@cratis/pi 7.29.0 → 7.30.0

package/package/corpus/skills/cratis-screenplay-model-review/references/public-keys-and-routes.md

@@ -0,0 +1,32 @@
+<!-- Copyright (c) Cratis. All rights reserved. -->
+<!-- Licensed under the MIT license. See LICENSE file in the project root for full license information. -->
+
+# Public contracts, lookup keys and observer routes
+
+Add these to the element sweep, with evidence pinned to the declaration:
+
+- Does a command publish a public event, a foreign event get produced locally,
+  or a local public event get produced outside an explicit outbound Translate?
+  Check for unintended personal/secret fields in the exported contract. An outbound
+  slice owns exactly one local public event type and consumes private local facts.
+- Is direction explicit when public metadata is used? Does an inbound translation
+  accept public foreign events and emit private local facts? A quoted origin is
+  an opaque store name with an unverified local shape, not proof of interoperability.
+  Read automations-and-translations `references/public-events-and-direction.md`.
+- Is the view identity explicitly marked `key` or unambiguously inferred? Does each
+  single-instance query/read supply every part exactly once, with compatible types,
+  and do state fixtures contain all parts? Do PDL keys align with the view's key?
+  Composite view keys still refuse binding at 4.135.0 (PLAY0268, #599); compilation
+  is not executable evidence. Read read-surface `references/named-keys.md`.
+- Does a production override replace the whole source/stream/id route, rather than
+  assume partial inheritance? Is its `for` destination still explicit and compatible?
+  Are skipped production routes valid, so eager resolution cannot fail unexpectedly?
+- Does a reaction/reducer `from Source[.Stream]` include the intended producers'
+  effective routes? Unrouted facts never match, including capture, reaction-direct
+  facts and public publication. PLAY0666 is a C# warning about all *known* producers,
+  not proof that a handler/foreign source will deliver. Filters have no stream-id
+  predicate and are not projection filters. Read toolchain
+  `references/production-routes-and-filters.md`.
+
+Report binding, reference execution and Stage admission separately. Never remove
+public metadata, key parts or filters to make a review's mode gate pass.

package/package/corpus/skills/cratis-screenplay-model-review/verification.json

@@ -3,6 +3,7 @@
   "input": "Review the marina berth .play model before we accept it: check the model and report findings, do not change anything.",
   "fixtures": [],
   "assertions": [
+    { "kind": "skill-contains", "value": "all *known* producers", "file": "references/public-keys-and-routes.md" },
     { "kind": "play-compiles" },
     { "kind": "skill-contains", "value": "PASS WITH WARNINGS" },
     { "kind": "skill-contains", "value": "Every finding is pinned to one declaration" },

package/package/corpus/skills/cratis-screenplay-projections/SKILL.md

@@ -75,6 +75,17 @@ build a read model** — two builders is error `PLAY0191`: *a projection or a
 reducer builds it, and only one of them*. A slice may still declare several
 projections, each building a **different** read model.
 
+## Public-event targets and observer filters
+
+In an explicitly outbound Translate slice, `projection P => PublicEvent` or
+`reducer P => PublicEvent` targets the slice's one local public event (ESM v9).
+The projection folds one instance per event source id; opaque reducers remain
+Unsupported in reference execution. Read
+[public-event folds](../cratis-screenplay-automations-and-translations/references/public-events-and-direction.md)
+for publication rules and the `when append`/`then PublicEvent` specification.
+A reducer can filter `from Source[.Stream]` (ESM v10); a projection cannot.
+Read [observer filters](../cratis-screenplay-toolchain/references/production-routes-and-filters.md).
+
 ## Projection-level directives
 
 `no automap`, `sequence <name>`, `file <path>`. `sequence` is a realization

package/package/corpus/skills/cratis-screenplay-read-surface/SKILL.md

@@ -55,16 +55,19 @@ A read model declares what it **is** — nothing about what builds it. Whatever
 builds it points at it with `=>`, and **exactly one thing may**: two builders is
 error `PLAY0191`. See `cratis-screenplay-projections` for the builder side.
 
-Do not mark a read-model property `identifier`. The executable model infers the
-instance identifier from the `by` property of the keyed queries that return the
-read model in its own slice
-(`query InvoiceById => InvoiceSummary optional`, then `by invoiceId InvoiceId`
-on its own body line). Several queries
-over the same `by` property are fine; each must still have the shape the
-executable model admits, `=> <ReadModel> optional` with one caller-supplied `by`. A read
-model with no keyed query, or with keyed queries over different `by` properties,
-has no unambiguous identifier and does not bind (`PLAY0268`), and specifications
-cannot select an instance of it.
+Use trailing `key` on top-level read-model properties, never `identifier`.
+Explicit marks replace inference; otherwise a single-instance query's `by` supplies
+identity (all such queries must agree). Only with no single-instance identifier
+and an admitted list query does the binder infer an unambiguous `*Id`; queryless
+read models need an explicit `key`. See named keys below for collection-key exclusions.
+One explicit key binds byte-identically to equivalent inference. Several marks
+form a composite key, supplied by name in query/read
+`by` blocks. At Screenplay 4.135.0 composite keys and block queries remain
+**authoring-only** (PLAY0268, #599); the scalar optional snapshot shape binds.
+Read [named keys](references/named-keys.md) for complete examples, trigger/command
+reads, all-parts fixtures, PLAY0660–0662 and command-read-only PLAY0661 repair.
+A `=>` target resolving to an event is an event-target builder, not a read model;
+keep event and read-model names distinct (see projections' public-event targets).
 
