@cratis/pi 7.21.0 → 7.23.0

package/package/corpus/skills/cratis-screenplay-toolchain/SKILL.md

@@ -22,17 +22,16 @@ files is one application: always check the folder, never one file of it.
 
 When choosing or upgrading a tool, or checking version-specific capabilities, read `references/versions.md`; it is the only version table, and other skills point to it.
 
-| Package | Version | Purpose |
-| --- | --- | --- |
-| `Cratis.Screenplay.Tool` | `4.68.0` (`79801bf`) | standalone compiler, binder and MCP server; admits ESM v7 (generated values and responses) |
-| cratis CLI | `3.40.7` (`v3.40.7`, `af9f18e`) | Tag pins Stage 4.51.1 and Screenplay 4.114.0, with `cratis/stage:4.51.1` as the runtime image. The public CLI executed render publication, the browser acceptance run and the real stdio MCP transcript harness (37 tools, `executableReady true`). Reading baselines: 3.40.3, 3.39.0 and 3.28.3 (`8b43fef`) |
-| Screenplay | bundled `4.114.0`; latest language package `4.122.0` | CLI 3.40.7 bundles 4.114.0 and reports `sourceSuccess true`, `semanticSuccess true`, `executableReady true` for the canonical corpus; the repo tool compiles it with `10 file(s) compiled - 0 error(s), 0 warning(s)`. Language features newer than 4.114.0 need the standalone 4.122.0 tool until a CLI bundles them |
-| Stage | `4.51.1` (CLI default; latest package 4.51.3) | Docker image `cratis/stage:4.51.1`; renders the canonical screen corpus with Arc `CommandForm` shells and query bindings, and refuses guarded Close and double-click with `STAGE-SCENE-ACTION-001` / `STAGE-SCENE-INTERACTION-001`. Check generated package sets before claiming exact Scene 4.14 runtime parity |
-| Arc / Chronicle | `22.50.5` / `19.32.0` | code-level facts cited here |
+The standalone pin is Screenplay 4.127.0. CLI 3.41.0 bundles Screenplay 4.114.0,
+Stage 4.51.3 and Cratis.Arc.Screenplay 22.54.0. The single version table records
+released source evidence and historical probes separately; do not relabel an old
+render/browser result as a probe of the current packages.
 
-Facts were read with `git show <tag>:<path>` and probed on the installed tools. Behaviour
-was probed on 4.63.1 and re-checked on 4.66.0 and 4.68.0 (the example gates). 4.65.0 adds command named-rule `implementation` blocks (handlers and operation phases already had the wrapper; it is rejected on concept rules, built-in property rules and whole-command `require`/`validate` bodies); 4.66.0 is editor tooling only. Neither changes execution.
-Re-verify before claiming another version behaves the same.
+Historical screens-release evidence: CLI 3.40.7 / Stage 4.51.1 / bundled
+Screenplay 4.114.0 opened the canonical corpus with `executableReady true`
+and the stdio transcript exposed 37 tools; standalone language 4.122.0 was
+recorded in that vector. These retained results are not a rerun on CLI 3.41.0
+or Screenplay 4.127.0.
 
 ## Ground rules
 
@@ -42,15 +41,15 @@ Re-verify before claiming another version behaves the same.
 2. **Check the folder, warnings as errors.** `screenplay <folder> --warnaserror` or
    `cratis screenplay validate <folder> --warnings-as-errors`. Warnings hide defects:
    PLAY0029 (a misspelt keyword or a `type` inside a slice) drops a construct silently.
-3. **Pick the compiler deliberately and name it.** Standalone `screenplay` for V1 to V3 (file
-   mode follows imports); `cratis` 3.28.2 or later bundles the 4.66.0 compiler (same up to ESM v6, no ESM v7) and is the
-   route for `render`. A cratis before 3.28.2 bundle (4.60.1) rejects ESM v6 and reports a
-   false PLAY0285 on cascades (cli#242). Report tool and version with every verdict.
+3. **Pick the compiler deliberately and name it.** Standalone `screenplay` for
+   current language checks and reference specifications; `cratis` for rendering
+   and generation. Bundled and standalone versions differ. Report both tool and
+   version, rather than transferring a verdict across releases.
 4. **Know the mode** (design, executable, renderable) and write from its subset.
 5. **Capability is not correctness.** The tool you ran decides what is accepted today; the
    domain and the documented semantics decide what is correct. On conflict keep the correct
    model and record a tool gap; never reshape a model to silence a tool.
-6. **Never remove `@pii`, `@sensitive`, authorization, list queries, automations or rules
+6. **Never remove `pii`, `secret`, authorization, list queries, automations or rules
    to reach V3 or a render.** Report the verdict as blocked with the codes.
 7. **A clean verdict proves only its own layer.** "Not run" with the reason is a valid
    result. Specifications written or bound are never specifications passing.
@@ -62,14 +61,13 @@ Re-verify before claiming another version behaves the same.
 
 ## The two compilers
 
-| | Standalone `screenplay` 4.68.0 | `cratis screenplay ...` 3.28.3 and 3.28.2 (bundle Screenplay 4.66.0) |
+| | Standalone `screenplay` | `cratis screenplay ...` |
 | --- | --- | --- |
-| Check a folder | `screenplay <folder> --warnaserror --no-color` (exit 0 pass, 1 fail; an empty folder also exits 0, so read "N file(s) compiled") | `cratis screenplay validate <folder> --warnings-as-errors -o json-compact` (0 pass, 5 fail, 1 missing path or no files) |
-| ESM admitted | v1 to v7 | v1 to v6 (generated values and responses report `PLAY0268`; before 3.28.2 bundled 4.60.1: v1 to v5) |
-| Automation, Translate, reactions, captures, clocks, triggers | bind | bind (before 3.28.2: PLAY0268 "Slice '<name>' of type '<type>' is not admitted by ESM v1.") |
-| Cascade specs | compile | compile (before 3.28.2: false PLAY0285, cli#242) |
-| File argument | follows imports | ignores imports, false PLAY0165 warnings (cli#244, probed on 3.28.2): validate the folder |
-| MCP | `screenplay mcp <folder>`; 29 tools | `cratis screenplay mcp [root]`; 29 tools; registered by `cratis ai install` |
+| Check root | `screenplay <root> --warnaserror --no-color` | `cratis screenplay validate <root> --warnings-as-errors -o json-compact` |
+| Scope/checks | `--scope <address>`, `--check <names>`; a scoped pass is not whole-application success | Discover installed validation options |
+| Reference execution | `screenplay test <root>` or MCP `run-specifications` | Discover bundled MCP capability; target tests are not V4 |
+| MCP | `screenplay mcp <root>`; discover schemas | `cratis screenplay mcp [root]`; registered by `cratis ai install` |
+| Render version boundary | Binder admission is not Stage admission | CLI 3.41.0 passes up to ESM v7 to Stage; newer versions: `CLI-RENDER-004` |
 
