@cratis/pi 7.75.0 → 7.77.0

package/package/corpus/skills/cratis-stage-rendering-and-sandbox/SKILL.md

@@ -11,9 +11,8 @@ ships a **renderer** (a .NET library, driven from a terminal by `cratis render`)
 disposable **sandbox** container (`cratis/stage`, started by `cratis run`) and a
 **specification runner** container (`cratis/stage-specrunner`).
 
-The admitted model shape is deliberately small. A model Stage cannot render exactly
-produces **no artifacts at all**, never thinner ones. Render the model to find out
-whether it is admitted; reading the admission rules is not a render result.
+A model Stage cannot render exactly produces **no artifacts**, never thinner ones.
+Probe the model; admission rules are not a render result.
 
 Requires cratis CLI ≥ 3.57 (`cratis --version`) to render ESM v14 and v15 models; an older CLI refuses newer ESM versions with `CLI-RENDER-004` (or `STAGE-ESM-016` from Stage directly).
 
@@ -22,9 +21,9 @@ Requires Cratis CLI 3.74.0 to render ESM v21–v26 models and 3.75.0 for v27; CL
 ## Batches, described handlers, text rules and protected reads
 
 Read [language admission](../cratis-screenplay-toolchain/references/language-admission.md)
-for v22–v25: text rules render, atomic batches/protected reads/described bodies do
-not. The semantic Host and specification runner execute admitted protected reads;
-that is not rendering. Stub mode emits no described-body stubs. Keep protection and report refusal.
+for v22–v25: text rules and admitted protected reads render; atomic batches and
+described bodies do not. Semantic execution is separate from rendering. Stub mode
+emits no described-body stubs. Keep protection and report refusal.
 
 ## When to use
 
@@ -73,12 +72,15 @@ Order: recover any interrupted publication, compile, bind, build the plan, plan
 Exit `0` is a published render, `5` is a refusal with nothing published (diagnostics are
 printed), `1` is a missing input. Add `-o json` for the counts and the publication receipt.
 
-Facts that surprise:
+Key facts:
 
 - **Binding uses the CLI's bundled compiler**, not the standalone one. Version admission
-  does not imply construct support: exact ESM v1–v21 and v23–v27 pairs are admitted,
-  while v22/v28 and mixed pairs refuse `STAGE-ESM-016`. Date/DateTime command comparisons (v26)
-  execute in the semantic Host and executor but refuse `STAGE-ESM-046` in the renderer. Pattern/random generation and checksum validation
+  does not imply construct support: exact ESM v1–v27 pairs are admitted;
+  v28 and mixed pairs refuse `STAGE-ESM-016`. Requires Stage 4.139.0 for v22 admission;
+  older Stage refuses v22 with `-016`, while atomic mode still refuses `-043`.
+  Requires Stage 4.141.0 to render v26 Date/DateTime command comparisons; older
+  renderers refuse `-046`. Read [references/date-comparisons.md](references/date-comparisons.md)
+  when rendering dates for the remaining refusals and input-binding differences. Pattern/random generation and checksum validation
   render with an admitting renderer; `generate rule` renders in a new enough bundle (the Host and legacy syntax engine still refuse it with `STAGE-ESM-028`).
   Read [references/admission.md](references/admission.md) for the introducing-release
   prerequisites, all-Proven unpinned specifications and construct/pin checks (-011/-038).
@@ -116,7 +118,10 @@ modified stale artifacts. Recovery runs before planning:
 
 ## Admission
 
-One blocker publishes nothing. Codes, limits and fixes: [references/admission.md](references/admission.md).
+One blocker publishes nothing. Requires Stage 4.146.0 to collect independent admission
+refusals in one plan; older renderers stop at earlier batches of checks. Target-profile
+and unaudited-version refusals still stop first. Codes, limits and fixes:
+[references/admission.md](references/admission.md).
 
 - **Renders:** concepts/types/collections/optionals; portable StateChange and StateView slices,
   flat/scoped projections, pure reducers and reducer `from` filters; keyed optional snapshots,
@@ -139,11 +144,9 @@ One blocker publishes nothing. Codes, limits and fixes: [references/admission.md
   for ESM admission. Read the required typed `arguments.subject` for the command,
   never match message text. Requires Screenplay 4.210.0 (`screenplay --version`);
   older bundled binders use PLAY0268 for these handlers.
-- **Binding refusals (`PLAY0268`/`PLAY0271`):** legacy reads, `concurrency`,
-  context/single-result filters, opaque scope/performer, a list-query `by` block,
-  enum/identity compliance and subject lineage. Eligible protected reads bind v25;
-  pending handlers with unconditional productions bind v23, but neither renders. A read model with several key parts (v27) is admitted but refuses rendering (`STAGE-ESM-048`).
-  Never drop protection.
+- **Binding refusals:** read toolchain `references/executable-subset.md` for
+  `PLAY0268`/`PLAY0271` families; binding is not rendering. V27 keys are admitted
+  but refuse rendering (`STAGE-ESM-048`). Never drop protection.
 
