@cratis/pi 7.23.0 → 7.24.0

package/package/corpus/skills/cratis-screenplay-specifications/references/examples-and-routes.md

@@ -8,6 +8,7 @@
 - Typed examples
 - Effective values
 - Event routes
+- Redelivery locators
 - Operation and recovery intent
 
 ## Typed examples
@@ -96,6 +97,63 @@ Source: v4.127.0 `event-sources.md`, `specifications.md`, `diagnostics.md`.
 CLI 3.41.0 rendering rejects versions above v7 before planning, even though
 source compilation and reference routing pass.
 
+Command and read-model examples refuse routes (PLAY0526). Effective role and
+`for` checks use the inherited or replaced route: inherited `no stream` on a
+`given`/append is PLAY0547; incompatible destination/route pairs are PLAY0550,
+and contradictory expectations PLAY0551. Declaration checks still run on unused
+examples and routes overridden at every use. MCP route rows retain the origin
+(authored/example/override), with the replaced whole route on the stream/no-stream
+row and individual lineage on id parts.
+
+## Redelivery locators
+
+`when redelivered <Event> to <Reaction>` may contain a route, using the same scalar
+or complete composite `streamId` shape as event steps. No route is a wildcard;
+`no stream` selects the unrouted given. Compare effective, example-expanded givens.
+Every `for`, payload and route comparison is true, false or unknown: a definite
+mismatch excludes a candidate even when another comparison is unknown. Selection
+needs exactly one definitely matching candidate and **no undecided candidates**
+(PLAY0543). Equal duplicate givens remain separate candidates. Narrow with `for`,
+values, `stream` or `no stream`; do not guess an unknown value. A locator's `for`
+is optional but typed against the routed source when present.
+
+This complete syntax-only model validates on 4.127.0; `screenplay test` reports
+PLAY0268 for redelivery, not a passing scenario:
+
+```screenplay
+eventsource Account
+  identifier String
+  stream Transactions
+    streamId String
+module Accounts
+  feature Recovery
+    slice Automation Observe
+      event Recorded
+        amount Int
+      reaction Observer
+        when Recorded
+      example FirstPartition : Recorded
+        for "account-1"
+        stream Account.Transactions
+          streamId = "first"
+        amount = 10
+      specification RedeliveringTheSecondPartition
+        given FirstPartition
+        given FirstPartition
+          stream Account.Transactions
+            streamId = "second"
+        when redelivered Recorded to Observer
+          stream Account.Transactions
+            streamId = "second"
+        then no events
+```
+
+The second given replaces the example's **entire** route, independently of `for`,
+not just its id. PLAY0548 is command-action-only, never a locator route error;
+malformed routes use PLAY0547 and resolution/key-shape errors PLAY0549. MCP labels
+locator fixtures `whenRedeliveredEvent` with route-origin rows. Route admission
+alone does not admit redelivery or `then no events`.
+
 ## Operation and recovery intent
 
 Operation failure/request/compensation forms are authoring-only (PLAY0268):
@@ -108,4 +166,4 @@ remain unadmitted; they are not executed append scenarios. Forms, matching,
 acknowledgement and their whole-model refusal boundary are in
 captures-and-reactions `references/refusals-and-redelivery.md`.
 
-Authority: Screenplay `v4.125.0:Documentation/screenplay/specifications.md`.
+Authority: Screenplay `v4.127.0:Documentation/screenplay/specifications.md`.

package/package/corpus/skills/cratis-screenplay-specifications/references/persona-callers-and-cases.md