 Read `references/versions.md` when you need the exact messages, exit codes or the MCP roots bug.
 
@@ -84,7 +82,7 @@ Independent results, not a ladder. Read `references/verdicts.md` for the command
 | V1 | authorable (compiles, warnings as errors) | the folder command above |
 | V2 | executable diagnostics read | MCP `open-workspace`, then `read-workspace view=executable-diagnostics` |
 | V3 | binding-ready (binds, no blocking executable diagnostics) | `executableReady` true and no error-severity diagnostic in V2; informational PLAY0269/0270 are reported separately |
-| V4 | reference specifications run | the Screenplay reference execution route only (none ships in the pinned tools: `V4 not run: no route`); rendered Debug tests are V5.tests, never V4 |
+| V4 | reference specifications run | `screenplay test` or MCP `run-specifications`; unsupported/unbound is not a pass; rendered Debug tests are V5.tests, never V4 |
 | V5 | rendered and target-verified | `cratis render`, then Debug build and tests; report admission, publication, build and tests separately |
 
 V2 and V3 need MCP: send `initialize`, then `notifications/initialized`, and start the
@@ -92,7 +90,7 @@ server with a fixed root when the tool is older than 4.63.2 (the roots bug hit 4
 4.60.1 bundled by cratis before 3.28.2; 4.66.0 and later and cratis 3.28.2 are fine). A subagent without MCP reports "V2 not run: no MCP in this agent".
 
 One line per verdict, tool first, for example `V1 pass (screenplay 4.68.0, 3 files)` and
-`V3 blocked: PLAY0268 x3 (list query, @pii)`. Name the source identity (commit plus the digest from
+`V3 blocked: PLAY0268 x3 (list query, pii)`. Name the source identity (commit plus the digest from
 the source-identity helper (`cratis-screenplay-modeling-lifecycle` `references/verdicts-and-modes.md` "Source identity")) the verdict ran on; keep it apart from the MCP
 `modelRevision`, which is semantic and, without `.screenplay/identities.json`,
 changes with the root folder name.
@@ -103,14 +101,23 @@ changes with the root folder name.
   `references/cheat-sheet.md`. Read [references/cheat-sheet-example.md](references/cheat-sheet-example.md) when you need one complete design-mode document with every construct family.
 - **Executable** (binds, V3): `references/executable-subset.md`. Keyed optional queries
   only; no handler (PLAY0268, with or without `implementation`/`hint`); `reads` and
-  `concurrency` do not bind (PLAY0271); no `@pii`; v6 constructs bind on Screenplay 4.61 or
+  `concurrency` do not bind (PLAY0271); no compliance markers (`pii`/`secret`); v6 constructs bind on Screenplay 4.61 or
   later (standalone, and cratis 3.28.2 or later); generated values and `returns` responses bind (ESM v7)
-  only on standalone 4.68.0 or later (`references/generated-responses-example.md`). Read [references/executable-example.md](references/executable-example.md) when you need a small StateChange and StateView model that binds executable, [references/pdl-example.md](references/pdl-example.md) when writing projection forms that bind and run, and [references/automation-translate-example.md](references/automation-translate-example.md) when writing Automation and Translate slices (ESM v6).
-- **Renderable** (V5): `references/renderable-subset.md`. Stage 4.24.2 renders ESM v1 to v4 (evolved events refused, `STAGE-ESM-026`)
-  `StateChange`/`StateView` slices; Automation and Translate are gap-fill (Stage#79), and so are generated values and responses (ESM v7: Stage refuses it with `STAGE-ESM-016`, tracked in Stage#201).
-- **Event sources, streams and command routes** (and operations): authorable and validatable, but never
-  bound (`PLAY0268`: not admitted by any supported ESM version), run or rendered
-  (`STAGE-ESM-016`); gap-fill with the model as contract (`references/sources-and-streams.md`).
+  from Screenplay 4.68.0 (also in the current CLI bundle) (`references/generated-responses-example.md`). Read [references/executable-example.md](references/executable-example.md) when you need a small StateChange and StateView model that binds executable, [references/pdl-example.md](references/pdl-example.md) when writing projection forms that bind and run, and [references/automation-translate-example.md](references/automation-translate-example.md) when writing Automation and Translate slices (ESM v6).
+- **Renderable** (V5): `references/renderable-subset.md` retains explicitly labeled
+  older Stage probes. Current CLI admits v7 to planning, but its v7 corpus gets
+  Stage generated-value/response refusals `STAGE-ESM-028`/`029`, not a blanket
+  compiler refusal. Run admission before claiming a particular model renders.
+- **Event sources, streams and routes** bind as ESM v8 at 4.125.0; CLI 3.41.0
+  render refuses versions above v7 (`CLI-RENDER-004`). Operations and exact numeric
+  mode remain authorable/unadmitted. Details: `references/sources-and-streams.md`.
+
+- **Caller/compliance metadata** at 4.127.0: `$identity` aliases caller built-ins;
+  additional identity details are metadata and executable reads still refuse.
+  Bare `pii`/`secret` replace legacy spellings; `pii personal` repeats one marker
+  (PLAY0653). Purposes/checks/processing records and event `subject` are report-only,
+  not legal compliance, retention or runtime subject realization. See
+  command-surface `references/context.md` and `references/compliance.md`.
 
