@cratis/pi 7.22.0 → 7.24.0

package/package/corpus/skills/cratis-screenplay-slice-design/references/model-reasoning.md

@@ -0,0 +1,87 @@
+<!-- Copyright (c) Cratis. All rights reserved. -->
+<!-- Licensed under the MIT license. See LICENSE file in the project root for full license information. -->
+
+# Keep reasoning on the model
+
+Use `description` for a short summary and `documentation` for assumptions,
+boundaries, trade-offs and rejected alternatives. Put reasoning on the declaration
+it explains, not in comments or disconnected session notes. Modules, features,
+slices, commands, events, read models and reactions accept one nonempty block,
+directly in their body (not beneath a reaction trigger). Queries, personas and other
+declarations do not accept `documentation`: keep their intent in `description` (a
+query's ordering, "oldest first", for example). A short status marker such as **NOT
+enforced in the model today** or **ASSUMED** stays in `description`, where a reader
+sees it first; the reasoning behind it goes in `documentation`:
+
+````screenplay
+module Billing
+  documentation
+    ```markdown
+    ## Boundary
+    Billing records agreed amounts; payment delivery belongs elsewhere.
+    ```
+  feature Amounts
+    documentation
+      ```markdown
+      Keep the agreed amount, not a running total.
+      ```
+    slice StateChange RecordAmount
+      documentation
+        ```markdown
+        A recorded amount is a decision, not a recalculated view.
+        ```
+      command RecordAmount
+        documentation
+          ```markdown
+          The caller supplies the agreed amount.
+          ```
+        recordId String identifier
+        amount Int
+        produces AmountRecorded
+          for recordId
+          amount = amount
+      event AmountRecorded
+        amount Int
+      specification RecordingAnAmount
+        description "Witnesses that the agreed amount is retained"
+        when RecordAmount amount = 10
+          recordId = "amount-1"
+        then AmountRecorded amount = 10
+    slice StateView AmountHistory
+      readmodel AmountView
+        documentation
+          ```markdown
+          This view is display state, not an atomic decision input.
+          ```
+        id String
+        amount Int
+      projection AmountHistory => AmountView
+        from AmountRecorded
+          id = $eventSourceId
+          amount = amount
+      query AmountById => AmountView optional
+        by id String
+    slice Automation ObserveAmount
+      reaction ObserveAmount
+        documentation
+          ```markdown
+          Observation does not certify an exactly-once external effect.
+          ```
+        when AmountRecorded
+````
+
+A specification accepts a `description` naming the behavior it witnesses, not
+`documentation`; longer reasoning belongs to its slice. Projections and screens
+do not accept documentation. `documentation String` remains a typed property
+where properties are allowed; bare `documentation` starts metadata.
+
+Both metadata fields are report-only (PLAY0270): no executable bytes,
+`modelRevision` or ESM version change, no rule enforcement or rendered code.
+Canonical printing retains documentation on its owner; source identity changes. MCP `declaration-details` summary exposes
+`description` and `documentation` wherever supported. Folder merge keeps the
+first module/feature block: identical copies are accepted, conflicting copies
+warn PLAY0559. Malformed, empty or repeated blocks report PLAY0558; events retain
+PLAY0477. These diagnostics have no automatic repair; choose the owning text.
+
+Authority: Screenplay v4.127.0 `slices.md` and `specifications.md`. The complete
+model above validates and its specification passes on standalone 4.127.0.

package/package/corpus/skills/cratis-screenplay-slice-design/references/provenance.md

