@cratis/pi 7.21.0 → 7.23.0

package/package/corpus/skills/cratis-screenplay-render-and-gap-fill/verification.json

@@ -37,14 +37,14 @@
     },
     {
       "kind": "skill-contains",
-      "value": "case A or C today"
+      "value": "case A or C for rendering"
     },
     {
       "kind": "skill-contains",
       "value": "STAGE-ESM-026"
     },
     { "kind": "skill-contains", "value": "Generated command values and `returns` responses (ESM v7) bind and run" },
-    { "kind": "skill-contains", "value": "tracked in Stage#201" },
+    { "kind": "skill-contains", "value": "STAGE-ESM-028`/`STAGE-ESM-029" },
     { "kind": "skill-contains", "value": "authored-UI parity" },
     { "kind": "skill-contains", "value": "responsible tool version" }
   ]

package/package/corpus/skills/cratis-screenplay-scenario-coverage/SKILL.md

@@ -183,8 +183,9 @@ scope is reported as explicitly incomplete); V1 passes with the tool named in
   populated-then-removed spec.
 - V1 passes (standalone `screenplay` required when cascades are specified); report tool and
   version.
-- V4 is "not run: no route" unless a Screenplay reference route was actually executed (Stage's spec runner is target-engine evidence, never V4); V1/V3 do not prove specs
-  pass. V5 is "not run" unless rendering was attempted; report admission, publication, build and
+- Run V4 through standalone `screenplay test` or MCP `run-specifications`;
+  if not executed, report the actual host/input reason, not a blanket no-route
+  claim. Stage's runner is target-engine evidence, never V4; V1/V3 do not prove pass. V5 is "not run" unless rendering was attempted; report admission, publication, build and
   tests separately.
 - Match guarantees to evidence: `.play` outcomes, in-process Chronicle scenarios and real-kernel
   tests are not interchangeable (`references/chronicle-verification.md`).

package/package/corpus/skills/cratis-screenplay-scenario-coverage/references/spec-forms-by-mode.md

@@ -3,7 +3,11 @@
 The subsets themselves (what binds, what renders) are owned by `cratis-screenplay-toolchain`
 (its executable and renderable subset references); version facts by its `references/versions.md`. This file
 says what that means for writing specs. A form outside the chosen mode is never deleted from a
-design model: keep it and record the gap.
+design model: keep it and record the gap. The detailed Stage 4.24.x rows below
+retain historical admission evidence; current pins are Screenplay 4.127.0 / CLI
+3.41.0. Run actual target admission instead of assuming old restrictions carry over.
+Typed example/override forms: `cratis-screenplay-specifications`
+`references/examples-and-routes.md`.
 
 | Form | design | executable | renderable |
 |---|---|---|---|
@@ -19,6 +23,10 @@ design model: keep it and record the gap.
 | Command spec listing reaction cascade events | yes (v6 semantics) | false PLAY0285 on a cratis before 3.28.2 bundle only; see SKILL.md "Version skew" | no (no reactions) |
 | `generated <name> = <value>` under `when`, `then returns` (ESM v7) | yes | yes on standalone Screenplay 4.68.0 or later; not on the 4.66.0 bundled in cratis 3.28.x (`PLAY0268`) | no (Stage does not render ESM v7) |
 | `then events in any order` | yes | yes | yes |
+| Event `stream` / `no stream`, typed `for` and stream ids | yes | ESM v8 at 4.125.0 | CLI 3.41.0 refuses models above v7 before planning |
+| Typed examples and overrides | yes | expanded and type-checked before binding; required fields remain required | depends on expanded contract, not fixture reuse |
+| `given operation ... fails`, `then operation`, `then compensated` | yes | unadmitted PLAY0268 | gap-fill |
+| Refusal branches, `when redelivered`, `then no events` | yes | unadmitted PLAY0268 | gap-fill |
 | Composite (JSON) values in specs | yes | yes | no |
 | Rules over dates or `today`, nested paths | spec them in design | rule does not bind: `recorded` | `recorded` |
 | Bodied rules, code policies | spec them | spec reported **unsupported**, never passed | no |
@@ -36,7 +44,10 @@ bundle is available). Mark each such spec in the coverage matrix as
   the projection's effective key (`cratis-screenplay-slice-design` `references/read-model-design.md`
   decision table). View specs assert through a keyed query.
 - Run V3 (binding-ready, per `cratis-screenplay-toolchain`); binding-only codes (PLAY0273/0350/0352/0388/0389) appear only there.
-- V4 (reference specs run) needs a runner route; otherwise report "V4 not run: no route". Unsupported is not passed.
+- V4 runs through `screenplay test` or MCP `run-specifications`; record expected,
+  discovered/selected and passed/failed/unsupported counts. Unbound/unsupported
+  is not passed. Authoring-only refusal/redelivery/operation specs remain recorded
+  contracts; test them at the owning target after authorized gap-fill.
 
