@cratis/pi 7.29.1 → 7.31.0

package/package/corpus/skills/cratis-chronicle-client-dotnet/SKILL.md

@@ -204,6 +204,20 @@ from `string` (`:158`) and a `Redacted` form for logging (`:152`).
 
 Read [references/hosting.md](references/hosting.md) when wiring Chronicle into a worker or ASP.NET Core host, or when `AddCratisChronicle` or a namespace resolver does not resolve.
 
+## Pin event generations for delivery
+
+`ChronicleOptions.EventGenerationDelivery` defaults to `Compatibility`. Opt in
+with `EventGenerationDelivery.Pinned` (`Cratis.Chronicle.Observation`) **before
+connecting**. Reactors and reducers then receive their handler's CLR event
+generation (Chronicle **19.41.0+**); typed materialized projections use each
+clause's declared CLR event generation (**19.48.0+**). These additions are
+verified separately against those release tags, not the baseline above.
+
+Read [references/pinned-generation-delivery.md](references/pinned-generation-delivery.md)
+for compiling standalone/host configuration, registration constraints, and the
+Compatibility-only surfaces. For migration, PDL pin persistence, and integration
+test requirements, use **cratis-chronicle-event-type-migration**.
+
 ## The client and the server check each other
 
 The client runs the server-side compatibility check automatically inside `Connect()`; a genuine mismatch throws `IncompatibleServerException`, while a transport error is logged and ignored by design.

package/package/corpus/skills/cratis-chronicle-client-dotnet/references/pinned-generation-delivery.md

@@ -0,0 +1,92 @@
+<!-- Copyright (c) Cratis. All rights reserved. -->
+<!-- Licensed under the MIT license. See LICENSE file in the project root for full license information. -->
+
+# Pin event generations before connecting
+
+Requires Chronicle **19.41.0+** for client reactors/reducers and **19.48.0+** for
+typed materialized projections. Upgrade every kernel silo before enabling the
+option. `Compatibility` remains the default; adding a generation alone does not
+opt consumers in.
+
+## Standalone client
+
+This configuration excerpt uses `Cratis.Chronicle` **19.48.0** and a running
+local development kernel. Keep the client alive for observation; supply logging
+and a service provider when the application's observers need them (see the main
+skill's standalone checklist).
+
+```csharp
+using Cratis.Chronicle;
+using Cratis.Chronicle.Connections;
+using Cratis.Chronicle.Observation;
+
+var options = new ChronicleOptions(ChronicleConnectionString.Development)
+{
+    EventGenerationDelivery = EventGenerationDelivery.Pinned
+};
+using var client = new ChronicleClient(options);
+var eventStore = await client.GetEventStore("People");
+```
+
+## Host integration
+
+`AddCratisChronicle` extends `IHostApplicationBuilder` (an `IHostBuilder`
+overload also exists), **not** `IServiceCollection`. Its `ChronicleClientOptions` inherits the delivery option.
+This worker-host configuration excerpt uses `Cratis.Chronicle` **19.48.0** and
+`Microsoft.Extensions.Hosting`; add the application's hosted worker and start
+the host as usual.
+
+```csharp
+using Cratis.Chronicle.Observation;
+using Microsoft.Extensions.Hosting;
+
+var builder = Host.CreateApplicationBuilder();
+builder.AddCratisChronicle(options =>
+{
+    options.EventStore = "People";
+    options.EventGenerationDelivery = EventGenerationDelivery.Pinned;
+});
+```
+
+## Scope and registration
+
+- Reactors and reducers pin the generation of the handler's CLR event type.
+  Typed materialized projections (fluent, model-bound, or explicitly registered)
+  pin each clause's declared CLR event generation. Live, catch-up, and replay
+  (and, for reactors and reducers, partition retry) use kernel generation
+  selection and schema-guided release.
+- Projection pins cover `From`, `Join`, children, nested objects, removals,
+  event-content keys, and parent keys. Stored join/parent-event lookups select
+  and release through the same boundary as incoming events.
+- **One generation per event identifier per observer/projection**, across every
+  handler or clause, including children and nested objects. Different
+  identifiers may pin different generations. Client validation throws
+  `Cratis.Chronicle.Observation.MultipleGenerationsOfEventTypeInObserver` for
+  conflicting pins; the kernel rejects them with
+  `ObserverPinsMultipleGenerationsOfEventType`. Kernel observer subscription
+  rejects an unregistered generation with
+  `EventTypeGenerationNotRegisteredForObserver`; projection schema resolution
+  can reject an unavailable pin with `PinnedEventTypeGenerationUnavailable`.
