@cratis/pi 7.21.0 → 7.22.0

package/package/corpus/skills/cratis-screenplay-automations-and-translations/SKILL.md

@@ -28,10 +28,15 @@ identity, effect and pending-work contract at that point; do not postpone it to
   4.66.0). Probed on 3.28.2: the complete examples are `executableReady`. A cratis bundle before 3.28.2
   (4.60.1) reports PLAY0268 at binding: report "V3 blocked: PLAY0268 (ESM v6)" and
   name the tool, never remove them.
-- No MCP tool, `validate` or render runs Automation or Translate specs. V4 is "not run: no route".
-- Stage 4.24.2 (bundled in cratis 3.28.3) renders no Automation or Translate slice (Stage#79); `cratis render` refuses the whole v6 model with STAGE-ESM-016: the whole automation is
-  gap-fill or hand-written delivery with the model as contract (`references/realization-and-gap-fill.md`).
-- Invoked commands run with no caller; `.play` cannot name an actor (Screenplay#383).
+- Standalone 4.125.0 runs admitted scenarios through `screenplay test` or MCP
+  `run-specifications`; source validation and render publication do not run V4.
+- Stage 4.51.3 refuses Automation/Translate members with STAGE-ESM-024; its direct
+  planner audits through v7. Deliver that scope as authorized gap-fill
+  (`references/realization-and-gap-fill.md`).
+- Reaction `runs as system role "<Role>"` declares an invocation actor (ESM v10).
+  Without it the invoke has no caller. CLI 3.41.0's 4.114.0 compiler rejects the
+  new syntax (PLAY0137). Checked model/diagnostics: captures-and-reactions
+  `references/invocation-identity.md`.
 
 ## Effect guarantees and recovery traps
 | Guarantee | What it promises | What can show it |
@@ -113,12 +118,12 @@ or actor that nobody confirmed. Read `references/worked-integration.md` when you
    supersession), the work-item key and the recovery path. Direct reaction only for an immediate,
    internal, always-possible effect; say why no pending state is needed. A translation is not
    automatically infallible.
-4. **Effect and actor.** `produces <Fact>` when nothing should refuse the fact. `invokes <Command>`
-   when the step is a decision that may reject; it carries **no caller**, so gated commands reject it.
-   Record one actor decision: internal ungated command (only when safe and unreachable), direct
-   `produces`, or gated command with a trusted actor and the capability gap (Screenplay#383). The code
-   realization of the actor is a reactor with `[ExecuteCommandsAsSystem("<role>")]` and a policy
-   requiring that role; never invent `runs as`. Never strip authorization to pass a tool.
+4. **Effect and actor.** `produces <Fact>` records a decided fact; `invokes <Command>`
+   requests a decision. Keep its gate and declare the trusted role with reaction
+   `runs as system role "<Role>"` (ESM v10). An undeclared actor remains caller-less.
+   CLI/Stage realization is a separate gap; a returned-command reactor uses
+   `[ExecuteCommandsAsSystem("<role>")]` and the matching policy. Never strip a
+   gate or supply `given caller` as a fictional reaction identity.
 5. **Trace inputs.** Every trigger value, command input, event property and destination needs a
    supported source; every filter a business reason. Gaps are questions, not invented mappings.
 6. **Repetition and termination.** Identify one logical work occurrence and what a retry is. Guard the
@@ -140,7 +145,8 @@ or actor that nobody confirmed. Read `references/worked-integration.md` when you
 - Clock triggers take no values (PLAY0450) and no `by` on reads (PLAY0443). `for each <View>` is
   reserved, not available.
 - Capture `when` cannot mix `and` and `or` (PLAY0089). A capture without `key` does not bind.
-- Undeclared events in capture `append` and `remove with` pass V1 and fail only at binding (V3, PLAY0273): run V3.
+- Current V1 warns on undeclared capture/removal events (PLAY0166); V3 remains a
+  separate binder check.
 - A trigger with `reads` that `produces` directly fails binding: decide in a command. `reads` never protects.
 - An authorized command exercised in a spec without `given caller` is PLAY0389 at binding.
 - A list query (`=> Item[]`) and a clock sweep that iterates items do not bind; show them only as marked
@@ -175,7 +181,8 @@ Never report a verdict without the tool and version that produced it.
 
