-screenplay-render-and-gap-fill/SKILL.md

@@ -67,7 +67,7 @@ refused reactions, captures and Translate slices remain gap-fill.
 Models with event sources, streams or command routes bind and reference-execute as ESM v8 on the standalone
 tool, so report V3 and V4 from that tool. The CLI/Stage pair
 (`cratis-screenplay-toolchain/references/renderable-subset.md`) reaches v8 route checks
-and construct admission through v26 (Requires Cratis CLI 3.74.0; older bundles stop earlier). Public/foreign events and production overrides
+and construct admission through v27 (Requires Cratis CLI 3.75.0; older bundles stop earlier, v28 is `CLI-RENDER-004`). Public/foreign events and production overrides
 still refuse; semantic reaction/reducer filters and role/authenticated `runs as` render.
 Claim-reading/opaque system gates, legacy actor/filter paths and mixed effects still refuse. Keep refused scope as case A/C,
 never infer target support from binding. Read Stage's `references/admission.md` and
@@ -163,7 +163,7 @@ Adapters and non-renderable scope follow the contract rules of `cratis-applicati
 - `description` and `documentation` reach rendered code only as XML documentation comments (Stage#178),
   never as behavior. A rule stated only in prose is unenforced: fallback record entry or target requirement,
   never "delivered".
-- The `cratis run` sandbox's default engine enforces only simple literal validation rules and no
+- The `cratis run` sandbox's legacy EventModel engine (the default engine before CLI 3.73.0) enforces only simple literal validation rules and no
   authorization; it is no evidence for denial behaviour or for any other rule.
 - Never remove `pii`, `secret`, authorization or rules to get a render through; report the gap.
 - Stop and ask only on a genuine contradiction between model, specs, descriptions and declared

package/package/corpus/skills/cratis-screenplay-render-and-gap-fill/references/gap-fill-handoff.md

@@ -108,11 +108,12 @@ reaction or drop an effect to dodge rendering.
 Preserve declared `reaction batches atomic` boundaries: each trigger occurrence's
 direct productions and each selected refusal branch are separate batches, with
 invoked commands independent. Stage refuses v22 (STAGE-ESM-016) and atomic mode
-in admitted v23–v26 (STAGE-ESM-043); the declaration is not external-effect deduplication.
+in admitted v23–v27 (STAGE-ESM-043); the declaration is not external-effect deduplication.
 For described handlers, hand off only payload computation under the v23 result
 contract; Stage STAGE-IMPL-002 means no stubs, even Stub mode. Protected v25 reads
-refuse Cratis C# rendering with STAGE-ESM-044 despite version admission and need
-generated-app admission/enrollment tests; ordinary injection never supplies protection.
+render from Stage 4.138.0 (STAGE-ESM-044 from older bundles, or for shapes it cannot
+preserve) and need generated-app admission/enrollment tests wherever you hand-write them;
+ordinary injection never supplies protection.
 Semantic Host/executor support is a separate result, not generated-app enforcement.
 
 ## Re-delivery

package/package/corpus/skills/cratis-screenplay-render-and-gap-fill/references/renderability-gate.md

