@cratis/pi 7.69.1 → 7.70.1

package/package/corpus/skills/cratis-screenplay-specifications/references/generated-fixtures.md

@@ -30,8 +30,8 @@ secret safety. Client-minted IDs stay inputs; gapless invoice numbering needs an
 allocator, not a random fixture or pattern. Check digits catch typos, not forgery;
 short payload codes need uniqueness enforcement separate from source freshness.
 Pattern/random/rule and checksum validation bind as v21. Stage renders
-pattern/random/checksum under the version gates below; `generate rule` remains
-STAGE-ESM-028. Generated secrets remain refused. Source: Screenplay
+pattern/random/checksum under the version gates below; `generate rule` renders in a new
+enough bundle (the Host and legacy syntax engine refuse it with STAGE-ESM-028). Generated secrets remain refused. Source: Screenplay
 `Documentation/screenplay/generated-values/choosing.md`.
 
 ## Fixtures and outcomes
@@ -106,4 +106,4 @@ Requires Stage 4.95.0 for command clock specs and 4.109.0 for v20 rule-bearing p
 Requires Stage 4.115.0 for v21 admission/all-Proven unpinned rendering, 4.117.0
 for warning/info generated-concept rules, 4.118.0 for checksum validation and
 4.119.0 for pattern/random. Older renderers require rule-bearing pins or refuse
-the respective rules/strategies with -038/-042/-028. `generate rule` remains -028.
+the respective rules/strategies with -038/-042/-028. `generate rule` renders in a new enough bundle.

package/package/corpus/skills/cratis-screenplay-streams-and-consistency/SKILL.md

@@ -114,7 +114,7 @@ Unattended work takes the conservative option and marks it `ASSUMED` in model
   conflict. Legacy reads remain PLAY0271/PLAY0268; `concurrency` remains unbound and
   combining it with protected reads is PLAY0783. Read
   [protected reads](../cratis-screenplay-command-surface/references/protected-reads.md)
-  for admission and the Cratis C# renderer's STAGE-ESM-044 protected-read refusal (the v25 pair itself is admitted). `description` text never reaches rendered code: a rule that lives only in prose is
+  for admission and protected-read rendering (Stage 4.138.0; STAGE-ESM-044 otherwise; the v25 pair itself is admitted). `description` text never reaches rendered code: a rule that lives only in prose is
   unenforced there.
 - `pii` and `secret` bind as ESM v13;
   enum/identity compliance and protected events with explicit subject marks still
@@ -147,7 +147,7 @@ Requires Chronicle 19.59.6 or later (19.59.3 for the InMemory provider) for the
 - New models declare `reaction batches atomic`: direct productions per trigger
   occurrence and each selected refusal branch are separate batches; invoked commands
   stay independent. Legacy absence retains per-fact appends. Stage refuses v22
-  with STAGE-ESM-016 and atomic mode in admitted v23–v26 with STAGE-ESM-043. Read
+  with STAGE-ESM-016 and atomic mode in admitted v23–v27 with STAGE-ESM-043. Read
   [atomic boundaries](../cratis-screenplay-captures-and-reactions/references/atomic-batches-and-source-mappings.md)
   when defining failure rollback; batching is not redelivery deduplication.
 - Match duplicate protection to scope. A property constraint lets a source re-claim its own

package/package/corpus/skills/cratis-screenplay-streams-and-consistency/references/consistency-and-concurrency.md

@@ -58,7 +58,7 @@ observed legacy check from verified atomic protection.
 | a value across all sources | `unique <prop> on <Event>` | value owned by one source; same source may re-claim |
 | a fact at most once per source; mutually exclusive facts | `unique event` (+ `released by`) | covers simple lifecycle transitions |
 | state-dependent rule (balance, capacity, "only if approved") | eligible `reads` + `require` under `command reads protected` (v25) | required absence rejects; matching intervening facts conflict. Payload-key fan-in, joins, reducers and other refused shapes remain target gaps |
-| a view (read model) | unguarded materialized reads are not protection | legacy command and trigger reads remain unprotected; the Cratis C# renderer refuses protected reads (STAGE-ESM-044); semantic Host/executor evidence is not generated-app protection |
+| a view (read model) | unguarded materialized reads are not protection | legacy command and trigger reads remain unprotected; protected-read rendering needs Stage 4.138.0 (STAGE-ESM-044 otherwise); semantic Host/executor evidence is not generated-app protection |
 
 ## 3. Record each state-dependent rule that the model cannot enforce
 Never accept the caller's copy of the state: `currentStatus Status` on the command with
@@ -69,7 +69,7 @@ the rule unenforced in rendered scope.
 
 First inspect [protected reads](../../cratis-screenplay-command-surface/references/protected-reads.md):
 opt eligible command reads into v25, retain absence/conflict specifications and verify
-target consistency separately. Stage admits v25 but the Cratis C# renderer refuses protected reads (STAGE-ESM-044).
+target consistency separately. Stage admits v25 and renders protected reads from 4.138.0 (STAGE-ESM-044 otherwise).
 Semantic Host/executor support has separate severity and outside-append limits. A payload-keyed
 fan-in such as the course-capacity example remains refused; the preamble is not a
 blanket admission of arbitrary projections.

package/package/corpus/skills/cratis-screenplay-streams-and-consistency/references/read-model-keys.md

@@ -36,11 +36,11 @@ composite type only to carry flat parts: both hide the identity the model should
   refuse the duplicate (`references/consistency-and-concurrency.md`).
 - **Lookups.** An optional single-instance query names every part in a `by` block; a list
   uses equality filters. A command or reaction that must read the view by parts is refused
-  (PLAY0271, PLAY0781 ByParts, or PLAY0268 for a producing reaction), so decide on a stream
+  (PLAY0271, PLAY0781 reason `by-parts`, or PLAY0268 for a producing reaction), so decide on a stream
   the command owns instead, or restructure the read. Do not drop the read to bind.
 - **Limits.** Joins, `children`, `nested`, `every`, `all`, `variant` and reducers on the
-  composite-keyed view are PLAY0268. Stage refuses v27 with STAGE-ESM-016, so deliver it
-  through gap-fill with the model as the contract.
+  composite-keyed view are PLAY0268. Stage 4.137.0 admits v27 but the renderer refuses it (STAGE-ESM-048 for several key parts or a projection keyed by parts,
+  STAGE-ESM-047 for a single-instance query by parts), so deliver it through gap-fill with the model as the contract.
 
 Read read-surface `references/named-keys.md` for one complete executable example and the
 projections skill `references/pdl-grammar.md` for the key block syntax.

package/package/corpus/skills/cratis-screenplay-streams-and-consistency/references/streams-example.md

@@ -4,7 +4,7 @@ Legacy control: no `command reads protected` preamble is declared. The course-ca
 payload-key fan-in remains refused even with opt-in; eligible active-enrolment reads
 can protect under v25, but reads plus concurrency cannot combine (PLAY0783). Read
 [protected reads](../../cratis-screenplay-command-surface/references/protected-reads.md)
-for admission and the Cratis C# renderer's protected-read refusal (STAGE-ESM-044). The legacy diagnostics below describe this
+for admission and protected-read rendering (Stage 4.138.0; STAGE-ESM-044 otherwise). The legacy diagnostics below describe this
 control, not a blanket refusal of command reads.
 
 A complete design-mode model for course enrolment. It shows one business identity per stream,

package/package/corpus/skills/cratis-screenplay-toolchain/SKILL.md

@@ -74,7 +74,7 @@ superseded statement needs context; exceptions do not change the contract.
 
 Read `references/verdicts.md` for exact commands, exit codes, the MCP roots caveat and the model notes gate.
 