 ## `query`
 
@@ -79,12 +82,12 @@ query ListInvoices => InvoiceListReadModel[]
   authorize IsAuthenticated
 ```
 
-⚠️ **A list query is design-only.** `=> RM[]`, `observable`, `filter`, `scoped to` and
-`performer` are valid model language, but neither the executable model nor Stage
-4.24.0 binds or renders them (`PLAY0268`). Model them when the application needs them,
-and keep a list the domain needs. A keyed `XById => RM optional` query with one `by` is
-the shape that binds, runs in specifications and renders, but adding it beside a list
-does not unblock anything: while a list remains, the whole application stays unbound.
+**Name the compiler and renderer.** At Screenplay 4.135.0, optional keyed queries
+and collection queries bind, including `observable`, with caller-supplied `by`
+or no `by` on a collection. Filters, scope, performer and context-derived `by`
+remain PLAY0268. The old Stage 4.24.0 list refusal is not a current compiler
+limitation; check the target renderer's admission separately. Keep a list the
+domain needs rather than inventing a keyed query solely to infer identity.
 
 Return-type forms after `=>`: `ReadModel`, `ReadModel optional`, `ReadModel[]`,
 each optionally prefixed `observable`. `ReadModel[] optional` permits an absent

package/package/corpus/skills/cratis-screenplay-read-surface/references/named-keys.md

@@ -0,0 +1,122 @@
+<!-- Copyright (c) Cratis. All rights reserved. -->
+<!-- Licensed under the MIT license. See LICENSE file in the project root for full license information. -->
+
+# Named read-model keys and complete lookups
+
+## Contents
+
+- Declare identity
+- Supply every part
+- Specifications and executable boundary
+- Repairs and evidence
+
+## Declare identity
+
+A trailing `key` on a top-level read-model property declares instance identity.
+One explicit mark replaces inference and binds byte-identically to the equivalent
+inferred identifier. Several marks declare a composite key. At 4.135.0, identity
+selection is:
+
+1. Explicit `key` marks take precedence over inference.
+2. Without marks, single-instance queries in the owning slice supply identity from
+   their `by` property; their distinct `by` names must identify one property.
+3. Only when no single-instance query supplies an identifier **and** an admitted
+   collection/list query exists does the binder consider conventional `*Id` names
+   (case-sensitive). It first excludes collection-query `by` properties: if exactly
+   one candidate remains, that is the identifier; otherwise it uses all `*Id`
+   candidates and requires exactly one. An admitted list query here is a collection
+   query without context-derived `by`, filters, scope or performer.
+
+A projection-only/queryless read model needs an explicit `key`: a lone `*Id`
+property alone does not infer identity. Never use the command's `identifier`
+modifier on a read model.
+
+A key part is required and noncollection; it cannot also be `optional`, `generated`,
+`identifier` or `subject`. A single key may have a composite type, but parts of a
+multipart key must be scalar. Declaration order is display order, not identity:
+Chronicle's object keys are not ordered, encoded event stream ids.
+
+Choose a composite key when independent coordinates identify the business view,
+such as resource and reporting period. Prefer the natural single id when the view
+is one entity's state. Do not concatenate parts into an invented string id merely
+to pass binding; keep the truthful model and report the capability gap. Read-model
+keys do not supply projection routes: align each PDL `from ... key` mapping with
+the declared view identity (projection keys are a separate contract).
+
+## Supply every part
+
+A scalar query keeps `by name Type` on its own body line. A composite query has a
+bare `by` header and at least two distinct `name Type [from source]` children.
+Do not combine scalar and block forms. A single-instance lookup must supply every
+key part exactly once, with the declared types; collection queries may narrow by
+a subset but still have their separate executable-query limitations.
+
+A command or reaction trigger read uses a child `by` block of `part = source`.
+Sources are required, noncollection property paths with compatible nominal types,
+not literals. Trigger reads map from the trigger's declared values. The historical
+single `reads View by value` form remains available for a single key.
+
+This complete authoring-only example declares all lookup parts:
+
+```screenplay
+concept ResourceId : Uuid
+concept Period : String
+module Reporting
+  feature Months
+    slice StateView Totals
+      readmodel ResourceMonth
+        resourceId ResourceId key
+        period Period key
+        hours Decimal
+      query FindMonth => ResourceMonth optional
+        by
+          resourceId ResourceId
+          period Period
+    slice StateChange CloseMonth
+      command CloseMonth
+        resourceId ResourceId identifier
+        period Period
+        reads ResourceMonth as totals
+          by
+            resourceId = resourceId
+            period = period
+        produces event MonthClosed
+          for resourceId
+          period Period = period
+```
+
+Screen `data ... via query ... by value`, forms and navigation remain scalar