 ## Renderable mode
 - Specs use given events, a command `when`, and then events / readmodel / query / error /

package/package/corpus/skills/cratis-screenplay-slice-design/SKILL.md

@@ -65,8 +65,9 @@ report and the slice `description`, and continue.
    origin must be **reachable** (some screen, form, reaction or integration leads to the
    command) and **authorized** (the persona's policies satisfy every gate on module, feature
    and command). A command may have several origins; each must be real. A reaction's `invokes`
-   has no caller, so a gated command it invokes is refused: design the trusted path, never
-   delete the gate.
+   has no caller unless the reaction declares `runs as system role "<Role>"` (ESM v10), so a
+   gated command it invokes is refused: declare that trusted path with the role the gate
+   admits, never delete the gate.
 3. **Design the command** (`references/command-inventory.md`). Imperative business name for
    **one** decision (`ReassignLocker`, `CorrectLockerVolume`). A form verb (`Update`, `Edit`,
    `Save`, `Set`, `Change`, `Manage` + noun) means several decisions share a form: ask which
@@ -92,7 +93,16 @@ report and the slice `description`, and continue.
    `$context.occurred` or caller identity. No event-source id in the payload (it is the `for`);
    references to other instances are payload. No nullable property by default (a required value
    or a separate event). No PII on the identifier; one data subject per stream. Add a field only
-   when something downstream needs it.
+   when something downstream needs it. At 4.127.0 personal values use bare `pii`,
+   operational secrets `secret`; declare processing use/basis/retention in `purpose`,
+   not a reason. An event-property `subject` may identify a different person from
+   the stream but is report-only, not runtime propagation. See command-surface
+   `references/compliance.md`.
+   Trace caller details to claims or a keyed single-result identity-source query
+   (built-in/claim/literal key, detail-independent effective gate, compatible result).
+   The `identity` block is authoring metadata; executable `$identity.<detail>` reads
+   remain PLAY0268. `scoped to` is opaque, not a detail reference; see command-surface
+   `references/context.md`.
 5. **Events or views?** For each value someone needs: was it decided or supplied (event), or
    can it be worked out from facts already recorded (view)? Test, anti-patterns and where the
    outputs of an automation go: `references/read-model-design.md` *Events or views*. Decided calculations (a quoted

package/package/corpus/skills/cratis-screenplay-slice-design/references/command-inventory.md

@@ -118,9 +118,11 @@ not been asked the refusal questions.
 - Copying state into the command so `require` can read it, instead of `reads <View>`.
 - An origin that is neither reachable (no screen, form or reaction leads there) nor authorized
   for the persona who should act.
-- A reaction invoking a gated command: the invocation has no caller and is refused; design the
-  trusted path (`cratis-screenplay-automations-and-translations`), never delete the gate.
+- A reaction invoking a gated command without `runs as system role "<Role>"`: the invocation has
+  no caller and is refused; declare the trusted path with the role the gate admits
+  (`cratis-screenplay-automations-and-translations`), never delete the gate.
 - Refusals recorded as prose in the `description` with no layer and no spec row.
 - Personal data or secrets as command input: values are by default recorded in the causation chain, so treat them as permanent
   (retention can be configured in newer Chronicle; verify it, never audit secrets).
-  Mark the concept `@pii` or record the need; never put `@pii` on the identifier's concept.
+  Mark concepts bare `pii` for personal data or `secret` for operational secrets,
+  never on the identifier; declare use/basis/retention in a purpose, not a reason.

package/package/corpus/skills/cratis-screenplay-slice-design/references/review-questions.md

@@ -9,7 +9,8 @@ domain consequence.
 - Does this command apply in every state and set most of the entity's fields? That is a form:
   which business reasons hide behind it? What does a person decide with each field?
 - Does a command input carry a secret or personal value (by default the causation chain keeps it; retention is configurable, verify it)?
-  Mark the concept `@pii` or record the need for a not-audited marking.
+  Mark the concept bare `pii` for personal data or `secret` for an operational
+  secret; inspect declared purpose coverage, not just the reason. Never protect an identifier.
 - Does this optional event property hide two situations, or is it an optional detail?
 - Does an event exist for a derived condition? Only when a domain expert names it and something
   reacts to it; merge causes only when they mean the same to the business.

package/package/corpus/skills/cratis-screenplay-slice-design/references/rule-layers.md

