@cratis/pi 7.74.0 → 7.76.0

package/package/corpus/harnesses/copilot/instructions/vertical-slices.instructions.md

@@ -257,15 +257,17 @@ public record AuthorRegistered(AuthorName Name);
 
 ## Read Models and Queries
 
-**[contract]** `[ReadModel]` records expose queries as `public static` methods; dependencies are plain method parameters (no `[FromServices]`). For application code, start with model-bound mappings, use fluent when the definition needs structure, and choose reducer code when transitions read better as code. For step-by-step creation, invoke the **cratis-chronicle-read-model** skill.
+**[contract]** `[ReadModel]` records expose eligible public and internal static methods as queries; internal visibility does not hide an endpoint. Dependencies are plain method parameters (no `[FromServices]`). For application code, start with model-bound mappings, use fluent when the definition needs structure, and choose reducer code when transitions read better as code. For step-by-step creation, invoke the **cratis-chronicle-read-model** skill.
 
 Use `[ReadModel(RequireQueryAttribute = true)]` with `[Query]` on intended
-endpoints when public folds/helpers exist (ARC0026/ARCCHR0019). `[Query]` alone
-does not hide siblings; private/compiler-generated statics are never queries.
+endpoints when folds exist (ARC0026/ARCCHR0019). `[Query]` alone does not hide
+siblings. Keep helpers outside the read model regardless of visibility.
+Requires Arc 22.27.1 for private/protected/compiler-generated methods to be
+excluded; older versions can expose private statics too. Check `dotnet list package`.
 A `CancellationToken` is supplied by Arc; concept arguments come from the caller,
 not DI. Bad GET/QUERY argument conversions return 400. Single-instance MongoDB/EF
 observations emit `default` on absence/deletion/filter exit: guard `hasData` and
-`isReady` in React. Verified at Arc v22.75.0; see the read-model query reference.
+`isReady` in React; see the read-model query reference.
 
 ### Query return shapes **[contract]**
 

package/package/corpus/harnesses/pi/extensions/cratis-hooks/index.ts

@@ -332,7 +332,10 @@ export default function (pi: ExtensionAPI) {
 		label: "Cratis quality gate",
 		description:
 			"Run the Cratis quality gate (.cratis/ai/hooks/scripts/cratis-quality-gate.sh): the build, spec and lint gates the current " +
-			"working-tree changes touch, configured in quality-gates.json. Runs in the foreground with a deadline and can be cancelled. " +
+			"working-tree changes touch. Shipped defaults: .cratis/ai/hooks/scripts/quality-gates.json; project overrides: " +
+			".cratis/ai/quality-gates.project.json, shallow-merged by gate id (command without requires drops inherited packageScripts). " +
+			"CRATIS_HOOKS_GATES replaces the defaults; project overrides still merge over it. " +
+			"Runs in the foreground with a whole-tool deadline and optional per-gate timeoutSeconds; can be cancelled. " +
 			"A failure, a timeout or a cancellation is returned as an error and means the change is NOT verified. " +
 			"Run it explicitly at a verification checkpoint, not after every prompt. It selects gates for all current " +
 			"working-tree changes, not the complete CI matrix; run CI-equivalent gates before claiming completion or pushing/opening a PR. " +
@@ -378,7 +381,7 @@ export default function (pi: ExtensionAPI) {
 				const last = latestGateLog(gateLogDirectory(sessionId), started);
 				const tail = last ? tailLines(last.file, TAIL_LINES) : "";
 				throw new Error(`The Cratis quality gate TIMED OUT after ${duration(timeoutSeconds * 1000)}${last ? ` while running '${last.gate}'${last.cwd ? ` (cwd: ${last.cwd})` : ""}` : ""}. This is not a pass: nothing was verified.` +
-					(last ? `\n\nGate log: ${last.file}` : "") +
+					(last ? `\nRun a narrower command instead: ${last.gate === "backend-specs" ? "dotnet test <affected.Specs.csproj-or-Tests.csproj> --configuration Debug --no-build (replace the placeholder; repeat for affected dependents)." : "run the affected project alone using this gate's configured command."}\nConfigure it in .cratis/ai/quality-gates.project.json.\n\nGate log: ${last.file}` : "") +
 					(tail ? `\n\n--- last ${TAIL_LINES} lines ---\n${tail}\n--- end ---` : ""));
 			};
 			const reportInterrupted = () => {

package/package/corpus/hooks/README.md

@@ -277,6 +277,9 @@ their explicit consent. Slice-only scope checks do not replace the repository's
 
 ### Project-specific gate configuration
 
+Shipped defaults live in `.cratis/ai/hooks/scripts/quality-gates.json`, not `.cratis/ai/quality-gates.json`.
+Project overrides live in `.cratis/ai/quality-gates.project.json`. `CRATIS_HOOKS_GATES=<path>` replaces
+the defaults file; the project overrides still merge over that replacement by gate id.
 The shipped gates discover the repository's own solution and package, so most repositories need no
 configuration at all. An eligible root workspace or solution keeps repository-wide dispatch. Without
 one, discovery uses only each gate's matching, non-excluded changes and runs it once per affected
@@ -547,9 +550,30 @@ inapplicable gate remains a no-op. Pi preserves the script's diagnostics when pl
 The same shipped file therefore activates in application and framework repositories, and reports
 an empty plan without running gates in a repository that has no project at all.
 
