@cratis/pi 7.127.0 → 7.129.0

package/package/corpus/product-sync.json

@@ -171,9 +171,9 @@
         }
       ],
       "synced": {
-        "version": "4.245.0",
-        "date": "2026-10-25",
-        "by": "Cratis/AI#820"
+        "version": "5.1.0",
+        "date": "2026-11-02",
+        "by": "Cratis/AI#975"
       },
       "covers": {
         "skills": [
@@ -201,7 +201,7 @@
         ],
         "rules": []
       },
-      "notes": "Cratis/AI#820: reviewed v4.245.0 release; protected-read constraint precedence preserved. Review correction: removed unsupported parser-repair and inbound-public refusal release attributions and the incorrect PLAY0136 event-key claim, restoring prior teaching. Published contract asset is byte-identical to the previous snapshot; pin and compatibility entry advanced together. Prior: Cratis/AI#779: reference-runner capability refusals taught as scoped per specification (introduced in v4.213.2, Cratis/Screenplay#897) from the v4.216.0 tool and MCP documentation and plan source: an unadmitted projection (UnsupportedEventContext, UnsupportedProjectionBlock) marks unsupported only the specifications that reach it or its read model, the others run and planIssues lists deferred issues; application-level issues still block every selected specification; no new render/runtime probe. Prior: Cratis/AI#776: PLAY0802 ReservedStoredName (introduced in v4.213.3, Cratis/Screenplay#893) taught from the v4.216.0 compilers and documentation: stored event source `Default` and stored event stream `All` (ordinal, name or `id` pin) refused at authoring time, a pin away from the reserved name valid, PLAY0273 kept as the binding backstop; no new render/runtime probe. Prior: Cratis/AI#784: standalone Screenplay 4.216.0 pinned; compiler contract replaced by the v4.216.0 release asset (adds the propose-repair destinationIntent v1 schema and PLAY0802 ReservedStoredName). Source-checked decision 0096 and the MCP reference for the explicit author-intent PLAY0470 repair: repair-intents discovery, intentActions feature detection, complete per-production selections, retained production-destination report and identity views, explicit apply and refusals. No new render/runtime probe. Prior: Cratis/AI#771: standalone Screenplay 4.213.0 pinned; regenerated compiler contract is byte-identical to the v4.213.0 release asset and unchanged from 4.212.4. Reviewed the full v4.212.4-v4.213.0 delta against tagged decision 0093 and MCP reference: pre-binding container identities and stable binding/migration continuity, own-slice member substitutions, containerIdentities completeness/ambiguity/collision refusals, retained ambiguous notes, explicit semanticRenames/retirements, binding fixes through MCP, exact reopen exception, notes/identity rollback and exact-ID re-add anchoring. No grammar, binder, ESM or diagnostic-code changes; no new render/runtime probe. Prior: Cratis/AI#772: standalone Screenplay 4.212.4 pinned; regenerated compiler contract is byte-identical to the v4.212.4 release asset. Source-checked joined-event automap/no automap overrides and level fallback in executable binding; PLAY0380 covers only all inside children/nested. No new render/runtime probe. Prior: Cratis/AI#769: standalone Screenplay 4.212.3 pinned; regenerated compiler contract is byte-identical to the v4.212.3 release asset. Source-checked both compilers and projection documentation for PLAY0801 DuplicateEventInProjectionScope: shared from/removal/clear set, separate join set, fresh sets per children/nested/variant level, and no two-row update through repeated from blocks with different keys. No new render/runtime probe. Prior: Cratis/AI#768: standalone Screenplay 4.212.2 pinned; regenerated compiler contract is byte-identical to the v4.212.2 release asset (unchanged from the previous contract). Source-checked v4.212.0 split-model dotted note targets, open-workspace applicationIdentity and complete add/reanchor substitutions; unbound container identities are not claimed. v4.212.1 aligns PLAY0535 collection fields, optional parameters and single-result identity inference. v4.212.2 counts read-only query denials for SPEC004, not SPEC006. No new render/runtime probe. Prior: Cratis/AI#762 and #761: source-checked v4.210.0 and v4.211.0 contracts for PLAY0800 CommandHandlerRequiresAttachment (required typed subject, permanent code-attachment requirement, other PLAY0268 families unchanged), independent reference remove/add batches, located same-text ambiguity conflicts and string MCP conflict/move-report document fields. v4.211.1 mapping changes inspected but excluded from this guidance update at the user's request; no typed PLAY0273 property/type arguments are claimed. Standalone Screenplay 4.211.1 and its compiler contract pinned; the contract is a byte-identical copy of the v4.211.1 release asset. No new render/runtime probe. Prior: Standalone 4.205.0 and byte-identical compiler contract pinned. Cratis/AI#746: Uuid ==/!= in command require and produces when (ESM v28): same-concept rule, bare Uuid against a concept, canonical literals, protected read paths in require only; PLAY0268 (different concepts, ordering, Uuid validation and concept rules, read paths in produces when) and PLAY0273 (non-canonical literal) checked against the 4.205.0 compiler, v28 selection read from the MCP executable-model view; Stage admits exact v1-v21 and v23-v26 pairs so v28 is refused STAGE-ESM-016, not probed against a Stage image; CLI 3.74.0 renders through v26. Prior: Standalone 4.204.0 and byte-identical compiler contract pinned. Cratis/AI#702 and #691: PLAY0690 reducer identity (Screenplay 4.170.0, native compiler only) and the screenplay.json validation gate (Screenplay 4.165.0; cratis screenplay validate reads it from CLI 3.65.0) are taught and probed against the 4.204.0 compiler. Cratis/AI#743: flat composite read-model keys (ESM v27): untyped projection key blocks on root from and remove with, equality-filter lists, single-instance by blocks and per-part fixtures, with PLAY0661/PLAY0662/PLAY0268 refusals checked against the 4.204.0 compiler; Stage origin/main still refuses v27 with STAGE-ESM-016 (stage-rendering.md); Stage v4.135.0 v26 admission (Host and executor run date comparisons; renderer STAGE-ESM-046) was source-checked for this sync; no render or runtime probe. Prior: Standalone 4.201.0 and byte-identical compiler contract pinned. Cratis/AI#733: the ui profile root template, shell options, appearance and new screens default (PLAY0788-PLAY0799, quick fix for the legacy layout line, ui-profiles MCP tool, 44 tools). Cratis/AI#735: chronological Date/DateTime ordering in command conditions and command/property literal validation (ESM v26), UTC tick precision and pre-rule offset validation; then matching remains ordinal. Source-checked Screenplay v4.199.0 commands, diagnostics, interoperability and specifications documentation plus decision 0087. Stage v4.127.1 still refuses v26 with STAGE-ESM-016 (stage-rendering.md and SemanticVersionFeatures.Supports); no render/runtime probe. Cratis/AI#576: prior mechanical compiler catch-up. Language batch #717/#722/#723/#724/#720/#728/#734 teaches atomic reaction batches (v22), described payload handlers (v23), portable linear matching, ordinal text rules (v24), protected command reads (v25), diagnostic arguments and event-source invokes mappings. Facts read at Screenplay v4.198.0 and introducing tags; Stage v4.127.0 admits exact v1-v21 and v23-v25 pairs but refuses v22/v26 and mixed pairs (STAGE-ESM-016), protected reads (044), atomic mode (043) and described handlers (STAGE-IMPL-002), even Stub mode. Stage text rules execute/render; no new renderer/runtime probe or Stage pin uplift. Cratis/AI#706: application navigation regions (module inherit, extend or override), toolbar slice buttons, blueprint template references and sample data packs in cratis-screenplay-ui-composition (references/application-shell.md), with the canonical shell vector and the rejection codes PLAY0710-PLAY0722 and PLAY0740-PLAY0765. Examples moved to the executable-state rules since 4.164: translator reactions in an Automation slice beside the Translate slice (PLAY0694) and the first record of a capture key appended with `when added`. Earlier: Standalone 4.164.0 and byte-identical compiler contract pinned. Cratis/AI#663: one origin per capture (PLAY0687). #668: executable no-event/redelivery v17. #684: concept query-argument validation in every version and query-error assertions v18. #681: executable refusal branches and refusal values v19. #666: proposal summary/severity counts and exact structural source proposals. Generated-concept rules select v20 with PLAY0688/0689 proofs and derived-matches repair; generated secrets and preview strategies remain refused. Release-baseline from-esm admission reads storedName. Standalone binding is not renderer admission: Stage 4.103.0 admits v1-v17 and v19; CLI 3.62.0 bundles Screenplay 4.159.0 / Stage 4.99.0 and renders through v16. Prior evidence remains unless superseded; no new renderer, Docker or browser probe."