@@ -35,7 +35,8 @@ Command property values are, by default, recorded in the causation chain of the
 produce, so treat them as permanent. Newer Chronicle versions can omit causation properties
 (`CausationPropertyRetention.Omit`, Chronicle v19.32.0); rendered apps pin Chronicle 19.8.1.
 Verify the actual auditing and retention configuration before relying on omission, and never
-audit secrets. Never mark the identifier's
-concept `@pii`; use a surrogate `Uuid` identity and carry the personal value as a `@pii`
-property. Bearer tokens, magic links and signed URLs are never facts (record a keyed hash or
+audit secrets. Classify personal values as bare `pii` and operational secrets as
+`secret` on their concepts, never the identifier concept. Use a surrogate identity
+and protected payload (PLAY0515). Processing use/basis/retention is a `purpose`,
+not a reason; see command-surface `references/compliance.md`. Bearer tokens, magic links and signed URLs are never facts (record a keyed hash or
 reference).

package/package/corpus/skills/cratis-screenplay-slice-design/references/slicing.md

@@ -62,6 +62,46 @@ For `worked-example.md`:
 | LockerBoard | LockerInstalled, LockerAssigned | InstallLocker, AssignLocker | |
 | RequestProgress | LockerRequested, LockerAssigned | RequestLocker, AssignLocker | |
 
+### Declare container dependencies
+
+At Screenplay 4.125.0, modules and features may declare `depends on <Name>`, one
+target per line. Use a bare sibling name or a qualified module/feature address.
+Bare names resolve inside out: siblings, ancestor siblings, then root modules;
+qualified names match an unambiguous trailing address. Ambiguity is `PLAY0198`.
+Self, ancestor, descendant and unresolved targets warn with `PLAY0554`; repeats
+keep the first resolved target and warn with `PLAY0555`.
+
+Declarations accumulate on the same owner in ordinal file-path order, independent
+of board import order. Layout expansion writes them only in the owner's file.
+They are authoring metadata: no execution rule, implementation order, identity
+or executable-model revision change.
+
+Once a container declares dependencies, its own inventory must cover counted
+explicit references leaving it, including descendants. Parent and child lists
+are independent. Module targets cover all their features; feature targets cover
+their descendants. `usesFactsFrom`, `reactsTo`, `decidesFrom`, `asks` and `shows`
+count; specification-only and outside-context edges do not. `PLAY0552` warns on
+uncovered producer modules; `PLAY0553` marks unused declarations and `PLAY0556`
+mutual declarations as information. Ambiguous ownership is provisional, not proof
+of an undeclared dependency. Inspect MCP `dependency-graph`'s `declarations` view.
+
+Example: Payroll declares Timesheets; its Handover feature declares
+Timesheets.Approval and sibling Runs. These are dependency inventories, not
+actual references or execution dependencies:
+
+```screenplay
+module Payroll
+  depends on Timesheets
+  feature Handover
+    depends on Timesheets.Approval
+    depends on Runs
+  feature Runs
+module Timesheets
+  feature Approval
+```
+
+Source: Screenplay `v4.125.0:Documentation/screenplay/slices.md` and `folders.md`.
+
 ## State-transition table (per entity)
 
 Rows are states (named after the fact that put the entity there); columns are commands. Each

package/package/corpus/skills/cratis-screenplay-specifications/SKILL.md

@@ -37,15 +37,12 @@ The update follows `commands.md`, `events.md`, `types.md` and
 `specifications.md` at that main commit (after v4.52.0). This pass compiles the
 changed examples; it does not rerun the reference runner.
 
-**Which tool says what.** The standalone `screenplay` tool 4.68.0 admits ESM v1-v7.
-The `cratis` CLI 3.28.2 and 3.28.3 bundle Screenplay 4.66.0 (ESM v1-v6: generated fixtures and `then returns` report `PLAY0268`). Before `cratis` 3.28.2 the
-bundle was Screenplay 4.60.1, which admitted ESM v1-v5 only and reported a false
-`PLAY0285` on reaction cascades (see "Version skew" in [references/reactions-and-cascades.md](references/reactions-and-cascades.md)). Facts below marked **ESM v6**
-hold for Screenplay 4.61.0 and later: the standalone tool and `cratis` 3.28.2 or later. The full table is in `cratis-screenplay-toolchain`
-(`references/versions.md`; read it before choosing a compiler or interpreting version-dependent binding diagnostics). Neither tool runs specifications: `screenplay` and
-`cratis screenplay validate` parse and check consistency, the MCP server also binds,
-and spec outcomes come only from the reference runner as a library, Stage's
-specification runner or a rendered application's tests.
+Current specification syntax follows Screenplay v4.125.0 `specifications.md`;
+older probes in the table remain historical. Pins: `cratis-screenplay-toolchain`
+`references/versions.md`. Compile commands check source, not reference execution.
+Use `screenplay test` or MCP `run-specifications` for V4; Stage/target tests are
+separate evidence. Unsupported/unbound is never a pass. Typed examples and
+route assertions are in [examples and routes](references/examples-and-routes.md).
 