+- Immediate/passive and wildcard (`all`/`FromAll`) projections stay
+  `Compatibility` when built through the .NET client. A definition explicitly
+  submitted as both wildcard and `Pinned` is unsupported and rejected by the
+  kernel with `EventGenerationDeliveryNotSupported`; the option does not make
+  wildcard pinning work.
+- Ad-hoc queries/event reads are not opted in. Neither are webhooks, captures,
+  or event-store subscriptions. Do not generalize this option to every read
+  path, or to unreleased generation-delivery work.
+
+For delivery-time migration, persisted PDL pins, and testing limits, read
+[the migration reference](../../cratis-chronicle-event-type-migration/references/pinned-generations.md).
+
+## Product sources
+
+Verified at `Cratis/Chronicle` **v19.48.0**:
+`Source/Clients/DotNET/ChronicleOptions.cs`,
+`Observation/EventGenerationDelivery.cs`,
+`ChronicleHostApplicationBuilderExtensions.cs`,
+`Projections/ProjectionGenerationDeliveryValidation.cs`, and
+`Source/Kernel/Core/Projections/Engine/ProjectionFactory.cs`.
+The option and reactor/reducer validation also exist at **v19.41.0**.
+
+See [Chronicle's pinned observer delivery documentation](https://github.com/Cratis/Chronicle/blob/v19.48.0/Documentation/concepts/event-type-migrations.mdx#opt-in-to-pinned-observer-delivery).

package/package/corpus/skills/cratis-chronicle-event-type-migration/SKILL.md

@@ -51,8 +51,9 @@ public sealed class EventTypeAttribute(string id = "", uint generation = 1) : At
 
 `id` defaults to the CLR type name and `generation` starts at `1`. The attribute
 is not repeatable, so two generations are always two distinct CLR types.
-Chronicle routes a stored event through the migration chain before delivering it
-to observers:
+Chronicle chains adjacent migrations to produce another generation. This is a
+possible upcast path, **not a promise that every observer receives the latest
+generation**; delivery policy is described below:
 
 ```text
 Generation 1 (stored) -> Migration 1->2 -> Migration 2->3 -> Current (Generation 3)
@@ -212,6 +213,23 @@ Migrations are discovered by convention — nothing is registered. They are
 activated through the service provider, so a migration may take constructor
 dependencies.
 
+## Choose the generation an observer receives
+
+`Compatibility` remains the default. With
+`ChronicleOptions.EventGenerationDelivery = EventGenerationDelivery.Pinned`,
+reactors and reducers receive the generation of their handler's CLR event type
+(verified at **19.41.0**). Typed materialized projection clauses receive the
+generation they declare (verified at **19.48.0**), including joins, children,
+removals, and event-content keys on live, catch-up, and replay.
+
+Read [references/pinned-generations.md](references/pinned-generations.md) for
+missing-generation migration, release and revision behavior, registration
+rejections, persisted PDL pins, and testing limits. Configure the opt-in through
+**cratis-chronicle-client-dotnet**; do not invent generation-qualified Screenplay
+syntax. `ReadModelScenario` and `ReactorScenario` do **not** emulate the kernel's
+pinned-generation migration and release; prove delivery with real-client
+integration, not a scenario-only assertion.
+
 ## Do not model absence with a nullable property
 
 **CHR0012** (warning) flags a nullable property on an `[EventType]` record.
@@ -246,3 +264,7 @@ is expected, since the prior generation records history rather than new intent.
   outstanding.
 - Old-generation events replay into the current shape through the read-model
   specifications for the affected observers.
+- With `EventGenerationDelivery.Pinned`, real-client integration also verifies
+  old-generation events on live delivery, catch-up, and replay into each
+  observer's pinned generation; in-process read-model/reactor scenarios alone
+  do not prove kernel migration and release.

package/package/corpus/skills/cratis-chronicle-event-type-migration/references/pinned-generations.md

@@ -0,0 +1,114 @@
+<!-- Copyright (c) Cratis. All rights reserved. -->
+<!-- Licensed under the MIT license. See LICENSE file in the project root for full license information. -->
+
+# Migrations and pinned delivery
+
+## Contents
+
+- What a pinned consumer receives
+- PDL pins are resolved once, when saved
+- Verify delivery through a real client
+- Product sources
+
+Verified against Chronicle **v19.48.0**. Reactor/reducer opt-in shipped in
+**19.41.0**; typed materialized projection opt-in shipped in **19.48.0**.
