@cratis/pi 7.21.0 → 7.23.0

package/package/corpus/skills/cratis-screenplay-toolchain/references/renderable-subset.md

@@ -1,6 +1,20 @@
 # Renderable subset (V5): what `cratis render` admits
 
-Sources, all read at tags: Stage v4.24.1 `Source/Rendering.Cratis/Semantics/SemanticSurfaceLedger.cs`
+## Contents
+
+- What Stage 4.24 admits
+- Authoring consequences in renderable mode
+- Ownership, publication and recovery
+- Reading V5
+
+Current pins: standalone Screenplay 4.127.0; CLI 3.41.0 bundles Screenplay
+4.114.0 and Stage 4.51.3 (`versions.md`). CLI admits ESM v7 to Stage planning;
+above v7 is CLI-RENDER-004. Its v7 canonical corpus gets STAGE-ESM-028/029 for
+generated values/responses (`v3.41.0:Source/Cli.Specs/for_ScreenplayPlanning/when_planning_an_esm_v7_model.cs`).
+The following detailed Stage 4.24.x results are **historical**, not reverified
+4.51.3 claims. Run the bundled renderer before asserting current renderability.
+
+Historical sources, all read at tags: Stage v4.24.1 `Source/Rendering.Cratis/Semantics/SemanticSurfaceLedger.cs`
 (an exhaustive map of every ESM member to Rendered, Rejected(code) or Ignored),
 `CratisArtifactRenderPlanner.cs`, `PureTransitionAdmission.cs`; cli v3.28.2
 `Commands/Render/RenderSettings.cs` and `Documentation/reference/screenplay.md`. Re-run the
@@ -41,6 +55,14 @@ whole automation is hand-written (gap-fill).
 | Specifications | command-action scenarios: given events, `when <Command>`, `then` events (ordered or any order), `then readmodel`, `then query`, `then error` (naming a rendered constraint or message), `then denied`, `given caller`. Two narrow when-less routes: an unprotected single `then query` seeded by exactly one `given readmodel` whose key and values match (no given events, no caller), and a query-only denial (`given caller`, one `then query` with no results, `then denied`, a protected query, no role claims) | `then no readmodel`, `when append`, composite values, error codes not naming a rendered constraint: 011. Any other when-less specification (for example given events with `then query`) fails 011 |
 | Compliance | none | any `@pii` or `@sensitive` already fails binding (PLAY0268). The C# provider mapping (Stage v4.29.0, Stage#197) is `@pii` to `[PII]`, `@sensitive` to `[Encrypted]` + `[NotAudited]`, both to `[PII]` only |
 
+At standalone 4.127.0, compliance uses bare `pii`/`secret` (legacy markers are
+accepted with PLAY0565 information); either still refuses binding. Identity blocks,
+purposes and event `subject` are authoring metadata, not provider realization;
+executing identity detail reads still refuses PLAY0268. Current source/stream
+routes are admitted as v8, including composite ids, not the historical binding
+refusal above; CLI 3.41.0 still refuses versions above v7. Never split hand-joined
+legacy ids or drop protected ids into routing to fit a renderer (PLAY0515).
+
 ## Authoring consequences in renderable mode
 
 - `produces when` is STAGE-ESM-006: split conditional outcomes into separate commands, or

package/package/corpus/skills/cratis-screenplay-toolchain/references/sources-and-streams.md