 A refusal is not a licence to weaken the model: drop no specification, event generation or
 protection to get a render; keep the model, record the capability gap and gap-fill.
@@ -156,19 +159,15 @@ prose is not enforced. A documentation edit changes managed-file hashes (a `--ch
 Generated identities: read [shop strategy choices](references/choosing-generation.md) before
 rendering a model with generated values. Case tables and whole numbers:
 [case tables and whole numbers](references/case-tables-and-whole-numbers.md).
-`[ProtectedDecision]` and `DecisionRead<T>` are available to gap-fill code, not
-automatically emitted or protected by Stage; admission and unit-of-work enrollment still matter.
+Gap-fill `[ProtectedDecision]`/`DecisionRead<T>` use still needs admission and
+unit-of-work enrollment.
 
 ## What it emits
 
-At application scope the plan holds the scaffold plus the modeled artifacts: a `.csproj`
-and `.slnx`, `Program.cs`, `appsettings.json`, `docker-compose.yml`, the Directory props
-files, a policy registration and generated policies, `Common/<Concept>.cs`, one
-`<Module>/<Feature>/<Slice>/` folder per slice with the `[Command]` record and `Handle()`,
-the `[EventType]` event, the validator and the `[ReadModel]` with its query, `scene.json`,
-and a React/Vite frontend scaffold (`.frontend/`, `package.json`, `tsconfig.json`,
-`.gitignore`). Per-file detail, the scaffold's dependency set and the `Customizations/`
-contract, including the opt-in self-reducing layout for confirmed new Cratis C# applications:
+Application plans hold the backend scaffold, concepts, commands/events/validators,
+read models/queries and policies, plus Scene and React/Vite frontend artifacts.
+Read the per-file scaffold, dependency and `Customizations/` contract, including
+the opt-in self-reducing layout for confirmed new Cratis C# applications:
 [references/rendered-application.md](references/rendered-application.md). Scene
 package ids, host capabilities and the boundary from hand-built Components pages:
 [references/scene-runtime.md](references/scene-runtime.md). A complete renderable model:
@@ -193,36 +192,19 @@ Silent fallback to a default screen is a failure, not a partial render.
 
 ## Sandbox and specification runner
 
-`cratis run [PATH]` (Docker required) starts `cratis/stage` on the folder or file: Stage
-API on `9090`, Chronicle Workbench on `https://localhost:35000`. It is a **partial,
-disposable runtime**, not a generated application. `cratis run` runs the `semantic` engine
-(Requires Cratis CLI 3.73.0); Stage's semantic engine is the only engine going forward. The legacy
-EventModel engine (older CLIs, or the image without `Stage__Runtime__Engine=semantic`) is legacy; do not rely on it.
-It appends modeled
-`produces` facts and echoes the payload. It refuses missing required properties and
-simple literal `validate` rules on top-level properties, but enforces no other rule, no
-constraint and no command or query authorization; the semantic engine enforces them and
-refuses what it cannot execute (HTTP 501). The legacy engine
-also refuses routed models (`STAGE-ESM-030`), composite read-model keys (v27) and protected reads (`STAGE-ESM-044`); the semantic engine runs composite keys.
-Requires Cratis CLI 3.75.0 for `cratis run` to run v27 composite keys.
-Requires Stage 4.129.0 for semantic Host/runner protected reads; older engines refuse
-`STAGE-ESM-044`. Required absence rejects before requirements/generation, read properties
-feed requirements and productions, and non-Error protected requirements refuse
-`STAGE-ESM-045`, including reaction invocations. The Host faults on any outside append,
-even unrelated facts; this is stricter than reference dependency-scoped conflicts.
-Callers are built from unsigned headers, so
-authorization there is not a security boundary.
-
-`cratis/stage-specrunner` checks modeled specifications and writes a results file. The
-default `structural` engine is deprecated and model-level only; `--engine semantic`
-executes admitted specs through Arc's in-memory pipeline and reports `Passed`, `Failed`,
-`Unsupported` or `Cancelled`. A green result is Stage semantic-engine evidence: not V4 and
-not a rendered Debug test run. Commands, the report schema and limits:
-[references/sandbox-and-specrunner.md](references/sandbox-and-specrunner.md).
-
-Specification runner exit codes: `0` means the run completed and the results file was
-written **even when a specification failed**, so read the outcomes; `1` is a missing or
-uncompilable input; `2` a missing required argument or an invalid semantic option.
+`cratis run [PATH]` (Docker required) starts the disposable `cratis/stage`, not a
+generated application: API on `9090`, Workbench on `https://localhost:35000`.
+Requires Cratis CLI 3.73.0 for the semantic engine by default, 3.75.0 for v27 keys;
+older CLIs use the legacy EventModel engine, which does not enforce authorization.
+Unsigned caller headers make sandbox authorization no security boundary.
+Read [references/sandbox-and-specrunner.md](references/sandbox-and-specrunner.md)
+before running either image: engine selection, protected reads, outside-append
+conflicts/retries, reached bodies, authored occurrence and generated-spec limits live there.
+
+`cratis/stage-specrunner --engine semantic` reports `Passed`, `Failed`, `Unsupported`
+or `Cancelled`; deprecated structural mode is model-level only. Neither proves V4
+or rendered Debug tests. Exit `0` means the report was written **even on failed specs**:
+read outcomes. Exit `1` means missing/uncompilable input; `2` invalid arguments.
 