@@ -28,7 +28,7 @@ is adapted with the agreement of Martin Dilger and Nebulit GmbH.
 | `eventmodeling-identifying-outputs/SKILL.md`: events vs read models test, recalculated-state anti-pattern, processor outputs categorized (new event, view update, notification) | `references/read-model-design.md` "Events or views" | shared with TrogonStack's version, including the processor-output categories (row above); adapted closely; the "independent means event" and "no computed fields" rows dropped because decided calculations are facts in Screenplay |
 | `eventmodeling-identifying-outputs/SKILL.md` Step 5a/5c: enumerate consumers, one component one read model, homogeneous list is one component, wide-fan-in versus cheap fields | `references/read-model-design.md` "Components" | adapted closely; "always split" softened to "split when you can name the consequence" (existing decision); screen copies become one `data` line per component |
 | `eventmodeling-identifying-outputs/SKILL.md` Step 5d: build read models from the screen's field mappings, not from its title or a summary | `references/read-model-design.md` "Components"; `references/field-lineage.md` | adapted closely |
-| `eventmodeling-identifying-outputs/SKILL.md` Step 5h.4, 5i: event-to-field reasoning note, per-node verification result list | `SKILL.md` step 8; `references/read-model-design.md` "Checks before handing off"; `references/field-lineage.md` | adapted closely; the note lives in the StateView slice `description` |
+| `eventmodeling-identifying-outputs/SKILL.md` Step 5h.4, 5i: event-to-field reasoning note, per-node verification result list | `SKILL.md` step 8; `references/read-model-design.md` "Checks before handing off"; `references/field-lineage.md` | adapted closely; the reasoning note lives in StateView slice `documentation` |
 | `eventmodeling-identifying-outputs/SKILL.md` lines 378-379: before completion re-read every read model and recheck each field and every reason note (roll-ups, additions) | `references/read-model-design.md` "Checks before handing off" | adapted closely; Cratis named-consequence threshold kept instead of "always split" |
 | `eventmodeling-identifying-outputs/SKILL.md` Interview: calculated fields confirmation wording | `SKILL.md` *Interview phase* question 3 | adapted closely |
 | `eventmodeling-identifying-inputs/SKILL.md`: automation level and outside-trigger questions, user versus processor commands marked, conditional input pattern, processor failure/retry stated | `SKILL.md` *Interview phase* question 1; `references/command-inventory.md` | adapted closely; `[USER]`/`[AUTO]` kept as plain classification |

package/package/corpus/skills/cratis-screenplay-slice-design/references/read-model-design.md

@@ -127,7 +127,7 @@ it stays.
   (worklists, status awaiting an outside answer); one-shot otherwise. Design mode only
   (PLAY0268). If access can be revoked mid-session, record that the target re-checks per emission.
 - Never model paging or page size (no syntax, Screenplay#140). State the order in the query
-  `description` ("oldest first"); an unbounded list is a review question.
+  `description` ("oldest first"; queries do not accept `documentation`); an unbounded list is a review question.
 - A gated keyed query needs its own denial spec.
 
 Never drop a list query from a design model just to make it bind; record the capability gap.
@@ -260,7 +260,7 @@ module Berths
 
 ## Checks before handing off
 
-- The StateView slice `description` gives, per contributing event, the fields it sets and why
+- StateView slice `documentation` gives, per contributing event, the fields it sets and why
   (see `LockerBoard` in `worked-example.md`); extend it whenever a `from` is added. Shape of
   the note: `BerthBooked sets bookingId, status="booked": the view's creation event; the booking
   does not exist before it.` / `BoatArrived sets status="arrived", arrivedAt: the only

package/package/corpus/skills/cratis-screenplay-slice-design/references/review-questions.md

@@ -9,7 +9,8 @@ domain consequence.
 - Does this command apply in every state and set most of the entity's fields? That is a form:
   which business reasons hide behind it? What does a person decide with each field?
 - Does a command input carry a secret or personal value (by default the causation chain keeps it; retention is configurable, verify it)?
-  Mark the concept `@pii` or record the need for a not-audited marking.
+  Mark the concept bare `pii` for personal data or `secret` for an operational
+  secret; inspect declared purpose coverage, not just the reason. Never protect an identifier.
 - Does this optional event property hide two situations, or is it an optional detail?
 - Does an event exist for a derived condition? Only when a domain expert names it and something
   reacts to it; merge causes only when they mean the same to the business.

package/package/corpus/skills/cratis-screenplay-slice-design/references/rule-layers.md

@@ -14,18 +14,18 @@ rendered code (Stage#178): a rule that exists only in prose is unenforced in ren
 | stored state (record exists, balance, current status) | `reads <View>` + `require <expr> message "..."` | stated intent, **NOT enforced in the model today** (PLAY0268/0271 at binding are expected in design mode; Screenplay#129/#209). Name the target: Arc `[ProtectedDecision]` + `DecisionRead<T>` (Arc 22.39.0 or later), Chronicle DCB (`concurrency` scope), or a constraint |
 
 An unguarded materialized read is unsafe for a protected decision; a guarded read is the
-supported route. Availability: `[ProtectedDecision]` and `DecisionRead<T>` need Arc 22.39.0 or
-later and are **not available in Stage-rendered apps**, whose scaffold pins Arc 22.25.0 (Stage
-4.24.0); never edit the managed dependency files to get them. For rendered scope, record a
-capability gap (or a separately verified compatible enforcement path, such as a constraint or
-a Chronicle DCB scope) and keep the rule as NOT enforced. Forbidden: caller-supplied copies of state in `require`, boolean attestation
+supported route. Availability: `[ProtectedDecision]` and `DecisionRead<T>` exist in
+Stage 4.51.3's Arc 22.50.5/Chronicle 19.32.0 package set, but Stage does not emit
+protected decisions. Gap-fill must use an admitted projection/key shape and active
+unit-of-work enrollment; do not edit managed dependencies. Keep the `.play` rule
+NOT enforced until its target enforcement is separately verified. Forbidden: caller-supplied copies of state in `require`, boolean attestation
 inputs (`confirmsX == true`), rules in `handler` / implementation-hint prose.
 
