@cratis/pi 7.29.1 → 7.31.0

package/package/corpus/skills/cratis-screenplay-command-surface/references/context.md

@@ -105,7 +105,7 @@ Checked at Screenplay 4.127.0: `$identity.<property>` is the same caller value a
 is supported, not deprecated. Historical `cratis` CLI 3.41.0 bundled Screenplay 4.114.0, which predated both:
 its parser rejected a top-level `identity` block (`PLAY0001`), and with `--executable` it read a
 `$identity.<property>` mapping as a raw expression (`PLAY0268`). Those checks used standalone 4.127.0;
-they are not current CLI 3.46.1/Screenplay 4.130.0 parser claims. Check current renderer
+they are not current CLI 3.50.0/Screenplay 4.131.0 parser claims. Check current renderer
 admission separately before choosing caller mappings. Built-ins are `id`, `name`, `userName`,
 `isAuthenticated`, `roles`, `claims.<name>` (everything after `claims.` is opaque).
 Bare `$identity` reports PLAY0152; unknown properties report PLAY0155. Only

package/package/corpus/skills/cratis-screenplay-command-surface/references/generated-values-and-responses.md

@@ -1,8 +1,8 @@
 ## Generated values and responses (ESM v7)
 
 A `generated` command property and `returns` response bind and reference-execute
-as ESM v7 (checked at 4.68.0). Current pins are standalone Screenplay 4.131.0
-and CLI 3.46.1 (bundled Screenplay 4.130.0/Stage 4.52.0); `cratis-screenplay-toolchain`
+as ESM v7 (checked at 4.68.0). Current pins are standalone Screenplay 4.135.0
+and CLI 3.50.0 (bundled Screenplay 4.131.0/Stage 4.67.0); `cratis-screenplay-toolchain`
 `references/versions.md` owns the table. CLI#261 is closed: CLI now admits v7
 to Stage planning. The historical CLI 3.41.0 v7 canonical corpus received Stage
 generated-value and response refusals STAGE-ESM-028/029. Do not turn this into a blanket compiler
@@ -45,8 +45,8 @@ Rules (all read at `v4.68.0`):
 
 Operations remain authorable/unadmitted (PLAY0268). Named event sources,
 streams and command/specification routes instead bind and reference-execute as
-ESM v8 at 4.125.0; CLI 3.46.1 render refuses versions above v7 before planning
-(CLI-RENDER-004). Syntax/MCP acceptance alone is not execution. Source/stream
+ESM v8 at 4.125.0; CLI 3.50.0 reaches Stage construct admission through v10,
+not blanket target support. Syntax/MCP acceptance alone is not execution. Source/stream
 forms and realization boundary: `cratis-screenplay-toolchain`
 `references/sources-and-streams.md`. Do not infer further syntax or provider
 admission from decision numbers.

package/package/corpus/skills/cratis-screenplay-event-modeling/SKILL.md

@@ -139,8 +139,8 @@ What binds depends on **which tool** you ask, so name the tool and its version:
   standalone 4.125.0. Use `screenplay test` or MCP `run-specifications` for V4.
   Operations/systems, exact numbers and refusal/redelivery remain unadmitted.
   Historical CLI 3.41.0 rejected `runs as` syntax and its Stage 4.51.3 check
-  refused generated values/responses with STAGE-ESM-028/029. Current CLI 3.46.1
-  bundles Screenplay 4.130.0 / Stage 4.52.0 but still renders through v7 only.
+  refused generated values/responses with STAGE-ESM-028/029. CLI 3.50.0 bundles
+  Screenplay 4.131.0/Stage 4.67.0; v10 reaches construct admission, not full support.
   Source/binding admission and target realization are separate gates.
 