+Configure `ChronicleOptions.EventGenerationDelivery` before connecting; see
+[standalone and host examples](../../cratis-chronicle-client-dotnet/references/pinned-generation-delivery.md).
+
+## What a pinned consumer receives
+
+The kernel selects the pinned generation's content and hash, and releases
+protected values using **that generation's schema**. A reactor or reducer pins
+its handler's CLR event generation. A typed materialized projection uses the
+CLR generation each clause declares, including joins, children, nested objects,
+removals, event-content keys, and parent keys. Incoming live, catch-up, and replay
+events and stored join/parent-event lookups use the same release boundary.
+
+`EventContext.EventType.Generation` is the delivered generation;
+`EventContext.AppendedGeneration` is the original append generation, or null for
+legacy events where it is unknown. Do not infer the append generation from the
+handler type.
+
+If the pinned generation's content is missing from storage, Chronicle releases
+the known appended generation (or the highest stored generation for legacy
+events), then runs the adjacent `EventTypeMigration` upcast/downcast chain to the
+pin **for this delivery only**. It neither persists that result nor caches
+plaintext. The delivered hash is `EventHash.NotSet` because no durable hash
+exists for that migrated content. Erased PII stays erased through migration.
+An unavailable registered pin or an unreachable migration target fails with
+`PinnedEventTypeGenerationUnavailable`, rather than silently substituting a
+schema.
+
+Revised events use their **latest revision**, migrating it to the pin when
+needed. The revision's stored hash is retained only when its generation already
+matches the pin; otherwise the delivered hash is `EventHash.NotSet`. SQL
+revisions from before this release cannot be distinguished from original
+content and retain existing generation-selection behavior until revised again.
+
+Every observer/projection may pin **only one generation per event identifier**
+across all handlers/clauses, including children and nested objects. Different
+identifiers may pin different generations. See the client reference for the
+client and kernel registration exception names. Changing a reactor/reducer's
+pin or delivery mode does not itself trigger replay; request replay when prior
+state needs rebuilding.
+
+## PDL pins are resolved once, when saved
+
+For a PDL definition saved with `GenerationDelivery = Pinned`, a bare reference
+such as `from PersonRegistered` resolves to the **highest registered generation
+at registration time**. The definition persists that resolved pin. Join and
+removal references, including children and nested references, follow the same
+rule.
+
+Registering a later generation does **not** advance an existing saved pin.
+Re-saving the declaration resolves bare names again against the generations
+registered at that time. Keep this distinction when deploying migrations: a
+saved declaration is not a moving "latest" subscription.
+
+PDL is owned by Screenplay and has **no generation-qualified event reference
+syntax**. Never invent `PersonRegistered+2` or `Event+N`. When an explicit pin is
+needed, use .NET fluent or model-bound builders with that generation's CLR event
+type: for example, a `From<TEvent>` clause or `[FromEvent<TEvent>]` whose
+`TEvent` carries the intended `[EventType]` or `[EventTypeGenerationFor<T>]`.
+Do not mix two generations of the same identifier in different clauses.
+
+Compatibility PDL retains bare-name generation **1** and identifier-only
+dispatch. Immediate/passive and wildcard projections remain Compatibility;
+ad-hoc queries are not opted in by this change. Do not use their results as
+proof of pinned delivery.
+
+## Verify delivery through a real client
+
+`ReadModelScenario` and `ReactorScenario` do **not** emulate kernel pinned
+migration and protected-value release. The projection scenario preserves a
+seeded event's generation, but that is not the kernel selecting or migrating
+stored content. A scenario that feeds the desired CLR type only proves local
+handling/mapping for that type.
+
+Keep local decision/mapping specifications, and add **real-client integration**
+against a matching kernel to prove generation delivery:
+
+- Register both generations and their adjacent migration; use one pin per
+  identifier. Assert that conflicting pins are rejected.
+- Append another generation and assert delivered content and
+  `EventContext.EventType.Generation` on reactors/reducers, plus projected state
+  for typed materialized projections. Check `AppendedGeneration` separately.
+- Cover live delivery, catch-up, and replay; exercise contributing joins,
+  children, removals, and event-content/parent keys when the projection uses
+  them. Include missing stored generations and protected values when relevant.
+- For saved PDL, verify that adding a generation preserves the old pin and that
+  re-saving resolves the bare reference anew.