@@ -0,0 +1,117 @@
+<!-- Copyright (c) Cratis. All rights reserved. -->
+<!-- Licensed under the MIT license. See LICENSE file in the project root for full license information. -->
+
+# Persona callers and named case tables
+
+## Contents
+
+- Persona callers
+- Case tables
+
+Authority: Screenplay v4.127.0 `specifications.md`, `personas.md` and `mcp/reference.md`.
+
+## Persona callers
+
+`given caller as <Persona>` has no body and cannot coexist with an explicit
+`given caller`. It expands before binding into an ordinary authenticated caller
+satisfying every persona policy; persona names remain outside ESM bytes. Required
+atoms are collected first. Policies are visited in declared order, depth first,
+left to right: an already satisfied `or` adds nothing, otherwise the leftmost
+buildable alternative wins. Operand order matters. This witnesses one minimal
+caller, not every caller fitting the persona.
+
+Synthesis refuses no policies, any policy containing `not` (including
+`not authenticated`), inline/file policy code, and required non-literal claims.
+An `or` may skip an unsupported claim alternative. The role-URI claim type
+`http://schemas.microsoft.com/ws/2008/06/identity/claims/role` is never synthesized;
+use role atoms, not that claim. Use explicit `given caller` when synthesis is
+refused (binding PLAY0573), never infer a runtime allow/deny. Malformed references,
+body lines or unknown top-level personas report PLAY0572.
+
+Hover or `declaration-details` (`kind: "Persona"`, `view: "caller"`) shows the
+chosen caller and policy contributions or refusal. Opt-in `personas` completeness
+checks report personas gating nothing (PLAY0574), gates denying every known
+synthesized persona (PLAY0575), and unpinned buildable alternatives (PLAY0576).
+Unsynthesizable/undecidable callers are unknown, not denials. A persona-backed
+denial still uses `then denied`; a visitor persona is not an anonymous caller.
+
+## Case tables
+
+Use tables for validation matrices whose steps stay the same. Rows are **cases**,
+not examples: `example` means a named typed fixture. This complete model's five
+expanded specifications pass in the 4.127.0 reference runner:
+
+```screenplay
+policy IsAccountant
+  require role "Accountant"
+policy IsVisitor
+  require role "Visitor"
+persona Accountant
+  policy IsAccountant
+persona Visitor
+  policy IsVisitor
+module Billing
+  feature Invoices
+    slice StateChange RecordAmount
+      command RecordAmount
+        recordId String identifier
+        amount Int
+        authorize IsAccountant
+        validate
+          require amount > 0
+            message "The amount must be positive"
+        produces AmountRecorded
+          for recordId
+          amount = amount
+      event AmountRecorded
+        amount Int
+      specification RecordingAmounts
+        description "An accountant can record a positive amount"
+        parameter amount Int
+        case Small amount = 10
+        case Large amount = 100
+        given caller as Accountant
+        when RecordAmount amount = case.amount
+          recordId = "amount-1"
+        then AmountRecorded amount = case.amount
+      specification RejectingAmounts
+        parameter amount Int
+        parameter reason String
+        case Zero
+          amount = 0
+          reason = "The amount must be positive"
+        case Negative
+          amount = -1
+          reason = "The amount must be positive"
+        given caller as Accountant
+        when RecordAmount amount = case.amount
+          recordId = "amount-1"
+        then error case.reason
+      specification RefusingAVisitor
+        given caller as Visitor
+        when RecordAmount amount = 10
+          recordId = "amount-1"
+        then denied
+```
+
+Every case assigns every typed parameter exactly once, inline or indented.
+Values are concrete literals or whole single-line objects/lists, never mappings,
+`$` expressions, examples or other case references. `optional` permits `null`,
+not omission or a default; ordinary command/event null restrictions still apply.
+
+`case.<parameter>` fills a whole value position, after example expansion and step
+overrides. It works in step assignments, generated fixtures, query arguments and
+results, `for`, absent read-model keys and scalar `streamId` mappings in a restated
+route. Types must match (concept/underlying primitive in either direction is
+allowed); optional cannot feed required. `then error case.reason` needs String.
+Callers, redelivery locators, clocks, declaration names, step kinds and members
+inside structured literals cannot use case values: pass the whole object/list.
+
+Each case expands independently to `<Specification>_<Case>`, in case order,
+inheriting the description, with the same executable bytes as hand-expanded
+specifications. Derived names must not collide in scope. Failures name the case.
+Selecting a table address in `run-specifications` or `screenplay test --filter`
+selects all cases; a derived address selects one. MCP specification `cases` pages
+effective addresses and values; `find-fixtures` accepts `case` and retains
+`table`, `case`, `caseParameter` provenance. C# singular `Expand` refuses tables
+(PLAY0589); use `SpecificationExamples.ExpandAll`.

package/package/corpus/skills/cratis-screenplay-specifications/verification.json

@@ -41,7 +41,7 @@
     },
     {
       "kind": "skill-contains",
-      "value": "**Authorized commands and queries need `given caller`**"
+      "value": "**Authorized commands and queries need `given caller` or `given caller as <Persona>`**"
     },
     {
       "kind": "skill-contains",

package/package/corpus/skills/cratis-screenplay-streams-and-consistency/SKILL.md

@@ -28,8 +28,8 @@ Require target evidence that the check ran: a concurrent first-append scenario a
 Chronicle, asserting one append wins, one is rejected, and `IAppendResult.ConcurrencyCheckPerformed`
 is `true` (a skipped check and a passing one look identical otherwise; a current client against
 an older kernel always reads `false`). This was source- and documentation-inspected, not
-concurrency-tested here. Stage-rendered apps pin Chronicle client 19.8.1: do not assume these
-APIs exist there; confirm the package version before recommending them.
+concurrency-tested here. Stage 4.51.3 rendered apps pin Chronicle client/kernel 19.32.0
+and Arc 22.50.5; the APIs exist for gap-fill, not as automatically rendered enforcement.
 
 ## Verified product sources
 
@@ -38,7 +38,7 @@ APIs exist there; confirm the package version before recommending them.
 | Screenplay | v4.68.0 (`79801bf`) | ESM v7 generated values (`generated identifier`, decision 0026) and decision 0025's numbering; the diagnostics below were read at v4.66.0 (`c89198b`): `identifier`, `for`, constraints, generations, `id` pins, diagnostics PLAY0019/0135/0268/0271/0273/0391-0393/0446-0449/0469/0471 |
 | Chronicle | v19.32.0 (`f17a2ff`) | CHR0012, CHR0034; open defects #3744, #4123, #4131 |
 | Arc | v22.50.5 | `[ProtectedDecision]` and `DecisionRead<T>` (since v22.39.0) |
-| Stage | v4.24.2 | rendered apps pin Arc 22.25.0 and Chronicle client 19.8.1 (unchanged from 4.24.0); admits ESM v4 but refuses evolved events with `STAGE-ESM-026` (migrations not rendered, Stage#204) |
+| Stage | v4.51.3 | rendered apps pin Arc 22.50.5 and Chronicle client/kernel 19.32.0; protected-read APIs available to gap-fill. Historical 4.24.2 admission probe: ESM v4, evolved events refused with `STAGE-ESM-026` |
 
 Full pin table: `references/versions.md` in `cratis-screenplay-toolchain`. Re-check the three
 Chronicle issues before relying on a constraint in a later release.
@@ -58,7 +58,7 @@ Chronicle issues before relying on a constraint in a later release.
 **Skip if** the user or the model already states the stream identities, who owns each module, how
 much autonomy each side has, the external systems, and rough growth. Otherwise ask only what is
 missing, one question at a time, with options. **Unattended:** assume the most conservative
-option, mark it `ASSUMED` in the slice or module `description` and in the session `STATE.md`
+option, mark it `ASSUMED` in the slice or module `documentation` and in the session `STATE.md`
 (`.ai-work/screenplay/<model-slug>/STATE.md`), and continue.
 