-**Overriding it, in order of increasing force.** Set `workingDirectory` on a gate to pin one of
-several candidate projects; drop a `quality-gates.json` of your own in place of the shipped one; or
-point `CRATIS_HOOKS_GATES` at a file anywhere. None of them requires forking the script.
+**Overriding it.** Set `workingDirectory` on a gate in `.cratis/ai/quality-gates.project.json` to pin
+one of several candidate projects. For a replacement defaults file, point `CRATIS_HOOKS_GATES` at a
+file anywhere instead of editing the managed file. Neither requires forking the script.
+A missing defaults file reports both real configuration paths and runs no gates.
+
+**Per-gate deadlines.** `timeoutSeconds` is an optional integer from 1 to 86400, applied separately
+to each command/directory. Unset means no per-gate deadline; Pi's whole-tool deadline still applies
+and may expire first. The shipped `backend-specs` gate allows 120 seconds so a long solution-wide
+spec run stops with a named diagnostic rather than consuming the entire tool budget. On timeout,
+the script stops the command's process group (TERM, then KILL after one second), exits **2**, and
+reports **NOT VERIFIED**, the gate, its directory, log tail, and `timeoutHint` (advice, never executed).
+Commands that create separate sessions/process groups can escape this cleanup; this is not a sandbox.
+
+For a large solution, replace the placeholder below with the affected test project and repeat for
+its affected dependents. Override `command` with that narrower argv array (or a repository-owned
+runner covering all affected projects), rather than raising the timeout without diagnosing the delay:
+
+```json
+{ "gates": [{ "id": "backend-specs", "command": ["dotnet", "test", "<affected.Specs.csproj>", "--configuration", "Debug", "--no-build"], "timeoutSeconds": 120, "timeoutHint": "Run dotnet test for each affected Specs/Tests project separately." }] }
+```
+
+This is not automatic affected-project selection: imported/conditional MSBuild references and
+linked or shared sources require evaluation to establish coverage safely. The default retains
+solution-wide tests rather than silently missing dependents, and a timeout is never a pass.
 
 **Profile note.** The C# patterns are application-profile and scoped to `Source/**/*.cs`, which is
 the application source root [`../rules/general.md`](../rules/general.md) documents. A

package/package/corpus/hooks/scripts/cratis-quality-gate.sh

@@ -35,7 +35,10 @@ here="$(cd -P "$(dirname "${BASH_SOURCE[0]}")" && pwd -P)"
 config="${CRATIS_HOOKS_GATES:-$here/quality-gates.json}"
 dryrun="${CRATIS_HOOKS_GATE_DRYRUN:-0}"
 
-[ -f "$config" ] || exit 0
+[ -f "$config" ] || {
+    printf 'cratis-quality-gate: configuration not found: %s — no gates ran. Shipped defaults: .cratis/ai/hooks/scripts/quality-gates.json; project overrides: .cratis/ai/quality-gates.project.json (merged by gate id). CRATIS_HOOKS_GATES replaces the defaults.\n' "$config" >&2
+    exit 0
+}
 jq -e . "$config" >/dev/null 2>&1 || {
     printf 'cratis-quality-gate: %s is not valid JSON — gate skipped.\n' "$config" >&2
     exit 0
@@ -265,7 +268,8 @@ discover_workdirs() {
 
 gate_count="$(jq -r '.gates | length' "$config")"
 [ "${gate_count:-0}" -gt 0 ] || exit 0
-fail_fast="$(jq -r '.failFast // true' "$config")"
+# jq's // treats false as absent; failFast=false must keep running after a failed gate.
+fail_fast="$(jq -r '.failFast | if . == null then true else . end' "$config")"
 max_lines="$(jq -r '.maxOutputLines // 60' "$config")"
 
 tmp_root="$(hook_state_dir "$(hook_json "$input" '.session_id')")" || tmp_root="${TMPDIR:-/tmp}"
@@ -335,6 +339,46 @@ EOF
     return 0
 }
 
+# Bash job control gives the command and watchdog separate process groups without GNU timeout
+# or a language runtime. Keep the supervisor in the caller's group so Pi cancellation reaches
+# its trap too. Wait for escalation even if the command leader exits on TERM: its test hosts
+# may still be running. Only configured gates use this wrapper; other gates remain unchanged.
+run_timed_gate() (
+    set -m
+    local worker timer rc=0 marker="$log.timeout"
+    rm -f "$marker"
+    stop_group() {
+        kill -TERM -- "-$1" 2>/dev/null || return 0
+        sleep 1
+        kill -KILL -- "-$1" 2>/dev/null || true
+    }
+    cleanup() {
+        trap '' TERM INT
+        kill -TERM -- "-$timer" 2>/dev/null || true
+        stop_group "$worker"
+        wait "$timer" 2>/dev/null || true
+        wait "$worker" 2>/dev/null || true
+    }
+    (cd -P "$root/$wd" && exec "${cmd[@]}") </dev/null &
+    worker=$!
+    (
+        sleep "$gate_timeout"
+        printf 'timed out\n' >"$marker"
+        stop_group "$worker"
+    ) &
+    timer=$!
+    trap 'cleanup; exit 2' TERM INT
+    wait "$worker" || rc=$?
+    if [ -f "$marker" ]; then
+        wait "$timer" || true
+        rc=124
+    else
+        cleanup
+    fi
+    trap - TERM INT
+    exit "$rc"
+)
+
 idx=0
 ran=0
 planned_gates=0
@@ -383,6 +427,15 @@ while [ "$idx" -lt "$gate_count" ]; do
 $(jq -r --argjson i "$idx" '.gates[$i].command // [] | .[]' "$config")
 EOF
 
+    gate_timeout="$(jq -r --argjson i "$idx" 'if .gates[$i].timeoutSeconds == null then "" else .gates[$i].timeoutSeconds end' "$config")"
+    timeout_hint="$(jq -r --argjson i "$idx" '.gates[$i].timeoutHint // empty' "$config")"
+    if ! jq -e --argjson i "$idx" '
+        .gates[$i].timeoutSeconds | . == null or (type == "number" and . >= 1 and . <= 86400 and floor == .)
+    ' "$config" >/dev/null; then
+        printf 'cratis-quality-gate: UNVERIFIED %s — timeoutSeconds must be an integer from 1 to 86400.\n' "$id" >&2
+        exit 2
+    fi
+
     project_index=0
     gate_ran=0
     gate_noops=0
@@ -424,13 +477,23 @@ EOF
         rc=0
         {
             printf 'cratis-quality-gate: LOG %s (cwd: %s)\n' "$id" "$wd"
-            (cd -P "$root/$wd" && "${cmd[@]}") </dev/null
+            if [ -n "$gate_timeout" ]; then
+                run_timed_gate
+            else
+                (cd -P "$root/$wd" && "${cmd[@]}") </dev/null
+            fi
         } >"$log" 2>&1 || rc=$?
         ran=$((ran + 1))
 