+
+Kernel specs provide product-level proof; in-process application scenarios are
+not a replacement for real-client integration of this option.
+
+## Product sources
+
+`Source/Kernel/Core/Events/EventGenerationRelease.cs` selects stored content,
+releases with the selected schema, and migrates missing/revised generations.
+`Source/Kernel/Core/Projections/ProjectionGenerationDeliveryValidation.cs`
+validates all clauses; `Engine/DefinitionLanguage/ProjectionEventTypeReference.cs`
+resolves PDL bare names. `Source/Clients/Testing/ReadModels/ProjectionReadModelProcessor.cs`
+and `Reactors/ReactorScenario.cs` define the scenario boundary.
+
+See [Chronicle's event type migration documentation](https://github.com/Cratis/Chronicle/blob/v19.48.0/Documentation/concepts/event-type-migrations.mdx#opt-in-to-pinned-observer-delivery).

package/package/corpus/skills/cratis-screenplay-automations-and-translations/SKILL.md

@@ -12,9 +12,13 @@ guarantees. Then write it as `Automation` and `Translate` slices that say truthf
 protected, what is only recorded, and who acts. Grammar depth is in
 `cratis-screenplay-captures-and-reactions`; this skill owns the decisions.
 
-**One meaning of Translation:** outside data becomes our facts (a `capture` or a translator
-reaction over an imported event, in a `Translate` slice). Our own event-to-event follow-up is an
+**Translation crosses an application boundary:** inbound turns outside data or foreign
+public events into private local facts; outbound publishes private facts as one local public
+event type. Declare `direction inbound|outbound` when public metadata is used; omission
+preserves historical inbound for legacy translations. Private-to-private follow-up is an
 Automation (`produces` or `invokes`), even when a Chronicle reactor realizes it.
+Read [public events and direction](references/public-events-and-direction.md) for released
+ESM v9 forms, event-target folds, publication specifications and the Unsupported capture limit.
 
 Work in the model first. Code appears only where it is truly needed: the external call, the
 source adapter, the trusted actor, and everything Stage cannot render (below). Session and
@@ -35,8 +39,9 @@ identity, effect and pending-work contract at that point; do not postpone it to
   (`references/realization-and-gap-fill.md`).
 - Reaction `runs as system role "<Role>"` declares an invocation actor (ESM v10).
   Without it the invoke has no caller. Historical CLI 3.41.0's 4.114.0 compiler
-  rejected the syntax (PLAY0137); current CLI 3.46.1 instead refuses ESM v10
-  at render admission (CLI-RENDER-004). Checked model/diagnostics: captures-and-reactions
+  rejected the syntax (PLAY0137); previous CLI 3.46.1 refused ESM v10
+  at render admission (CLI-RENDER-004). CLI 3.50.0 reaches Stage 4.67.0's
+  construct admission, which still refuses reaction identity (STAGE-ESM-034). Checked model/diagnostics: captures-and-reactions
   `references/invocation-identity.md`.
 
 ## Effect guarantees and recovery traps

package/package/corpus/skills/cratis-screenplay-automations-and-translations/references/audit-format.md

@@ -11,8 +11,10 @@ technique: partial work stays visible and nothing is skipped because it looked r
 
 Result is `complete` only when every column is filled or says why it does not apply (for example
 "direct effect: immediate, internal, cannot fail"). `open` names the unresolved decision and who
-answers. `blocked` names the actual capability gap (for example current CLI
-3.46.1 refuses ESM v10 at render admission with CLI-RENDER-004) with intended behavior.
+answers. `blocked` names the actual capability gap with intended behavior. For example,
+CLI 3.50.0 admits ESM v10 to Stage 4.67.0 construct checks, where reaction identity
+is refused with STAGE-ESM-034. Previous CLI 3.46.1 refused v10 at the version gate
+with CLI-RENDER-004; do not report that historical refusal as the current gap.
 
 ## Per translation (capture or translator reaction)
 | Source and type | Location | Correlation | Field dispositions | Target fields traced | Dedup and ordering | Trust boundary | Recovery owner | Named cases | Result |

package/package/corpus/skills/cratis-screenplay-automations-and-translations/references/automation-patterns.md

@@ -72,9 +72,9 @@ Screenplay 4.125.0 declares the actor with reaction-level `runs as system role
 "<Role>"` (ESM v10); without it a gated invocation has no caller and denies.