 ## Authorization is executable
 
 Persona Does/Reads/Cannot text is intent. Every Cannot line resolves to an `authorize` gate
-(policy or ownership claim) plus a `then denied` spec whose `given caller` carries the roles
-and claims standing for that persona; otherwise record a gap. Every command and query under an
+(policy or ownership claim) plus a `then denied` spec using `given caller as <Persona>` or an explicit
+caller for the effective gate; otherwise record a gap. Every command and query under an
 inherited module/feature `authorize` gets its own `then denied` spec. Ownership gates need a
 second caller with another claim value.
 
@@ -33,9 +33,10 @@ second caller with another claim value.
 
 Command property values are, by default, recorded in the causation chain of the events they
 produce, so treat them as permanent. Newer Chronicle versions can omit causation properties
-(`CausationPropertyRetention.Omit`, Chronicle v19.32.0); rendered apps pin Chronicle 19.8.1.
+(`CausationPropertyRetention.Omit`, Chronicle v19.32.0); Stage 4.51.3 rendered apps pin 19.32.0.
 Verify the actual auditing and retention configuration before relying on omission, and never
-audit secrets. Never mark the identifier's
-concept `@pii`; use a surrogate `Uuid` identity and carry the personal value as a `@pii`
-property. Bearer tokens, magic links and signed URLs are never facts (record a keyed hash or
+audit secrets. Classify personal values as bare `pii` and operational secrets as
+`secret` on their concepts, never the identifier concept. Use a surrogate identity
+and protected payload (PLAY0515). Processing use/basis/retention is a `purpose`,
+not a reason; see command-surface `references/compliance.md`. Bearer tokens, magic links and signed URLs are never facts (record a keyed hash or
 reference).

package/package/corpus/skills/cratis-screenplay-slice-design/references/slicing.md

@@ -23,7 +23,7 @@ step at the end: design each behaviour as its slice, then audit the set.
 | `Translate` | captures, translated events | the integration (`CarrierManifests`) | see `cratis-screenplay-automations-and-translations` |
 
 Screenplay allows several commands or read models in one slice; prefer splitting unless the
-behaviour is genuinely one (and say why in the `description`).
+behaviour is genuinely one (and say why in `documentation`).
 
 ## Slice dependencies
 
@@ -142,8 +142,8 @@ result in every row and no refusal anywhere, whose event restates most of the en
    relocated).
 4. Apply rule coverage (below) to each new path.
 5. If the business treats a multi-value data-entry correction as one act, keep one correction
-   command named for the correction (never `Update`), with the reason in the slice
-   `description`; rule coverage still applies.
+   command named for the correction (never `Update`), with the reason in slice
+   `documentation`; rule coverage still applies.
 
 A repeated-field event is a review signal; it is major only when business meaning is lost, a
 rule is bypassed or consumers become ambiguous. Historical generations repeat prior shape on

package/package/corpus/skills/cratis-screenplay-slice-design/references/worked-example.md

@@ -13,9 +13,15 @@ complete givens) so they are the right form once binding is possible.
 Lineage matrix: `field-lineage.md`. State-transition table and rule coverage: `slicing.md`.
 Per-command refusal inventory: `command-inventory.md`.
 
