@cratis/pi 7.22.0 → 7.24.0

package/package/corpus/skills/cratis-screenplay-toolchain/references/sources-and-streams.md

@@ -5,6 +5,7 @@
 - Admission
 - Declare and route
 - Specification routes
+- Canonical keys and evolution
 - Boundaries
 
 ## Admission
@@ -82,6 +83,26 @@ Typed event examples may supply a route, replaced as a whole by step overrides;
 `for` is independent. No spelling restores a wildcard after an example supplies
 a route. See `cratis-screenplay-specifications` for fixture provenance.
 
+## Canonical keys and evolution
+
+At Screenplay 4.127.0, stream-id literals on command routes (PLAY0504) and
+specification routes (PLAY0549) must be nonempty, well-formed Unicode NFC text;
+invalid text is refused, never normalized. In Double numeric mode integer ids
+are within ±(2^53−1); Exact mode has no such bound but still refuses binding.
+Known routed command identifiers and production destination types must equal
+the source's nominal identifier type (PLAY0504 is an error, not a warning).
+Allocation is typed by the generated identifier, or without one requires a
+UUID-based source. Unrouted commands are unaffected.
+
+Composite schemas declare `streamId` with at least two named scalar parts.
+Command routes map every part once; specification parts are literals only.
+Format each part by the portable scalar rules, escape `%` to `%25` and `|` to
+`%7C`, then join with `|` in declaration order; decoding is strict. Specification
+route contradictions compare canonical values part by part (UUID case variants
+are equal). Changing a stored stream's key schema needs a new stream identity
+or migration. Keep hand-joined legacy ids as scalar text: never split by guesswork.
+Authority: v4.127.0 `event-sources.md`, `diagnostics.md`, decision 0033.
+
 ## Boundaries
 
 Reference routing does not prove target deployment, concurrency or protected

package/package/corpus/skills/cratis-screenplay-toolchain/references/traps.md

@@ -1,6 +1,6 @@
 # Traps (one line each, with the fix)
 
