@cratis/pi 7.22.0 → 7.24.0

package/package/corpus/skills/cratis-screenplay-streams-and-consistency/references/boundaries.md

@@ -33,7 +33,7 @@ exchange does not make that decision atomic.
 Run it when ownership, autonomy or integration decisions are missing; skip it when the user or
 the model already states all three. Ask one question at a time, offer the options, and follow
 the trigger. Unattended: assume the most conservative option, mark it `ASSUMED` in the slice or
-module `description` and in `STATE.md`.
+module `description`, give the reason in its `documentation`, and add it to `STATE.md`.
 
 | # | Question (options) | Decides | Follow-up trigger |
 |---|---|---|---|
@@ -88,7 +88,7 @@ Processors: <trigger -> decision/effect -> result; operational owner>
 External: <system -> adapter owner -> contract>
 Open: <unresolved decisions, each also in STATE.md>
 ```
-Keep durable rationale in module, feature and slice descriptions and the record's `Open` lines in
+Keep durable rationale in module, feature and slice `documentation` and the record's `Open` lines in
 `STATE.md`. Do not build a second catalogue that duplicates the model.
 
 ## Cross-boundary walkthrough
@@ -137,7 +137,7 @@ integration support.
 - Treat a public event like a published API: evolution follows `evolution.md` with the
   consumers named, and breaking changes become new events.
 - Screenplay has no public/internal marker. Record the classification in the event's
-  `description`, and keep the list in `STATE.md`.
+  `documentation`, and keep the list in `STATE.md`.
 
 ## Crossing a boundary in Screenplay
 | Situation | Construct |

package/package/corpus/skills/cratis-screenplay-streams-and-consistency/references/chronicle-boundaries.md

@@ -10,8 +10,9 @@ event-source id) are present. Three runtime defects are **open at v19.32.0**: #3
 InMemory providers do not settle unique claims), #4123 (constraint index updates run after commit
 and fail silently) and #4131 (composite unique constraints collide when a component contains the
 separator). Arc **v22.50.5** has `[ProtectedDecision]` (since v22.39.0, needs Chronicle 19.23 or
-later); Stage-rendered apps pin Arc 22.25.0 and Chronicle client 19.8.1, so it is not available
-there (see `consistency-and-concurrency.md` section 3). Re-check the issues before relying on a
+later); Stage 4.51.3 rendered apps pin Arc 22.50.5 and Chronicle client/kernel
+19.32.0, so the APIs are available to gap-fill, not automatically emitted or
+protected (see `consistency-and-concurrency.md` section 3). Re-check the issues before relying on a
 constraint in a new release.
 A concurrency scope's first append is unchecked by default at v19.32.0; see
 SKILL.md, ‘First append into a scope’.
@@ -42,10 +43,14 @@ protection: keep the invariant and its race outcome as explicit target requireme
 A namespace scopes event positions, claims, observer progress and encryption keys. State
 whether uniqueness and completion are per tenant or genuinely cross-tenant.
 
-Decide the data subject before the event and view shape. One data subject per event and per
-stream; one per read-model instance. Never put PII on the event-source id and never mark the
-identifier's concept `@pii` or `@sensitive`: Chronicle cannot encrypt a source id (analyzers CHR0034 and CHR0052; Screenplay PLAY0515 reports it from 4.69.1 for `@pii` and 4.84.1 for `@sensitive`, not on the pinned tools). Use a surrogate `Uuid`
-identity and carry the value as a `@pii` property (personal data) or a `@sensitive` property (operational secret). Bearer tokens, magic links and
+Decide the data subject before the event/view shape: one person per event or
+read-model instance, not necessarily the stream's identity. At Screenplay 4.127.0
+trailing event `subject` is report-only lineage, not runtime propagation or C#
+`[Subject]`; read-model marks remain unsupported. Use bare `pii` for personal
+values and `secret` for operational secrets on concepts, never on identities or
+subjects. Current PLAY0515 is a source error, including destinations, stream-id
+parts and nested route sources (Chronicle CHR0034/0052 likewise reject protected
+source ids). Use a surrogate identity and protected payload. Bearer tokens, magic links and
 signed URLs are never facts; record a keyed hash or a reference.
 
 Redaction (payload replacement keeping the sequence slot) and crypto-erasure serve compliance

package/package/corpus/skills/cratis-screenplay-streams-and-consistency/references/consistency-and-concurrency.md

@@ -16,6 +16,16 @@
 Pins: Screenplay v4.66.0, Chronicle v19.32.0, Arc v22.50.5, Stage v4.24.2 (table in `versions.md` of
 `cratis-screenplay-toolchain`).
 
+Current routing identity checks (4.127.0): PLAY0515 refuses personal/secret
+concepts in stream-id types, composite parts and route sources, including nested
+paths. Composite keys require every named scalar part, not a legacy separator
+split. Text must be well-formed, nonempty NFC and Double integer ids bounded by
+±(2^53−1); PLAY0504 is an error for routed nominal destination-type mismatch.
+Canonical specification comparisons preserve part order and treat UUID case
+variants as equal. Key-schema evolution for stored events requires a new stream
+identity or migration. These checks do not protect command decision reads.
+Details: toolchain `references/sources-and-streams.md`.
+
 ## 1. Invariant table (fill before writing constraints)
 | # | Rule (business words) | Data it needs | Decided atomically where | Screenplay construct | Status | Race / retry outcome |
 |---|---|---|---|---|---|---|
@@ -61,7 +71,8 @@ Right: write the rule as stated intent and mark it unenforced.
 - `reads <View> as x by …` plus `require <expr over x> message "…"` on the command (the
   `StateChange` slice in `streams-example.md`). Binding reports PLAY0271 / PLAY0268; that is
   expected in design mode, so keep the lines. Do not remove them to pass a tool.
-- Slice `description`, one block per rule:
+- Slice `description`: one short marker per rule, `NOT enforced in the model today; target: <mechanism>`.
+- Slice fenced `documentation`, one block per rule:
   - Requirement: the business rule in business words.
   - Status: NOT enforced in the model today (Screenplay#129, #209).
   - Decision inputs: the authoritative facts or state.
@@ -98,15 +109,17 @@ example a course capacity computed from enrolment streams, needs option a or b:
 deciding fact on the source that owns the state, or give each scarce item its own identity. Sources: Arc `v22.50.5:Documentation/backend/csharp/chronicle/read-models/injecting-into-commands.md`;
 `chronicle-boundaries.md`.
 
-**Availability caveat for Stage-rendered applications.** `cratis render` scaffolds Arc 22.25.0 and