         if [ "$rc" -ne 0 ]; then
             {
-                printf 'QUALITY GATE FAILED: %s (exit %s)\n' "$id" "$rc"
+                if [ -n "$gate_timeout" ] && [ -f "$log.timeout" ]; then
+                    printf 'QUALITY GATE TIMED OUT: %s after %ss (cwd: %s) — NOT VERIFIED.\n' "$id" "$gate_timeout" "$wd"
+                    printf 'Run a narrower command instead: %s\n' "${timeout_hint:-run the affected project with the command below, not the whole workspace/solution.}"
+                    printf 'Configure command/workingDirectory/timeoutSeconds in .cratis/ai/quality-gates.project.json.\n'
+                else
+                    printf 'QUALITY GATE FAILED: %s (exit %s)\n' "$id" "$rc"
+                fi
                 printf '  %s\n' "$desc"
                 printf '  $ %s   (cwd: %s)\n\n' "${cmd[*]}" "$wd"
                 printf -- '--- last %s lines ---\n' "$max_lines"

package/package/corpus/hooks/scripts/quality-gates.json

@@ -1,7 +1,8 @@
 {
   "$comment": [
     "Quality gates run by the Stop hook (cratis-quality-gate.sh).",
-    "Data, not code: a consuming repository overrides this file (or points CRATIS_HOOKS_GATES at",
+    "Shipped defaults: .cratis/ai/hooks/scripts/quality-gates.json; project overrides: .cratis/ai/quality-gates.project.json.",
+    "Data, not code: a consuming repository patches gates by id (or points CRATIS_HOOKS_GATES at",
     "its own) without touching the script. Gates run in order and stop at the first failure.",
     "",
     "A gate runs only when the working tree contains a change matching one of its \"changed\" globs,",
@@ -41,6 +42,9 @@
     "                   Mixed RUN/NO-OP directories report UNVERIFIED and exit 2, not a partial success.",
     "                   Gate commands read /dev/null so they cannot consume remaining directories.",
     "  command          argv array \u2014 executed directly, never through a shell (no eval)",
+    "  timeoutSeconds   optional integer 1..86400; deadline per command/directory, plus 1s TERM-to-KILL cleanup",
+    "                   (Pi's whole-tool deadline still applies); timeout exits 2, never a pass",
+    "  timeoutHint      narrower command to run when the gate times out; diagnostic text, never executed",
     "",
     "Managed corpus and adapter trees (.cratis/**, .pi/**, .claude/**) never count as a relevant change:",
     "a corpus update must not run a repository's application gates over files that are not its application.",
@@ -114,6 +118,8 @@
     {
       "id": "backend-specs",
       "description": "dotnet test (Debug, --no-build) \u2014 zero failures",
+      "timeoutSeconds": 120,
+      "timeoutHint": "dotnet test <affected.Specs.csproj-or-Tests.csproj> --configuration Debug --no-build (replace the placeholder with the affected test project; repeat for its affected dependents)",
       "changed": [
         "**/*.cs",
         "**/*.csproj",