-The per-event reason lines in each StateView `description` are the lineage record
-(`field-lineage.md`). Multi-line descriptions use a tagged ` ```text ` fence in a real model;
-they are written as one string here so this document stays a single compiling fence.
+This historical compiled example keeps per-event reasoning in StateView
+`description` strings. For current 4.127.0 authoring, keep descriptions as summaries
+and record lineage reasoning in fenced Markdown `documentation` (`field-lineage.md`).
+The historical source below stays unchanged; it is not the current placement recipe.
+
+The excerpt's Stage availability note is historical (Stage 4.24.x, Arc 22.25.0).
+Stage 4.51.3 pins Arc 22.50.5/Chronicle 19.32.0, so protected-read APIs are available
+to gap-fill; this neither admits these `.play` rules nor proves target protection.
+The original compiled excerpt is retained unchanged.
 
 ```screenplay
 domain Parcelpoint.Lockers

package/package/corpus/skills/cratis-screenplay-specifications/SKILL.md

@@ -37,7 +37,7 @@ The update follows `commands.md`, `events.md`, `types.md` and
 `specifications.md` at that main commit (after v4.52.0). This pass compiles the
 changed examples; it does not rerun the reference runner.
 
-Current specification syntax follows Screenplay v4.125.0 `specifications.md`;
+Current specification syntax follows Screenplay v4.127.0 `specifications.md`;
 older probes in the table remain historical. Pins: `cratis-screenplay-toolchain`
 `references/versions.md`. Compile commands check source, not reference execution.
 Use `screenplay test` or MCP `run-specifications` for V4; Stage/target tests are
@@ -95,13 +95,27 @@ Unsupported is not passed. Report it as "needs a target", not as green. "Specifi
 and "bound" are never "passing": run the reference CLI/MCP route or the owning
 target tests, and name the engine, version and expected/discovered selection.
 
+## Descriptions, persona callers and case tables
+
+Use one `description "<rule or behavior>"` (or a fenced `text` description) to
+name what the specification witnesses. It is report-only (PLAY0270), changing
+neither execution nor ESM bytes. Specifications do not accept `documentation`;
+put longer assumptions and rejected alternatives on the owning slice's fenced
+Markdown `documentation` block.
+
+`given caller as <Persona>` expands to one authenticated policy witness before
+binding. Named `parameter`/`case` tables share steps and read values as
+`case.<parameter>`; each case runs independently as `<Specification>_<Case>`.
+Read [persona callers and case tables](references/persona-callers-and-cases.md)
+for synthesis refusals, selection, provenance and a complete passing model.
+
 ## The vocabulary
 
 | Construct | Meaning |
 | --- | --- |
 | `given <EventType>` | prior state, established by replaying events before the action |
 | `given readmodel <ReadModelType>` | prior read-model state, established directly — a **complete** instance including its identifier |
-| `given caller` | the caller: `authenticated`, `role "<r>"`, repeatable `claim "<type>" = "<value>"`; empty means unauthenticated |
+| `given caller` / `given caller as <Persona>` | explicit caller (`authenticated`, roles, claims; empty means anonymous), or an authenticated synthesized persona witness |
 | `when <CommandType>` | run a command |
 | `when append <EventType>` | append one event: constraints and projections run, the command does not; reactions run only from ESM v6, where `then` lists what followed |
 | `when query <Query>` | perform a query with the argument values beneath it (v4.48.0) |
@@ -146,7 +160,7 @@ Rules the binder enforces:
 - **`then denied` stands alone**: not with events, errors or state assertions
   (`PLAY0388`). For a query, pair it with one `then query` that has `arguments`
   and no `result`.
-- **Authorized commands and queries need `given caller`** (`PLAY0389`). The runner
+- **Authorized commands and queries need `given caller` or `given caller as <Persona>`** (`PLAY0389`). The runner
   never invents a caller.
 - **`null` only in optional read-model values.** A `null` in a command or event
   value is `PLAY0350`: an optional fact is a separate event.
@@ -168,7 +182,7 @@ the one-rejection rule (`PLAY0273`) are reported only when the model binds, so
 - **Rejections:** `then error "<message>"` matches the message whatever the rule's
   validation severity; no form asserts severity. Bare `then error` never matches
   a denial. Quote a localized key: `then error "$strings.invoices.reasonRequired"`.
-  The grammar takes only quoted messages here, never an unquoted `$strings` token
+  Besides a String `case.<parameter>`, the grammar takes only quoted messages here, never an unquoted `$strings` token
   (unlike a rule's `message` operand). The reference runner compares the symbolic key
   and requires the rejection to carry the string-key marker; it never loads
   translated text; resolving the key is the realization's job.
@@ -197,7 +211,10 @@ Read [references/reactions-and-cascades.md](references/reactions-and-cascades.md
 
 Use typed `example` declarations for repeated event/command/read-model values;
 step overrides keep the action/outcome visible and carry authored/example/override