-Current pins: Screenplay 4.125.0 / CLI 3.41.0 (`versions.md`). Unless explicitly
+Current pins: Screenplay 4.127.0 / CLI 3.41.0 (`versions.md`). Unless explicitly
 updated below, [probed]/[source] rows retain their historical v4.66.0/CLI 3.28.2
 scope; negative capability claims there are not current verdicts. Current routes
 bind as v8, v7 reaches Stage planning, reference tests have CLI/MCP routes, and
@@ -29,7 +29,7 @@ exact numbers are documented in the grammar. Compiler syntax: `cheat-sheet.md`.
 21. Quoted `import "x/*.play"` = my files; unquoted `import Ctx.Event` = another context's contract (does not bind: PLAY0268). [probed]
 22. Construct keywords are closed (`aggregate`, `saga`, `workflow` do not exist): PLAY0029 or PLAY0001/0022/0024.
 23. `@` escapes are mandatory for `tag`, `authorize`, `produces`, `reads`, `file`, `validate`, `sequence`, `occurred`, `causedBy`, `namespace`, `correlation`, `causation`, and projection `key`/`parent`/`with` as names.
-24. Comments do not survive canonicalizing edits (PLAY0288 reprint; `droppedCommentCount`); keep durable rationale in `description` text, not `//`.
+24. Canonicalizing edits can drop unplaceable comments (PLAY0288; inspect `droppedCommentCount`); keep durable rationale in fenced Markdown `documentation`, not `//`, and summaries in `description`. Documentation survives canonical printing but changes neither executable bytes nor `modelRevision`; it is not rendered code.
 25. MCP writes: propose, review, approval, apply by the identity owner (the session that owns the MCP connection); other subagents return edit requests; proposals are connection-local, at most 16 (`cratis-screenplay-model-authoring`).
 26. Operations/systems and exact numbers remain unadmitted. Sources/streams/routes bind and reference-execute as ESM v8 at 4.125.0; generated values/responses bind as v7. CLI 3.41.0 renders through v7 only, with construct-specific Stage refusals. Consult released grammar rather than inventing syntax from decisions.
 27. Translate vs Automation is semantic: external facts become local facts in `Translate`; in-app event-to-event goes in `Automation`.
@@ -43,8 +43,25 @@ exact numbers are documented in the grammar. Compiler syntax: `cheat-sheet.md`.
 34. A `from <Event> key <property>` routes only if every such event carries that property: an event that frees or updates a row keyed by another stream's id must carry that id in its payload, or the row never changes. Whether the compiler reports a missing key property is unverified [to probe]; check by hand.
 35. `description`/`documentation` are authoring metadata: board, MCP and Prologue show them; `cratis render` never does (Stage#178). A rule only in prose is unenforced in rendered code; make it a rule layer, a spec or a recorded target requirement.
 36. One unadmitted construct (operations, exact numbers, refusal/redelivery) blocks whole-model binding. Routing is admitted v8, not one of those constructs; CLI render's v7 boundary is a separate refusal. Do not remove routing or authorization to render a model.
-37. Personas are not in the ESM (Screenplay#254); specs cannot reference them. Write `given caller` as the roles/claims that stand for the persona.
-38. A rule that depends on stored state is `reads <View>` + `require <expr> message "..."` (stated intent; PLAY0268/0271 at binding are expected in design mode). The slice `description` must mark it NOT enforced in the model today (Screenplay#129/#209) and name the target: Arc `[ProtectedDecision]` + `DecisionRead<T>` (Arc v22.39.0 and later; not available in a Stage-rendered app on Arc 22.25.0), Chronicle DCB (`concurrency` scope), or a constraint where one fits. Forbidden: caller-supplied copies of state in `require`, boolean attestation inputs (`confirmsX == true`), rules hidden in `handler`/implementation-hint prose. An unguarded materialized read is unsafe for a protected decision.
+37. Personas remain outside ESM bytes, but 4.127.0 specifications accept `given caller as <Persona>`: one authenticated deterministic policy witness, not every matching caller. Inspect the chosen `or` branch; use explicit callers when synthesis is refused.
+38. A rule that depends on stored state is `reads <View>` + `require <expr> message "..."` (stated intent; PLAY0268/0271 at binding are expected in design mode). The slice `description` must mark it NOT enforced in the model today (Screenplay#129/#209) and name the target: Arc `[ProtectedDecision]` + `DecisionRead<T>` (Arc v22.39.0 and later; available to gap-fill on Stage 4.51.3's Arc 22.50.5/Chronicle 19.32.0, not emitted protection), Chronicle DCB (`concurrency` scope), or a constraint where one fits. Forbidden: caller-supplied copies of state in `require`, boolean attestation inputs (`confirmsX == true`), rules hidden in `handler`/implementation-hint prose. An unguarded materialized read is unsafe for a protected decision.
+
+Current identity/compliance traps (v4.127.0 `identity.md`, `concepts.md`, `events.md`,
+`purposes.md`, `diagnostics.md`):
+- `$identity` built-ins alias `$context.identity`; declared detail reads are PLAY0268,
+  while an identity block alone does not block readiness. `scoped to` is opaque,
+  not a detail reference. Query sources need keyed single compatible results and
+  token-only keys/gates that do not depend on details.
+- `pii personal` repeats one marker (PLAY0653). Legacy markers are accepted but
+  deprecated (PLAY0565); repairs preserve notes, never invent legal content.
+- Event `subject` is report-only (PLAY0270), not emitted C# `[Subject]` or runtime
+  lineage. Keep stream identity, data subject, encryption scope and policy subject apart.
+- Purpose metadata/checks/records declare processing, not lawfulness or retention.
+- PLAY0504 is an error; stream-id text is nonempty well-formed NFC (refuse, never
+  normalize), Double integer ids are within ±(2^53−1); canonical UUID comparison
+  ignores case. Protected concepts cannot be stream ids/parts/mapping sources (PLAY0515).
+- Run `--check privilege` on elevated event-trigger paths; opaque producers are
+  unknown, not safe. Arc needs `[ExecuteCommandsAsSystem]` to supply a principal.
 