 Checked against the Screenplay repository at tag `v4.31.0` (commit `355dffb`):
 `Documentation/screenplay/{specifications,policies,constraints,readmodels,diagnostics}.md`.
@@ -95,9 +92,8 @@ target has one normalized behavior to match.
   rejects, the earlier accepted facts and their projections remain.
 
 Unsupported is not passed. Report it as "needs a target", not as green. "Specified"
-and "bound" are never "passing": no command-line tool runs these specifications, so a
-pass is claimed only from the reference runner, Stage's specification runner or a
-rendered application's tests, and named as such.
+and "bound" are never "passing": run the reference CLI/MCP route or the owning
+target tests, and name the engine, version and expected/discovered selection.
 
 ## The vocabulary
 
@@ -184,7 +180,7 @@ Read [references/worked-example.md](references/worked-example.md) when writing o
 
 ## Generated fixtures and return expectations (ESM v7)
 
-Standalone `screenplay` 4.68.0 or later binds and runs generated fixtures (`generated <name> = <value>`, `for` beneath `when`) and `then returns`; the cratis CLI 3.28.3 does not. If execution reaches generation without every generated value supplied, the run is unsupported and never passes.
+Current standalone and bundled compilers bind generated fixtures (`generated <name> = <value>`, `for` beneath `when`) and `then returns` as ESM v7. If execution reaches generation without every generated value supplied, the run is unsupported and never passes.
 Read [references/generated-fixtures.md](references/generated-fixtures.md) when writing generated-value fixtures or scalar and record return expectations for a command.
 
 ## Actions beyond commands
@@ -197,6 +193,18 @@ Read [references/actions-beyond-commands.md](references/actions-beyond-commands.
 From ESM v6 every action sets reactions off and `then` events compare every new fact, the action's and the reactions'. A specification whose action is a command goes in the slice that declares the command. A false `PLAY0285` on a cascade under `cratis` before 3.28.2 is tool skew, not a modeling error: never delete the `then` line to silence it.
 Read [references/reactions-and-cascades.md](references/reactions-and-cascades.md) when a specification's expected events include what a reaction appends, when a cascade, clock tick or invoked command is involved, or when `cratis` reports `PLAY0285` on a model that `screenplay` accepts (it holds the "Version skew: cascades and the false `PLAY0285` (cratis before 3.28.2)" section).
 
+## Reusable fixtures, routes and recovery intent
+
+Use typed `example` declarations for repeated event/command/read-model values;
+step overrides keep the action/outcome visible and carry authored/example/override
+provenance. Event `stream`/`no stream` assertions bind as ESM v8; typed `for` and
+stream ids are not guessed. Read [examples and routes](references/examples-and-routes.md).
+
+`given operation ... fails`, `then operation` and `then compensated` describe
+future external-work behavior. Reaction refusal branches, `when redelivered`
+and `then no events` are also authoring-only: compile them, but report their
+PLAY0268 binding refusal instead of an executed result. Preserve the contract.
+
 ## Rejections and denials say different things
 
 `then error "<message>"` says **rejected, for this reason** — pin it when the
@@ -252,9 +260,9 @@ For view specifications:
 
 ## Verify
 
-- [ ] `screenplay <model> --warnaserror` reports zero errors and zero warnings
-      (standalone 4.68.0 or `cratis` 3.28.2 or later, bundling 4.66.0; under `cratis` before 3.28.2 expect the false
-      `PLAY0285` on reaction cascades and record that it is skew).
+- [ ] Validate the complete root with warnings as errors, naming tool/version.
+      Current standalone pin: 4.127.0. Run specification examples through
+      `screenplay test`; expected unadmitted syntax reports unbound, not passed.
 - [ ] Executable diagnostics are clean too: `PLAY0350`, `PLAY0352`, `PLAY0388`,
       `PLAY0389` and `PLAY0273` are only reported at binding.
 - [ ] Every slice has at least one boundary specification.

package/package/corpus/skills/cratis-screenplay-specifications/references/examples-and-routes.md

