CANP-WP-0002 T03: composition by reference, two kinds

T01 had already delivered half of composition without naming it: a derived
default binds an input to a prompt dependency, which is transclusion — run
package B, use its output. What was missing was the deterministic half.

`include` inlines another package's rendered template as text. No model is
involved, so the reference CLI can actually perform it, and a shared preamble,
rubric or style block becomes a versioned package instead of copied text. This
is the concrete way to honor INTENT principle 9 without any runtime. `derive`
stays as it was. Both are input defaults, so composition reuses the resolution
machinery rather than adding a second one.

No template inheritance. Four of this repo's own documents argue against it:
INTENT principle 3 (hidden context defeats reuse), section 19's "make package
contents visible before execution", section 17's requirement that behavior
changes produce a new version, and the non-goal on range resolution.

Version selectors: an exact pin is the expected form, with `any`, `newest` and
`>= X.Y.Z` as explicit opt-ins so looseness is written rather than implied by
absence. Selectors are evaluated per dependency against what is available —
no solver, no cross-dependency constraint satisfaction — which is what keeps
them outside the range-resolution non-goal, and the spec says so.

Also defines `type` (template | fragment), which appeared once in the section 4
manifest surface and was specified nowhere.

Spec: 3.2 (type), 5.1 (inclusion resolution rule, renumbered), 6.1 (included
default), 10.1 and 10.2 (new), 18 (rules 14-16), 21.

Reference CLI: validate_version_selector, select_version,
prompt_dependencies replacing prompt_dependency_ids,
check_composition_reference, CatalogComposer with cycle detection, and
resolve_inputs gaining composer= and inherited=. Tests 21 -> 42.

Examples: house-style is a real fragment package; pqrst-estimate composes it
and is bumped 0.1.0 -> 0.2.0 per section 17.

Fixes an ordering bug found while testing: inputs resolved before parameters,
so an included package could not see the including package's parameters and
silently fell back to its own defaults — the fragment rendered tone=neutral
where the including package said blunt. Parameters now resolve first; the
report still lists inputs first.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Bjefh8NUiEiahN4JLwoSKM

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 388925@bnt-lap001
Assistant-Session: 3507023f-e0fd-4a1e-9d90-a0d4217d1502

README.md

@@ -8,6 +8,7 @@ This bundle contains a first project seed for `canned-prompts`:
 - [`CannedPromptFormat-v0.1.md`](CannedPromptFormat-v0.1.md) — experimental package-format specification.
 - [`reference/`](reference/) — deliberately small Python CLI implementing the basic lifecycle.
 - [`examples/pqrst-estimate/`](examples/pqrst-estimate/) — a real package that can be used to exercise the implementation.
+- [`examples/house-style/`](examples/house-style/) — a `type: fragment` package that `pqrst-estimate` composes.
 
 ## Try the reference implementation
 
@@ -17,7 +18,8 @@ python -m venv .venv
 . .venv/bin/activate            # Windows: .venv\Scripts\activate
 pip install -r requirements.txt
 
-# add the included example to your local catalog
+# add the included examples to your local catalog
+python canned_prompts.py add ../examples/house-style
 python canned_prompts.py add ../examples/pqrst-estimate
 
 # find and inspect it
@@ -76,6 +78,42 @@ This reference tool never calls a model, so it resolves supplied values and
 static defaults only, and reports anything it cannot derive instead of
 rendering a prompt with a silent hole in it.
 
+## Composition
+
+A package composes another by declaring it as a dependency and binding it to an
+input default. There are two kinds:
+
+- **`include`** — inline the other package's *rendered template* as text.
+  Deterministic, needs no model, and the reference CLI performs it.
+- **`derive`** — use the other package's *result*, obtained by running it.
+  Only a consumer able to run it can supply one.
+
+`examples/pqrst-estimate` includes `examples/house-style`, so a shared style
+block is a versioned package rather than copied text:
+
+```yaml
+dependencies:
+  prompts:
+    - id: practice/house-style
+      version: ">= 0.1.0"
+      requirement: required
+
+inputs:
+  - name: house_style
+    required: false
+    default:
+      include: practice/house-style
+```
+
+A dependency pins an exact version by default; `any`, `newest` and a `>= X.Y.Z`
+lower bound are explicit opt-ins. These are per-dependency selectors, not
+version ranges — there is no solver, and constraint resolution across a
+dependency graph remains a non-goal.
+
+There is no template inheritance. A package never extends another or overrides
+its parts; composition is by reference only, so a package's content stays
+readable without chasing ancestors.
+
 ## Registries and identity
 
 An id names a package *within a registry* (`CannedPromptFormat-v0.1.md`