+      "notes": "Cratis/AI#975: reviewed every release v4.246.0 through v5.1.0. Standalone 5.1.0 and its byte-identical contract pinned; the onboarding/environment contract exceptions are gone. v5.0.0: objects and lists are indented blocks (`member = value`, `item`, `none`, `empty`), inline JSON is PLAY0833, and every skill example uses the block form. v4.246.0 (decision 0115): a specification runs only its own slice; command specifications state their own events, automations state cross-slice hand-overs with `then invokes` (ESM v34), and every cross-slice expectation in the examples moved to the producing slice. v4.248.0: action subjects `for item`/`for screen` with PLAY0817-PLAY0821; every example action states its subject by intent. v4.250.0 (decision 0117): attached handlers beside unconditional produces with a resolved body bind as the v23 result contract; PLAY0800 only for the remaining shapes; PLAY0035 retired. v4.254.0: `$eventContext.occurred` runs in scoped projections for facts appended under `given clock` (probed on the 5.1.0 tool; a `given` fact carries none). v4.257.0: PLAY0824/PLAY0825 preferred-syntax rows. v5.1.0: `statemachine` and `workflow` (ESM v36) taught with a compiled, passing example; Stage 4.214.0 refuses v36. Cratis.Orleans engine hosting remains Cratis/AI#972. Editor-only, host-provider and board releases need no teaching change. Prior: Cratis/AI#820: reviewed v4.245.0 release; protected-read constraint precedence preserved. Review correction: removed unsupported parser-repair and inbound-public refusal release attributions and the incorrect PLAY0136 event-key claim, restoring prior teaching. Published contract asset is byte-identical to the previous snapshot; pin and compatibility entry advanced together. Prior: Cratis/AI#779: reference-runner capability refusals taught as scoped per specification (introduced in v4.213.2, Cratis/Screenplay#897) from the v4.216.0 tool and MCP documentation and plan source: an unadmitted projection (UnsupportedEventContext, UnsupportedProjectionBlock) marks unsupported only the specifications that reach it or its read model, the others run and planIssues lists deferred issues; application-level issues still block every selected specification; no new render/runtime probe. Prior: Cratis/AI#776: PLAY0802 ReservedStoredName (introduced in v4.213.3, Cratis/Screenplay#893) taught from the v4.216.0 compilers and documentation: stored event source `Default` and stored event stream `All` (ordinal, name or `id` pin) refused at authoring time, a pin away from the reserved name valid, PLAY0273 kept as the binding backstop; no new render/runtime probe. Prior: Cratis/AI#784: standalone Screenplay 4.216.0 pinned; compiler contract replaced by the v4.216.0 release asset (adds the propose-repair destinationIntent v1 schema and PLAY0802 ReservedStoredName). Source-checked decision 0096 and the MCP reference for the explicit author-intent PLAY0470 repair: repair-intents discovery, intentActions feature detection, complete per-production selections, retained production-destination report and identity views, explicit apply and refusals. No new render/runtime probe. Prior: Cratis/AI#771: standalone Screenplay 4.213.0 pinned; regenerated compiler contract is byte-identical to the v4.213.0 release asset and unchanged from 4.212.4. Reviewed the full v4.212.4-v4.213.0 delta against tagged decision 0093 and MCP reference: pre-binding container identities and stable binding/migration continuity, own-slice member substitutions, containerIdentities completeness/ambiguity/collision refusals, retained ambiguous notes, explicit semanticRenames/retirements, binding fixes through MCP, exact reopen exception, notes/identity rollback and exact-ID re-add anchoring. No grammar, binder, ESM or diagnostic-code changes; no new render/runtime probe. Prior: Cratis/AI#772: standalone Screenplay 4.212.4 pinned; regenerated compiler contract is byte-identical to the v4.212.4 release asset. Source-checked joined-event automap/no automap overrides and level fallback in executable binding; PLAY0380 covers only all inside children/nested. No new render/runtime probe. Prior: Cratis/AI#769: standalone Screenplay 4.212.3 pinned; regenerated compiler contract is byte-identical to the v4.212.3 release asset. Source-checked both compilers and projection documentation for PLAY0801 DuplicateEventInProjectionScope: shared from/removal/clear set, separate join set, fresh sets per children/nested/variant level, and no two-row update through repeated from blocks with different keys. No new render/runtime probe. Prior: Cratis/AI#768: standalone Screenplay 4.212.2 pinned; regenerated compiler contract is byte-identical to the v4.212.2 release asset (unchanged from the previous contract). Source-checked v4.212.0 split-model dotted note targets, open-workspace applicationIdentity and complete add/reanchor substitutions; unbound container identities are not claimed. v4.212.1 aligns PLAY0535 collection fields, optional parameters and single-result identity inference. v4.212.2 counts read-only query denials for SPEC004, not SPEC006. No new render/runtime probe. Prior: Cratis/AI#762 and #761: source-checked v4.210.0 and v4.211.0 contracts for PLAY0800 CommandHandlerRequiresAttachment (required typed subject, permanent code-attachment requirement, other PLAY0268 families unchanged), independent reference remove/add batches, located same-text ambiguity conflicts and string MCP conflict/move-report document fields. v4.211.1 mapping changes inspected but excluded from this guidance update at the user's request; no typed PLAY0273 property/type arguments are claimed. Standalone Screenplay 4.211.1 and its compiler contract pinned; the contract is a byte-identical copy of the v4.211.1 release asset. No new render/runtime probe. Prior: Standalone 4.205.0 and byte-identical compiler contract pinned. Cratis/AI#746: Uuid ==/!= in command require and produces when (ESM v28): same-concept rule, bare Uuid against a concept, canonical literals, protected read paths in require only; PLAY0268 (different concepts, ordering, Uuid validation and concept rules, read paths in produces when) and PLAY0273 (non-canonical literal) checked against the 4.205.0 compiler, v28 selection read from the MCP executable-model view; Stage admits exact v1-v21 and v23-v26 pairs so v28 is refused STAGE-ESM-016, not probed against a Stage image; CLI 3.74.0 renders through v26. Prior: Standalone 4.204.0 and byte-identical compiler contract pinned. Cratis/AI#702 and #691: PLAY0690 reducer identity (Screenplay 4.170.0, native compiler only) and the screenplay.json validation gate (Screenplay 4.165.0; cratis screenplay validate reads it from CLI 3.65.0) are taught and probed against the 4.204.0 compiler. Cratis/AI#743: flat composite read-model keys (ESM v27): untyped projection key blocks on root from and remove with, equality-filter lists, single-instance by blocks and per-part fixtures, with PLAY0661/PLAY0662/PLAY0268 refusals checked against the 4.204.0 compiler; Stage origin/main still refuses v27 with STAGE-ESM-016 (stage-rendering.md); Stage v4.135.0 v26 admission (Host and executor run date comparisons; renderer STAGE-ESM-046) was source-checked for this sync; no render or runtime probe. Prior: Standalone 4.201.0 and byte-identical compiler contract pinned. Cratis/AI#733: the ui profile root template, shell options, appearance and new screens default (PLAY0788-PLAY0799, quick fix for the legacy layout line, ui-profiles MCP tool, 44 tools). Cratis/AI#735: chronological Date/DateTime ordering in command conditions and command/property literal validation (ESM v26), UTC tick precision and pre-rule offset validation; then matching remains ordinal. Source-checked Screenplay v4.199.0 commands, diagnostics, interoperability and specifications documentation plus decision 0087. Stage v4.127.1 still refuses v26 with STAGE-ESM-016 (stage-rendering.md and SemanticVersionFeatures.Supports); no render/runtime probe. Cratis/AI#576: prior mechanical compiler catch-up. Language batch #717/#722/#723/#724/#720/#728/#734 teaches atomic reaction batches (v22), described payload handlers (v23), portable linear matching, ordinal text rules (v24), protected command reads (v25), diagnostic arguments and event-source invokes mappings. Facts read at Screenplay v4.198.0 and introducing tags; Stage v4.127.0 admits exact v1-v21 and v23-v25 pairs but refuses v22/v26 and mixed pairs (STAGE-ESM-016), protected reads (044), atomic mode (043) and described handlers (STAGE-IMPL-002), even Stub mode. Stage text rules execute/render; no new renderer/runtime probe or Stage pin uplift. Cratis/AI#706: application navigation regions (module inherit, extend or override), toolbar slice buttons, blueprint template references and sample data packs in cratis-screenplay-ui-composition (references/application-shell.md), with the canonical shell vector and the rejection codes PLAY0710-PLAY0722 and PLAY0740-PLAY0765. Examples moved to the executable-state rules since 4.164: translator reactions in an Automation slice beside the Translate slice (PLAY0694) and the first record of a capture key appended with `when added`. Earlier: Standalone 4.164.0 and byte-identical compiler contract pinned. Cratis/AI#663: one origin per capture (PLAY0687). #668: executable no-event/redelivery v17. #684: concept query-argument validation in every version and query-error assertions v18. #681: executable refusal branches and refusal values v19. #666: proposal summary/severity counts and exact structural source proposals. Generated-concept rules select v20 with PLAY0688/0689 proofs and derived-matches repair; generated secrets and preview strategies remain refused. Release-baseline from-esm admission reads storedName. Standalone binding is not renderer admission: Stage 4.103.0 admits v1-v17 and v19; CLI 3.62.0 bundles Screenplay 4.159.0 / Stage 4.99.0 and renders through v16. Prior evidence remains unless superseded; no new renderer, Docker or browser probe."
     },
     {
       "id": "scene",