 `given caller` is not an invocation actor. Role requirements remain enforced;
 claim conditions for this system principal remain unknown. Historical CLI 3.41.0's
-older compiler rejected the syntax (PLAY0137). Current CLI 3.46.1 bundles
-Screenplay 4.130.0 / Stage 4.52.0 and refuses v10 at render admission
-(CLI-RENDER-004; toolchain `references/versions.md`).
+older compiler rejected the syntax (PLAY0137). CLI 3.50.0 bundles Screenplay 4.131.0 / Stage 4.67.0 and reaches v10
+construct admission, but reaction identity still refuses STAGE-ESM-034.
+Previous CLI 3.46.1 refused v10 at its version gate; see toolchain `references/versions.md`.
 Use the checked model in captures-and-reactions `references/invocation-identity.md`.
 Arc gap-fill uses `[ExecuteCommandsAsSystem("<role>")]` for returned commands,
 not identity inferred from prose or an imperative pipeline call.

package/package/corpus/skills/cratis-screenplay-automations-and-translations/references/provenance.md

@@ -44,5 +44,8 @@ binds); tool-qualified verdict text; the trusted-actor text now names `[ExecuteC
 `reactions.md`, `ReactionIdentityParser.cs`, `ReactionRefusalValidator.cs` and the
 binder's v10 selection; the checked scenario passed reference execution. CLI
 3.41.0's older parser and Stage 4.51.3's v7 planner were historical target limits.
-Current CLI 3.46.1 bundles Screenplay 4.130.0 / Stage 4.52.0 and still refuses
-v10 at render admission (CLI-RENDER-004; toolchain `references/versions.md`).
+Previous CLI 3.46.1 refused v10 at its version gate. CLI 3.50.0 bundles
+Screenplay 4.131.0/Stage 4.67.0, reaches v10 construct checks, and still refuses
+reaction identity with STAGE-ESM-034; see toolchain `references/versions.md`.
+Public/direction forms and routes/filters follow Screenplay v4.135.0 decisions
+0049–0051 and 0060–0066, not the older inbound-only translation scope.

package/package/corpus/skills/cratis-screenplay-automations-and-translations/references/public-events-and-direction.md

@@ -0,0 +1,137 @@
+<!-- Copyright (c) Cratis. All rights reserved. -->
+<!-- Licensed under the MIT license. See LICENSE file in the project root for full license information. -->
+
+# Public events and translation direction (released ESM v9)
+
+## Contents
+
+- Choose the boundary and direction
+- Outbound publication and specifications
+- Inbound event captures
+- Admission and evidence
+
+## Choose the boundary and direction
+
+Events are private by default. `public event X` declares a local public contract;
+`event X from "store"` declares a foreign public event's shape locally. The quoted
+origin is an opaque store name, not a path or declaration reference. Nothing checks
+that the local shape matches the other application's contract. A public/foreign
+`import Qualified.X from "store"` has no local shape and remains PLAY0268.
+
+`direction inbound` and `direction outbound` belong directly inside a Translate
+slice. Omission preserves historical inbound behavior for translations with no
+public metadata. A translation declaring or using public metadata needs explicit
+direction (PLAY0614), not a guess from its name.
+
+- Inbound: accept public foreign events or outside data and produce private local
+  facts. Use `capture` or a translating reaction. Correlation, deduplication,
+  enrichment and recovery still need the method skill's decisions.
+- Outbound: consume private local facts and publish exactly one local public event
+  type through a reaction or event-target projection/reducer. No capture belongs
+  here. A private-to-private follow-up is an Automation, not an outbound Translate.
+- A command never produces a public event (PLAY0607), and a foreign public event
+  is never produced locally (PLAY0613). Export only the intended contract fields;
+  public visibility does not authorize exposing personal data or secrets.
+
+## Outbound publication and specifications
+
+`projection P => PublicEvent` resolves its target as an event rather than a read
+model. Keep read-model and event names distinct. The outbound slice owns exactly
+one local public event type; its builders target that event only. Event-target
+reducers have the same boundary but opaque transitions: the reference evaluator
+returns typed Unsupported when a transition is reached, not a successful fold.
+
+An event-target projection holds one folded instance per event source id, not a
+read-model key. It publishes when the folded instance is complete and differs from
+the last published instance for that id. An identical repeated private fact emits
+nothing; changed state emits a new public instance, never rewrites the old fact.
+The reference fold admits only root-property set/clear from literals or event
+properties; other mappings block planning. Publication is unrouted and reactions
+can observe the new public fact. A route filter therefore cannot select publication.