@@ -0,0 +1,111 @@
+<!-- Copyright (c) Cratis. All rights reserved. -->
+<!-- Licensed under the MIT license. See LICENSE file in the project root for full license information. -->
+
+# Typed examples, overrides and event routes
+
+## Contents
+
+- Typed examples
+- Effective values
+- Event routes
+- Operation and recovery intent
+
+## Typed examples
+
+`example <Name> : <EventOrCommandOrReadModel>` declares a possibly partial typed
+fixture at document/module/feature/slice scope. Its underlying type resolves in
+the declaration scope, not the use scope. It can state properties, description,
+`for` and command generated fixtures, not callers/clocks or a whole scenario.
+Examples share the type namespace and use the current event generation. They
+cannot inherit from examples or serve as query results/returns/trigger/capture
+fixtures. They are specification data, not operational `seed` events.
+
+This complete example compiled and its two reference scenarios passed on 4.125.0:
+
+```screenplay
+concept ProjectId : Uuid
+module Projects
+  feature Registration
+    example DefaultProject : RegisterProject
+      name = "Default"
+    slice StateChange Register
+      command RegisterProject
+        projectId ProjectId identifier
+        name String
+        produces event ProjectRegistered
+          name String = name
+      specification RegisteringTheDefault
+        when DefaultProject
+          projectId = "3fa85f64-5717-4562-b3fc-2c963f66afa6"
+        then ProjectRegistered
+          for "3fa85f64-5717-4562-b3fc-2c963f66afa6"
+          name = "Default"
+      specification OverridingTheName
+        when DefaultProject name = "Override"
+          projectId = "3fa85f64-5717-4562-b3fc-2c963f66afa6"
+        then ProjectRegistered
+          for "3fa85f64-5717-4562-b3fc-2c963f66afa6"
+          name = "Override"
+```
+
+## Effective values
+
+An example occupies the ordinary name slot in given/event, given readmodel,
+when command, when append, then event or then readmodel. One assignment may be
+inline after the name; more stay indented. There is **no with keyword**.
+Step values override example values by property name; objects/lists replace
+whole values, never recursively merge. Indented `for` replaces its destination;
+generated fixtures merge by name. A new step-only value is authored, not an
+override. Each step/declaration assigns a property once (PLAY0519); malformed
+headers are PLAY0518.
+
+After expansion, required given-event/read-model, command, append and expected
+event fields must be complete (binding PLAY0524); examples can remain partial.
+Read-model assertions retain subset matching unless `exactly` is authored.
+Even unused example values or values overridden at every use are type-checked.
+No default fixture values are invented. A command action must belong to the
+specification's own slice even when a qualified example resolves elsewhere.
+
+MCP `find-fixtures` reports effective authored/example/override origins and
+replaced values. Source-bound runner failures retain that provenance; canonical
+ESM contains merged values only, equivalent to hand-expansion. ESM-only runners
+cannot reconstruct source origins.
+
+## Event routes
+
+Event occurrences in `given`, `when append` and `then` accept `stream Source.Stream`
+with nested scalar `streamId = <literal>` or a complete composite part block.
+These select ESM v8 and reference-execute at 4.125.0; the complete checked model
+is in toolchain `references/sources-and-streams.md`. Command actions take their
+route from the command declaration, never the fixture.
+
+Routed history/appends need typed concrete `for`; routed expectations may omit
+it. `then ... no stream` expects no route; no route in a then is a wildcard.
+`no stream` is invalid on given/appends. Event examples can supply routes, but
+steps replace the entire route, independently of `for`; an inherited route
+cannot be changed back to a wildcard. Literal compatibility/route contradiction
+checks use resolved source/stream types, not guessed text (PLAY0547–PLAY0551).
+At Screenplay 4.127.0, route literals must be nonempty, well-formed NFC text
+(refused, not normalized); Double integer ids are within ±(2^53−1), while Exact
+has no such bound but remains unadmitted. Invalid specification routes report
+PLAY0549. Contradictions compare canonical scalar ids and every composite part,
+so UUID casing is immaterial. Composite mappings supply each named part once,
+using literals only; encoding escapes `%`/`|` and preserves declaration order.
+Source: v4.127.0 `event-sources.md`, `specifications.md`, `diagnostics.md`.
+
+CLI 3.41.0 rendering rejects versions above v7 before planning, even though
+source compilation and reference routing pass.
+
+## Operation and recovery intent
+
+Operation failure/request/compensation forms are authoring-only (PLAY0268):
+`given operation <Name> fails`, `then operation <Name>` with a partial input
+subset, and leaf `then compensated <Name>`. See command-surface
+`references/operations.md` for the complete checked authoring fixture.
+
+Refusal selectors, redelivery to one observer and `then no events` likewise
+remain unadmitted; they are not executed append scenarios. Forms, matching,
+acknowledgement and their whole-model refusal boundary are in
+captures-and-reactions `references/refusals-and-redelivery.md`.
+
+Authority: Screenplay `v4.125.0:Documentation/screenplay/specifications.md`.