 ## Behavior walk (optional, after V3)
 

package/package/corpus/skills/cratis-stage-rendering-and-sandbox/references/admission.md

@@ -11,10 +11,10 @@
 - Specification rules (`STAGE-ESM-011`)
 - Refusals seen while drafting a model
 
-Stage admits exact ESM v1–v21 and v23–v27 language/semantic pairs, then checks
-constructs. V22, v28 and mixed or unknown pairs report `STAGE-ESM-016`. `cratis render` admits
-ESM v1–v27: Stage plans each model and refuses the constructs it cannot render with typed `STAGE-ESM-*`
-codes (a v22 model reports `STAGE-ESM-016`; v26 date comparisons report `STAGE-ESM-046`; v27 composite
+Stage admits exact ESM v1–v27 language/semantic pairs, then checks
+constructs. V28 and mixed or unknown pairs report `STAGE-ESM-016`. `cratis render` admits
+ESM v1–v27: Stage plans each model and refuses the constructs it cannot render with typed `STAGE-*`
+codes (atomic batches report `STAGE-ESM-043`; unsupported v26 date shapes `STAGE-ESM-046`; v27 composite
 read-model keys report `STAGE-ESM-048`/`-047`). The CLI refuses
 a bound model above v27 with `CLI-RENDER-004` before planning; a construct its bundled compiler cannot bind
 reports PLAY0268 instead.
@@ -38,15 +38,16 @@ opaque/unsupported rules refuse -005 before pin evaluation. Independent executio
 always needs pins.
 Requires Stage 4.124.0 for v24 text-rule admission (`cratis --version` identifies the CLI bundle); older renderers refuse v24 with STAGE-ESM-016.
 Requires Stage 4.127.0 for v25 version admission; older renderers refuse v25 with STAGE-ESM-016. Requires Stage 4.138.0 for the Cratis renderer to render protected reads as Arc read protection (`[ReadProtection(On)]`, a nullable read-model `Handle` parameter per read with `[LookUpBy]`, the `<View> '<key>' does not exist.` rejection, requirements evaluated in `Handle` after the reads; generated specifications run in decision mode); `cratis render` gets it from the first CLI that bundles Stage 4.138.0, and earlier bundles (CLI 3.75.0 bundles 4.137.0) refuse every protected read with STAGE-ESM-044. Reads it cannot preserve faithfully stay STAGE-ESM-044 and name the reason: constrained events, read paths in `produces when`, mappings to optional, collection, composite or mistyped event properties, generated-value freshness scopes. See [protected reads](../../cratis-screenplay-command-surface/references/protected-reads.md).
-Requires Stage 4.129.0 for semantic Host/executor protected reads; older engines refuse STAGE-ESM-044. Required absence rejects before requirements or generation; read-backed requirements and produced-event mappings execute. Non-Error protected requirements refuse STAGE-ESM-045, including reaction invocations. See [sandbox boundaries](sandbox-and-specrunner.md#protected-command-reads) for ordering and the Host's stricter outside-append fault boundary.
+Requires Stage 4.129.0 for semantic Host/executor protected reads; older engines refuse STAGE-ESM-044. Required absence rejects before requirements or generation; read-backed requirements and produced-event mappings execute. Non-Error protected requirements refuse STAGE-ESM-045, including reaction invocations. See [sandbox boundaries](sandbox-and-specrunner.md#protected-command-reads) for ordering and outside-append commit boundaries.
 Described handlers refuse STAGE-IMPL-002, even Stub mode; atomic mode in an
 admitted pair refuses STAGE-ESM-043. Version admission never implements a body,
 batch or composite-key rendering. Chronological Date/DateTime command comparisons
-select v26. The semantic Host and specification executor run them; the renderer,
-legacy engines and default sandbox engine refuse them with STAGE-ESM-046, naming the
-property, and emit no artifacts. Standalone reference success is not rendering. Keep
-the date rule and use authorized gap-fill rather than downgrading to ordinal text or
-millisecond precision.
+select v26. The semantic Host and specification executor run them.
+Requires Stage 4.139.0 for v22 admission; older Stage refuses v22 with -016.
+Requires Stage 4.141.0 for rendered date comparisons; older renderers and legacy
+engines refuse -046. Read [date comparisons](date-comparisons.md) when rendering
+v26 for the remaining -046 shapes and input-binding differences. Keep refused date
+rules; never downgrade to ordinal text or millisecond precision.
 