 The ESM versions, the full disposition table and the Step 7 clock example's binding

package/package/corpus/skills/cratis-screenplay-event-modeling/references/parsed-not-runnable.md

@@ -28,7 +28,7 @@ Pins and consumer boundaries: toolchain `references/versions.md`.
 | Command reads/concurrency | Legacy unprotected decisions, PLAY0271 |
 | Invokes-only trigger reads | Report-only, not protected state; direct production with reads refuses |
 | Generated values/responses | v7 binding/reference execution; historical Stage 4.51.3 check: member refusals STAGE-ESM-028/029 |
-| Sources/streams and command/specification routes | v8 binding/reference execution; current CLI 3.46.1 render boundary is v7 |
+| Sources/streams and command/specification routes | v8 binding/reference execution; CLI 3.50.0 reaches Stage construct checks through v10 |
 | Declared reaction invocation actor | v10 binding/reference execution; older CLI parser PLAY0137; Stage planner refuses v10 |
 | Operations/systems, exact numbers, refusal/redelivery | Source accepted; whole binding refuses PLAY0268 |
 | UI | Authoring/deferred metadata; runtime support is a separate consumer contract |

package/package/corpus/skills/cratis-screenplay-legacy-extraction/references/generate-notes.md

@@ -17,9 +17,9 @@ cratis-screenplay-toolchain `references/versions.md`; behaviour from the cratis
 Screenplay.CritterStack `v0.24.0`. Version-specific capability facts belong in cratis-screenplay-toolchain
 `references/versions.md`.
 
-Current CLI is 3.46.1, with Screenplay 4.130.0 / Stage 4.52.0 /
+Current CLI is 3.50.0, with Screenplay 4.131.0 / Stage 4.67.0 /
 Arc.Screenplay 22.54.0 / Chronicle 19.32.0 / Fundamentals 7.22.8
-(`references/versions.md` in the toolchain; standalone Screenplay is 4.131.0).
+(`references/versions.md` in the toolchain; standalone Screenplay is 4.135.0).
 Option/admission evidence checked at CLI 3.41.0: released
 `GenerateScreenplaySettings.cs`, `ArcScreenplayGeneration.cs`, v7 planning specs
 and `Documentation/reference/screenplay.md`; older diagnostic probes below keep

package/package/corpus/skills/cratis-screenplay-model-authoring/SKILL.md

@@ -23,7 +23,7 @@ contract is in `cratis-screenplay-ui-composition`.
 
 ## Verified product sources
 
-Current authoring/MCP guidance follows Screenplay v4.131.0
+Current authoring/MCP guidance follows Screenplay v4.135.0
 `Documentation/screenplay/mcp/`, `ast-authoring.md`, `folders.md`, `vscode.md`.
 Discover installed tools and schemas; CLI bundles can differ from the standalone
 tool. Pins are in `cratis-screenplay-toolchain` `references/versions.md`.
@@ -291,9 +291,9 @@ that the code compiles or behaves. Read `references/mcp-tools.md#code-attachment
   it defines them and maps them onto V1 to V5. `screenplay --warnaserror` checks
   syntax plus the consistency rules (`PLAY0282`-`PLAY0294`) but never binds, so a
   clean run is not a bound or executable result.
-- Operations/exact numbers remain unadmitted; source/stream routes bind as ESM v8,
-  and generated values/responses as v7. CLI 3.46.1 render passes v7 to Stage but
-  refuses newer versions. A source contract is never dropped or stubbed to bind.
+- Operations/`numbers exact` remain unadmitted; routes bind as v8, public
+  boundaries v9, identity/overrides/filters v10, qualifying non-route Double
+  literals v11. CLI 3.50.0 reaches Stage checks through v10. Never drop or stub source contracts to bind.
 - Distinguish authoring acceptance from `executableReady`; unsupported backend
   capabilities are not a reason to drop source constructs or invent stubs.
 - If execution is intended, validate with the owning downstream runtime as well.

package/package/corpus/skills/cratis-screenplay-model-authoring/references/language-reference.md

@@ -243,6 +243,12 @@ v4.31.0 table, re-read against v4.66.0 and v4.68.0 documentation and probed thro
 the standalone 4.66.0 tool for the rows marked "probed"; Cratis CLI 3.28.2 and 3.28.3 bundle
 Screenplay 4.66.0 (before 3.28.2, Screenplay 4.60.1, differ where stated).
 