+
+This complete source uses the released publication specification form:
+
+```screenplay
+domain Contracts
+concept OrderId : Uuid
+concept OrderStatus : String
+module Integration
+  feature Translation
+    slice StateChange PackOrder
+      command PackOrder
+        orderId OrderId identifier
+        carrier String
+        produces OrderPacked
+          for orderId
+          carrier = carrier
+      event OrderPacked
+        carrier String
+    slice Translate PublishOrderShipped
+      direction outbound
+      public event OrderShipped
+        carrier String
+        status OrderStatus
+      projection OrderShippedPublisher => OrderShipped
+        from OrderPacked
+          status = "packed"
+      specification PublishingAPackedOrder
+        when append OrderPacked
+          for "3fa85f64-5717-4562-b3fc-2c963f66afa6"
+          carrier = "DHL"
+        then OrderShipped
+          carrier = "DHL"
+          status = "packed"
+```
+
+`when append <PrivateEvent>` commits the input; the `then <PublicEvent>` list
+contains only the follow-up publications, exhaustive and ordered. Also specify
+incomplete state, unchanged repeat, changed state and independent event source ids.
+An expected public instance is not a `then readmodel` assertion.
+
+## Inbound event captures
+
+The foreign declaration must carry a quoted origin. `source events` has one or
+more distinct `from <ForeignEvent>` children; no URL, table or other setting is
+allowed in that block. It is valid only in an explicitly inbound Translate slice.
+
+```screenplay
+domain Contracts
+concept OrderId : Uuid
+module Integration
+  feature Tracking
+    slice Translate TrackShipments
+      direction inbound
+      event ShipmentDispatched from "shipping"
+        orderId OrderId
+      event OrderDispatched
+        orderId OrderId
+      capture ShipmentTracking
+        source events
+          from ShipmentDispatched
+        key orderId
+        append OrderDispatched
+          orderId = $.orderId
+```
+
+This compiles and binds as ESM v9. Evaluating the events-source capture returns
+typed Unsupported: the event-payload-to-working-record contract is not admitted.
+Do not equate binding with a passing capture specification or invent that mapping.
+Keep correlation and resulting private events in the model and report the runtime gap.
+
+## Admission and evidence
+
+ESM v9 shipped in Screenplay 4.117.0 and is selected only by use of public events,
+origins, direction, event-target builders or events-source captures. At 4.135.0,
+publication reference scenarios execute; imported shapes still refuse binding.
+Stage 4.52.0 (previous CLI 3.46.1) audits only through v7: CLI-RENDER-004 precedes
+its STAGE-ESM-016 version refusal. CLI 3.50.0/Stage 4.67.0 reaches construct
+admission through v10 but still refuses publication (STAGE-ESM-032), foreign
+events/events-source captures (STAGE-ESM-033); source admission is not rendering.
+
+Source: Screenplay `v4.135.0:Documentation/screenplay/fixtures/public-events.play`,
+`events.md`, `slices.md`, `captures.md`, decisions 0049–0051 and
+`Source/DotNET/Screenplay.CanonicalCorpus/PublicEventsCorpus.cs`.
+Renderer source: Stage `v4.52.0:Source/Rendering.Cratis/Semantics/SemanticCratisAdmission.cs`
+and `v4.67.0:Source/Rendering.Cratis/Semantics/SemanticVersionFeatures.cs`.
+Diagnostics and repairs: toolchain `references/diagnostics.md`; version allocation:
+toolchain `references/versions.md`.

package/package/corpus/skills/cratis-screenplay-automations-and-translations/verification.json

@@ -3,12 +3,16 @@
   "input": "Our payment provider sends webhooks when invoices are paid or refunded, and we must email a receipt afterwards. Model the integration and the follow-up in the Screenplay model.",
   "fixtures": [],
   "assertions": [
+    { "kind": "skill-contains", "value": "direction outbound", "file": "references/public-events-and-direction.md" },
+    { "kind": "skill-contains", "value": "source events", "file": "references/public-events-and-direction.md" },
+    { "kind": "skill-contains", "value": "then OrderShipped", "file": "references/public-events-and-direction.md" },
+    { "kind": "skill-contains", "value": "typed Unsupported", "file": "references/public-events-and-direction.md" },
     { "kind": "play-compiles" },
     { "kind": "skill-contains", "value": "`[ExecuteCommandsAsSystem(\"<role>\")]`" },
     { "kind": "skill-contains", "value": "ESM v10" },
     { "kind": "skill-contains", "value": "STAGE-ESM-024" },
     { "kind": "skill-contains", "value": "runs as system role" },
-    { "kind": "skill-contains", "value": "**One meaning of Translation:**" },
+    { "kind": "skill-contains", "value": "**Translation crosses an application boundary:**" },
     { "kind": "skill-contains", "value": "complete, open or blocked" },
     { "kind": "skill-contains", "value": "never write a mapping" },
     { "kind": "skill-contains", "value": "run-specifications" },

package/package/corpus/skills/cratis-screenplay-captures-and-reactions/SKILL.md

@@ -6,9 +6,8 @@ license: MIT
 
 # Captures and reactions
 
-The two slice types that run without anyone pressing a button. A `capture` in a
-`Translate` slice turns outside data into events; a `reaction` in an `Automation`
-slice runs when something happens.