+lookups: they cannot supply a composite single-instance key (PLAY0661). Do not
+invent UI tuple syntax. Context-derived query parts do not become caller inputs;
+keep tenant/subject ownership at the runtime boundary, not in editable UI filters.
+
+## Specifications and executable boundary
+
+`given readmodel` and `then readmodel` state every key part (PLAY0351 if missing).
+A composite absence fixture uses an object with every named part. Query result
+assertions may omit keys when arguments already select the instance.
+
+At Screenplay 4.135.0, composite read-model keys, query `by` blocks and fixtures
+over those views remain authoring-only: binding reports PLAY0268 citing
+Screenplay#599 (still open). They do not reference-execute or render. This is not
+ESM v10 admission; v10 covers reaction identity, production routes and observer
+filters. Command reads independently remain unprotected/unadmitted (PLAY0271).
+A single explicit key does bind; Stage admission still depends on the complete
+model and projection/query shape, not just the key modifier.
+
+## Repairs and evidence
+
+- PLAY0660: fix key owner, modifier or type; no automatic repair.
+- PLAY0661: supply missing parts. The typed repair covers **command reads only**
+  when each missing part has one same-named compatible source. It preserves
+  authored mappings and refuses ambiguity; queries/trigger reads are not repaired.
+- PLAY0662: fix shape, duplicate/unknown parts or incompatible sources; no repair.
+- Read-model property rename remains unsupported until its mapping chain can be
+  preserved. Use the model-authoring proposal/preview/apply contract, not a text
+  shortcut around an identity-preserving refusal.
+
+Source: Screenplay `v4.135.0:Documentation/screenplay/{readmodels,queries,commands,reactions,specifications}.md`,
+`fixtures/named-read-model-keys.play`, decision 0060, and
+`Source/DotNET/Screenplay/Semantics/SemanticModelBinder.ReadModels.cs` (identity inference).
+Its authoring delivery shipped
+in 4.129.0; that release did not deliver #599's executable composite-key contract.

package/package/corpus/skills/cratis-screenplay-read-surface/verification.json

@@ -3,6 +3,9 @@
   "input": "Declare a Screenplay query and the screen that binds to it.",
   "fixtures": [],
   "assertions": [
+    { "kind": "skill-contains", "value": "query FindMonth", "file": "references/named-keys.md" },
+    { "kind": "skill-contains", "value": "command reads only", "file": "references/named-keys.md" },
+    { "kind": "skill-contains", "value": "remain authoring-only", "file": "references/named-keys.md" },
     { "kind": "play-compiles" },
     { "kind": "skill-contains", "value": "main `fd18129`" },
     { "kind": "skill-contains", "value": "filter status     InvoiceStatus optional" },

package/package/corpus/skills/cratis-screenplay-render-and-gap-fill/SKILL.md

@@ -25,9 +25,9 @@ Version pins live once in `cratis-screenplay-toolchain` `references/versions.md`
 
 | Source | Pin | Used for |
 | --- | --- | --- |
-| cratis CLI | `3.46.1` (`v3.46.1`) | Source-checked `Directory.Packages.props`: Stage 4.52.0, Screenplay 4.130.0, `Cratis.Arc.Screenplay` 22.54.0, Chronicle 19.32.0, Fundamentals 7.22.8; default runtime image `cratis/stage:4.52.0`. No new render/browser probe. UI-profile rejection (`CLI-RENDER-007` to `CLI-RENDER-010`) and render-then-recover shipped in 3.41.0 (Cratis/cli#301). Historical screens release vector: 3.40.7 (`af9f18e`) with `cratis/stage:4.51.1`. Reading baselines: 3.40.3, 3.39.0 and 3.28.3 (`8b43fef`) |
-| Stage | `4.52.0` (CLI 3.46.1 default) | Executed on CLI 3.43.0. Admission (`STAGE-ESM-*`, and `PLAY0268` render refusals surfaced by the CLI), ownership manifest, `Customizations/` seams, Debug-only specifications, guarded actions (`STAGE-SCENE-ACTION-001`) and interactions (`STAGE-SCENE-INTERACTION-001`) were source-checked at 4.51.3. Older baselines: 4.49.5, 4.43.0 and `v4.24.2` (`32dcac4`) |
-| Screenplay | bundled `4.130.0`; standalone `4.131.0` | Standalone compiler for V1 to V3; binding codes `PLAY0268` and code-attachment rules were read at `v4.66.0`. Historical CLI 3.41.0 probes used bundled 4.114.0; current `cratis` compiler claims require checking 4.130.0 |
+| cratis CLI | `3.50.0` (`v3.50.0`) | Source-checked `Directory.Packages.props`: Stage 4.67.0, Screenplay 4.131.0, `Cratis.Arc.Screenplay` 22.54.0, Chronicle 19.32.0, Fundamentals 7.22.8; default runtime image `cratis/stage:4.67.0`. Previous CLI 3.46.1 used Stage 4.52.0/Screenplay 4.130.0. No new render/browser probe. UI-profile rejection (`CLI-RENDER-007` to `CLI-RENDER-010`) and render-then-recover shipped in 3.41.0 (Cratis/cli#301). Historical screens release vector: 3.40.7 (`af9f18e`) with `cratis/stage:4.51.1`. Reading baselines: 3.40.3, 3.39.0 and 3.28.3 (`8b43fef`) |
+| Stage | `4.67.0` (CLI 3.50.0 default) | Source-checked, not executed as a new vector. Previous Stage 4.52.0 was executed on CLI 3.43.0. Admission (`STAGE-ESM-*`, and `PLAY0268` render refusals surfaced by the CLI), ownership manifest, `Customizations/` seams, Debug-only specifications, guarded actions (`STAGE-SCENE-ACTION-001`) and interactions (`STAGE-SCENE-INTERACTION-001`) were source-checked at 4.51.3. Older baselines: 4.49.5, 4.43.0 and `v4.24.2` (`32dcac4`) |