-Chronicle client 19.8.1 (Stage v4.24.0), which predate `[ProtectedDecision]` and `DecisionRead<T>`.
-In a rendered app that attribute is not available, so a gap-fill handler cannot use it unless the
-application's Arc and Chronicle packages are upgraded as a separately approved change. When they
-are not, choose option a or b (put the deciding fact on the stream that owns the state, or give
-each scarce item its own identity and claim it with a constraint), or option c, and keep the rule
-**NOT enforced in the model today** in the slice description with the race consequence. Never
-claim protection for a rendered app because the rule is written as `reads` + `require`, and never
-weaken the rule to make it render.
+**Availability in Stage-rendered applications.** Stage v4.51.3 scaffolds Arc 22.50.5
+and Chronicle client/kernel 19.32.0. `[ProtectedDecision]` and `DecisionRead<T>` /
+`IDecisionReads` exist in that package set; source checks are in
+`cratis-stage-rendering-and-sandbox` `references/rendered-application.md`.
+This does not mean Stage emits protected decisions. Gap-fill must opt into the
+protected command profile, use an admitted projection/key shape and enroll the
+read in the active unit of work. For refused shapes choose option a/b (state on
+its owning stream or one identity per scarce item), or agreed compensation c.
+Keep the rule **NOT enforced in the model today** with its race consequence.
+Never infer protection from `.play` `reads` + `require`, weaken the rule to render,
+or edit managed dependency files. Older Stage 4.24.x scaffolds predate these APIs.
 
 ## 4. Concurrency scenarios
 For each enforced or recorded rule write three short scenarios:
@@ -143,7 +156,7 @@ The append may commit while the reply is lost. The caller retries. Decide per co
   rejection the caller must see; never report it as success;
 - **new identifier** -> duplicate unless a business-key constraint exists.
 The model shows only the rejection; payload comparison and outcome replay are target
-behaviour. Write the answer in the slice `description`.
+behaviour. Write the answer in the slice `documentation`.
 
 ## 7. Ordering
 - Within one source, facts are in append order. Across sources, do not assume an order

package/package/corpus/skills/cratis-screenplay-streams-and-consistency/references/evolution.md

@@ -16,7 +16,7 @@ compatibility scenarios below first; the identity owner then applies the change
 
 | Change | Old facts still mean the same? | Screenplay action | Edit class |
 |---|---|---|---|
-| add a property with a business-defined value for old facts | yes | new `generation N+1`, every generation declared in full in the same slice; record the default for old facts in the slice `description` | contract evolution |
+| add a property with a business-defined value for old facts | yes | new `generation N+1`, every generation declared in full in the same slice; record the default and its reason for old facts in slice `documentation` | contract evolution |
 | add a property with no sensible old value | the old fact lacks information | usually a **new event** for the new situation, or a separate fact recording the extra information | review with the expert |
 | remove a property | yes, if no reader needs it | new generation without it; every reference fails with PLAY0273 until removed | contract evolution, check readers |
 | change meaning (same name, different business fact) | **no** | **new event** with its own name; old event stays for history | identity: add, not rename |
@@ -28,7 +28,7 @@ A test for "generation or new event": a new version must be convertible from the
 without inventing facts. If it is not, it is a different event.
 
 ## Compatibility scenarios (write before editing)
-For each changed event, answer in the slice `description` or `STATE.md`:
+For each changed event, answer in the slice `documentation` or `STATE.md`:
 1. **Replay**: does every projection still build from generation 1 facts? Which value do old
    facts give the new property (default, absent, derived)?
 2. **Readers**: which projections, reactions, constraints, specifications and other modules

package/package/corpus/skills/cratis-screenplay-streams-and-consistency/references/stream-patterns.md

@@ -20,6 +20,15 @@ A stream in Screenplay is the event source a production lands on: `identifier` o
 command, `for <identifier>` on each `produces`, `$eventSourceId` in projections, `for "<id>"`
 in specifications. Choosing the identifier *is* choosing the stream.
 
+Composite stream keys (Screenplay 4.127.0) declare `streamId` with two or more
+named scalar parts and map every part on routes (specification parts are literals).
+Scalar forms remain valid. Text is nonempty, well-formed NFC; Double integer ids
+stay within ±(2^53−1). Protected concepts cannot be key types/parts or mapping
+sources (PLAY0515); choose surrogate keys and keep protection in payloads.
+Canonical encoding formats parts, escapes `%`/`|`, and joins in declaration order;
+never split hand-joined legacy text by guesswork. A stored key-schema change needs
+a new stream identity or migration. See toolchain `references/sources-and-streams.md`.
+
 ## Identity and event-membership review
 Start from the business instance, then choose its representation. A generated id can name a
 real instance; a readable constant can hide a collection. Write one sentence per identity

package/package/corpus/skills/cratis-screenplay-streams-and-consistency/references/streams-example.md

@@ -5,7 +5,7 @@ cross-stream references as payload, three kinds of uniqueness constraint, a stat
 rule recorded as **NOT enforced in the model today**, a declared `concurrency` scope, and an
 active-state view with removal. Read it with `consistency-and-concurrency.md` (sections 1-4).
 
-The model compiles (V1, warnings as errors) but is not binding-ready by design: the `@pii`
+The model compiles at 4.127.0 (V1, warnings as errors) but is not binding-ready by design: the `pii`
 concept fails binding (PLAY0268), `reads` and the `concurrency` block are PLAY0271, and
 `require` over a view is PLAY0268. Keep those lines: they state real intent.
 
@@ -14,7 +14,7 @@ concept fails binding (PLAY0268), `reads` and the `concurrency` block are PLAY02
 // Shows: one business identity per stream, cross-stream references as payload, uniqueness
 // constraints (single, composite with release, unique event), a recorded state-dependent rule
 // that Screenplay cannot enforce, a declared concurrency scope, and an active-state view with removal.
-// Not executable on either tool (probed): the @pii concept fails binding (PLAY0268), the
+// Historical binding probes refused compliance; the pii concept still fails binding (PLAY0268), the
