@cratis/pi 7.23.0 → 7.25.0

package/package/corpus/skills/cratis-screenplay-specifications/references/persona-callers-and-cases.md

@@ -0,0 +1,117 @@
+<!-- Copyright (c) Cratis. All rights reserved. -->
+<!-- Licensed under the MIT license. See LICENSE file in the project root for full license information. -->
+
+# Persona callers and named case tables
+
+## Contents
+
+- Persona callers
+- Case tables
+
+Authority: Screenplay v4.127.0 `specifications.md`, `personas.md` and `mcp/reference.md`.
+
+## Persona callers
+
+`given caller as <Persona>` has no body and cannot coexist with an explicit
+`given caller`. It expands before binding into an ordinary authenticated caller
+satisfying every persona policy; persona names remain outside ESM bytes. Required
+atoms are collected first. Policies are visited in declared order, depth first,
+left to right: an already satisfied `or` adds nothing, otherwise the leftmost
+buildable alternative wins. Operand order matters. This witnesses one minimal
+caller, not every caller fitting the persona.
+
+Synthesis refuses no policies, any policy containing `not` (including
+`not authenticated`), inline/file policy code, and required non-literal claims.
+An `or` may skip an unsupported claim alternative. The role-URI claim type
+`http://schemas.microsoft.com/ws/2008/06/identity/claims/role` is never synthesized;
+use role atoms, not that claim. Use explicit `given caller` when synthesis is
+refused (binding PLAY0573), never infer a runtime allow/deny. Malformed references,
+body lines or unknown top-level personas report PLAY0572.
+
+Hover or `declaration-details` (`kind: "Persona"`, `view: "caller"`) shows the
+chosen caller and policy contributions or refusal. Opt-in `personas` completeness
+checks report personas gating nothing (PLAY0574), gates denying every known
+synthesized persona (PLAY0575), and unpinned buildable alternatives (PLAY0576).
+Unsynthesizable/undecidable callers are unknown, not denials. A persona-backed
+denial still uses `then denied`; a visitor persona is not an anonymous caller.
+
+## Case tables
+
+Use tables for validation matrices whose steps stay the same. Rows are **cases**,
+not examples: `example` means a named typed fixture. This complete model's five
+expanded specifications pass in the 4.127.0 reference runner:
+
+```screenplay
+policy IsAccountant
+  require role "Accountant"
+policy IsVisitor
+  require role "Visitor"
+persona Accountant
+  policy IsAccountant
+persona Visitor
+  policy IsVisitor
+module Billing
+  feature Invoices
+    slice StateChange RecordAmount
+      command RecordAmount
+        recordId String identifier
+        amount Int
+        authorize IsAccountant
+        validate
+          require amount > 0
+            message "The amount must be positive"
+        produces AmountRecorded
+          for recordId
+          amount = amount
+      event AmountRecorded
+        amount Int
+      specification RecordingAmounts
+        description "An accountant can record a positive amount"
+        parameter amount Int
+        case Small amount = 10
+        case Large amount = 100
+        given caller as Accountant
+        when RecordAmount amount = case.amount
+          recordId = "amount-1"
+        then AmountRecorded amount = case.amount
+      specification RejectingAmounts
+        parameter amount Int
+        parameter reason String
+        case Zero
+          amount = 0
+          reason = "The amount must be positive"
+        case Negative
+          amount = -1
+          reason = "The amount must be positive"
+        given caller as Accountant
+        when RecordAmount amount = case.amount
+          recordId = "amount-1"
+        then error case.reason
+      specification RefusingAVisitor
+        given caller as Visitor
+        when RecordAmount amount = 10
+          recordId = "amount-1"
+        then denied
+```
+
+Every case assigns every typed parameter exactly once, inline or indented.
+Values are concrete literals or whole single-line objects/lists, never mappings,
+`$` expressions, examples or other case references. `optional` permits `null`,
+not omission or a default; ordinary command/event null restrictions still apply.
+
+`case.<parameter>` fills a whole value position, after example expansion and step
+overrides. It works in step assignments, generated fixtures, query arguments and
+results, `for`, absent read-model keys and scalar `streamId` mappings in a restated
+route. Types must match (concept/underlying primitive in either direction is
+allowed); optional cannot feed required. `then error case.reason` needs String.
+Callers, redelivery locators, clocks, declaration names, step kinds and members
+inside structured literals cannot use case values: pass the whole object/list.
+
+Each case expands independently to `<Specification>_<Case>`, in case order,
+inheriting the description, with the same executable bytes as hand-expanded
+specifications. Derived names must not collide in scope. Failures name the case.
+Selecting a table address in `run-specifications` or `screenplay test --filter`
+selects all cases; a derived address selects one. MCP specification `cases` pages
+effective addresses and values; `find-fixtures` accepts `case` and retains
+`table`, `case`, `caseParameter` provenance. C# singular `Expand` refuses tables
+(PLAY0589); use `SpecificationExamples.ExpandAll`.

package/package/corpus/skills/cratis-screenplay-specifications/references/reactions-and-cascades.md

@@ -5,7 +5,7 @@ tick, a trigger or a capture record, each new fact runs the reactions to its eve
 and what those append or invoke runs more, until nothing is left. `then` events
 compare every new fact, the action's and the reactions'.
 