 ## Verify
 - V1 and V3 per `cratis-screenplay-toolchain`, each with tool and version. On a cratis before 3.28.2
-  bundle report "V3 blocked: PLAY0268 (ESM v6)"; on 4.66.0 (standalone or cratis 3.28.2) these slices bind. V4 is "not run: no route" for these slices.
+  bundle report "V3 blocked: PLAY0268 (ESM v6)". Current admitted scenarios use
+  standalone `screenplay test`/MCP for V4; unsupported or unbound is not passed.
 - For each external source and type: its translation, or an explicit out-of-scope reason; check
   target-field completeness as well as source-field dispositions.
 - One happy path is not coverage: cite the spec or the missing case for each branch, denial, competing

package/package/corpus/skills/cratis-screenplay-automations-and-translations/references/audit-format.md

@@ -11,8 +11,8 @@ technique: partial work stays visible and nothing is skipped because it looked r
 
 Result is `complete` only when every column is filled or says why it does not apply (for example
 "direct effect: immediate, internal, cannot fail"). `open` names the unresolved decision and who
-answers. `blocked` names the capability gap (for example Screenplay#383 for the actor, or a
-list query that does not bind) with the intended behaviour.
+answers. `blocked` names the actual capability gap (for example CLI 3.41.0's
+older compiler cannot parse a declared ESM v10 reaction actor) with intended behavior.
 
 ## Per translation (capture or translator reaction)
 | Source and type | Location | Correlation | Field dispositions | Target fields traced | Dedup and ordering | Trust boundary | Recovery owner | Named cases | Result |
@@ -45,4 +45,5 @@ never skip it silently or call the chain complete.
 | Unreviewed | `RecordCompletion` denial for a non-coordinator is specified; query authorization not in scope | stated |
 
 Then the verdict line per `cratis-screenplay-toolchain`: tool and version on each of V1 to V4
-(V4 for these slices: "not run: no route").
+(V4 uses standalone `screenplay test` or MCP `run-specifications`; report the
+actual result, or a specific host/input limitation if not run).

package/package/corpus/skills/cratis-screenplay-automations-and-translations/references/automation-patterns.md

@@ -65,16 +65,17 @@ When a todo list is not needed: the effect is immediate, internal and cannot fai
 | can it be refused? | only by append-time constraints | authorization, validation, `require`, constraints |
 | destination | `for` value; without `for`, the trigger fact's source | the command's identifier |
 | with trigger `reads` | fails binding (unprotected decision) | allowed; protection is the command's job |
-| caller | n/a | **none**: gated commands reject |
+| caller | n/a | declared reaction `runs as` actor (ESM v10), otherwise none |
 
 ## 4. The actor behind an invoke
-On Screenplay 4.66.0 there is no caller: the invoked command runs its full pipeline (authorization, validation,
-requirements, constraints) with no caller, a command that needs one rejects, and the rejection
-ends the scenario. Screenplay has no syntax for an identity (Screenplay#383, open); never invent
-`runs as` or a caller line. At code level the realization is a Chronicle reactor whose returned
-commands run as a trusted system actor: `[ExecuteCommandsAsSystem("<role>")]` (Arc, since
-v20.56.0; also in a Stage-rendered app, whose Arc is 22.25.0) with a policy that requires that
-role. Record the intended actor in the model; the attribute lives in gap-fill code.
+Screenplay 4.125.0 declares the actor with reaction-level `runs as system role
+"<Role>"` (ESM v10); without it a gated invocation has no caller and denies.
+`given caller` is not an invocation actor. Role requirements remain enforced;
+claim conditions for this system principal remain unknown. CLI 3.41.0's older
+compiler rejects the syntax (PLAY0137), and Stage 4.51.3 admits through v7 only.
+Use the checked model in captures-and-reactions `references/invocation-identity.md`.
+Arc gap-fill uses `[ExecuteCommandsAsSystem("<role>")]` for returned commands,
+not identity inferred from prose or an imperative pipeline call.
 
 Decide and record one of:
 1. **Internal ungated command** - only if the security design supports it: not reachable by
@@ -84,13 +85,10 @@ Decide and record one of:
    requirement in `STATE.md`.
 2. **Direct `produces`** - when no decision is left (the fact is already decided) and nothing
    should refuse it.
-3. **Gated command + trusted actor + recorded gap** - when the command must stay protected.
-   Keep the gate (a policy requiring the service role), name the role as the intended actor,
-   and record that Screenplay 4.66.0 cannot declare it. The reference rejects the caller-less invoke,
-   so the automation spec cannot pass: do not write a fake passing spec. Report V4 as "not run:
-   no route" (no available route executes these specs) and record the expected rejection and
-   the trusted-actor gap separately, citing the reaction semantics (a command that requires a
-   caller rejects the reaction).
+3. **Gated command + declared trusted actor** - keep the service-role policy and
+   declare matching `runs as system role` on the reaction. Reference-test the
+   scenario with standalone 4.125.0; separately record CLI/Stage target refusal.
+   A missing actor must not be excused by removing the gate or inventing a caller.
 Never remove an existing gate only to make a reaction spec pass.
 Omitting an HTTP route is not an authorization proof: the exposure requirement stays a target
 requirement with its negative case (an outside caller is refused).