 1. **Instance.** "What is the real-world thing this stream is about, and when does it start and
@@ -103,8 +103,8 @@ option, mark it `ASSUMED` in the slice or module `description` and in the sessio
      `unique event`, `released by`); list every event that sets the claimed value;
    - a state-dependent rule not reducible to those: write `reads <View>` + `require <expr>
      message "..."` as stated intent (PLAY0268/0271 at binding are expected in design mode) and
-     mark it **NOT enforced in the model today** in the slice `description`, with requirement,
-     missing guarantee, race consequence and the named target enforcement. Add a `STATE.md` row
+     mark it **NOT enforced in the model today** in the slice `description` with the named target,
+     and record requirement, missing guarantee and race consequence in the slice `documentation`. Add a `STATE.md` row
      with an owner. A general "some rules are unsupported" note is not enough.
    - Forbidden: a caller-supplied copy of state in `require`, a boolean attestation input
      (`confirmsX == true`) standing in for a rule, and rules hidden in `handler` or
@@ -118,7 +118,7 @@ option, mark it `ASSUMED` in the slice or module `description` and in the sessio
 4. **Set granularity.** One decision usually records one event; several facts are fine when each
    is a fact the business recognises. Different meanings get different events, not a flag with
    nullable siblings. Event properties are required by default (CHR0012, PLAY0350): an optional
-   detail is a separate event, and any deviation is justified in the description. One data
+   detail is a separate event, and any deviation is justified in the event's `documentation`. One data
    subject per event; never personal data, a secret, or a `pii`/`secret` concept as
    identifier or subject (CHR0034, CHR0052, PLAY0515/0592). Use a surrogate identity
    and protected payload. A stream identity and an event's data subject may differ:
@@ -134,7 +134,7 @@ option, mark it `ASSUMED` in the slice or module `description` and in the sessio
    interface and processor inventory, one real interaction walked across each boundary, coupling
    check. Keep team, module, stream and deployment boundaries distinct; inbound facts via
    Translate; unresolved decisions stay visible.
-7. **Record and gate.** Durable rationale in feature and slice `description`; open consistency
+7. **Record and gate.** Durable rationale in feature and slice `documentation`; open consistency
    decisions and capability gaps in `STATE.md`. Then the gate below.
 
 ## Rules
@@ -166,9 +166,10 @@ option, mark it `ASSUMED` in the slice or module `description` and in the sessio
 - Chronicle (open at v19.32.0): the SQL and InMemory providers do not settle unique claims
   (#3744); index updates run after commit and may fail silently (#4123); composite values can
   collide on the separator (#4131). A declared constraint is a declaration, not a runtime test.
-- `[ProtectedDecision]` is available in Arc v22.39.0 or later, **not** in Stage-rendered apps
-  (Arc 22.25.0). In a rendered app, record the rule as NOT enforced and choose the stream or
-  identity redesign (`references/consistency-and-concurrency.md`, section 3).
+- `[ProtectedDecision]` is available in Arc v22.39.0 or later, including Stage 4.51.3's
+  rendered package set. It is not emitted protection: gap-fill must enroll an admitted
+  decision read, or redesign the stream/identity when the shape is refused
+  (`references/consistency-and-concurrency.md`, section 3).
 
 **Modeling defaults** (deviate with a recorded reason)
 - One business identity per stream; cross-stream references are payload properties.
@@ -204,8 +205,8 @@ option, mark it `ASSUMED` in the slice or module `description` and in the sessio
 Do not report done until all hold; otherwise report what is open:
 - Every identifier has its identity sentence, the event-membership table and a justified decision.
 - Every rule has an invariant-table row with an exact construct or limitation reference.
-- Every `recorded` rule is in its slice `description` and `STATE.md` with requirement, missing
-  guarantee, race consequence and intended enforcement owner.
+- Every `recorded` rule has its NOT-enforced marker in the slice `description`, and its requirement,
+  missing guarantee, race consequence and intended enforcement owner in the slice `documentation` and `STATE.md`.
 - Every changed event has compatibility scenarios; identity changes were made by the identity owner.
 - Every changed boundary has a named owner (or `ASSUMED`), callers, processors and contracts.
 - Verdicts are stated V1-V5 per `cratis-screenplay-modeling-lifecycle`, each a result or "not run".

package/package/corpus/skills/cratis-screenplay-streams-and-consistency/references/boundaries.md

@@ -33,7 +33,7 @@ exchange does not make that decision atomic.
 Run it when ownership, autonomy or integration decisions are missing; skip it when the user or
 the model already states all three. Ask one question at a time, offer the options, and follow
 the trigger. Unattended: assume the most conservative option, mark it `ASSUMED` in the slice or
-module `description` and in `STATE.md`.
+module `description`, give the reason in its `documentation`, and add it to `STATE.md`.
 