 The SKILL.md top 12: 1, 4, 5, 6, 7, 10, 12, 13, 17, 18, 20, 21 (+ mode/version notes there). Traps 39 to 44 are tool traps added at the 4.66.0 pin.
 39. A handler never binds: PLAY0268 "Command '<n>' handler requires a constrained implementation attachment", with a file, a fence, `implementation` or `hint` alike. `implementation` and `hint` are accepted on a command handler, an operation execute/compensate phase and (from 4.65.0) a command property named rule, and are rejected on concept rules, built-in property rules and whole-command `require`/`validate` bodies; on a handler they are authoring intent only (no execution, lock or confirmation). A handler slice is gap-fill, not a customization of a rendered slice. [source, probed]
@@ -52,4 +69,4 @@ The SKILL.md top 12: 1, 4, 5, 6, 7, 10, 12, 13, 17, 18, 20, 21 (+ mode/version n
 41. MCP roots bug (4.63.1 and earlier, including the 4.60.1 bundled by cratis before 3.28.2; not present in 4.66.0 or cratis 3.28.2, probed): a dynamic-root server answers the roots request with an `id: null` error right after `notifications/initialized`; hosts treat it as fatal. `open-workspace.path` does not help. Start with a fixed root (`screenplay mcp <folder>`, `cratis screenplay mcp` in a project with `.cratis/ai.json`) or use 4.63.2 or later (cratis 3.28.2 or later). [source, probed]
 42. A symlinked model path is refused by the MCP server (macOS `/tmp` is a symlink); pass the physical path. Proposals are connection-local (at most 16); `apply` persists identities to `.screenplay/identities.json` and is not crash-atomic across files; never retry `apply` after `ApplyOutcomeUnknown`. [source]
 43. `modelRevision` is canonical semantic (line positions and descriptions do not change it; a file move only if it changes logical placement or application identity) and, without `identities.json`, changes with the root folder name; it is not comparable with a render's `semanticRevision`. Source identity for verdicts is the commit plus the digest from the source-identity helper (`cratis-screenplay-modeling-lifecycle` `references/verdicts-and-modes.md` "Source identity"). [probed]
-44. `cratis render` neither builds nor tests; `--name` is required for plain source; `.cratis-render/` is control state and is never staged; Stage-rendered apps are on Arc 22.25.0 (no `[ProtectedDecision]`). `cratis` file mode versus folder mode (trap 6) and a stale `cratis` on `PATH` (`which -a cratis`) both silently change what a verdict means. [source]
+44. `cratis render` neither builds nor tests; `--name` is required for plain source; `.cratis-render/` is control state and is never staged; Stage 4.51.3 rendered apps pin Arc 22.50.5/Chronicle 19.32.0 (`[ProtectedDecision]` available to gap-fill, not automatically emitted). `cratis` file mode versus folder mode (trap 6) and a stale `cratis` on `PATH` (`which -a cratis`) both silently change what a verdict means. [source]

package/package/corpus/skills/cratis-screenplay-toolchain/references/verdicts.md

@@ -28,7 +28,7 @@ V3 are read from the MCP server or from a render, V1 and V5 from the CLIs.
 
 | Tool | Command | Pass | Fail |
 | --- | --- | --- | --- |
-| Standalone 4.125.0 (preferred) | `screenplay <model-root> --warnaserror --no-color` | exit 0 and a nonzero compiled file count | exit 1 defects; exit 2 could not run/invalid arguments or input |
+| Standalone 4.127.0 (preferred) | `screenplay <model-root> --warnaserror --no-color` | exit 0 and a nonzero compiled file count | exit 1 defects; exit 2 could not run/invalid arguments or input |
 | cratis (fallback) | `cratis screenplay validate <model-folder> --warnings-as-errors -o json-compact` | exit 0 | exit 5; exit 1 means missing path or no files |
 
 - Validate the complete application root, not an independently selected fragment.
@@ -40,7 +40,8 @@ V3 are read from the MCP server or from a render, V1 and V5 from the CLIs.
   Exit/`--warnaserror` apply to that reported set; inspect the separate whole
   application counts before a whole-model claim. Unknown/ambiguous scopes exit 2.
 - `--check <names>` (repeatable) or `--check all` opts into completeness warnings
-  PLAY0530–PLAY0537. Whole-source errors skip them; a skipped check is not passed.
+  including PLAY0530–PLAY0537, purposes (PLAY0602–0606) and privilege (PLAY0652).
+  Whole-source errors skip them; a skipped check is not passed.
   Names/codes, coverage limits and editor support: `diagnostics.md`.
 - Warnings are failures here. PLAY0029 (a construct dropped silently) and the unresolved-name
   warnings are the defects this verdict exists to catch.
@@ -62,7 +63,7 @@ MCP reports `V2 not run: no MCP in this agent` unless the brief supplies fresh o
    source revision).
 4. Report the codes with counts, blocking (error severity) apart from informational. A list
    with blocking entries is a valid V2 result (`V2 read: 6 blocking, PLAY0268 x3 list query,
-   @pii ...`); it is the evidence for a "V3 blocked" report. The view also lists
+   pii ...`); it is the evidence for a "V3 blocked" report. The view also lists
    information-severity diagnostics (PLAY0269 deferred UI, PLAY0270 authoring metadata such as
    descriptions, personas and screens) on models that bind; they do not block.
 