 Requires Stage 4.135.0 for v26 admission; older Stage refuses v26 with STAGE-ESM-016.
 
@@ -61,6 +62,13 @@ prerequisite. The exhaustive construct table is `references/renderable-subset.md
 One blocking diagnostic fails the **whole** plan and nothing is published (exit 5).
 Informational diagnostics (`PLAY0270` authoring metadata, `PLAY0469`, `STAGE-ESM-023`) do not.
 
+Requires Stage 4.146.0 for one plan collecting all independent version-feature,
+implementation-envelope, typed-context, event-lineage, slice, specification and Scene
+admission refusals; older renderers return earlier batches first. Duplicate refusals
+are listed once; refusals already collected survive an unexpected model shape.
+A target-profile mismatch or unaudited ESM version still stops before these checks.
+Classify the complete plan before editing; another probe is still required after fixes.
+
 A refusal can come from four layers, and the code tells you which: compilation and binding
 (`PLAY*`, from the CLI's bundled Screenplay), execution planning (`PLAN-*`), Stage
 admission (`STAGE-*`) and the CLI itself (`CLI-RENDER-*`). A publication conflict (a
@@ -149,13 +157,13 @@ Requires Stage 4.90.0 for snapshot/live lists, 4.96.0 for non-text secrets and 4
 | `STAGE-ESM-005` | Code validation or rule predicate bodies; or a command beyond the first capability (optional event property, event revision other than the first, validation or requirement that cannot be rendered, neither `produces` nor a response) | Use declarative validation; non-initial event generations are not rendered |
 | `STAGE-ESM-006` | `produces` that cannot render without changing its destination or mappings (expression/enum conditions, literal or computed mappings, `for` not a command identifier, mappings not one-to-one with event properties, duplicate tags) | Map properties one to one; supported conditional productions render as guarded events, not separate commands |
 | `STAGE-ESM-007`, `-008`, `-009` | Projection count per read model (exactly one projection or reducer each); unresolvable properties or no single read-model transition (**flat** projections only); affected instance not one, not keyed by an event property, or not the event-source identity (flat projections only) | One projection per read model; see "Projections" below |
-| `STAGE-ESM-010` | A query is neither an optional snapshot lookup by the read-model identifier nor a supported snapshot/observable collection query; each query is checked on its own. Both collection modes render. Concept-typed keys and filters retain Arc validation, including composite members and collection elements; nullable concept keys or optional concept filters with `not empty` cannot preserve null semantics | Keyed `XById => X optional` queries or snapshot/observable lists. Equality filters render on both collections; DateTime filters, required filters after optional ones and unsupported null-validation shapes refuse 010. Filter-name collisions refuse 012. Context/single-result filters, opaque scope/performer and a list-query `by` block remain PLAY0268; a read model with several key parts (v27) refuses `STAGE-ESM-016` |
+| `STAGE-ESM-010` | A query is neither an optional snapshot lookup by the read-model identifier nor a supported snapshot/observable collection query; each query is checked on its own. Both collection modes render. Concept-typed keys and filters retain Arc validation, including composite members and collection elements; nullable concept keys or optional concept filters with `not empty` cannot preserve null semantics | Keyed `XById => X optional` queries or snapshot/observable lists. Equality filters render on both collections; DateTime filters, required filters after optional ones and unsupported null-validation shapes refuse 010. Filter-name collisions refuse 012. Context/single-result filters, opaque scope/performer and a list-query `by` block remain PLAY0268; a read model with several key parts (v27) refuses `STAGE-ESM-048` |
 | `STAGE-ESM-011` | A specification cannot render (see the rules below) | Reshape it only if the assertion keeps its meaning; otherwise keep the specification, record the gap, and gap-fill with the specification as the oracle. Never weaken or delete it to get a render |
 | `STAGE-ESM-012` | Generated C# names collide (properties, types, namespaces, constraints) | Rename |
 | `STAGE-ESM-013` | An event-context value other than `$context.occurred` mapped in `produces` | Map a command property when that preserves the meaning; otherwise gap-fill |
 | `STAGE-ESM-014` | A constraint Chronicle cannot reproduce (kind, scope, message; multi-claim in one command; optional or composite targets) | A different constraint is a requirement change for the model owner; otherwise gap-fill |
 | `STAGE-ESM-015` | Authorization Stage cannot render exactly: a role-claim URI, an opaque policy nested inside a condition, an unresolved or non-portable policy, no single identifier, an opaque-policy subject that is not text, Uuid, Date or DateTime (a restriction on opaque-policy subjects, separate from declarative claim targets), an unsupported claim artifact. Role-only, authenticated, opaque pure policies, claim conditions with Uuid, Date, DateTime or text targets (numeric and Boolean claim matches render as always false) and `not`/and/or render; roles are read through the identity's `RoleClaimType` | Reshape the policy to a portable condition; otherwise gap-fill |