@@ -1,29 +1,113 @@
 # Event sources, streams and command routes
 
-What a model that uses `eventsource`, `stream`, `streamId` or a command route can and
-cannot do today. Facts read at Screenplay v4.68.0 (`SemanticModelBinder.CommandProductions.cs`),
-Stage v4.24.0 (`SemanticCratisAdmission.cs`) and Chronicle v19.30.0 / Arc v22.49.0.
-
-| Activity | Today |
-| --- | --- |
-| Author in `.play` (syntax, MCP views `event-sources`, `event-streams`, `command-routes`) | yes, since Screenplay v4.62.0 |
-| Validate (V1: authorable) | yes |
-| Bind (V3) and run specifications | no: binding reports `PLAY0268`; the whole application then has no executable model. V2 (executable diagnostics) shows that blocking `PLAY0268` as the evidence for the blocked V3 |
-| Render (V5) | no: Stage admits ESM v1 to v4 only, so a model of v5 or later is refused with `STAGE-ESM-016` and an evolved event with `STAGE-ESM-026` |
-| Deliver as code | gap-fill by hand with the model as the contract (`cratis-screenplay-render-and-gap-fill`, case C) |
-
-Why binding refuses: no supported executable model (ESM) version admits these constructs. At 4.68.0 the
-`PLAY0268` message reads "Event sources, streams and routes are not admitted by any supported executable model
-(ESM) version yet (#302)." They have no ESM version number: by decision 0025 a number is assigned only at a
-release-ready admission, so do not copy a number into a model, a skill or a decision. Tracked in
-Cratis/Screenplay#407 (increment 2 of #302).
-
-Stage: even when a model uses none of these constructs, Stage 4.24.0 renders appends
-without event source type, event stream type or event stream id, so Chronicle's defaults
-apply. Tracked in Cratis/Stage#177, #200 and #201. Keep a declared route as intent in the
-model and implement it in hand-written code; never remove it to make the model bind or render.
-
-Code-level target for the hand-written part: `IEventSource`, `[EventSource]`, `[EventStream]`
-(Chronicle 19.30.0 and later) and Arc's `[EventSource<TSource>(stream)]` on a command
-(Arc 22.49.0 and later); see `cratis-chronicle-client-dotnet` and `cratis-arc-command`
-(`references/handler-shapes.md`).
+## Contents
+
+- Admission
+- Declare and route
+- Specification routes
+- Canonical keys and evolution
+- Boundaries
+
+## Admission
+
+Sources, streams and command/specification routes bind and reference-execute as
+**ESM v8** on Screenplay 4.125.0. Current evidence: released `event-sources.md`,
+`specifications.md`, `Versions.cs`; the complete example below compiled with
+`--warnaserror` and passed `screenplay test` on 4.125.0.
+
+CLI 3.41.0 renders only model versions up to v7: routed v8 models receive
+`CLI-RENDER-004` before planning/publication. This is not a source-validation or
+binder refusal. Keep the routed model as contract and gap-fill its realization;
+never remove routing to obtain a render. Pins: `versions.md`.
+
+The 4.68.0 historical binder refusal (`PLAY0268`, no admitted version then) is
+not the current disposition. Systems/operations and exact numbers still report
+PLAY0268; they are separate capabilities, not evidence against v8 routing.
+
+## Declare and route
+
+An `eventsource` belongs to the application. Its `identifier` states the nominal
+source-id type; streams belong to that source. A command's `stream Source.Stream`
+selects the exact declared source/stream, with nested scalar `streamId = <value>`
+for a keyed stream. Portable mapping sources are required direct non-generated
+command properties or compatible scalar literals; nested paths can be authored
+but refuse executable admission with PLAY0268. An unkeyed stream takes no id. Composite stream ids instead
+use a bare nested `streamId` followed by all named part mappings exactly once.