@@ -79,9 +80,9 @@ comparison needs it). Binding is what makes a model renderable at all. V3 means
 never "specifications pass".
 
 - Report the ESM version the model needs: `V3 ready (screenplay 4.68.0, ESM v6)`,
-  `V3 blocked: PLAY0268 x3 (list query, @pii) - design scope kept`.
-- A blocked V3 is not repaired by deleting protection or domain rules. Never remove `@pii`,
-  `@sensitive`, authorization, list queries, automations or rules to reach V3; record the
+  `V3 blocked: PLAY0268 x3 (list query, pii) - design scope kept`.
+- A blocked V3 is not repaired by deleting protection or domain rules. Never remove `pii`,
+  `secret`, authorization, list queries, automations or rules to reach V3; record the
   slice and the code in the gap list.
 - A model is executable only on the compiler that bound it. V3 does not carry
   to render admission: CLI 3.41.0 passes up to ESM v7 to Stage, refuses newer

package/package/corpus/skills/cratis-screenplay-toolchain/references/versions.md

@@ -17,12 +17,13 @@ probe; older probes retain their original labels in the other references.
 
 | Source | Pin | Evidence |
 | --- | --- | --- |
-| Screenplay language, standalone tool and MCP | **4.125.0** (`4d818eb`) | Released tag `v4.125.0`; installed `screenplay --version` and `--help` |
+| Screenplay language, standalone tool and MCP | **4.127.0** (`e70435a4`) | Released tag `v4.127.0`; installed `screenplay --version`; changed identity/compliance examples compiled |
 | cratis CLI | **3.41.0** | Released tag `v3.41.0`; installed `cratis --version` |
 | Screenplay bundled by CLI | **4.114.0** | CLI `v3.41.0:Directory.Packages.props` |
 | Stage bundled by CLI | **4.51.3** | Same file; the CLI's runtime image follows its Stage package version |
 | Cratis.Arc.Screenplay bundled by CLI | **22.54.0** | Same file; this is the generator package, not a blanket rendered-app dependency pin |
 | Chronicle / Fundamentals bundled by CLI | **19.32.0 / 7.22.8** | Same file |
+| Stage 4.51.3 rendered backend | **Arc 22.50.5 / Chronicle 19.32.0** | Stage `v4.51.3:Source/Rendering.Cratis/Scaffolding/CratisBackendApplicationScaffoldProfile.cs`; client/testing/image match; scaffold disables embedded reverse extraction |
 
 Check the actual executable before relying on this table: `screenplay --version`,
 `cratis --version`, MCP `initialize` → `serverInfo.version`. An older executable
@@ -30,7 +31,7 @@ on PATH can shadow a newer install; inspect `which -a cratis`.
 
 ## Two compilers, one rule
 
-Standalone Screenplay 4.125.0 and the CLI's 4.114.0 bundle are different releases.
+Standalone Screenplay 4.127.0 and the CLI's 4.114.0 bundle are different releases.
 Prefer standalone for the current language checks; CLI owns generation, Prologue
 and rendering. Name the tool/version with every verdict. No verdict transfers
 between differing compilers without checking the same inputs there.
@@ -62,7 +63,7 @@ for identity-stable selection.
 
 ## Admission boundaries
 
-Screenplay `v4.125.0:Source/DotNET/Screenplay/Semantics/Versions.cs` supports schema
+Screenplay `v4.127.0:Source/DotNET/Screenplay/Semantics/Versions.cs` supports schema
 pairs through v10. Generated values/responses and policy negation select v7;
 sources/streams and command/specification routes select v8; reaction
 `runs as system [role "<Role>"]` selects v10 and reference-executes on 4.125.0.
@@ -86,6 +87,22 @@ The renderable-subset and Stage references retain older probes explicitly;
 read them as tested snapshots, not as a claim that Stage 4.51.3 shares every
 4.24.2 limitation. Query the actual bundled renderer before a V5 claim.
 