-```screenplay
+```screenplay expect PLAY0469
 concept InvoiceId : Uuid
 module Collections
   feature Invoices

package/package/corpus/skills/cratis-screenplay-specifications/verification.json

@@ -3,6 +3,7 @@
   "input": "Write given/when/then specifications for a Screenplay slice.",
   "fixtures": [],
   "assertions": [
+    { "kind": "play-compiles" },
     {
       "kind": "skill-contains",
       "value": "main `fd18129`"
@@ -41,7 +42,7 @@
     },
     {
       "kind": "skill-contains",
-      "value": "**Authorized commands and queries need `given caller`**"
+      "value": "**Authorized commands and queries need `given caller` or `given caller as <Persona>`**"
     },
     {
       "kind": "skill-contains",

package/package/corpus/skills/cratis-screenplay-streams-and-consistency/SKILL.md

@@ -28,8 +28,8 @@ Require target evidence that the check ran: a concurrent first-append scenario a
 Chronicle, asserting one append wins, one is rejected, and `IAppendResult.ConcurrencyCheckPerformed`
 is `true` (a skipped check and a passing one look identical otherwise; a current client against
 an older kernel always reads `false`). This was source- and documentation-inspected, not
-concurrency-tested here. Stage-rendered apps pin Chronicle client 19.8.1: do not assume these
-APIs exist there; confirm the package version before recommending them.
+concurrency-tested here. Stage 4.51.3 rendered apps pin Chronicle client/kernel 19.32.0
+and Arc 22.50.5; the APIs exist for gap-fill, not as automatically rendered enforcement.
 
 ## Verified product sources
 
@@ -38,7 +38,7 @@ APIs exist there; confirm the package version before recommending them.
 | Screenplay | v4.68.0 (`79801bf`) | ESM v7 generated values (`generated identifier`, decision 0026) and decision 0025's numbering; the diagnostics below were read at v4.66.0 (`c89198b`): `identifier`, `for`, constraints, generations, `id` pins, diagnostics PLAY0019/0135/0268/0271/0273/0391-0393/0446-0449/0469/0471 |
 | Chronicle | v19.32.0 (`f17a2ff`) | CHR0012, CHR0034; open defects #3744, #4123, #4131 |
 | Arc | v22.50.5 | `[ProtectedDecision]` and `DecisionRead<T>` (since v22.39.0) |
-| Stage | v4.24.2 | rendered apps pin Arc 22.25.0 and Chronicle client 19.8.1 (unchanged from 4.24.0); admits ESM v4 but refuses evolved events with `STAGE-ESM-026` (migrations not rendered, Stage#204) |
+| Stage | v4.51.3 | rendered apps pin Arc 22.50.5 and Chronicle client/kernel 19.32.0; protected-read APIs available to gap-fill. Historical 4.24.2 admission probe: ESM v4, evolved events refused with `STAGE-ESM-026` |
 
 Full pin table: `references/versions.md` in `cratis-screenplay-toolchain`. Re-check the three
 Chronicle issues before relying on a constraint in a later release.
@@ -58,7 +58,7 @@ Chronicle issues before relying on a constraint in a later release.
 **Skip if** the user or the model already states the stream identities, who owns each module, how
 much autonomy each side has, the external systems, and rough growth. Otherwise ask only what is
 missing, one question at a time, with options. **Unattended:** assume the most conservative
-option, mark it `ASSUMED` in the slice or module `description` and in the session `STATE.md`
+option, mark it `ASSUMED` in the slice or module `documentation` and in the session `STATE.md`
 (`.ai-work/screenplay/<model-slug>/STATE.md`), and continue.
 
 1. **Instance.** "What is the real-world thing this stream is about, and when does it start and
@@ -103,8 +103,8 @@ option, mark it `ASSUMED` in the slice or module `description` and in the sessio
      `unique event`, `released by`); list every event that sets the claimed value;
    - a state-dependent rule not reducible to those: write `reads <View>` + `require <expr>
      message "..."` as stated intent (PLAY0268/0271 at binding are expected in design mode) and
-     mark it **NOT enforced in the model today** in the slice `description`, with requirement,
-     missing guarantee, race consequence and the named target enforcement. Add a `STATE.md` row
+     mark it **NOT enforced in the model today** in the slice `description` with the named target,
+     and record requirement, missing guarantee and race consequence in the slice `documentation`. Add a `STATE.md` row
      with an owner. A general "some rules are unsupported" note is not enough.
    - Forbidden: a caller-supplied copy of state in `require`, a boolean attestation input
      (`confirmsX == true`) standing in for a rule, and rules hidden in `handler` or
@@ -118,7 +118,7 @@ option, mark it `ASSUMED` in the slice or module `description` and in the sessio
 4. **Set granularity.** One decision usually records one event; several facts are fine when each
    is a fact the business recognises. Different meanings get different events, not a flag with
    nullable siblings. Event properties are required by default (CHR0012, PLAY0350): an optional
-   detail is a separate event, and any deviation is justified in the description. One data
+   detail is a separate event, and any deviation is justified in the event's `documentation`. One data
    subject per event; never personal data, a secret, or a `pii`/`secret` concept as
    identifier or subject (CHR0034, CHR0052, PLAY0515/0592). Use a surrogate identity
    and protected payload. A stream identity and an event's data subject may differ:
@@ -134,7 +134,7 @@ option, mark it `ASSUMED` in the slice or module `description` and in the sessio
    interface and processor inventory, one real interaction walked across each boundary, coupling
    check. Keep team, module, stream and deployment boundaries distinct; inbound facts via
    Translate; unresolved decisions stay visible.
-7. **Record and gate.** Durable rationale in feature and slice `description`; open consistency
+7. **Record and gate.** Durable rationale in feature and slice `documentation`; open consistency
    decisions and capability gaps in `STATE.md`. Then the gate below.
 