-Requires Cratis CLI 3.57.0 or later (`cratis --version`) to render models that use equality filters or concept generation strategies (ESM v14 and v15); an older CLI answers `CLI-RENDER-004`. Requires Cratis CLI 3.74.0 for ESM v21–v26; above the CLI's ceiling, a bundled compiler that binds the construct answers `CLI-RENDER-004`, and one that predates it reports the binder's PLAY0268 (Uuid equality before Screenplay 4.205.0). Either way keep the rule and gap-fill.
+Requires Cratis CLI 3.57.0 or later (`cratis --version`) to render models that use equality filters or concept generation strategies (ESM v14 and v15); an older CLI answers `CLI-RENDER-004`. Requires Cratis CLI 3.74.0 for ESM v21–v26 and 3.75.0 for v27 (v28 and later: `CLI-RENDER-004`); above the CLI's ceiling, a bundled compiler that binds the construct answers `CLI-RENDER-004`, and one that predates it reports the binder's PLAY0268 (Uuid equality before Screenplay 4.205.0). Either way keep the rule and gap-fill.
 
 MCP calls below use the `screenplay` server declared in `.cratis/ai/mcp-servers.json`, for example `screenplay` → `read-workspace`.
 
@@ -145,7 +145,7 @@ changes with the root folder name.
   (Requires Screenplay 4.205.0; `screenplay --version`; older binders refuse PLAY0268).
   Read [language admission](references/language-admission.md) and command-surface
   `references/uuid-equality.md`.
-- **v22–v26:** read [language admission](references/language-admission.md) for atomic
+- **v22–v27:** read [language admission](references/language-admission.md) for atomic
   batches, described handlers, text rules, protected reads, chronological command
   Date/DateTime comparisons (Requires Screenplay 4.199.0; `screenplay --version`;
   older binders refuse PLAY0268) and Stage refusals.

package/package/corpus/skills/cratis-screenplay-toolchain/references/cheat-sheet.md

@@ -211,7 +211,7 @@ generated source destinations need freshness. Read
 [Stage admission](../../cratis-stage-rendering-and-sandbox/references/admission.md)
 for v21 admission, all-Proven unpinned specs and the separate prerequisites for
 warning/info rules, checksum validation and pattern/random rendering.
-`generate rule` remains STAGE-ESM-028. Reference binding is not rendering.
+`generate rule` renders from Stage 4.136.0 (STAGE-ESM-028 in the Host). Reference binding is not rendering.
 
 ## Specification forms
 Full list with semantics: `Documentation/screenplay/specifications.md`. Compiled in the

package/package/corpus/skills/cratis-screenplay-toolchain/references/diagnostic-arguments.md

@@ -49,6 +49,10 @@ a separate `case` names an expansion. Argument order is immaterial.
 | PLAY0524 | `specification` (declaration), `step` (keyword), `stepIndex` (index), `property`, `type`, `example?`, `case?`, `parameter?` |
 | PLAY0525, PLAY0526 | `example` |
 | PLAY0583 | `case?`, `parameter?`, `type?`, `text?` |
+| PLAY0781 | `command` (declaration), `read`, `readModel` (declaration), `reason` (keyword) |
+| PLAY0782 | `command` (declaration), `read` |
+| PLAY0783 | `command` (declaration) |
+| PLAY0784, PLAY0785 | `command` (declaration), `read`, `path` |
 | PLAY0790, PLAY0794, PLAY0799 | `profile`, `template`, `blueprint?` |
 | PLAY0791 | `profile`, `template` (the layout name) |
 | PLAY0792 | `profile`, `template`, `blueprint` |
@@ -57,6 +61,10 @@ a separate `case` names an expansion. Argument order is immaterial.
 | PLAY0796 | `profile`, `template`, `blueprint?`, `option` |
 | PLAY0797 | `profile`, `value` |
 
+PLAY0781–PLAY0785 need Screenplay 4.207.0; earlier compilers omit these arguments. `read` is the alias when the
+command gives one, else the read model name. The PLAY0781 `reason` keywords are listed in command-surface
+[protected reads](../../cratis-screenplay-command-surface/references/protected-reads.md); each refused read gets its own PLAY0781.
+
 For PLAY0524, `step` is given, given readmodel, when, when append or then.
 `stepIndex` counts every authored given/when/then clause once across all forms,
 not nested lines, synthesized callers or defaults. Example/case expansion retains

package/package/corpus/skills/cratis-screenplay-toolchain/references/diagnostics.md

@@ -352,25 +352,28 @@ refusal reasons. Read [language admission](language-admission.md) before changin
 | PLAY0698 | Pending intent plus another handler; retain one |
 | PLAY0699 | Pattern outside portable dialect or over 1,000 UTF-16 units / 3,000 expanded nodes; rewrite the refused construct |
 | PLAY0780 | Invalid placement/repetition of `command reads protected`; declare once at root |
-| PLAY0781 | Protected read shape/key refused; inspect the closed reason, never downgrade to an unguarded read |
+| PLAY0781 | Protected read shape/key refused; read the typed `reason` argument (see `diagnostic-arguments.md` for the compiler prerequisite), never downgrade to an unguarded read |
 | PLAY0782 | Omitted `by` without command identifier; declare the lookup input |
 | PLAY0783 | Command combines reads and concurrency; choose the intended boundary |
 | PLAY0784 | Unknown read/property path; reference a declared read or alias |
 | PLAY0785 | Ambiguous view path; use distinct aliases on repeated reads |
 | PLAY0786 (I) | Eligible legacy model; preview typed preamble repair, individually review absence/conflict semantics |
 | PLAY0787 (W) | Exact deprecated Studio text-rule pattern; repair to literal rule or equality, preserving message/severity |
-| STAGE-ESM-043 | Atomic mode not realized, even in admitted v23–v26; retain declaration and gap-fill |
-| STAGE-ESM-044 | Cratis C# renderer refuses protected reads despite v25 admission; semantic Host/executor support is separate; keep protection and gap-fill generated-app scope |
+| STAGE-ESM-043 | Atomic mode not realized, even in admitted v23–v27; retain declaration and gap-fill |
+| STAGE-ESM-047 | Single-instance query by composite key parts (v27) in the renderer, until Chronicle can look up composite keys (Chronicle#4265); keep the query, gap-fill |
+| STAGE-ESM-048 | Read model with several key parts, or projection keyed by parts (v27), in the renderer or legacy syntax engine; keep the model, gap-fill |
+| STAGE-ESM-044 | Renderer refuses a protected read despite v25 admission: any protected read in a bundle that predates protected-read rendering, afterwards only shapes it cannot preserve (constrained events, read paths in `produces when`, optional/collection/composite/mistyped mapping targets, freshness scopes), naming the reason; the legacy Host/structural runner refuse the preamble. Semantic Host/executor support is separate; keep protection and gap-fill generated-app scope |
 | STAGE-ESM-045 | Non-Error protected requirement; semantic Host/executor refuse before execution, including reaction-invoked commands; keep severity and report Unsupported |
 | STAGE-IMPL-002 | Described handler body not realized by Stage, even Stub mode; no stubs emitted |
 
 Invalid match syntax remains PLAY0367. Property/concept text rules bind v24;
 `contains`/`starts with` in conditions only still fail PLAY0268. Stage rejects
-v22/v27/v28 and mixed pairs with STAGE-ESM-016; v23–v26 admission does not implement
-bodies, batches or rendered protected reads (STAGE-ESM-044), and the renderer refuses
-v26 date comparisons with STAGE-ESM-046. Requires Stage 4.129.0
-for semantic Host/executor protected reads; older engines refuse -044. Read
+v22/v28 and mixed pairs with STAGE-ESM-016; v23–v27 admission does not implement
+bodies or batches, the renderer refuses protected reads it cannot preserve (STAGE-ESM-044; every
+protected read in an older bundle), v26 date comparisons (STAGE-ESM-046) and composite read-model
+keys (STAGE-ESM-048/-047). Read
 [language admission](language-admission.md) for the stricter Host outside-append guard.
+Requires Stage 4.129.0 for semantic Host/executor protected reads; older engines refuse -044.
 