package/package/corpus/product-sync.json

@@ -27,9 +27,9 @@
       "repository": "Cratis/Stage",
       "packages": [],
       "synced": {
-        "version": "4.138.0",
+        "version": "4.146.0",
         "date": "2026-10-17",
-        "by": "Cratis/AI#752"
+        "by": "Cratis/AI#773"
       },
       "covers": {
         "skills": [
@@ -46,7 +46,7 @@
         ],
         "rules": []
       },
-      "notes": "Source-checked Stage v4.103.0: exact ESM v1-v17 and v19, not v18 or v20 (v18 admitted from 4.106.0 and v20 from 4.109.0, taught with Requires lines; 4.104-4.108 not otherwise reviewed). Snapshot/live collection queries, identity-mapping all projections, stored event names, event-id publication checks, release-baseline warnings, command clock/receipt-time generation, conditional and multi-command slices, generated text constraints, no-event and bounded redelivery specs, refusal branches. Query concept validation still uses primitive workaround; Stage#370 released in 4.106.0. CLI v3.62.0 bundles Stage 4.99.0, not 4.103.0. Generated-values-only delta checked at v4.127.0: v21/all-Proven unpinned specs from 4.115.0, warning/info generated rules 4.117.0, checksum validation 4.118.0, pattern/random factories/Host/executor 4.119.0; generate rule still STAGE-ESM-028. Language admission reconciled at the same v4.127.0 tag: exact v1-v21 and v23-v25 pairs; v22/v26 and mixed pairs -016, protected reads -044, atomic mode -043, described bodies STAGE-IMPL-002 even Stub mode; v24 first admitted 4.124.0 (absent 4.123.0). Reviewed v4.128.0-v4.130.0 deltas for Cratis/AI#739: v4.128.0 new-application self-reducing Cratis C# profile (CreateNewApplicationProfile, ReducerConventionInput.Read, WithReducerConvention; existing callers classic); shared SemanticValidationRules.Check confirmed (already present in v4.127.1, so no new 4.128.0 minimum claimed); v4.129.0 semantic Host/executor protected reads, presence before requirements/generation, read-backed requirements/mappings, non-Error requirements STAGE-ESM-045 including reaction invocations, Host fault on any outside append (stricter than reference scoped conflict). Renderer/legacy Host/structural runner retain STAGE-ESM-044. v4.130.0 root-template shell, options/appearance and fail-closed startup/planning findings reviewed in stage-rendering.md, RootShell.cs and stageShell.ts. Exact pairs remain v1-v21 and v23-v25; v26 refused STAGE-ESM-016 and Stage#473 still open. Earlier unreviewed deltas remain as noted above, so synced stays at the last fully reviewed release. No new render/browser/Docker probe."
+      "notes": "Cratis/AI#773: release/tag delta v4.139.0-v4.146.0 (including v4.141.1). Exact ESM v1-v27 pairs admitted; v22 from 4.139.0, atomic mode still -043. Date comparisons render from 4.141.0 with remaining -046 shapes and named-policy binding differences. 4.141.1 supplies authored occurrence in independent event-reaction specs, not clock triggers or generated append/redelivery clock fixtures. 4.142.0 Host decide/commit absorbs unrelated outside facts, with dependency conflicts, guarded batch retries only without invocations and fail-closed unknown writes. 4.143.0 shared STAGE-PROFILE-001 through -006 findings; 4.144.0 scaffold pins follow Stage package inputs. 4.145.0 reached reducer/validation bodies use STAGE-IMPL-003 without refusing unrelated behavior; described handlers retain -002. 4.146.0 collects independent render refusals, preserving profile/version early exits. Scene template verification changes classified as internal; no new render/browser/Docker probe. Prior focused checks remain; v4.104-v4.108 were not otherwise fully reviewed."
     },
     {
       "id": "arc",
@@ -63,9 +63,9 @@
         }
       ],
       "synced": {
-        "version": "22.100.0",
-        "date": "2026-10-15",
-        "by": "Cratis/AI#710"
+        "version": "22.117.0",
+        "date": "2026-10-17",
+        "by": "Cratis/AI#773"
       },
       "covers": {
         "skills": [
@@ -99,7 +99,7 @@
           "vertical-slices.md"
         ]
       },
-      "notes": "Whole-product floor unchanged at 22.100.0. Focused read-protection coverage, Arc 22.106.0-22.108.0: ReadProtectionMode Off, Measure and On (MSBuild property, assembly and command attributes, runtime MaximumMode cap), read-model parameters of Handle and validator constructors guarded under On, [LookUpBy], [Unprotected(\"why\")], per-stream read models on routed commands, Measure report, ReadChanged and ReadIncomplete refusals, and CommandScenario selecting decision mode automatically. the caller severity threshold (X-Allowed-Severity, [BlockOnValidationSeverity]) and the Error floor for commands declared On (22.108.0). [ProtectedDecision] and DecisionRead<T> retained as the per-command opt-in. The other 22.101.0-22.108.0 changes were not reviewed. Prior notes: scoped completion and routing validation, generated-target freshness, observable scenarios, asynchronous execution scopes, read-model diagnostics, ordered reactor refusal handling and ICommandExceptionMapper. Generated-values-only delta checked at v22.107.1: 22.104.0 enforces every concept-rule severity and carries Fundamentals 7.25.0; 22.107.0 recovers pattern/random/checksum and self-contained String generation rules, with v21 caps and fixture validation. No new runtime probe."
+      "notes": "Reviewed releases 22.100.1-22.117.0 at tags: occurrence command receipts and retry classification, tenant/purpose storage resolution, explicit-offset binding and authorization of malformed bodies, camelCase validation members, conflict event details, hub fallback authorization and snapshot guards, and React query-key isolation/resubscription. Existing read-protection and generated-value guidance retained. Query discovery includes internal statics; public-only discovery in Arc#3368 is unreleased. Screenplay-generator deltas classified for the owning lane, not changed here. No new runtime probe."
     },
     {
       "id": "ai",
@@ -171,9 +171,9 @@
         }
       ],
       "synced": {
-        "version": "4.211.1",
+        "version": "4.212.4",
         "date": "2026-10-17",
-        "by": "Cratis/AI#762"
+        "by": "Cratis/AI#772"
       },
       "covers": {
         "skills": [
@@ -201,7 +201,7 @@
         ],
         "rules": []
       },
-      "notes": "Cratis/AI#762 and #761: source-checked v4.210.0 and v4.211.0 contracts for PLAY0800 CommandHandlerRequiresAttachment (required typed subject, permanent code-attachment requirement, other PLAY0268 families unchanged), independent reference remove/add batches, located same-text ambiguity conflicts and string MCP conflict/move-report document fields. v4.211.1 mapping changes inspected but excluded from this guidance update at the user's request; no typed PLAY0273 property/type arguments are claimed. Standalone Screenplay 4.211.1 and its compiler contract pinned; the contract is a byte-identical copy of the v4.211.1 release asset. No new render/runtime probe. Prior: Standalone 4.205.0 and byte-identical compiler contract pinned. Cratis/AI#746: Uuid ==/!= in command require and produces when (ESM v28): same-concept rule, bare Uuid against a concept, canonical literals, protected read paths in require only; PLAY0268 (different concepts, ordering, Uuid validation and concept rules, read paths in produces when) and PLAY0273 (non-canonical literal) checked against the 4.205.0 compiler, v28 selection read from the MCP executable-model view; Stage admits exact v1-v21 and v23-v26 pairs so v28 is refused STAGE-ESM-016, not probed against a Stage image; CLI 3.74.0 renders through v26. Prior: Standalone 4.204.0 and byte-identical compiler contract pinned. Cratis/AI#702 and #691: PLAY0690 reducer identity (Screenplay 4.170.0, native compiler only) and the screenplay.json validation gate (Screenplay 4.165.0; cratis screenplay validate reads it from CLI 3.65.0) are taught and probed against the 4.204.0 compiler. Cratis/AI#743: flat composite read-model keys (ESM v27): untyped projection key blocks on root from and remove with, equality-filter lists, single-instance by blocks and per-part fixtures, with PLAY0661/PLAY0662/PLAY0268 refusals checked against the 4.204.0 compiler; Stage origin/main still refuses v27 with STAGE-ESM-016 (stage-rendering.md); Stage v4.135.0 v26 admission (Host and executor run date comparisons; renderer STAGE-ESM-046) was source-checked for this sync; no render or runtime probe. Prior: Standalone 4.201.0 and byte-identical compiler contract pinned. Cratis/AI#733: the ui profile root template, shell options, appearance and new screens default (PLAY0788-PLAY0799, quick fix for the legacy layout line, ui-profiles MCP tool, 44 tools). Cratis/AI#735: chronological Date/DateTime ordering in command conditions and command/property literal validation (ESM v26), UTC tick precision and pre-rule offset validation; then matching remains ordinal. Source-checked Screenplay v4.199.0 commands, diagnostics, interoperability and specifications documentation plus decision 0087. Stage v4.127.1 still refuses v26 with STAGE-ESM-016 (stage-rendering.md and SemanticVersionFeatures.Supports); no render/runtime probe. Cratis/AI#576: prior mechanical compiler catch-up. Language batch #717/#722/#723/#724/#720/#728/#734 teaches atomic reaction batches (v22), described payload handlers (v23), portable linear matching, ordinal text rules (v24), protected command reads (v25), diagnostic arguments and event-source invokes mappings. Facts read at Screenplay v4.198.0 and introducing tags; Stage