 | # | Question (options) | Decides | Follow-up trigger |
 |---|---|---|---|
@@ -88,7 +88,7 @@ Processors: <trigger -> decision/effect -> result; operational owner>
 External: <system -> adapter owner -> contract>
 Open: <unresolved decisions, each also in STATE.md>
 ```
-Keep durable rationale in module, feature and slice descriptions and the record's `Open` lines in
+Keep durable rationale in module, feature and slice `documentation` and the record's `Open` lines in
 `STATE.md`. Do not build a second catalogue that duplicates the model.
 
 ## Cross-boundary walkthrough
@@ -137,7 +137,7 @@ integration support.
 - Treat a public event like a published API: evolution follows `evolution.md` with the
   consumers named, and breaking changes become new events.
 - Screenplay has no public/internal marker. Record the classification in the event's
-  `description`, and keep the list in `STATE.md`.
+  `documentation`, and keep the list in `STATE.md`.
 
 ## Crossing a boundary in Screenplay
 | Situation | Construct |

package/package/corpus/skills/cratis-screenplay-streams-and-consistency/references/chronicle-boundaries.md

@@ -10,8 +10,9 @@ event-source id) are present. Three runtime defects are **open at v19.32.0**: #3
 InMemory providers do not settle unique claims), #4123 (constraint index updates run after commit
 and fail silently) and #4131 (composite unique constraints collide when a component contains the
 separator). Arc **v22.50.5** has `[ProtectedDecision]` (since v22.39.0, needs Chronicle 19.23 or
-later); Stage-rendered apps pin Arc 22.25.0 and Chronicle client 19.8.1, so it is not available
-there (see `consistency-and-concurrency.md` section 3). Re-check the issues before relying on a
+later); Stage 4.51.3 rendered apps pin Arc 22.50.5 and Chronicle client/kernel
+19.32.0, so the APIs are available to gap-fill, not automatically emitted or
+protected (see `consistency-and-concurrency.md` section 3). Re-check the issues before relying on a
 constraint in a new release.
 A concurrency scope's first append is unchecked by default at v19.32.0; see
 SKILL.md, ‘First append into a scope’.

package/package/corpus/skills/cratis-screenplay-streams-and-consistency/references/consistency-and-concurrency.md

@@ -71,7 +71,8 @@ Right: write the rule as stated intent and mark it unenforced.
 - `reads <View> as x by …` plus `require <expr over x> message "…"` on the command (the
   `StateChange` slice in `streams-example.md`). Binding reports PLAY0271 / PLAY0268; that is
   expected in design mode, so keep the lines. Do not remove them to pass a tool.
-- Slice `description`, one block per rule:
+- Slice `description`: one short marker per rule, `NOT enforced in the model today; target: <mechanism>`.
+- Slice fenced `documentation`, one block per rule:
   - Requirement: the business rule in business words.
   - Status: NOT enforced in the model today (Screenplay#129, #209).
   - Decision inputs: the authoritative facts or state.
@@ -108,15 +109,17 @@ example a course capacity computed from enrolment streams, needs option a or b:
 deciding fact on the source that owns the state, or give each scarce item its own identity. Sources: Arc `v22.50.5:Documentation/backend/csharp/chronicle/read-models/injecting-into-commands.md`;
 `chronicle-boundaries.md`.
 
-**Availability caveat for Stage-rendered applications.** `cratis render` scaffolds Arc 22.25.0 and
-Chronicle client 19.8.1 (Stage v4.24.0), which predate `[ProtectedDecision]` and `DecisionRead<T>`.
-In a rendered app that attribute is not available, so a gap-fill handler cannot use it unless the
-application's Arc and Chronicle packages are upgraded as a separately approved change. When they
-are not, choose option a or b (put the deciding fact on the stream that owns the state, or give
-each scarce item its own identity and claim it with a constraint), or option c, and keep the rule
-**NOT enforced in the model today** in the slice description with the race consequence. Never
-claim protection for a rendered app because the rule is written as `reads` + `require`, and never
-weaken the rule to make it render.
+**Availability in Stage-rendered applications.** Stage v4.51.3 scaffolds Arc 22.50.5
+and Chronicle client/kernel 19.32.0. `[ProtectedDecision]` and `DecisionRead<T>` /
+`IDecisionReads` exist in that package set; source checks are in
+`cratis-stage-rendering-and-sandbox` `references/rendered-application.md`.
+This does not mean Stage emits protected decisions. Gap-fill must opt into the
+protected command profile, use an admitted projection/key shape and enroll the
+read in the active unit of work. For refused shapes choose option a/b (state on
+its owning stream or one identity per scarce item), or agreed compensation c.
+Keep the rule **NOT enforced in the model today** with its race consequence.
+Never infer protection from `.play` `reads` + `require`, weaken the rule to render,
+or edit managed dependency files. Older Stage 4.24.x scaffolds predate these APIs.
 
 ## 4. Concurrency scenarios
 For each enforced or recorded rule write three short scenarios:
@@ -153,7 +156,7 @@ The append may commit while the reply is lost. The caller retries. Decide per co
   rejection the caller must see; never report it as success;
 - **new identifier** -> duplicate unless a business-key constraint exists.
 The model shows only the rejection; payload comparison and outcome replay are target
-behaviour. Write the answer in the slice `description`.
+behaviour. Write the answer in the slice `documentation`.
 
 ## 7. Ordering
 - Within one source, facts are in append order. Across sources, do not assume an order

package/package/corpus/skills/cratis-screenplay-streams-and-consistency/references/evolution.md

@@ -16,7 +16,7 @@ compatibility scenarios below first; the identity owner then applies the change
 
 | Change | Old facts still mean the same? | Screenplay action | Edit class |