+Read-model identity and query admission below are corrected to 4.135.0:
+explicit trailing `key` wins; otherwise single-instance queries in the owning slice
+must agree on `by`. Only with no single-instance identifier and an admitted list
+query does conventional `*Id` inference run. Queryless views need explicit `key`.
+See read-surface `references/named-keys.md` for the collection-key exclusion algorithm.
+
 | Disposition | Constructs |
 | --- | --- |
 | Binds and runs in the reference runner | `StateChange`/`StateView` slices; `produces` including `when` conditions over command properties and literal tags; the portable validation rules, `matches email`, quoted `matches` patterns and `require` over command properties; declarative policies and `authorize` on modules, features, commands and keyed queries; `unique` constraints; projections as Chronicle lowers them, including variants, except the projection constructs in the next row; specifications, including `given caller`, `then denied` and `when append` |
@@ -254,7 +260,7 @@ Screenplay 4.66.0 (before 3.28.2, Screenplay 4.60.1, differ where stated).
 | Binds as ESM v7 on standalone Screenplay 4.68.0 (source and release notes; `PLAY0268` on the 4.66.0 in Cratis CLI 3.28.x, probed) | `generated` properties and `returns` responses, generated fixtures and `then returns`: bound and executed by the reference runner; a policy, rule or requirement that references a generated value is `PLAY0273`, and a generated property on a concept with validation rules is `PLAY0268`. Stage 4.24.2 does not render them (`STAGE-ESM-016`, tracked in Stage#201): gap-fill |
 | Authorable, not executable (PLAY0268) | Systems/operations, exact numbers and refusal/redelivery remain unadmitted |
 | Current routing and actor admission | Sources/streams and command/specification routes bind and reference-execute as v8; reaction `runs as system role` supplies the invocation actor as v10 on 4.125.0. Whole-workspace binding determines executable availability; CLI/Stage realization remains separate |
-| Blocks binding (`PLAY0268`) | `pii`/`secret` concepts (also legacy spellings; historical probe: "compliance attributes require portable data-subject semantics"), command `handler` (never binds; a command cannot declare both `produces` and `handler`, `PLAY0035`), bare `rule <Name>`, `require` or conditions over read-model paths, dates and `today` in comparisons, `$context.tenant`/claims/roles/causation in `produces`, `$env` conditions, `file` constraints, unquoted `import` of an external contract, a read model whose keyed queries in its own slice do not share one `by` property (none, or two different properties; several queries over the same property bind), any query other than `=> <ReadModel> optional` with one caller-supplied `by` argument (so also observable, filtered, scoped and performer-backed queries), `$causedBy` and templates in projections |
+| Blocks binding (`PLAY0268`) | `pii`/`secret` concepts (also legacy spellings; historical probe: "compliance attributes require portable data-subject semantics"), command `handler` (never binds; a command cannot declare both `produces` and `handler`, `PLAY0035`), bare `rule <Name>`, `require` or conditions over read-model paths, dates and `today` in comparisons, `$context.tenant`/claims/roles/causation in `produces`, `$env` conditions, `file` constraints, unquoted `import` of an external contract, a read model with neither explicit `key` nor unambiguous query-based identity as described above (composite keys remain unadmitted), queries with filters, scope, performer, context-derived `by` or composite `by` blocks (optional keyed and collection queries, including observable delivery, bind at 4.135.0), `$causedBy` and templates in projections |
 | Blocks binding (`PLAY0271`, legacy meaning) | Command `reads` and `concurrency` |
 | Deferred (`PLAY0269`, information) | Screens, layouts, templates, forms, contributions, UI profiles, themes, behaviors and `on`/`uses` |
 | Metadata only (`PLAY0270`, information) | `domain`, `seed`, `persona`, trigger and other descriptions, and `file` provenance on declarations |

package/package/corpus/skills/cratis-screenplay-model-authoring/references/mcp-tools.md