 ## Edit strategy
 
@@ -144,10 +151,12 @@ Read [references/diagnostics.md](references/diagnostics.md) when a PLAY, STAGE o
 2. Write `for <identifier>` on every `produces`.
 3. PLAY0029 is a warning: validate with warnings as errors.
 4. Validate the folder; name the compiler (cli#244, cli#242).
-5. Mappings to undeclared projection targets and undeclared events in `remove with`/capture
-   `append` pass V1 and fail binding (V2/V3, PLAY0273); a declared read-model property that
-   nothing maps is reported by no tool: run V3 and walk field lineage by hand.
-6. A reaction's `invokes` has no caller: a gated command rejects it; keep the gate.
+5. V1 warns on undeclared projection targets (`PLAY0514`) and removal/capture
+   event references (`PLAY0166`). Unmapped declared fields can be reported by
+   opt-in `--check field-origins` (`PLAY0534`); unknown coverage is skipped, so
+   still walk lineage. See diagnostics for editor versus C#-only checks.
+6. Without reaction `runs as` an invoke is caller-less. Declare its trusted role
+   (ESM v10), keep the gate, and reference-test; CLI/Stage support is separate.
 7. Read-model identity is one `query XById => RM optional` with `by xId XId`, and the identifier equal to the
    projection's key (see trap 12); never `identifier` on a read model.
 8. Projection `key` routes only on `from`; joins never create; `all` is per source.

package/package/corpus/skills/cratis-screenplay-toolchain/references/cheat-sheet-example.md

@@ -2,7 +2,7 @@
 
 One complete document with every construct family. Design mode, not executable. Prose rules: [cheat-sheet.md](cheat-sheet.md); tool versions: [versions.md](versions.md); what binds: [executable-subset.md](executable-subset.md).
 