+At 4.127.0, `$identity` aliases built-in caller paths; declared identity details
+remain metadata and their executable reads report PLAY0268. Bare `pii`/`secret`
+still block binding; `personal` aliases `pii`. Legacy markers are accepted with
+PLAY0565 information, duplicates warn PLAY0653. Event `subject` and processing
+purposes are report-only metadata (PLAY0270); purpose checks/reports do not prove
+lawfulness or enforce retention. See command-surface context/compliance references.
+
+Authoring features source-checked in standalone 4.127.0: `propose-source`,
+`find-specification-obligations`, `find-modeling-smells`, specification descriptions,
+container/command/read-model/reaction documentation, routed redelivery locators,
+guarded item interactions, persona callers and named case tables. Discover schemas
+in the older CLI bundle rather than assuming parity. Cases/persona callers expand
+to ordinary ESM; metadata changes no executable bytes. Redelivery remains
+unadmitted even when its route is valid. Details: model-authoring MCP references,
+specifications, UI composition and `diagnostics.md`.
+
 ## Historical probes
 
 - Screenplay 4.68.0 admitted v7; CLI 3.28.2/3.28.3 bundled 4.66.0 (v6 at most),

package/package/corpus/skills/cratis-screenplay-toolchain/verification.json

@@ -3,6 +3,12 @@
   "input": "Check a Screenplay model folder: which compiler should I run, what do V1 to V3 mean, and what does the cratis CLI do with my Automation slice?",
   "fixtures": [],
   "assertions": [
+    { "kind": "skill-contains", "value": "4.127.0" },
+    { "kind": "skill-contains", "value": "PLAY0653", "file": "references/diagnostics.md" },
+    { "kind": "skill-contains", "value": "PLAY0646", "file": "references/diagnostics.md" },
+    { "kind": "skill-contains", "value": "PLAY0595", "file": "references/diagnostics.md" },
+    { "kind": "skill-contains", "value": "PLAY0652", "file": "references/diagnostics.md" },
+    { "kind": "skill-contains", "value": "PLAY0504 | E", "file": "references/diagnostics.md" },
     { "kind": "skill-contains", "value": "references/versions.md" },
     { "kind": "skill-contains", "value": "PLAY0029" },
     { "kind": "skill-contains", "value": "--warnaserror" },

package/package/corpus/skills/cratis-screenplay-ui-composition/SKILL.md

@@ -240,8 +240,10 @@ acts. Three words carry it:
 | **Action** | a closed set: `execute`, `navigate to`/`navigate back`, `open dialog`/`close dialog`, `refresh`, `set … to`, `notify`, `confirm`, `raise` |
 | **Behavior** | a bundle of trigger-to-action bindings; inline (`on …`) or named (`behavior` + `uses`) |
 