 |---|---|---|---|
-| add a property with a business-defined value for old facts | yes | new `generation N+1`, every generation declared in full in the same slice; record the default for old facts in the slice `description` | contract evolution |
+| add a property with a business-defined value for old facts | yes | new `generation N+1`, every generation declared in full in the same slice; record the default and its reason for old facts in slice `documentation` | contract evolution |
 | add a property with no sensible old value | the old fact lacks information | usually a **new event** for the new situation, or a separate fact recording the extra information | review with the expert |
 | remove a property | yes, if no reader needs it | new generation without it; every reference fails with PLAY0273 until removed | contract evolution, check readers |
 | change meaning (same name, different business fact) | **no** | **new event** with its own name; old event stays for history | identity: add, not rename |
@@ -28,7 +28,7 @@ A test for "generation or new event": a new version must be convertible from the
 without inventing facts. If it is not, it is a different event.
 
 ## Compatibility scenarios (write before editing)
-For each changed event, answer in the slice `description` or `STATE.md`:
+For each changed event, answer in the slice `documentation` or `STATE.md`:
 1. **Replay**: does every projection still build from generation 1 facts? Which value do old
    facts give the new property (default, absent, derived)?
 2. **Readers**: which projections, reactions, constraints, specifications and other modules

package/package/corpus/skills/cratis-screenplay-toolchain/references/diagnostics.md

@@ -5,6 +5,8 @@
 - Warnings that hide defects (always validate with `--warnings-as-errors`)
 - Source reference and identifier checks
 - Caller identity, compliance and routes
+- Specification metadata, callers, cases and locators
+- Guarded interaction diagnostics
 - Structural completeness and timeline checks
 - Editor versus C# verdicts
 - Consistency errors (V1: the model contradicts itself)
@@ -111,6 +113,52 @@ concept-subject, line-only `PreserveTrivia` repair, no document-root or pinned
 repair evidence. PLAY0565 supports one discovered `line` or a document-root
 migration. Preview every repair; legal notes never move automatically.
 
+## Specification metadata, callers, cases and locators
+
+Authority: Screenplay v4.127.0 `diagnostics.md`, `specifications.md`, `slices.md`.
+
+| Code | Severity | Meaning / fix |
+| --- | --- | --- |
+| PLAY0558 | E | Module/feature/slice/command/read-model/reaction documentation must be one nonempty fenced Markdown block; remove repeats or fix the fence. Events retain PLAY0477. |
+| PLAY0559 | W | Conflicting module/feature documentation across files; first wins. Choose one owning text; identical copies are accepted. |
+| PLAY0572 | E | Malformed/unknown persona caller or body lines; use a declared top-level persona with no body. |
+| PLAY0573 | E (binding) | Persona synthesis refused (no policies, negation, required non-literal/role-URI claim, opaque or unresolved policy); inspect persona/policy/reason and use explicit `given caller`. |
+| PLAY0574 | W | Opt-in `personas`: persona gates nothing. |
+| PLAY0575 | W | Opt-in `personas`: gate denies every synthesized persona; unknown is not denial. |
+| PLAY0576 | I | Opt-in `personas`: multiple unpinned buildable `or` alternatives; inspect chosen witness or pin a policy. |
+| PLAY0577/0578 | E | Malformed parameter/case header; typed parameter has no body/default, case has a name and at most one inline assignment. |
+| PLAY0579/0580 | E | Duplicate parameter/case name. |
+| PLAY0581/0582 | E | Need parameters and cases; every case assigns each parameter exactly once, no extra names. |
+| PLAY0583 | E | Case value is not concrete or cannot normalize to its type. |
+| PLAY0584 | E | Unknown parameter or excluded reference position (callers/redelivery locators/clocks/names/nested literal members). |
+| PLAY0585 | E | Optional parameter feeds required target. |
+| PLAY0586 | E | Derived `<Specification>_<Case>` collides in scope. |
+| PLAY0587 | E | Unknown or incompatible parameter/target type. |
+| PLAY0588 | W | Unused parameter; remove it or use it intentionally. |
+| PLAY0589 | E | Singular effective expansion cannot handle a table; use `ExpandAll`. |
+| PLAY0526 | E | Route in command/read-model example; only event examples carry routes. Top-level `streamId = value` is payload. |
+| PLAY0543 | E | Malformed redelivery or not exactly one definite match with no undecided candidate; narrow `for`, values, `stream` or `no stream`. |
+| PLAY0548 | E | Route on `when <Command>` only; put it on the command declaration. Does not fire on redelivery locators. |
+
+Descriptions/documentation are report-only PLAY0270, not executable conditions.
+Case tables and persona callers expand before binding without a new ESM version.
+Routes do not make redelivery executable: it still reports PLAY0268.
+
+## Guarded interaction diagnostics
+
+| Code | Severity | Meaning / fix |
+| --- | --- | --- |
+| PLAY0560 | E | Alternatives on a non-item trigger; only click/double click/select admit them. |
+| PLAY0561 | E | Alternatives mixed with plain actions or `where`; choose one form. |
+| PLAY0562 | E | Empty branch; supply a nonempty action list. |
+| PLAY0563 | E | One-line labeled-action `when … execute …` in an interaction; use an indented list. C# offers a typed repair. |
+| PLAY0564 | W/I | Item-trigger opaque `where` deprecated: a strict item condition warns with a C# repair to one `when`, no fallback; other text is information with no repair. Other triggers unchanged. |
+
+PLAY0563/0564 repairs need individual review and canonical formatting, refuse
+comment loss and do not support pinned evidence. TypeScript diagnoses but does