@@ -98,6 +98,9 @@ with `view: "diagnostics"`, then `view: "repairs"` at the current revision.
 | `PLAY0469` | Remove an inline same-source identifier property and mapping, retiring its semantic address. This changes the contract; `canFixAll` is false. Refuse other consumers, opaque impact, changed routing or comment loss. Plain contracts get guidance only. |
 | `PLAY0479` | Migrate one optional type spelling, or all in a document, preserving syntax and trivia. Exclude `query Q => observable?`. |
 | `PLAY0563/0564` | Expand a one-line interaction alternative / turn a strict item `where` into one block-form `when`. Individual review, canonical formatting, no pinned evidence; refuse comment loss. Opaque non-item-condition text has no PLAY0564 repair. |
+| `PLAY0614` | Declare Translate direction only when exactly one inbound/outbound interpretation fits public metadata; never change event visibility to make a repair fit. |
+| `PLAY0661` | Complete command reads only when each missing part has one same-named compatible source; preserve authored parts and refuse ambiguity. Queries and trigger reads have no repair. |
+| `PLAY0664` | Remove an override identical to the command's complete source/stream/id route. |
 | `PLAY0516` | Move a producing sibling declaration/import before its consumer, or pin an already placed file before a retained glob. Preserve catalogs, comments, placement and executable readiness; introduce no timeline findings. Own-sub-feature edges, cycles, unranked members and mixed/different-parent boundaries have no repair. Rediscover after each move; pinned evidence is unsupported. |
 
 These discoveries verify acceptance before listing a repair. Only compact
@@ -188,7 +191,8 @@ persona/policy and table/case/caseParameter provenance. Neither view executes.
 
 Screenplay v4.127.0 `mcp/reference.md` and `authoring-tools.md` describe these
 additions (checked at 4.127.0); discover installed schemas because current
-CLI 3.46.1 bundles Screenplay 4.130.0, not standalone 4.131.0.
+Previous CLI 3.46.1 bundled Screenplay 4.130.0; CLI 3.50.0 bundles
+4.131.0, so these source objects are available there too.
 