+A property literally named `stream` is written `@stream` where the command clause
+would otherwise consume it. Do not invent source-only route syntax.
+
+```screenplay
+concept AccountId : Uuid
+concept Month : Int
+eventsource Account
+  identifier AccountId
+  stream Transactions
+    streamId Month
+module Banking
+  feature Deposits
+    slice StateChange Deposit
+      command Deposit
+        accountId AccountId identifier
+        month Month
+        amount Decimal
+        stream Account.Transactions
+          streamId = month
+        produces event Deposited
+          amount Decimal = amount
+      specification Depositing
+        when Deposit
+          accountId = "3fa85f64-5717-4562-b3fc-2c963f66afa6"
+          month = 10
+          amount = 40
+        then Deposited
+          for "3fa85f64-5717-4562-b3fc-2c963f66afa6"
+          stream Account.Transactions
+            streamId = 10
+          amount = 40
+```
+
+## Specification routes
+
+`given <Event>`, `when append <Event>` and `then <Event>` may state a route;
+`when <Command>` may not, because its route comes from the declaration. Routes
+belong to occurrences, not event types. Scalar ids are concrete literals of the
+stream's declared type; composite ids name every declared part. Routed history
+and appends require a concrete `for` of the source identifier type; routed `then`
+may omit it. Unknown/ambiguous destination types refuse, never default to text.
+
+`then` without routing leaves the route unspecified (wildcard), while
+`then ... no stream` explicitly expects an unrouted occurrence. `no stream` is
+not permitted on `given` or `when append`; no route there already means unrouted.
+An event-level `stream = ...` or `streamId = ...` remains payload, not routing.
+Typed event examples may supply a route, replaced as a whole by step overrides;
+`for` is independent. No spelling restores a wildcard after an example supplies
+a route. See `cratis-screenplay-specifications` for fixture provenance.
+
+## Canonical keys and evolution
+
+At Screenplay 4.127.0, stream-id literals on command routes (PLAY0504) and
+specification routes (PLAY0549) must be nonempty, well-formed Unicode NFC text;
+invalid text is refused, never normalized. In Double numeric mode integer ids
+are within ±(2^53−1); Exact mode has no such bound but still refuses binding.
+Known routed command identifiers and production destination types must equal
+the source's nominal identifier type (PLAY0504 is an error, not a warning).
+Allocation is typed by the generated identifier, or without one requires a
+UUID-based source. Unrouted commands are unaffected.
+
+Composite schemas declare `streamId` with at least two named scalar parts.
+Command routes map every part once; specification parts are literals only.
+Format each part by the portable scalar rules, escape `%` to `%25` and `|` to
+`%7C`, then join with `|` in declaration order; decoding is strict. Specification
+route contradictions compare canonical values part by part (UUID case variants
+are equal). Changing a stored stream's key schema needs a new stream identity
+or migration. Keep hand-joined legacy ids as scalar text: never split by guesswork.
+Authority: v4.127.0 `event-sources.md`, `diagnostics.md`, decision 0033.
+
+## Boundaries
+
+Reference routing does not prove target deployment, concurrency or protected
+reads. Personal/secret values cannot become source or stream ids (PLAY0515),
+including composite parts and nested command mapping sources. Use surrogates.
+Code-level realization uses Chronicle `IEventSource`, `[EventSource]`,
+`[EventStream]` and Arc's event-source route attribute; follow the corresponding
+client/command skills rather than translating route metadata to payload copies.