-provenance. Event `stream`/`no stream` assertions bind as ESM v8; typed `for` and
+provenance. Event examples can carry routes, replaced as a whole by a step.
+Redelivery locators may state `stream` or `no stream` to select one definitely
+matching given occurrence with no undecided candidates (PLAY0543); redelivery
+remains authoring-only. Event `stream`/`no stream` assertions bind as ESM v8; typed `for` and
 stream ids are not guessed. Read [examples and routes](references/examples-and-routes.md).
 
 `given operation ... fails`, `then operation` and `then compensated` describe
@@ -261,7 +278,7 @@ For view specifications:
 ## Verify
 
 - [ ] Validate the complete root with warnings as errors, naming tool/version.
-      Current standalone pin: 4.125.0. Run specification examples through
+      Current standalone pin: 4.127.0. Run specification examples through
       `screenplay test`; expected unadmitted syntax reports unbound, not passed.
 - [ ] Executable diagnostics are clean too: `PLAY0350`, `PLAY0352`, `PLAY0388`,
       `PLAY0389` and `PLAY0273` are only reported at binding.

package/package/corpus/skills/cratis-screenplay-specifications/references/examples-and-routes.md

@@ -8,6 +8,7 @@
 - Typed examples
 - Effective values
 - Event routes
+- Redelivery locators
 - Operation and recovery intent
 
 ## Typed examples
@@ -85,9 +86,74 @@ it. `then ... no stream` expects no route; no route in a then is a wildcard.
 steps replace the entire route, independently of `for`; an inherited route
 cannot be changed back to a wildcard. Literal compatibility/route contradiction
 checks use resolved source/stream types, not guessed text (PLAY0547–PLAY0551).
+At Screenplay 4.127.0, route literals must be nonempty, well-formed NFC text
+(refused, not normalized); Double integer ids are within ±(2^53−1), while Exact
+has no such bound but remains unadmitted. Invalid specification routes report
+PLAY0549. Contradictions compare canonical scalar ids and every composite part,
+so UUID casing is immaterial. Composite mappings supply each named part once,
+using literals only; encoding escapes `%`/`|` and preserves declaration order.
+Source: v4.127.0 `event-sources.md`, `specifications.md`, `diagnostics.md`.
+
 CLI 3.41.0 rendering rejects versions above v7 before planning, even though
 source compilation and reference routing pass.
 
+Command and read-model examples refuse routes (PLAY0526). Effective role and
+`for` checks use the inherited or replaced route: inherited `no stream` on a
+`given`/append is PLAY0547; incompatible destination/route pairs are PLAY0550,
+and contradictory expectations PLAY0551. Declaration checks still run on unused
+examples and routes overridden at every use. MCP route rows retain the origin
+(authored/example/override), with the replaced whole route on the stream/no-stream
+row and individual lineage on id parts.
+
+## Redelivery locators
+
+`when redelivered <Event> to <Reaction>` may contain a route, using the same scalar
+or complete composite `streamId` shape as event steps. No route is a wildcard;
+`no stream` selects the unrouted given. Compare effective, example-expanded givens.
+Every `for`, payload and route comparison is true, false or unknown: a definite
+mismatch excludes a candidate even when another comparison is unknown. Selection
+needs exactly one definitely matching candidate and **no undecided candidates**
+(PLAY0543). Equal duplicate givens remain separate candidates. Narrow with `for`,
+values, `stream` or `no stream`; do not guess an unknown value. A locator's `for`
+is optional but typed against the routed source when present.
+
+This complete syntax-only model validates on 4.127.0; `screenplay test` reports
+PLAY0268 for redelivery, not a passing scenario:
+
+```screenplay
+eventsource Account
+  identifier String
+  stream Transactions
+    streamId String
+module Accounts
+  feature Recovery
+    slice Automation Observe
+      event Recorded
+        amount Int
+      reaction Observer
+        when Recorded
+      example FirstPartition : Recorded
+        for "account-1"
+        stream Account.Transactions
+          streamId = "first"
+        amount = 10
+      specification RedeliveringTheSecondPartition
+        given FirstPartition
+        given FirstPartition
+          stream Account.Transactions
+            streamId = "second"
+        when redelivered Recorded to Observer
+          stream Account.Transactions
+            streamId = "second"
+        then no events
+```
+
+The second given replaces the example's **entire** route, independently of `for`,
+not just its id. PLAY0548 is command-action-only, never a locator route error;
+malformed routes use PLAY0547 and resolution/key-shape errors PLAY0549. MCP labels
+locator fixtures `whenRedeliveredEvent` with route-origin rows. Route admission
+alone does not admit redelivery or `then no events`.
+
 ## Operation and recovery intent
 
 Operation failure/request/compensation forms are authoring-only (PLAY0268):
@@ -100,4 +166,4 @@ remain unadmitted; they are not executed append scenarios. Forms, matching,
 acknowledgement and their whole-model refusal boundary are in
 captures-and-reactions `references/refusals-and-redelivery.md`.
 