package/package/corpus/skills/cratis-application-slice-conformance/SKILL.md

@@ -44,7 +44,7 @@ This skill is a method: it names no API of its own. When the Screenplay skills a
 | --- | --- |
 | Where each rule lives (validator, `Provide()`, handler result, constraint, exception) | `rules/vertical-slices.md` "The decision matrix"  |
 | A customization never makes a rejected model renderable; managed output is never hand-edited | Stage (`Customizations/` is the unmanaged seam; managed output is regenerated) |
-| Attached file or inline command handlers are refused with PLAY0800, a permanent requirement for a code implementation attachment (Requires Screenplay 4.210.0; older binders report PLAY0268); pending handlers with unconditional productions bind v23 as described commands, but reached bodies are Unsupported ImplementationBody and Stage refuses STAGE-IMPL-002 even in Stub mode | Screenplay and Stage; use the model as the gap-fill contract |
+| Attached file or inline command handlers bind beside unconditional `produces` with a resolved body (Screenplay 4.250.0) and are otherwise refused with PLAY0800 (4.210.0 to 4.249.x refuse every attached handler; older binders report PLAY0268); pending handlers with unconditional productions bind v23 as described commands, but reached bodies are Unsupported ImplementationBody and Stage refuses STAGE-IMPL-002 even in Stub mode | Screenplay and Stage; use the model as the gap-fill contract |
 