package/package/corpus/skills/cratis-screenplay-automations-and-translations/references/cases-to-specify.md

@@ -16,7 +16,7 @@ One spec in the slice does not cover the others.
 | queue opens / closes | item appears, item disappears | `then query …ById`; `when append <Closing>` + `then no readmodel … for` |
 | already done | trigger re-delivered after the result exists | `given <Result>` + `when <Command>` -> `then error "<fixed constraint message>"` |
 | invoked command rejects | validation or constraint refuses | command spec in its StateChange slice; record what the queue shows afterwards |
-| no caller | invoked command is gated | record the expected rejection and the actor decision (`automation-patterns.md` §4); V4 is "not run: no route" |
+| no declared actor | invoked command is gated | specify its denial; for the trusted path declare reaction `runs as system role` and reference-test with standalone 4.125.0 |
 | clock boundary | due exactly at the instant, just before, just after | `given clock` + `when clock`; boundary semantics are contested in the docs, mark the expectation as an assumption |
 | each branch | does every filter and conditional production have both outcomes? | concrete triggering and non-triggering values; assert the resulting facts or view |
 | denied actor | every command and query under an inherited module/feature `authorize` needs its own denial; also, can an unauthorized caller reach a gated invoked command by another origin? | command spec with otherwise-valid inputs, `given caller` carrying the wrong role/claim (or no caller) and `then denied`; separate from the caller-less reaction gap |
@@ -58,9 +58,9 @@ One spec in the slice does not cover the others.
   The decision must not depend on it (it is not protected).
 
 ## Spec limits (tool differences: `cratis-screenplay-toolchain` `references/versions.md`)
-- These Automation/Translate specs parse and bind (V3) on Screenplay 4.66.0, but no MCP tool,
-  `validate` or Stage render runs them (Stage renders no Automation or Translate slice). Report
-  V4 as "not run: no route"; never as passed.
+- Current admitted Automation/Translate specifications run through standalone
+  `screenplay test` or MCP `run-specifications`. Validate/render alone is not V4;
+  report unsupported/unbound separately from passing scenarios.
 - With Screenplay 4.66.0 (standalone or cratis 3.28.2), a command spec lists the cascade (v6 semantics: after
   `when <Command>`, `then` lists every new fact, including reaction appends). Only when a
   cratis before 3.28.2 bundle (4.60.1) is the V1 tool does it report a false PLAY0285 on a cascade (cli#242):

package/package/corpus/skills/cratis-screenplay-automations-and-translations/references/effects-and-idempotency.md

@@ -25,6 +25,27 @@ or reaction. Choose and record one of:
 Payments, legal notices and anything costly or irreversible: prefer 2 or 3 and an idempotency
 key; write a reconciliation case.
 
+## Refusal disposition and redelivery
+
+At Screenplay 4.125.0 an invocation can state ordered `on refused` selectors for
+validation, constraint (optionally named) or explicit authorization denial.
+Bare refusal does not include authorization. A matching branch declares a fact
+or leaf `acknowledge`; `$refusal.reason`/`.message` are String details and
+`.constraint` belongs only to constraint selectors. This is **authoring-only**
+(PLAY0268), not evidence that a duplicate was safely acknowledged at runtime.
+
+Recovery syntax `when redelivered <Event> to <Reaction>` selects exactly one
+existing given occurrence; it is not append or replay. `then no events` makes a
+no-new-facts contract explicit but remains unadmitted too. Full selectors,
+occurrence matching and checked source examples: captures-and-reactions
+`references/refusals-and-redelivery.md`.
+
+Infrastructure/contract errors, Unsupported and concurrency are never domain
+refusals. No `by concurrency` exists: fail/retry transient contention. Record the
+actual target's disposition, trusted actor, durable delivery identity and external
+idempotency/reconciliation owner. A branch or observer receipt alone proves no
+cascade transaction or exactly-once external effect.
+
 ## Retry identity
 - The retry must carry the same identity as the first attempt: the stream id chosen before
   the first try (never a fresh id per attempt), and the same idempotency key outward.

package/package/corpus/skills/cratis-screenplay-automations-and-translations/references/provenance.md