package/package/corpus/skills/cratis-screenplay-toolchain/references/traps.md

@@ -1,6 +1,10 @@
 # Traps (one line each, with the fix)
 
-Re-checked against Screenplay v4.66.0 and cli v3.28.2 where marked [probed] or [source]. Tool and version facts: `versions.md`. Compiler-verified syntax: `cheat-sheet.md`.
+Current pins: Screenplay 4.127.0 / CLI 3.41.0 (`versions.md`). Unless explicitly
+updated below, [probed]/[source] rows retain their historical v4.66.0/CLI 3.28.2
+scope; negative capability claims there are not current verdicts. Current routes
+bind as v8, v7 reaches Stage planning, reference tests have CLI/MCP routes, and
+exact numbers are documented in the grammar. Compiler syntax: `cheat-sheet.md`.
 
 1. Clean V1 is not executable: binding errors appear only through MCP (V2) or `render`. Neither `screenplay <folder>` nor `cratis screenplay validate` binds. [probed]
 2. The Screenplay samples validate clean but are not all executable; copying their idioms (list queries, `@pii`, `today`, `reads`, `$causedBy`, templates, performers) breaks V3. [probed]
@@ -8,10 +12,10 @@ Re-checked against Screenplay v4.66.0 and cli v3.28.2 where marked [probed] or [
 4. Plain `produces` without `for` means allocation in the ESM but "the identifier" in rendered code. Always write `for <identifier>`. [PLAY0478 probed]
 5. PLAY0029 is a warning: a misspelled keyword (or `type` inside a slice) drops the construct silently. Use `--warnings-as-errors`. [probed]
 6. Validate the folder: `cratis screenplay validate file.play` ignores imports and reports false unknown-name warnings (cli#244, open); the standalone tool follows them. [probed on 3.28.2 and 4.66.0]
-7. Unresolved names are warnings by design. Mappings to undeclared projection targets and undeclared events in `remove with`/capture `append` pass V1 and fail binding (V3, PLAY0273); a declared read-model property that nothing maps is reported by no tool. Run V3 and check field lineage by hand.
+7. Current V1 warns on absent projection/children/nested targets (PLAY0514) and unknown removal/capture events (PLAY0166). Opt-in field-origins checks find unmapped declared fields (PLAY0534) where coverage is known; still walk lineage for skipped/opaque shapes.
 8. Severity does not soften a rule: `severity warning` still rejects the command.
 9. Authorization (module AND feature AND construct) runs before validation; unauthorized is `then denied`, never `then error`.
-10. A reaction's `invokes` runs with no caller (no syntax for an identity yet: Screenplay#383, open): a gated invoked command rejects and ends the scenario. Design the trusted path (`cratis-screenplay-automations-and-translations`): keep the gate and record the capability gap; at code level `[ExecuteCommandsAsSystem]` (Arc 20.56.0 and later, so also in a Stage-rendered app on Arc 22.25.0); never invent `runs as`. Never strip authorization.
+10. Without a declared actor an invocation is caller-less. At 4.125.0 declare reaction `runs as system role "<Role>"` (ESM v10), keep its gate, and reference-test the trusted path. CLI 3.41.0's 4.114.0 parser rejects this syntax (PLAY0137); Stage 4.51.3 audits through v7 only. Arc gap-fill uses `[ExecuteCommandsAsSystem]` for returned commands, not a fictional `given caller`.
 11. A reaction `produces` without `for` lands on the trigger's event source; clock and application triggers need an explicit `for`.
 12. Read-model identity comes from its keyed queries, which must all use the same `by` property: `query XById => RM optional` + `by xId XId` with `xId` a read-model property, and the identifier equals the projection's effective key (table in slice-design `references/read-model-design.md`; full rule, including Stage's narrower admission and `STAGE-ESM-017`, in `cratis-stage-rendering-and-sandbox` `references/admission.md`). Never mark a read-model property `identifier`. (PLAY0268 when the keyed queries do not share one `by` property; PLAY0351 when a `given`/`then` readmodel block omits that property.)
 13. Projection `key` routes only on `from` (projection-level: PLAY0381). `all` is per event source. Joins never create instances and match the joined event's source id. [probed]
@@ -27,10 +31,10 @@ Re-checked against Screenplay v4.66.0 and cli v3.28.2 where marked [probed] or [
 23. `@` escapes are mandatory for `tag`, `authorize`, `produces`, `reads`, `file`, `validate`, `sequence`, `occurred`, `causedBy`, `namespace`, `correlation`, `causation`, and projection `key`/`parent`/`with` as names.
 24. Comments do not survive canonicalizing edits (PLAY0288 reprint; `droppedCommentCount`); keep durable rationale in `description` text, not `//`.
 25. MCP writes: propose, review, approval, apply by the identity owner (the session that owns the MCP connection); other subagents return edit requests; proposals are connection-local, at most 16 (`cratis-screenplay-model-authoring`).
-26. Future syntax (operations, systems, eventsource/stream) parses but never binds (not admitted by any supported ESM version); `generated` and `returns` bind from standalone 4.68.0 (ESM v7) and still report PLAY0268 on the 4.66.0 bundled in cratis 3.28.x; never invent ADR-planned syntax (`derive`, `provide`, `advisory`, `origin`, subject marks, `order by`, paging, `occurred at`, `from` filters, `for each`).
+26. Operations/systems and exact numbers remain unadmitted. Sources/streams/routes bind and reference-execute as ESM v8 at 4.125.0; generated values/responses bind as v7. CLI 3.41.0 renders through v7 only, with construct-specific Stage refusals. Consult released grammar rather than inventing syntax from decisions.
 27. Translate vs Automation is semantic: external facts become local facts in `Translate`; in-app event-to-event goes in `Automation`.
 28. Personas drive the board: a persona must list every policy on the path, including module-level `IsAuthenticated`.
-29. Sample specifications are never executed; their expected values (e.g. `.0000000Z` clock fraction, given==when clock boundary) are illustrative only.
+29. A sample's source check is not execution. Run selected admitted specifications through `screenplay test`/MCP; given==when clock still fires no scheduled occurrence.
 30. Claims compare with `matches` (`claim "dept" matches "Finance"`); `==` is PLAY0120. Conditions with `contains`/`starts with` compile but do not bind. [probed]
 31. One `every`/`all` block per projection level for V3; `$eventContext.occurred.Week` does not bind. [probed]
 32. Concept rules: `min`/`max`/`length ==`, not `length 3 to 10` (PLAY0141). [probed]
@@ -38,10 +42,27 @@ Re-checked against Screenplay v4.66.0 and cli v3.28.2 where marked [probed] or [
 