 ## Rules
@@ -166,9 +166,10 @@ option, mark it `ASSUMED` in the slice or module `description` and in the sessio
 - Chronicle (open at v19.32.0): the SQL and InMemory providers do not settle unique claims
   (#3744); index updates run after commit and may fail silently (#4123); composite values can
   collide on the separator (#4131). A declared constraint is a declaration, not a runtime test.
-- `[ProtectedDecision]` is available in Arc v22.39.0 or later, **not** in Stage-rendered apps
-  (Arc 22.25.0). In a rendered app, record the rule as NOT enforced and choose the stream or
-  identity redesign (`references/consistency-and-concurrency.md`, section 3).
+- `[ProtectedDecision]` is available in Arc v22.39.0 or later, including Stage 4.51.3's
+  rendered package set. It is not emitted protection: gap-fill must enroll an admitted
+  decision read, or redesign the stream/identity when the shape is refused
+  (`references/consistency-and-concurrency.md`, section 3).
 
 **Modeling defaults** (deviate with a recorded reason)
 - One business identity per stream; cross-stream references are payload properties.
@@ -204,8 +205,8 @@ option, mark it `ASSUMED` in the slice or module `description` and in the sessio
 Do not report done until all hold; otherwise report what is open:
 - Every identifier has its identity sentence, the event-membership table and a justified decision.
 - Every rule has an invariant-table row with an exact construct or limitation reference.
-- Every `recorded` rule is in its slice `description` and `STATE.md` with requirement, missing
-  guarantee, race consequence and intended enforcement owner.
+- Every `recorded` rule has its NOT-enforced marker in the slice `description`, and its requirement,
+  missing guarantee, race consequence and intended enforcement owner in the slice `documentation` and `STATE.md`.
 - Every changed event has compatibility scenarios; identity changes were made by the identity owner.
 - Every changed boundary has a named owner (or `ASSUMED`), callers, processors and contracts.
 - Verdicts are stated V1-V5 per `cratis-screenplay-modeling-lifecycle`, each a result or "not run".

package/package/corpus/skills/cratis-screenplay-streams-and-consistency/references/boundaries.md

@@ -33,7 +33,7 @@ exchange does not make that decision atomic.
 Run it when ownership, autonomy or integration decisions are missing; skip it when the user or
 the model already states all three. Ask one question at a time, offer the options, and follow
 the trigger. Unattended: assume the most conservative option, mark it `ASSUMED` in the slice or
-module `description` and in `STATE.md`.
+module `description`, give the reason in its `documentation`, and add it to `STATE.md`.
 