package/package/corpus/skills/cratis-screenplay-specifications/references/reactions-and-cascades.md

@@ -42,12 +42,11 @@ module Collections
 - A specification whose action is a command goes in the slice that declares that
   command, here `SendInvoice`, not in the `Automation` slice that reacts: a command
   from another slice is `PLAY0273` "command is unresolved in its slice" at binding.
-- A command a reaction `invokes` runs through its full pipeline **with no caller**.
-  A command that needs one rejects, and that rejection ends the scenario. Each
-  invoked command is atomic; the cascade is not, so earlier accepted facts stay.
-  There is no syntax for an identity (Screenplay#383). See
-  `cratis-screenplay-automations-and-translations` and
-  `cratis-screenplay-captures-and-reactions`.
+- A reaction invocation without a declared actor has no caller and a gated
+  command denies. At 4.125.0 reaction `runs as system role "<Role>"` supplies the
+  authenticated system actor (ESM v10); `given caller` does not. Each command is
+  atomic, not the cascade. Checked actor scenario and CLI/Stage limitations:
+  captures-and-reactions `references/invocation-identity.md`.
 - The clock is UTC and exact. An `every` or `at` occurrence fires once when it is
   due after `given clock` and at or before `when clock`; `when clock` needs
   `given clock`, so the same instant twice fires nothing.

package/package/corpus/skills/cratis-screenplay-streams-and-consistency/SKILL.md

@@ -52,7 +52,7 @@ Chronicle issues before relying on a constraint in a later release.
   themselves (`cratis-screenplay-scenario-coverage`), Chronicle C# mechanics
   (`cratis-chronicle-event-modeling`). See Route near misses.
 - Model-first applies: when an accepted model covers the scope, change the model and its
-  specifications, not code. Do not weaken authorization, `@pii` or rules to make a model compile.
+  specifications, not code. Do not weaken authorization, `pii` or rules to make a model compile.
 
 ## Interview phase
 **Skip if** the user or the model already states the stream identities, who owns each module, how
@@ -87,10 +87,10 @@ option, mark it `ASSUMED` in the slice or module `description` and in the sessio
    invariant consequences, not names or length. For Chronicle keep event-source identity,
    namespace, process-stream routing and concurrency scope apart
    (`references/chronicle-boundaries.md`). Declared `eventsource`/`stream`/`streamId` and
-   command routes can be authored and validated but not bound, run or rendered today
-   (`PLAY0268`, `STAGE-ESM-016`): keep them as intent and hand-write the routing
-   (`cratis-screenplay-toolchain` `references/sources-and-streams.md`); no supported ESM version
-   admits them. A `generated identifier` (ESM v7, standalone 4.68.0; not rendered by Stage yet) is
+   command/specification routes bind and reference-execute as ESM v8 on 4.125.0.
+   CLI 3.41.0 rendering admits through v7 only (CLI-RENDER-004); keep the routing
+   contract and gap-fill its target realization. Forms/boundaries:
+   toolchain `references/sources-and-streams.md`. A `generated identifier` (ESM v7, standalone 4.68.0; not rendered by Stage yet) is
    generated fresh on every acceptance: it is not a retry identity, and generated values give no
    idempotency, retry or deduplication guarantee. When a retry must find the same stream, the caller
    supplies the identifier before the first attempt.
@@ -119,8 +119,13 @@ option, mark it `ASSUMED` in the slice or module `description` and in the sessio
    is a fact the business recognises. Different meanings get different events, not a flag with
    nullable siblings. Event properties are required by default (CHR0012, PLAY0350): an optional
    detail is a separate event, and any deviation is justified in the description. One data
-   subject per event and stream; never personal data, a secret, or a `@pii` or `@sensitive` concept as the identifier (CHR0034, CHR0052):
-   use a surrogate `Uuid` and a `@pii` or `@sensitive` property.
+   subject per event; never personal data, a secret, or a `pii`/`secret` concept as
+   identifier or subject (CHR0034, CHR0052, PLAY0515/0592). Use a surrogate identity
+   and protected payload. A stream identity and an event's data subject may differ:
+   trailing event-property `subject` records that lineage but is report-only
+   (PLAY0270), not runtime propagation or generated C# `[Subject]`. Without a
+   supplied subject, the runtime defaults to the event source; see command-surface
+   `references/compliance.md` for allowed types and the policy/encryption distinction.
 5. **Plan evolution** with `references/evolution.md`: classify each event change (additive,
    meaning change, rename, removal, split or merge) and write its compatibility scenarios before
    editing. Renames and other identity-affecting edits are made by the identity owner (the
@@ -148,7 +153,16 @@ option, mark it `ASSUMED` in the slice or module `description` and in the sessio
   block compiles but is PLAY0271 at binding. Keep both when they state real intent; they are not
   protection. `description` text never reaches rendered code: a rule that lives only in prose is
   unenforced there.
-- `@pii` and `@sensitive` block binding (PLAY0268). Never remove them to pass a tool.
+- `pii` and `secret` block binding (PLAY0268); legacy markers are deprecated
+  (PLAY0565). Never remove protection to pass a tool. PLAY0515 also refuses
+  scalar/composite stream-id types and route mapping sources, including nested paths.
+- At 4.127.0 stream-id literals must be nonempty, well-formed NFC text (refused,
+  not normalized); integer ids in Double mode stay within ±(2^53−1). Exact mode
+  has no such bound but is unadmitted. PLAY0504 is an error for route/destination
+  nominal type mismatch. Composite ids use at least two named scalar parts,
+  complete named mappings and canonical comparison, not guessed legacy splits.
+  Stored key-schema changes require a new stream identity or migration; see
+  toolchain `references/sources-and-streams.md`.
 - Chronicle (open at v19.32.0): the SQL and InMemory providers do not settle unique claims
   (#3744); index updates run after commit and may fail silently (#4123); composite values can
   collide on the separator (#4131). A declared constraint is a declaration, not a runtime test.