-Blocking on every compiler: unquoted import, `@pii`, `reads` (PLAY0271), `starts with`, observable/list/filter query. Executable shapes are in the sibling examples. The fence compiles warning-free on the standalone 4.66.0 tool and on `cratis screenplay validate` 3.28.2. `RecordingAPayment` lists the `InvoiceClosed` cascade, which the cratis 3.27.1 bundle (4.60.1) rejected with a false PLAY0285 ("outcome cannot be produced by 'RecordPayment'"); 3.28.2 accepts it.
+Binding blockers: unquoted import, `pii`, `reads` (PLAY0271), `starts with`, observable/list/filter query. Executable shapes are in the sibling examples. The bare-marker fence compiles warning-free on standalone 4.127.0; the earlier legacy-marker version compiled on 4.66.0 and CLI 3.28.2. `RecordingAPayment` lists the `InvoiceClosed` cascade, which the cratis 3.27.1 bundle (4.60.1) rejected with a false PLAY0285 ("outcome cannot be produced by 'RecordPayment'"); 3.28.2 accepts it.
 
 ```screenplay
 // Design-mode cheat-sheet: every construct family; compiles warning-free on the standalone tool.
@@ -12,7 +12,7 @@ import Customers.CustomerRegistered        // unquoted = another bounded context
 
 concept InvoiceId : Uuid                   // primitives: Uuid String Int Decimal Bool Date DateTime Enum
 concept PaymentId : Uuid
-concept Email : String @pii                // @pii / @sensitive (blocks executability today)
+concept Email : String pii                 // pii / secret (blocks executability)
   pii reason "Identifies a person"
   validate
     not empty  message "An email is required"
@@ -230,7 +230,7 @@ module Billing
         then InvoiceClosed                            // ESM v6: the Reconciler cascade (amount > 0)
           for "9c858901-8a57-4791-81fe-4c455b099bc9"
 
-module Housekeeping                                   // no gates: a reaction's `invokes` has no caller
+module Housekeeping                                   // no gates: this reaction declares no `runs as`, so its `invokes` has no caller
   description "Background follow-up"
   feature FollowUp
     slice StateChange CloseInvoice

package/package/corpus/skills/cratis-screenplay-toolchain/references/cheat-sheet.md

@@ -1,5 +1,20 @@
 # Screenplay cheat-sheet (tool versions: versions.md)
 
+## Contents
+
+- Samples and preview fixtures
+- Lexical and structural rules
+- Exact numeric source mode
+- Clause order inside a command (canonical)
+- Slice contents (typical)
+- `$context.` paths (command `produces`)
+- `$eventContext.` (projections)
+- PDL quick reference (most forms are compiled in `pdl-example.md` or `cheat-sheet-example.md`; `remove via join` and `$eventContext.occurred` are not)
+- Specification forms
+
+Current pins: standalone Screenplay 4.127.0 / CLI 3.41.0; `versions.md` is the
+single table. Compile evidence below keeps its historical tool labels.
+
 The syntax lives in compiled example files next to this one (each is a Markdown file holding
 one complete `screenplay` fence). Copy shapes from them; do not write a form that none of
 them (or a compiled documentation example) shows. This file holds the prose rules; the
@@ -18,11 +33,31 @@ by `for_Documentation/when_comparing_the_grammar_against_the_parsers.cs`),
 Screenplay CI (`when_compiling_every_example.cs`) against repository main: the standalone
 compiler (4.68.0; `cratis` 3.28.2 or later bundles 4.66.0, which lacks ESM v7); older cratis bundles differ (`versions.md`).
 
+## Samples and preview fixtures
+
+Invoicing is a warning-free syntax showcase, not a runnable whole-language proof.
+The released samples policy excepts these preview families and points to dedicated
+fixtures; do not infer binder admission from the sample's coverage list:
+
+| Family | Screenplay v4.125.0 fixture |
+| --- | --- |
+| Exact numbers | `Source/Screenplay/Compiler/Conformance/exact-named-rule-intent.play` |
+| Sources/streams/command routes | `Documentation/screenplay/fixtures/source-streams.play` |
+| Specification routes | `Source/Screenplay/Compiler/Conformance/specification-streams.play` |
+| Systems/operations/specification steps | `Documentation/screenplay/fixtures/operations.play` |
+| Refusals/redelivery/no-events | `Source/Screenplay/Compiler/Conformance/reaction-refusals-redelivery.play`, `no-events.play` in that directory |
+
+Source: `v4.125.0:.cratis/ai/rules/project/samples.md`. Its preview list retains
+sources/specification routes, but the released binder/runner admits them as v8;
+its old blanket PLAY0268 wording is not the current route verdict. Other rows
+remain unadmitted. Compile and test each relevant fixture with the chosen tool.
+
 ## Lexical and structural rules
 - Spaces only, 2 per level (tabs: PLAY0006 W). Offside rule.
 - Comments: `//` only. `#` is not a comment (PLAY0058 E in a projection) despite doc examples.
-- Order is free (forward references fine) except `domain` first in the file and `description`
-  first in a body.
+- Body directives can appear in any order; singleton `description` still appears
+  at most once. Canonical printing may place it first, but the parser does not
+  require that position. Source preambles precede declarations.
 - Strings: `"..."`, escapes `\" \\ \n \r \t`; other backslashes kept (regex `"^INV-\d{6}$"` works).
 - Structured values: single-line JSON, quoted keys (`[{"sku": "A-1", "quantity": 2}]`).
 - One condition grammar (policy `require`, `produces when`, `require`, reaction `where`): `and`
@@ -40,6 +75,16 @@ compiler (4.68.0; `cratis` 3.28.2 or later bundles 4.66.0, which lacks ESM v7);
   or keyed query argument) or `matches <commandProperty>`; executable; renderable only for
   text-backed targets (Uuid-backed: STAGE-ESM-015).
 
+## Exact numeric source mode
+
+Start each file/import barrel with `numbers exact` to retain bounded decimal
+literals without Double rounding. All assembled files must agree on mode;
+PLAY0508–PLAY0513 diagnose malformed directives, range errors and disagreement.
+Exact mode is authoring-only (`PLAY0268` on binding), not ESM v7 generated values.
+Typed JSON needs consistent `sourceOptions.numericMode: "exact"` on every root
+and `ExactNumber` literal envelopes with canonical fixed-point string values,
+never JSON numbers. Details: model-authoring `references/language-reference.md`.
+
 ## Clause order inside a command (canonical)
 description, properties, `reads`, `authorize`, `validate`, `produces`/`handler`, `concurrency`.
 
@@ -60,6 +105,17 @@ a reference scenario that supplies only a clock carries no caller audit identity
 reference runner before relying on identity paths in a specification. Renderable:
 `$context.occurred` only.
 
+At 4.127.0, `$identity.id`/`.name`/`.userName` map to the same ESM kinds as