 | # | Question (options) | Decides | Follow-up trigger |
 |---|---|---|---|
@@ -88,7 +88,7 @@ Processors: <trigger -> decision/effect -> result; operational owner>
 External: <system -> adapter owner -> contract>
 Open: <unresolved decisions, each also in STATE.md>
 ```
-Keep durable rationale in module, feature and slice descriptions and the record's `Open` lines in
+Keep durable rationale in module, feature and slice `documentation` and the record's `Open` lines in
 `STATE.md`. Do not build a second catalogue that duplicates the model.
 
 ## Cross-boundary walkthrough
@@ -137,7 +137,7 @@ integration support.
 - Treat a public event like a published API: evolution follows `evolution.md` with the
   consumers named, and breaking changes become new events.
 - Screenplay has no public/internal marker. Record the classification in the event's
-  `description`, and keep the list in `STATE.md`.
+  `documentation`, and keep the list in `STATE.md`.
 
 ## Crossing a boundary in Screenplay
 | Situation | Construct |

package/package/corpus/skills/cratis-screenplay-streams-and-consistency/references/chronicle-boundaries.md

@@ -10,8 +10,9 @@ event-source id) are present. Three runtime defects are **open at v19.32.0**: #3
 InMemory providers do not settle unique claims), #4123 (constraint index updates run after commit
 and fail silently) and #4131 (composite unique constraints collide when a component contains the
 separator). Arc **v22.50.5** has `[ProtectedDecision]` (since v22.39.0, needs Chronicle 19.23 or
-later); Stage-rendered apps pin Arc 22.25.0 and Chronicle client 19.8.1, so it is not available
-there (see `consistency-and-concurrency.md` section 3). Re-check the issues before relying on a
+later); Stage 4.51.3 rendered apps pin Arc 22.50.5 and Chronicle client/kernel
+19.32.0, so the APIs are available to gap-fill, not automatically emitted or
+protected (see `consistency-and-concurrency.md` section 3). Re-check the issues before relying on a
 constraint in a new release.
 A concurrency scope's first append is unchecked by default at v19.32.0; see
 SKILL.md, ‘First append into a scope’.

package/package/corpus/skills/cratis-screenplay-streams-and-consistency/references/consistency-and-concurrency.md

@@ -71,7 +71,8 @@ Right: write the rule as stated intent and mark it unenforced.
 - `reads <View> as x by …` plus `require <expr over x> message "…"` on the command (the
   `StateChange` slice in `streams-example.md`). Binding reports PLAY0271 / PLAY0268; that is
   expected in design mode, so keep the lines. Do not remove them to pass a tool.
-- Slice `description`, one block per rule:
+- Slice `description`: one short marker per rule, `NOT enforced in the model today; target: <mechanism>`.
+- Slice fenced `documentation`, one block per rule:
   - Requirement: the business rule in business words.
   - Status: NOT enforced in the model today (Screenplay#129, #209).
   - Decision inputs: the authoritative facts or state.
@@ -108,15 +109,17 @@ example a course capacity computed from enrolment streams, needs option a or b:
 deciding fact on the source that owns the state, or give each scarce item its own identity. Sources: Arc `v22.50.5:Documentation/backend/csharp/chronicle/read-models/injecting-into-commands.md`;
 `chronicle-boundaries.md`.
 
-**Availability caveat for Stage-rendered applications.** `cratis render` scaffolds Arc 22.25.0 and
-Chronicle client 19.8.1 (Stage v4.24.0), which predate `[ProtectedDecision]` and `DecisionRead<T>`.
-In a rendered app that attribute is not available, so a gap-fill handler cannot use it unless the
-application's Arc and Chronicle packages are upgraded as a separately approved change. When they
-are not, choose option a or b (put the deciding fact on the stream that owns the state, or give
-each scarce item its own identity and claim it with a constraint), or option c, and keep the rule
-**NOT enforced in the model today** in the slice description with the race consequence. Never
-claim protection for a rendered app because the rule is written as `reads` + `require`, and never
-weaken the rule to make it render.
+**Availability in Stage-rendered applications.** Stage v4.51.3 scaffolds Arc 22.50.5
+and Chronicle client/kernel 19.32.0. `[ProtectedDecision]` and `DecisionRead<T>` /
+`IDecisionReads` exist in that package set; source checks are in
+`cratis-stage-rendering-and-sandbox` `references/rendered-application.md`.
+This does not mean Stage emits protected decisions. Gap-fill must opt into the
+protected command profile, use an admitted projection/key shape and enroll the
+read in the active unit of work. For refused shapes choose option a/b (state on
+its owning stream or one identity per scarce item), or agreed compensation c.
+Keep the rule **NOT enforced in the model today** with its race consequence.
+Never infer protection from `.play` `reads` + `require`, weaken the rule to render,
+or edit managed dependency files. Older Stage 4.24.x scaffolds predate these APIs.
 
 ## 4. Concurrency scenarios
 For each enforced or recorded rule write three short scenarios:
@@ -153,7 +156,7 @@ The append may commit while the reply is lost. The caller retries. Decide per co
   rejection the caller must see; never report it as success;
 - **new identifier** -> duplicate unless a business-key constraint exists.
 The model shows only the rejection; payload comparison and outcome replay are target
-behaviour. Write the answer in the slice `description`.
+behaviour. Write the answer in the slice `documentation`.
 
 ## 7. Ordering
 - Within one source, facts are in append order. Across sources, do not assume an order

package/package/corpus/skills/cratis-screenplay-streams-and-consistency/references/evolution.md

@@ -16,7 +16,7 @@ compatibility scenarios below first; the identity owner then applies the change
 