v4.127.0 admits exact v1-v21 and v23-v25 pairs but refuses v22/v26 and mixed pairs (STAGE-ESM-016), protected reads (044), atomic mode (043) and described handlers (STAGE-IMPL-002), even Stub mode. Stage text rules execute/render; no new renderer/runtime probe or Stage pin uplift. Cratis/AI#706: application navigation regions (module inherit, extend or override), toolbar slice buttons, blueprint template references and sample data packs in cratis-screenplay-ui-composition (references/application-shell.md), with the canonical shell vector and the rejection codes PLAY0710-PLAY0722 and PLAY0740-PLAY0765. Examples moved to the executable-state rules since 4.164: translator reactions in an Automation slice beside the Translate slice (PLAY0694) and the first record of a capture key appended with `when added`. Earlier: Standalone 4.164.0 and byte-identical compiler contract pinned. Cratis/AI#663: one origin per capture (PLAY0687). #668: executable no-event/redelivery v17. #684: concept query-argument validation in every version and query-error assertions v18. #681: executable refusal branches and refusal values v19. #666: proposal summary/severity counts and exact structural source proposals. Generated-concept rules select v20 with PLAY0688/0689 proofs and derived-matches repair; generated secrets and preview strategies remain refused. Release-baseline from-esm admission reads storedName. Standalone binding is not renderer admission: Stage 4.103.0 admits v1-v17 and v19; CLI 3.62.0 bundles Screenplay 4.159.0 / Stage 4.99.0 and renders through v16. Prior evidence remains unless superseded; no new renderer, Docker or browser probe."
+      "notes": "Cratis/AI#772: standalone Screenplay 4.212.4 pinned; regenerated compiler contract is byte-identical to the v4.212.4 release asset. Source-checked joined-event automap/no automap overrides and level fallback in executable binding; PLAY0380 covers only all inside children/nested. No new render/runtime probe. Prior: Cratis/AI#769: standalone Screenplay 4.212.3 pinned; regenerated compiler contract is byte-identical to the v4.212.3 release asset. Source-checked both compilers and projection documentation for PLAY0801 DuplicateEventInProjectionScope: shared from/removal/clear set, separate join set, fresh sets per children/nested/variant level, and no two-row update through repeated from blocks with different keys. No new render/runtime probe. Prior: Cratis/AI#768: standalone Screenplay 4.212.2 pinned; regenerated compiler contract is byte-identical to the v4.212.2 release asset (unchanged from the previous contract). Source-checked v4.212.0 split-model dotted note targets, open-workspace applicationIdentity and complete add/reanchor substitutions; unbound container identities are not claimed. v4.212.1 aligns PLAY0535 collection fields, optional parameters and single-result identity inference. v4.212.2 counts read-only query denials for SPEC004, not SPEC006. No new render/runtime probe. Prior: Cratis/AI#762 and #761: source-checked v4.210.0 and v4.211.0 contracts for PLAY0800 CommandHandlerRequiresAttachment (required typed subject, permanent code-attachment requirement, other PLAY0268 families unchanged), independent reference remove/add batches, located same-text ambiguity conflicts and string MCP conflict/move-report document fields. v4.211.1 mapping changes inspected but excluded from this guidance update at the user's request; no typed PLAY0273 property/type arguments are claimed. Standalone Screenplay 4.211.1 and its compiler contract pinned; the contract is a byte-identical copy of the v4.211.1 release asset. No new render/runtime probe. Prior: Standalone 4.205.0 and byte-identical compiler contract pinned. Cratis/AI#746: Uuid ==/!= in command require and produces when (ESM v28): same-concept rule, bare Uuid against a concept, canonical literals, protected read paths in require only; PLAY0268 (different concepts, ordering, Uuid validation and concept rules, read paths in produces when) and PLAY0273 (non-canonical literal) checked against the 4.205.0 compiler, v28 selection read from the MCP executable-model view; Stage admits exact v1-v21 and v23-v26 pairs so v28 is refused STAGE-ESM-016, not probed against a Stage image; CLI 3.74.0 renders through v26. Prior: Standalone 4.204.0 and byte-identical compiler contract pinned. Cratis/AI#702 and #691: PLAY0690 reducer identity (Screenplay 4.170.0, native compiler only) and the screenplay.json validation gate (Screenplay 4.165.0; cratis screenplay validate reads it from CLI 3.65.0) are taught and probed against the 4.204.0 compiler. Cratis/AI#743: flat composite read-model keys (ESM v27): untyped projection key blocks on root from and remove with, equality-filter lists, single-instance by blocks and per-part fixtures, with PLAY0661/PLAY0662/PLAY0268 refusals checked against the 4.204.0 compiler; Stage origin/main still refuses v27 with STAGE-ESM-016 (stage-rendering.md); Stage v4.135.0 v26 admission (Host and executor run date comparisons; renderer STAGE-ESM-046) was source-checked for this sync; no render or runtime probe. Prior: Standalone 4.201.0 and byte-identical compiler contract pinned. Cratis/AI#733: the ui profile root template, shell options, appearance and new screens default (PLAY0788-PLAY0799, quick fix for the legacy layout line, ui-profiles MCP tool, 44 tools). Cratis/AI#735: chronological Date/DateTime ordering in command conditions and command/property literal validation (ESM v26), UTC tick precision and pre-rule offset validation; then matching remains ordinal. Source-checked Screenplay v4.199.0 commands, diagnostics, interoperability and specifications documentation plus decision 0087. Stage v4.127.1 still refuses v26 with STAGE-ESM-016 (stage-rendering.md and SemanticVersionFeatures.Supports); no render/runtime probe. Cratis/AI#576: prior mechanical compiler catch-up. Language batch #717/#722/#723/#724/#720/#728/#734 teaches atomic reaction batches (v22), described payload handlers (v23), portable linear matching, ordinal text rules (v24), protected command reads (v25), diagnostic arguments and event-source invokes mappings. Facts read at Screenplay v4.198.0 and introducing tags; Stage v4.127.0 admits exact v1-v21 and v23-v25 pairs but refuses v22/v26 and mixed pairs (STAGE-ESM-016), protected reads (044), atomic mode (043) and described handlers (STAGE-IMPL-002), even Stub mode. Stage text rules execute/render; no new renderer/runtime probe or Stage pin uplift. Cratis/AI#706: application navigation regions (module inherit, extend or override), toolbar slice buttons, blueprint template references and sample data packs in cratis-screenplay-ui-composition (references/application-shell.md), with the canonical shell vector and the rejection codes PLAY0710-PLAY0722 and PLAY0740-PLAY0765. Examples moved to the executable-state rules since 4.164: translator reactions in an Automation slice beside the Translate slice (PLAY0694) and the first record of a capture key appended with `when added`. Earlier: Standalone 4.164.0 and byte-identical compiler contract pinned. Cratis/AI#663: one origin per capture (PLAY0687). #668: executable no-event/redelivery v17. #684: concept query-argument validation in every version and query-error assertions v18. #681: executable refusal branches and refusal values v19. #666: proposal summary/severity counts and exact structural source proposals. Generated-concept rules select v20 with PLAY0688/0689 proofs and derived-matches repair; generated secrets and preview strategies remain refused. Release-baseline from-esm admission reads storedName. Standalone binding is not renderer admission: Stage 4.103.0 admits v1-v17 and v19; CLI 3.62.0 bundles Screenplay 4.159.0 / Stage 4.99.0 and renders through v16. Prior evidence remains unless superseded; no new renderer, Docker or browser probe."
     },
     {
       "id": "scene",
@@ -284,9 +284,9 @@
         }
       ],
       "synced": {
-        "version": "19.65.0",
-        "date": "2026-10-14",
-        "by": "Cratis/AI#695"
+        "version": "19.81.1",
+        "date": "2026-10-17",
+        "by": "Cratis/AI#773"
       },
       "covers": {
         "skills": [
@@ -323,7 +323,7 @@
         ],
         "rules": []
       },
-      "notes": "Whole-product floor unchanged at 19.65.0. Focused read-protection coverage, Chronicle 19.68.0-19.71.x: admitted reducers (unfiltered, no constructor dependencies, 19.68.0), per-stream read models with [EventStream<TSource>], IUnitOfWork.EnforceReadProtection, AllowReads and GetAppendConditions, CHR0062-CHR0064. The other 19.66.0-19.71.x changes were not reviewed. Prior notes: explicit artifacts, collection observation, redelivery scenarios, webhook generation pins, enrollment contributors, seed ownership, reconnect readiness and hosting/storage fixes. No new kernel/transport probe."
+      "notes": "Reviewed releases 19.65.1-19.81.1 at tags: subscription generation pins, StartAtTail, namespace removal/reconnect, storage connection resolution (deploy 19.74.2+), definition refusal recovery, conflict event fields, .NET occurrences/lifecycle/receipts and testing identities, full-history per-key reads, child all-event mapping repair, projection SoftwareVersion, bounded job acceptance/recovery, immediate-append refusal ownership and namespace subscription reconciliation. Existing protected-read guidance retained. Chronicle#5028 definition round-trip/restart-replay fix is unreleased and not taught as fixed. No new kernel/transport probe."
     },
     {
       "id": "arc-go",