-Authority: Screenplay `v4.125.0:Documentation/screenplay/specifications.md`.
+Authority: Screenplay `v4.127.0:Documentation/screenplay/specifications.md`.

package/package/corpus/skills/cratis-screenplay-specifications/references/persona-callers-and-cases.md

@@ -0,0 +1,117 @@
+<!-- Copyright (c) Cratis. All rights reserved. -->
+<!-- Licensed under the MIT license. See LICENSE file in the project root for full license information. -->
+
+# Persona callers and named case tables
+
+## Contents
+
+- Persona callers
+- Case tables
+
+Authority: Screenplay v4.127.0 `specifications.md`, `personas.md` and `mcp/reference.md`.
+
+## Persona callers
+
+`given caller as <Persona>` has no body and cannot coexist with an explicit
+`given caller`. It expands before binding into an ordinary authenticated caller
+satisfying every persona policy; persona names remain outside ESM bytes. Required
+atoms are collected first. Policies are visited in declared order, depth first,
+left to right: an already satisfied `or` adds nothing, otherwise the leftmost
+buildable alternative wins. Operand order matters. This witnesses one minimal
+caller, not every caller fitting the persona.
+
+Synthesis refuses no policies, any policy containing `not` (including
+`not authenticated`), inline/file policy code, and required non-literal claims.
+An `or` may skip an unsupported claim alternative. The role-URI claim type
+`http://schemas.microsoft.com/ws/2008/06/identity/claims/role` is never synthesized;
+use role atoms, not that claim. Use explicit `given caller` when synthesis is
+refused (binding PLAY0573), never infer a runtime allow/deny. Malformed references,
+body lines or unknown top-level personas report PLAY0572.
+
+Hover or `declaration-details` (`kind: "Persona"`, `view: "caller"`) shows the
+chosen caller and policy contributions or refusal. Opt-in `personas` completeness
+checks report personas gating nothing (PLAY0574), gates denying every known
+synthesized persona (PLAY0575), and unpinned buildable alternatives (PLAY0576).
+Unsynthesizable/undecidable callers are unknown, not denials. A persona-backed
+denial still uses `then denied`; a visitor persona is not an anonymous caller.
+
+## Case tables
+
+Use tables for validation matrices whose steps stay the same. Rows are **cases**,
+not examples: `example` means a named typed fixture. This complete model's five
+expanded specifications pass in the 4.127.0 reference runner:
+
+```screenplay
+policy IsAccountant
+  require role "Accountant"
+policy IsVisitor
+  require role "Visitor"
+persona Accountant
+  policy IsAccountant
+persona Visitor
+  policy IsVisitor
+module Billing
+  feature Invoices
+    slice StateChange RecordAmount
+      command RecordAmount
+        recordId String identifier
+        amount Int
+        authorize IsAccountant
+        validate
+          require amount > 0
+            message "The amount must be positive"
+        produces AmountRecorded
+          for recordId
+          amount = amount
+      event AmountRecorded
+        amount Int
+      specification RecordingAmounts
+        description "An accountant can record a positive amount"
+        parameter amount Int
+        case Small amount = 10
+        case Large amount = 100
+        given caller as Accountant
+        when RecordAmount amount = case.amount
+          recordId = "amount-1"
+        then AmountRecorded amount = case.amount
+      specification RejectingAmounts
+        parameter amount Int
+        parameter reason String
+        case Zero
+          amount = 0
+          reason = "The amount must be positive"
+        case Negative
+          amount = -1
+          reason = "The amount must be positive"
+        given caller as Accountant
+        when RecordAmount amount = case.amount
+          recordId = "amount-1"
+        then error case.reason
+      specification RefusingAVisitor
+        given caller as Visitor
+        when RecordAmount amount = 10
+          recordId = "amount-1"
+        then denied
+```
+
+Every case assigns every typed parameter exactly once, inline or indented.
+Values are concrete literals or whole single-line objects/lists, never mappings,
+`$` expressions, examples or other case references. `optional` permits `null`,
+not omission or a default; ordinary command/event null restrictions still apply.
+
+`case.<parameter>` fills a whole value position, after example expansion and step
+overrides. It works in step assignments, generated fixtures, query arguments and
+results, `for`, absent read-model keys and scalar `streamId` mappings in a restated
+route. Types must match (concept/underlying primitive in either direction is
+allowed); optional cannot feed required. `then error case.reason` needs String.
+Callers, redelivery locators, clocks, declaration names, step kinds and members
+inside structured literals cannot use case values: pass the whole object/list.
+
+Each case expands independently to `<Specification>_<Case>`, in case order,
+inheriting the description, with the same executable bytes as hand-expanded
+specifications. Derived names must not collide in scope. Failures name the case.