 ## Procedure
 

package/package/corpus/skills/cratis-arc-react-page/references/from-screenplay.md

@@ -83,9 +83,9 @@ module Marina
       screen BerthListScreen
         title "Berths"
         data BerthListView[] via query ListBerths
-        action BookBerth
+        action BookBerth for screen
           label "Book a berth"
-        action CancelBerth
+        action CancelBerth for item
         table BerthListView
           column boatName label "Boat"
           on row-click navigate to BerthDetailsScreen by berthId
@@ -94,7 +94,7 @@ module Marina
         data BerthListView via query GetBerth by berthId
         summary BerthListView
           field boatName label "Boat"
-        action CancelBerth
+        action CancelBerth for item
           navigate to BerthListScreen
 
   form BookBerthForm for BookBerth
@@ -119,8 +119,8 @@ field because `berthId` is the identifier, not something the user types.
 | `table BerthListView` with `column boatName label "Boat"` | `<DataPage.Columns><Column field='boatName' header='Boat' /></DataPage.Columns>`; one `Column` per modeled `column`, no extras | Verified |
 | A second `table` on one screen | `DataTableForQuery` / `DataTableForObservableQuery` ([data-tables.md](data-tables.md)) | Verified |
 | `summary BerthListView` with `field boatName label "Boat"` | Plain markup in the page or in `detailsComponent` (`{ item }`), one labelled line per modeled `field` | Gap: this skill's verified sources name no summary component |
-| `action BookBerth` with `label "Book a berth"` | `<MenuItem label='Book a berth' icon={...} command={() => showBookBerth()} />` plus `CommandDialog` and `useDialog` | Verified |
-| `action CancelBerth` on a list with a table | `MenuItem` with `disableOnUnselected`; the selected row supplies the identifier | Verified prop |
+| `action BookBerth for screen` with `label "Book a berth"` | `<MenuItem label='Book a berth' icon={...} command={() => showBookBerth()} />` plus `CommandDialog` and `useDialog`; no row fills its inputs | Verified |
+| `action CancelBerth for item` on a list with a table | `MenuItem` with `disableOnUnselected`; the selected row supplies the identifier | Verified prop |
 | `action` with no `label` | The model gives no text. Use the command name, spaced, and report it | Gap |
 | `action X` with `navigate to S [by p]` | Navigate to the page for `S` after the command succeeds, in `onSuccess`; pass `p` from the response or the row | Assumption: `screens.md` does not say when it navigates. The form's `on submit` is defined as "after a successful submit"; confirm with the model owner |
 | `on row-click navigate to S by p` | `DataPage` and `DataTableForQuery` forward no row-click prop (only `DataTableCore` has `onRowClick`, and it takes rows, not a query). Use controlled `selection` and `onSelectionChange` to navigate, or a link in a `Column` `body` | Gap: selection is not a click; report which you chose |

package/package/corpus/skills/cratis-onboarding-runtime/SKILL.md

@@ -13,7 +13,7 @@ that read one contract, produced from the model and a Cratis environment:
 |---|---|---|
 | **AuthProxy** | The only public entry point; signs people in with the model's providers. | `Cratis:AuthProxy:Application` (see the AuthProxy reference of `cratis-arc-authentication-authorization-and-identity`). |
 | **Ante** | **One per application.** Signs invitation tokens, serves the lobby, records acceptance and legal terms, publishes to its outbox. | `Ante:Onboarding:*`. |
-| **Herald** | Sends the invitation and welcome emails from the application (the declined template waits for an Ante outcome). | `cratis-showrunner-herald`. |
+| **Herald** | Sends the invitation and welcome emails from the application (including the declined sign-up email). | `cratis-showrunner-herald`. |
 
 Nobody writes the equivalent `Ante:*` or `Cratis:AuthProxy:*` keys by hand for a Screenplay
 application. The model supplies structure (providers, personas, invitation types, legal files);
@@ -29,7 +29,7 @@ persona and invitation-type checks. The **application** owns the persona list (t
 invited, link delivery, membership and provisioning. Ante sends no email: the application sends
 the invitation link through Herald using the `InvitationTokenIssued` token. Every accepted fact
 (`InvitationToJoinTenantAccepted`, `InvitationToCreateTenantAccepted`,
-`OrganizationRegistrationCompleted`, `LegalTermsAccepted`) means **published to Ante's outbox, not
+`OrganizationRegistrationCompleted`, `OrganizationRegistrationDeclined`, `LegalTermsAccepted`) means **published to Ante's outbox, not
 provisioned**: make provisioning idempotent by event source id and event kind. Ante does not know
 what a persona may do; it validates grantable personas against the configured list only.
 
@@ -46,6 +46,12 @@ for the table before configuring anything.
 - Legal terms are files in a mounted folder (`terms.md`, `privacy.md`). The version is a content hash, so editing either file requires everyone onboarding afterwards to accept again. Archive each version for consent audit; the bodies live in your files.
 - **Secrets** (the signing private key, pinned attestation public keys) arrive only as mounted files or standard configuration, never on the command line; Ante logs no value.
 
+## Sign-up review and the default offering
+
+- **Sign-up review** is opt-in (`Ante:Registration:Review`, off by default): Ante holds each sign-up until the host decides. Read [sign-up review](references/sign-up-review.md) before turning it on or handling `OrganizationRegistrationAwaitingReview`.
+- **The default offering** starts each new tenant on the offer the product declared, through Box Office. Read [default offering](references/default-offering.md) before wiring `IDefaultOffering` or diagnosing a tenant without seats or modules.
+- `InvitationRejected` is a host configuration problem, never a message to the invitee; only `OrganizationRegistrationDeclined` says a person was turned down.
+
 ## Development mode is for local runs only
 
 `Ante:Onboarding:Development:Enabled=true` generates a 2048-bit RSA signing key per data volume and
@@ -76,6 +82,7 @@ with its AuthProxy when the application has `authentication` and its own Ante wh
 - Treating `Accepted` as provisioned: provisioning is the application's, and must be idempotent.
 - Setting a signing key or provider secret as an environment variable in a manifest: use the mounted files.
 - Two Ante instances for one application, or one Ante shared by several Performances: one Ante per Performance, with its own event store (`ante-<name>` by default).
+- Answering `InvitationRejected` with a message to the invitee: fix the invitation or host configuration instead.
 - Using development mode in a shared cluster: Ante refuses; do not work around the guard.
 
