@cratis/pi 7.20.0 → 7.22.0

package/package/corpus/skills/cratis-screenplay-model-authoring/references/mcp-tools.md

@@ -8,6 +8,10 @@
 - Tool groups
 - Diagnostic repairs and refactorings
 - Syntax-only constructs through the MCP
+- Evidence-pinned production repairs
+- Scoped diagnostics and completeness
+- Dependencies and intent inventories
+- Semantic revision comparison
 - Source map and appended-event fixtures
 - Revision and ownership rules
 - Refusals are useful information
@@ -27,16 +31,17 @@ report unsupported adapters or drift.
 
 ## Tool groups
 
-`tools/list` returns 29 tools (30 on MCP-Apps hosts, which add `visualize-model`),
-after `initialize` and `notifications/initialized`. Discover current argument
-schemas with `tools/list`; do not infer arguments from these short descriptions.
+After `initialize` and `notifications/initialized`, discover current tools and
+argument schemas with `tools/list`; do not hard-code counts or infer arguments
+from these short descriptions. The additions below follow Screenplay v4.125.0's
+`Documentation/screenplay/mcp/reference.md`.
 The connection procedure, edit routes, identity state and failure handling are in
 the [MCP loop](mcp-loop.md).
 
 | Group | Tools | Intent |
 | --- | --- | --- |
 | Understanding | `describe-application`, `search-declarations`, `find-declaration`, `declaration-details` | Navigate logical hierarchy and inspect bounded details |
-| References and examples | `find-references`, `dependencies`, `find-fixtures`, `find-assertion-gaps` | Inspect declared relationships and authored examples, not executed coverage |
+| References and examples | `find-references`, `dependencies`, `dependency-graph`, `find-fixtures`, `find-assertion-gaps`, `semantic-diff` | Inspect declared relationships and authored examples, not executed coverage |
 | Source and validation | `diagnostics`, `read-document`, `merged-document`, `syntax-schema` | Read exact source or typed structure and diagnose problems |
 | Workspace inspection | `open-workspace`, `read-workspace`, `read-ast`, `workspace-state`, `export-workspace`, `repair-capabilities` | Obtain current identities, handles, readiness, code attachment requirements, source-map locations, durable-state status and the repair catalog |
 | Visual (MCP-Apps hosts only) | `visualize-model` | Draw the board for the model or a `proposalId`; its `sketch` argument previews a what-if of whole documents. Reads only |
@@ -58,10 +63,11 @@ with `view: "diagnostics"`, then `view: "repairs"` at the current revision.
 | Code | Offered repair and boundary |
 | --- | --- |
 | `PLAY0166` | Declare a missing command-produced event in its slice. Infer known command-path types (retaining concepts) or `$context.occurred` as `DateTime`; refuse uncertain/conflicting shapes, imports, existing declarations, cross-file producers and parser-invalid workspaces. |
-| `PLAY0478` | Add `for <identifier>` to a plain production. Both models must be executable; refuse a version change or retargeting another production. Accept only if the identifier, not allocation, is intended. |
+| `PLAY0478` | Add `for <identifier>` to a plain production. Both models must be executable; refuse a version change or retargeting another production. This changes routing: accept only if the identifier, not allocation, is intended; `canFixAll: false`. |
 | `PLAY0471` | Remove a redundant event id only with unchanged executable model, catalog and comments. |
 | `PLAY0469` | Remove an inline same-source identifier property and mapping, retiring its semantic address. This changes the contract; `canFixAll` is false. Refuse other consumers, opaque impact, changed routing or comment loss. Plain contracts get guidance only. |
 | `PLAY0479` | Migrate one optional type spelling, or all in a document, preserving syntax and trivia. Exclude `query Q => observable?`. |
+| `PLAY0516` | Move a producing sibling declaration/import before its consumer, or pin an already placed file before a retained glob. Preserve catalogs, comments, placement and executable readiness; introduce no timeline findings. Own-sub-feature edges, cycles, unranked members and mixed/different-parent boundaries have no repair. Rediscover after each move; pinned evidence is unsupported. |
 
 These discoveries verify acceptance before listing a repair. Only compact
 acceptance/conflict verdicts are cached on the immutable snapshot, not diagnostics,
@@ -98,22 +104,37 @@ pin, but retains a pin for a different earlier name. Contradictory generation pi
 refuse the rename. Do not promise a generation-2 payload-removal repair or a
 `PLAY0470` repair: neither is available.
 
-VS Code and Monaco provide local optionality quick fixes without .NET; they do
-not host these production-repair transactions. Use MCP for production repairs.
+VS Code and Monaco provide local PLAY0479 optionality and PLAY0471 redundant-id
+fixes without .NET. PLAY0471 removes the whole id line; a trailing comment blocks
+it. VS Code also has an experimental opt-in trusted C# bridge for PLAY0166/PLAY0478:
+configure the executable/root in User settings, preview source and identity changes,
+then explicitly confirm Apply. Dirty/untitled buffers and evidence drift refuse;
+uncertain Apply outcomes are never retried. Restricted Mode cannot launch it.
+Monaco has no production-repair host bridge. See v4.125.0 `vscode.md`.
 