+`$context.identity`; prefer the shorter root, but the older one stays supported.
+Other built-ins parse but roles/claims/authentication status do not bind in
+produces mappings. Identity details are metadata: executable detail reads report
+PLAY0268. See command-surface `references/context.md`.
+
+Use bare `pii`/`secret` on concepts (`personal` aliases `pii`); legacy markers
+are PLAY0565 information and repeated markers are PLAY0653 warning. Event `subject`
+is report-only lineage; processing purposes/checks/reports declare use, not lawful
+processing or runtime retention. See command-surface `references/compliance.md`.
+
 ## `$eventContext.` (projections)
 `eventType{.id,.generation,.tombstone}`, `eventSourceType`, `eventSourceId`, `eventStreamType`,
 `eventStreamId`, `sequenceNumber`, `occurred`, `occurred.Week`, `eventStore`, `namespace`,

package/package/corpus/skills/cratis-screenplay-toolchain/references/diagnostics.md

@@ -3,8 +3,10 @@
 ## Contents
 
 - Warnings that hide defects (always validate with `--warnings-as-errors`)
-- Not caught at V1 (fail binding: V2/V3, PLAY0273)
-- Silent at every level
+- Source reference and identifier checks
+- Caller identity, compliance and routes
+- Structural completeness and timeline checks
+- Editor versus C# verdicts
 - Consistency errors (V1: the model contradicts itself)
 - Binding (V2 and V3) - see `executable-subset.md` for the full table
 - Frequent errors
@@ -33,13 +35,125 @@ then STAGE (V5 admission). Tool differences: `versions.md`.
 | PLAY0455 | quoted import glob matches no file | fix the glob |
 | PLAY0196/0197/0198 | unknown query/screen; ambiguous bare name | declare or qualify `Slice.Name` |
 
-## Not caught at V1 (fail binding: V2/V3, PLAY0273)
-- Projection mapping to a property the read model does not declare.
-- Undeclared event in `remove with` or in a capture `append`.
-(Screenplay v4.66.0 `SemanticModelBinder` `BindMapping`, `LevelEvent`, `BindCaptureAppends`.)
+## Source reference and identifier checks
 
-## Silent at every level
-- A declared read-model property that nothing maps (it stays empty): walk field lineage by hand.
+At Screenplay 4.127.0 these are V1 source checks, not binding-only gaps:
+
+| Code | Severity | Meaning |
+| --- | --- | --- |
+| PLAY0514 | W | Projection mapping, children or nested target absent from the declared read-model/element shape; unknown/imported shapes are not guessed |
+| PLAY0166 | W | Unknown event, including `remove with`, `remove via join on` and capture `append` |
+| PLAY0515 | E | Personal/secret concept in a command identifier, typed `for` destination, event-source identity, stream-id type/part or route mapping source (including nested paths); keep a surrogate identity and protected data in payload |
+
+Legacy compliance spellings (`@pii`/`@sensitive`) do not evade PLAY0515.
+
+## Caller identity, compliance and routes
+
+Source authority: v4.127.0 `diagnostics.md`, `identity.md`, `concepts.md`,
+`purposes.md`, `events.md`, `event-sources.md`, `reactions.md`.
+
+| Code | Severity | Meaning / fix |
+| --- | --- | --- |
+| PLAY0152 | E | Bare `$identity` needs a property path |
+| PLAY0155 | W | A `$identity` or `$context.identity` path names a property the caller does not carry; correct the built-in/detail name (claims suffixes are opaque) |
+| PLAY0633 | E | Invalid identity header; write bare `identity` |
+| PLAY0634 | E | Second identity block in one document; a second file uses the folder singular-declaration diagnostic |
+| PLAY0635 | E | Invalid typed detail or escape source; exactly one source per detail |
+| PLAY0636 | E | Unknown source kind; use claim, query, inline code or file |
+| PLAY0637 | E | Detail has no source/implementation |
+| PLAY0638 | E | Claim/query source has a body; refresh/cache belongs to runtime |
+| PLAY0639 | E | Duplicate detail name |
+| PLAY0640 | E | Detail redeclares a token built-in |
+| PLAY0641 | E | Unknown/ambiguous source query |
+| PLAY0642 | E | Source query is unkeyed or returns a list |
+| PLAY0643 | E | Query source lacks `by <expression>` |
+| PLAY0644 | E | Query key reads more than built-ins, claims or literals |
+| PLAY0645 | E | Source query's effective gate depends on details |
+| PLAY0646 | E | Result type/optionality differs from detail; optional result needs optional detail |
+| PLAY0565 | I | Deprecated `@pii`, `sensitive`, `@sensitive`; repair to bare `pii`/`secret`, preserving notes/trivia |
+| PLAY0566 | E | Unknown concept marker |
+| PLAY0567/0568 | E | Invalid secret scope / repeated scope |
+| PLAY0569 | W | Explicit secret scope ignored on `pii secret` because only `[PII]` renders |
+| PLAY0570/0571 | E | Invalid personal-data qualifier/category / repeated special category |
+| PLAY0653 | W | Repeated concept-header compliance marker; `pii personal` is one marker repeated. Keep the first; body settings stay attached; canonical printing writes one marker |
+| PLAY0590 | E | More than one event subject; choose one, no safe automatic repair |
+| PLAY0591 | E | Subject not required scalar String/Uuid or a String/Uuid/Int-backed concept |
+| PLAY0592 | E | Protected subject concept; EventContext.Subject is plaintext, use a surrogate |
+| PLAY0593 | E | Subject modifier outside event properties |
+| PLAY0594 | E | Read-model subject mark is unsupported |
+| PLAY0595 | E | Repeated/out-of-order subject modifier; write it last |
+| PLAY0596/0597/0598/0599 | E | Malformed purpose declaration/reference/field; unknown closed value; repeated singleton; duplicate purpose name, respectively |
+| PLAY0600/0601 | W | Unknown purpose reference / inconsistent legitimate-interest declaration |
+| PLAY0602–0606 | W | Opt-in purposes coverage: uncovered pii, missing Art. 9 condition, Art. 10 authorization, basis, or unused purpose |
+| PLAY0647 | E | Malformed/repeated/misplaced `runs as`, empty/duplicate role; one reaction-level line with quoted roles (zero allowed) |
+| PLAY0648 | W | Gated invocation without declared identity; an authorization refusal branch gets PLAY0557 instead, once per invocation |
+| PLAY0649 | W | Identity declared without invokes or inline/file implementation |
+| PLAY0650 | W | C# bound-gate check: role needed by no invocation; opaque gates/implementation bodies suppress it |
+| PLAY0651 | W | C# bound-gate check: declared actor definitely cannot satisfy gate; unknown is not denial |
+| PLAY0652 | W/I | Opt-in `privilege`: trigger producer lacks every declared actor role (W), or has opaque gates that cannot be compared (I); clock/application triggers are silent |
+| PLAY0504 | E | Missing/ambiguous stream, invalid/mismatched route parts, nominal source identifier/destination type mismatch or invalid stream-id literal; never a warning |