@@ -40,5 +40,7 @@ Changes in this version: the examples are complete fenced documents that compile
 example's anonymous-booking spec gained the `given caller` PLAY0389 requires; the todo-list
 example's list query, `reads` and retry sweep moved to marked design-only excerpts so the core
 binds); tool-qualified verdict text; the trusted-actor text now names `[ExecuteCommandsAsSystem]`
-(Arc v20.56.0, available in a rendered app's Arc 22.25.0) and Screenplay#383; Stage renders no
-Automation or Translate slice (Stage#79).
+(Arc v20.56.0). Current actor syntax was reverified at Screenplay v4.125.0
+`reactions.md`, `ReactionIdentityParser.cs`, `ReactionRefusalValidator.cs` and the
+binder's v10 selection; the checked scenario passes reference execution. CLI
+3.41.0's older parser and Stage 4.51.3's v7 planner remain target limits.

package/package/corpus/skills/cratis-screenplay-automations-and-translations/references/todo-list-example.md

@@ -13,7 +13,8 @@ The first spec lists the whole cascade (`then` names every new fact: `CoursePass
 `CertificateSent` through the reaction), and `given clock` supplies the instant that
 `$context.occurred` needs. Both 4.66.0 tools accept that cascade; the cratis 3.27.1 bundle reported a false PLAY0285 on it
 (cli#242). These specs were not
-run (V4: not run, no route); the expectations follow the v4.66.0 reference semantics.
+run in that historical probe; current admitted scenarios can be run with
+standalone `screenplay test` or MCP `run-specifications`.
 
 What the model proves and what it does not:
 