 ## Binding (V2 and V3) - see `executable-subset.md` for the full table
 | Code | Meaning | Fix |
@@ -435,7 +438,7 @@ for v21 admission/all-Proven unpinned specs, 4.117.0 for warning/info rules,
 4.118.0 for checksum validation and 4.119.0 for pattern/random. Older renderers
 refuse those constructs or require pins even for Proven rules. Bad pins fail
 STAGE-ESM-011; unpinned Unproven/Refuted rules fail -038; opaque rules fail -005
-before pin evaluation. `generate rule` remains -028; checksum remains -042 only
+before pin evaluation. `generate rule` renders in a new enough bundle (bodies refuse -019/-022/-020; the Host and legacy syntax engine keep -028); checksum remains -042 only
 on legacy syntax paths. Tool-author checks: [generation checks](generation-checks.md).
 
 Fix order: E at V1 -> W at V1 -> silent-gap check -> V2 codes (if the mode needs V3).
@@ -458,9 +461,9 @@ Publication STAGE-ESM-032, foreign facts/event captures 033, claim-reading/opaqu
 | STAGE-ESM-007 / 009 / 010 / 017 | projection shape (one projection or reducer per read model, affected-instance key, unsupported query shapes, keys, unsupported `all` mappings, event-context values) |
 | STAGE-ESM-011 | specification shape not rendered (`when append` outside the single-hop reaction subset, command specifications that cascade into reactions, composite values, an unauthenticated caller carrying roles or claims, generated fixtures that do not match their strategy shape or concept rules). Command scenarios and single-hop reaction appends render |
 | STAGE-ESM-014 | constraint shape (multi-claim in one command, optional or composite targets) |
-| STAGE-ESM-019/022 | reducer or opaque pure policy body outside the pure allowlist |
+| STAGE-ESM-019/022 | reducer or opaque pure policy body outside the pure allowlist; a `generate rule` body that does not compile or warns (019) or shadows a type or namespace (022) |
 | STAGE-ESM-024 | interval, schedule, application, startup and shutdown triggers, opaque reaction bodies, captures, Translate, clock/trigger/capture specifications |
-| STAGE-ESM-020 | a body the model requires is missing or changed (content hash check); blocks publication |
+| STAGE-ESM-020 | a body the model requires, including a `generate rule` attachment, is missing or changed (content hash check); blocks publication |
 | STAGE-ESM-039 | unsupported refusal branch conditions/routes/mappings, same-event multi-trigger refusal groups, localized `$refusal.message` or ambiguous multi-constraint `$refusal.constraint` |
 | STAGE-EVENT-002 / CLI-RENDER-016 | existing destination event type ids changed or unreadable; pin stored identity, never bypass with `--force` |
 | STAGE-BASELINE-001–004 | whole-application warnings: changed/missing admitted event revision, unreadable baseline, unavailable or stale assessment; keep `baseline check` as the independent CI gate |

package/package/corpus/skills/cratis-screenplay-toolchain/references/executable-subset.md

@@ -45,7 +45,7 @@ Complete examples that bind live in `executable-example.md`, `pdl-example.md` (p
 For atomic batches (v22), described handlers (v23), ordinal text rules (v24) and
 protected reads (v25), chronological command dates (v26), composite keys (v27) and Uuid equality (v28), read
 [language admission](language-admission.md). A later
-version alone does not enable either application opt-in.
+version alone does not enable either application opt-in. The language is frozen at ESM v1–v28 ([the freeze decision](https://github.com/Cratis/Screenplay/blob/main/decisions/0092-the-language-is-frozen-at-esm-v28.md)): no new versions, constructs, keywords or grammar, except a construct for a real model that is blocked with no model-side alternative, accepted in its own record. Model with what v1–v28 offers; when Stage, `cratis render` or Studio does not support a construct yet, treat the typed refusal as a platform gap to report, since consumers are catching up to v28, not a reason to wait for new language.
 
 ## Caller and compliance boundary
 
@@ -223,7 +223,7 @@ author `validate checksum` for arithmetic. Requires Stage 4.109.0 for v20,
 4.118.0 for checksum validation and 4.119.0 for pattern/random rendering; older
 renderers refuse those constructs or require rule-bearing pins even when Proven.
 Unproven/Refuted rules still need pins (-038), bad pins fail -011, and
-`generate rule` remains -028. Do not remove rules or classification to render.
+`generate rule` renders from Stage 4.136.0 (the Host and legacy syntax engine keep -028). Do not remove rules or classification to render.
 
 ## Released public boundaries and observer routes
 
@@ -284,9 +284,8 @@ Models with one `key` mark keep their earlier version and bytes. Refused with PL
 joins, `children`, `remove via join`, `every`, `all`, `nested`, `clear with`, `variant`
 and reducers on the composite-keyed read model, a list query with a `by` block, a
 non-optional single-instance return, and command reads (PLAY0271, or PLAY0781
-ByParts under `command reads protected`) or trigger reads that produce directly.
-Stage refuses v27 with STAGE-ESM-016, independently of standalone binding and
-reference execution. Read read-surface
+reason `by-parts` under `command reads protected`) or trigger reads that produce directly.
+Requires Stage 4.137.0 for v27 admission (older Stage refuses it with STAGE-ESM-016): the semantic Host runs composite-keyed read models end to end, and the specification executor refuses specifications over them as unsupported. The Cratis renderer refuses a read model with several key parts or a projection keyed by parts with STAGE-ESM-048 and a single-instance query by parts with STAGE-ESM-047 (Chronicle#4265); composite-keyed read models get no conventional `Get<ReadModel>ById` query. This is independent of standalone binding and reference execution. Read read-surface
 [named keys](../../cratis-screenplay-read-surface/references/named-keys.md) for the
 complete example.
 

package/package/corpus/skills/cratis-screenplay-toolchain/references/language-admission.md

@@ -9,12 +9,12 @@ exact language/semantic pairs; binding, reference execution and rendering are se
 
 | ESM | Selecting construct | Binding/reference behavior | Stage boundary |
 | --- | --- | --- | --- |
-| v22 | Application-root `reaction batches atomic` | Direct productions per trigger occurrence and each selected refusal branch are separate atomic batches; commands remain independent | v22 refused STAGE-ESM-016; mode in admitted v23–v26 refused STAGE-ESM-043 |
+| v22 | Application-root `reaction batches atomic` | Direct productions per trigger occurrence and each selected refusal branch are separate atomic batches; commands remain independent | v22 refused STAGE-ESM-016; mode in admitted v23–v27 refused STAGE-ESM-043 |
 | v23 | Pending `handler implementation` beside unconditional `produces` | Payload-only body; PLAY0695 information; reaching body gives Unsupported ImplementationBody | v23 admitted, body refused STAGE-IMPL-002 in renderer/Host/executor, even Stub mode |
 | v24 | `contains`, `not contains`, `starts with`, `ends with` property/concept rules | Ordinal UTF-16, absent optional passes; not text-condition operators | v24 admitted; semantic Host/executor and generated ordinal comparisons preserve rules |
-| v25 | Application-root `command reads protected` | Admitted reads in requirements/mappings, absence Validation, matching decide/commit changes Conflict | v25 admitted; Cratis C# renderer refuses STAGE-ESM-044; semantic Host/executor execute reads, non-Error protected requirements refuse STAGE-ESM-045 |
+| v25 | Application-root `command reads protected` | Admitted reads in requirements/mappings, absence Validation, matching decide/commit changes Conflict | v25 admitted; Cratis renderer renders protected reads in a new enough bundle (STAGE-ESM-044 before it, and for shapes it cannot preserve); semantic Host/executor execute reads, non-Error protected requirements refuse STAGE-ESM-045 |
 | v26 | Chronological command Date/DateTime comparisons | Same-primitive `==`, `!=`, `>`, `>=`, `<`, `<=`; DateTime UTC ticks and pre-rule offset validation | v26 admitted; Host/executor run it, renderer and legacy engines refuse STAGE-ESM-046 |
-| v27 | A read model with two or more `key` marks | Untyped projection `key` blocks, equality-filter lists, single-instance `by` blocks, per-part fixtures | v27 refused STAGE-ESM-016 |
+| v27 | A read model with two or more `key` marks | Untyped projection `key` blocks, equality-filter lists, single-instance `by` blocks, per-part fixtures | v27 admitted; Host runs it, renderer refuses STAGE-ESM-048/-047, executor refuses specs over it |
 | v28 | `==`/`!=` between Uuid values in command `require` and `produces when` | Uuid properties, Uuid concepts and identities, canonical literals; protected read paths in `require` only | v28 refused STAGE-ESM-016 |
 