 ## Syntax-only constructs through the MCP
 
-`system`/`operation` and `eventsource`/`stream` are authorable but not executable (`PLAY0268`; not admitted
-by any supported ESM version: `cratis-screenplay-toolchain` `references/sources-and-streams.md`).
+The 4.66.0/4.68.0 negative probes below are historical. At 4.125.0,
+sources/streams and command/specification routes bind as ESM v8 and have
+catalog identities; `executionAvailable` still requires whole-workspace binding.
+Source/stream `propose-rename` repairs bound route references. Operations and
+exact numeric mode remain unadmitted. Check installed schemas, especially when
+the CLI bundle predates the standalone tool.
+
+Systems/operations remain authoring-only (PLAY0268). Sources/streams and their
+routes are admitted v8, not syntax-only; see toolchain `references/sources-and-streams.md`.
 `generated` properties and `returns` responses are admitted as ESM v7 by Screenplay 4.68.0 and bind
 there (`PLAY0268` on the 4.66.0 in the cratis 3.28.x bundle). The server reads and edits them: `declaration-details` exposes `isGenerated`
 and a command `response` view, `route` and `streams` views; `read-workspace` offers
 the views `event-sources`, `event-streams`, `event-source-details`,
 `event-stream-details`, `command-routes` and `event-source-diagnostics` (detail
-views need the exact `authoringKey` from the inventory). Each discloses
-`executionAvailable: false`. Discover the node kinds with `syntax-schema` and edit
-through typed `propose-ast`; there is no automatic source or stream rename and no
-routing repair. Inline-event extraction refuses response-bearing commands.
+views need the exact `authoringKey` from the inventory). Executable availability
+requires successful whole-workspace binding, not just an inventoried source node.
+Discover `syntax-schema` and edit through typed `propose-ast`; source/stream rename
+can repair proven route references on the current compiler. At 4.125.0, inline-event extraction
+admits response-bearing commands when it proves byte-identical canonical ESM,
+unchanged catalog assignments and exact comment preservation; responses are not
+an automatic refusal.
 
 For `generated`/`returns` on 4.68.0 (`mcp/reference.md` at `v4.68.0`): `propose-ast` accepts
 `validation: "Executable"` for the admitted subset (use `"Authoring"` for full-language syntax); a
@@ -123,6 +144,85 @@ unadmitted feature. Null readiness does not prove the whole application binds or
 fixture exists. Canonical `executable-model` pages include `generated`, `response`, `generatedValues`
 and `thenReturns` when present. Form response scopes and a renderer response type remain downstream work.
 
+## Evidence-pinned production repairs
+
+For PLAY0166/PLAY0478, read `repair-capabilities` before opting in. Read workspace
+`diagnostics` and `repairs`, retain their `repairEvidenceRevision`, and send
+`pinRepairEvidence: true` with `expectedRepairEvidenceRevision` on `propose-repair`,
+alongside workspace/catalog revisions, subject and formatting. Both evidence fields
+are required together. The proposal retains `repairEvidence.beforeRevision` and
+`candidateRevision`; preview every document and identity-state change. Echo the
+before revision on `read-proposal`/`apply` if supplied; the retained pin is enforced
+even when omitted there.
+
+Evidence covers authoritative base/candidate attachment text and load/refusal
+states, including missing files, not unreferenced files or implementation locks.
+Changed inputs or loading diagnostics return `RepairEvidenceDrift`, not refreshed
+readiness. Attachment inputs overlapping source/state/recovery writes return
+`RepairEvidenceWriteConflict`; uncertain aliases fail closed. Never bypass these
+refusals with text edits. A pin is a reviewed snapshot, not a crash-atomic write.
+
+## Scoped diagnostics and completeness
+
+`diagnostics` accepts an exact case-sensitive module/feature/slice `scope` and
+optional `checks` (comma-separated names/codes or `all`). Unknown/ambiguous scopes
+or check names refuse. Whole-application compilation still resolves references;
+selection includes descendants and direct dependents, not transitive impact.
+`success`/severity counts describe the selected set before document filtering and
+paging; `wholeApplicationSuccess` retains the full verdict. Check `affectedScopes`
+and coverage rather than claiming full application validity from a scoped page.
+
+The six core structural families are `data-bindings`, `input-surfaces`,
+`field-origins`, `query-keys`, `event-consumers`, `navigation` (PLAY0530–PLAY0537).
+The current nine-family catalog also includes `personas`, `purposes` and
+`privilege` (PLAY0652); discover names/codes from released `CompletenessChecks.cs`.
+They opt into findings, not execution proof. Whole-source errors skip them; report
+`completenessStatus` as skipped, never passed. `completenessCoverage` states their
+limits. Continue with `expectedSourceRevision`.
+
+## Dependencies and intent inventories
+
+`dependency-graph` edges point consumer → producer. Views: `edges`, `cycles`,
+`order`, `unresolved`, `declarations`; `from`/`to` select slice/feature/module
+aggregation (`to` also accepts context). `scope`, `direction`, `kinds` and
+`includeTestOnly` filter inferred views. Test-only `verifiedWith` edges are excluded
+by default. Other kinds: `usesFactsFrom`, `reactsTo`, `decidesFrom`, `asks`, `shows`,
+`outsideTheModel`. Code, expressions and property paths are not inferred.
+
+`declarations` checks each opted-in container's own `depends on` inventory,
+including descendant consumers. Rows retain declared/provisional/undeclared
+coverage and declaration status used/provisional/unused/invalid. Ambiguous owners
+are always provisional, never undeclared proof. Kind/direction/level filters do
+not narrow this check. `evidenceLimit` (0–20, default 3) limits evidence, not counts
+or checking. Pages default to 50, maximum 200; pin `expectedSourceRevision` on
+continuation. Failed compilation may leave a partial graph.
+
+Cycles and suggested order use only `usesFactsFrom`, `reactsTo`, `decidesFrom`.
+Mixed-level cycles return no groups. Order puts producers first after removing
+internal cycle edges, with authored ties and cycle-member order retained. It is
+advisory, never an edit or runtime order. MCP App and VS Code boards can toggle to
+a dependency map, with story-shaping edges by default and filters for other kinds;
+select an edge to inspect slice pairs and reference evidence (VS Code opens source).
+
+Workspace views `named-rule-intents`/`named-rule-intent-details` cover CommandNamedRule
+only, including pending hints without a requirement ID. Details select either
+`subject` or attached `requirementId`, not both. `handler-intents` and
+`handler-intent-details` cover CommandHandler only; handler details select
+`requirementId`. All page ordered hints, not implementation correctness. Continue
+with `expectedRevision` and `expectedCatalogRevision`; provisional owner IDs are
+not authoritative. Edit hints through reviewed `propose-ast`.
+
+## Semantic revision comparison
+
+`semantic-diff` takes `beforeWorkspaceJson` and `afterWorkspaceJson`: decoded,
+reassembled canonical `export-workspace` JSON, not Git refs or raw source. Exports
+must share the application identity and authoritative catalogs; the tool never
+guesses rename continuity. Invalid exports return `UnreadableRevision`, different
+applications `IncompatibleRevisions`. It does not open/replace the active workspace
+or write state. Inspect incomplete sections and exclusions: structure comparison
+is not executed behavior. Echo the ordered-pair `sourceRevision` on continuation.
+Use `read-proposal` `view: "semantic-diff"` for an uninstalled proposal instead.
+
 ## Source map and appended-event fixtures
 