@@ -22,8 +23,10 @@ What the model proves and what it does not:
 - Not proven: that the certificate email reaches the person once. See
   `references/effects-and-idempotency.md`.
 - The actor behind `SendCertificate` is a recorded security decision in the `Certification`
-  module `description`, because reaction invocations carry no caller on Screenplay 4.66.0 (Screenplay#383).
-- No local engine runs Automation specifications: report them as authored, not as run.
+  module `description`: this example declares no reaction identity, so its
+  invocations remain caller-less. A gated trusted path can instead declare
+  `runs as system role` on 4.125.0 (ESM v10), with separate CLI/Stage refusal.
+- Report reference outcomes only after executing the selected scenarios.
 
 ```screenplay
 // Todo-list automation. Shape: CoursePassed opens an item -> CertificateSender invokes
@@ -101,7 +104,7 @@ module Courses
           for "0d3b9e2a-6c4f-4f1e-8b7a-5e2d1c3b4a01"
 
 module Certification
-  description "Trusted background boundary. No persona or screen issues SendCertificate; only the CertificateSender reaction invokes it, and reaction invocations carry no caller. Leaving the command ungated is a SECURITY DECISION, accepted only because: (1) it appends a fact keyed to one enrolment, (2) a repeat is rejected by IssueOnce, (3) the realization must not expose it to external callers (requirement to verify in the target). If (3) cannot hold, gate it with a service-actor policy and record the capability gap instead (reaction invocations carry no caller: Screenplay#383)."
+  description "Trusted background boundary. No persona or screen issues SendCertificate; only the CertificateSender reaction invokes it, and reaction invocations carry no caller. Leaving the command ungated is a SECURITY DECISION, accepted only because: (1) it appends a fact keyed to one enrolment, (2) a repeat is rejected by IssueOnce, (3) the realization must not expose it to external callers (requirement to verify in the target). If (3) cannot hold, gate it with a service-actor policy and declare runs as system role on the reaction (ESM v10), retaining the CLI/Stage realization gap."
   feature Certificates
     slice StateView CertificatesToSend
       description "Work queue: membership means 'still to send'; there is no status flag"

package/package/corpus/skills/cratis-screenplay-automations-and-translations/verification.json

@@ -4,13 +4,13 @@
   "fixtures": [],
   "assertions": [
     { "kind": "skill-contains", "value": "`[ExecuteCommandsAsSystem(\"<role>\")]`" },
-    { "kind": "skill-contains", "value": "Screenplay#383" },
-    { "kind": "skill-contains", "value": "renders no Automation or Translate slice" },
-    { "kind": "skill-contains", "value": "never invent `runs as`" },
+    { "kind": "skill-contains", "value": "ESM v10" },
+    { "kind": "skill-contains", "value": "STAGE-ESM-024" },
+    { "kind": "skill-contains", "value": "runs as system role" },
     { "kind": "skill-contains", "value": "**One meaning of Translation:**" },
     { "kind": "skill-contains", "value": "complete, open or blocked" },
     { "kind": "skill-contains", "value": "never write a mapping" },
-    { "kind": "skill-contains", "value": "V4 is \"not run: no route\"" },
+    { "kind": "skill-contains", "value": "run-specifications" },
     { "kind": "skill-contains", "value": "never skipped silently" },
     { "kind": "skill-contains", "value": "not applicable: no queue" }
   ]

package/package/corpus/skills/cratis-screenplay-captures-and-reactions/SKILL.md

@@ -32,16 +32,10 @@ source is the single flow model.
 | `Cratis.Screenplay` | main `fd18129` | Command-only inline event boundary |
 | `Cratis.Screenplay` | `4.66.0` (`c89198b`) | ESM v6: reactions, clock, trigger and capture specifications bind; `invokes` caller rule; probed with the standalone tool and its MCP server |
 
-The update follows `commands.md`, `events.md` and `diagnostics.md` at that main
-commit (after v4.52.0).
-
-Historical baseline evidence: the original examples were checked against the Screenplay repository at tag `v4.31.0` (commit `355dffb`):
-`Documentation/screenplay/{captures,captures/grammar,reactions,triggers,interactions,file-references,grammar,diagnostics}.md`
-and decisions 0003, 0006 and 0009; those original examples compiled with that
-version's compiler. The specification actions and ESM v6 text were checked at
-`v4.66.0` (see its row above), and the complete examples here and in
-`references/complete-examples.md` compile with the standalone 4.68.0 compiler.
-Reverify before claiming another version behaves the same.
+The table records historical examples/probes; they are not reclassified as
+current execution evidence. Refusal/redelivery guidance follows released
+v4.125.0 `reactions.md`/`specifications.md`. Current pins are in toolchain
+`references/versions.md`; reverify before promoting an old probe to that version.
 
 ⚠️ **Which tool admits them depends on its Screenplay version.** The ESM level
 decides, not the slice type:
@@ -50,14 +44,10 @@ decides, not the slice type:
   `Translate` slices, reactions, declared triggers and captures bind, and the
   reference runner executes them. Probed: the complete example below is
   `executableReady` over `screenplay mcp`.
-- **`cratis` 3.28.2 (bundles Screenplay 4.66.0, ESM v1-v6):** the same as the standalone
-  tool. Probed: the complete examples validate with warnings as errors and are
-  `executableReady` over `cratis screenplay mcp`. `cratis` before 3.28.2 (Screenplay
-  4.60.1, ESM v1-v5) failed an `Automation` or `Translate` slice at binding with `PLAY0268`
-  (*Slice '<name>' of type '<type>' is not admitted by ESM v1*), reported reactions as
-  *requires portable occurrence and effect semantics* and captures as *require a portable
-  compiled CDL plan*, and gave a false `PLAY0285` on a specification that follows a reaction
-  cascade (Cratis/cli#242).
+- **Historical CLI 3.28.2 / Screenplay 4.66.0 probe:** complete examples validated
+  and were executableReady through MCP. Earlier 4.60.1 bundles refused v6 at
+  binding and falsely reported PLAY0285 on cascades. Toolchain `references/versions.md`
+  separates that history from current pins.