@@ -31,7 +31,7 @@ ESM). Only the probe answers renderability. `PLAY0270` entries are information,
 | Class | Meaning | Typical examples (each verified in `admission.md`) | Action |
 | --- | --- | --- | --- |
 | **Model fix (in mode)** | the model is in, or the user chose, renderable mode and breaks its own subset in a way that has a renderable equivalent with the same meaning | a `produces` whose `for` is not the command identifier; two projections for one read model (`-007`); a policy Stage cannot express portably (`-015`; role-only and opaque pure policies render) | edit request to the modeler session with address, change and rationale |
-| **Capability gap** | the intended meaning needs a construct Stage does not render yet | DateTime equality filters and required parameters after optional filters (`-010`); context/single-result filters, opaque `scoped to`/`performer` and a list-query `by` block remain PLAY0268; a read model with several key parts (v27) refuses `STAGE-ESM-016`; Translate, clocks, captures, non-event triggers and opaque reaction bodies (`-024`); claim-reading/opaque `runs as` gates (`-034`), legacy `from` (`-035`), mixed effects in one handler (`-037`, retries can duplicate events; keep it whole), unsupported reaction mappings (`-039`); unsupported generated types/result combinations (`-028`/`-038`); `then no readmodel` (`-027`); evolved events (`STAGE-ESM-026`); unsupported expression/enum production conditions (`-006`; supported conditional productions render); legacy reads (`PLAY0271`), protected-read rendering (STAGE-ESM-044 despite v25 admission; semantic Host/executor support is separate); code validation (`-005`); protected identities/enums (`-040`) or unadmitted explicit subject lineage (`PLAY0268`); attached command handlers (PLAY0268), described handlers (v23, STAGE-IMPL-002 even Stub mode), atomic mode (STAGE-ESM-016 for v22, STAGE-ESM-043 in admitted v23–v26) | keep the model; fallback record entry; options a to c in `SKILL.md`; link the Stage issue |
+| **Capability gap** | the intended meaning needs a construct Stage does not render yet | DateTime equality filters and required parameters after optional filters (`-010`); context/single-result filters, opaque `scoped to`/`performer` and a list-query `by` block remain PLAY0268; a read model with several key parts or a projection keyed by parts (v27) refuses `STAGE-ESM-048` and a single-instance query by parts `STAGE-ESM-047` (Chronicle#4265); Translate, clocks, captures, non-event triggers and opaque reaction bodies (`-024`); claim-reading/opaque `runs as` gates (`-034`), legacy `from` (`-035`), mixed effects in one handler (`-037`, retries can duplicate events; keep it whole), unsupported reaction mappings (`-039`); unsupported generated types/result combinations (`-028`/`-038`); `then no readmodel` (`-027`); evolved events (`STAGE-ESM-026`); unsupported expression/enum production conditions (`-006`; supported conditional productions render); legacy reads (`PLAY0271`), protected reads the renderer cannot preserve, or any protected read in an older CLI bundle (STAGE-ESM-044 despite v25 admission; semantic Host/executor support is separate); code validation (`-005`); protected identities/enums (`-040`) or unadmitted explicit subject lineage (`PLAY0268`); attached command handlers (PLAY0268), described handlers (v23, STAGE-IMPL-002 even Stub mode), atomic mode (STAGE-ESM-016 for v22, STAGE-ESM-043 in admitted v23–v27) | keep the model; fallback record entry; options a to c in `SKILL.md`; link the Stage issue |
 | **Tool skew** | the bundled compiler disagrees with documented semantics | the false `PLAY0285` on reaction cascades from an older bundle; codes the standalone compiler does not raise | record in the session state and the fallback record; never "fix" a correct model |
 | **Environment** | not the model | restore failures, missing SDK, a destination that is not writable | fix the environment or report blocked |
 
@@ -39,6 +39,7 @@ Requires Stage 4.129.0 for semantic Host/executor protected reads; older engines
 refuse STAGE-ESM-044. Non-Error protected requirements refuse STAGE-ESM-045, including
 reaction invocations. A semantic-engine pass does not resolve the rendering gap;
 read [sandbox boundaries](../../cratis-stage-rendering-and-sandbox/references/sandbox-and-specrunner.md#protected-command-reads).
+Requires Stage 4.138.0 for the Cratis renderer to render protected reads.
 
 ## Triage rules
 - A capability gap never becomes a model fix by deleting meaning. Turning a list screen into a

package/package/corpus/skills/cratis-screenplay-scenario-coverage/references/berth-reservations.md

@@ -4,7 +4,7 @@ This is a legacy control without `command reads protected`; the unprotected-read
 markers below describe that control, not all command reads. Eligible views can opt
 into v25; the date-rule blocker still remains. Read
 [protected reads](../../cratis-screenplay-command-surface/references/protected-reads.md)
-for admission and the Cratis C# renderer's protected-read refusal (STAGE-ESM-044).
+for admission and protected-read rendering (Stage 4.138.0; STAGE-ESM-044 otherwise).
 
 Complete, compiled design-mode model (marina guest berths) showing a coverage matrix turned into specifications: happy path, one rejection per rule, authorization denial, duplicate and retry, competing claim, state violation, alternative branches, compensation and a view lifecycle family. The matrix for it is in `coverage-matrix.md`; the catalogue (`scenario-catalogue.md`) names its specifications.
 

package/package/corpus/skills/cratis-screenplay-scenario-coverage/references/invoicing-dues-design.md

@@ -3,8 +3,8 @@
 **Legacy control without `command reads protected`, not binding-ready by design.**
 Read [protected reads](../../cratis-screenplay-command-surface/references/protected-reads.md)
 for the opt-in alternative. Do not insert the preamble blindly: every read must meet
-finite event-source-keyed admission with removals. A v25 reference pass still does not
-render protected reads: Stage admits v25 but the Cratis C# renderer refuses them with STAGE-ESM-044. The comments and unenforced markers below describe
+finite event-source-keyed admission with removals. A v25 reference pass is not
+rendering: Stage admits v25 and renders protected reads from 4.138.0, and older bundles refuse them with STAGE-ESM-044. The comments and unenforced markers below describe
 this legacy control, not a general limit on command reads.
 