 Requires Screenplay 4.181.0 or later (`screenplay --version`) for atomic batches; older compilers cannot admit the preamble.
@@ -33,7 +33,7 @@ Requires Screenplay 4.205.0 (ESM v28; `screenplay --version`) for Uuid equality
 
 Requires Stage 4.124.0 for v24 text-rule admission (`cratis --version` identifies the CLI bundle); older renderers refuse v24 with STAGE-ESM-016. V23 admission alone does not implement described bodies.
 
-Requires Stage 4.127.0 for v25 version admission; older renderers refuse v25 with STAGE-ESM-016. The Cratis C# renderer still refuses protected reads with STAGE-ESM-044; no artifacts are emitted.
+Requires Stage 4.127.0 for v25 version admission; older renderers refuse v25 with STAGE-ESM-016. Requires Stage 4.138.0 for the Cratis renderer to render protected reads as Arc read protection; earlier renderers, and reads it cannot preserve, refuse STAGE-ESM-044 and emit no artifacts. `cratis render` gets this from the first CLI that bundles Stage 4.138.0; CLI 3.75.0 bundles Stage 4.137.0.
 
 Requires Stage 4.129.0 for semantic Host/executor protected reads; older engines refuse STAGE-ESM-044. Absence rejects before requirements/generation; read properties feed requirements and productions. Non-Error protected requirements refuse STAGE-ESM-045, including reaction invocations. Legacy Host/structural runner retain -044. The Host faults on any outside append, stricter than reference dependency-scoped conflicts; see [sandbox boundaries](../../cratis-stage-rendering-and-sandbox/references/sandbox-and-specrunner.md#protected-command-reads).
 
@@ -74,9 +74,10 @@ the same condition without Uuid operands keeps its earlier version. To see the s
 the model with the `screenplay` MCP server and call `read-workspace` with `view` `executable-model`:
 `languageVersion` reads `28.0`.
 
-Stage's semantic engines admit exact v1–v21 and v23–v26 pairs. V22/v27/v28 and mixed
-pairs refuse STAGE-ESM-016. Requires Stage 4.135.0 for v26 admission; older Stage
-refuses v26 with STAGE-ESM-016. Admission of v23–v26 is not admission of described bodies,
-atomic mode or rendered protected reads. A CLI may bundle an older compiler/Stage pair: run no-write render
+Stage's semantic engines admit exact v1–v21 and v23–v27 pairs. V22/v28 and mixed
+pairs refuse STAGE-ESM-016. Admission of v23–v27 is not admission of described bodies,
+atomic mode or composite-key rendering, and protected reads render only in a bundle that supports them. A CLI may bundle an older compiler/Stage pair: run no-write render
 admission rather than transferring a standalone verdict. Pattern diagnostics arise
 in Screenplay before rendering; diagnostic arguments add no ESM version or new tool.
+
+Requires Stage 4.135.0 for v26 admission and 4.137.0 for v27; older Stage refuses them with STAGE-ESM-016.

package/package/corpus/skills/cratis-screenplay-toolchain/references/renderable-subset.md

@@ -21,7 +21,9 @@ and concept compliance (v13) render.
 
 ## Current admission
 
-Stage admits exact ESM v1–v21 and v23–v26 pairs; v22/v27/v28 and mixed pairs
+The language is frozen at ESM v1–v28 ([the freeze decision](https://github.com/Cratis/Screenplay/blob/main/decisions/0092-the-language-is-frozen-at-esm-v28.md)): no new versions, constructs, keywords or grammar, except a construct for a real model that is blocked with no model-side alternative, accepted in its own record. Model with what v1–v28 offers; when Stage, `cratis render` or Studio does not support a construct yet, treat the typed refusal as a platform gap to report, since consumers are catching up to v28, not a reason to wait for new language.
+
+Stage admits exact ESM v1–v21 and v23–v27 pairs; v22/v28 and mixed pairs
 refuse STAGE-ESM-016. Chronological command Date/DateTime comparisons select v26:
 the Host and executor run them, but the renderer refuses STAGE-ESM-046, so they are not renderable. Keep the
 rule and use authorized gap-fill. Version admission is separate from construct support.
@@ -33,11 +35,13 @@ The CLI's bundled Stage can be older: read installed versions and the pins in
 does not render refuses with its own code before any artifact is planned.
 
 Requires Stage 4.96.0 for stored event names (v16), 4.101.0 for no-event assertions (v17), 4.102.0 for refusal branches (v19), and 4.103.0 for rendered redelivery; older renderers refuse the respective shapes.
-Requires Cratis CLI 3.60.0 (`cratis --version`) for v16 rendering and 3.74.0 for v21–v26; a bundle below the model's version refuses it with CLI-RENDER-004, or with PLAY0268 when its bundled compiler predates the construct.
+Requires Cratis CLI 3.60.0 (`cratis --version`) for v16 rendering, 3.74.0 for v21–v26 and 3.75.0 for v27 admission (v28 and later: CLI-RENDER-004); a bundle below the model's version refuses it with CLI-RENDER-004, or with PLAY0268 when its bundled compiler predates the construct.
 
 With an admitting renderer, all-Proven generated-concept rules allow unpinned
 rendered specs; warning/info rules and semantic checksum validation are enforced,
-and pattern/random strategies render. `generate rule` remains STAGE-ESM-028.
+and pattern/random strategies render. `generate rule` renders in a new enough bundle (see the Requires line below): the body
+refuses -019 when it does not compile or warns, -022 on shadowing and -020 when the attachment is missing; the Host and legacy syntax engine keep -028.
+Requires Stage 4.136.0 for `generate rule`, carried by Cratis CLI 3.75.0.
 The independent executor still needs deterministic pins. Dated patterns use
 receipt-time UTC; random ranges use `long` with inclusive endpoints.
 