 `read-workspace` `view: "source-map"` pages the compiler's semantic entries (ordered
@@ -132,6 +232,11 @@ span. Compilation must have succeeded for entries to exist (`available`).
 `whenAppendedEventDestination` and `thenEvent` (and others for commands and
 queries): a `when append` payload is labeled `whenAppendedEvent`, not `thenEvent`,
 in `declaration-details`, `find-fixtures`, references and dependencies.
+Event roles also have `…Stream`, `…StreamId` and `…NoStream` rows (`property`
+respectively `stream`, `streamId`, `no stream`). Effective fixture values expose
+`origin` (authored/example/override), example name and replaced value where present.
+A whole-route replacement records `overriddenValue` once on its stream/no-stream
+row; route parts retain their individual lineage. These are source facts, not execution.
 
 ## Revision and ownership rules
 

package/package/corpus/skills/cratis-screenplay-model-authoring/verification.json

@@ -5,7 +5,7 @@
   "assertions": [
     {
       "kind": "skill-contains",
-      "value": "main `fd18129`"
+      "value": "Screenplay v4.125.0"
     },
     {
       "kind": "skill-contains",
@@ -105,11 +105,11 @@
     },
     {
       "kind": "skill-contains",
-      "value": "**Prefer a fixed root.**"
+      "value": "registered Git worktree"
     },
     {
       "kind": "skill-contains",
-      "value": "29 tools (30 on MCP-Apps hosts)"
+      "value": "schemas rather than relying on a remembered count"
     },
     {
       "kind": "skill-contains",

package/package/corpus/skills/cratis-screenplay-model-review/SKILL.md

@@ -62,7 +62,11 @@ model's behalf.
    `read-workspace view=executable-diagnostics` when the mode needs them; `describe-application
    view=summary`, `find-assertion-gaps` (slices with no assertion; authored, not executed) and
    `dependencies direction=incoming` for orphans. The verdict lines are independent: a V1 pass is
-   necessary, never sufficient. Any line without evidence is "not run: reason".
+   necessary, never sufficient. Opt into completeness with `--check` or MCP
+   `checks` for bindings, input surfaces, field origins, query keys, event consumers
+   and navigation; whole-source errors skip these checks. Record selected families,
+   skipped status and coverage limits, never a vacuous pass. Any line without
+   evidence is "not run: reason".
 3. **Element sweep** (phase 1, mechanical, before any judgement). One line per gated element, event,
    name, command, event property and slice; `references/checklist.md` S1-S7 gives each line's
    format. Each `NONE` and each form name is its own finding naming that element. A repeated
@@ -164,11 +168,12 @@ labelled as such. The user decides whether it is enough (the user is sufficient
 never blocked as a matter of authority.
 
 ## Rules
-- Compiler contracts (defects when the mode needs them): V1 must pass with warnings as errors;
-  PLAY0029 means a construct was silently dropped. Missing projection targets and undeclared
-  events in `remove with` or capture `append` pass V1 and are reported at V3 (PLAY0273); check
-  by hand only unresolved-name warnings and declared properties that nothing maps. Binding
-  codes appear only in V3.
+- Compiler contracts (defects when the mode needs them): V1 must pass with warnings
+  as errors; PLAY0029 means a construct was silently dropped. Current source checks
+  warn on missing projection targets (PLAY0514) and removal/capture events
+  (PLAY0166). Opt-in field-origin warnings (PLAY0534) do not replace a manual
+  lineage walk when coverage is unknown. PLAY0516/0517 are presentation-only
+  information, not broken execution or a reason to fail warnings-as-errors.
 - Modeling defaults (deviation needs a recorded reason, otherwise a finding): one business
   decision, one event by default; one view per screen component; one command per `StateChange`
   (renderable: required); facts carry decided or supplied data and running figures belong in

package/package/corpus/skills/cratis-screenplay-model-review/references/anti-patterns.md