 // concurrency block and `reads` are PLAY0271, `require` over a view is PLAY0268. Keep them: they state
 // real intent. The capacity rule is NOT enforced in the model today (see the slice description).
 
@@ -23,7 +23,7 @@ domain Acme.Academy
 concept MemberId : Uuid                    // event source id of one member stream
 concept CourseId : Uuid                    // event source id of one course stream
 concept EnrolmentId : Uuid                 // event source id of one enrolment stream
-concept Email : String @pii
+concept Email : String pii
   pii reason "Identifies a person"
   validate
     not empty  message "An email is required"

package/package/corpus/skills/cratis-screenplay-toolchain/SKILL.md

@@ -22,7 +22,7 @@ files is one application: always check the folder, never one file of it.
 
 When choosing or upgrading a tool, or checking version-specific capabilities, read `references/versions.md`; it is the only version table, and other skills point to it.
 
-The standalone pin is Screenplay 4.125.0. CLI 3.41.0 bundles Screenplay 4.114.0,
+The standalone pin is Screenplay 4.127.0. CLI 3.41.0 bundles Screenplay 4.114.0,
 Stage 4.51.3 and Cratis.Arc.Screenplay 22.54.0. The single version table records
 released source evidence and historical probes separately; do not relabel an old
 render/browser result as a probe of the current packages.
@@ -31,7 +31,7 @@ Historical screens-release evidence: CLI 3.40.7 / Stage 4.51.1 / bundled
 Screenplay 4.114.0 opened the canonical corpus with `executableReady true`
 and the stdio transcript exposed 37 tools; standalone language 4.122.0 was
 recorded in that vector. These retained results are not a rerun on CLI 3.41.0
-or Screenplay 4.125.0.
+or Screenplay 4.127.0.
 
 ## Ground rules
 
@@ -49,7 +49,7 @@ or Screenplay 4.125.0.
 5. **Capability is not correctness.** The tool you ran decides what is accepted today; the
    domain and the documented semantics decide what is correct. On conflict keep the correct
    model and record a tool gap; never reshape a model to silence a tool.
-6. **Never remove `@pii`, `@sensitive`, authorization, list queries, automations or rules
+6. **Never remove `pii`, `secret`, authorization, list queries, automations or rules
    to reach V3 or a render.** Report the verdict as blocked with the codes.
 7. **A clean verdict proves only its own layer.** "Not run" with the reason is a valid
    result. Specifications written or bound are never specifications passing.
@@ -90,7 +90,7 @@ server with a fixed root when the tool is older than 4.63.2 (the roots bug hit 4
 4.60.1 bundled by cratis before 3.28.2; 4.66.0 and later and cratis 3.28.2 are fine). A subagent without MCP reports "V2 not run: no MCP in this agent".
 
 One line per verdict, tool first, for example `V1 pass (screenplay 4.68.0, 3 files)` and
-`V3 blocked: PLAY0268 x3 (list query, @pii)`. Name the source identity (commit plus the digest from
+`V3 blocked: PLAY0268 x3 (list query, pii)`. Name the source identity (commit plus the digest from
 the source-identity helper (`cratis-screenplay-modeling-lifecycle` `references/verdicts-and-modes.md` "Source identity")) the verdict ran on; keep it apart from the MCP
 `modelRevision`, which is semantic and, without `.screenplay/identities.json`,
 changes with the root folder name.
@@ -101,7 +101,7 @@ changes with the root folder name.
   `references/cheat-sheet.md`. Read [references/cheat-sheet-example.md](references/cheat-sheet-example.md) when you need one complete design-mode document with every construct family.
 - **Executable** (binds, V3): `references/executable-subset.md`. Keyed optional queries
   only; no handler (PLAY0268, with or without `implementation`/`hint`); `reads` and
-  `concurrency` do not bind (PLAY0271); no `@pii`; v6 constructs bind on Screenplay 4.61 or
+  `concurrency` do not bind (PLAY0271); no compliance markers (`pii`/`secret`); v6 constructs bind on Screenplay 4.61 or
   later (standalone, and cratis 3.28.2 or later); generated values and `returns` responses bind (ESM v7)
   from Screenplay 4.68.0 (also in the current CLI bundle) (`references/generated-responses-example.md`). Read [references/executable-example.md](references/executable-example.md) when you need a small StateChange and StateView model that binds executable, [references/pdl-example.md](references/pdl-example.md) when writing projection forms that bind and run, and [references/automation-translate-example.md](references/automation-translate-example.md) when writing Automation and Translate slices (ESM v6).
 - **Renderable** (V5): `references/renderable-subset.md` retains explicitly labeled
@@ -112,6 +112,13 @@ changes with the root folder name.
   render refuses versions above v7 (`CLI-RENDER-004`). Operations and exact numeric
   mode remain authorable/unadmitted. Details: `references/sources-and-streams.md`.
 
+- **Caller/compliance metadata** at 4.127.0: `$identity` aliases caller built-ins;
+  additional identity details are metadata and executable reads still refuse.
+  Bare `pii`/`secret` replace legacy spellings; `pii personal` repeats one marker
+  (PLAY0653). Purposes/checks/processing records and event `subject` are report-only,
+  not legal compliance, retention or runtime subject realization. See
+  command-surface `references/context.md` and `references/compliance.md`.
+
 ## Edit strategy
 
 - **Discover the capabilities available** (tool, version, `tools/list`, model root) once,

package/package/corpus/skills/cratis-screenplay-toolchain/references/cheat-sheet-example.md

@@ -2,7 +2,7 @@
 
 One complete document with every construct family. Design mode, not executable. Prose rules: [cheat-sheet.md](cheat-sheet.md); tool versions: [versions.md](versions.md); what binds: [executable-subset.md](executable-subset.md).
 
-Blocking on every compiler: unquoted import, `@pii`, `reads` (PLAY0271), `starts with`, observable/list/filter query. Executable shapes are in the sibling examples. The fence compiles warning-free on the standalone 4.66.0 tool and on `cratis screenplay validate` 3.28.2. `RecordingAPayment` lists the `InvoiceClosed` cascade, which the cratis 3.27.1 bundle (4.60.1) rejected with a false PLAY0285 ("outcome cannot be produced by 'RecordPayment'"); 3.28.2 accepts it.
+Binding blockers: unquoted import, `pii`, `reads` (PLAY0271), `starts with`, observable/list/filter query. Executable shapes are in the sibling examples. The bare-marker fence compiles warning-free on standalone 4.127.0; the earlier legacy-marker version compiled on 4.66.0 and CLI 3.28.2. `RecordingAPayment` lists the `InvoiceClosed` cascade, which the cratis 3.27.1 bundle (4.60.1) rejected with a false PLAY0285 ("outcome cannot be produced by 'RecordPayment'"); 3.28.2 accepts it.
 