+| PLAY0549 | E | Invalid specification route/mapping, including invalid stream-id literals |
+
+Stream-id text must be nonempty, well-formed Unicode NFC: refuse, never normalize.
+Integer ids in Double mode are within ±9007199254740991; Exact mode has no such
+bound but remains unadmitted. Specification contradictions compare canonical ids,
+so UUID casing does not distinguish routes. Composite encoding is ordered and
+escapes `%`/`|`, not an inferred split of legacy text.
+
+Identity declarations and event `subject` are metadata; reading a declared
+`$identity` detail in executable clauses is PLAY0268. `runs as` is admitted as
+ESM v10 in the current standalone, not a current PLAY0268 gap. Compliance markers
+still block binding; purpose metadata is PLAY0270. See command-surface
+`references/compliance.md` and `references/context.md` for syntax and limits.
+
+`screenplay_repair_capabilities` and `propose-repair` advertise PLAY0653: a
+concept-subject, line-only `PreserveTrivia` repair, no document-root or pinned
+repair evidence. PLAY0565 supports one discovered `line` or a document-root
+migration. Preview every repair; legal notes never move automatically.
+
+## Structural completeness and timeline checks
+
+Opt in with `--check <names>` or MCP diagnostics `checks`, then treat warnings
+as errors if gating. Ordinary compile success does not imply these ran:
+
+| Family | Codes | Checks |
+| --- | --- | --- |
+| data-bindings | PLAY0530/0531 | Conflicting visible bindings; binding/query read-model or cardinality mismatch |
+| input-surfaces | PLAY0532/0533 | Missing command input form/issuing screen; missing reachable issuer |
+| field-origins | PLAY0534 | Missing read-model builder or top-level field origin (AutoMap, identity and variants considered) |
+| query-keys | PLAY0535 | Query argument not representable by known identity/fields |
+| event-consumers | PLAY0536 | Latest local event generation lacks an operational consumer; a terminal fact can legitimately be reported |
+| navigation | PLAY0537 | Unreachable screens; unreachable cycles do not establish an entry point |
+| privilege | PLAY0652 | Elevated event-trigger producers must require every actor role; opaque gates are information, clock/application triggers exempt |
+| purposes | PLAY0602–0606 | Personal-data coverage, special/criminal safeguards, basis and unused-purpose prompts; union of ancestor/direct references |
+
+Whole-source errors skip completeness checks. Unknown/opaque coverage is not
+invented: report skipped status/coverage and walk field lineage manually.
+
+PLAY0516/0517 are **information**, so never fail `--warnaserror`. They review
+presentation order, not execution: a backward event/read-model dependency or a
+mutually dependent sibling group. A cycle group replaces internal individual
+backward findings. Ordering roots are the sole source document, an importing
+`application.play`, or a unique importing root; without one, folder timeline
+checking is skipped. Safe PLAY0516 repairs move siblings/imports or pin files
+before a retained glob; cycles and own-sub-feature findings have no repair.
+
+## Editor versus C# verdicts
+
+Monaco/VS Code use the TypeScript syntax/authoring compiler. They share projection
+and protected-identifier checks (PLAY0514/0515), typed-example syntax (0518/0519),
+guarded actions (0341–0348, including item paths/input bindings 0345–0348),
+identity details (0633–0646), compliance/subject checks, reaction identity
+(0647–0649), and reaction-refusal syntax/checks (0538–0545).
+A shared catalog code is not proof that a check is implemented in both compilers.
+
+C# CLI/MCP owns whole-application scoped diagnostics, opt-in completeness
+(including PLAY0530–0537, PLAY0602–0606 and PLAY0652), bound reaction gate
+checks PLAY0650/0651, semantic binding and PLAY0546 (a negated claim targets optional,
+unavailable-subject or non-text data). The VS Code repair bridge is not a general
+C# validator. A clean editor is not V1 for the complete application, V3 binding
+or V4 execution. Run the CLI or MCP for those verdicts. Authority:
+`v4.127.0:Documentation/screenplay/editor-diagnostics.md`, `diagnostics.md`.
 
 ## Consistency errors (V1: the model contradicts itself)
 | Code | Meaning |
@@ -55,7 +169,7 @@ then STAGE (V5 admission). Tool differences: `versions.md`.
 ## Binding (V2 and V3) - see `executable-subset.md` for the full table
 | Code | Meaning | Fix |
 |---|---|---|
-| PLAY0268 | construct the ESM cannot represent; read the message for the construct (`executable-subset.md` lists the common ones: handler, list or observable query, `@pii`, `produces when` over read models, v6 constructs on cratis before 3.28.2) | stay in design mode, or change the construct if the domain allows; never strip `@pii`/authorization |
+| PLAY0268 | construct the ESM cannot represent; read the message for the construct (`executable-subset.md` lists the common ones: handler, list or observable query, `pii`, `produces when` over read models, v6 constructs on cratis before 3.28.2) | stay in design mode, or change the construct if the domain allows; never strip `pii`/authorization |
 | PLAY0269 / 0270 | UI deferred / authoring metadata (I) | none |
 | PLAY0271 | legacy `reads` or a `concurrency` block keeps its legacy meaning and cannot bind (error) | design gap; a constraint for uniqueness; protected decisions are a target requirement |
 | PLAY0273 | incoherent: ambiguous `for`, property not on event revision, operand type mismatch, derived `$eventContext` path | fix the reference |
@@ -99,7 +213,11 @@ Fix order: E at V1 -> W at V1 -> silent-gap check -> V2 codes (if the mode needs
 Report each as `code file:line one-line meaning`; never paste more than about 30 lines.
 
 ## Render admission (V5): `STAGE-*`, `CLI-RENDER-*`, `STAGE-CRATIS-*`
-Full table with causes: `renderable-subset.md`. Codes you meet most:
+Full table with causes: `renderable-subset.md`. The Stage 4.24.x rows below
+retain historical source/probe evidence. Current CLI 3.41.0 admits up to ESM v7
+for Stage planning; above that is CLI-RENDER-004. Its v7 corpus is refused by
+STAGE-ESM-028 (generated values) and -029 (responses), not the old v7 version gate.
+Codes in the historical snapshot:
 | Code | Meaning |
 |---|---|
 | STAGE-ESM-016 | model above the admitted ESM schema (v4 on Stage 4.24.2: v5 absence and v6 constructs; 4.24.1 admitted v3, so a v4 model with generations was refused): whole model refused |

package/package/corpus/skills/cratis-screenplay-toolchain/references/doc-contradictions.md

@@ -1,5 +1,17 @@
 # Documentation contradictions and which side to trust
 
+Current pins are Screenplay 4.127.0 / CLI 3.41.0 (`versions.md`). This is a