 ## Verify
@@ -90,5 +97,6 @@ with its AuthProxy when the application has `authentication` and its own Ante wh
 - The model's `onboarding` block and environment keys: `cratis-screenplay-authentication-and-onboarding`.
 - Environment commands and secrets providers: `cratis-environments-and-secrets`.
 - Sending the emails: `cratis-showrunner-herald`.
+- Box Office offers, seats and entitlements beyond the default offering: Showrunner's Box Office documentation; this corpus covers only starting a tenant on the default offering.
 - Ante used by a host product, not a Screenplay application: Ante's own documentation; this corpus does not cover it.
 - Chronicle itself in a cluster: `cratis-chronicle-hosting`.

package/package/corpus/skills/cratis-onboarding-runtime/references/default-offering.md

@@ -0,0 +1,61 @@
+# Default offering
+
+Requires Showrunner 1.13.0 or later (`Cratis.Showrunner.BoxOffice`) for `DefaultOffering`,
+`IDefaultOffering` and an event store taken from the host. Older releases have neither.
+
+A product that sells itself starts a new tenant on its default offering without waiting for the
+operator. The product decides, the operator is told, and a later operator decision replaces it.
+
+## Declare it
+
+```csharp
+builder.Services.AddBoxOfficeOffering(offering => offering
+    .Product(productId)
+    .Seats(SeatLicensing.PerUser)
+    .DefaultOffering("Starter"));
+```
+
+The name is the offer in the operator's catalog. The declaration is reported once per change as
+`DefaultOfferingDeclared`, so the operator knows which offer new tenants start on. A declaration
+that cannot be sold throws `InvalidOffering` at startup, one sentence per problem.
+
+## Start a tenant
+
+Call `IDefaultOffering.StartTenant(tenant, organization)` when the product has created the tenant.
+It finds the named offer among the offers the operator published and does two things:
+
+- records `TenantStartedOnDefaultOffering` in the tenant's own stream, so the tenant has the offer's
+  included seats and modules at once, with no trial;
+- publishes `TenantStartedOnOffer` to the operator, with the offer's name, included seats and
+  modules.
+
+A later operator decision such as `SeatCapacitySet` or `ModuleRevoked` supersedes what the tenant
+started with: the newest decision wins.
+
+## Failures
+
+| Failure | Meaning | Action |
+|---|---|---|
+| `DefaultOfferingNotDeclared` | The product declared no default offering. | Add `DefaultOffering(...)`. |
+| `DefaultOfferingNotPublished` | The operator has not published an offer with that name, or withdrew it. The name compares ignoring case. | Publish the offer; retry. |
+| `TenantNotStarted` | The tenant could not be started. | Read the reason; retry. |
+
+The catalog arrives after the product starts, so a name is checked when a tenant starts, not at
+startup. Nothing is published on a failure. Starting the same tenant again, also from another
+instance, returns `TenantStart.AlreadyStarted` and publishes nothing; if the product stopped
+between the two facts, starting again completes what is missing. A different default later does
+not restart a tenant.
+
+## Event store
+
+Herald, Box Office and the offering record in the host application's own event store in a host set
+up with `AddCratis` or `AddCratisChronicle`; nothing needs naming. Set `HeraldOptions.EventStore`,
+`BoxOfficeOptions.EventStore` or `OfferingOptions.EventStore` only to use another store. A host that
+registers only the Chronicle client uses the name in `ChronicleClientOptions.EventStore`.
+
+## Verify
+
+1. After the operator publishes the offer, `StartTenant` for a new tenant publishes
+   `TenantStartedOnOffer`; a second call returns `TenantStart.AlreadyStarted`.
+2. Before the offer is published, `StartTenant` throws `DefaultOfferingNotPublished` and publishes
+   nothing.

package/package/corpus/skills/cratis-onboarding-runtime/references/sign-up-review.md

@@ -0,0 +1,52 @@
+# Sign-up review
+
+Requires Ante 1.6.0 or later (`Ante:Registration:Review`, `RegistrationReview` in the onboarding
+contract). Older releases complete every sign-up without a decision and publish neither event
+below.
+
+Review is off by default and changes nothing while off. Turn it on when a person must be approved
+before an organization is created.
+
+## Flow
+
+1. A person finishes the sign-up. With review on, Ante accepts it but holds it: no
+   `OrganizationRegistrationCompleted` is published and the registration is not complete.
+2. Ante publishes `OrganizationRegistrationAwaitingReview` to its outbox, once per registration, on
+   the registration id. It carries the same details `OrganizationRegistrationCompleted` would carry:
+   the organization name asked for, the contact address (can be empty, never verified), the names,
+   the sign-in subject and provider, and the untrusted sign-up context.
+3. The host shows the sign-up to its reviewers. Ante has no administrator screen and takes no
+   decision itself.
+4. The host appends one of these to **its own store's outbox**, with the registration id as the
+   event source id:
+   - `OrganizationRegistrationApproved`: Ante completes the registration as it would have without
+     review and publishes `OrganizationRegistrationCompleted`.
+   - `OrganizationRegistrationDeclineRequested(Message)`: Ante publishes
+     `OrganizationRegistrationDeclined` with the contact address, the name the person gave and the
+     reviewer's message. `Message` is required; a blank one is refused and nothing is published.
+
+## Rules
+
+- A registration is decided once. A decision for a registration that was completed, was already
+  declined or was never held is ignored, so redelivery is safe and a completed registration is
+  never declined afterwards.
+- Deduplicate `OrganizationRegistrationAwaitingReview` by registration id, like every Ante outcome:
+  delivery is at least once.
+- If an approved registration's organization name was claimed by someone else while it waited, it
+  stays held and Ante logs a warning. Decline it with a message instead.
+- While a sign-up is held the lobby tells the person it is waiting for review; after a decline it
+  says the sign-up was not approved, stops polling and offers no second submission.
+- Ante emails no one. The host sends the person the declined message from
+  `OrganizationRegistrationDeclined` (Herald, `signupDeclined` template with `decline.message`).
+- `OrganizationRegistrationDeclined` is the only outcome that says a person was turned down.
+  `InvitationRejected` says an invitation did not match what the host allows; treat it as a
+  configuration problem for whoever issued the invitation.
+
+## Verify
+
+1. With review on, a sign-up produces `OrganizationRegistrationAwaitingReview` and no
+   `OrganizationRegistrationCompleted`.
+2. Appending `OrganizationRegistrationApproved` on the registration id produces
+   `OrganizationRegistrationCompleted`; appending it again produces nothing.
+3. A decline request with a blank message publishes nothing; with a message it publishes
+   `OrganizationRegistrationDeclined` once.