package/package/corpus/skills/cratis-screenplay-streams-and-consistency/references/chronicle-boundaries.md

@@ -42,10 +42,14 @@ protection: keep the invariant and its race outcome as explicit target requireme
 A namespace scopes event positions, claims, observer progress and encryption keys. State
 whether uniqueness and completion are per tenant or genuinely cross-tenant.
 
-Decide the data subject before the event and view shape. One data subject per event and per
-stream; one per read-model instance. Never put PII on the event-source id and never mark the
-identifier's concept `@pii` or `@sensitive`: Chronicle cannot encrypt a source id (analyzers CHR0034 and CHR0052; Screenplay PLAY0515 reports it from 4.69.1 for `@pii` and 4.84.1 for `@sensitive`, not on the pinned tools). Use a surrogate `Uuid`
-identity and carry the value as a `@pii` property (personal data) or a `@sensitive` property (operational secret). Bearer tokens, magic links and
+Decide the data subject before the event/view shape: one person per event or
+read-model instance, not necessarily the stream's identity. At Screenplay 4.127.0
+trailing event `subject` is report-only lineage, not runtime propagation or C#
+`[Subject]`; read-model marks remain unsupported. Use bare `pii` for personal
+values and `secret` for operational secrets on concepts, never on identities or
+subjects. Current PLAY0515 is a source error, including destinations, stream-id
+parts and nested route sources (Chronicle CHR0034/0052 likewise reject protected
+source ids). Use a surrogate identity and protected payload. Bearer tokens, magic links and
 signed URLs are never facts; record a keyed hash or a reference.
 
 Redaction (payload replacement keeping the sequence slot) and crypto-erasure serve compliance

package/package/corpus/skills/cratis-screenplay-streams-and-consistency/references/consistency-and-concurrency.md

@@ -16,6 +16,16 @@
 Pins: Screenplay v4.66.0, Chronicle v19.32.0, Arc v22.50.5, Stage v4.24.2 (table in `versions.md` of
 `cratis-screenplay-toolchain`).
 
+Current routing identity checks (4.127.0): PLAY0515 refuses personal/secret
+concepts in stream-id types, composite parts and route sources, including nested
+paths. Composite keys require every named scalar part, not a legacy separator
+split. Text must be well-formed, nonempty NFC and Double integer ids bounded by
+±(2^53−1); PLAY0504 is an error for routed nominal destination-type mismatch.
+Canonical specification comparisons preserve part order and treat UUID case
+variants as equal. Key-schema evolution for stored events requires a new stream
+identity or migration. These checks do not protect command decision reads.
+Details: toolchain `references/sources-and-streams.md`.
+
 ## 1. Invariant table (fill before writing constraints)
 | # | Rule (business words) | Data it needs | Decided atomically where | Screenplay construct | Status | Race / retry outcome |
 |---|---|---|---|---|---|---|

package/package/corpus/skills/cratis-screenplay-streams-and-consistency/references/stream-patterns.md

@@ -20,6 +20,15 @@ A stream in Screenplay is the event source a production lands on: `identifier` o
 command, `for <identifier>` on each `produces`, `$eventSourceId` in projections, `for "<id>"`
 in specifications. Choosing the identifier *is* choosing the stream.
 