+**historical** contradiction inventory, not a claim that all listed defects still
+exist. Current grammar documents exact numbers and free description placement;
+sources/routes bind as ESM v8; PLAY0515 is a source error; CLI v7 reaches Stage.
+
+At v4.127.0 `concepts.md` links the shipped purpose declarations/checks/record
+but its final identifier section still calls them later phases. `purposes.md`,
+the released grammar/tool and successful purpose probes take precedence. The same
+page's legacy `@pii` mentions do not change bare `pii`/`secret` canonical syntax;
+legacy forms compile with PLAY0565 information, duplicates with PLAY0653 warning.
+Event `subject` remains report-only, despite accepted future lineage work.
+
 `D/` is Screenplay `Documentation/screenplay/` at **v4.66.0**; line numbers were re-read at
 that tag. Rule: the compiler you ran decides what the tool accepts today; the documentation
 and the domain decide what the model should mean. When they disagree, follow the compiler
@@ -32,7 +44,7 @@ read from source or documentation.
 | 19 | `$strings` constraint messages | `D/constraints.md:31` vs `D/internationalization.md:55` | the compiler keeps the key; realization localizes |
 | 20 | composite key braces | optional in the EBNF; both forms in docs | both fine |
 | 21 | counters list | `D/projections/index.md:54` lists only increment and decrement | `count` exists too [probed] |
-| 22 | ESM version allocation | older text and decisions 0023 and 0024 give exact numbers, operations, streams and reads fixed numbers (v7 to v11) | decision 0025 (accepted 2026-10-06): v7 is generated values and responses (decision 0026, released in 4.68.0); every other feature has no number until its release-ready admission, so say "not admitted by any supported ESM version" |
+| 22 | ESM version allocation | older text and decisions 0023 and 0024 give exact numbers, operations, streams and reads fixed numbers (v7 to v11) | use actual released binder selection: v7 generated values/responses, v8 routing, v10 reaction identity at 4.125.0; operations and exact numbers remain unadmitted. Never infer current admission from older proposed allocations |
 | 23 | claim conditions | the condition grammar lists `==` | claims need `matches` (PLAY0120) [probed] |
 | 24 | `numbers exact` | released in 4.64.0 as syntax only, but absent from `D/grammar.md`; documented only in `D/diagnostics.md` (PLAY0508 to PLAY0513) | the compiler: it parses, never binds (PLAY0268, "not admitted by any supported executable model (ESM) version yet"), PLAY0001 on older compilers [probed] |
 | 25 | command `concurrency` | `D/commands.md:609` says the executable model "does not bind the `concurrency` block yet" | the binder reports PLAY0271 as an **error**, not a silent skip (`SemanticModelBinder.Commands.cs:32-38`) |

package/package/corpus/skills/cratis-screenplay-toolchain/references/executable-subset.md

@@ -2,6 +2,7 @@
 
 ## Contents
 
+- Caller and compliance boundary (4.127.0)
 - Admitted on both compilers
 - Admitted from Screenplay 4.61 (ESM v6): standalone tool and cratis 3.28.2 or later
 - Generated values and responses (ESM v7): standalone 4.68.0 or later only
@@ -10,6 +11,12 @@
 - Not refused, but do not rely on it
 - Never do this to reach V3
 
+Current pins are Screenplay 4.127.0 / CLI 3.41.0 (`versions.md`). Detailed
+4.66.0/4.68.0 binder probes below retain their historical labels. Current source
+admits sources/streams/routes as ESM v8 and policy negation as ESM v7; operations,
+exact numbers and reaction refusals/redelivery remain unadmitted. Use the actual
+binder before promoting an older probe to a current capability claim.
+
 What the binder admits, and what it refuses with which code. The answer depends on the
 compiler version: standalone Screenplay 4.68.0 admits ESM v1 to v7; the 4.66.0 compiler bundled in
 cratis 3.28.2 and 3.28.3 admits v1 to v6; the 4.60.1 compiler bundled in cratis before 3.28.2 admits v1 to v5.
@@ -26,6 +33,20 @@ Complete examples that bind live in `executable-example.md` (both compilers),
 (ESM v6; standalone tool and cratis 3.28.2 or later) and `generated-responses-example.md`
 (ESM v7; standalone tool 4.68.0 or later only).
 
+## Caller and compliance boundary (4.127.0)
+
+`$identity.id`/`.name`/`.userName` are aliases of the admitted
+`$context.identity` produces-mapping values. Authentication status, roles and
+claims still refuse there (PLAY0268); the older root is not deprecated.
+A top-level `identity` block alone is authoring metadata and does not block
+readiness. Executable reads of declared `$identity.<detail>` do (PLAY0268);
+`$context.identity` remains built-ins only. Purposes and event `subject` marks
+are metadata (PLAY0270), not source resolution, retention or subject propagation.
+Bare `pii`/`personal` and `secret` concepts, scopes and qualifiers still block
+binding. Legacy spellings compile with PLAY0565 information; duplicates warn
+PLAY0653. Never remove protection; see command-surface `references/compliance.md`.
+Authority: v4.127.0 `context.md`, `identity.md`, `concepts.md`, `events.md`, `purposes.md`.
+
 ## Admitted on both compilers
 
 - `StateChange` and `StateView` slices.
@@ -63,9 +84,10 @@ Complete examples that bind live in `executable-example.md` (both compilers),
 
 - `slice Automation` with `reaction`: `when <Event>` (with values) then `produces` (no
   `for` means the trigger's event source) or `invokes <Command>`; `where`; clock `at ... on
-  ...` with an explicit `for`. The invoked command runs its full pipeline with **no caller**
-  (Screenplay#383, open): a gated command rejects and the rejection ends the scenario.
-  Keep the gate and record the capability gap; never strip authorization.
+  ...` with an explicit `for`. Without a declared actor, a gated invocation denies.
+  On 4.125.0 reaction `runs as system role "<Role>"` supplies the actor and
+  selects ESM v10; keep the gate. CLI 3.41.0's older compiler rejects this syntax,
+  while standalone reference execution admits it.
 - Application `trigger` declarations and `when trigger` specifications.
 - `slice Translate` with `capture` (`key`, `map ... translate`, `append ... when x from "a"
   to "b"`), and `given capture` / `when capture` specifications.
@@ -152,7 +174,7 @@ bodies still leave their owner non-executable.
 | --- | --- | --- |
 | `Automation` or `Translate` slice, `reaction`, `capture`, `trigger`; `given clock`, `when clock`, `when trigger`, `when capture` | PLAY0268 | **cratis before 3.28.2 bundles only** (4.60.1); messages in `versions.md` |
 | Unquoted `import Other.Contract` | PLAY0268 | external contract import is not bound |