 - Identity/detail summaries expose declared sources; `$identity` has its own
   expression node. The block alone stays executable-ready, but executable reads
@@ -322,7 +326,8 @@ the open model as candidate:
 }
 ```
 
-These source objects require Screenplay 4.131.0; CLI 3.46.1 bundles 4.130.0.
+These source objects require Screenplay 4.131.0; CLI 3.50.0 bundles it
+(previous CLI 3.46.1 bundled 4.130.0).
 Discover installed schemas rather than assuming bundle parity.
 Check that the registered worktree is checked out at the intended commit and
 contains the baseline model; Git refs are not resolved. An admitted missing

package/package/corpus/skills/cratis-screenplay-model-authoring/references/screen-authoring-workflow.md

@@ -146,10 +146,12 @@ Historical verified public vector and executable checks:
 
 - executed toolchain: public CLI 3.43.0 (`23e5a24`), whose default runtime was
   `cratis/stage:4.52.0` and which bundled Screenplay 4.127.0. Published since,
-  and not verified by this vector: Scene 4.17.0, Screenplay 4.133.1, Stage 4.64.0, CLI
-  3.46.1 (bundling Screenplay 4.130.0, default Stage still 4.52.0) and Studio 0.152.2.
+  and not verified by this vector: Scene 4.17.0, Screenplay 4.133.1, Stage 4.64.0,
+  previous CLI 3.46.1 (bundling Screenplay 4.130.0, then-default Stage 4.52.0) and
+  Studio 0.152.2. Current pins are CLI 3.50.0 (Screenplay 4.131.0 / Stage 4.67.0)
+  and standalone Screenplay 4.135.0; see toolchain `references/versions.md`.
   Compiler claims from this `cratis` probe are 4.127.0 claims, not current CLI
-  3.46.1/Screenplay 4.130.0 claims;
+  3.50.0/Screenplay 4.131.0 claims;
 - fixture root: `Source/DotNET/Screenplay.CanonicalCorpus/Corpus/ScreenComposition/v1/source/folder`
   in the Screenplay repository;
 - Screenplay repo tool (available checkout): `dotnet run --project Source/DotNET/Tool

package/package/corpus/skills/cratis-screenplay-model-authoring/verification.json

@@ -6,7 +6,7 @@
     { "kind": "play-compiles" },
     {
       "kind": "skill-contains",
-      "value": "Screenplay v4.131.0"
+      "value": "Screenplay v4.135.0"
     },
     {
       "kind": "skill-contains",

package/package/corpus/skills/cratis-screenplay-model-review/SKILL.md

@@ -31,7 +31,7 @@ adapted to `.play` declarations (`references/provenance.md`).
 |---|---|---|
 | Screenplay | `v4.66.0` (`c89198b`) | MCP catalog (29 tools: `describe-application`, `search-declarations`, `dependencies`, `find-assertion-gaps`, `read-workspace`, `declaration-details`) in `Source/DotNET/Screenplay.Mcp/McpToolCatalog.cs`; diagnostics PLAY0029, PLAY0191, PLAY0268, PLAY0271, PLAY0350, PLAY0381, PLAY0469 in `Source/DotNET/Screenplay/Diagnostics/DiagnosticCodes.cs`; decision 0008 (one data subject per event) |
 | Screenplay | `v4.127.0` | `find-specification-obligations` (SPEC001–SPEC008 authored presence), `find-modeling-smells` (SMELL001–SMELL005 advisory questions); neither proves executed behavior or complete lineage |
-| Screenplay | `v4.131.0` | `semantic-diff` source objects and revision-pinned pages: `Source/DotNET/Screenplay.Mcp/{McpRevisionDiff,McpWorkspaces.Comparison,McpToolCatalog}.cs`, `Documentation/screenplay/mcp/reference.md`; CLI 3.46.1's 4.130.0 bundle predates these arguments |
+| Screenplay | `v4.131.0` | `semantic-diff` source objects and revision-pinned pages: `Source/DotNET/Screenplay.Mcp/{McpRevisionDiff,McpWorkspaces.Comparison,McpToolCatalog}.cs`, `Documentation/screenplay/mcp/reference.md`; previous CLI 3.46.1 predates these; CLI 3.50.0 bundles them |
 | cratis CLI | `v3.28.3` | bundles Screenplay 4.66.0 and Stage 4.24.2; see the toolchain skill |
 
 The full pin table lives in `cratis-screenplay-toolchain` `references/versions.md`; do not copy
@@ -243,18 +243,17 @@ verdict follows the rules in `references/report-template.md`.
 - Complete examples in this skill compile: `references/worked-example.md`.
 
 ## Route near misses
-- Writing missing specs: `cratis-screenplay-scenario-coverage`. Slice redesign:
-  `cratis-screenplay-slice-design`. Stream and invariant fixes:
-  `cratis-screenplay-streams-and-consistency`. Automations and translations:
-  `cratis-screenplay-automations-and-translations`.
-- Phases, modes and verdicts: `cratis-screenplay-modeling-lifecycle`. Tools, versions and
-  diagnostics: `cratis-screenplay-toolchain`. Construct mechanics: `cratis-screenplay-specifications`,
+- Specs: `cratis-screenplay-scenario-coverage`; slices: `cratis-screenplay-slice-design`;