+Composite stream keys (Screenplay 4.127.0) declare `streamId` with two or more
+named scalar parts and map every part on routes (specification parts are literals).
+Scalar forms remain valid. Text is nonempty, well-formed NFC; Double integer ids
+stay within ±(2^53−1). Protected concepts cannot be key types/parts or mapping
+sources (PLAY0515); choose surrogate keys and keep protection in payloads.
+Canonical encoding formats parts, escapes `%`/`|`, and joins in declaration order;
+never split hand-joined legacy text by guesswork. A stored key-schema change needs
+a new stream identity or migration. See toolchain `references/sources-and-streams.md`.
+
 ## Identity and event-membership review
 Start from the business instance, then choose its representation. A generated id can name a
 real instance; a readable constant can hide a collection. Write one sentence per identity
@@ -205,8 +214,10 @@ Ask for each stream:
 Some event stores decide consistency by a query over tagged events instead of one stream
 (often called dynamic consistency boundaries). Chronicle's concurrency scopes can narrow a
 check to event types, source type or stream (`concurrency` block, Screenplay
-`commands.md`), and Screenplay has syntax-only event-source/stream declarations (not admitted by any supported ESM version;
-`event-sources.md`). None of this binds on either compiler (`versions.md` in `cratis-screenplay-toolchain`). Model the stream by business
+`commands.md`). Legacy concurrency metadata still fails binding (PLAY0271),
+but sources/streams/routes bind and reference-execute as ESM v8 on 4.125.0.
+Route admission does not make a view read protected. CLI 3.41.0's render boundary
+is v7; see toolchain `references/versions.md`. Model the stream by business
 identity; when a rule truly needs a cross-stream decision, record it (see
 `consistency-and-concurrency.md`) rather than inventing a construct.
 

package/package/corpus/skills/cratis-screenplay-streams-and-consistency/references/streams-example.md

@@ -5,7 +5,7 @@ cross-stream references as payload, three kinds of uniqueness constraint, a stat
 rule recorded as **NOT enforced in the model today**, a declared `concurrency` scope, and an
 active-state view with removal. Read it with `consistency-and-concurrency.md` (sections 1-4).
 
-The model compiles (V1, warnings as errors) but is not binding-ready by design: the `@pii`
+The model compiles at 4.127.0 (V1, warnings as errors) but is not binding-ready by design: the `pii`
 concept fails binding (PLAY0268), `reads` and the `concurrency` block are PLAY0271, and
 `require` over a view is PLAY0268. Keep those lines: they state real intent.
 
@@ -14,7 +14,7 @@ concept fails binding (PLAY0268), `reads` and the `concurrency` block are PLAY02
 // Shows: one business identity per stream, cross-stream references as payload, uniqueness
 // constraints (single, composite with release, unique event), a recorded state-dependent rule
 // that Screenplay cannot enforce, a declared concurrency scope, and an active-state view with removal.
-// Not executable on either tool (probed): the @pii concept fails binding (PLAY0268), the
+// Historical binding probes refused compliance; the pii concept still fails binding (PLAY0268), the
 // concurrency block and `reads` are PLAY0271, `require` over a view is PLAY0268. Keep them: they state
 // real intent. The capacity rule is NOT enforced in the model today (see the slice description).
 
@@ -23,7 +23,7 @@ domain Acme.Academy
 concept MemberId : Uuid                    // event source id of one member stream
 concept CourseId : Uuid                    // event source id of one course stream
 concept EnrolmentId : Uuid                 // event source id of one enrolment stream
-concept Email : String @pii
+concept Email : String pii
   pii reason "Identifies a person"
   validate
     not empty  message "An email is required"

package/package/corpus/skills/cratis-screenplay-streams-and-consistency/verification.json

@@ -12,9 +12,9 @@
     { "kind": "skill-contains", "value": "CHR0034" },
     { "kind": "skill-contains", "value": "No calculated events" },
     { "kind": "skill-contains", "value": "decision tree and red flags" },
-    { "kind": "skill-contains", "value": "not bound, run or rendered" },
+    { "kind": "skill-contains", "value": "bind and reference-execute as ESM v8" },
     { "kind": "skill-contains", "value": "STAGE-ESM-026" },
     { "kind": "skill-contains", "value": "generated values give no\n   idempotency, retry or deduplication guarantee" },
-    { "kind": "skill-contains", "value": "no supported ESM version\n   admits them" }
+    { "kind": "skill-contains", "value": "CLI-RENDER-004" }
   ]
 }