+not offer these repairs. Preview through MCP `propose-repair`, never text-patch
+around a refusal. Condition/subject errors also use guarded-action PLAY0341–0348.
+
 ## Structural completeness and timeline checks
 
 Opt in with `--check <names>` or MCP diagnostics `checks`, then treat warnings
@@ -126,6 +174,7 @@ as errors if gating. Ordinary compile success does not imply these ran:
 | navigation | PLAY0537 | Unreachable screens; unreachable cycles do not establish an entry point |
 | privilege | PLAY0652 | Elevated event-trigger producers must require every actor role; opaque gates are information, clock/application triggers exempt |
 | purposes | PLAY0602–0606 | Personal-data coverage, special/criminal safeguards, basis and unused-purpose prompts; union of ancestor/direct references |
+| personas | PLAY0574–0576 | Unused personas, unreachable gates and ambiguous buildable policy alternatives; unsynthesizable/undecidable is unknown |
 
 Whole-source errors skip completeness checks. Unknown/opaque coverage is not
 invented: report skipped status/coverage and walk field lineage manually.

package/package/corpus/skills/cratis-screenplay-toolchain/references/renderable-subset.md

@@ -96,9 +96,12 @@ legacy ids or drop protected ids into routing to fit a renderer (PLAY0515).
   `Customizations/styles.css`. The planner never reads it, and it never binds a modeled
   reaction or capture. A customization never makes a rejected model renderable.
 - `cratis render` does **not** build, test or run the application.
-- The scaffold pins .NET 10, Arc 22.25.0, Chronicle 19.8.1 and emits a `.frontend/` React/Vite
-  app (Components 4.14.0, Scene 4.2.0). `Directory.Packages.props` is Stage-managed: do not
-  edit it. `[ProtectedDecision]` (Arc v22.39.0) is not available in a rendered application.
+- Stage 4.51.3's scaffold pins .NET 10, Arc 22.50.5, Chronicle client/kernel 19.32.0
+  and emits a `.frontend/` React/Vite app (Components 4.14.0, Scene 4.10.0).
+  `CratisEmbeddedScreenplayEnabled=false`; `Directory.Packages.props` is managed,
+  never edit it. `[ProtectedDecision]` / `DecisionRead<T>` are available to gap-fill,
+  not Stage-emitted enforcement; projection/key admission and unit-of-work enrollment
+  remain required. Source checks: Stage skill `references/rendered-application.md`.
 
 ## Reading V5
 

package/package/corpus/skills/cratis-screenplay-toolchain/references/traps.md

@@ -29,7 +29,7 @@ exact numbers are documented in the grammar. Compiler syntax: `cheat-sheet.md`.
 21. Quoted `import "x/*.play"` = my files; unquoted `import Ctx.Event` = another context's contract (does not bind: PLAY0268). [probed]
 22. Construct keywords are closed (`aggregate`, `saga`, `workflow` do not exist): PLAY0029 or PLAY0001/0022/0024.
 23. `@` escapes are mandatory for `tag`, `authorize`, `produces`, `reads`, `file`, `validate`, `sequence`, `occurred`, `causedBy`, `namespace`, `correlation`, `causation`, and projection `key`/`parent`/`with` as names.
-24. Comments do not survive canonicalizing edits (PLAY0288 reprint; `droppedCommentCount`); keep durable rationale in `description` text, not `//`.
+24. Canonicalizing edits can drop unplaceable comments (PLAY0288; inspect `droppedCommentCount`); keep durable rationale in fenced Markdown `documentation`, not `//`, and summaries in `description`. Documentation survives canonical printing but changes neither executable bytes nor `modelRevision`; it is not rendered code.
 25. MCP writes: propose, review, approval, apply by the identity owner (the session that owns the MCP connection); other subagents return edit requests; proposals are connection-local, at most 16 (`cratis-screenplay-model-authoring`).
 26. Operations/systems and exact numbers remain unadmitted. Sources/streams/routes bind and reference-execute as ESM v8 at 4.125.0; generated values/responses bind as v7. CLI 3.41.0 renders through v7 only, with construct-specific Stage refusals. Consult released grammar rather than inventing syntax from decisions.
 27. Translate vs Automation is semantic: external facts become local facts in `Translate`; in-app event-to-event goes in `Automation`.
@@ -43,8 +43,8 @@ exact numbers are documented in the grammar. Compiler syntax: `cheat-sheet.md`.
 34. A `from <Event> key <property>` routes only if every such event carries that property: an event that frees or updates a row keyed by another stream's id must carry that id in its payload, or the row never changes. Whether the compiler reports a missing key property is unverified [to probe]; check by hand.
 35. `description`/`documentation` are authoring metadata: board, MCP and Prologue show them; `cratis render` never does (Stage#178). A rule only in prose is unenforced in rendered code; make it a rule layer, a spec or a recorded target requirement.
 36. One unadmitted construct (operations, exact numbers, refusal/redelivery) blocks whole-model binding. Routing is admitted v8, not one of those constructs; CLI render's v7 boundary is a separate refusal. Do not remove routing or authorization to render a model.
-37. Personas are not in the ESM (Screenplay#254); specs cannot reference them. Write `given caller` as the roles/claims that stand for the persona.
-38. A rule that depends on stored state is `reads <View>` + `require <expr> message "..."` (stated intent; PLAY0268/0271 at binding are expected in design mode). The slice `description` must mark it NOT enforced in the model today (Screenplay#129/#209) and name the target: Arc `[ProtectedDecision]` + `DecisionRead<T>` (Arc v22.39.0 and later; not available in a Stage-rendered app on Arc 22.25.0), Chronicle DCB (`concurrency` scope), or a constraint where one fits. Forbidden: caller-supplied copies of state in `require`, boolean attestation inputs (`confirmsX == true`), rules hidden in `handler`/implementation-hint prose. An unguarded materialized read is unsafe for a protected decision.