+| Screenplay | bundled `4.131.0`; standalone `4.135.0` | Standalone compiler for V1 to V3; binding codes `PLAY0268` and code-attachment rules were read at `v4.66.0`. Historical CLI 3.41.0 probes used bundled 4.114.0; current `cratis` compiler claims require checking 4.131.0 |
 | Rendered apps (historical check) | Arc `22.50.5`, Chronicle `19.32.0`, Scene packages | Stage 4.51.3 scaffold; `[ProtectedDecision]` / `DecisionRead<T>` available to gap-fill, not emitted enforcement. Embedded reverse extraction disabled; verify generated packages before claiming exact Scene runtime parity |
 
 Historical facts retain their checked tags; current pins are source-checked, not new runtime probes.
@@ -77,9 +77,12 @@ the model, hand-write the command and its response with the model (and its fixtu
 specifications) as the contract, and report V3 from the standalone tool and V5 as `not run: no render`.
 
 Models with event sources, streams or command routes bind and reference-execute as ESM v8 on standalone
-Screenplay 4.125.0, so report V3 and V4 from that tool. They are still case A or C for rendering: current CLI 3.46.1
-refuses models above ESM v7 with `CLI-RENDER-004`, so hand-write the code with the model as the
-contract (`cratis-screenplay-toolchain` `references/sources-and-streams.md`).
+Screenplay 4.125.0, so report V3 and V4 from that tool. Previous CLI 3.46.1 refused above v7 with CLI-RENDER-004. Current CLI 3.50.0/Stage
+4.67.0 reaches v8 route checks and construct admission through v10. Public publication,
+foreign events/event captures and v10 reaction identity/filters/production overrides
+still receive typed refusals; reducer filters render. Keep refused scope as case A/C,
+never infer target support from binding. Read Stage's `references/admission.md` and
+toolchain `references/sources-and-streams.md`.
 
 Two rules hold in every case: a customization never makes a rejected model renderable, and
 a whole-application V5 is never claimed from a subset. The CLI renders whole applications

package/package/corpus/skills/cratis-screenplay-render-and-gap-fill/references/gap-fill-handoff.md

@@ -77,9 +77,9 @@ not bind a modeled reaction or capture. Case C (no generated application): there
 composition conventions (`rules/vertical-slices.md`, `cratis-chronicle-reactor`).
 Declare the trusted actor with reaction `runs as system role "<Role>"`
 (standalone 4.125.0, ESM v10); `given caller` is not an invocation actor.
-Historical CLI 3.41.0's older compiler rejected the syntax. Current CLI 3.46.1
-bundles Screenplay 4.130.0 / Stage 4.52.0 but still admits through v7 only
-(CLI-RENDER-004 for v10). Gap-fill retains the declared role and uses Arc
+Historical CLI 3.41.0's older compiler rejected the syntax. CLI 3.50.0/Stage 4.67.0
+reaches v10 construct admission but still refuses reaction identity
+(STAGE-ESM-034); previous CLI 3.46.1 admitted through v7 only. Gap-fill retains the declared role and uses Arc
 `[ExecuteCommandsAsSystem]` for returned commands. Checked model and diagnostics:
 captures-and-reactions `references/invocation-identity.md`.
 

package/package/corpus/skills/cratis-screenplay-render-and-gap-fill/verification.json

@@ -38,7 +38,7 @@
     },
     {
       "kind": "skill-contains",
-      "value": "case A or C for rendering"
+      "value": "Keep refused scope as case A/C"
     },
     {
       "kind": "skill-contains",

package/package/corpus/skills/cratis-screenplay-scenario-coverage/SKILL.md

@@ -175,6 +175,17 @@ target requirements.
 - After a correction or backdated fact, does the view still say something true?
 - Cross-context views: are the real source contracts resolved, or is missing evidence a gap?
 
+## Public-event coverage (ESM v9)
+
+Outbound publication needs `when append <private>` and `then <PublicEvent>`:
+complete state, incomplete state, unchanged repeat, changed instance, separate
+source ids and the exported field boundary. Reference publication is executable;
+source-event captures and reached opaque event-target reducers are typed
+Unsupported. Read automations-and-translations `references/public-events-and-direction.md`.
+For routed producers/observers, cover override versus inherited route, skipped
+production route failure, matching/wrong source/stream and unrouted facts;
+see toolchain `references/production-routes-and-filters.md`.
+
 ## Version skew: reaction cascades and false PLAY0285
 Under ESM v6 a command spec's `then` lists the events reactions cascade from it. The compiler
 bundled in `cratis` before 3.28.2 (Screenplay 4.60.1) reported a **false PLAY0285** for such

package/package/corpus/skills/cratis-screenplay-scenario-coverage/references/spec-forms-by-mode.md

@@ -5,7 +5,7 @@ The subsets themselves (what binds, what renders) are owned by `cratis-screenpla
 says what that means for writing specs. A form outside the chosen mode is never deleted from a
 design model: keep it and record the gap. The detailed Stage 4.24.x rows below
 retain historical admission evidence; current pins are standalone Screenplay
-4.131.0 / CLI 3.46.1 (Screenplay 4.130.0 / Stage 4.52.0). Run actual target admission instead of assuming old restrictions carry over.
+4.135.0 / CLI 3.50.0 (Screenplay 4.131.0 / Stage 4.67.0). Run actual target admission instead of assuming old restrictions carry over.