@@ -62,7 +62,7 @@ the problem, the checks it violates, the fix, all pinned to one declaration.
 | Missing `for` | an event production (`produces <Event>` or `produces event`) without `for`. Not operation productions: they are authorable design intent, belong to commands, and take no event `for`, tags or routing | runtimes disagree on the destination | C (executable) / D | `for <identifier>` |
 | Unbuilt read-model field | field no projection maps and AutoMap cannot fill | always empty; not reported by the compiler | D | map it or remove it |
 | Undeclared removal/append event | `remove with` or capture `append` names an undeclared event | passes V1, fails binding (V2/V3, PLAY0273) | C (executable) / D | declare or fix the name; run V3 |
-| Gated command invoked by a reaction | reaction `invokes` a command under a caller policy | invocations carry no caller: rejected at run time | D (major) | record a trusted-path decision (ungated internal command or service actor) - never just delete the gate |
+| Gated command invoked by a reaction without a declared actor | reaction `invokes` a command under a caller policy and has no `runs as system role "<Role>"` that satisfies the gate | the invocation carries no caller: rejected at run time | D (major) | declare `runs as system role "<Role>"` with the least-privilege role the gate admits (ESM v10, Screenplay 4.125.0; CLI 3.41.0 cannot render it yet, so gap-fill) or record another trusted-path decision - never just delete the gate. A matching `runs as system role` is the admitted trusted path, not a defect |
 | `reads` + `produces` reaction | reaction both reads a view and produces | fails binding | C (executable) | invoke a command, or produce without reads |
 | `reads` treated as protection | rule "checked" because the command or reaction `reads` a view | `reads` enforces nothing | D (major) | keep or introduce `reads <View>` + `require ... message` as stated intent, mark it NOT enforced in the slice `description`, name the target (`[ProtectedDecision]` + `DecisionRead<T>`, Chronicle DCB, or a constraint where it fits); checklist E3 |
 | Caller-supplied state rule | `require currentStatus == "open"` where the caller sends `currentStatus` | the caller decides its own permission | D (major) | read the stored state with `reads`; keep or introduce `reads <View>` + `require ... message` as stated intent, mark it NOT enforced in the slice `description`, name the target (`[ProtectedDecision]` + `DecisionRead<T>`, Chronicle DCB, or a constraint where it fits); checklist E3 |

package/package/corpus/skills/cratis-screenplay-model-review/references/checklist.md

@@ -74,7 +74,7 @@ the format in `worked-example.md`.
 
 | Id | Check | Evidence | Tier |
 |---|---|---|---|
-| A1 | Every read-model field maps from an event field, `$eventSourceId`, `$eventContext`, a literal, or a documented derivation (`count`, `add ... by`) | projection blocks; AutoMap name matches (on by default) | D (a declared field that nothing maps is reported by no tool; a mapping to an undeclared property fails binding at V3, PLAY0273, tier C when executable) |
+| A1 | Every read-model field maps from an event field, `$eventSourceId`, `$eventContext`, a literal, or a documented derivation (`count`, `add ... by`) | projection blocks; AutoMap name matches (on by default) | D (opt-in PLAY0534 detects known missing origins; unknown coverage still needs a walk. Absent mapping targets warn at V1 with PLAY0514, tier C for source validity) |
 | A2 | Every event field comes from a command input, `$context` value, literal, capture field or reaction mapping | `produces` mappings, capture `map`, reaction `invokes` | C for undeclared names (warning), D for meaning |
 | A3 | Every command input is supplied by someone: screen form field, reaction mapping, capture, or a caller who knows it | screens, forms, reactions | D |
 | A4 | Every command input ends in an event field or is used by a rule | `produces`, `validate`, `require` | Q (an unused input is often a missed fact) |
@@ -100,7 +100,7 @@ the format in `worked-example.md`.
 | C2 | A fact, not a request, a running calculation, a UI action or a technical step | names and payloads | D |
 | C3 | No speculative or pending events ("MayBe...", "...Pending") where a decision is meant | names | Q |
 | C4 | No nullable or optional event property by default: a required value, or a separate event for the second situation (CHR0012; a `null` in a specification value is PLAY0350); a kept `optional` has its reason in the `description` | `optional` members | D |
-| C5 | Sensitive members marked (`@pii`/`@sensitive`) and not mixed across data subjects; operational secrets are `@sensitive`, not `@pii`; no `@pii` or `@sensitive` on the event-source id (no such identifier concept; use a surrogate id; Chronicle CHR0034 and CHR0052, and Screenplay PLAY0515 from 4.69.1 for `@pii` and 4.84.1 for `@sensitive`, only on tools at those versions - the pinned tools do not report it); one data subject per event or stream | concepts and members | D; removal to pass tools = critical |
+| C5 | Sensitive members marked (`@pii`/`@sensitive`) and not mixed across data subjects; operational secrets are `@sensitive`, not `@pii`; no `@pii` or `@sensitive` on the event-source id (no such identifier concept; use a surrogate id; Chronicle CHR0034 and CHR0052, and Screenplay PLAY0515 from 4.69.1 for `@pii` and 4.84.1 for `@sensitive`, only on tools at those versions - current pins report it as a source error, including typed destinations and route-id parts); one data subject per event or stream | concepts and members | D; removal to pass tools = critical |
 | C6 | No secret or bearer values as facts (tokens, magic links, signed URLs): record a keyed hash or a reference | event payloads | D |
 | C7 | No two events of one kind of event source mean the same thing (a shared property set is a signal, not a defect: distinct facts may share a shape and historical generations are exempt; major only when meaning is lost, a rule bypassed or consumers ambiguous); one fact is not recorded twice (aggregate event plus per-item fan-out) | event declarations side by side | D |
 | C8 | Corrections are new facts that name what they correct; redaction and crypto-erasure are compliance tools, not corrections | event names | D |
@@ -131,6 +131,15 @@ the format in `worked-example.md`.
 | E9 | A decided refusal is a `then error` or `then denied` specification (permanent behavior), never a lingering open question; only a genuinely unanswered question counts as open, and resolving it means answering it | specs, `STATE.md` questions, descriptions | D |
 