+  streams/invariants: `cratis-screenplay-streams-and-consistency`;
+  reactions/translations: `cratis-screenplay-automations-and-translations`.
+- Modes/verdicts: `cratis-screenplay-modeling-lifecycle`; tools/diagnostics:
+  `cratis-screenplay-toolchain`; syntax: `cratis-screenplay-specifications`,
   `cratis-screenplay-command-surface`, `cratis-screenplay-projections`.
-- Chronicle compliance review: `cratis-chronicle-event-modeling`. Rendered code, gap-fill and
-  code review: `cratis-screenplay-render-and-gap-fill`, `cratis-code-review`,
-  `cratis-application-slice-conformance`.
+- Compliance: `cratis-chronicle-event-modeling`; rendered/gap-filled code:
+  `cratis-screenplay-render-and-gap-fill`, `cratis-code-review`, `cratis-application-slice-conformance`.
 
 ## References (load on demand)
+- Review public leaks, direction, complete keys and effective routes with [public/key/route checks](references/public-keys-and-routes.md).
 - Read `references/checklist.md` when performing the element sweep and phased audit; it contains eleven phases, 89 checks, tiers and evidence sources.
 - Read `references/anti-patterns.md` when investigating an anti-pattern signal; it gives the signal, why it matters, tier and Screenplay fix.
 - Read `references/report-template.md` when classifying findings, deciding the verdict, writing the report or conducting a re-review; it defines report, severity and verdict rules.
@@ -263,4 +262,4 @@ verdict follows the rules in `references/report-template.md`.
 - Read `references/business-questions.md` when conducting the business-question pass; it contains the explainer journey method, prompts and word translation.
 
 ## Lineage
-Read `references/provenance.md` when checking method lineage, attribution or adaptation permissions.
+Method lineage, attribution and adaptation permissions: `references/provenance.md`.

package/package/corpus/skills/cratis-screenplay-model-review/references/anti-patterns.md

@@ -62,7 +62,7 @@ the problem, the checks it violates, the fix, all pinned to one declaration.
 | Missing `for` | an event production (`produces <Event>` or `produces event`) without `for`. Not operation productions: they are authorable design intent, belong to commands, and take no event `for`, tags or routing | runtimes disagree on the destination | C (executable) / D | `for <identifier>` |
 | Unbuilt read-model field | field no projection maps and AutoMap cannot fill | always empty; not reported by the compiler | D | map it or remove it |
 | Undeclared removal/append event | `remove with` or capture `append` names an undeclared event | passes V1, fails binding (V2/V3, PLAY0273) | C (executable) / D | declare or fix the name; run V3 |
-| Gated command invoked by a reaction without a declared actor | reaction `invokes` a command under a caller policy and has no `runs as system role "<Role>"` that satisfies the gate | the invocation carries no caller: rejected at run time | D (major) | declare `runs as system role "<Role>"` with the least-privilege role the gate admits (ESM v10, Screenplay 4.125.0; current CLI 3.46.1 refuses v10 with CLI-RENDER-004, so gap-fill) or record another trusted-path decision - never just delete the gate. A matching `runs as system role` is the admitted trusted path, not a defect |
+| Gated command invoked by a reaction without a declared actor | reaction `invokes` a command under a caller policy and has no `runs as system role "<Role>"` that satisfies the gate | the invocation carries no caller: rejected at run time | D (major) | declare `runs as system role "<Role>"` with the least-privilege role the gate admits (ESM v10, Screenplay 4.125.0; previous CLI 3.46.1 refused v10 with CLI-RENDER-004, so gap-fill) or record another trusted-path decision - never just delete the gate. A matching `runs as system role` is the admitted trusted path, not a defect |
 | `reads` + `produces` reaction | reaction both reads a view and produces | fails binding | C (executable) | invoke a command, or produce without reads |
 | `reads` treated as protection | rule "checked" because the command or reaction `reads` a view | `reads` enforces nothing | D (major) | keep or introduce `reads <View>` + `require ... message` as stated intent, mark it NOT enforced in the slice `description`, name the target (`[ProtectedDecision]` + `DecisionRead<T>`, Chronicle DCB, or a constraint where it fits); checklist E3 |