@@ -46,11 +50,11 @@ This table is a reading of the renderer's admission, not a render result: run th
 | Area | Renders | Refused (code) |
 | --- | --- | --- |
 | Slice kinds | `StateChange`, `StateView`, supported event-triggered `Automation` with Chronicle reactors | Translate, captures, non-event triggers, opaque bodies, clock/trigger/capture specs (`-024`); claim-reading/opaque `runs as` gates (`-034`), mixed effects from one handler (`-037`, redelivery can duplicate events), unsupported conditions/destinations/mappings (`-039`). Keep refused reactions whole |
-| Queries | optional keyed snapshot lookups; snapshot or observable collections, keyed or unkeyed, with v14 equality filters | context/single-result filters, opaque `scoped to`/`performer` and a list-query `by` block: PLAY0268; v27 composite keys: STAGE-ESM-016. DateTime filters and required parameters after optional filters refuse `-010`; filter-name collisions refuse `-012`; concept arguments retain Arc validation, including nested members/elements; nullable keys or optional concept filters with `not empty` refuse `-010` rather than changing null behavior |
+| Queries | optional keyed snapshot lookups; snapshot or observable collections, keyed or unkeyed, with v14 equality filters | context/single-result filters, opaque `scoped to`/`performer` and a list-query `by` block: PLAY0268; v27 composite-key lookups by parts: STAGE-ESM-047, read models and projections keyed by parts: STAGE-ESM-048. DateTime filters and required parameters after optional filters refuse `-010`; filter-name collisions refuse `-012`; concept arguments retain Arc validation, including nested members/elements; nullable keys or optional concept filters with `not empty` refuse `-010` rather than changing null behavior |
 | Authorization | role-only, authenticated, opaque pure policies, claim conditions with Uuid, Date, DateTime or text targets (numeric and Boolean claim matches render as always false), `not`/and/or; roles read through the identity's `RoleClaimType` | role-claim URIs, nested opaque policies, unresolved or non-portable policies, no single identifier, opaque-policy subjects that are not text, Uuid, Date or DateTime (`STAGE-ESM-015`, a restriction separate from declarative claim targets) |
 | Event sources, streams, routes (ESM v8) | rendered, including routed read-model/query companion replay | reserved stored names, unformattable routed fixtures (`STAGE-ESM-030`) |
 | Numbers, case tables | whole numbers as `long` from ESM v8; case tables | out-of-`int` literals below v8 (`STAGE-ESM-031`) |
-| Generated values and responses (v7/v15/v20/v21) | required scalar UUID/String strategies and Int random, pattern/checksum, concept validators at all severities, all-Proven unpinned relational specs, Guarded v15 freshness, scalar/named responses and fixtures | `generate rule`, unknown strategies and unsupported generated types (`-028`); unsupported response combinations, generated-property validation, name collisions, unpinned Unproven/Refuted rules or unordered/projected/collision-sensitive expectations (`-038`); invalid pins (`-011`); opaque concept rules (`-005`); unknown rule kinds and legacy checksum (`-042`) |
+| Generated values and responses (v7/v15/v20/v21) | required scalar UUID/String strategies and Int random, pattern/checksum, concept validators at all severities, all-Proven unpinned relational specs, Guarded v15 freshness, scalar/named responses and fixtures | unknown strategies and unsupported generated types (`-028`); `generate rule` bodies that do not compile (`-019`), shadow a type (`-022`) or lack an attachment (`-020`); unsupported response combinations, generated-property validation, name collisions, unpinned Unproven/Refuted rules or unordered/projected/collision-sensitive expectations (`-038`); invalid pins (`-011`); opaque concept rules (`-005`); unknown rule kinds and legacy checksum (`-042`) |
 | Enum numbers / compliance | explicit enum numbers (v12); concept `[PII]` or scoped `[Encrypted]` + `[NotAudited]` (v13), property-level `[NotAudited]` for protected command inputs | protected identities/enums (`-040`); explicit subject lineage remains unadmitted |
 | Specifications | command scenarios and supported single-hop reaction appends; Stage's `admission.md` | appends outside the single-hop subset and commands cascading into reactions (`-011`); `then no readmodel` (`-027`); an unauthenticated caller carrying roles or claims (`-011`); command `given clock` renders only whole milliseconds at or after 1970 |
 | v9 and v10 | reaction/reducer `from` filters; role/authenticated `runs as` | public events and event-target projections (`-032`); foreign origins and event-source captures (`-033`); directed Translate (`-024`); claim-reading/opaque `runs as` gates (`-034`); legacy `from` (`-035`); per-production route overrides (`-036`) |
@@ -60,14 +64,14 @@ This table is a reading of the renderer's admission, not a render result: run th
 | Evolved events | initial revisions only (migrations are not rendered) | `STAGE-ESM-026` |
 | Descriptions, documentation | XML `<summary>`/`<remarks>` doc comments only | characters invalid in XML: `CLI-RENDER-005`; never behavior |
 
-The Cratis C# renderer refuses protected command reads with STAGE-ESM-044, described handlers
+The Cratis renderer renders protected command reads in a bundle that supports them (STAGE-ESM-044 for shapes it cannot preserve and in every earlier bundle), refuses described handlers
 with STAGE-IMPL-002 (even Stub mode), and atomic mode in admitted pairs with
 STAGE-ESM-043. Literal
 text rules execute/render ordinal UTF-16 comparisons. Read [language admission](language-admission.md).
 A CLI's older bundled compiler may fail first: legacy reads/concurrency PLAY0271,
-attached handlers PLAY0268. Protected reads bind v25, not a Stage render. Requires Stage 4.129.0 for semantic
-Host/executor protected reads; older engines refuse -044. Non-Error protected requirements
+attached handlers PLAY0268. Protected reads bind v25. Non-Error protected requirements
 refuse STAGE-ESM-045, including reaction invocations; this is not a rendering result.
+Requires Stage 4.129.0 for semantic Host/executor protected reads (older engines refuse -044) and Stage 4.138.0 for the Cratis renderer to render them.
 Response-name authoring scopes are not rendered and Scene runtime does not supply them.
 
 Compliance mapping in the generated C#: personal data to `[PII]`, operational secrets to

package/package/corpus/skills/cratis-screenplay-toolchain/references/traps.md

@@ -42,7 +42,7 @@ Compiler syntax: `cheat-sheet.md`. Negative capability claims depend on the tool
 35. `description`/`documentation` are authoring metadata: board, MCP and Prologue show them; `cratis render` emits them only as XML doc comments (invalid XML characters are CLI-RENDER-005), never as behavior. A rule only in prose is unenforced in rendered code; make it a rule layer, a spec or a recorded target requirement.
 36. One unadmitted construct (operations, `numbers exact`) blocks whole-model binding. Routing is admitted (v8), as are flat composite view keys (v27). Overrides replace the whole route, filters never match unrouted facts. Do not remove routing or authorization to render a model.
 37. Personas remain outside ESM bytes, but specifications accept `given caller as <Persona>`: one authenticated deterministic policy witness, not every matching caller. Inspect the chosen `or` branch; use explicit callers when synthesis is refused.
-38. A stored-state rule uses `reads <View>` and `require` with an indented message. Opt into `command reads protected` for eligible v25 views; absence rejects and matching decide/commit changes conflict. Legacy reads remain unprotected. The Cratis C# renderer refuses protected reads (STAGE-ESM-044), not the v25 pair; semantic Host/executor support is separate: hand-written Arc `[ProtectedDecision]` + `DecisionRead<T>` or Chronicle consistency enforcement needs separate target verification; use a constraint for uniqueness. Forbidden: caller-supplied copies of state in `require`, boolean attestation inputs (`confirmsX == true`), rules hidden in `handler`/implementation-hint prose. An unguarded materialized read is unsafe for a protected decision.
+38. A stored-state rule uses `reads <View>` and `require` with an indented message. Opt into `command reads protected` for eligible v25 views; absence rejects and matching decide/commit changes conflict. Legacy reads remain unprotected. Stage 4.138.0 renders protected reads as Arc read protection (earlier bundles, and shapes it cannot preserve, refuse STAGE-ESM-044); semantic Host/executor support is separate: otherwise hand-written Arc `[ProtectedDecision]` + `DecisionRead<T>` or Chronicle consistency enforcement needs separate target verification; use a constraint for uniqueness. Forbidden: caller-supplied copies of state in `require`, boolean attestation inputs (`confirmsX == true`), rules hidden in `handler`/implementation-hint prose. An unguarded materialized read is unsafe for a protected decision.
     Requires Arc 22.39.0 or later for `[ProtectedDecision]`.
 