package/package/corpus/skills/cratis-screenplay-authentication-and-onboarding/SKILL.md

@@ -69,7 +69,7 @@ block. The diagnostics for each rule are in that reference. The rules that decid
   `signup open creates tenant` makes a signup create a tenant, `signup open joins tenant` asks to join an existing one.
 - Every persona in `as`, `by` and `grant` must be declared with `persona`; there are no free-text roles.
 - `emails` names only `invitation`, `welcome` and `signupDeclined`. The sender and mail server are not in the model.
-- `file` paths are repository-relative, like handler files. `offering` is an opaque name resolved where the application is provisioned.
+- `file` paths are repository-relative, like handler files. `offering` is the name of an offer the operator publishes in Box Office; a rendered application starts each new tenant on it. `signupDeclined` is sent when the host declines a held sign-up (review is not modeled; see `cratis-onboarding-runtime`).
 
 ## Environment keys
 

package/package/corpus/skills/cratis-screenplay-authentication-and-onboarding/references/onboarding-directives.md

@@ -66,7 +66,7 @@ Syntax and meaning of each line of the `onboarding` block. All lines are optiona
 | `invite tenant` | `invite tenant as <Persona>` | An invitation that creates a tenant; the invitee becomes the persona in it. One line, no body. |
 | `invite member` | body with `by <Persona>, ...` and `grant <Persona>, ...` | An invitation into an existing tenant. `by` lists who may send it, `grant` what the invitee is given. Both are required. |
 | `legal terms` | body of `file <path>` lines | Documents a newcomer must accept. Present means acceptance is required. |
-| `offering` | `offering <Id>` | The offering a new tenant starts on. Opaque; absent means no licensing. |
+| `offering` | `offering <Id>` | The Box Office offer a new tenant starts on. Absent means no licensing. |
 | `emails` | body of `<email> file <path>` lines and `images <folder>` | Templates for `invitation`, `welcome` and `signupDeclined`, and the folder they take images from. |
 
 ## What the block deliberately lacks

package/package/corpus/skills/cratis-screenplay-automations-and-translations/SKILL.md

@@ -95,7 +95,12 @@ another version behaves the same.
 
 ## When / when not
 - Use: "when X happens, then ...", schedules, retries, work queues, notifications, webhooks, APIs,
-  files or message feeds, events imported from another context, legacy sync.
+  files or message feeds, events imported from another context, legacy sync, lifecycles and
+  longer processes.
+- A lifecycle (where one thing is and what moves it on) is a `statemachine`; a process that
+  sends several commands, waits, asks for approval or gives up after a deadline is a
+  `workflow` (ESM v36). Read
+  [state machines and workflows](references/statemachines-and-workflows.md) before modeling either.
 - Not for: reaction, trigger or CDL grammar (`cratis-screenplay-captures-and-reactions`); stream
   identity and invariants (`cratis-screenplay-streams-and-consistency`); UI interactions such as
   `on click` (`cratis-screenplay-ui-composition`); hand-written reactors (`cratis-chronicle-reactor`).

package/package/corpus/skills/cratis-screenplay-automations-and-translations/references/automation-patterns.md

@@ -13,7 +13,7 @@
 - 9. Fan-out
 - 10. Long-running process shapes
 
-Complete compiled example: `todo-list-example.md` (binds as ESM v6; the list query
+Complete compiled example: `todo-list-example.md` (binds as ESM v34 for `then invokes`; the list query
 excerpt binds too, and the retry sweep that needs code is shown as a marked excerpt).
 
 ## 1. Deciding whether it is an automation

package/package/corpus/skills/cratis-screenplay-automations-and-translations/references/cases-to-specify.md

@@ -63,11 +63,11 @@ One spec in the slice does not cover the others.
 - Current admitted Automation/Translate specifications run through standalone
   `screenplay test` or MCP `run-specifications`. Validate/render alone is not V4;
   report unsupported/unbound separately from passing scenarios.
-- A command spec lists the cascade (v6 semantics: after
-  `when <Command>`, `then` lists every new fact, including reaction appends). Only when the V1
-  tool's compiler stops before v6 does it report a false PLAY0285 on a cascade:
-  then keep the cascade out of the command spec, specify it in the Automation slice
-  (`when append <Trigger>`) and record the expectation. See `cratis-screenplay-scenario-coverage`.
+- A specification runs only its own slice (Screenplay decision 0115). A command spec
+  states the command's own events; the Automation states what its reaction appends in
+  its own `when append <Trigger>` spec, and a command it invokes in another slice with
+  `then invokes <Command>` (ESM v34). Another slice's event in a spec is PLAY0285
+  (unreachable). See `cratis-screenplay-scenario-coverage`.
 - `given capture` never persists between specs: state the baseline in each record
   update spec. First records (root, child, nested) are added only; field-change
   `and`/`or` and transitions need previous state. Expressions/maps/unguarded record

package/package/corpus/skills/cratis-screenplay-automations-and-translations/references/statemachines-and-workflows.md