 | Change | Old facts still mean the same? | Screenplay action | Edit class |
 |---|---|---|---|
-| add a property with a business-defined value for old facts | yes | new `generation N+1`, every generation declared in full in the same slice; record the default for old facts in the slice `description` | contract evolution |
+| add a property with a business-defined value for old facts | yes | new `generation N+1`, every generation declared in full in the same slice; record the default and its reason for old facts in slice `documentation` | contract evolution |
 | add a property with no sensible old value | the old fact lacks information | usually a **new event** for the new situation, or a separate fact recording the extra information | review with the expert |
 | remove a property | yes, if no reader needs it | new generation without it; every reference fails with PLAY0273 until removed | contract evolution, check readers |
 | change meaning (same name, different business fact) | **no** | **new event** with its own name; old event stays for history | identity: add, not rename |
@@ -28,7 +28,7 @@ A test for "generation or new event": a new version must be convertible from the
 without inventing facts. If it is not, it is a different event.
 
 ## Compatibility scenarios (write before editing)
-For each changed event, answer in the slice `description` or `STATE.md`:
+For each changed event, answer in the slice `documentation` or `STATE.md`:
 1. **Replay**: does every projection still build from generation 1 facts? Which value do old
    facts give the new property (default, absent, derived)?
 2. **Readers**: which projections, reactions, constraints, specifications and other modules

package/package/corpus/skills/cratis-screenplay-streams-and-consistency/references/streams-example.md

@@ -9,7 +9,7 @@ The model compiles at 4.127.0 (V1, warnings as errors) but is not binding-ready
 concept fails binding (PLAY0268), `reads` and the `concurrency` block are PLAY0271, and
 `require` over a view is PLAY0268. Keep those lines: they state real intent.
 
-```screenplay
+```screenplay expect PLAY0516 test=unbound
 // cratis-screenplay-streams-and-consistency: complete design-mode example (V1 with --warnings-as-errors).
 // Shows: one business identity per stream, cross-stream references as payload, uniqueness
 // constraints (single, composite with release, unique event), a recorded state-dependent rule

package/package/corpus/skills/cratis-screenplay-streams-and-consistency/verification.json

@@ -3,6 +3,7 @@
   "input": "Review the stream identities in our Screenplay model, tell me whether two people can enrol in the last seat at once, and what happens when a client retries after a lost reply.",
   "fixtures": [],
   "assertions": [
+    { "kind": "play-compiles" },
     { "kind": "skill-contains", "value": "one business identity per stream" },
     { "kind": "skill-contains", "value": "NOT enforced in the model today" },
     { "kind": "skill-contains", "value": "#3744" },

package/package/corpus/skills/cratis-screenplay-toolchain/references/cheat-sheet-example.md

@@ -4,7 +4,7 @@ One complete document with every construct family. Design mode, not executable.
 
 Binding blockers: unquoted import, `pii`, `reads` (PLAY0271), `starts with`, observable/list/filter query. Executable shapes are in the sibling examples. The bare-marker fence compiles warning-free on standalone 4.127.0; the earlier legacy-marker version compiled on 4.66.0 and CLI 3.28.2. `RecordingAPayment` lists the `InvoiceClosed` cascade, which the cratis 3.27.1 bundle (4.60.1) rejected with a false PLAY0285 ("outcome cannot be produced by 'RecordPayment'"); 3.28.2 accepts it.
 
-```screenplay
+```screenplay test=unbound
 // Design-mode cheat-sheet: every construct family; compiles warning-free on the standalone tool.
 domain Acme.Invoicing                      // optional; first line when present
 import Customers.CustomerRegistered        // unquoted = another bounded context's contract

package/package/corpus/skills/cratis-screenplay-toolchain/references/diagnostics.md

@@ -5,6 +5,8 @@
 - Warnings that hide defects (always validate with `--warnings-as-errors`)
 - Source reference and identifier checks
 - Caller identity, compliance and routes
+- Specification metadata, callers, cases and locators
+- Guarded interaction diagnostics
 - Structural completeness and timeline checks
 - Editor versus C# verdicts
 - Consistency errors (V1: the model contradicts itself)
@@ -111,6 +113,52 @@ concept-subject, line-only `PreserveTrivia` repair, no document-root or pinned
 repair evidence. PLAY0565 supports one discovered `line` or a document-root
 migration. Preview every repair; legal notes never move automatically.
 
+## Specification metadata, callers, cases and locators
+
+Authority: Screenplay v4.127.0 `diagnostics.md`, `specifications.md`, `slices.md`.
+
+| Code | Severity | Meaning / fix |
+| --- | --- | --- |
+| PLAY0558 | E | Module/feature/slice/command/read-model/reaction documentation must be one nonempty fenced Markdown block; remove repeats or fix the fence. Events retain PLAY0477. |
+| PLAY0559 | W | Conflicting module/feature documentation across files; first wins. Choose one owning text; identical copies are accepted. |
+| PLAY0572 | E | Malformed/unknown persona caller or body lines; use a declared top-level persona with no body. |
+| PLAY0573 | E (binding) | Persona synthesis refused (no policies, negation, required non-literal/role-URI claim, opaque or unresolved policy); inspect persona/policy/reason and use explicit `given caller`. |
+| PLAY0574 | W | Opt-in `personas`: persona gates nothing. |
+| PLAY0575 | W | Opt-in `personas`: gate denies every synthesized persona; unknown is not denial. |