 34. A `from <Event> key <property>` routes only if every such event carries that property: an event that frees or updates a row keyed by another stream's id must carry that id in its payload, or the row never changes. Whether the compiler reports a missing key property is unverified [to probe]; check by hand.
 35. `description`/`documentation` are authoring metadata: board, MCP and Prologue show them; `cratis render` never does (Stage#178). A rule only in prose is unenforced in rendered code; make it a rule layer, a spec or a recorded target requirement.
-36. Any `system`/`operation`, event source or stream (not admitted by any supported ESM version), and `generated`/`returns` on a compiler before 4.68.0 (including the 4.66.0 in cratis 3.28.x), leaves the whole application without an executable model (PLAY0268), not just the slice: keep them out of executable/renderable scope. Even on 4.68.0 Stage 4.24.2 refuses generated values and responses (ESM v7) whole with `STAGE-ESM-016`; gap-fill.
+36. One unadmitted construct (operations, exact numbers, refusal/redelivery) blocks whole-model binding. Routing is admitted v8, not one of those constructs; CLI render's v7 boundary is a separate refusal. Do not remove routing or authorization to render a model.
 37. Personas are not in the ESM (Screenplay#254); specs cannot reference them. Write `given caller` as the roles/claims that stand for the persona.
 38. A rule that depends on stored state is `reads <View>` + `require <expr> message "..."` (stated intent; PLAY0268/0271 at binding are expected in design mode). The slice `description` must mark it NOT enforced in the model today (Screenplay#129/#209) and name the target: Arc `[ProtectedDecision]` + `DecisionRead<T>` (Arc v22.39.0 and later; not available in a Stage-rendered app on Arc 22.25.0), Chronicle DCB (`concurrency` scope), or a constraint where one fits. Forbidden: caller-supplied copies of state in `require`, boolean attestation inputs (`confirmsX == true`), rules hidden in `handler`/implementation-hint prose. An unguarded materialized read is unsafe for a protected decision.
 