 Identity and compliance traps (`identity.md`, `concepts.md`, `events.md`, `purposes.md`, `diagnostics.md` in the Screenplay documentation):

package/package/corpus/skills/cratis-stage-rendering-and-sandbox/SKILL.md

@@ -17,7 +17,7 @@ whether it is admitted; reading the admission rules is not a render result.
 
 Requires cratis CLI ≥ 3.57 (`cratis --version`) to render ESM v14 and v15 models; an older CLI refuses newer ESM versions with `CLI-RENDER-004` (or `STAGE-ESM-016` from Stage directly).
 
-Requires Cratis CLI 3.74.0 to render ESM v21–v26 models; CLI 3.66.0–3.73.0 refuse v21 and later with `CLI-RENDER-004`. Above the ceiling, a construct the bundled compiler cannot bind reports PLAY0268 before `CLI-RENDER-004` is reached.
+Requires Cratis CLI 3.74.0 to render ESM v21–v26 models and 3.75.0 for v27; CLI 3.66.0–3.73.0 refuse v21 and later with `CLI-RENDER-004`, and every CLI refuses v28 and later with it. Above the ceiling, a construct the bundled compiler cannot bind reports PLAY0268 before `CLI-RENDER-004` is reached.
 
 ## Batches, described handlers, text rules and protected reads
 
@@ -76,10 +76,10 @@ printed), `1` is a missing input. Add `-o json` for the counts and the publicati
 Facts that surprise:
 
 - **Binding uses the CLI's bundled compiler**, not the standalone one. Version admission
-  does not imply construct support: exact ESM v1–v21 and v23–v26 pairs are admitted,
-  while v22/v27/v28 and mixed pairs refuse `STAGE-ESM-016`. Date/DateTime command comparisons (v26)
+  does not imply construct support: exact ESM v1–v21 and v23–v27 pairs are admitted,
+  while v22/v28 and mixed pairs refuse `STAGE-ESM-016`. Date/DateTime command comparisons (v26)
   execute in the semantic Host and executor but refuse `STAGE-ESM-046` in the renderer. Pattern/random generation and checksum validation
-  render with an admitting renderer; `generate rule` still refuses `STAGE-ESM-028`.
+  render with an admitting renderer; `generate rule` renders in a new enough bundle (the Host and legacy syntax engine still refuse it with `STAGE-ESM-028`).
   Read [references/admission.md](references/admission.md) for the introducing-release
   prerequisites, all-Proven unpinned specifications and construct/pin checks (-011/-038).
   An older CLI bundle can refuse `CLI-RENDER-004` (direct Stage: `STAGE-ESM-016`);
@@ -131,13 +131,13 @@ One blocker publishes nothing. Codes, limits and fixes: [references/admission.md
   appends beyond single-hop/cascade specs (`-011`), absence (`-027`), evolution (`STAGE-ESM-026`), public/foreign events
   (`-032`/`-033`), claim-reading/opaque `runs as` gates (`-034`), legacy filters (`-035`), production
   overrides (`-036`), code validation (`-005`), DateTime filters (`-010`),
-  unsupported conditional productions, composite projection keys and unsupported `all` shapes.
-  The Cratis C# renderer refuses protected reads with `STAGE-ESM-044`, described handlers `STAGE-IMPL-002`
+  unsupported conditional productions, composite read-model keys (`STAGE-ESM-048`, and `-047` for a single-instance query by parts) and unsupported `all` shapes.
+  Protected reads render as Arc read protection in a new enough bundle; shapes it cannot preserve, and every protected read in an older bundle, refuse `STAGE-ESM-044` (see admission.md). The renderer refuses described handlers `STAGE-IMPL-002`
   (even Stub mode), and atomic mode in admitted pairs `STAGE-ESM-043`.
 - **Binding refusals (`PLAY0268`/`PLAY0271`):** legacy reads, `concurrency`, attached
   handlers, context/single-result filters, opaque scope/performer, a list-query `by` block,
   enum/identity compliance and subject lineage. Eligible protected reads bind v25;
-  pending handlers with unconditional productions bind v23, but neither renders. A read model with several key parts (v27) refuses `STAGE-ESM-016`.
+  pending handlers with unconditional productions bind v23, but neither renders. A read model with several key parts (v27) is admitted but refuses rendering (`STAGE-ESM-048`).
   Never drop protection.
 
 A refusal is not a licence to weaken the model: drop no specification, event generation or
@@ -190,12 +190,16 @@ Silent fallback to a default screen is a failure, not a partial render.
 
 `cratis run [PATH]` (Docker required) starts `cratis/stage` on the folder or file: Stage
 API on `9090`, Chronicle Workbench on `https://localhost:35000`. It is a **partial,
-disposable runtime**, not a generated application. The default engine appends modeled
+disposable runtime**, not a generated application. `cratis run` runs the `semantic` engine
+(Requires Cratis CLI 3.73.0); Stage's semantic engine is the only engine going forward. The legacy
+EventModel engine (older CLIs, or the image without `Stage__Runtime__Engine=semantic`) is legacy; do not rely on it.
+It appends modeled
 `produces` facts and echoes the payload. It refuses missing required properties and
 simple literal `validate` rules on top-level properties, but enforces no other rule, no
-constraint and no command or query authorization; `Stage__Runtime__Engine=semantic` opts
-in to an engine that does, and refuses what it cannot execute (HTTP 501). The default engine
-also refuses routed models (`STAGE-ESM-030`) and protected reads (`STAGE-ESM-044`).
+constraint and no command or query authorization; the semantic engine enforces them and
+refuses what it cannot execute (HTTP 501). The legacy engine
+also refuses routed models (`STAGE-ESM-030`), composite read-model keys (v27) and protected reads (`STAGE-ESM-044`); the semantic engine runs composite keys.
+Requires Cratis CLI 3.75.0 for `cratis run` to run v27 composite keys.
 Requires Stage 4.129.0 for semantic Host/runner protected reads; older engines refuse
 `STAGE-ESM-044`. Required absence rejects before requirements/generation, read properties
 feed requirements and productions, and non-Error protected requirements refuse
@@ -243,7 +247,7 @@ to disk with no managed staging and no safe stale-file removal; a failure can le
 - No file under `.cratis-render/` is staged; managed files carry no local edits.
 - Stage's plan is deterministic (same bytes and hashes); that is not a review, and Stage never reviews, stages or approves anything.
 - Sandbox expectations account for the rules, constraints, authorization and query
-  authorization the default engine does not enforce.
+  authorization the legacy EventModel engine does not enforce.
 - Runtime screen smoke coverage uses the same model root or workspace export as
   `cratis render`, names package/image versions, and fails on dropped authored UI
   or silent default composition.

package/package/corpus/skills/cratis-stage-rendering-and-sandbox/references/admission.md

@@ -11,14 +11,15 @@
 - Specification rules (`STAGE-ESM-011`)
 - Refusals seen while drafting a model
 
-Stage admits exact ESM v1–v21 and v23–v26 language/semantic pairs, then checks
-constructs. V22, v27, v28 and mixed or unknown pairs report `STAGE-ESM-016`. `cratis render` admits
-ESM v1–v26: Stage plans each model and refuses the constructs it cannot render with typed `STAGE-ESM-*`
-codes (a v22 model reports `STAGE-ESM-016`; v26 date comparisons report `STAGE-ESM-046`). The CLI refuses
-a bound model above v26 with `CLI-RENDER-004` before planning; a construct its bundled compiler cannot bind
+Stage admits exact ESM v1–v21 and v23–v27 language/semantic pairs, then checks
+constructs. V22, v28 and mixed or unknown pairs report `STAGE-ESM-016`. `cratis render` admits
+ESM v1–v27: Stage plans each model and refuses the constructs it cannot render with typed `STAGE-ESM-*`
+codes (a v22 model reports `STAGE-ESM-016`; v26 date comparisons report `STAGE-ESM-046`; v27 composite
+read-model keys report `STAGE-ESM-048`/`-047`). The CLI refuses
+a bound model above v27 with `CLI-RENDER-004` before planning; a construct its bundled compiler cannot bind
 reports PLAY0268 instead.
 