-| `STAGE-ESM-016` | Model language/semantic pair is not admitted by the installed Stage; exact v1–v21 and v23–v27 pairs are admitted, v22/v28 and mixed pairs refused; older Stage also refuses the versions listed in the minimums above. A CLI bundle reports `CLI-RENDER-004` above its ceiling (v27 for CLI 3.75.0) first. v14 filters and v15 generation join v11 numbers, v12 enum numbers and v13 compliance as supported constructs, not blanket construct support | Not fixable by editing: the model needs a newer renderer. Keep the model, record the gap, gap-fill |
+| `STAGE-ESM-016` | Model language/semantic pair is not admitted by the installed Stage; exact v1–v27 pairs are admitted, v28 and mixed pairs refused; older Stage also refuses the versions listed in the minimums above. A CLI bundle reports `CLI-RENDER-004` above its ceiling (v27 for CLI 3.75.0) first. v14 filters and v15 generation join v11 numbers, v12 enum numbers and v13 compliance as supported constructs, not blanket construct support | Not fixable by editing: the model needs a newer renderer. Keep the model, record the gap, gap-fill |
 | `STAGE-ESM-017` | Read model or projection cannot render (property names that collide with Chronicle paths or expression syntax, mappings that overwrite the key or child identity, composite keys, unsupported `all` mappings, the refused scope shapes below) | Reshape the projection without changing what it records, or record the gap |
 | `STAGE-ESM-018` | `$strings.` key missing in the default locale or containing formatting characters | Fix the strings |
 | `STAGE-ESM-019` | Reducer structure or body not admitted (outside a `StateView`, impure, does not compile), or a `generate rule` body that does not compile or produces a compiler warning | An equivalent pure body, or gap-fill |
@@ -179,9 +187,11 @@ Requires Stage 4.90.0 for snapshot/live lists, 4.96.0 for non-text secrets and 4
 | `STAGE-ESM-043` | `reaction batches atomic` in an admitted version pair | Keep the batch boundary; gap-fill without splitting it |
 | `STAGE-ESM-044` | A protected read the Cratis renderer cannot preserve faithfully, naming the reason (every protected read before Stage 4.138.0); the legacy Host/structural runner refuse the preamble | Keep protection; gap-fill the refused command; semantic Host/executor support is separate from generated-app enforcement |
 | `STAGE-ESM-047`, `-048` | ESM v27 composite read-model keys: `-048` read model with several key parts or projection keyed by parts (also the legacy syntax engine); `-047` single-instance query by parts | Keep the model; gap-fill the composite-keyed scope |
-| `STAGE-ESM-046` | Date/DateTime comparison in `require`, `produces when` or a validation rule (including through concepts) in the renderer, legacy engines or default sandbox engine; names the property | Keep the date rule; the semantic Host/executor run it; deliver rendering through gap-fill that compares exact calendar dates and UTC ticks |
+| `STAGE-ESM-046` | Compared DateTime concept with compliance or optionality, or a non-camel-case compared DateTime property; older renderers and legacy engines refuse all date comparisons | Keep the date rule and protection; see [date comparisons](date-comparisons.md) |
 | `STAGE-ESM-045` | Non-Error requirement on a protected command, including reaction-invoked commands; semantic admission refuses before reads, requirements or facts | Keep the severity contract; record the execution gap, never silently promote or drop the requirement |
 | `STAGE-IMPL-002` | Described command handler, naming command and RequirementId; also refused in Stub mode | Supply authorized implementation outside rendering; no generated stub is emitted |
+| `STAGE-IMPL-003` | Semantic Host/executor reaches a reducer or command/concept validation body; names owner and RequirementId (Requires Stage 4.145.0; older engines refuse unrelated behavior too) | Keep the body; run unaffected scope separately and gap-fill reached behavior. Renderer admission is unchanged |
+| `STAGE-PROFILE-001` to `-006` | Profile input cannot be honored: unknown package, missing layout, incompatible packages, missing theme, invalid root template or unresolved blueprint template | Fix the named input without substituting a different shell. Requires Stage 4.143.0 for shared `CratisRendering.ResolveProfileInputs(scene, approvedPackages)` findings; older consumers may have CLI-only checks |
 | `STAGE-ESM-037` | Events and commands from one handler, even across separate triggers on the same event in one reaction. The scaffold's Arc supports mixed results, but appends events before commands; a refused command causes redelivery and duplicate events | **Do not split the modeled reaction or drop an effect.** Gap-fill only with a proven retry-safe implementation; `[OnceOnly]` excludes replay, not retry |
 | `STAGE-ESM-023` | Information: transition bodies analysed | none |
 | `STAGE-CRATIS-001` to `-005` | Profile or `scene.json` not the package-owned shape; unrecognized or missing scaffold input; artifact path collision (`-004`, for example case names that normalize to one path); a modeled module or feature that would render into the reserved `Customizations/` (`-005`) | Rename the module, feature or case |