 - **Stage 4.24.2** admits ESM v1-v4 and renders no `Automation` or `Translate`
   slice. The automation is gap-fill, with the `.play` slice and its specifications
   as the contract: `cratis-screenplay-render-and-gap-fill`.
@@ -69,25 +59,26 @@ Method (the four-part automation test, loops, translations versus automations):
 
 ## Specify what sets them off
 
-A specification names what sets the automation off: `when clock`, `when trigger` or `when capture`. No command runs these specifications; report one as authored, not executed.
+A specification names what sets the automation off: `when clock`, `when trigger`
+or `when capture`. Execute admitted scenarios through `screenplay test` or MCP
+`run-specifications`; source compilation alone is only authored evidence.
 
 Read [references/specifying-triggers-and-clock.md](references/specifying-triggers-and-clock.md) when writing a specification for a reaction, trigger or capture, or when the clock, occurrence or limit rules matter.
 
 ## Caller-less invokes and unprotected reads
 
-**Who is the caller of an `invokes`?** Nobody. In the reference execution the invoked
-command runs its full pipeline - authorization, validation, requirements,
-constraints - **with no caller**; a command that needs one rejects, and the
-rejection ends the scenario. Each invoked command is atomic, but the cascade is not,
-so facts accepted earlier remain. There is no syntax for a trusted identity in the verified Screenplay versions
-(Screenplay#383, open): never invent `runs as` or a `given caller` for a reaction.
-Say so in the model: a `description` on the reaction that names the trusted actor
-the target must use. At code level a rendered or hand-written target runs such a
-command as the system with `[ExecuteCommandsAsSystem]` (Arc 20.56.0 and later, so
-also in a rendered application's Arc 22.25.0). An authorized command a reaction
-invokes needs that decision made explicit, in the model's description and in the
-gap-fill code, not left to a rejection nobody expected. Cascades and their
-specification limits: `cratis-screenplay-specifications`.
+**Who is the caller of an `invokes`?** Without a declared actor, nobody.
+Screenplay 4.125.0 supports reaction-level `runs as system role "<Role>"`
+(optional roles, joined with `and role`). It selects ESM v10 and supplies the
+reference invocation's authenticated system principal with exactly those roles;
+`given caller` does not supply it. Keep gates and declare the least-privilege actor.
+Read [invocation identity](references/invocation-identity.md) for the checked
+scenario, claim/unknown semantics and PLAY0647–0652/0557 diagnostics.
+
+CLI 3.41.0's 4.114.0 compiler rejects this source with PLAY0137; its version gate
+and Stage 4.51.3 planner admit only through v7. Target realization is gap-fill,
+using Arc `[ExecuteCommandsAsSystem]` for returned commands. Each invoked command
+is atomic, not the whole cascade; earlier accepted facts remain after a later refusal.
 
 ⚠️ **Declared, not enforced.** A trigger `reads` gives no runtime protection. From
 ESM v6 the binder refuses to treat it as one: a trigger with `reads` that **produces
@@ -101,9 +92,19 @@ the input selection or not; nested paths and read aliases fail binding): keep th
 the invoked command or the implementation. Under `cratis` before 3.28.2 none of this
 bound at all (`PLAY0268`); `cratis` 3.28.2 binds it like the standalone tool.
 
+## Refusals and recovery redelivery
+
+At 4.125.0, invocation refusal selectors, `$refusal` branch values,
+`acknowledge`, `when redelivered ... to ...` and `then no events` are valid
+authoring intent but refuse binding with PLAY0268. Read
+[refusals and redelivery](references/refusals-and-redelivery.md) for first-match
+selectors, typed values, occurrence matching, diagnostics and the checked
+unbound example. Never acknowledge infrastructure or concurrency failures.
+
 ## Complete example (ESM v6)
 
-One document with every construct (application trigger, reactions on an event, a trigger, a view read and the clock, and a capture with specifications) is kept in the reference file.
+The reference document covers v6 triggers, event/clock reactions, view reads and
+capture specifications. Refusal/redelivery forms use their separate checked reference.
 
 Read [references/complete-examples.md](references/complete-examples.md) when you need a complete, compiling parent document for an excerpt or want to check the authoring and binding prerequisites.
 
@@ -338,7 +339,8 @@ something is reported. `Startup` and `Shutdown` are registered the second way.
       `PLAY0268` at binding and a false `PLAY0285` on cascade specifications, and report them
       as tool skew.
 - [ ] The tool that bound the model is named (Screenplay 4.61 or later, so standalone or
-      `cratis` 3.28.2 or later, for ESM v6 constructs); no tool runs the specifications.
+      `cratis` 3.28.2 or later, for ESM v6 constructs); reference scenarios use
+      `screenplay test`/MCP. Unadmitted refusal/redelivery is not executed evidence.
 - [ ] Each automation has all four components — occurrence, state consulted,
       conditional logic, resulting command or event. If it always fires
       unconditionally it is co-production, not an automation.
@@ -351,8 +353,8 @@ something is reported. `Startup` and `Shutdown` are registered the second way.
       value the trigger takes, and clock triggers read without `by`.
 - [ ] Nobody reports trigger or command `reads` as protected; UI clicks are
       interactions, not triggers.
-- [ ] Every `invokes` of an authorized command names the trusted actor in a
-      description; no caller is invented for a reaction.
+- [ ] Every gated invocation declares its trusted actor with reaction `runs as`
+      (ESM v10) or records the target gap explicitly; `given caller` is not that actor.
 
 ## Route near misses
 

package/package/corpus/skills/cratis-screenplay-captures-and-reactions/references/complete-examples.md

@@ -97,7 +97,7 @@ module Delivery
 
 ## Reaction with `produces` and `invokes`
 
-Parent of the `Provisioner` excerpt. The invoked command runs with no caller in the
+Parent of the `Provisioner` excerpt. The reaction declares no `runs as system`, so the invoked command runs with no caller in the
 reference execution.
 