-Requires Cratis CLI 3.74.0 (`cratis --version`) for v21–v26 rendering; CLI 3.66.0–3.73.0 stop at v20 and refuse v21 and
+Requires Cratis CLI 3.74.0 (`cratis --version`) for v21–v26 rendering and 3.75.0 for v27; CLI 3.66.0–3.73.0 stop at v20 and refuse v21 and
 later with `CLI-RENDER-004`. A construct newer than the CLI's bundled compiler reports that binder's PLAY0268 first.
 Requires Cratis CLI 3.63.0 for v17 and v19 and 3.65.0 for v18; older CLIs refuse those versions with `CLI-RENDER-004`.
 
@@ -32,15 +33,15 @@ Requires Stage 4.117.0 for warning/info-severity generated-concept rules; older
 renderers refuse them with STAGE-ESM-038. All severities are enforced at runtime.
 Requires Stage 4.118.0 for semantic checksum validation; older renderers refuse it with STAGE-ESM-042.
 Requires Stage 4.119.0 for pattern/random rendering, Host generation and independent executor fixture checks; older renderers refuse those strategies with STAGE-ESM-028.
-`generate rule` still refuses -028. Any Unproven/Refuted rule needs a pin (-038);
+Requires Stage 4.136.0 to render `generate rule`: the attached C# body becomes the concept's `IGeneratableInContext<T>.New(GenerationContext)` factory; a body that does not compile or warns refuses STAGE-ESM-019, type or namespace shadowing STAGE-ESM-022 and a missing attachment STAGE-ESM-020. The Host and the legacy syntax engine still refuse a command that generates a `generate rule` value with STAGE-ESM-028. Any Unproven/Refuted rule needs a pin (-038);
 opaque/unsupported rules refuse -005 before pin evaluation. Independent execution
 always needs pins.
 Requires Stage 4.124.0 for v24 text-rule admission (`cratis --version` identifies the CLI bundle); older renderers refuse v24 with STAGE-ESM-016.
-Requires Stage 4.127.0 for v25 version admission; older renderers refuse v25 with STAGE-ESM-016. The Cratis C# renderer still refuses protected reads with STAGE-ESM-044.
+Requires Stage 4.127.0 for v25 version admission; older renderers refuse v25 with STAGE-ESM-016. Requires Stage 4.138.0 for the Cratis renderer to render protected reads as Arc read protection (`[ReadProtection(On)]`, a nullable read-model `Handle` parameter per read with `[LookUpBy]`, the `<View> '<key>' does not exist.` rejection, requirements evaluated in `Handle` after the reads; generated specifications run in decision mode); `cratis render` gets it from the first CLI that bundles Stage 4.138.0, and earlier bundles (CLI 3.75.0 bundles 4.137.0) refuse every protected read with STAGE-ESM-044. Reads it cannot preserve faithfully stay STAGE-ESM-044 and name the reason: constrained events, read paths in `produces when`, mappings to optional, collection, composite or mistyped event properties, generated-value freshness scopes. See [protected reads](../../cratis-screenplay-command-surface/references/protected-reads.md).
 Requires Stage 4.129.0 for semantic Host/executor protected reads; older engines refuse STAGE-ESM-044. Required absence rejects before requirements or generation; read-backed requirements and produced-event mappings execute. Non-Error protected requirements refuse STAGE-ESM-045, including reaction invocations. See [sandbox boundaries](sandbox-and-specrunner.md#protected-command-reads) for ordering and the Host's stricter outside-append fault boundary.
 Described handlers refuse STAGE-IMPL-002, even Stub mode; atomic mode in an
 admitted pair refuses STAGE-ESM-043. Version admission never implements a body,
-batch or rendered protected decision. Chronological Date/DateTime command comparisons
+batch or composite-key rendering. Chronological Date/DateTime command comparisons
 select v26. The semantic Host and specification executor run them; the renderer,
 legacy engines and default sandbox engine refuse them with STAGE-ESM-046, naming the
 property, and emit no artifacts. Standalone reference success is not rendering. Keep
@@ -49,6 +50,8 @@ millisecond precision.
 
 Requires Stage 4.135.0 for v26 admission; older Stage refuses v26 with STAGE-ESM-016.
 