+`capture` accepts outside data; `reaction` responds to an occurrence.
+Translate slices cross public boundaries; Automation slices cause private follow-up.
 
 ## Locate the model
 
@@ -26,16 +25,9 @@ source is the single flow model.
 
 ## Verified product sources
 
-| Package | Version | Purpose |
-| --- | --- | --- |
-| `Cratis.Screenplay` | `4.31.0` | CDL parser, reaction and trigger parsers, diagnostics, semantic binder |
-| `Cratis.Screenplay` | main `fd18129` | Command-only inline event boundary |
-| `Cratis.Screenplay` | `4.66.0` (`c89198b`) | ESM v6: reactions, clock, trigger and capture specifications bind; `invokes` caller rule; probed with the standalone tool and its MCP server |
-
-The table records historical examples/probes; they are not reclassified as
-current execution evidence. Refusal/redelivery guidance follows released
-v4.125.0 `reactions.md`/`specifications.md`. Current pins are in toolchain
-`references/versions.md`; reverify before promoting an old probe to that version.
+Read [product sources](references/product-sources.md) for retained historical
+parser/binder probes and refusal/redelivery evidence. Current pins are in toolchain
+`references/versions.md`; historical examples are not current execution evidence.
 
 ⚠️ **Which tool admits them depends on its Screenplay version.** The ESM level
 decides, not the slice type:
@@ -57,6 +49,13 @@ them. Read `cratis-screenplay-toolchain` (`references/versions.md`) when selecti
 Method (the four-part automation test, loops, translations versus automations):
 `cratis-screenplay-automations-and-translations`.
 
+## Public boundaries and observer selection
+
+Read [ESM v9 translation](../cratis-screenplay-automations-and-translations/references/public-events-and-direction.md)
+for `direction`, `source events`/`from`, and its typed Unsupported evaluation.
+Read [v10 filters](../cratis-screenplay-toolchain/references/production-routes-and-filters.md)
+for reaction/reducer `from Source[.Stream]`; unrouted facts never match.
+
 ## Specify what sets them off
 
 A specification names what sets the automation off: `when clock`, `when trigger`
@@ -76,9 +75,9 @@ Read [invocation identity](references/invocation-identity.md) for the checked
 scenario, claim/unknown semantics and PLAY0647–0652/0557 diagnostics.
 
 Historical CLI 3.41.0's 4.114.0 compiler rejected this source with PLAY0137.
-Current CLI 3.46.1 bundles Screenplay 4.130.0 / Stage 4.52.0; its render version
-gate still admits only through v7 (CLI-RENDER-004 for v10). Target realization is gap-fill,
-using Arc `[ExecuteCommandsAsSystem]` for returned commands. Without that attribute
+Previous CLI 3.46.1 refused v10 (CLI-RENDER-004); CLI 3.50.0 reaches
+Stage 4.67.0's construct admission, still refusing identity (STAGE-ESM-034).
+Target realization is gap-fill, using Arc `[ExecuteCommandsAsSystem]` for returned commands. Without that attribute
 Arc supplies no principal and `[Authorize]`/`[Roles]` deny. Each invoked command
 is atomic, not the whole cascade; earlier accepted facts remain after a later refusal.
 

package/package/corpus/skills/cratis-screenplay-captures-and-reactions/references/invocation-identity.md

@@ -71,10 +71,10 @@ module Work
 
 Historical CLI 3.41.0 bundled Screenplay 4.114.0, which did not parse `runs as`:
 the example's `cratis screenplay validate --executable --warnings-as-errors`
-returned PLAY0137, exit 5. This is not a current parser claim. Current CLI 3.46.1
-bundles Screenplay 4.130.0 but its render gate still admits only through v7
-(CLI-RENDER-004 for v10); bundled Stage 4.52.0's direct planner audits through
-v7 and refuses v10 with STAGE-ESM-016 (`references/versions.md` in toolchain).