 ```screenplay

package/package/corpus/skills/cratis-screenplay-captures-and-reactions/references/invocation-identity.md

@@ -0,0 +1,84 @@
+<!-- Copyright (c) Cratis. All rights reserved. -->
+<!-- Licensed under the MIT license. See LICENSE file in the project root for full license information. -->
+
+# Declare the actor behind a reaction invocation
+
+## Contents
+
+- Trusted system identity
+- Checked example
+- Diagnostics and target boundaries
+
+## Trusted system identity
+
+Screenplay 4.125.0 supports one reaction-level line
+`runs as system [role "<Role>" and role "<Role>"]`. Roles are optional, nonempty,
+distinct quoted literals; personas and expressions are not accepted. Put it
+under the reaction, not its trigger or invocation. The declaration selects
+**ESM v10**. Without it, invocations remain caller-less; `given caller` never
+supplies an actor to a reaction.
+
+The reference evaluator authenticates a system principal with exactly the stated
+roles. Claim conditions remain unknown, including under not; a satisfied role
+alternative may allow, but final unknown denies. This is not the caller's audit
+identity and does not invent Arc's system subject claims. The identity covers
+invoked/returned commands across that reaction's triggers, not imperative
+pipeline calls in bodies, direct productions, reads, refusal productions or
+causation. Record the actual least-privilege role, not a prose-only actor or an
+ungated command substituted to make the scenario pass.
+
+## Checked example
+
+This complete model compiled with warnings as errors and its reference scenario
+passed on standalone Screenplay 4.125.0:
+
+```screenplay
+policy Worker
+  require role "Worker"
+module Work
+  feature Processing
+    slice StateChange RecordWork
+      command RecordWork
+        workId String identifier
+        authorize Worker
+        produces event WorkRecorded
+    slice Automation ProcessWork
+      event WorkRequested
+        workId String
+      reaction Processor
+        runs as system role "Worker"
+        when WorkRequested
+          workId
+          invokes RecordWork
+            workId = workId
+      specification ProcessingRequestedWork
+        when append WorkRequested
+          workId = "work-1"
+        then WorkRecorded
+          for "work-1"
+```
+
+## Diagnostics and target boundaries
+
+- PLAY0647: malformed, repeated or misplaced identity, including duplicate/empty roles.
+- PLAY0648: gated invocation without declared identity and without an authorization
+  refusal branch. PLAY0557 instead warns on that refusal branch; it cannot turn
+  an always-denied caller-less invocation into a trusted path.
+- PLAY0649: identity with neither invocations nor an implementation body.
+- C# binding PLAY0650/0651 warns about unused roles or definite authorization
+  denial; opaque/unknown cases are not guessed. `--check privilege` (PLAY0652)
+  reviews whether event producers require every elevated role, not runtime safety.
+
+CLI 3.41.0 bundles Screenplay 4.114.0, which does not parse `runs as`: the example's
+`cratis screenplay validate --executable --warnings-as-errors` returns PLAY0137,
+exit 5. It cannot render this source. Its render version gate separately admits
+only through v7 (CLI-RENDER-004 for newer admitted compiler output), while Stage
+4.51.3's direct planner audits through v7 and refuses v10 with STAGE-ESM-016.
+Clock/application-trigger identities have no Stage Arc realization either.
+Use authorized gap-fill with the model as contract; returned-command Arc identity
+uses `[ExecuteCommandsAsSystem]`, never permission inferred from a model header.
+Refusal/redelivery syntax remains unadmitted even when identity itself runs.
+
+Authority: Screenplay v4.125.0 `reactions.md`, `ReactionIdentityParser.cs`,
+`ReactionRefusalValidator.cs`, `SemanticModelBinder.cs`; CLI v3.41.0
+`RenderedSemanticVersions.cs`; Stage v4.51.3 `SemanticCratisAdmission.cs`.

package/package/corpus/skills/cratis-screenplay-captures-and-reactions/references/refusals-and-redelivery.md