package/package/corpus/rules/general.md

@@ -95,6 +95,7 @@ A claim is only as good as the signal behind it — a build result, a test run,
 
 - **Confirm "done"/"fixed"/"correct" against a fresh signal — never self-assessment.** Run the relevant gate and observe it pass *this time*.
 - **Check at the right frequency.** Run affected-project checks while iterating; a prompt ending is not task completion. Before claiming a task complete or pushing/opening a PR, run the full CI-equivalent gates required for that repository (including its Tier 1/2 policy where applicable). A change-selected hook gate is not a substitute for the repository's full CI matrix. After a fix, re-run the gate that failed. Don't argue yourself to green.
+- **Gate configuration:** shipped defaults `.cratis/ai/hooks/scripts/quality-gates.json`; project overrides `.cratis/ai/quality-gates.project.json` shallow-merge by gate id (command without requires drops inherited packageScripts). `CRATIS_HOOKS_GATES` replaces defaults; project overrides still apply.
 - **A green build is not behavioral correctness.** Compilation proves it builds, not that the slice does the right thing — that's what specs and exercising the UI are for.
 - **Report the conclusion and what you didn't verify, in a line or two.** Show the output when asked, when a claim is contested, or when the check failed — see [verification-discipline.md](./verification-discipline.md).
 

package/package/corpus/rules/vertical-slices.md

@@ -256,15 +256,17 @@ public record AuthorRegistered(AuthorName Name);
 
 ## Read Models and Queries
 
-**[contract]** `[ReadModel]` records expose queries as `public static` methods; dependencies are plain method parameters (no `[FromServices]`). For application code, start with model-bound mappings, use fluent when the definition needs structure, and choose reducer code when transitions read better as code. For step-by-step creation, invoke the **cratis-chronicle-read-model** skill.
+**[contract]** `[ReadModel]` records expose eligible public and internal static methods as queries; internal visibility does not hide an endpoint. Dependencies are plain method parameters (no `[FromServices]`). For application code, start with model-bound mappings, use fluent when the definition needs structure, and choose reducer code when transitions read better as code. For step-by-step creation, invoke the **cratis-chronicle-read-model** skill.
 
 Use `[ReadModel(RequireQueryAttribute = true)]` with `[Query]` on intended
-endpoints when public folds/helpers exist (ARC0026/ARCCHR0019). `[Query]` alone
-does not hide siblings; private/compiler-generated statics are never queries.
+endpoints when folds exist (ARC0026/ARCCHR0019). `[Query]` alone does not hide
+siblings. Keep helpers outside the read model regardless of visibility.
+Requires Arc 22.27.1 for private/protected/compiler-generated methods to be
+excluded; older versions can expose private statics too. Check `dotnet list package`.
 A `CancellationToken` is supplied by Arc; concept arguments come from the caller,
 not DI. Bad GET/QUERY argument conversions return 400. Single-instance MongoDB/EF
 observations emit `default` on absence/deletion/filter exit: guard `hasData` and
-`isReady` in React. Verified at Arc v22.75.0; see the read-model query reference.
+`isReady` in React; see the read-model query reference.
 
 ### Query return shapes **[contract]**
 

package/package/corpus/skills/cratis-arc-authentication-authorization-and-identity/references/authorization.md

@@ -217,6 +217,15 @@ MVC actions). Configure both: the evaluator for the Arc pipeline, `FallbackPolic
 for MVC. Neither protects an endpoint that is mapped explicitly anonymous (see the
 discovery endpoints in the skill).
 