+| PLAY0576 | I | Opt-in `personas`: multiple unpinned buildable `or` alternatives; inspect chosen witness or pin a policy. |
+| PLAY0577/0578 | E | Malformed parameter/case header; typed parameter has no body/default, case has a name and at most one inline assignment. |
+| PLAY0579/0580 | E | Duplicate parameter/case name. |
+| PLAY0581/0582 | E | Need parameters and cases; every case assigns each parameter exactly once, no extra names. |
+| PLAY0583 | E | Case value is not concrete or cannot normalize to its type. |
+| PLAY0584 | E | Unknown parameter or excluded reference position (callers/redelivery locators/clocks/names/nested literal members). |
+| PLAY0585 | E | Optional parameter feeds required target. |
+| PLAY0586 | E | Derived `<Specification>_<Case>` collides in scope. |
+| PLAY0587 | E | Unknown or incompatible parameter/target type. |
+| PLAY0588 | W | Unused parameter; remove it or use it intentionally. |
+| PLAY0589 | E | Singular effective expansion cannot handle a table; use `ExpandAll`. |
+| PLAY0526 | E | Route in command/read-model example; only event examples carry routes. Top-level `streamId = value` is payload. |
+| PLAY0543 | E | Malformed redelivery or not exactly one definite match with no undecided candidate; narrow `for`, values, `stream` or `no stream`. |
+| PLAY0548 | E | Route on `when <Command>` only; put it on the command declaration. Does not fire on redelivery locators. |
+
+Descriptions/documentation are report-only PLAY0270, not executable conditions.
+Case tables and persona callers expand before binding without a new ESM version.
+Routes do not make redelivery executable: it still reports PLAY0268.
+
+## Guarded interaction diagnostics
+
+| Code | Severity | Meaning / fix |
+| --- | --- | --- |
+| PLAY0560 | E | Alternatives on a non-item trigger; only click/double click/select admit them. |
+| PLAY0561 | E | Alternatives mixed with plain actions or `where`; choose one form. |
+| PLAY0562 | E | Empty branch; supply a nonempty action list. |
+| PLAY0563 | E | One-line labeled-action `when … execute …` in an interaction; use an indented list. C# offers a typed repair. |
+| PLAY0564 | W/I | Item-trigger opaque `where` deprecated: a strict item condition warns with a C# repair to one `when`, no fallback; other text is information with no repair. Other triggers unchanged. |
+
+PLAY0563/0564 repairs need individual review and canonical formatting, refuse
+comment loss and do not support pinned evidence. TypeScript diagnoses but does
+not offer these repairs. Preview through MCP `propose-repair`, never text-patch
+around a refusal. Condition/subject errors also use guarded-action PLAY0341–0348.
+
 ## Structural completeness and timeline checks
 
 Opt in with `--check <names>` or MCP diagnostics `checks`, then treat warnings
@@ -126,6 +174,7 @@ as errors if gating. Ordinary compile success does not imply these ran:
 | navigation | PLAY0537 | Unreachable screens; unreachable cycles do not establish an entry point |
 | privilege | PLAY0652 | Elevated event-trigger producers must require every actor role; opaque gates are information, clock/application triggers exempt |
 | purposes | PLAY0602–0606 | Personal-data coverage, special/criminal safeguards, basis and unused-purpose prompts; union of ancestor/direct references |
+| personas | PLAY0574–0576 | Unused personas, unreachable gates and ambiguous buildable policy alternatives; unsynthesizable/undecidable is unknown |
 
 Whole-source errors skip completeness checks. Unknown/opaque coverage is not
 invented: report skipped status/coverage and walk field lineage manually.

package/package/corpus/skills/cratis-screenplay-toolchain/references/renderable-subset.md

@@ -96,9 +96,12 @@ legacy ids or drop protected ids into routing to fit a renderer (PLAY0515).
   `Customizations/styles.css`. The planner never reads it, and it never binds a modeled
   reaction or capture. A customization never makes a rejected model renderable.
 - `cratis render` does **not** build, test or run the application.
-- The scaffold pins .NET 10, Arc 22.25.0, Chronicle 19.8.1 and emits a `.frontend/` React/Vite
-  app (Components 4.14.0, Scene 4.2.0). `Directory.Packages.props` is Stage-managed: do not
-  edit it. `[ProtectedDecision]` (Arc v22.39.0) is not available in a rendered application.
+- Stage 4.51.3's scaffold pins .NET 10, Arc 22.50.5, Chronicle client/kernel 19.32.0
+  and emits a `.frontend/` React/Vite app (Components 4.14.0, Scene 4.10.0).
+  `CratisEmbeddedScreenplayEnabled=false`; `Directory.Packages.props` is managed,
+  never edit it. `[ProtectedDecision]` / `DecisionRead<T>` are available to gap-fill,
+  not Stage-emitted enforcement; projection/key admission and unit-of-work enrollment
+  remain required. Source checks: Stage skill `references/rendered-application.md`.
 
 ## Reading V5
 

package/package/corpus/skills/cratis-screenplay-toolchain/references/traps.md

@@ -29,7 +29,7 @@ exact numbers are documented in the grammar. Compiler syntax: `cheat-sheet.md`.
 21. Quoted `import "x/*.play"` = my files; unquoted `import Ctx.Event` = another context's contract (does not bind: PLAY0268). [probed]
 22. Construct keywords are closed (`aggregate`, `saga`, `workflow` do not exist): PLAY0029 or PLAY0001/0022/0024.
 23. `@` escapes are mandatory for `tag`, `authorize`, `produces`, `reads`, `file`, `validate`, `sequence`, `occurred`, `causedBy`, `namespace`, `correlation`, `causation`, and projection `key`/`parent`/`with` as names.
-24. Comments do not survive canonicalizing edits (PLAY0288 reprint; `droppedCommentCount`); keep durable rationale in `description` text, not `//`.
+24. Canonicalizing edits can drop unplaceable comments (PLAY0288; inspect `droppedCommentCount`); keep durable rationale in fenced Markdown `documentation`, not `//`, and summaries in `description`. Documentation survives canonical printing but changes neither executable bytes nor `modelRevision`; it is not rendered code.