 ```screenplay
 // Design-mode cheat-sheet: every construct family; compiles warning-free on the standalone tool.
@@ -12,7 +12,7 @@ import Customers.CustomerRegistered        // unquoted = another bounded context
 
 concept InvoiceId : Uuid                   // primitives: Uuid String Int Decimal Bool Date DateTime Enum
 concept PaymentId : Uuid
-concept Email : String @pii                // @pii / @sensitive (blocks executability today)
+concept Email : String pii                 // pii / secret (blocks executability)
   pii reason "Identifies a person"
   validate
     not empty  message "An email is required"

package/package/corpus/skills/cratis-screenplay-toolchain/references/cheat-sheet.md

@@ -12,7 +12,7 @@
 - PDL quick reference (most forms are compiled in `pdl-example.md` or `cheat-sheet-example.md`; `remove via join` and `$eventContext.occurred` are not)
 - Specification forms
 
-Current pins: standalone Screenplay 4.125.0 / CLI 3.41.0; `versions.md` is the
+Current pins: standalone Screenplay 4.127.0 / CLI 3.41.0; `versions.md` is the
 single table. Compile evidence below keeps its historical tool labels.
 
 The syntax lives in compiled example files next to this one (each is a Markdown file holding
@@ -105,6 +105,17 @@ a reference scenario that supplies only a clock carries no caller audit identity
 reference runner before relying on identity paths in a specification. Renderable:
 `$context.occurred` only.
 
+At 4.127.0, `$identity.id`/`.name`/`.userName` map to the same ESM kinds as
+`$context.identity`; prefer the shorter root, but the older one stays supported.
+Other built-ins parse but roles/claims/authentication status do not bind in
+produces mappings. Identity details are metadata: executable detail reads report
+PLAY0268. See command-surface `references/context.md`.
+
+Use bare `pii`/`secret` on concepts (`personal` aliases `pii`); legacy markers
+are PLAY0565 information and repeated markers are PLAY0653 warning. Event `subject`
+is report-only lineage; processing purposes/checks/reports declare use, not lawful
+processing or runtime retention. See command-surface `references/compliance.md`.
+
 ## `$eventContext.` (projections)
 `eventType{.id,.generation,.tombstone}`, `eventSourceType`, `eventSourceId`, `eventStreamType`,
 `eventStreamId`, `sequenceNumber`, `occurred`, `occurred.Week`, `eventStore`, `namespace`,

package/package/corpus/skills/cratis-screenplay-toolchain/references/diagnostics.md

@@ -4,6 +4,9 @@
 
 - Warnings that hide defects (always validate with `--warnings-as-errors`)
 - Source reference and identifier checks
+- Caller identity, compliance and routes
+- Specification metadata, callers, cases and locators
+- Guarded interaction diagnostics
 - Structural completeness and timeline checks
 - Editor versus C# verdicts
 - Consistency errors (V1: the model contradicts itself)
@@ -36,7 +39,7 @@ then STAGE (V5 admission). Tool differences: `versions.md`.
 
 ## Source reference and identifier checks
 
-At Screenplay 4.125.0 these are V1 source checks, not binding-only gaps:
+At Screenplay 4.127.0 these are V1 source checks, not binding-only gaps:
 
 | Code | Severity | Meaning |
 | --- | --- | --- |
@@ -46,6 +49,116 @@ At Screenplay 4.125.0 these are V1 source checks, not binding-only gaps:
 
 Legacy compliance spellings (`@pii`/`@sensitive`) do not evade PLAY0515.
 