+returned PLAY0137, exit 5. This is not a current parser claim. CLI 3.50.0 bundles
+Screenplay 4.131.0/Stage 4.67.0 and reaches v10 construct admission, but
+reaction identity still refuses STAGE-ESM-034. Previous CLI 3.46.1/Stage 4.52.0
+audited through v7 only (`references/versions.md` in toolchain).
 Clock/application-trigger identities have no Stage Arc realization either.
 Use authorized gap-fill with the model as contract; returned-command Arc identity
 uses `[ExecuteCommandsAsSystem]`, never permission inferred from a model header.

package/package/corpus/skills/cratis-screenplay-captures-and-reactions/references/product-sources.md

@@ -0,0 +1,15 @@
+<!-- Copyright (c) Cratis. All rights reserved. -->
+<!-- Licensed under the MIT license. See LICENSE file in the project root for full license information. -->
+
+# Retained product-source evidence
+
+| Package | Version | Purpose |
+| --- | --- | --- |
+| `Cratis.Screenplay` | `4.31.0` | CDL parser, reaction and trigger parsers, diagnostics, semantic binder |
+| `Cratis.Screenplay` | main `fd18129` | Command-only inline event boundary |
+| `Cratis.Screenplay` | `4.66.0` (`c89198b`) | ESM v6: reactions, clock, trigger and capture specifications bind; `invokes` caller rule; probed with the standalone tool and its MCP server |
+
+The table records historical examples/probes, not current execution evidence.
+Refusal/redelivery guidance follows released v4.125.0 `reactions.md`/`specifications.md`.
+Current pins live in toolchain `references/versions.md`; reverify before promoting
+an old probe to that version.

package/package/corpus/skills/cratis-screenplay-captures-and-reactions/verification.json

@@ -3,10 +3,12 @@
   "input": "Translate external data into events and declare a reaction.",
   "fixtures": [],
   "assertions": [
+    { "kind": "skill-contains", "value": "unrouted facts never match" },
+    { "kind": "skill-contains", "value": "source events" },
     { "kind": "play-compiles" },
     {
       "kind": "skill-contains",
-      "value": "main `fd18129`"
+      "value": "main `fd18129`", "file": "references/product-sources.md"
     },
     {
       "kind": "skill-contains",

package/package/corpus/skills/cratis-screenplay-command-surface/SKILL.md

@@ -260,14 +260,13 @@ produces when isProForma == true
 
 ## Routes and external operations
 
-Named event sources/streams and command routes bind as ESM v8 (verified at 4.125.0);
-CLI 3.46.1 render rejects models above v7. A routed command's identifier and
-known event destinations must match the source's nominal identifier type
-(PLAY0504, error). Allocation uses the generated identifier's type, or without
-one requires a UUID-based source. Composite `streamId` routes map every named
-part exactly once; scalar `streamId T` and `streamId = x` remain valid. The complete checked route example
-and nested `streamId =` form are in `cratis-screenplay-toolchain`
-`references/sources-and-streams.md`.
+Routes bind as ESM v8; production `stream Source.Stream` overrides
+select v10. Read toolchain [routes](../cratis-screenplay-toolchain/references/production-routes-and-filters.md)
+and [source/stream declarations](../cratis-screenplay-toolchain/references/sources-and-streams.md).
+`public event X` is a local export; `event X from "store"` is a locally declared,
+unverified foreign shape. Commands never produce public events. Read
+[translation direction](../cratis-screenplay-automations-and-translations/references/public-events-and-direction.md)
+for the released ESM v9 boundary and quoted opaque origins.
 
 Use `system`, `uses` and inline/standalone `operation` declarations to state
 external work in the authored production sequence, with execute/compensate phase
@@ -369,7 +368,7 @@ Four contexts, and **what each omits is load-bearing** — when writing a code b
 ## Verify
 
 - [ ] Validate the complete model root with warnings as errors; name the tool,
-      version and result. Current pins: standalone 4.131.0 / CLI 3.46.1; bundle
+      version and result. Current pins: standalone 4.135.0 / CLI 3.50.0; bundle
       compatibility and execution are separate checks.
 - [ ] No unintended `PLAY0478` or `PLAY0479` information remains.
 - [ ] At most one command property carries `identifier`, and no event property does.