-| `@pii` or `@sensitive` on any concept | PLAY0268 | "Concept '<n>' compliance attributes require portable data-subject semantics." Same message at 4.60.1 and 4.66.0. `@sensitive` means an operational secret, rendered `[Encrypted]` + `[NotAudited]` (Screenplay decision 0034) |
+| `pii` or `secret` on any concept (also alias/legacy markers) | PLAY0268 | Compliance requires portable data-subject semantics; scopes/qualifiers do not admit it. Secret provider mapping is `[Encrypted]` + `[NotAudited]`, not a bind/render claim |
 | `query` returning a collection (`RM[]`), or without exactly one caller-supplied `by` | PLAY0268 | "must declare one caller-supplied 'by' argument" or "must return one optional read model" |
 | `observable`, `filter`, `scoped to`, `performer` queries | PLAY0268 | "uses delivery, filtering, scope, or implementation behavior outside the first ESM v1 vertical." `observable` goes in the return position (`=> observable RM optional`); as a body line it is PLAY0048 |
 | `contains` or `starts with` in conditions | PLAY0268 | equality and numeric ordering only |
@@ -173,7 +195,7 @@ bodies still leave their owner non-executable.
 | `$eventContext.occurred.Week` | PLAY0273 | derived value |
 | Projection `parent p` where `p` is not on the child event | PLAY0273 | "Event property not found" |
 | `generated` or `returns` on a compiler before 4.68.0 (4.66.0 and 4.67.0 refuse; 4.66.0 is bundled in cratis 3.28.x) | PLAY0268 | admitted from standalone 4.68.0 (ESM v7), see above |
-| Operations or systems, `numbers exact`, eventsource or stream | PLAY0268 | not admitted by any supported ESM version; syntax only (`sources-and-streams.md`); one such construct leaves the **whole** application without an executable model |
+| Operations or systems, `numbers exact`, reaction refusals/redelivery | PLAY0268 | not admitted by any supported ESM version; one such construct leaves the **whole** application without an executable model. Event sources/streams/routes instead bind as ESM v8 on the current compiler (`sources-and-streams.md`) |
 | Spec of a gated command or query without `given caller` | PLAY0389 | module and feature gates count |
 | `given` or `then readmodel` missing the key property | PLAY0351 | key is the keyed query's `by` |
 | When-less spec asserting events or errors | PLAY0352 | |
@@ -185,15 +207,17 @@ bodies still leave their owner non-executable.
 - Plain `produces` without `for` binds (PLAY0478, information) but means allocation in the
   ESM and "the identifier" in rendered Arc code. Always write `for`.
 - A projection-level (root) `remove via join` binds, but the reference execution plan refuses it (`UnsupportedProjectionBlock`), so no specification in the application runs; Chronicle wires it as a child pull. See the blocked-plan rows above.
-- A projection mapping to a property the read model does not declare, and an undeclared
-  event in `remove with` or a capture `append`: V1 does not report them; binding (V3) does,
-  with PLAY0273 (Screenplay v4.66.0 `BindMapping`, `LevelEvent`, `BindCaptureAppends`). A
-  declared read-model property that nothing maps is different: no tool reports it, so check
-  field lineage by hand.
+- At Screenplay 4.125.0, V1 reports absent projection/children/nested targets
+  with PLAY0514 and unknown removal/capture events with PLAY0166. An unmapped
+  declared field can be found by opt-in `--check field-origins` (PLAY0534);
+  unknown or opaque coverage is skipped, so still check lineage by hand.
 
 ## Never do this to reach V3
 
-Do not remove `@pii`, `@sensitive`, `authorize` or policies, list queries, automations or
+Do not remove `pii`, `secret`, `authorize` or policies, list queries, automations or
 rules a domain needs just to make binding pass. Report `V3 blocked: <codes>` and record the
-slice in the gap list. A `@pii` or `@sensitive` attribute blocks V3 and rendering, and
-either attribute on an event-source identifier is not reported by the pinned tools (`PLAY0515` ships for `@pii` in Screenplay 4.69.1 and for `@sensitive` in 4.84.1); only Chronicle rejects it, at build time of the generated code (CHR0034 for `[PII]`, CHR0052 for `[Encrypted]`).
+slice in the gap list. A `pii` or `secret` marker blocks V3 and rendering, and
+either attribute on an identifier or typed destination is a source error
+PLAY0515 on the current compiler (including stream-id parts and route mapping
+sources). Chronicle also rejects `[PII]`/`[Encrypted]` on event-source identifiers
+(CHR0034/CHR0052). Keep surrogate identity and protected payload separate.

package/package/corpus/skills/cratis-screenplay-toolchain/references/provenance.md

@@ -28,6 +28,13 @@ is adapted with the agreement of Martin Dilger and Nebulit GmbH.
 
 ## Sources read for facts
 
+- Identity/compliance/route-literal guidance: Screenplay `v4.127.0` (`e70435a4`)
+  `identity.md`, `context.md`, `concepts.md`, `purposes.md`, `events.md`,
+  `event-sources.md`, `reactions.md`, `completeness.md`, `diagnostics.md`,
+  `editor-diagnostics.md`, MCP reference/authoring tools and `Semantics/Versions.cs`.
+  Installed 4.127.0 version and changed examples were checked separately. Historical
+  execution and renderer probes retain their labels; CLI stays 3.41.0.
+- Earlier baseline: Screenplay `v4.125.0` `Documentation/screenplay/{tool,diagnostics,editor-diagnostics,grammar,event-sources,specifications,policies}.md`, MCP reference/authoring guides and `Semantics/Versions.cs`; CLI `v3.41.0` dependency pins, `RenderedSemanticVersions.cs` and its v7 planning specification. Installed versions/CLI help and changed examples were checked separately. Pins are in `versions.md`; the older probes below retain their original labels.
 - Screenplay `v4.66.0` (`c89198b`): `Documentation/screenplay/` (grammar, commands, queries,
   specifications, reactions, diagnostics, mcp), `decisions/0017`, `0020`, `0022` to `0024`,
   `Source/DotNET/Screenplay/Semantics/` (binder, versions, execution),
@@ -39,8 +46,9 @@ is adapted with the agreement of Martin Dilger and Nebulit GmbH.
 - cratis `v3.28.2` (`141c499`; `Render/`, `Run/`, `Prologue/` and `Screenplay/Generate*` are unchanged since `v3.27.1`, `a327e89`): `Source/Cli/Commands/Render/`, `ScreenplayMcpRoot.cs`,
   `Documentation/reference/screenplay.md`.
 - Arc `v22.50.5` and Chronicle `v19.32.0` for the code-level facts cited in `versions.md`.
-- Open issues cited as limits: cli#242, #243, #244, #245; Screenplay#377, #379, #383,
-  #388; Stage#79, #165, #178; Chronicle#3744, #4123, #4131.
+- Historical issue inventory at the old probes: cli#242, #243, #244, #245;
+  Stage#79, #165, #178; Chronicle#3744, #4123, #4131. Current invocation actor and
+  reference-execution availability are verified against v4.125.0, not old open-issue status.
 
 ## Changes from the earlier toolkit