+Selecting a table address in `run-specifications` or `screenplay test --filter`
+selects all cases; a derived address selects one. MCP specification `cases` pages
+effective addresses and values; `find-fixtures` accepts `case` and retains
+`table`, `case`, `caseParameter` provenance. C# singular `Expand` refuses tables
+(PLAY0589); use `SpecificationExamples.ExpandAll`.

package/package/corpus/skills/cratis-screenplay-specifications/verification.json

@@ -41,7 +41,7 @@
     },
     {
       "kind": "skill-contains",
-      "value": "**Authorized commands and queries need `given caller`**"
+      "value": "**Authorized commands and queries need `given caller` or `given caller as <Persona>`**"
     },
     {
       "kind": "skill-contains",

package/package/corpus/skills/cratis-screenplay-streams-and-consistency/SKILL.md

@@ -28,8 +28,8 @@ Require target evidence that the check ran: a concurrent first-append scenario a
 Chronicle, asserting one append wins, one is rejected, and `IAppendResult.ConcurrencyCheckPerformed`
 is `true` (a skipped check and a passing one look identical otherwise; a current client against
 an older kernel always reads `false`). This was source- and documentation-inspected, not
-concurrency-tested here. Stage-rendered apps pin Chronicle client 19.8.1: do not assume these
-APIs exist there; confirm the package version before recommending them.
+concurrency-tested here. Stage 4.51.3 rendered apps pin Chronicle client/kernel 19.32.0
+and Arc 22.50.5; the APIs exist for gap-fill, not as automatically rendered enforcement.
 
 ## Verified product sources
 
@@ -38,7 +38,7 @@ APIs exist there; confirm the package version before recommending them.
 | Screenplay | v4.68.0 (`79801bf`) | ESM v7 generated values (`generated identifier`, decision 0026) and decision 0025's numbering; the diagnostics below were read at v4.66.0 (`c89198b`): `identifier`, `for`, constraints, generations, `id` pins, diagnostics PLAY0019/0135/0268/0271/0273/0391-0393/0446-0449/0469/0471 |
 | Chronicle | v19.32.0 (`f17a2ff`) | CHR0012, CHR0034; open defects #3744, #4123, #4131 |
 | Arc | v22.50.5 | `[ProtectedDecision]` and `DecisionRead<T>` (since v22.39.0) |
-| Stage | v4.24.2 | rendered apps pin Arc 22.25.0 and Chronicle client 19.8.1 (unchanged from 4.24.0); admits ESM v4 but refuses evolved events with `STAGE-ESM-026` (migrations not rendered, Stage#204) |
+| Stage | v4.51.3 | rendered apps pin Arc 22.50.5 and Chronicle client/kernel 19.32.0; protected-read APIs available to gap-fill. Historical 4.24.2 admission probe: ESM v4, evolved events refused with `STAGE-ESM-026` |
 
 Full pin table: `references/versions.md` in `cratis-screenplay-toolchain`. Re-check the three
 Chronicle issues before relying on a constraint in a later release.
@@ -52,13 +52,13 @@ Chronicle issues before relying on a constraint in a later release.
   themselves (`cratis-screenplay-scenario-coverage`), Chronicle C# mechanics
   (`cratis-chronicle-event-modeling`). See Route near misses.
 - Model-first applies: when an accepted model covers the scope, change the model and its
-  specifications, not code. Do not weaken authorization, `@pii` or rules to make a model compile.
+  specifications, not code. Do not weaken authorization, `pii` or rules to make a model compile.
 
 ## Interview phase
 **Skip if** the user or the model already states the stream identities, who owns each module, how
 much autonomy each side has, the external systems, and rough growth. Otherwise ask only what is
 missing, one question at a time, with options. **Unattended:** assume the most conservative
-option, mark it `ASSUMED` in the slice or module `description` and in the session `STATE.md`
+option, mark it `ASSUMED` in the slice or module `documentation` and in the session `STATE.md`
 (`.ai-work/screenplay/<model-slug>/STATE.md`), and continue.
 
 1. **Instance.** "What is the real-world thing this stream is about, and when does it start and
@@ -103,8 +103,8 @@ option, mark it `ASSUMED` in the slice or module `description` and in the sessio
      `unique event`, `released by`); list every event that sets the claimed value;
    - a state-dependent rule not reducible to those: write `reads <View>` + `require <expr>
      message "..."` as stated intent (PLAY0268/0271 at binding are expected in design mode) and
-     mark it **NOT enforced in the model today** in the slice `description`, with requirement,
-     missing guarantee, race consequence and the named target enforcement. Add a `STATE.md` row
+     mark it **NOT enforced in the model today** in the slice `description` with the named target,
+     and record requirement, missing guarantee and race consequence in the slice `documentation`. Add a `STATE.md` row
      with an owner. A general "some rules are unsupported" note is not enough.
    - Forbidden: a caller-supplied copy of state in `require`, a boolean attestation input
      (`confirmsX == true`) standing in for a rule, and rules hidden in `handler` or
@@ -118,9 +118,14 @@ option, mark it `ASSUMED` in the slice or module `description` and in the sessio
 4. **Set granularity.** One decision usually records one event; several facts are fine when each
    is a fact the business recognises. Different meanings get different events, not a flag with