 25. MCP writes: propose, review, approval, apply by the identity owner (the session that owns the MCP connection); other subagents return edit requests; proposals are connection-local, at most 16 (`cratis-screenplay-model-authoring`).
 26. Operations/systems and exact numbers remain unadmitted. Sources/streams/routes bind and reference-execute as ESM v8 at 4.125.0; generated values/responses bind as v7. CLI 3.41.0 renders through v7 only, with construct-specific Stage refusals. Consult released grammar rather than inventing syntax from decisions.
 27. Translate vs Automation is semantic: external facts become local facts in `Translate`; in-app event-to-event goes in `Automation`.
@@ -43,8 +43,8 @@ exact numbers are documented in the grammar. Compiler syntax: `cheat-sheet.md`.
 34. A `from <Event> key <property>` routes only if every such event carries that property: an event that frees or updates a row keyed by another stream's id must carry that id in its payload, or the row never changes. Whether the compiler reports a missing key property is unverified [to probe]; check by hand.
 35. `description`/`documentation` are authoring metadata: board, MCP and Prologue show them; `cratis render` never does (Stage#178). A rule only in prose is unenforced in rendered code; make it a rule layer, a spec or a recorded target requirement.
 36. One unadmitted construct (operations, exact numbers, refusal/redelivery) blocks whole-model binding. Routing is admitted v8, not one of those constructs; CLI render's v7 boundary is a separate refusal. Do not remove routing or authorization to render a model.
-37. Personas are not in the ESM (Screenplay#254); specs cannot reference them. Write `given caller` as the roles/claims that stand for the persona.
-38. A rule that depends on stored state is `reads <View>` + `require <expr> message "..."` (stated intent; PLAY0268/0271 at binding are expected in design mode). The slice `description` must mark it NOT enforced in the model today (Screenplay#129/#209) and name the target: Arc `[ProtectedDecision]` + `DecisionRead<T>` (Arc v22.39.0 and later; not available in a Stage-rendered app on Arc 22.25.0), Chronicle DCB (`concurrency` scope), or a constraint where one fits. Forbidden: caller-supplied copies of state in `require`, boolean attestation inputs (`confirmsX == true`), rules hidden in `handler`/implementation-hint prose. An unguarded materialized read is unsafe for a protected decision.
+37. Personas remain outside ESM bytes, but 4.127.0 specifications accept `given caller as <Persona>`: one authenticated deterministic policy witness, not every matching caller. Inspect the chosen `or` branch; use explicit callers when synthesis is refused.
+38. A rule that depends on stored state is `reads <View>` + `require <expr> message "..."` (stated intent; PLAY0268/0271 at binding are expected in design mode). The slice `description` must mark it NOT enforced in the model today (Screenplay#129/#209) and name the target: Arc `[ProtectedDecision]` + `DecisionRead<T>` (Arc v22.39.0 and later; available to gap-fill on Stage 4.51.3's Arc 22.50.5/Chronicle 19.32.0, not emitted protection), Chronicle DCB (`concurrency` scope), or a constraint where one fits. Forbidden: caller-supplied copies of state in `require`, boolean attestation inputs (`confirmsX == true`), rules hidden in `handler`/implementation-hint prose. An unguarded materialized read is unsafe for a protected decision.
 
 Current identity/compliance traps (v4.127.0 `identity.md`, `concepts.md`, `events.md`,
 `purposes.md`, `diagnostics.md`):
@@ -69,4 +69,4 @@ The SKILL.md top 12: 1, 4, 5, 6, 7, 10, 12, 13, 17, 18, 20, 21 (+ mode/version n
 41. MCP roots bug (4.63.1 and earlier, including the 4.60.1 bundled by cratis before 3.28.2; not present in 4.66.0 or cratis 3.28.2, probed): a dynamic-root server answers the roots request with an `id: null` error right after `notifications/initialized`; hosts treat it as fatal. `open-workspace.path` does not help. Start with a fixed root (`screenplay mcp <folder>`, `cratis screenplay mcp` in a project with `.cratis/ai.json`) or use 4.63.2 or later (cratis 3.28.2 or later). [source, probed]
 42. A symlinked model path is refused by the MCP server (macOS `/tmp` is a symlink); pass the physical path. Proposals are connection-local (at most 16); `apply` persists identities to `.screenplay/identities.json` and is not crash-atomic across files; never retry `apply` after `ApplyOutcomeUnknown`. [source]
 43. `modelRevision` is canonical semantic (line positions and descriptions do not change it; a file move only if it changes logical placement or application identity) and, without `identities.json`, changes with the root folder name; it is not comparable with a render's `semanticRevision`. Source identity for verdicts is the commit plus the digest from the source-identity helper (`cratis-screenplay-modeling-lifecycle` `references/verdicts-and-modes.md` "Source identity"). [probed]
-44. `cratis render` neither builds nor tests; `--name` is required for plain source; `.cratis-render/` is control state and is never staged; Stage-rendered apps are on Arc 22.25.0 (no `[ProtectedDecision]`). `cratis` file mode versus folder mode (trap 6) and a stale `cratis` on `PATH` (`which -a cratis`) both silently change what a verdict means. [source]
+44. `cratis render` neither builds nor tests; `--name` is required for plain source; `.cratis-render/` is control state and is never staged; Stage 4.51.3 rendered apps pin Arc 22.50.5/Chronicle 19.32.0 (`[ProtectedDecision]` available to gap-fill, not automatically emitted). `cratis` file mode versus folder mode (trap 6) and a stale `cratis` on `PATH` (`which -a cratis`) both silently change what a verdict means. [source]