+Current identity/compliance traps (v4.127.0 `identity.md`, `concepts.md`, `events.md`,
+`purposes.md`, `diagnostics.md`):
+- `$identity` built-ins alias `$context.identity`; declared detail reads are PLAY0268,
+  while an identity block alone does not block readiness. `scoped to` is opaque,
+  not a detail reference. Query sources need keyed single compatible results and
+  token-only keys/gates that do not depend on details.
+- `pii personal` repeats one marker (PLAY0653). Legacy markers are accepted but
+  deprecated (PLAY0565); repairs preserve notes, never invent legal content.
+- Event `subject` is report-only (PLAY0270), not emitted C# `[Subject]` or runtime
+  lineage. Keep stream identity, data subject, encryption scope and policy subject apart.
+- Purpose metadata/checks/records declare processing, not lawfulness or retention.
+- PLAY0504 is an error; stream-id text is nonempty well-formed NFC (refuse, never
+  normalize), Double integer ids are within ±(2^53−1); canonical UUID comparison
+  ignores case. Protected concepts cannot be stream ids/parts/mapping sources (PLAY0515).
+- Run `--check privilege` on elevated event-trigger paths; opaque producers are
+  unknown, not safe. Arc needs `[ExecuteCommandsAsSystem]` to supply a principal.
+
 The SKILL.md top 12: 1, 4, 5, 6, 7, 10, 12, 13, 17, 18, 20, 21 (+ mode/version notes there). Traps 39 to 44 are tool traps added at the 4.66.0 pin.
 39. A handler never binds: PLAY0268 "Command '<n>' handler requires a constrained implementation attachment", with a file, a fence, `implementation` or `hint` alike. `implementation` and `hint` are accepted on a command handler, an operation execute/compensate phase and (from 4.65.0) a command property named rule, and are rejected on concept rules, built-in property rules and whole-command `require`/`validate` bodies; on a handler they are authoring intent only (no execution, lock or confirmation). A handler slice is gap-fill, not a customization of a rendered slice. [source, probed]
 40. `numbers exact` parses on 4.66.0 to 4.68.0 but never binds (PLAY0268; "not admitted by any supported executable model (ESM) version yet") and is PLAY0001 on older compilers; it is absent from `grammar.md`. Never use it in a model or example meant to execute. [probed]

package/package/corpus/skills/cratis-screenplay-toolchain/references/verdicts.md

@@ -28,12 +28,21 @@ V3 are read from the MCP server or from a render, V1 and V5 from the CLIs.
 
 | Tool | Command | Pass | Fail |
 | --- | --- | --- | --- |
-| Standalone (preferred) | `screenplay <model-folder> --warnaserror --no-color` | exit 0 and `N file(s) compiled - 0 error(s), 0 warning(s)` | exit 1 |
+| Standalone 4.127.0 (preferred) | `screenplay <model-root> --warnaserror --no-color` | exit 0 and a nonzero compiled file count | exit 1 defects; exit 2 could not run/invalid arguments or input |
 | cratis (fallback) | `cratis screenplay validate <model-folder> --warnings-as-errors -o json-compact` | exit 0 | exit 5; exit 1 means missing path or no files |
 
-- Always validate the **folder**. cratis file mode ignores imports (cli#244); the standalone
-  tool follows them, but a folder run is the same on both tools.
-- An empty folder exits 0 on the standalone tool: read the file count.
+- Validate the complete application root, not an independently selected fragment.
+  Standalone file mode follows imports; folder mode includes all files. The CLI
+  file-import limitation below was a 3.28.2 probe, not a current tool claim.
+- Require a nonzero file count; empty input is not a model-validation pass.
+- Optional `--scope <Module.Feature.Slice>` compiles the whole application but
+  reports descendants and direct dependent declarations, not transitive impact.
+  Exit/`--warnaserror` apply to that reported set; inspect the separate whole
+  application counts before a whole-model claim. Unknown/ambiguous scopes exit 2.
+- `--check <names>` (repeatable) or `--check all` opts into completeness warnings
+  including PLAY0530–PLAY0537, purposes (PLAY0602–0606) and privilege (PLAY0652).
+  Whole-source errors skip them; a skipped check is not passed.
+  Names/codes, coverage limits and editor support: `diagnostics.md`.
 - Warnings are failures here. PLAY0029 (a construct dropped silently) and the unresolved-name
   warnings are the defects this verdict exists to catch.
 - Syntax and consistency checks (PLAY0282 to PLAY0294) run; binding does not.
@@ -54,7 +63,7 @@ MCP reports `V2 not run: no MCP in this agent` unless the brief supplies fresh o
    source revision).
 4. Report the codes with counts, blocking (error severity) apart from informational. A list
    with blocking entries is a valid V2 result (`V2 read: 6 blocking, PLAY0268 x3 list query,
-   @pii ...`); it is the evidence for a "V3 blocked" report. The view also lists
+   pii ...`); it is the evidence for a "V3 blocked" report. The view also lists
    information-severity diagnostics (PLAY0269 deferred UI, PLAY0270 authoring metadata such as
    descriptions, personas and screens) on models that bind; they do not block.
 