+Requires Stage 4.137.0 for v27 admission; older Stage refuses v27 with STAGE-ESM-016. The semantic Host runs read models with several key parts end to end (projections keyed by parts, removals, list queries on any part, queries by parts), and composite-keyed read models get no conventional `Get<ReadModel>ById` query. The specification executor refuses specifications over them as unsupported. The renderer and legacy syntax engine refuse a read model with several key parts or a projection keyed by parts with `STAGE-ESM-048`, and the renderer a single-instance query by parts with `STAGE-ESM-047` until Chronicle can look up composite keys (Chronicle#4265); nothing is published.
+
 Binding with the CLI's bundled compiler is a separate
 prerequisite. The exhaustive construct table is `references/renderable-subset.md` in
 `cratis-screenplay-toolchain`; run the real render before claiming anything is admitted.
@@ -152,17 +155,17 @@ Requires Stage 4.90.0 for snapshot/live lists, 4.96.0 for non-text secrets and 4
 | `STAGE-ESM-013` | An event-context value other than `$context.occurred` mapped in `produces` | Map a command property when that preserves the meaning; otherwise gap-fill |
 | `STAGE-ESM-014` | A constraint Chronicle cannot reproduce (kind, scope, message; multi-claim in one command; optional or composite targets) | A different constraint is a requirement change for the model owner; otherwise gap-fill |
 | `STAGE-ESM-015` | Authorization Stage cannot render exactly: a role-claim URI, an opaque policy nested inside a condition, an unresolved or non-portable policy, no single identifier, an opaque-policy subject that is not text, Uuid, Date or DateTime (a restriction on opaque-policy subjects, separate from declarative claim targets), an unsupported claim artifact. Role-only, authenticated, opaque pure policies, claim conditions with Uuid, Date, DateTime or text targets (numeric and Boolean claim matches render as always false) and `not`/and/or render; roles are read through the identity's `RoleClaimType` | Reshape the policy to a portable condition; otherwise gap-fill |
-| `STAGE-ESM-016` | Model language/semantic pair is not admitted by the installed Stage; exact v1–v21 and v23–v26 pairs are admitted, v22/v27/v28 and mixed pairs refused; older Stage also refuses the versions listed in the minimums above. A CLI bundle reports `CLI-RENDER-004` above its ceiling (v26 for CLI 3.74.0) first. v14 filters and v15 generation join v11 numbers, v12 enum numbers and v13 compliance as supported constructs, not blanket construct support | Not fixable by editing: the model needs a newer renderer. Keep the model, record the gap, gap-fill |
+| `STAGE-ESM-016` | Model language/semantic pair is not admitted by the installed Stage; exact v1–v21 and v23–v27 pairs are admitted, v22/v28 and mixed pairs refused; older Stage also refuses the versions listed in the minimums above. A CLI bundle reports `CLI-RENDER-004` above its ceiling (v27 for CLI 3.75.0) first. v14 filters and v15 generation join v11 numbers, v12 enum numbers and v13 compliance as supported constructs, not blanket construct support | Not fixable by editing: the model needs a newer renderer. Keep the model, record the gap, gap-fill |
 | `STAGE-ESM-017` | Read model or projection cannot render (property names that collide with Chronicle paths or expression syntax, mappings that overwrite the key or child identity, composite keys, unsupported `all` mappings, the refused scope shapes below) | Reshape the projection without changing what it records, or record the gap |
 | `STAGE-ESM-018` | `$strings.` key missing in the default locale or containing formatting characters | Fix the strings |
-| `STAGE-ESM-019` | Reducer structure or body not admitted (outside a `StateView`, impure, does not compile) | An equivalent pure body, or gap-fill |
-| `STAGE-ESM-020` | Implementation body missing, changed (hash differs) or refused by the loader | Provide the body inside the model root |
-| `STAGE-ESM-021`, `-022` | Reducer typed-context or analysis failure; a construct outside the pure allowlist, or a generated name shadowing a reducer type | An equivalent pure body, or gap-fill |
+| `STAGE-ESM-019` | Reducer structure or body not admitted (outside a `StateView`, impure, does not compile), or a `generate rule` body that does not compile or produces a compiler warning | An equivalent pure body, or gap-fill |
+| `STAGE-ESM-020` | Implementation body (including a `generate rule` attachment) missing, changed (hash differs) or refused by the loader | Provide the body inside the model root |
+| `STAGE-ESM-021`, `-022` | Reducer typed-context or analysis failure; a construct outside the pure allowlist, or a generated name shadowing a reducer type; also type or namespace shadowing in a `generate rule` body (`-022`) | An equivalent pure body, or gap-fill |
 | `STAGE-ESM-025` | Typed context references an earlier event revision or an earlier property identity; checked before `-026` | Reference the current revision; an earlier reference is not renderable, so gap-fill |
 | `STAGE-ESM-026` | A selected event, or an event a selected slice depends on (producing command, observing projection or reducer, specification, constraint target), is above its initial revision: `Event 'X' has evolved to revision N; Stage does not render event migrations yet.` The whole selection is refused, nothing is emitted | Not fixable by editing without dropping the evolution. Gap-fill the evolved events and hand-write the migrations (`cratis-chronicle-event-type-migration`). A scoped slice of initial events that depends on no evolved event still renders |
 | `STAGE-ESM-024` | Interval, schedule, application, startup and shutdown triggers, opaque reaction bodies, captures, Translate (including directed Translate), and clock/trigger/capture specifications. Event-triggered Automation slices render as Chronicle reactors, subject to `-013` and `-034` to `-040` below | Keep refused scope as gap-fill; do not confuse semantic Host settlement with live reactor delivery |
 | `STAGE-ESM-027` | A specification asserting a read model is absent (`then no readmodel`) is not rendered (the semantic specification engine executes keyed absence) | Keep the specification; verify absence another way and record the gap |
-| `STAGE-ESM-028`, `-029` | Generated values or responses Stage cannot render. Supported scalar UUID/String-concept strategies and Int random, v15 freshness, generation fixtures, scalar/named responses and `then returns` render; `generate rule`, unknown strategies and unsupported generated types report `-028` | Probe the supported form; preserve refused combinations as gap-fill |
+| `STAGE-ESM-028`, `-029` | Generated values or responses Stage cannot render. Supported scalar UUID/String-concept strategies and Int random, v15 freshness, generation fixtures, scalar/named responses and `then returns` render; unknown strategies, unsupported generated types, and (in the Host and legacy syntax engine) a command generating a `generate rule` value report `-028` | Probe the supported form; preserve refused combinations as gap-fill |
 | `STAGE-ESM-038` | Generated/response results combined with routes, generated-property rules, legacy allocation, non-scalar/non-command response sources or generated-name collisions | Keep the model; gap-fill that command |
 | `STAGE-ESM-039`, `-040` | Reaction conditions, destinations or mappings outside the faithful target subset; protected identity uses (including reaction destinations) and protected enum concepts | See the event-reaction boundary above; never declassify protected values |
 | `STAGE-ESM-030` | Named event-source or stream definition with a reserved stored name; unformattable routed fixtures or command replay routes. The default sandbox engine also reports it for every routed model | Rename the reserved name; render the model with `cratis render`, not `cratis run` |
@@ -174,7 +177,8 @@ Requires Stage 4.90.0 for snapshot/live lists, 4.96.0 for non-text secrets and 4
 | `STAGE-ESM-041` | Older renderers refuse non-text secrets; supported renderers keep their original types | Keep classification; upgrade the renderer, never declassify |
 | `STAGE-ESM-042` | Unknown validation rule kinds; checksum on the legacy syntax path (semantic checksum renders) | Keep the rule; use an admitting semantic renderer or gap-fill |
 | `STAGE-ESM-043` | `reaction batches atomic` in an admitted version pair | Keep the batch boundary; gap-fill without splitting it |
-| `STAGE-ESM-044` | Protected-read preamble, command reads or read-backed conditions/mappings in the Cratis C# renderer; legacy Host/structural runner also refuse the preamble | Keep protection; semantic Host/executor support is separate from generated-app enforcement |
+| `STAGE-ESM-044` | A protected read the Cratis renderer cannot preserve faithfully, naming the reason (every protected read before Stage 4.138.0); the legacy Host/structural runner refuse the preamble | Keep protection; gap-fill the refused command; semantic Host/executor support is separate from generated-app enforcement |
+| `STAGE-ESM-047`, `-048` | ESM v27 composite read-model keys: `-048` read model with several key parts or projection keyed by parts (also the legacy syntax engine); `-047` single-instance query by parts | Keep the model; gap-fill the composite-keyed scope |
 | `STAGE-ESM-046` | Date/DateTime comparison in `require`, `produces when` or a validation rule (including through concepts) in the renderer, legacy engines or default sandbox engine; names the property | Keep the date rule; the semantic Host/executor run it; deliver rendering through gap-fill that compares exact calendar dates and UTC ticks |
 | `STAGE-ESM-045` | Non-Error requirement on a protected command, including reaction-invoked commands; semantic admission refuses before reads, requirements or facts | Keep the severity contract; record the execution gap, never silently promote or drop the requirement |
 | `STAGE-IMPL-002` | Described command handler, naming command and RequirementId; also refused in Stub mode | Supply authorized implementation outside rendering; no generated stub is emitted |

package/package/corpus/skills/cratis-stage-rendering-and-sandbox/references/behavior-walk.md

@@ -12,9 +12,10 @@ V5 evidence.
   as the application it describes).
 - Docker, and the `cratis/stage` image at the tag `cratis run` would use (by default the
   Stage version the CLI renders with).
-- The **semantic engine**. `cratis run` has no `--engine` option and passes no environment
-  to the container, so it starts the default EventModel engine, which enforces only
-  simple literal validation rules, no authorization, and refuses routed models. Start the same image directly:
+- The **semantic engine**. `cratis run` runs it by default; an older CLI needs
+  `cratis run --engine semantic`, and one without `--engine` only starts the legacy EventModel engine, which enforces only
+  simple literal validation rules, no authorization, and refuses routed models; with such a CLI, start the same image directly.
+  Requires Cratis CLI 3.73.0 for the semantic default (`--engine` needs 3.64.0; check with `cratis --version`):
 
 ```bash
 docker run --rm -p 127.0.0.1:9090:9090 -p 127.0.0.1:35000:35000 \

package/package/corpus/skills/cratis-stage-rendering-and-sandbox/references/choosing-generation.md

@@ -38,7 +38,7 @@ Do not generate client-owned inputs, idempotency keys, gapless invoice numbers o
 secrets. Generation is not authorization, projection readiness or external-effect
 success. Patterns are not gapless/sequential allocators or secrets; check digits
 catch typos, not forgery. Short codes need uniqueness separate from whole-source
-freshness. `generate rule` remains unsupported by Stage (STAGE-ESM-028), and
+freshness. `generate rule` renders only from Stage 4.136.0 (STAGE-ESM-028 before it, and in the Host), and
 sequence is refused by Screenplay. Admitted command clock specs render. Stage
 emits explicit whole-source scopes when the model serializes a strategy; models
 with only implicit UUID stay Unguarded even at v20. This is not a general freshness