 **Design mode.** This document states the stored-state rules of the

package/package/corpus/skills/cratis-screenplay-scenario-coverage/references/scenario-catalogue.md

@@ -102,8 +102,8 @@ name them as unfinished.
   matching value. Both are needed. Ownership checks on text, Uuid, Date and DateTime subjects render;
   other subjects are STAGE-ESM-015: note it.
 - Traps: `then error` for a denial; a denial spec whose inputs also break a rule (it still
-  denies, but reads ambiguously); trusting a `cratis run` sandbox answer (the default engine enforces no authorization;
-  the opt-in semantic engine enforces both but reads forgeable caller headers, so it is no security boundary); counting another command's denial.
+  denies, but reads ambiguously); trusting a `cratis run` sandbox answer (the legacy EventModel engine enforces no authorization;
+  the semantic engine, `cratis run`'s default from CLI 3.73.0, enforces both but reads forgeable caller headers, so it is no security boundary); counting another command's denial.
 
 ## 4. State violation
 - Ask: "After which earlier facts must this request be refused?"

package/package/corpus/skills/cratis-screenplay-scenario-coverage/references/spec-forms-by-mode.md

@@ -39,8 +39,8 @@ Typed example/override forms: `cratis-screenplay-specifications`
 | Bodied rules, code policies | spec them | spec reported **unsupported**, never passed | no |
 | Pending described command handlers (v23) | specify intent | binds; denial/validation execute, body-reaching specs Unsupported ImplementationBody; all-Unsupported is not green | STAGE-IMPL-002 even Stub mode |
 | Attached command handlers, `file` constraints, query `performer`s | spec them in design | blocked: PLAY0268 at binding, no spec runs (V3 blocked) | no |
-| Atomic reaction mode (v22) | declare for new models | failed batch adds no facts or view changes; earlier batches/commands remain; `then error` alone is insufficient | v22 STAGE-ESM-016; mode in admitted v23–v26 STAGE-ESM-043 |
-| Protected command reads (v25) | declare opt-in for eligible reads | absence Validation; matching intervening facts Conflict; race vectors are not a new spec construct | Cratis C# rendering STAGE-ESM-044; semantic Host/executor execute admitted reads, non-Error protected requirements STAGE-ESM-045; v25 pair admitted |
+| Atomic reaction mode (v22) | declare for new models | failed batch adds no facts or view changes; earlier batches/commands remain; `then error` alone is insufficient | v22 STAGE-ESM-016; mode in admitted v23–v27 STAGE-ESM-043 |
+| Protected command reads (v25) | declare opt-in for eligible reads | absence Validation; matching intervening facts Conflict; race vectors are not a new spec construct | Cratis C# rendering in a new enough bundle (STAGE-ESM-044 before, or for unpreservable shapes); semantic Host/executor execute admitted reads, non-Error protected requirements STAGE-ESM-045; v25 pair admitted |
 
 Requires Screenplay 4.105.0 or later (`screenplay --version`) for list-query specifications, and 4.143.0 or later for collection equality filters (ESM v14).
 

package/package/corpus/skills/cratis-screenplay-slice-design/references/rule-layers.md

@@ -20,7 +20,7 @@ protected decisions. Gap-fill must use an admitted projection/key shape and acti
 unit-of-work enrollment; do not edit managed dependencies. Keep the `.play` rule
 target enforcement separate from reference semantics until target tests verify it.
 Read [protected command reads](../../cratis-screenplay-command-surface/references/protected-reads.md)
-for admission and the Cratis C# renderer's protected-read refusal (STAGE-ESM-044); never remove protection to obtain rendering. Forbidden: caller-supplied copies of state in `require`, boolean attestation
+for admission and protected-read rendering (Stage 4.138.0; STAGE-ESM-044 otherwise); never remove protection to obtain rendering. Forbidden: caller-supplied copies of state in `require`, boolean attestation
 inputs (`confirmsX == true`), rules in `handler` / implementation-hint prose.
 
 ## Authorization is executable

package/package/corpus/skills/cratis-screenplay-slice-design/references/worked-example.md

@@ -5,7 +5,7 @@ One complete legacy design-mode control for `cratis-screenplay-slice-design`, wi
 specification runs here. List queries and clock fixtures bind on an admitting compiler;
 they are not the remaining blocker. Personas and screens are informational.
 Eligible command reads can opt into v25; inspect every projection/key/removal before
-migration and retain the Cratis C# renderer's separate refusal (STAGE-ESM-044; the v25 pair itself is admitted). Read
+migration and keep the separate rendering result (Stage 4.138.0 renders protected reads, STAGE-ESM-044 otherwise; the v25 pair itself is admitted). Read
 [protected reads](../../cratis-screenplay-command-surface/references/protected-reads.md).
 The unenforced descriptions below refer to this legacy control, not all command reads.
 The specifications still seed every read-model source (`LockerInstalled`, `LockerRequested`,