+37. Personas remain outside ESM bytes, but 4.127.0 specifications accept `given caller as <Persona>`: one authenticated deterministic policy witness, not every matching caller. Inspect the chosen `or` branch; use explicit callers when synthesis is refused.
+38. A rule that depends on stored state is `reads <View>` + `require <expr> message "..."` (stated intent; PLAY0268/0271 at binding are expected in design mode). The slice `description` must mark it NOT enforced in the model today (Screenplay#129/#209) and name the target: Arc `[ProtectedDecision]` + `DecisionRead<T>` (Arc v22.39.0 and later; available to gap-fill on Stage 4.51.3's Arc 22.50.5/Chronicle 19.32.0, not emitted protection), Chronicle DCB (`concurrency` scope), or a constraint where one fits. Forbidden: caller-supplied copies of state in `require`, boolean attestation inputs (`confirmsX == true`), rules hidden in `handler`/implementation-hint prose. An unguarded materialized read is unsafe for a protected decision.
 
 Current identity/compliance traps (v4.127.0 `identity.md`, `concepts.md`, `events.md`,
 `purposes.md`, `diagnostics.md`):
@@ -69,4 +69,4 @@ The SKILL.md top 12: 1, 4, 5, 6, 7, 10, 12, 13, 17, 18, 20, 21 (+ mode/version n
 41. MCP roots bug (4.63.1 and earlier, including the 4.60.1 bundled by cratis before 3.28.2; not present in 4.66.0 or cratis 3.28.2, probed): a dynamic-root server answers the roots request with an `id: null` error right after `notifications/initialized`; hosts treat it as fatal. `open-workspace.path` does not help. Start with a fixed root (`screenplay mcp <folder>`, `cratis screenplay mcp` in a project with `.cratis/ai.json`) or use 4.63.2 or later (cratis 3.28.2 or later). [source, probed]
 42. A symlinked model path is refused by the MCP server (macOS `/tmp` is a symlink); pass the physical path. Proposals are connection-local (at most 16); `apply` persists identities to `.screenplay/identities.json` and is not crash-atomic across files; never retry `apply` after `ApplyOutcomeUnknown`. [source]
 43. `modelRevision` is canonical semantic (line positions and descriptions do not change it; a file move only if it changes logical placement or application identity) and, without `identities.json`, changes with the root folder name; it is not comparable with a render's `semanticRevision`. Source identity for verdicts is the commit plus the digest from the source-identity helper (`cratis-screenplay-modeling-lifecycle` `references/verdicts-and-modes.md` "Source identity"). [probed]
-44. `cratis render` neither builds nor tests; `--name` is required for plain source; `.cratis-render/` is control state and is never staged; Stage-rendered apps are on Arc 22.25.0 (no `[ProtectedDecision]`). `cratis` file mode versus folder mode (trap 6) and a stale `cratis` on `PATH` (`which -a cratis`) both silently change what a verdict means. [source]
+44. `cratis render` neither builds nor tests; `--name` is required for plain source; `.cratis-render/` is control state and is never staged; Stage 4.51.3 rendered apps pin Arc 22.50.5/Chronicle 19.32.0 (`[ProtectedDecision]` available to gap-fill, not automatically emitted). `cratis` file mode versus folder mode (trap 6) and a stale `cratis` on `PATH` (`which -a cratis`) both silently change what a verdict means. [source]

package/package/corpus/skills/cratis-screenplay-toolchain/references/versions.md

@@ -23,6 +23,7 @@ probe; older probes retain their original labels in the other references.
 | Stage bundled by CLI | **4.51.3** | Same file; the CLI's runtime image follows its Stage package version |
 | Cratis.Arc.Screenplay bundled by CLI | **22.54.0** | Same file; this is the generator package, not a blanket rendered-app dependency pin |
 | Chronicle / Fundamentals bundled by CLI | **19.32.0 / 7.22.8** | Same file |
+| Stage 4.51.3 rendered backend | **Arc 22.50.5 / Chronicle 19.32.0** | Stage `v4.51.3:Source/Rendering.Cratis/Scaffolding/CratisBackendApplicationScaffoldProfile.cs`; client/testing/image match; scaffold disables embedded reverse extraction |
 
 Check the actual executable before relying on this table: `screenplay --version`,
 `cratis --version`, MCP `initialize` → `serverInfo.version`. An older executable
@@ -93,6 +94,15 @@ PLAY0565 information, duplicates warn PLAY0653. Event `subject` and processing
 purposes are report-only metadata (PLAY0270); purpose checks/reports do not prove
 lawfulness or enforce retention. See command-surface context/compliance references.
 
+Authoring features source-checked in standalone 4.127.0: `propose-source`,
+`find-specification-obligations`, `find-modeling-smells`, specification descriptions,
+container/command/read-model/reaction documentation, routed redelivery locators,
+guarded item interactions, persona callers and named case tables. Discover schemas
+in the older CLI bundle rather than assuming parity. Cases/persona callers expand
+to ordinary ESM; metadata changes no executable bytes. Redelivery remains
+unadmitted even when its route is valid. Details: model-authoring MCP references,
+specifications, UI composition and `diagnostics.md`.
+
 ## Historical probes
 
 - Screenplay 4.68.0 admitted v7; CLI 3.28.2/3.28.3 bundled 4.66.0 (v6 at most),

package/package/corpus/skills/cratis-screenplay-ui-composition/SKILL.md

@@ -240,8 +240,10 @@ acts. Three words carry it:
 | **Action** | a closed set: `execute`, `navigate to`/`navigate back`, `open dialog`/`close dialog`, `refresh`, `set … to`, `notify`, `confirm`, `raise` |
 | **Behavior** | a bundle of trigger-to-action bindings; inline (`on …`) or named (`behavior` + `uses`) |
 
-A complete example — a named behavior with parameters, attached with `uses`, and
-an inline `on` block with a continuation:
+Guarded alternatives and `where` deprecation:
+[guarded interactions](references/guarded-interactions.md).
+
+Complete named/inline behavior example:
 