+Requires Arc 22.116.0 for hub subscriptions to apply the host's endpoint fallback
+before running an unannotated query: ASP.NET Core evaluates `FallbackPolicy`,
+and Arc Core requires authentication when authentication handlers are registered.
+`IEndpointFallbackAuthorization` supplies this host check; it is separate from
+`IFallbackAuthorizationEvaluator`. `[AllowAnonymous]` and guest-policy queries
+remain exempt. Denial sends an Unauthorized frame; SSE subscribe returns 401.
+Check with `dotnet list package`; on older Arc do not rely on host fallback alone
+to secure the hub path.
+
 ## Default access by hosting model
 
 There is no `ArcOptions` switch for a default requirement. What you get depends

package/package/corpus/skills/cratis-arc-authentication-authorization-and-identity/references/observable-emission-guards.md

@@ -44,7 +44,15 @@ Arc API, and never an always-true stub.
 It runs on **every emission** of **every subscription**, on **every transport**:
 the multiplexed hub, WebSocket and SSE.
 
-Requires Arc 22.69.1 for guards and read-model interceptors on plain HTTP snapshots, waits and long polls; on an older Arc those requests are not guarded.
+Requires Arc 22.69.1 for guards and read-model interceptors on plain HTTP snapshots
+of observable queries, waits and long polls; on an older Arc those requests are not guarded.
+
+Requires Arc 22.116.0 for **non-observable** query results performed through the
+hub to run emission guards. Such a result has `IsSnapshot = true` and
+`IsFirstEmission = true`. `Suppress` withholds the result (SSE subscribe still
+returns 200); denial sends Unauthorized (SSE subscribe returns 401). Ordinary
+non-observable direct HTTP queries do not run these guards. Check with
+`dotnet list package`; on older Arc secure hub snapshots without relying on a guard.
 
 Source: [ObservableQueryHttp.cs](https://github.com/Cratis/Arc/blob/main/Source/DotNET/Arc.Core/Queries/ObservableQueryHttp.cs).
 
@@ -63,7 +71,7 @@ Several guards: every guard is asked, the **most restrictive** verdict wins
 ## The context
 
 `ObservableQueryEmissionContext` carries `QueryName`, `Arguments`,
-`SubscriptionScope`, `Principal`, `CorrelationId`, `IsFirstEmission`,
+`SubscriptionScope`, `Principal`, `CorrelationId`, `IsFirstEmission`, `IsSnapshot`,
 `CancellationToken` and the `ServiceProvider` to resolve from. Each guard gets its
 own copy of the scope and arguments.
 
@@ -108,7 +116,8 @@ a failure.
 
 ## What a guard does not protect
 
-- Plain HTTP **is** guarded (Requires Arc 22.69.1; older versions leave it unguarded): suppression returns 202 until an allowed
+- Plain HTTP **observable-query** snapshots are guarded (Requires Arc 22.69.1;
+  older versions leave them unguarded): suppression returns 202 until an allowed
   emission (or the wait deadline), denial returns unauthorized with no data.
   Keep safe data selection and initial
   authorization on every query regardless of transport.

package/package/corpus/skills/cratis-arc-command/references/decisions-and-routing.md

@@ -61,6 +61,17 @@ Requires Arc 22.106.0 for read protection. Older Arc has only the per-command
   `[Unprotected("why")]` (`Cratis.Arc.Chronicle.ReadModels`; on a method it covers
   the body, not injected parameters), or repair with a reactor.
 
+Requires Arc 22.113.0 with Chronicle 19.76.0 for `ReadChanged` validation state
+to include the conflicting event type/id and sequence number when the kernel
+reports them. Older kernels can leave those details absent. Outside-decision
+read-model injection (for example a custom command filter) is refused under
+`On`; explicitly unprotected models stay advisory. Check `dotnet list package`
+before asserting conflict detail fields.
+
+Requires Arc 22.116.2 for aggregate application, rehydration and append to resolve
+events from registrations, including explicitly registered types without an
+`[EventType]` attribute. Unregistered events still fail; do not omit registration.
+
 Under `On`, `IReadModels`, `IMongoCollection`, detached reads and immediate appends
 through an injected `IEventLog` are refused; take the model as a parameter and
 return the events. Admitted models: event-source-keyed model-bound or declarative

package/package/corpus/skills/cratis-arc-command-execution/SKILL.md

@@ -23,6 +23,9 @@ Operation execution,
 nesting restrictions, and backend recovery members below are described in
 `cratis-arc-command-operation`, which lists sources and limits.
 
+Read references/occurrence-commands.md when an occurrence handler must execute a
+command under a stable effect name with an atomic receipt and retry classification.
+
 ## When this is the wrong tool
 
 `ICommandPipeline` is for **command-shaped** work that needs authorization and

package/package/corpus/skills/cratis-arc-command-execution/references/occurrence-commands.md