 ## Phase 8. Flow and lifecycle (13 checks, F1-F13)
+
+Review PLAY0516 backward-flow and PLAY0517 sibling-cycle findings as
+**presentation-only** information: they do not fail `--warnaserror`, change
+execution or prove a business deadlock. An ordering root is required; without
+one the folder check is skipped. A real F6 defect needs a named domain
+consequence, not just the diagram's cycle. Suggested graph order and safe
+PLAY0516 moves preserve executable bytes/identities. Source: Screenplay
+`v4.125.0:Documentation/screenplay/imports.md`, `diagnostics.md`.
+
 | Id | Check | Evidence | Tier |
 |---|---|---|---|
 | F1 | Each entity has a first fact, a state-transition table (including refused transitions) and terminal states | slices, constraints, `description` | D |

package/package/corpus/skills/cratis-screenplay-read-surface/SKILL.md

@@ -231,6 +231,16 @@ block or a named `behavior` attached with `uses`. See
 `cratis-screenplay-ui-composition`. Screens and interactions are deferred from the
 executable model (information `PLAY0269`); they never block binding.
 
+## Guarded screen actions
+
+One labeled user decision can choose among commands using ordered
+`when item.<path> ... execute <Command>` alternatives, with optional last
+`otherwise execute` or `otherwise hidden`. First match wins; no item or no match
+without an execute fallback hides it. Inputs use typed `with ... from ...`
+bindings; the selected command still enforces its own gate/rules/constraints.
+Read [guarded actions](references/guarded-actions.md) for the checked model,
+missing-versus-null behavior and source-versus-renderer boundary.
+
 ## How a bare name resolves
 
 **Inside out:** the slice, then the enclosing feature, then the module, then the

package/package/corpus/skills/cratis-screenplay-read-surface/references/guarded-actions.md

@@ -0,0 +1,79 @@
+<!-- Copyright (c) Cratis. All rights reserved. -->
+<!-- Licensed under the MIT license. See LICENSE file in the project root for full license information. -->
+
+# Guarded screen actions
+
+## Contents
+
+- State one user decision
+- Select and bind
+- Guard boundaries
+
+## State one user decision
+
+A label-headed `action "<text>"` (or `$strings.<key>`) can choose a command
+from the displayed item's state. The label replaces a plain action's `label`
+child. This complete model compiled without warnings on Screenplay 4.125.0;
+it is authoring evidence, not a rendered interaction test:
+
+```screenplay
+module Tasks
+  feature Work
+    slice StateChange CloseTask
+      command CloseTask
+        taskId String identifier
+        produces event TaskClosed
+    slice StateView Details
+      readmodel TaskDetails
+        taskId String
+        status String
+      query TaskById => TaskDetails optional
+        by taskId String
+      screen Details
+        data TaskDetails via query TaskById by taskId
+        action "Close"
+          when item.status == "open" execute CloseTask
+            with taskId from item.taskId
+          otherwise hidden
+```
+
+## Select and bind
+
+`item` is the nearest container's data item, or selected element for collection
+data. Sibling data in the action's container takes precedence over outer data
+regardless of text order; ambiguous/missing data warns rather than guessing.
+Without an item (loading/no selection), always hide the action, even if it has an
+execute fallback.
+
+Check alternatives in authored order whenever data changes; **first match wins**.
+At least one when is required. Last optional `otherwise execute <Command>` is
+a fallback; `otherwise hidden` or omission hides unmatched actions. Intentional
+overlap is valid; only provable shadowing warns. Inputs resolve from explicit
+`with <property> from <binding>`, matching subject fields, declared command form,
+then renderer input. Terminal collection fields may fill collection inputs;
+traversing through a collection is not supported.
+
+A single `navigate to` runs after the chosen command succeeds, not to open that
+command's input screen. Open a form/dialog first when it needs separate input.
+A click runs the choice shown; if a click-time check changes it, refresh instead
+of executing the newly selected command.
+
+## Guard boundaries
+
+Conditions compare item paths to literals, not other paths, route/screen state,
+`$context` or `$env`. Equality/inequality, numeric ordering, string contains/starts
+with and grouped and/or are supported; and binds tighter than or. Collections
+cannot be condition operands. Missing/null fields compare false, including !=
+to a non-null literal; == null matches an explicit null, not a missing member.
+Type mismatches compare false. Editors validate syntax/shape, not runtime choices.
+
+The guard controls an offer, never server permission. The selected command still
+runs authorization, validation and constraints; denial never falls through to a
+second command. Screens remain outside portable ESM execution. A downstream
+renderer must explicitly admit guarded selection or report unsupported behavior,
+not approximate it as a plain action. CLI 3.41.0's bundled screen renderer reports
+unsupported guarded actions with STAGE-SCENE-ACTION-001; source compilation alone
+cannot establish usable controls.
+
+Authority: Screenplay `v4.125.0:Documentation/screenplay/screens.md`;
+CLI `v3.41.0:Documentation/reference/screenplay.md` for renderer disposition.