 Typed example/override forms: `cratis-screenplay-specifications`
 `references/examples-and-routes.md`.
 
@@ -23,7 +23,7 @@ Typed example/override forms: `cratis-screenplay-specifications`
 | Command spec listing reaction cascade events | yes (v6 semantics) | false PLAY0285 on a cratis before 3.28.2 bundle only; see SKILL.md "Version skew" | no (no reactions) |
 | `generated <name> = <value>` under `when`, `then returns` (ESM v7) | yes | yes on standalone Screenplay 4.68.0 or later; not on the 4.66.0 bundled in cratis 3.28.x (`PLAY0268`) | historically no at Stage 4.24.x; check current target admission |
 | `then events in any order` | yes | yes | yes |
-| Event `stream` / `no stream`, typed `for` and stream ids | yes | ESM v8 at 4.125.0 | CLI 3.46.1 refuses models above v7 before planning |
+| Event `stream` / `no stream`, typed `for` and stream ids | yes | ESM v8 at 4.125.0 | CLI 3.50.0 reaches Stage route checks; routed read-model/query replay can still refuse STAGE-ESM-030 |
 | Typed examples and overrides | yes | expanded and type-checked before binding; required fields remain required | depends on expanded contract, not fixture reuse |
 | `given operation ... fails`, `then operation`, `then compensated` | yes | unadmitted PLAY0268 | gap-fill |
 | Refusal branches, `when redelivered`, `then no events` | yes | unadmitted PLAY0268 | gap-fill |

package/package/corpus/skills/cratis-screenplay-slice-design/SKILL.md

@@ -113,10 +113,14 @@ report and slice `documentation`, and continue.
    slice is `read model -> screen -> command -> event`. Pick the builder (declarative projection first, reducer when
    guards cannot be expressed). The query follows the business view: a list where people scan a
    list, a keyed lookup where they open one thing. For **executable or renderable scope**, every
-   read model also needs one unambiguous key: keyed queries `query XById => RM optional` all
-   using the same `by xId XId`. The identifier always equals the projection's effective key;
-   the decision table is in `references/read-model-design.md` and the full rule in
-   `cratis-stage-rendering-and-sandbox` `references/admission.md`. Keep the list query in design mode and record that it blocks V3.
+   read model needs one unambiguous identity: explicit trailing `key` first, else
+   single-instance queries agreeing on `by xId XId`, else conventional `*Id` inference
+   only with an admitted list query and no single-instance identifier. Queryless views
+   need explicit `key`; read-surface `references/named-keys.md` gives the exact fallback.
+   The identifier equals the projection's effective key (decision table in
+   `references/read-model-design.md`; Stage rule in `references/admission.md` of
+   `cratis-stage-rendering-and-sandbox`). Collections and observable delivery bind at
+   4.135.0; check renderer admission separately.
    Whose rows is part of the view; a caller-supplied filter is not access control.
 7. **Screens, Level 1.** `data <RM> via query <Q>` plus `action <Command>` per thing the user
    can do there. Build each slice as read model, screen, command, event. A screen acting on an
@@ -149,11 +153,13 @@ report and slice `documentation`, and continue.
 ### Compiler contracts (the tool enforces these)
 
 - At most one `identifier` per command; never on an event property; never on a read-model
-  property (identity comes from the keyed query's `by`).
+  property (use `key`; otherwise identity comes from single-instance `by`, or
+  conventional `*Id` only with an admitted list query and no single-instance identifier).
+  Queryless read models need explicit `key`.
 - At most one builder (projection or reducer) per read model (`PLAY0191`).
-- A query's `by` goes on its own body line. Only `=> RM optional` with one caller-supplied `by`
-  binds in the executable model; list, observable, filtered or scoped queries are `PLAY0268` at
-  binding but compile.
+- A query's `by` goes on its own body line. At 4.135.0, optional keyed and collection
+  queries bind, including observable delivery; scalar `by` must be caller-supplied.
+  Filtered, scoped, performer-backed and composite-block queries remain `PLAY0268`.
 - A `unique` constraint names a property the event declares directly; the constraint name is
   its identity (renaming starts an empty index).
 - Unauthorized is `then denied`; a broken rule is `then error`; authorization runs first.
@@ -181,6 +187,21 @@ report and slice `documentation`, and continue.
 Ask `references/review-questions.md` (reachability, forms in disguise, secrets, fan-in,
 collections, invariants, who sees which rows); report a finding only with a domain consequence.
 
+## Public boundaries and view identity
+
+Translate crosses an application boundary: inbound consumes foreign public events
+or data and produces private facts; outbound folds private facts into exactly one
+local public event type. Commands never publish public events. Put direction in
+the slice outline and trace every exported field; read automations-and-translations
+`references/public-events-and-direction.md` for the released ESM v9 contract.
+
+Mark view identity with trailing `key`. Use a composite key for independent view