@@ -0,0 +1,164 @@
+# State machines and workflows (ESM v36)
+
+## Contents
+
+- Which construct
+- Complete example
+- Specifications
+- Diagnostics and targets
+
+Requires Screenplay 5.1.0 or later (`screenplay --version`). Sources: Screenplay
+`Documentation/screenplay/statemachines.md`, `workflows.md` and decision 0124.
+
+## Which construct
+
+| The domain says | Model |
+| --- | --- |
+| "When X happens, do Y", one step | An `Automation` slice with a reaction |
+| Where one thing is in its lifecycle, and what moves it on | A `statemachine` that follows the thing's read model |
+| A longer process: several commands, a choice, a wait for a fact or a person, a deadline, a fan-out | A `workflow` with one run per subject |
+
+A state machine never decides on commands: it follows facts that already happened. Entering
+a state may `send` a command or `start` a workflow; both may run again on redelivery, so the
+command or workflow must be safe to repeat. A workflow is how a process waits, retries, asks
+for approval and gives up; do not chain reactions across slices to imitate one.
+
+Both are top-level declarations, siblings of `trigger` and `policy`. They name commands,
+events, read models and personas declared in slices of any module. A model that declares one
+selects ESM v36.
+
+## Complete example
+
+This model compiles with `--warnaserror` and its three specifications pass with
+`screenplay test`:
+
+```screenplay
+concept InvoiceId : Uuid
+persona FinanceController
+module Billing
+  feature Invoices
+    slice StateChange SendInvoice
+      command SendInvoice
+        invoiceId InvoiceId identifier
+        produces event InvoiceSent
+    slice StateChange MarkOverdue
+      command MarkOverdue
+        invoiceId InvoiceId identifier
+        produces event InvoiceMarkedOverdue
+    slice StateChange PayInvoice
+      command PayInvoice
+        invoiceId InvoiceId identifier
+        produces event InvoicePaid
+    slice StateChange SendReminder
+      command SendReminder
+        invoiceId InvoiceId identifier
+        produces event ReminderSent
+    slice StateChange WriteOffInvoice
+      command WriteOffInvoice
+        invoiceId InvoiceId identifier
+        produces event InvoiceWrittenOff
+    slice StateView InvoiceStatus
+      readmodel Invoice
+        invoiceId InvoiceId key
+        status String
+      projection Invoices => Invoice
+        from InvoiceSent
+          invoiceId = $eventSourceId
+          status = "sent"
+        from InvoiceMarkedOverdue
+          status = "overdue"
+        from InvoicePaid
+          status = "paid"
+      query InvoiceById => Invoice optional
+        by invoiceId InvoiceId
+
+statemachine InvoiceLifecycle
+  description "Where an invoice is, from sent to settled"
+  follows Invoice
+  state Sent initial
+    on InvoiceMarkedOverdue -> Overdue
+    on InvoicePaid -> Paid
+  state Overdue
+    entering start CollectOverdue
+    on InvoicePaid -> Paid
+    on InvoiceWrittenOff -> WrittenOff
+  state Paid final
+  state WrittenOff final
+
+  specification GoingOverdueStartsCollection
+    given InvoiceSent
+      for "9c858901-8a57-4791-81fe-4c455b099bc9"
+    when append InvoiceMarkedOverdue
+      for "9c858901-8a57-4791-81fe-4c455b099bc9"
+    then is Overdue
+    then starts CollectOverdue
+
+workflow CollectOverdue
+  description "Reminds the customer, waits for payment and asks finance before writing off"
+  for Invoice
+  trigger when InvoiceLifecycle enters Overdue
+    -> Remind
+  action Remind sends SendReminder
+    next -> AwaitPayment
+  wait AwaitPayment for InvoicePaid expires after 14 days
+    expired -> ApproveWriteOff
+  approval ApproveWriteOff by FinanceController expires after 7 days
+    approved -> WriteOff
+  action WriteOff sends WriteOffInvoice
+
+  specification AnUnpaidInvoiceIsWrittenOff
+    given InvoiceSent
+      for "9c858901-8a57-4791-81fe-4c455b099bc9"
+    when append InvoiceMarkedOverdue
+      for "9c858901-8a57-4791-81fe-4c455b099bc9"
+    outcome AwaitPayment expired
+    outcome ApproveWriteOff approved
+    then sends SendReminder
+    then sends WriteOffInvoice
+    then completes
+
+  specification TheRunWaitsForPayment
+    given InvoiceSent
+      for "9c858901-8a57-4791-81fe-4c455b099bc9"
+    when append InvoiceMarkedOverdue
+      for "9c858901-8a57-4791-81fe-4c455b099bc9"
+    then sends SendReminder
+    then waits at AwaitPayment
+```
+
+- `follows Invoice` / `for Invoice`: the read model whose key is one instance (one run per
+  invoice). A transition condition (`on E when <condition> -> S`) reads that read model after
+  the event; a condition over an optional property is refused at binding.
+- Exactly one `initial` state; a `final` state has no transitions. An event takes the first
+  transition on it, in declaration order across the whole machine, whose condition holds and
+  whose target the current state allows. Anything else is ignored, not an error.
+- Workflow nodes: `trigger` (`on <Event>`, `when <StateMachine> enters <State>`, `every`,
+  `at`, `manual`), `action <Name> sends <Command> [attempts n] [timeout] [retry after]`,
+  `decide <Name> when <condition>` with exactly two outlets, `wait` for an event or a
+  duration, `approval <Name> by <Persona or Policy>`, `foreach <Name> over <collection>` and
+  `join all|any|at least n`. Edges are `<outlet> -> <Node>` under their node.
+- An unconnected negative outlet (`failed`, `rejected`, `expired`) fails the run; an
+  unconnected positive outlet ends that branch. Give every event wait and approval an
+  `expires after` (PLAY0849 warns otherwise).
+
+## Specifications
+
+| Construct | Lines |
+| --- | --- |
+| `statemachine` | `given <Event>`, `when append <Event>`, `then is <State>`, `then sends <Command>`, `then starts <Workflow>` (every command and workflow, in order) |
+| `workflow` | `given <Event>`, `when append <Event>` or `when start <key>`, `outcome <Node> <outlet>`, `then sends <Command>` (every one, in order), `then completes`, `then fails at <Node>`, `then waits at <Node>` |
+
+The reference evaluator steps the run deterministically. A wait or approval with no stated
+`outcome` suspends the run (`then waits at`); an action defaults to `next`; a wait for a
+duration resumes at once.
+
+## Diagnostics and targets
+
+- State machines: PLAY0834-PLAY0842 (missing or duplicate `initial` is PLAY0835, an
+  unreachable state warns PLAY0836, an undeclared reference is PLAY0840).
+- Workflows: PLAY0843-PLAY0851 (no trigger is PLAY0844, a bad outlet PLAY0847, a decision
+  without exactly two outlets PLAY0848, an undeclared reference PLAY0851); PLAY0839 and
+  PLAY0841 are shared.
+- Stage refuses ESM v36 models with `STAGE-ESM-016`; every other model renders as
+  before. The durable engine is Cratis.Orleans; its hosting and adapters are outside this
+  reference.

package/package/corpus/skills/cratis-screenplay-automations-and-translations/references/todo-list-example.md