package/package/corpus/skills/cratis-stage-rendering-and-sandbox/references/date-comparisons.md

@@ -0,0 +1,44 @@
+<!-- Copyright (c) Cratis. All rights reserved. -->
+<!-- Licensed under the MIT license. See LICENSE file in the project root for full license information. -->
+
+# Rendering Date and DateTime comparisons
+
+Requires Stage 4.141.0 to render ESM v26 comparisons; older renderers refuse them
+with `STAGE-ESM-046`. Check `cratis --version` and its bundled Stage before rendering;
+a newer standalone Screenplay does not upgrade the CLI renderer.
+
+The Cratis renderer emits comparisons in command `require`, `produces when` and
+command/property validation rules. Date compares calendar days with `DateOnly`;
+DateTime compares UTC instants with `DateTimeOffset` at tick precision, not text
+or millisecond precision. Absence passes validation rules. Date predicates are
+server-side `.Must` rules; no client-side date comparator is extracted.
+
+Every compared DateTime command property carries Arc's `ExplicitOffset` marker:
+input without an offset or `Z` is rejected. A compared DateTime concept binds as
+`DateTimeOffset` and converts back to the concept in events, rules and responses.
+That workaround cannot preserve every shape. `STAGE-ESM-046` names the property for:
+
+- a compared DateTime concept carrying compliance;
+- an optional compared DateTime concept;
+- a compared DateTime property whose name is not camel case.
+
+Keep compliance and optionality: these are gaps, not reasons to change the model.
+Date comparisons from protected-read operands are not rendered. Reaction date
+conditions are not admitted by the language. Legacy engines retain `-046`.
+
+## Input and expectation differences
+
+With a named authorization policy, an unauthorized caller sending an unbindable
+date body receives Validation rather than 403: Arc binds the body before Stage's
+named policy evaluates. Test this boundary; do not claim identical denial ordering.
+Rendered DateTime `then` expectations compare instants, while reference expectations
+remain ordinal text comparisons; the binder requires expected event values to match
+the produced spelling.
+
+## Verify
+
+Run `cratis render <root> --name <App> --destination <out>`, then build and test the
+rendered project in Debug, in separate bounded calls. Admission/publication, build
+and specification outcomes are separate results. Check valid offset inputs,
+offset-less rejections and calendar-day/UTC-instant boundaries; retain any typed
+refusal rather than replacing the comparison with text ordering.

package/package/corpus/skills/cratis-stage-rendering-and-sandbox/references/rendered-application.md

@@ -15,6 +15,10 @@ image, Cratis Components, Scene, Fundamentals, Vite and React). The pins belong
 renderer: read them from the rendered `.csproj`, `docker-compose.yml` and `package.json`, never
 from this skill. Moving them is a renderer change, so a re-render
 under a newer Stage is how they change; never bump a managed file.
+Requires Stage 4.144.0 for backend pins derived at build time from Stage's central
+package versions and shared frontend pins following Stage's frontend manifest;
+older renderers use separately maintained scaffold pins. Regeneration updates
+existing applications; it does not float dependencies in an already rendered app.
 
 | Item | Value |
 | --- | --- |
@@ -36,8 +40,10 @@ Consequences: `[ProtectedDecision]` (`Cratis.Arc.Chronicle.ReadModels`) and
 in the scaffold's package set, as is `[ExecuteCommandsAsSystem]`. This is API
 availability, not Stage emission or runtime protection: gap-fill must opt into
 the protected command profile and enroll an admitted projection/key read in the
-active unit of work. The Cratis C# renderer does not turn `.play` `reads`/`require` into protected decisions;
-semantic Host/executor support is separate from generated-application protection.
+active unit of work. Requires Stage 4.138.0 for Cratis C# rendering of admitted
+`.play` protected reads as Arc read protection; older renderers refuse them with
+`STAGE-ESM-044`, as do shapes the renderer cannot preserve. Semantic Host/executor
+support is separate from generated-application protection.
 Hand-written scope that needs a newer dependency can raise its version through
 `Customizations/Dependencies.props` (explicit `Version`, imported last; central management
 is off), but any override must be proven with a restore and build. The compose file binds local ports `27017` and

package/package/corpus/skills/cratis-stage-rendering-and-sandbox/references/sandbox-and-specrunner.md