+coordinates (resource + period), a natural single id for one entity's state.
+Supply every named part in single-instance queries and command/trigger reads;
+see read-surface `references/named-keys.md`. Composite view keys remain
+unadmitted at 4.135.0 (PLAY0268, #599), unlike admitted composite stream routes.
+Keep the true identity and report the gap rather than inventing a concatenated id.
+
 ## Identity-affecting edits on an existing model
 
 Classify an edit by whether it changes catalog addresses. When `.screenplay/identities.json`
@@ -203,7 +224,9 @@ Slice design is done when these hold; otherwise report what is open.
 - [ ] Every command has a refusal inventory (success, each refusal with layer and message,
       denied persona); every gated command and query has a `then denied` row.
 - [ ] Every event is past tense, a specific change, and consumed or justified.
-- [ ] Every read model has a consumer and, when the scope is executable, one unambiguous key (keyed queries all using the same `by` property).
+- [ ] Every read model has a consumer and, for executable scope, one identity: explicit
+      `key`, else agreeing single-instance `by`, else unambiguous `*Id` only with an
+      admitted list query and no single-instance identifier. Queryless views use `key`.
 - [ ] Every StateView's `documentation` gives a reason per contributing event; every read-model
       field and screen field is traced; every `from` event sets a field.
 - [ ] No `screen` without `data` or `action`; every acting screen has `data` or a stated

package/package/corpus/skills/cratis-screenplay-slice-design/references/read-model-design.md

@@ -118,21 +118,27 @@ it stays.
 
 | The person... | Design-mode query | Executable/renderable scope |
 |---|---|---|
-| opens one thing | `XById => RM optional` + `by xId XId` | same (the only shape that binds today) |
-| scans a list | `ListX => RM[]` (optionally `observable`, `filter`) | keep the list for design; add the keyed query; record V3 blocked by the list |
-| sees their own rows | list with scope/`from` on the caller | as above; access rules are part of the view, enforced by the target |
+| opens one thing | `XById => RM optional` + `by xId XId` | binds at 4.135.0 with caller-supplied `by`; check target renderer |
+| scans a list | `ListX => RM[]` (optionally `observable`, `filter`) | collection and observable delivery bind at 4.135.0; filters remain PLAY0268; check target renderer |
+| sees their own rows | list with scope/`from` on the caller | scope and context-derived `by` remain PLAY0268; access rules are part of the view, enforced by the target |
 | sees a site-wide figure | singleton read model, `from <Event> key literal "global"` on every `from` (a projection-level `key` routes nothing, PLAY0381; example in Screenplay `projections/keys.md`, "Literal keys") | check the binding (V3, `cratis-screenplay-toolchain`) |
 
 - `observable` when people are expected to see others' or automation's changes while looking
-  (worklists, status awaiting an outside answer); one-shot otherwise. Design mode only
-  (PLAY0268). If access can be revoked mid-session, record that the target re-checks per emission.
+  (worklists, status awaiting an outside answer); one-shot otherwise. Observable delivery
+  binds at 4.135.0; renderer support is separate. If access can be revoked mid-session,
+  record that the target re-checks per emission.
 - Never model paging or page size (no syntax, Screenplay#140). State the order in the query
   `description` ("oldest first"; queries do not accept `documentation`); an unbounded list is a review question.
 - A gated keyed query needs its own denial spec.
 
-Never drop a list query from a design model just to make it bind; record the capability gap.
-The keyed query also defines the read model's identity: its `by` property must be a read-model
-property. The identifier always equals the projection's effective key:
+Never drop a business-required list query to satisfy an old compiler or renderer;
+record any actual capability gap. At 4.135.0, explicit trailing `key` takes precedence
+for read-model identity. Otherwise single-instance queries in the owning slice must
+agree on one `by` property declared on the read model. Only with no single-instance
+identifier and an admitted collection/list query does conventional `*Id` inference
+run; queryless views need explicit `key`. The fallback excludes collection-query key
+candidates when that leaves one identifier (full algorithm: read-surface
+`references/named-keys.md`). The identifier equals the projection's effective key:
 
 | Effective key | Executable model | Renderable model (Stage) |
 |---|---|---|
@@ -182,8 +188,8 @@ has children, not a single value.
 If a view must stop showing cancelled items, use `remove with <Event>` and pin it with
 `then no readmodel <RM> for "<key>"`. If it keeps them, map a status literal from that event
 instead. The slice `description`, the projection and every spec of the view must agree.
-A complete example (marina berths; the `then no readmodel` assertion needs the keyed
-query, which is why the view has one):
+A complete example (marina berths; the keyed query supplies the view's identity
+for the `then no readmodel` assertion; explicit `key` could supply it instead):
 