package/package/corpus/skills/cratis-screenplay-render-and-gap-fill/SKILL.md

@@ -25,9 +25,9 @@ Version pins live once in `cratis-screenplay-toolchain` `references/versions.md`
 
 | Source | Pin | Used for |
 | --- | --- | --- |
-| cratis CLI | `3.40.7` (`v3.40.7`, `af9f18e`) | `cratis render` options, exit codes, publication receipt; tag pins Stage 4.51.1 and Screenplay 4.114.0, with `cratis/stage:4.51.1` as the runtime image. UI-profile rejection and render-then-recover fixes are pending in Cratis/cli#301. Reading baselines: 3.40.3, 3.39.0 and 3.28.3 (`8b43fef`) |
-| Stage | `4.51.1` (CLI default; latest package 4.51.3) | admission (`STAGE-ESM-*`, and `PLAY0268` render refusals surfaced by the CLI), ownership manifest, `Customizations/` seams, Debug-only specifications, fail-closed guarded actions (`STAGE-SCENE-ACTION-001`) and interactions (`STAGE-SCENE-INTERACTION-001`). Older baselines: 4.49.5, 4.43.0 and `v4.24.2` (`32dcac4`) |
-| Screenplay | bundled `4.114.0`; latest language package `4.122.0` | standalone compiler for V1 to V3; binding codes `PLAY0268` and the code-attachment rules, read at `v4.66.0`; claims made through `cratis` are 4.114.0 claims |
+| cratis CLI | `3.41.0` (`v3.41.0`) | `cratis render` options, exit codes, publication receipt, UI-profile rejection (`CLI-RENDER-007` to `CLI-RENDER-010`); tag pins Stage 4.51.3, Screenplay 4.114.0 and `Cratis.Arc.Screenplay` 22.54.0, with `cratis/stage:4.51.3` as the runtime image. UI-profile rejection and render-then-recover shipped in 3.41.0 (Cratis/cli#301). The screens release vector was verified on 3.40.7 (`af9f18e`) with `cratis/stage:4.51.1`. Reading baselines: 3.40.3, 3.39.0 and 3.28.3 (`8b43fef`) |
+| Stage | `4.51.3` (CLI 3.41.0 default) | admission (`STAGE-ESM-*`, and `PLAY0268` render refusals surfaced by the CLI), ownership manifest, `Customizations/` seams, Debug-only specifications, fail-closed guarded actions (`STAGE-SCENE-ACTION-001`) and interactions (`STAGE-SCENE-INTERACTION-001`). Older baselines: 4.49.5, 4.43.0 and `v4.24.2` (`32dcac4`) |
+| Screenplay | bundled `4.114.0`; standalone `4.125.0` | standalone compiler for V1 to V3; binding codes `PLAY0268` and the code-attachment rules, read at `v4.66.0`; claims made through `cratis` are 4.114.0 claims |
 | Rendered apps | Arc `22.25.0`, Chronicle `19.8.1`, Scene packages | `[ProtectedDecision]` (Arc 22.39.0 and later) is not available in code written into one; verify the generated package set before claiming exact Scene 4.14.0 runtime parity |
 
 Facts were read at those tags and `cratis render` was run at 3.28.2 and 3.28.3 for the worked example
@@ -68,13 +68,15 @@ assume an answer to 4, and record it as `blocked` for the user.
 Evolved events (a model that selects ESM v4) are gap-fill too: Stage 4.24.2 admits the v4 model but refuses any evolved event and its dependent scope with `STAGE-ESM-026`, because it cannot render Chronicle event-type migrations yet (Stage#204). Events at their initial revision still render. Hand-write the evolved events and their migrations per `cratis-chronicle-event-type-migration`, with the model as the contract. The cratis CLI bundles Stage 4.24.2 since 3.28.3 and reports an evolved event with `STAGE-ESM-026` (probed); 3.28.2 bundled Stage 4.24.1 (3.28.1 and earlier: 4.24.0) and refused a v4 model with `STAGE-ESM-016`.
 
 Generated command values and `returns` responses (ESM v7) bind and run in the reference runner on standalone
-Screenplay 4.68.0 but are not rendered: the cratis CLI 3.28.3 bundles 4.66.0 and reports `PLAY0268`, and Stage
-4.24.2 refuses ESM v7 with `STAGE-ESM-016` (tracked in Stage#201). A command that uses them is case A or C: keep
+Screenplay 4.68.0 and later but are not rendered: CLI 3.41.0 admits ESM v7 to Stage planning, and Stage 4.51.3
+refuses generated values and responses with `STAGE-ESM-028`/`STAGE-ESM-029` (`cratis-screenplay-toolchain`
+`references/versions.md`). A command that uses them is case A or C: keep
 the model, hand-write the command and its response with the model (and its fixtures and `then returns`
 specifications) as the contract, and report V3 from the standalone tool and V5 as `not run: no render`.
 