+## Caller identity, compliance and routes
+
+Source authority: v4.127.0 `diagnostics.md`, `identity.md`, `concepts.md`,
+`purposes.md`, `events.md`, `event-sources.md`, `reactions.md`.
+
+| Code | Severity | Meaning / fix |
+| --- | --- | --- |
+| PLAY0152 | E | Bare `$identity` needs a property path |
+| PLAY0155 | W | A `$identity` or `$context.identity` path names a property the caller does not carry; correct the built-in/detail name (claims suffixes are opaque) |
+| PLAY0633 | E | Invalid identity header; write bare `identity` |
+| PLAY0634 | E | Second identity block in one document; a second file uses the folder singular-declaration diagnostic |
+| PLAY0635 | E | Invalid typed detail or escape source; exactly one source per detail |
+| PLAY0636 | E | Unknown source kind; use claim, query, inline code or file |
+| PLAY0637 | E | Detail has no source/implementation |
+| PLAY0638 | E | Claim/query source has a body; refresh/cache belongs to runtime |
+| PLAY0639 | E | Duplicate detail name |
+| PLAY0640 | E | Detail redeclares a token built-in |
+| PLAY0641 | E | Unknown/ambiguous source query |
+| PLAY0642 | E | Source query is unkeyed or returns a list |
+| PLAY0643 | E | Query source lacks `by <expression>` |
+| PLAY0644 | E | Query key reads more than built-ins, claims or literals |
+| PLAY0645 | E | Source query's effective gate depends on details |
+| PLAY0646 | E | Result type/optionality differs from detail; optional result needs optional detail |
+| PLAY0565 | I | Deprecated `@pii`, `sensitive`, `@sensitive`; repair to bare `pii`/`secret`, preserving notes/trivia |
+| PLAY0566 | E | Unknown concept marker |
+| PLAY0567/0568 | E | Invalid secret scope / repeated scope |
+| PLAY0569 | W | Explicit secret scope ignored on `pii secret` because only `[PII]` renders |
+| PLAY0570/0571 | E | Invalid personal-data qualifier/category / repeated special category |
+| PLAY0653 | W | Repeated concept-header compliance marker; `pii personal` is one marker repeated. Keep the first; body settings stay attached; canonical printing writes one marker |
+| PLAY0590 | E | More than one event subject; choose one, no safe automatic repair |
+| PLAY0591 | E | Subject not required scalar String/Uuid or a String/Uuid/Int-backed concept |
+| PLAY0592 | E | Protected subject concept; EventContext.Subject is plaintext, use a surrogate |
+| PLAY0593 | E | Subject modifier outside event properties |
+| PLAY0594 | E | Read-model subject mark is unsupported |
+| PLAY0595 | E | Repeated/out-of-order subject modifier; write it last |
+| PLAY0596/0597/0598/0599 | E | Malformed purpose declaration/reference/field; unknown closed value; repeated singleton; duplicate purpose name, respectively |
+| PLAY0600/0601 | W | Unknown purpose reference / inconsistent legitimate-interest declaration |
+| PLAY0602–0606 | W | Opt-in purposes coverage: uncovered pii, missing Art. 9 condition, Art. 10 authorization, basis, or unused purpose |
+| PLAY0647 | E | Malformed/repeated/misplaced `runs as`, empty/duplicate role; one reaction-level line with quoted roles (zero allowed) |
+| PLAY0648 | W | Gated invocation without declared identity; an authorization refusal branch gets PLAY0557 instead, once per invocation |
+| PLAY0649 | W | Identity declared without invokes or inline/file implementation |
+| PLAY0650 | W | C# bound-gate check: role needed by no invocation; opaque gates/implementation bodies suppress it |
+| PLAY0651 | W | C# bound-gate check: declared actor definitely cannot satisfy gate; unknown is not denial |
+| PLAY0652 | W/I | Opt-in `privilege`: trigger producer lacks every declared actor role (W), or has opaque gates that cannot be compared (I); clock/application triggers are silent |
+| PLAY0504 | E | Missing/ambiguous stream, invalid/mismatched route parts, nominal source identifier/destination type mismatch or invalid stream-id literal; never a warning |
+| PLAY0549 | E | Invalid specification route/mapping, including invalid stream-id literals |
+
+Stream-id text must be nonempty, well-formed Unicode NFC: refuse, never normalize.
+Integer ids in Double mode are within ±9007199254740991; Exact mode has no such
+bound but remains unadmitted. Specification contradictions compare canonical ids,
+so UUID casing does not distinguish routes. Composite encoding is ordered and
+escapes `%`/`|`, not an inferred split of legacy text.
+
+Identity declarations and event `subject` are metadata; reading a declared
+`$identity` detail in executable clauses is PLAY0268. `runs as` is admitted as
+ESM v10 in the current standalone, not a current PLAY0268 gap. Compliance markers
+still block binding; purpose metadata is PLAY0270. See command-surface
+`references/compliance.md` and `references/context.md` for syntax and limits.
+
+`screenplay_repair_capabilities` and `propose-repair` advertise PLAY0653: a
+concept-subject, line-only `PreserveTrivia` repair, no document-root or pinned
+repair evidence. PLAY0565 supports one discovered `line` or a document-root
+migration. Preview every repair; legal notes never move automatically.
+
+## Specification metadata, callers, cases and locators
+
+Authority: Screenplay v4.127.0 `diagnostics.md`, `specifications.md`, `slices.md`.
+
+| Code | Severity | Meaning / fix |
+| --- | --- | --- |
+| PLAY0558 | E | Module/feature/slice/command/read-model/reaction documentation must be one nonempty fenced Markdown block; remove repeats or fix the fence. Events retain PLAY0477. |
+| PLAY0559 | W | Conflicting module/feature documentation across files; first wins. Choose one owning text; identical copies are accepted. |
+| PLAY0572 | E | Malformed/unknown persona caller or body lines; use a declared top-level persona with no body. |
+| PLAY0573 | E (binding) | Persona synthesis refused (no policies, negation, required non-literal/role-URI claim, opaque or unresolved policy); inspect persona/policy/reason and use explicit `given caller`. |
+| PLAY0574 | W | Opt-in `personas`: persona gates nothing. |
+| PLAY0575 | W | Opt-in `personas`: gate denies every synthesized persona; unknown is not denial. |
+| PLAY0576 | I | Opt-in `personas`: multiple unpinned buildable `or` alternatives; inspect chosen witness or pin a policy. |
+| PLAY0577/0578 | E | Malformed parameter/case header; typed parameter has no body/default, case has a name and at most one inline assignment. |
+| PLAY0579/0580 | E | Duplicate parameter/case name. |
+| PLAY0581/0582 | E | Need parameters and cases; every case assigns each parameter exactly once, no extra names. |
+| PLAY0583 | E | Case value is not concrete or cannot normalize to its type. |
+| PLAY0584 | E | Unknown parameter or excluded reference position (callers/redelivery locators/clocks/names/nested literal members). |
+| PLAY0585 | E | Optional parameter feeds required target. |
+| PLAY0586 | E | Derived `<Specification>_<Case>` collides in scope. |
+| PLAY0587 | E | Unknown or incompatible parameter/target type. |
+| PLAY0588 | W | Unused parameter; remove it or use it intentionally. |
+| PLAY0589 | E | Singular effective expansion cannot handle a table; use `ExpandAll`. |
+| PLAY0526 | E | Route in command/read-model example; only event examples carry routes. Top-level `streamId = value` is payload. |
+| PLAY0543 | E | Malformed redelivery or not exactly one definite match with no undecided candidate; narrow `for`, values, `stream` or `no stream`. |
+| PLAY0548 | E | Route on `when <Command>` only; put it on the command declaration. Does not fire on redelivery locators. |
+
+Descriptions/documentation are report-only PLAY0270, not executable conditions.
+Case tables and persona callers expand before binding without a new ESM version.
+Routes do not make redelivery executable: it still reports PLAY0268.
+
+## Guarded interaction diagnostics
+
+| Code | Severity | Meaning / fix |
+| --- | --- | --- |
+| PLAY0560 | E | Alternatives on a non-item trigger; only click/double click/select admit them. |
+| PLAY0561 | E | Alternatives mixed with plain actions or `where`; choose one form. |
+| PLAY0562 | E | Empty branch; supply a nonempty action list. |
+| PLAY0563 | E | One-line labeled-action `when … execute …` in an interaction; use an indented list. C# offers a typed repair. |
+| PLAY0564 | W/I | Item-trigger opaque `where` deprecated: a strict item condition warns with a C# repair to one `when`, no fallback; other text is information with no repair. Other triggers unchanged. |
+
+PLAY0563/0564 repairs need individual review and canonical formatting, refuse
+comment loss and do not support pinned evidence. TypeScript diagnoses but does
+not offer these repairs. Preview through MCP `propose-repair`, never text-patch
+around a refusal. Condition/subject errors also use guarded-action PLAY0341–0348.
+
 ## Structural completeness and timeline checks
 