@@ -5,6 +5,7 @@
 - The sandbox: a partial, disposable runtime
 - Protected command reads
 - Date comparisons (v26)
+- Implementation bodies and authored occurrence
 - Refusals shared by both engines
 - The specification runner
 - Choosing between them
@@ -124,10 +125,20 @@ execution. This includes reaction-invoked commands, even a specification expecti
 rejection: the outcome is `Unsupported`, before seeding facts, not a passing refusal.
 Do not change modeled severity to get an executable result.
 
-The semantic Host faults the session on **any outside append** to its event log,
-even an unrelated one, before committing an accepted command. This interim guard
-is stricter than the reference's dependency-scoped decide/commit conflicts; do not
-claim full reference conflict parity or generated-application protection.
+Requires Stage 4.142.0 for decide/commit against outside facts; older Hosts fault
+on any outside append. The Host decides on the session world, reads the outside
+suffix and commits against the extended world. A later fact matching a protected
+read's key and event contracts causes a concurrency conflict without faulting the
+session; unrelated facts remain for commit-time constraints and projections.
+Outside facts do not fire reactions again. Refusals retain their outcome.
+
+The root/reaction batch uses one guarded write against the durable pre-batch tail,
+even for a successful empty batch. A definitive guard loss may retry the same
+decision, preserving generated values, only when settlement invoked no commands.
+An invocation or eight unsuccessful attempts returns a conflict. An unknown write
+outcome or unreadable/unsupported outside history faults the session, never retries
+as success. Legacy custom appenders without these capabilities retain conservative
+checks. These are Host guarantees, not generated-application evidence.
 
 ## Date comparisons (v26)
 
@@ -136,14 +147,54 @@ The semantic Host and specification executor compare `Date` as calendar days and
 `DateTime` as UTC ticks in `require`, `produces when` and validation rules, including
 through concepts. A participating `DateTime` input without an offset or `Z` rejects
 with Validation after authorization and before any rule. `then` stays ordinal. The
-renderer, legacy engines and default sandbox engine refuse these comparisons with
-`STAGE-ESM-046`, naming the property; no date validators or artifacts are emitted.
+Cratis renderer renders these comparisons from Stage 4.141.0; older renderers and
+legacy engines refuse `STAGE-ESM-046`. Read [date comparisons](date-comparisons.md)
+when checking remaining renderer refusals and input-binding differences.
 
 One ordering differs from the reference: the reference checks authorization, then
 offsets, then opaque C# validation, so an offset-less DateTime beside opaque
 validation is a Validation rejection there. The specification executor refuses opaque
-validation at run admission and the Host refuses it before authorization, so both Stage
-paths report `Unsupported`, which never counts as a pass.
+validation when reached at specification admission and the Host refuses a command
+that reaches it before authorization, so both Stage paths report `Unsupported`,
+which never counts as a pass.
+
+## Implementation bodies and authored occurrence
+
+Requires Stage 4.145.0 for reach-scoped reducer and validation refusals; older semantic
+engines refuse unrelated behavior when any such body exists. Neither Host nor executor
+runs these bodies. `STAGE-IMPL-003` names the reached owner and RequirementId:
+
+- command under test and commands invoked by reactions reach command validation;
+- command input and query argument types reach concept rules through composites,
+  collections and optionals;
+- given, appended or produced events reach reducer transitions; read-model assertions
+  and queries reach the corresponding reducer too;
+- potential reaction effects are included without evaluating guards, including effects
+  of an action expected to be refused.
+
+Unrelated commands, queries and specifications remain admitted. Reducer refusals use
+Projection capability; validation refusals use Command. This does not relax live-world
+history rebuilding or renderer admission, nor described-handler `STAGE-IMPL-002`.
+
+Requires Stage 4.141.1 for authored occurrence in event-reaction specifications; older
+executors refuse clocks beside reactions. Independent command, append and named-redelivery
+specifications accept `given clock` at or after the Unix epoch in whole milliseconds.
+Offset-bearing source clocks normalize to UTC; the same instant reaches direct/cascading
+productions, invocation arguments, invoked commands and refusal productions. Redelivery
+uses the scenario clock, not the given event's timestamp.
+
+No authored clock means no reaction occurrence: a reached production using
+`$context.occurred` rejects with `Reaction '<name>' uses $context, which needs the scenario's 'given clock'.`;
+an invocation argument instead rejects as unresolved in its declared root scope.
+A false `where` skips evaluation; the executor never invents wall time. The fixture
+supplies time, not audit identity: `$eventSourceId`/`$eventContext.eventSourceId` and
+`$context.causedBy.*` remain `STAGE-ESM-013`, even under `runs as system`.
+
+Clock/application/startup/shutdown triggers and `when clock`/trigger/capture actions
+remain `STAGE-ESM-024`. **A clock fixture is not a scheduler.** Generated backend
+occurrence mappings use `EventContext.Occurred`, but context-dependent generated
+reaction specs retain `-011`; generated append/redelivery clock fixtures retain `-024`.
+Rendered clock fixtures remain command-only.
 