-Models with event sources, streams or command routes are case A or C today: they cannot
-bind or render (`PLAY0268`: not admitted by any supported ESM version, so also `STAGE-ESM-016`), so hand-write the code with the model as the
+Models with event sources, streams or command routes bind and reference-execute as ESM v8 on standalone
+Screenplay 4.125.0, so report V3 and V4 from that tool. They are still case A or C for rendering: CLI 3.41.0
+refuses models above ESM v7 with `CLI-RENDER-004`, so hand-write the code with the model as the
 contract (`cratis-screenplay-toolchain` `references/sources-and-streams.md`).
 
 Two rules hold in every case: a customization never makes a rejected model renderable, and

package/package/corpus/skills/cratis-screenplay-render-and-gap-fill/references/gap-fill-handoff.md

@@ -75,9 +75,12 @@ gap-fill): the registration goes through the seams in `Customizations/Program.cs
 not bind a modeled reaction or capture. Case C (no generated application): there is no generated
 `Program.cs` or partial hook, so the registration follows the hand-written application's own
 composition conventions (`rules/vertical-slices.md`, `cratis-chronicle-reactor`).
-A reaction invokes a command with no caller (Screenplay 4.68.0 has no caller syntax), so the
-code needs a trusted path (`[ExecuteCommandsAsSystem]`, Arc 20.56.0 and later, in a rendered
-application's Arc 22.25.0 too); never invent `runs as`.
+Declare the trusted actor with reaction `runs as system role "<Role>"`
+(standalone 4.125.0, ESM v10); `given caller` is not an invocation actor.
+CLI 3.41.0's older compiler rejects the syntax, and Stage 4.51.3's planner admits
+through v7 only. Gap-fill retains the declared role and uses Arc
+`[ExecuteCommandsAsSystem]` for returned commands. Checked model and diagnostics:
+captures-and-reactions `references/invocation-identity.md`.
 
 ## Re-delivery
 The work list is the full in-scope contract delta since the ledger's last verified source

package/package/corpus/skills/cratis-screenplay-render-and-gap-fill/verification.json

@@ -37,14 +37,14 @@
     },
     {
       "kind": "skill-contains",
-      "value": "case A or C today"
+      "value": "case A or C for rendering"
     },
     {
       "kind": "skill-contains",
       "value": "STAGE-ESM-026"
     },
     { "kind": "skill-contains", "value": "Generated command values and `returns` responses (ESM v7) bind and run" },
-    { "kind": "skill-contains", "value": "tracked in Stage#201" },
+    { "kind": "skill-contains", "value": "STAGE-ESM-028`/`STAGE-ESM-029" },
     { "kind": "skill-contains", "value": "authored-UI parity" },
     { "kind": "skill-contains", "value": "responsible tool version" }
   ]

package/package/corpus/skills/cratis-screenplay-scenario-coverage/SKILL.md

@@ -183,8 +183,9 @@ scope is reported as explicitly incomplete); V1 passes with the tool named in
   populated-then-removed spec.
 - V1 passes (standalone `screenplay` required when cascades are specified); report tool and
   version.
-- V4 is "not run: no route" unless a Screenplay reference route was actually executed (Stage's spec runner is target-engine evidence, never V4); V1/V3 do not prove specs
-  pass. V5 is "not run" unless rendering was attempted; report admission, publication, build and
+- Run V4 through standalone `screenplay test` or MCP `run-specifications`;
+  if not executed, report the actual host/input reason, not a blanket no-route
+  claim. Stage's runner is target-engine evidence, never V4; V1/V3 do not prove pass. V5 is "not run" unless rendering was attempted; report admission, publication, build and
   tests separately.
 - Match guarantees to evidence: `.play` outcomes, in-process Chronicle scenarios and real-kernel
   tests are not interchangeable (`references/chronicle-verification.md`).

package/package/corpus/skills/cratis-screenplay-scenario-coverage/references/spec-forms-by-mode.md

@@ -3,7 +3,11 @@
 The subsets themselves (what binds, what renders) are owned by `cratis-screenplay-toolchain`
 (its executable and renderable subset references); version facts by its `references/versions.md`. This file
 says what that means for writing specs. A form outside the chosen mode is never deleted from a
-design model: keep it and record the gap.
+design model: keep it and record the gap. The detailed Stage 4.24.x rows below
+retain historical admission evidence; current pins are Screenplay 4.125.0 / CLI
+3.41.0. Run actual target admission instead of assuming old restrictions carry over.
+Typed example/override forms: `cratis-screenplay-specifications`
+`references/examples-and-routes.md`.
 