 Opt in with `--check <names>` or MCP diagnostics `checks`, then treat warnings
@@ -59,6 +172,9 @@ as errors if gating. Ordinary compile success does not imply these ran:
 | query-keys | PLAY0535 | Query argument not representable by known identity/fields |
 | event-consumers | PLAY0536 | Latest local event generation lacks an operational consumer; a terminal fact can legitimately be reported |
 | navigation | PLAY0537 | Unreachable screens; unreachable cycles do not establish an entry point |
+| privilege | PLAY0652 | Elevated event-trigger producers must require every actor role; opaque gates are information, clock/application triggers exempt |
+| purposes | PLAY0602–0606 | Personal-data coverage, special/criminal safeguards, basis and unused-purpose prompts; union of ancestor/direct references |
+| personas | PLAY0574–0576 | Unused personas, unreachable gates and ambiguous buildable policy alternatives; unsynthesizable/undecidable is unknown |
 
 Whole-source errors skip completeness checks. Unknown/opaque coverage is not
 invented: report skipped status/coverage and walk field lineage manually.
@@ -75,15 +191,18 @@ before a retained glob; cycles and own-sub-feature findings have no repair.
 
 Monaco/VS Code use the TypeScript syntax/authoring compiler. They share projection
 and protected-identifier checks (PLAY0514/0515), typed-example syntax (0518/0519),
-guarded actions (0341–0348), and reaction-refusal syntax/checks (0538–0545).
+guarded actions (0341–0348, including item paths/input bindings 0345–0348),
+identity details (0633–0646), compliance/subject checks, reaction identity
+(0647–0649), and reaction-refusal syntax/checks (0538–0545).
 A shared catalog code is not proof that a check is implemented in both compilers.
 
 C# CLI/MCP owns whole-application scoped diagnostics, opt-in completeness
-(PLAY0530–0537), semantic binding and PLAY0546 (a negated claim targets optional,
+(including PLAY0530–0537, PLAY0602–0606 and PLAY0652), bound reaction gate
+checks PLAY0650/0651, semantic binding and PLAY0546 (a negated claim targets optional,
 unavailable-subject or non-text data). The VS Code repair bridge is not a general
 C# validator. A clean editor is not V1 for the complete application, V3 binding
 or V4 execution. Run the CLI or MCP for those verdicts. Authority:
-`v4.125.0:Documentation/screenplay/editor-diagnostics.md`, `diagnostics.md`.
+`v4.127.0:Documentation/screenplay/editor-diagnostics.md`, `diagnostics.md`.
 
 ## Consistency errors (V1: the model contradicts itself)
 | Code | Meaning |
@@ -99,7 +218,7 @@ or V4 execution. Run the CLI or MCP for those verdicts. Authority:
 ## Binding (V2 and V3) - see `executable-subset.md` for the full table
 | Code | Meaning | Fix |
 |---|---|---|
-| PLAY0268 | construct the ESM cannot represent; read the message for the construct (`executable-subset.md` lists the common ones: handler, list or observable query, `@pii`, `produces when` over read models, v6 constructs on cratis before 3.28.2) | stay in design mode, or change the construct if the domain allows; never strip `@pii`/authorization |
+| PLAY0268 | construct the ESM cannot represent; read the message for the construct (`executable-subset.md` lists the common ones: handler, list or observable query, `pii`, `produces when` over read models, v6 constructs on cratis before 3.28.2) | stay in design mode, or change the construct if the domain allows; never strip `pii`/authorization |
 | PLAY0269 / 0270 | UI deferred / authoring metadata (I) | none |
 | PLAY0271 | legacy `reads` or a `concurrency` block keeps its legacy meaning and cannot bind (error) | design gap; a constraint for uniqueness; protected decisions are a target requirement |
 | PLAY0273 | incoherent: ambiguous `for`, property not on event revision, operand type mismatch, derived `$eventContext` path | fix the reference |

package/package/corpus/skills/cratis-screenplay-toolchain/references/doc-contradictions.md

@@ -1,10 +1,17 @@
 # Documentation contradictions and which side to trust
 
-Current pins are Screenplay 4.125.0 / CLI 3.41.0 (`versions.md`). This is a
+Current pins are Screenplay 4.127.0 / CLI 3.41.0 (`versions.md`). This is a
 **historical** contradiction inventory, not a claim that all listed defects still
 exist. Current grammar documents exact numbers and free description placement;
 sources/routes bind as ESM v8; PLAY0515 is a source error; CLI v7 reaches Stage.
 