    nullable siblings. Event properties are required by default (CHR0012, PLAY0350): an optional
-   detail is a separate event, and any deviation is justified in the description. One data
-   subject per event and stream; never personal data, a secret, or a `@pii` or `@sensitive` concept as the identifier (CHR0034, CHR0052):
-   use a surrogate `Uuid` and a `@pii` or `@sensitive` property.
+   detail is a separate event, and any deviation is justified in the event's `documentation`. One data
+   subject per event; never personal data, a secret, or a `pii`/`secret` concept as
+   identifier or subject (CHR0034, CHR0052, PLAY0515/0592). Use a surrogate identity
+   and protected payload. A stream identity and an event's data subject may differ:
+   trailing event-property `subject` records that lineage but is report-only
+   (PLAY0270), not runtime propagation or generated C# `[Subject]`. Without a
+   supplied subject, the runtime defaults to the event source; see command-surface
+   `references/compliance.md` for allowed types and the policy/encryption distinction.
 5. **Plan evolution** with `references/evolution.md`: classify each event change (additive,
    meaning change, rename, removal, split or merge) and write its compatibility scenarios before
    editing. Renames and other identity-affecting edits are made by the identity owner (the
@@ -129,7 +134,7 @@ option, mark it `ASSUMED` in the slice or module `description` and in the sessio
    interface and processor inventory, one real interaction walked across each boundary, coupling
    check. Keep team, module, stream and deployment boundaries distinct; inbound facts via
    Translate; unresolved decisions stay visible.
-7. **Record and gate.** Durable rationale in feature and slice `description`; open consistency
+7. **Record and gate.** Durable rationale in feature and slice `documentation`; open consistency
    decisions and capability gaps in `STATE.md`. Then the gate below.
 
 ## Rules
@@ -148,13 +153,23 @@ option, mark it `ASSUMED` in the slice or module `description` and in the sessio
   block compiles but is PLAY0271 at binding. Keep both when they state real intent; they are not
   protection. `description` text never reaches rendered code: a rule that lives only in prose is
   unenforced there.
-- `@pii` and `@sensitive` block binding (PLAY0268). Never remove them to pass a tool.
+- `pii` and `secret` block binding (PLAY0268); legacy markers are deprecated
+  (PLAY0565). Never remove protection to pass a tool. PLAY0515 also refuses
+  scalar/composite stream-id types and route mapping sources, including nested paths.
+- At 4.127.0 stream-id literals must be nonempty, well-formed NFC text (refused,
+  not normalized); integer ids in Double mode stay within ±(2^53−1). Exact mode
+  has no such bound but is unadmitted. PLAY0504 is an error for route/destination
+  nominal type mismatch. Composite ids use at least two named scalar parts,
+  complete named mappings and canonical comparison, not guessed legacy splits.
+  Stored key-schema changes require a new stream identity or migration; see
+  toolchain `references/sources-and-streams.md`.
 - Chronicle (open at v19.32.0): the SQL and InMemory providers do not settle unique claims
   (#3744); index updates run after commit and may fail silently (#4123); composite values can
   collide on the separator (#4131). A declared constraint is a declaration, not a runtime test.
-- `[ProtectedDecision]` is available in Arc v22.39.0 or later, **not** in Stage-rendered apps
-  (Arc 22.25.0). In a rendered app, record the rule as NOT enforced and choose the stream or
-  identity redesign (`references/consistency-and-concurrency.md`, section 3).
+- `[ProtectedDecision]` is available in Arc v22.39.0 or later, including Stage 4.51.3's
+  rendered package set. It is not emitted protection: gap-fill must enroll an admitted
+  decision read, or redesign the stream/identity when the shape is refused
+  (`references/consistency-and-concurrency.md`, section 3).
 
 **Modeling defaults** (deviate with a recorded reason)
 - One business identity per stream; cross-stream references are payload properties.
@@ -190,8 +205,8 @@ option, mark it `ASSUMED` in the slice or module `description` and in the sessio
 Do not report done until all hold; otherwise report what is open:
 - Every identifier has its identity sentence, the event-membership table and a justified decision.
 - Every rule has an invariant-table row with an exact construct or limitation reference.
-- Every `recorded` rule is in its slice `description` and `STATE.md` with requirement, missing
-  guarantee, race consequence and intended enforcement owner.
+- Every `recorded` rule has its NOT-enforced marker in the slice `description`, and its requirement,
+  missing guarantee, race consequence and intended enforcement owner in the slice `documentation` and `STATE.md`.
 - Every changed event has compatibility scenarios; identity changes were made by the identity owner.
 - Every changed boundary has a named owner (or `ASSUMED`), callers, processors and contracts.
 - Verdicts are stated V1-V5 per `cratis-screenplay-modeling-lifecycle`, each a result or "not run".