package/package/corpus/skills/cratis-screenplay-toolchain/references/versions.md

@@ -23,6 +23,7 @@ probe; older probes retain their original labels in the other references.
 | Stage bundled by CLI | **4.51.3** | Same file; the CLI's runtime image follows its Stage package version |
 | Cratis.Arc.Screenplay bundled by CLI | **22.54.0** | Same file; this is the generator package, not a blanket rendered-app dependency pin |
 | Chronicle / Fundamentals bundled by CLI | **19.32.0 / 7.22.8** | Same file |
+| Stage 4.51.3 rendered backend | **Arc 22.50.5 / Chronicle 19.32.0** | Stage `v4.51.3:Source/Rendering.Cratis/Scaffolding/CratisBackendApplicationScaffoldProfile.cs`; client/testing/image match; scaffold disables embedded reverse extraction |
 
 Check the actual executable before relying on this table: `screenplay --version`,
 `cratis --version`, MCP `initialize` → `serverInfo.version`. An older executable
@@ -93,6 +94,15 @@ PLAY0565 information, duplicates warn PLAY0653. Event `subject` and processing
 purposes are report-only metadata (PLAY0270); purpose checks/reports do not prove
 lawfulness or enforce retention. See command-surface context/compliance references.
 
+Authoring features source-checked in standalone 4.127.0: `propose-source`,
+`find-specification-obligations`, `find-modeling-smells`, specification descriptions,
+container/command/read-model/reaction documentation, routed redelivery locators,
+guarded item interactions, persona callers and named case tables. Discover schemas
+in the older CLI bundle rather than assuming parity. Cases/persona callers expand
+to ordinary ESM; metadata changes no executable bytes. Redelivery remains
+unadmitted even when its route is valid. Details: model-authoring MCP references,
+specifications, UI composition and `diagnostics.md`.
+
 ## Historical probes
 
 - Screenplay 4.68.0 admitted v7; CLI 3.28.2/3.28.3 bundled 4.66.0 (v6 at most),

package/package/corpus/skills/cratis-screenplay-toolchain/verification.json

@@ -3,6 +3,7 @@
   "input": "Check a Screenplay model folder: which compiler should I run, what do V1 to V3 mean, and what does the cratis CLI do with my Automation slice?",
   "fixtures": [],
   "assertions": [
+    { "kind": "play-compiles" },
     { "kind": "skill-contains", "value": "4.127.0" },
     { "kind": "skill-contains", "value": "PLAY0653", "file": "references/diagnostics.md" },
     { "kind": "skill-contains", "value": "PLAY0646", "file": "references/diagnostics.md" },

package/package/corpus/skills/cratis-screenplay-ui-composition/SKILL.md

@@ -74,11 +74,11 @@ work on a screen whose purpose is unsettled is rework.
 2. **Review the flow before adding layout.** Walk it screen by screen as text
    (format in `references/flow-review.md`). When the host advertises the MCP-Apps
    extension for the `screenplay` MCP server, `visualize-model` (a `proposalId` or a `sketch`) can also show it on
-   a board; that is optional, and the text review is enough on its own. Do not
+   a board; that is optional, and the text review is enough. Do not
    use the Stage sandbox as the review: it renders only part of a screen, and
    nothing here establishes that Stage renders an authored screen faithfully.
 3. **Add structure only to screens whose Level 1 is agreed**: template, sections,
-   forms, `on`/`uses`. Use Level 3 inline code last, and only where Level 2 cannot
+   forms, `on`/`uses`. Use Level 3 inline code last, only where Level 2 cannot
    say it.
 4. **Trace every field.** Each `form` `field` is a property of the form's command.
    A prefilled value comes from `populate` or `from`; a derived one from
@@ -132,7 +132,7 @@ or `regular` — phone landscape, phone portrait, desktop short, desktop tall.
 **`arrangement freeform`** declares one variant per matrix point. Excerpt, inside
 the `layout` above in place of its `arrangement flow`:
 
-```screenplay
+```screenplay excerpt
 arrangement freeform
   variant width regular, height regular
     place navigation at 0,0 size 240,fill
@@ -149,7 +149,7 @@ arrangement freeform
 
 Declared at module level, referenced by screens. Excerpt, inside a `module`:
 
-```screenplay
+```screenplay excerpt
 screen template MasterDetail
   fits slot content
   sidebar
@@ -178,7 +178,7 @@ difference. See `cratis-screenplay-read-surface` for the directives that go insi
 Excerpt, inside a `module`; the command, query and screen are declared in its
 slices.
 
-```screenplay
+```screenplay excerpt
 form RegisterInvoiceForm for RegisterInvoice
   populate via query GetInvoiceDefaults by customerId
   field invoiceNumber label "Invoice #"
@@ -204,7 +204,7 @@ level, so it disambiguates by module rather than by feature or slice.
 Excerpt, inside a `module` or `feature`; `Navigation` is the contribution point
 the layout above declares.
 
-```screenplay
+```screenplay excerpt
 contribute to Navigation
   navigate to InvoiceList
   label "Invoices"
@@ -240,8 +240,10 @@ acts. Three words carry it:
 | **Action** | a closed set: `execute`, `navigate to`/`navigate back`, `open dialog`/`close dialog`, `refresh`, `set … to`, `notify`, `confirm`, `raise` |
 | **Behavior** | a bundle of trigger-to-action bindings; inline (`on …`) or named (`behavior` + `uses`) |
 
-A complete example — a named behavior with parameters, attached with `uses`, and
-an inline `on` block with a continuation:
+Guarded alternatives and `where` deprecation:
+[guarded interactions](references/guarded-interactions.md).
+
+Complete named/inline behavior example:
 
 ```screenplay
 concept InvoiceId : Uuid
@@ -313,7 +315,7 @@ An existing success continuation does not imply a response contract.
 
 Excerpt: `AppShell` is the layout above.
 
-```screenplay
+```screenplay excerpt
 ui profile Desktop
   target platform web
   target size regular