+At v4.127.0 `concepts.md` links the shipped purpose declarations/checks/record
+but its final identifier section still calls them later phases. `purposes.md`,
+the released grammar/tool and successful purpose probes take precedence. The same
+page's legacy `@pii` mentions do not change bare `pii`/`secret` canonical syntax;
+legacy forms compile with PLAY0565 information, duplicates with PLAY0653 warning.
+Event `subject` remains report-only, despite accepted future lineage work.
+
 `D/` is Screenplay `Documentation/screenplay/` at **v4.66.0**; line numbers were re-read at
 that tag. Rule: the compiler you ran decides what the tool accepts today; the documentation
 and the domain decide what the model should mean. When they disagree, follow the compiler

package/package/corpus/skills/cratis-screenplay-toolchain/references/executable-subset.md

@@ -2,6 +2,7 @@
 
 ## Contents
 
+- Caller and compliance boundary (4.127.0)
 - Admitted on both compilers
 - Admitted from Screenplay 4.61 (ESM v6): standalone tool and cratis 3.28.2 or later
 - Generated values and responses (ESM v7): standalone 4.68.0 or later only
@@ -10,7 +11,7 @@
 - Not refused, but do not rely on it
 - Never do this to reach V3
 
-Current pins are Screenplay 4.125.0 / CLI 3.41.0 (`versions.md`). Detailed
+Current pins are Screenplay 4.127.0 / CLI 3.41.0 (`versions.md`). Detailed
 4.66.0/4.68.0 binder probes below retain their historical labels. Current source
 admits sources/streams/routes as ESM v8 and policy negation as ESM v7; operations,
 exact numbers and reaction refusals/redelivery remain unadmitted. Use the actual
@@ -32,6 +33,20 @@ Complete examples that bind live in `executable-example.md` (both compilers),
 (ESM v6; standalone tool and cratis 3.28.2 or later) and `generated-responses-example.md`
 (ESM v7; standalone tool 4.68.0 or later only).
 
+## Caller and compliance boundary (4.127.0)
+
+`$identity.id`/`.name`/`.userName` are aliases of the admitted
+`$context.identity` produces-mapping values. Authentication status, roles and
+claims still refuse there (PLAY0268); the older root is not deprecated.
+A top-level `identity` block alone is authoring metadata and does not block
+readiness. Executable reads of declared `$identity.<detail>` do (PLAY0268);
+`$context.identity` remains built-ins only. Purposes and event `subject` marks
+are metadata (PLAY0270), not source resolution, retention or subject propagation.
+Bare `pii`/`personal` and `secret` concepts, scopes and qualifiers still block
+binding. Legacy spellings compile with PLAY0565 information; duplicates warn
+PLAY0653. Never remove protection; see command-surface `references/compliance.md`.
+Authority: v4.127.0 `context.md`, `identity.md`, `concepts.md`, `events.md`, `purposes.md`.
+
 ## Admitted on both compilers
 
 - `StateChange` and `StateView` slices.
@@ -159,7 +174,7 @@ bodies still leave their owner non-executable.
 | --- | --- | --- |
 | `Automation` or `Translate` slice, `reaction`, `capture`, `trigger`; `given clock`, `when clock`, `when trigger`, `when capture` | PLAY0268 | **cratis before 3.28.2 bundles only** (4.60.1); messages in `versions.md` |
 | Unquoted `import Other.Contract` | PLAY0268 | external contract import is not bound |
-| `@pii` or `@sensitive` on any concept | PLAY0268 | "Concept '<n>' compliance attributes require portable data-subject semantics." Same message at 4.60.1 and 4.66.0. `@sensitive` means an operational secret, rendered `[Encrypted]` + `[NotAudited]` (Screenplay decision 0034) |
+| `pii` or `secret` on any concept (also alias/legacy markers) | PLAY0268 | Compliance requires portable data-subject semantics; scopes/qualifiers do not admit it. Secret provider mapping is `[Encrypted]` + `[NotAudited]`, not a bind/render claim |
 | `query` returning a collection (`RM[]`), or without exactly one caller-supplied `by` | PLAY0268 | "must declare one caller-supplied 'by' argument" or "must return one optional read model" |
 | `observable`, `filter`, `scoped to`, `performer` queries | PLAY0268 | "uses delivery, filtering, scope, or implementation behavior outside the first ESM v1 vertical." `observable` goes in the return position (`=> observable RM optional`); as a body line it is PLAY0048 |
 | `contains` or `starts with` in conditions | PLAY0268 | equality and numeric ordering only |
@@ -199,9 +214,9 @@ bodies still leave their owner non-executable.
 
 ## Never do this to reach V3
 
-Do not remove `@pii`, `@sensitive`, `authorize` or policies, list queries, automations or
+Do not remove `pii`, `secret`, `authorize` or policies, list queries, automations or
 rules a domain needs just to make binding pass. Report `V3 blocked: <codes>` and record the
-slice in the gap list. A `@pii` or `@sensitive` attribute blocks V3 and rendering, and
+slice in the gap list. A `pii` or `secret` marker blocks V3 and rendering, and
 either attribute on an identifier or typed destination is a source error
 PLAY0515 on the current compiler (including stream-id parts and route mapping
 sources). Chronicle also rejects `[PII]`/`[Encrypted]` on event-source identifiers

package/package/corpus/skills/cratis-screenplay-toolchain/references/provenance.md

@@ -28,7 +28,13 @@ is adapted with the agreement of Martin Dilger and Nebulit GmbH.
 