@@ -5,14 +5,15 @@
 - Design-only additions
 
 A complete model: a result opens a work item, a reaction invokes a command, the command's fact
-closes the item. It binds as ESM v6 (`executableReady: true`), standalone and through `cratis screenplay mcp`.
-Stage renders supported event reactions, but this model's clock/cascade specs remain
-refused (`-024`/`-011`); keep them intact. A compiler that stops before v6 rejects the
-Automation slice at binding with PLAY0285 or PLAY0268. Versions: `cratis-screenplay-toolchain` `SKILL.md`.
-
-The first spec lists the whole cascade (`then` names every new fact: `CoursePassed`, and
-`CertificateSent` through the reaction), and `given clock` supplies the instant that
-`$context.occurred` needs. Both tools accept that cascade when they admit v6; an older compiler reports a false PLAY0285 on it.
+closes the item. `then invokes` selects ESM v34 (`executableReady: true` from Screenplay 4.246.0),
+standalone and through `cratis screenplay mcp`. The Stage spec runner compares `then invokes`, but the
+Cratis renderer refuses models after v33 with `STAGE-ESM-016`; keep the specifications intact. A compiler
+that stops before v34 refuses `then invokes`. Versions: `cratis-screenplay-toolchain` `SKILL.md`.
+
+Each specification states only its own slice (Screenplay decision 0115): `RecordingAPass`
+states `CoursePassed`, `SendingAfterAPass` states the hand-over with `then invokes
+SendCertificate` (ESM v34), and `SendingACertificate` states `CertificateSent`. `given clock`
+supplies the instant that `$context.occurred` needs.
 Current admitted scenarios can be run with
 standalone `screenplay test` or MCP `run-specifications`.
 
@@ -58,7 +59,7 @@ module Courses
           CoursePassed
             for enrolmentId
             enrolmentId = enrolmentId          // copied on purpose: the reaction selects it as a value
-            completedAt = $context.occurred    // carried on the fact: a projection cannot read $eventContext.occurred
+            completedAt = $context.occurred    // carried on the fact, so every reader sees the same instant
         produces when passed == false
           CourseFailed
             for enrolmentId
@@ -81,9 +82,6 @@ module Courses
           for "0d3b9e2a-6c4f-4f1e-8b7a-5e2d1c3b4a01"
           enrolmentId = "0d3b9e2a-6c4f-4f1e-8b7a-5e2d1c3b4a01"
           completedAt = "2026-10-05T08:00:00Z"
-        then CertificateSent
-          for "0d3b9e2a-6c4f-4f1e-8b7a-5e2d1c3b4a01"
-          sentAt = "2026-10-05T08:00:00Z"
       specification RefusingANonCoordinator
         given caller
           authenticated
@@ -180,9 +178,8 @@ module Certification
           for "0d3b9e2a-6c4f-4f1e-8b7a-5e2d1c3b4a01"
           enrolmentId = "0d3b9e2a-6c4f-4f1e-8b7a-5e2d1c3b4a01"
           completedAt = "2026-10-05T08:00:00Z"
-        then CertificateSent
-          for "0d3b9e2a-6c4f-4f1e-8b7a-5e2d1c3b4a01"
-          sentAt = "2026-10-05T08:00:00Z"
+        then invokes SendCertificate
+          enrolmentId = "0d3b9e2a-6c4f-4f1e-8b7a-5e2d1c3b4a01"
 ```
 
 ## Design-only additions

package/package/corpus/skills/cratis-screenplay-automations-and-translations/references/translate-example.md

@@ -93,9 +93,6 @@ module Exams
           for "7e9d1c2b-4a3f-4e5d-8c6b-1a2b3c4d5e06"
           outcome = "passed"
           score   = 87
-        then ExamPassed
-          for "7e9d1c2b-4a3f-4e5d-8c6b-1a2b3c4d5e06"
-          score = 87
     slice Automation RecordExamResult
       reaction PassTranslator
         when ProctorResultReceived
@@ -115,6 +112,14 @@ module Exams
       constraint OneResultPerAttempt
         unique event ExamPassed
         unique event ExamFailed
+      specification RecordingAPass
+        when append ProctorResultReceived
+          for "7e9d1c2b-4a3f-4e5d-8c6b-1a2b3c4d5e06"
+          outcome = "passed"
+          score   = 87
+        then ExamPassed
+          for "7e9d1c2b-4a3f-4e5d-8c6b-1a2b3c4d5e06"
+          score = 87
       specification RefusingASecondResult
         given ExamPassed
           for "7e9d1c2b-4a3f-4e5d-8c6b-1a2b3c4d5e06"
@@ -131,7 +136,8 @@ module Exams
 - Keep the capture and its appended event in Translate; put reactions to that local
   event in a separate Automation. Co-location in a directionless Translate warns
   PLAY0694 and fails `--warnaserror`; explicit inbound refuses it with PLAY0616.
-  `then` lists every new fact, so `TranslatingAPass` includes the Automation result.
+  A specification runs only its own slice (Screenplay decision 0115), so `TranslatingAPass`
+  states the Translate slice's fact and `RecordingAPass` states the Automation's result.
 - `when added` records first sight; the separate `when outcome` append handles
   later changes. For an update spec, seed the same reference with `given capture`.
   Requires Screenplay 4.175.0 or later (`screenplay --version`); older evaluators

package/package/corpus/skills/cratis-screenplay-captures-and-reactions/references/complete-examples.md

@@ -289,8 +289,8 @@ module Collections
         when trigger PaymentFileArrived
           invoiceId = "9c858901-8a57-4791-81fe-4c455b099bc9"
           amount = 120
-        then InvoiceClosed
-          for "9c858901-8a57-4791-81fe-4c455b099bc9"
+        then invokes CloseInvoice
+          invoiceId = "9c858901-8a57-4791-81fe-4c455b099bc9"
           reason = "paid"
       specification IssuingTheWeeklyDigest
         given clock "2026-10-05T07:00:00Z"

package/package/corpus/skills/cratis-screenplay-captures-and-reactions/references/invocation-identity.md

@@ -54,10 +54,16 @@ module Work
       specification ProcessingRequestedWork
         when append WorkRequested
           workId = "work-1"
-        then WorkRecorded
-          for "work-1"
+        then invokes RecordWork
+          workId = "work-1"
 ```
 
+The automation states the hand-over with `then invokes` (ESM v34). `RecordWork` is
+decided under the declared system identity, so a denial would reach the reaction's
+refusal branches, but `WorkRecorded` belongs to the `RecordWork` slice and is not kept
+in this specification (Screenplay decision 0115). `RecordWork`'s own slice proves the
+event with a `when RecordWork` specification.
+
 ## Diagnostics and target boundaries
 
 - PLAY0647: malformed, repeated or misplaced identity, including duplicate/empty roles.