 ```screenplay
 domain Harbourlight.Berths
@@ -277,7 +283,8 @@ module Berths
 - Every consumer that needs state has its read model (a blank creation form and a direct reaction
   with a documented no-pending-work reason need none); every read model has a consumer.
 - Every field traced (`field-lineage.md`).
-- Executable/renderable scope: one unambiguous key per read model (one or more keyed queries,
-  all with the same `by` property), identifier equal to the projection's key (table above);
-  no list queries.
+- Executable scope: one identity per read model: explicit `key`, else agreeing
+  single-instance `by`, else unambiguous `*Id` only with an admitted list query and
+  no single-instance identifier. Queryless views need explicit `key`. The identifier
+  equals the projection's key (table above); check target renderer admission separately.
 - Design-only shapes listed with the V3 code they cause.

package/package/corpus/skills/cratis-screenplay-specifications/SKILL.md

@@ -26,16 +26,9 @@ source is the single flow model.
 
 ## Verified product sources
 
-| Package | Version | Purpose |
-| --- | --- | --- |
-| `Cratis.Screenplay` | `4.31.0` | Original parser, binder and reference execution evidence |
-| `Cratis.Screenplay` | main `fd18129` | Inline facts, `optional` and clock spelling; changed examples compiled |
-| `Cratis.Screenplay` | `4.68.0` (`79801bf`) | ESM v7 generated fixtures and `then returns` (decision 0026, `specifications.md` "Generated fixtures and return expectations"): the excerpt matches the compiled example in `cratis-screenplay-toolchain`, whose specifications run in the reference runner |
-| `Cratis.Screenplay` | `4.66.0` (`c89198b`) | ESM v6 specification actions and reaction cascades, `then no readmodel`, `$strings` rejections, `invokes` caller rule; probed with the standalone tool and its MCP server |
+Retained inline-fact update evidence: [source notes](references/source-notes.md).
 
-The update follows `commands.md`, `events.md`, `types.md` and
-`specifications.md` at that main commit (after v4.52.0). This pass compiles the
-changed examples; it does not rerun the reference runner.
+The historical parser/binder/reference-runner version table is in the source notes.
 
 Specification syntax was checked against Screenplay v4.127.0 `specifications.md`;
 older probes in the table remain historical. Pins: `cratis-screenplay-toolchain`
@@ -207,6 +200,15 @@ Read [references/actions-beyond-commands.md](references/actions-beyond-commands.
 From ESM v6 every action sets reactions off and `then` events compare every new fact, the action's and the reactions'. A specification whose action is a command goes in the slice that declares the command. A false `PLAY0285` on a cascade under `cratis` before 3.28.2 is tool skew, not a modeling error: never delete the `then` line to silence it.
 Read [references/reactions-and-cascades.md](references/reactions-and-cascades.md) when a specification's expected events include what a reaction appends, when a cascade, clock tick or invoked command is involved, or when `cratis` reports `PLAY0285` on a model that `screenplay` accepts (it holds the "Version skew: cascades and the false `PLAY0285` (cratis before 3.28.2)" section).
 
+## Published-event specifications (released ESM v9)
+
+Use `when append <PrivateEvent>` then `then <PublicEvent>` for outbound publication,
+not `then readmodel`. The follow-up event list is exhaustive and ordered. Read
+[publication example and fold cases](../cratis-screenplay-automations-and-translations/references/public-events-and-direction.md).
+Events-source captures and reached opaque event-target reducers return typed
+Unsupported, not a pass. Composite view fixtures need every key part but remain
+unadmitted (PLAY0268, #599); see read-surface `references/named-keys.md`.
+
 ## Reusable fixtures, routes and recovery intent
 
 Use typed `example` declarations for repeated event/command/read-model values;
@@ -278,7 +280,7 @@ For view specifications:
 ## Verify
 
 - [ ] Validate the complete root with warnings as errors, naming tool/version.
-      Current standalone pin: 4.131.0. Run specification examples through
+      Current standalone pin: 4.135.0. Run specification examples through
       `screenplay test`; expected unadmitted syntax reports unbound, not passed.
 - [ ] Executable diagnostics are clean too: `PLAY0350`, `PLAY0352`, `PLAY0388`,
       `PLAY0389` and `PLAY0273` are only reported at binding.

package/package/corpus/skills/cratis-screenplay-specifications/references/examples-and-routes.md

@@ -94,8 +94,9 @@ so UUID casing is immaterial. Composite mappings supply each named part once,
 using literals only; encoding escapes `%`/`|` and preserves declaration order.
 Source: v4.127.0 `event-sources.md`, `specifications.md`, `diagnostics.md`.
 
-CLI 3.46.1 rendering rejects versions above v7 before planning, even though
-source compilation and reference routing pass.
+Previous CLI 3.46.1 refused above v7; CLI 3.50.0/Stage 4.67.0 reaches route
+checks through v10. Routed read-model/query replay can still refuse
+STAGE-ESM-030. Source/reference success never establishes target parity.
 