 | Form | design | executable | renderable |
 |---|---|---|---|
@@ -19,6 +23,10 @@ design model: keep it and record the gap.
 | Command spec listing reaction cascade events | yes (v6 semantics) | false PLAY0285 on a cratis before 3.28.2 bundle only; see SKILL.md "Version skew" | no (no reactions) |
 | `generated <name> = <value>` under `when`, `then returns` (ESM v7) | yes | yes on standalone Screenplay 4.68.0 or later; not on the 4.66.0 bundled in cratis 3.28.x (`PLAY0268`) | no (Stage does not render ESM v7) |
 | `then events in any order` | yes | yes | yes |
+| Event `stream` / `no stream`, typed `for` and stream ids | yes | ESM v8 at 4.125.0 | CLI 3.41.0 refuses models above v7 before planning |
+| Typed examples and overrides | yes | expanded and type-checked before binding; required fields remain required | depends on expanded contract, not fixture reuse |
+| `given operation ... fails`, `then operation`, `then compensated` | yes | unadmitted PLAY0268 | gap-fill |
+| Refusal branches, `when redelivered`, `then no events` | yes | unadmitted PLAY0268 | gap-fill |
 | Composite (JSON) values in specs | yes | yes | no |
 | Rules over dates or `today`, nested paths | spec them in design | rule does not bind: `recorded` | `recorded` |
 | Bodied rules, code policies | spec them | spec reported **unsupported**, never passed | no |
@@ -36,7 +44,10 @@ bundle is available). Mark each such spec in the coverage matrix as
   the projection's effective key (`cratis-screenplay-slice-design` `references/read-model-design.md`
   decision table). View specs assert through a keyed query.
 - Run V3 (binding-ready, per `cratis-screenplay-toolchain`); binding-only codes (PLAY0273/0350/0352/0388/0389) appear only there.
-- V4 (reference specs run) needs a runner route; otherwise report "V4 not run: no route". Unsupported is not passed.
+- V4 runs through `screenplay test` or MCP `run-specifications`; record expected,
+  discovered/selected and passed/failed/unsupported counts. Unbound/unsupported
+  is not passed. Authoring-only refusal/redelivery/operation specs remain recorded
+  contracts; test them at the owning target after authorized gap-fill.
 
 ## Renderable mode
 - Specs use given events, a command `when`, and then events / readmodel / query / error /

package/package/corpus/skills/cratis-screenplay-slice-design/SKILL.md

@@ -65,8 +65,9 @@ report and the slice `description`, and continue.
    origin must be **reachable** (some screen, form, reaction or integration leads to the
    command) and **authorized** (the persona's policies satisfy every gate on module, feature
    and command). A command may have several origins; each must be real. A reaction's `invokes`
-   has no caller, so a gated command it invokes is refused: design the trusted path, never
-   delete the gate.
+   has no caller unless the reaction declares `runs as system role "<Role>"` (ESM v10), so a
+   gated command it invokes is refused: declare that trusted path with the role the gate
+   admits, never delete the gate.
 3. **Design the command** (`references/command-inventory.md`). Imperative business name for
    **one** decision (`ReassignLocker`, `CorrectLockerVolume`). A form verb (`Update`, `Edit`,
    `Save`, `Set`, `Change`, `Manage` + noun) means several decisions share a form: ask which

package/package/corpus/skills/cratis-screenplay-slice-design/references/command-inventory.md

@@ -118,8 +118,9 @@ not been asked the refusal questions.
 - Copying state into the command so `require` can read it, instead of `reads <View>`.
 - An origin that is neither reachable (no screen, form or reaction leads there) nor authorized
   for the persona who should act.
-- A reaction invoking a gated command: the invocation has no caller and is refused; design the
-  trusted path (`cratis-screenplay-automations-and-translations`), never delete the gate.
+- A reaction invoking a gated command without `runs as system role "<Role>"`: the invocation has
+  no caller and is refused; declare the trusted path with the role the gate admits
+  (`cratis-screenplay-automations-and-translations`), never delete the gate.
 - Refusals recorded as prose in the `description` with no layer and no spec row.
 - Personal data or secrets as command input: values are by default recorded in the causation chain, so treat them as permanent
   (retention can be configured in newer Chronicle; verify it, never audit secrets).

package/package/corpus/skills/cratis-screenplay-slice-design/references/slicing.md

@@ -62,6 +62,46 @@ For `worked-example.md`:
 | LockerBoard | LockerInstalled, LockerAssigned | InstallLocker, AssignLocker | |
 | RequestProgress | LockerRequested, LockerAssigned | RequestLocker, AssignLocker | |
 
+### Declare container dependencies
+
+At Screenplay 4.125.0, modules and features may declare `depends on <Name>`, one
+target per line. Use a bare sibling name or a qualified module/feature address.
+Bare names resolve inside out: siblings, ancestor siblings, then root modules;
+qualified names match an unambiguous trailing address. Ambiguity is `PLAY0198`.
+Self, ancestor, descendant and unresolved targets warn with `PLAY0554`; repeats
+keep the first resolved target and warn with `PLAY0555`.
+
+Declarations accumulate on the same owner in ordinal file-path order, independent
+of board import order. Layout expansion writes them only in the owner's file.
+They are authoring metadata: no execution rule, implementation order, identity
+or executable-model revision change.
+
+Once a container declares dependencies, its own inventory must cover counted
+explicit references leaving it, including descendants. Parent and child lists
+are independent. Module targets cover all their features; feature targets cover
+their descendants. `usesFactsFrom`, `reactsTo`, `decidesFrom`, `asks` and `shows`
+count; specification-only and outside-context edges do not. `PLAY0552` warns on
+uncovered producer modules; `PLAY0553` marks unused declarations and `PLAY0556`
+mutual declarations as information. Ambiguous ownership is provisional, not proof
+of an undeclared dependency. Inspect MCP `dependency-graph`'s `declarations` view.
+
+Example: Payroll declares Timesheets; its Handover feature declares
+Timesheets.Approval and sibling Runs. These are dependency inventories, not
+actual references or execution dependencies:
+
+```screenplay
+module Payroll
+  depends on Timesheets
+  feature Handover
+    depends on Timesheets.Approval
+    depends on Runs
+  feature Runs
+module Timesheets
+  feature Approval
+```
+
+Source: Screenplay `v4.125.0:Documentation/screenplay/slices.md` and `folders.md`.
+
 ## State-transition table (per entity)
 
 Rows are states (named after the fact that put the entity there); columns are commands. Each