-A complete example — a named behavior with parameters, attached with `uses`, and
-an inline `on` block with a continuation:
+Guarded alternatives and `where` deprecation:
+[guarded interactions](references/guarded-interactions.md).
+
+Complete named/inline behavior example:
 
 ```screenplay
 concept InvoiceId : Uuid

package/package/corpus/skills/cratis-screenplay-ui-composition/references/guarded-interactions.md

@@ -0,0 +1,71 @@
+<!-- Copyright (c) Cratis. All rights reserved. -->
+<!-- Licensed under the MIT license. See LICENSE file in the project root for full license information. -->
+
+# Choose a gesture's whole action list
+
+`on click`, `on double click` and `on select` accept ordered block-form `when`
+alternatives and an optional final `otherwise`. Use the same strict condition
+language and data-item subject as [guarded screen actions](../../cratis-screenplay-read-surface/references/guarded-actions.md):
+`item.<path>` compared with a literal, joined by `and`, `or` and parentheses.
+At least one `when` and a nonempty action list in every branch are required.
+Do not mix alternatives with plain actions or `where`; a one-line
+`when … execute …` belongs to labeled actions, not interactions.
+
+This complete model validates on standalone Screenplay 4.127.0:
+
+```screenplay
+module Billing
+  feature Invoices
+    slice StateView InvoiceHistory
+      event InvoiceRecorded
+        status String
+      readmodel InvoiceView
+        invoiceId String
+        status String
+      projection Invoices => InvoiceView
+        from InvoiceRecorded
+          invoiceId = $eventSourceId
+          status = status
+      query InvoiceById => InvoiceView optional
+        by invoiceId String
+      screen InvoiceDetails
+        data InvoiceView via query InvoiceById by invoiceId
+        table InvoiceView
+          column status
+          on double click
+            when item.status == "draft"
+              notify info "The draft can be edited"
+              refresh InvoiceById
+            otherwise
+              notify info "Only drafts can be edited"
+```
+
+The first matching branch runs once on the rendered item at gesture time, without
+refetch or re-evaluation while its list runs. No match uses fallback or does
+nothing; **no subject does nothing, including fallback**. Failure, denial or an
+unavailable command never falls through; backend commands retain their rules.
+Unlike labeled actions, no choice was displayed beforehand to refresh at click.
+
+A table click/double click uses the activated row; select uses the newly selected
+item, and clearing selection runs nothing. Elsewhere use the nearest enclosing
+single item or selected row, with guarded actions' sibling precedence. Check named
+behaviors at each `uses` site. Component `context` or `selectedItem` bindings do
+not supply the subject in this version; unresolved/equally near subjects report
+PLAY0346.
+
+Submit, event, change, interval and application triggers have no alternatives.
+The one-line `on row-click navigate to … by …` remains unchanged. Opaque `where`
+on click/double click/select is deprecated (PLAY0564): strict item conditions warn
+and C# offers a typed repair to one `when` with no fallback; other guard text is
+Information without repair. Other triggers' `where` remains unchanged. Repairs
+require individual review, canonical formatting, preserve comments and refuse
+comment loss; TypeScript diagnoses but offers no repair. PLAY0563 has a C# repair
+expanding a one-line alternative to the block form. Neither repair supports
+pinned evidence.
+
+UI is deferred from backend ESM (PLAY0269), not executable gesture proof. The
+board draws a static prototype; renderers must explicitly admit alternatives or
+report unsupported, never flatten them into plain actions.
+
+Authority: Screenplay v4.127.0 `interactions.md`, `diagnostics.md`,
+`mcp/authoring-tools.md`; decision 0048.

package/package/corpus/skills/cratis-stage-rendering-and-sandbox/SKILL.md

@@ -52,8 +52,11 @@ Everything below was read at those tags (`Source/Rendering.Cratis/**`, `README.m
 [references/render-example.md](references/render-example.md) was rendered, built and
 tested with cratis 3.28.2 (re-run on 3.28.3). Read `references/render-example.md` when you need a complete renderable model and the observed render, build, and test results. The full version table (Screenplay 4.66.0, Arc 22.50.5,
 Chronicle 19.32.0 and the tool split) is in the `cratis-screenplay-toolchain` skill,
-`references/versions.md`. Rendered apps are on Arc `22.25.0`, so `[ProtectedDecision]`
-(Arc 22.39.0 and later) is not available in code written into one. Screen render
+`references/versions.md`. Stage 4.51.3 scaffolds Arc `22.50.5` and Chronicle
+`19.32.0`, with `CratisEmbeddedScreenplayEnabled=false`. `[ProtectedDecision]` and
+`DecisionRead<T>` are available to gap-fill code, not automatically emitted or
+protected by Stage; admission and unit-of-work enrollment still matter. See
+[rendered application](references/rendered-application.md) for the source checks. Screen render