 ```screenplay
 concept InvoiceId : Uuid

package/package/corpus/skills/cratis-screenplay-ui-composition/references/guarded-interactions.md

@@ -0,0 +1,71 @@
+<!-- Copyright (c) Cratis. All rights reserved. -->
+<!-- Licensed under the MIT license. See LICENSE file in the project root for full license information. -->
+
+# Choose a gesture's whole action list
+
+`on click`, `on double click` and `on select` accept ordered block-form `when`
+alternatives and an optional final `otherwise`. Use the same strict condition
+language and data-item subject as [guarded screen actions](../../cratis-screenplay-read-surface/references/guarded-actions.md):
+`item.<path>` compared with a literal, joined by `and`, `or` and parentheses.
+At least one `when` and a nonempty action list in every branch are required.
+Do not mix alternatives with plain actions or `where`; a one-line
+`when … execute …` belongs to labeled actions, not interactions.
+
+This complete model validates on standalone Screenplay 4.127.0:
+
+```screenplay
+module Billing
+  feature Invoices
+    slice StateView InvoiceHistory
+      event InvoiceRecorded
+        status String
+      readmodel InvoiceView
+        invoiceId String
+        status String
+      projection Invoices => InvoiceView
+        from InvoiceRecorded
+          invoiceId = $eventSourceId
+          status = status
+      query InvoiceById => InvoiceView optional
+        by invoiceId String
+      screen InvoiceDetails
+        data InvoiceView via query InvoiceById by invoiceId
+        table InvoiceView
+          column status
+          on double click
+            when item.status == "draft"
+              notify info "The draft can be edited"
+              refresh InvoiceById
+            otherwise
+              notify info "Only drafts can be edited"
+```
+
+The first matching branch runs once on the rendered item at gesture time, without
+refetch or re-evaluation while its list runs. No match uses fallback or does
+nothing; **no subject does nothing, including fallback**. Failure, denial or an
+unavailable command never falls through; backend commands retain their rules.
+Unlike labeled actions, no choice was displayed beforehand to refresh at click.
+
+A table click/double click uses the activated row; select uses the newly selected
+item, and clearing selection runs nothing. Elsewhere use the nearest enclosing
+single item or selected row, with guarded actions' sibling precedence. Check named
+behaviors at each `uses` site. Component `context` or `selectedItem` bindings do
+not supply the subject in this version; unresolved/equally near subjects report
+PLAY0346.
+
+Submit, event, change, interval and application triggers have no alternatives.
+The one-line `on row-click navigate to … by …` remains unchanged. Opaque `where`
+on click/double click/select is deprecated (PLAY0564): strict item conditions warn
+and C# offers a typed repair to one `when` with no fallback; other guard text is
+Information without repair. Other triggers' `where` remains unchanged. Repairs
+require individual review, canonical formatting, preserve comments and refuse
+comment loss; TypeScript diagnoses but offers no repair. PLAY0563 has a C# repair
+expanding a one-line alternative to the block form. Neither repair supports
+pinned evidence.
+
+UI is deferred from backend ESM (PLAY0269), not executable gesture proof. The
+board draws a static prototype; renderers must explicitly admit alternatives or
+report unsupported, never flatten them into plain actions.
+
+Authority: Screenplay v4.127.0 `interactions.md`, `diagnostics.md`,
+`mcp/authoring-tools.md`; decision 0048.