 ## Sources read for facts
 
-- Current baseline: Screenplay `v4.125.0` `Documentation/screenplay/{tool,diagnostics,editor-diagnostics,grammar,event-sources,specifications,policies}.md`, MCP reference/authoring guides and `Semantics/Versions.cs`; CLI `v3.41.0` dependency pins, `RenderedSemanticVersions.cs` and its v7 planning specification. Installed versions/CLI help and changed examples were checked separately. Pins are in `versions.md`; the older probes below retain their original labels.
+- Identity/compliance/route-literal guidance: Screenplay `v4.127.0` (`e70435a4`)
+  `identity.md`, `context.md`, `concepts.md`, `purposes.md`, `events.md`,
+  `event-sources.md`, `reactions.md`, `completeness.md`, `diagnostics.md`,
+  `editor-diagnostics.md`, MCP reference/authoring tools and `Semantics/Versions.cs`.
+  Installed 4.127.0 version and changed examples were checked separately. Historical
+  execution and renderer probes retain their labels; CLI stays 3.41.0.
+- Earlier baseline: Screenplay `v4.125.0` `Documentation/screenplay/{tool,diagnostics,editor-diagnostics,grammar,event-sources,specifications,policies}.md`, MCP reference/authoring guides and `Semantics/Versions.cs`; CLI `v3.41.0` dependency pins, `RenderedSemanticVersions.cs` and its v7 planning specification. Installed versions/CLI help and changed examples were checked separately. Pins are in `versions.md`; the older probes below retain their original labels.
 - Screenplay `v4.66.0` (`c89198b`): `Documentation/screenplay/` (grammar, commands, queries,
   specifications, reactions, diagnostics, mcp), `decisions/0017`, `0020`, `0022` to `0024`,
   `Source/DotNET/Screenplay/Semantics/` (binder, versions, execution),

package/package/corpus/skills/cratis-screenplay-toolchain/references/renderable-subset.md

@@ -1,6 +1,13 @@
 # Renderable subset (V5): what `cratis render` admits
 
-Current pins: standalone Screenplay 4.125.0; CLI 3.41.0 bundles Screenplay
+## Contents
+
+- What Stage 4.24 admits
+- Authoring consequences in renderable mode
+- Ownership, publication and recovery
+- Reading V5
+
+Current pins: standalone Screenplay 4.127.0; CLI 3.41.0 bundles Screenplay
 4.114.0 and Stage 4.51.3 (`versions.md`). CLI admits ESM v7 to Stage planning;
 above v7 is CLI-RENDER-004. Its v7 canonical corpus gets STAGE-ESM-028/029 for
 generated values/responses (`v3.41.0:Source/Cli.Specs/for_ScreenplayPlanning/when_planning_an_esm_v7_model.cs`).
@@ -48,6 +55,14 @@ whole automation is hand-written (gap-fill).
 | Specifications | command-action scenarios: given events, `when <Command>`, `then` events (ordered or any order), `then readmodel`, `then query`, `then error` (naming a rendered constraint or message), `then denied`, `given caller`. Two narrow when-less routes: an unprotected single `then query` seeded by exactly one `given readmodel` whose key and values match (no given events, no caller), and a query-only denial (`given caller`, one `then query` with no results, `then denied`, a protected query, no role claims) | `then no readmodel`, `when append`, composite values, error codes not naming a rendered constraint: 011. Any other when-less specification (for example given events with `then query`) fails 011 |
 | Compliance | none | any `@pii` or `@sensitive` already fails binding (PLAY0268). The C# provider mapping (Stage v4.29.0, Stage#197) is `@pii` to `[PII]`, `@sensitive` to `[Encrypted]` + `[NotAudited]`, both to `[PII]` only |
 
+At standalone 4.127.0, compliance uses bare `pii`/`secret` (legacy markers are
+accepted with PLAY0565 information); either still refuses binding. Identity blocks,
+purposes and event `subject` are authoring metadata, not provider realization;
+executing identity detail reads still refuses PLAY0268. Current source/stream
+routes are admitted as v8, including composite ids, not the historical binding
+refusal above; CLI 3.41.0 still refuses versions above v7. Never split hand-joined
+legacy ids or drop protected ids into routing to fit a renderer (PLAY0515).
+
 ## Authoring consequences in renderable mode
 
 - `produces when` is STAGE-ESM-006: split conditional outcomes into separate commands, or
@@ -81,9 +96,12 @@ whole automation is hand-written (gap-fill).
   `Customizations/styles.css`. The planner never reads it, and it never binds a modeled
   reaction or capture. A customization never makes a rejected model renderable.
 - `cratis render` does **not** build, test or run the application.
-- The scaffold pins .NET 10, Arc 22.25.0, Chronicle 19.8.1 and emits a `.frontend/` React/Vite
-  app (Components 4.14.0, Scene 4.2.0). `Directory.Packages.props` is Stage-managed: do not
-  edit it. `[ProtectedDecision]` (Arc v22.39.0) is not available in a rendered application.
+- Stage 4.51.3's scaffold pins .NET 10, Arc 22.50.5, Chronicle client/kernel 19.32.0
+  and emits a `.frontend/` React/Vite app (Components 4.14.0, Scene 4.10.0).
+  `CratisEmbeddedScreenplayEnabled=false`; `Directory.Packages.props` is managed,
+  never edit it. `[ProtectedDecision]` / `DecisionRead<T>` are available to gap-fill,
+  not Stage-emitted enforcement; projection/key admission and unit-of-work enrollment
+  remain required. Source checks: Stage skill `references/rendered-application.md`.
 
 ## Reading V5