 publication and browser behavior for the canonical corpus are verified on public
 CLI 3.40.7 / `cratis/stage:4.51.1`. Studio 0.141 is released and production runs
 v0.139.0 or later, but production UI automation is pending a
@@ -68,7 +71,7 @@ The `.play` model is the source of truth; Stage-managed output is derived from i
 - Hand-written code goes in `Customizations/` (unmanaged), in a separate project, or in
   an explicitly authorized gap-fill for scope Stage cannot render (`cratis-screenplay-render-and-gap-fill`).
 - A customization never makes a rejected model renderable, and never weakens modeled
-  authorization, validation or `@pii` to get past a refusal.
+  authorization, validation or personal-data and secret markers to get past a refusal.
 - Never claim a whole-application result from a subset of the model.
 
 ## Publication and recovery
@@ -135,7 +138,7 @@ Facts that surprise:
 
 ## Historical Stage 4.24 admission
 
-Current pins are standalone Screenplay 4.125.0 / CLI 3.41.0 / Stage 4.51.3.
+Current pins are standalone Screenplay 4.127.0 / CLI 3.41.0 / Stage 4.51.3.
 Routes bind/reference-execute as v8; reaction `runs as` identity as v10.
 CLI renders through v7 only (CLI-RENDER-004 for newer model versions) and its
 older 4.114.0 parser rejects `runs as` (PLAY0137). Stage 4.51.3's direct planner

package/package/corpus/skills/cratis-stage-rendering-and-sandbox/references/rendered-application.md

@@ -7,18 +7,29 @@ render (see [render-example.md](render-example.md)).
 
 ## Scaffold pins
 
+The pin rows below are source-checked at Stage `v4.51.3`,
+`Source/Rendering.Cratis/Scaffolding/CratisBackendApplicationScaffoldProfile.cs`,
+`CratisBackendApplicationScaffold.cs` and `CratisFrontendPackageSet.cs`.
+Earlier runtime/customization probes above keep their original labels.
+
 | Item | Value |
 | --- | --- |
 | Target framework | .NET 10 (`net10.0`), `Microsoft.NET.Sdk.Web` |
-| Arc packages (`Cratis`, `Cratis.Arc.MongoDB`, Arc testing) | `22.25.0` |
-| Chronicle client | `Cratis.Chronicle` and `.AspNetCore` `19.8.1`, matched to the `cratis/chronicle:19.8.1-development` image in the compose file |
+| Arc packages (`Cratis`, `Cratis.Arc.MongoDB`, Arc testing) | `22.50.5` |
+| Chronicle client | `Cratis.Chronicle`, `.AspNetCore` and `.Testing` `19.32.0`, matched to the `cratis/chronicle:19.32.0-development` image in the compose file |
+| Embedded reverse extraction | `CratisEmbeddedScreenplayEnabled=false`: the source `.play` is authoritative |
 | Test packages | xunit, NSubstitute, Cratis.Specifications; **Debug configuration only** (`IsTestProject` when Debug) |
-| Frontend | Vite and React, Components `4.14.0`, Scene `4.2.0`, Fundamentals `7.19.6` |
+| Frontend | Vite and React, Components `4.14.0`, Scene `4.10.0`, Fundamentals `7.19.8` |
 | Package management | central package management **off**; `Directory.Packages.props` is managed, do not edit it |
 
-Consequences: `[ProtectedDecision]` and `DecisionRead<T>` (Arc 22.39.0 and later) are not
-available in a rendered application; `[ExecuteCommandsAsSystem]` (Arc 20.56.0 and later)
-is. Upgrading Arc or Chronicle inside a rendered application is a re-render under a newer
+Consequences: `[ProtectedDecision]` (`Cratis.Arc.Chronicle.ReadModels`) and
+`DecisionRead<T>` / `IDecisionReads` (`Cratis.Chronicle.ReadModels`) are available
+in this scaffold's package set, as is `[ExecuteCommandsAsSystem]`. This is API
+availability, not Stage emission or runtime protection: gap-fill must opt into
+the protected command profile and enroll an admitted projection/key read in the
+active unit of work. Source-checked at Arc v22.50.5 `ProtectedDecisionAttribute.cs`
+and `CommandDecisionReads.cs`, Chronicle v19.32.0 `DecisionRead.cs`/`IDecisionReads.cs`.
+Stage does not turn `.play` `reads`/`require` into protected decisions. Upgrading Arc or Chronicle inside a rendered application is a re-render under a newer
 Stage, not an edit of the managed files. The compose file binds local ports `27017` and
 `35000`, keeps data in the named volumes `chronicle-data` and `chronicle-config`, and
 `docker compose down --volumes` is the only thing that deletes them.

package/package/corpus/skills/cratis-stage-rendering-and-sandbox/verification.json

@@ -10,7 +10,7 @@
     { "kind": "skill-contains", "value": "means stop and reconcile" },
     { "kind": "skill-contains", "value": "STAGE-ESM-016" },
     { "kind": "skill-contains", "value": "**Render never builds, tests or runs**" },
-    { "kind": "skill-contains", "value": "Arc `22.25.0`" },
+    { "kind": "skill-contains", "value": "Arc `22.50.5`" },
     { "kind": "skill-contains", "value": "`[ProtectedDecision]`" },
     { "kind": "skill-contains", "value": "`Customizations/`" },
     { "kind": "skill-contains", "value": "`Stage__Runtime__Engine=semantic`" },

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cratis/pi",
-  "version": "7.22.0",
+  "version": "7.24.0",
   "description": "Configuration-aware Cratis AI integration for Pi",
   "type": "module",
   "files": [