@@ -71,18 +80,25 @@ comparison needs it). Binding is what makes a model renderable at all. V3 means
 never "specifications pass".
 
 - Report the ESM version the model needs: `V3 ready (screenplay 4.68.0, ESM v6)`,
-  `V3 blocked: PLAY0268 x3 (list query, @pii) - design scope kept`.
-- A blocked V3 is not repaired by deleting protection or domain rules. Never remove `@pii`,
-  `@sensitive`, authorization, list queries, automations or rules to reach V3; record the
+  `V3 blocked: PLAY0268 x3 (list query, pii) - design scope kept`.
+- A blocked V3 is not repaired by deleting protection or domain rules. Never remove `pii`,
+  `secret`, authorization, list queries, automations or rules to reach V3; record the
   slice and the code in the gap list.
-- A model is "executable" only on the compiler that bound it. A V3 from the standalone tool
-  does not carry to `cratis render`: Stage admits ESM v1 to v4 only on 4.24.2 (v1 to v3 on 4.24.1, bundled by cratis 3.28.2; cratis 3.28.3 bundles 4.24.2; evolved events are STAGE-ESM-026) (and on cratis before 3.28.2 the bundled 4.60.1 binder, ESM v1 to v5, refused v6 first; the 4.66.0 bundled by cratis 3.28.x refuses ESM v7 generated values and responses at binding with `PLAY0268`).
+- A model is executable only on the compiler that bound it. V3 does not carry
+  to render admission: CLI 3.41.0 passes up to ESM v7 to Stage, refuses newer
+  models with CLI-RENDER-004, and its v7 corpus receives STAGE-ESM-028/029.
+  The old 3.28.x/Stage 4.24.x probes remain historical in the subset references.
 
 ## V4: reference specifications run
 
-No MCP tool and no compile command runs specifications (Screenplay#377 is open). V4 comes
-only from an actually executed Screenplay **reference** route. Record the route, the expected
-versus discovered specification count, and passed, failed, unsupported and cancelled counts.
+Run `screenplay test <root> [--filter <exact-address>] [--format text|json]` on
+4.125.0, or MCP `run-specifications`. The compile command alone still does not
+execute scenarios. Reference execution is in-memory: no external services or
+opaque code run. Record route, expected versus discovered/selected counts,
+passed, failed and unsupported outcomes. Exit 0 means all selected passed; 1
+failed, 2 could not run/invalid input or selection, 3 unbound or unsupported.
+Unknown filters refuse rather than select zero. No discovered specifications
+is not proof of coverage.
 The reference runner returns unsupported for a specification that reads a reducer-built read
 model and for any construct whose evaluation needs an opaque body.
 
@@ -133,9 +149,11 @@ source change makes earlier verdicts stale.
 
 ## Example gate (for skill and documentation authors)
 
-Every complete `screenplay` fence in this corpus compiles with the standalone tool at the
-pin and `--warnaserror`. Every such fence also passes `cratis screenplay validate
---warnings-as-errors` (3.28.2, bundling the same compiler) on a folder holding that one file.
+Historical corpus fences were checked with standalone 4.68.0 and CLI 3.28.2.
+Do not promote those results to current pins without rerunning. Check each changed
+complete fence with standalone 4.125.0 `--warnaserror`; run `screenplay test` for
+specification examples, and verify expected-diagnostic examples against their
+claimed codes. Where bundle compatibility matters, also check CLI 3.41.0.
 The `// Needs the standalone screenplay compiler (ESM v6)` first-line marker belonged to cratis
 before 3.28.2, which could not validate those fences; no fence carries it now, and a
 checker that still skips marked fences under `cratis` skips nothing. Examples meant to execute are also opened through MCP and