@@ -0,0 +1,78 @@
+<!-- Copyright (c) Cratis. All rights reserved. -->
+<!-- Licensed under the MIT license. See LICENSE file in the project root for full license information. -->
+
+# Execute a command for an occurrence
+
+Requires Arc 22.117.0 and Chronicle client 19.77.2, plus a kernel advertising
+`effect-receipts`. Check with `dotnet list package`; older Arc has no occurrence
+executor. Do not substitute an ordinary pipeline call and claim durable deduplication.
+
+## Choose the executor
+
+Inject `IOccurrenceCommandExecutor` from `Cratis.Arc.Chronicle.Occurrences` into
+an occurrence handler. Its overloads are:
+
+```csharp
+Task<OccurrenceCommandResult> Execute(
+    object command, OccurrenceContext occurrence, EffectName effectName,
+    CancellationToken cancellationToken = default);
+
+Task<OccurrenceCommandResult> Execute(
+    object command, OccurrenceContext occurrence, EffectName effectName,
+    IEnumerable<string> systemRoles, CancellationToken cancellationToken = default);
+```
+
+`OccurrenceContext` and `EffectName` are Chronicle occurrence types. Read
+**cratis-chronicle-client-dotnet** for recording triggers and handling lifecycle
+occurrences. Do not call the executor from inside another command.
+
+The executor supplies a system principal; no caller roles are inherited. Supply
+only the explicit roles the automation needs. The occurrence namespace must
+match the resolved command tenant; a mismatch throws. Authorization still runs.
+
+Give each logical effect a stable, unique name within the occurrence. Retrying
+uses the same name. Reusing it for a different command returns the earlier
+receipt, not the new command's result. A deliberately new attempt at a terminal
+business refusal needs a new effect name.
+
+## Outcomes and retry
+
+The executor checks for an existing receipt before running the pipeline. Its
+receipt is committed atomically with the command's transactional events.
+
+- `Recorded` and `AlreadyRecorded` are settled results. Their outcomes are
+  `Appended`, `NoEvents` or `Refused`.
+- Validation, business-rule and append-constraint refusals are terminal and
+  recorded. Redelivery does not re-run the handler to reconsider them.
+- Authorization failures, concurrency conflicts and exceptions are `Failed`
+  without a receipt, so a later delivery can retry. Reread and re-decide rather
+  than replaying stale events.
+- The stored response is a minimal result, not a raw command response. It does
+  not preserve command values or validation messages. Never depend on a receipt
+  returning secret data or the original response object.
+
+A receipt settles Chronicle effects, not arbitrary I/O. Two concurrent attempts
+can both reach the handler before one wins the atomic commit. Use
+`occurrence.EffectKey(effectName).Value` as the external service's idempotency
+key where that service supports it; otherwise an external effect can repeat.
+
+## Keep all appends inside the boundary
+
+Return events from the command, or use transactional appends. Do not complete a
+stream or commit an aggregate early inside the executor's command.
+
+An immediate append can commit **before** the executor detects it and reports
+`OccurrenceCommandAppendedImmediately`. No receipt is recorded for that failed
+attempt, so retry can duplicate the escaped append. The executor does not
+implicitly provide Chronicle's `RefuseImmediateAppends()` guard. Read
+**cratis-chronicle-client-dotnet**'s immediate-append refusal reference when
+building a custom boundary that needs prevention before transport.
+
+## Verify
+
+Use an in-process occurrence scenario with the command's real validation and
+append behavior. Deliver the same occurrence twice under the same effect name:
+assert one committed effect and a recorded result on the second delivery. Cover
+a terminal refusal, a retryable concurrency conflict, insufficient capability,
+and commit-then-lost-reply recovery. Run the owning specification project with
+`dotnet test`; passing means those assertions ran, not just that compilation succeeded.

package/package/corpus/skills/cratis-arc-command-validation/SKILL.md

@@ -130,17 +130,11 @@ public class TransferFundsValidator : CommandValidator<TransferFunds>
   instance validators are refused. Under `[ProtectedDecision]` without `On`, a
   discoverable validator needs exactly one public parameterless constructor
   (otherwise HTTP 500).
-- **The caller can lower the severity threshold.** Model-bound commands accept
-  `X-Allowed-Severity` (`allowedSeverity`). Under `Off` and `Measure`, a caller
-  sending `3` (Error) removes Error results from validators, command filters and
-  `Provide()`, so `Handle()` runs and a validator's state rule can be skipped
-  unless the command declares
-  `[BlockOnValidationSeverity(ValidationResultSeverity.Error)]`
-  (`Cratis.Arc.Commands.ModelBound`). Requires Arc 22.108.0 for the `On` floor: a
-  command declared `On` blocks `Error` and `Unknown` whatever the caller sends; the
-  caller can relax only `Warning` and `Information`. Lowering
-  `ReadProtection:MaximumMode` at runtime does not remove the floor, and an explicit
-  attribute wins. Severity is not authorization.
+- **The caller can lower the severity threshold.** Under `Off`/`Measure`, pin
+  `[BlockOnValidationSeverity(ValidationResultSeverity.Error)]` when Error rules
+  must block. Requires Arc 22.108.0 for commands declared `On` to keep an Error
+  floor. Read references/validation-severity.md when choosing that threshold;
+  severity is not authorization.
 - **Omit the validator entirely when there are no rules.** An empty subclass is
   noise the reader has to check.
 - Single-property intrinsic rules belong on `ConceptValidator<T>` instead, so
@@ -258,32 +252,12 @@ public Result<ItemAddedToCart, ValidationResult> Handle(CartSummary? cart) =>
 - Keep the fetch for a *computed* key in `Provide()` with `IDecisionReads.Get`;
   under `On`, `IReadModels` there is refused.
 
-⚠️ **Two things the resolution does *not* do.** It does not key off the
-`[ReadModel]` attribute — a read model becomes injectable because a Chronicle
-projection or reducer, an EF Core `DbSet<T>`, or a MongoDB collection backs it.
-And there is **no slice or feature restriction**: registration is global by
-type, so "the read model must be in the same slice" is a convention with nothing
-enforcing it.
+Read references/read-model-resolution.md when choosing lookup keys, handling a
+missing injected model, or distinguishing registration from slice conventions.
 
-The resolution is **by the command's resolved event-source id**, not by the
-read-model type and not by "the property that looks like its key". If the
-instance you need is keyed by anything else — a referenced other entity, a
-command with more than one candidate identity, or an id generated inside
-`Handle()` — direct injection hands you the wrong instance or none. Read by
-explicit key in `Provide()` instead:
-
-```csharp
-var other = await readModels.GetInstanceById<Other>((EventSourceId)otherId);
-```
-
-A missing instance resolves to `null`, never to a default object. A nullable
-parameter receives that `null`; a non-nullable one is **rejected as a validation
-failure (400)**, not crashed. `ARC0006` warns on a non-nullable command-scoped
-read-model parameter for exactly this reason. Handle a nullable parameter by rejecting (a validator,
-`Provide()`, or `Result<TEvent, ValidationResult>`), never by returning a
-nullable event from `Handle()`. `cratis-arc-command` carries the
-full resolution and nullability reference, including the passive-projection case
-where absence is *not* `null`.
+Read references/input-binding.md when accepting date-time input or returning
+member-bound validation results: offset requirements, malformed-body
+authorization and camelCase member paths are separate contracts.
 
 ## Step 6 — Specify the rejection