 ## Refusals shared by both engines
 

package/package/corpus/skills/cratis-stage-rendering-and-sandbox/verification.json

@@ -19,12 +19,16 @@
     { "kind": "skill-contains", "value": "**Render never builds, tests or runs**" },
     { "kind": "skill-contains", "value": "`[ProtectedDecision]`" },
     { "kind": "skill-contains", "value": "`Customizations/`" },
-    { "kind": "skill-contains", "value": "`Stage__Runtime__Engine=semantic`" },
-    { "kind": "skill-contains", "value": "`--engine semantic`" },
+    { "kind": "skill-contains", "value": "`Stage__Runtime__Engine=semantic`", "file": "references/sandbox-and-specrunner.md" },
+    { "kind": "skill-contains", "value": "`--engine semantic`", "file": "references/sandbox-and-specrunner.md" },
     { "kind": "skill-contains", "value": "Requires Cratis CLI 3.64.0 for `--engine`", "file": "references/sandbox-and-specrunner.md" },
     { "kind": "skill-contains", "value": "the environment setting below", "file": "references/sandbox-and-specrunner.md" },
     { "kind": "skill-contains", "value": "fresh in-memory Chronicle log per specification", "file": "references/sandbox-and-specrunner.md" },
-    { "kind": "skill-contains", "value": "exact ESM v1–v21 and v23–v27 pairs" },
+    { "kind": "skill-contains", "value": "exact ESM v1–v27 pairs" },
+    { "kind": "skill-contains", "value": "Requires Stage 4.141.0", "file": "references/date-comparisons.md" },
+    { "kind": "skill-contains", "value": "Requires Stage 4.142.0", "file": "references/sandbox-and-specrunner.md" },
+    { "kind": "skill-contains", "value": "STAGE-IMPL-003", "file": "references/sandbox-and-specrunner.md" },
+    { "kind": "skill-contains", "value": "Requires Stage 4.146.0" },
     { "kind": "skill-contains", "value": "STAGE-ESM-044" },
     { "kind": "skill-contains", "value": "STAGE-IMPL-002" },
     { "kind": "skill-contains", "value": "all-Proven rules permit unpinned rendered", "file": "references/admission.md" },

package/package/corpus/skills/guiding-refactoring-with-code-health/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: guiding-refactoring-with-code-health
-description: Use when refactoring unhealthy code and needing Code Health findings to choose small safe steps and verify improvement. Only in repositories that opted into the cratis/codescene profile and have CodeScene MCP tools available; otherwise do not use.
+description: Improve unhealthy code incrementally using measured Code Health feedback. Use when planning structural refactoring steps for complexity, size, cohesion or nesting and comparing each step with a baseline. Requires an opted-in cratis/codescene profile and available CodeScene MCP tools; otherwise skip. Do not use for a pre-commit change gate (use safeguarding-ai-generated-code) or portfolio debt ranking (use prioritizing-technical-debt).
 license: Apache-2.0
 ---
 

package/package/corpus/skills/safeguarding-ai-generated-code/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: safeguarding-ai-generated-code
-description: Use when AI-generated or AI-modified changes need a Code Health gate before commit, handoff, or pull request. Only in repositories that opted into the cratis/codescene profile and have CodeScene MCP tools available; otherwise do not use.
+description: Gate AI-touched changes against Code Health regressions. Use when reviewing a staged diff or branch before commit, handoff or pull request with pre_commit_code_health_safeguard or analyze_change_set. Requires an opted-in cratis/codescene profile and available CodeScene MCP tools; otherwise skip. Do not use for a structural refactoring workflow (use guiding-refactoring-with-code-health) or risk-based test selection (use risk-based-testing-with-code-health).
 license: Apache-2.0
 ---
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cratis/pi",
-  "version": "7.75.0",
+  "version": "7.77.0",
   "description": "Configuration-aware Cratis AI integration for Pi",
   "type": "module",
   "files": [