 Command and read-model examples refuse routes (PLAY0526). Effective role and
 `for` checks use the inherited or replaced route: inherited `no stream` on a

package/package/corpus/skills/cratis-screenplay-specifications/references/source-notes.md

@@ -0,0 +1,16 @@
+<!-- Copyright (c) Cratis. All rights reserved. -->
+<!-- Licensed under the MIT license. See LICENSE file in the project root for full license information. -->
+
+# Retained source notes
+
+| Package | Version | Purpose |
+| --- | --- | --- |
+| `Cratis.Screenplay` | `4.31.0` | Original parser, binder and reference execution evidence |
+| `Cratis.Screenplay` | main `fd18129` | Inline facts, `optional` and clock spelling; changed examples compiled |
+| `Cratis.Screenplay` | `4.68.0` (`79801bf`) | ESM v7 generated fixtures and `then returns` (decision 0026, `specifications.md` "Generated fixtures and return expectations"): the excerpt matches the compiled example in `cratis-screenplay-toolchain`, whose specifications run in the reference runner |
+| `Cratis.Screenplay` | `4.66.0` (`c89198b`) | ESM v6 specification actions and reaction cascades, `then no readmodel`, `$strings` rejections, `invokes` caller rule; probed with the standalone tool and its MCP server |
+
+The inline-facts update followed `commands.md`, `events.md`, `types.md` and
+`specifications.md` at main `fd18129` (after v4.52.0). That pass compiled the
+changed examples; it did not rerun the reference runner. Keep this historical
+source evidence distinct from the current source-check gate and V4 execution.

package/package/corpus/skills/cratis-screenplay-specifications/verification.json

@@ -6,12 +6,12 @@
     { "kind": "play-compiles" },
     {
       "kind": "skill-contains",
-      "value": "main `fd18129`"
+      "value": "main `fd18129`", "file": "references/source-notes.md"
     },
     { "kind": "skill-contains", "value": "Generated fixtures and return expectations (ESM v7)" },
     { "kind": "skill-contains", "value": "`then returns` counts as a success outcome but does not relax event comparison", "file": "references/generated-fixtures.md" },
     { "kind": "skill-contains", "value": "`Unsupported(IdentityAllocation)`", "file": "references/generated-fixtures.md" },
-    { "kind": "skill-contains", "value": "4.68.0" },
+    { "kind": "skill-contains", "value": "4.68.0", "file": "references/source-notes.md" },
     {
       "kind": "skill-contains",
       "value": "Inline events are ordinary named facts", "file": "references/worked-example.md"

package/package/corpus/skills/cratis-screenplay-streams-and-consistency/SKILL.md

@@ -88,8 +88,8 @@ option, mark it `ASSUMED` in the slice or module `documentation` and in the sess
    namespace, process-stream routing and concurrency scope apart
    (`references/chronicle-boundaries.md`). Declared `eventsource`/`stream`/`streamId` and
    command/specification routes bind and reference-execute as ESM v8 on 4.125.0.
-   CLI 3.46.1 rendering admits through v7 only (CLI-RENDER-004); keep the routing
-   contract and gap-fill its target realization. Forms/boundaries:
+   CLI 3.50.0 reaches Stage construct checks through v10; keep the routing
+   contract when target admission requires gap-fill. Forms/boundaries:
    toolchain `references/sources-and-streams.md`. A `generated identifier` (ESM v7, standalone 4.68.0; not rendered by Stage yet) is
    generated fresh on every acceptance: it is not a retry identity, and generated values give no
    idempotency, retry or deduplication guarantee. When a retry must find the same stream, the caller

package/package/corpus/skills/cratis-screenplay-streams-and-consistency/references/stream-patterns.md

@@ -216,8 +216,8 @@ Some event stores decide consistency by a query over tagged events instead of on
 check to event types, source type or stream (`concurrency` block, Screenplay
 `commands.md`). Legacy concurrency metadata still fails binding (PLAY0271),
 but sources/streams/routes bind and reference-execute as ESM v8 on 4.125.0.
-Route admission does not make a view read protected. CLI 3.46.1's render boundary
-is v7; see toolchain `references/versions.md`. Model the stream by business
+Route admission does not make a view read protected. CLI 3.50.0 reaches Stage construct checks
+through v10; see toolchain `references/versions.md`. Model the stream by business
 identity; when a rule truly needs a cross-stream decision, record it (see
 `consistency-and-concurrency.md`) rather than inventing a construct.
 

package/package/corpus/skills/cratis-screenplay-streams-and-consistency/verification.json

@@ -16,6 +16,6 @@
     { "kind": "skill-contains", "value": "bind and reference-execute as ESM v8" },
     { "kind": "skill-contains", "value": "STAGE-ESM-026" },
     { "kind": "skill-contains", "value": "generated values give no\n   idempotency, retry or deduplication guarantee" },
-    { "kind": "skill-contains", "value": "CLI-RENDER-004" }
+    { "kind": "skill-contains", "value": "Stage construct checks through v10" }
   ]
 }