@@ -0,0 +1,102 @@
+<!-- Copyright (c) Cratis. All rights reserved. -->
+<!-- Licensed under the MIT license. See LICENSE file in the project root for full license information. -->
+
+# Refusal handling and redelivery intent
+
+## Contents
+
+- Select a refusal
+- Branch values and acknowledgement
+- Redeliver an existing occurrence
+- Recovery boundaries
+
+## Select a refusal
+
+At Screenplay 4.125.0 these forms are authoring-only: binding refuses the whole
+model with PLAY0268, even when the source is valid. Do not execute them as append
+scenarios or silently drop branches. Sources: released `reactions.md`,
+`specifications.md`, decision 0030.
+
+Inside an `invokes` block, ordered selectors state intended recovery:
+
+| Selector | Matches at future admission |
+| --- | --- |
+| `on refused` | Validation or constraint, not authorization |
+| `on refused by validation` | Input/concept/require rejection |
+| `on refused by constraint` | Any constraint rejection |
+| `on refused by constraint <Name>` | One unambiguously resolved applicable constraint |
+| `on refused by authorization` | Unauthorized, never an opaque policy's Unsupported result |
+
+The first matching selector wins. Repeated selectors or narrower branches after
+covering branches report PLAY0540; bare refusal does not cover authorization.
+Unknown named constraints report PLAY0542; known but inapplicable constraints
+also report PLAY0540. Authorization recovery requires a deliberate trusted path,
+not a fictional caller supplied by `given caller`. On current source a declared
+reaction `runs as` affects identity diagnostics, but refusal branches themselves
+remain unadmitted; do not infer their execution from that separate capability.
+
+## Branch values and acknowledgement
+
+A branch contains leaf `acknowledge` alone, or ordinary `produces <Event>` blocks
+with mappings and optional `for`. Empty branches, repeated acknowledgement,
+acknowledgement plus productions, operations, inline events and attachments refuse.
+Acknowledgement states a terminal disposition, not a successful command or fact.
+
+Branch event mappings may use String values `$refusal.reason` (validation,
+constraint, authorization), `$refusal.message` (verbatim details, including symbolic
+localization keys), and `$refusal.constraint` only in constraint selectors.
+Unknown members, wrong scope or incompatible targets report PLAY0541. Messages
+are display details, not stable identity; trigger inputs remain available, read
+aliases do not become branch inputs.
+
+The intended admitted behavior stops remaining invocations of that trigger after
+handling a refusal, but lets other reactions/cascades from accepted facts settle.
+The refused command adds no facts; branch appends obey normal constraints and
+cannot catch their own refusal through another branch. Unhandled refusal retains
+earlier accepted facts. This is a future contract, not passing runner behavior.
+
+## Redeliver an existing occurrence
+
+The complete authoring model below compiles without warnings on 4.125.0;
+`screenplay test` intentionally returns 3/unbound with PLAY0268 for redelivery
+and no-event assertion, not a recovery pass:
+
+```screenplay
+module Billing
+  feature Claims
+    slice Automation Recovery
+      event Approved
+        invoice String
+      reaction Claimer
+        when Approved
+      specification Recovery
+        given Approved
+          for "invoice-1"
+          invoice = "invoice-1"
+        when redelivered Approved to Claimer
+          for "invoice-1"
+          invoice = "invoice-1"
+        then no events
+```
+
+`to <Reaction>` must resolve to one observer of the event (PLAY0544). Optional
+`for`, payload values and stream/no-stream route narrow effective given occurrences;
+exactly one definitely matching occurrence and no unknown candidates are required
+(PLAY0543). Equal duplicate givens are still separate candidates. A locator with
+no route is a wildcard; explicit stream ids compare canonically, and `no stream`
+selects only unrouted givens. This is the sole action, not an extra action after
+append. Intended delivery uses the existing occurrence, never appends it again.
+
+Leaf `then no events` explicitly expects no new facts after a non-append action.
+It may accompany view/query/response assertions, not events, any-order events,
+error or denial. It is invalid after `when append` (PLAY0545), and remains
+unadmitted even on a model without a refusal branch.
+
+## Recovery boundaries
+
+Exceptions, infrastructure/contract errors, Unsupported and concurrency conflicts
+are not refusals. There is no `by concurrency`: transient contention fails/retries,
+not acknowledgement. Ordinary redelivery is not replay. Neither these forms nor
+an observer/occurrence locator prove runtime deduplication, a cascade-wide
+transaction, once-only delivery or exactly-once external effects. Specify the
+actual recovery owner and target enforcement before making those claims.

package/package/corpus/skills/cratis-screenplay-captures-and-reactions/references/specifying-triggers-and-clock.md

@@ -18,8 +18,10 @@ specification IssuingTheWeeklyDigest
 ```
 
 Under `cratis` before 3.28.2 these actions parsed and were checked against the application
-but bound to nothing (`PLAY0268` names ESM v6, decision 0022); on 3.28.2 they bind. Either way
-no command runs them: report such a specification as authored, not executed. Clock rules: the clock is UTC and exact; an
+but bound to nothing (`PLAY0268` names ESM v6, decision 0022); on 3.28.2 they bind.
+Current standalone 4.125.0 executes admitted scenarios through `screenplay test`
+or MCP `run-specifications`; source compilation alone is authored evidence.
+Clock rules: the clock is UTC and exact; an
 occurrence fires once when it is **due after `given clock` and at or before
 `when clock`**, in time order; intervals count from the Unix epoch; `when clock`
 needs `given clock`, so equal instants fire nothing. Limits: 10,000 occurrences per

package/package/corpus/skills/cratis-screenplay-captures-and-reactions/verification.json

@@ -57,7 +57,7 @@
     },
     {
       "kind": "skill-contains",
-      "value": "Screenplay#383"
+      "value": "ESM v10"
     },
     {
       "kind": "skill-contains",