 | Caller-supplied state rule | `require currentStatus == "open"` where the caller sends `currentStatus` | the caller decides its own permission | D (major) | read the stored state with `reads`; keep or introduce `reads <View>` + `require ... message` as stated intent, mark it NOT enforced in the slice `description`, name the target (`[ProtectedDecision]` + `DecisionRead<T>`, Chronicle DCB, or a constraint where it fits); checklist E3 |

package/package/corpus/skills/cratis-screenplay-model-review/references/public-keys-and-routes.md

@@ -0,0 +1,32 @@
+<!-- Copyright (c) Cratis. All rights reserved. -->
+<!-- Licensed under the MIT license. See LICENSE file in the project root for full license information. -->
+
+# Public contracts, lookup keys and observer routes
+
+Add these to the element sweep, with evidence pinned to the declaration:
+
+- Does a command publish a public event, a foreign event get produced locally,
+  or a local public event get produced outside an explicit outbound Translate?
+  Check for unintended personal/secret fields in the exported contract. An outbound
+  slice owns exactly one local public event type and consumes private local facts.
+- Is direction explicit when public metadata is used? Does an inbound translation
+  accept public foreign events and emit private local facts? A quoted origin is
+  an opaque store name with an unverified local shape, not proof of interoperability.
+  Read automations-and-translations `references/public-events-and-direction.md`.
+- Is the view identity explicitly marked `key` or unambiguously inferred? Does each
+  single-instance query/read supply every part exactly once, with compatible types,
+  and do state fixtures contain all parts? Do PDL keys align with the view's key?
+  Composite view keys still refuse binding at 4.135.0 (PLAY0268, #599); compilation
+  is not executable evidence. Read read-surface `references/named-keys.md`.
+- Does a production override replace the whole source/stream/id route, rather than
+  assume partial inheritance? Is its `for` destination still explicit and compatible?
+  Are skipped production routes valid, so eager resolution cannot fail unexpectedly?
+- Does a reaction/reducer `from Source[.Stream]` include the intended producers'
+  effective routes? Unrouted facts never match, including capture, reaction-direct
+  facts and public publication. PLAY0666 is a C# warning about all *known* producers,
+  not proof that a handler/foreign source will deliver. Filters have no stream-id
+  predicate and are not projection filters. Read toolchain
+  `references/production-routes-and-filters.md`.
+
+Report binding, reference execution and Stage admission separately. Never remove
+public metadata, key parts or filters to make a review's mode gate pass.

package/package/corpus/skills/cratis-screenplay-model-review/verification.json

@@ -3,6 +3,7 @@
   "input": "Review the marina berth .play model before we accept it: check the model and report findings, do not change anything.",
   "fixtures": [],
   "assertions": [
+    { "kind": "skill-contains", "value": "all *known* producers", "file": "references/public-keys-and-routes.md" },
     { "kind": "play-compiles" },
     { "kind": "skill-contains", "value": "PASS WITH WARNINGS" },
     { "kind": "skill-contains", "value": "Every finding is pinned to one declaration" },

package/package/corpus/skills/cratis-screenplay-projections/SKILL.md

@@ -75,6 +75,17 @@ build a read model** — two builders is error `PLAY0191`: *a projection or a
 reducer builds it, and only one of them*. A slice may still declare several
 projections, each building a **different** read model.
 
+## Public-event targets and observer filters
+
+In an explicitly outbound Translate slice, `projection P => PublicEvent` or
+`reducer P => PublicEvent` targets the slice's one local public event (ESM v9).
+The projection folds one instance per event source id; opaque reducers remain
+Unsupported in reference execution. Read
+[public-event folds](../cratis-screenplay-automations-and-translations/references/public-events-and-direction.md)
+for publication rules and the `when append`/`then PublicEvent` specification.
+A reducer can filter `from Source[.Stream]` (ESM v10); a projection cannot.
+Read [observer filters](../cratis-screenplay-toolchain/references/production-routes-and-filters.md).
+
 ## Projection-level directives
 
 `no automap`, `sequence <name>`, `file <path>`. `sequence` is a realization

package/package/corpus/skills/cratis-screenplay-read-surface/SKILL.md

@@ -55,16 +55,19 @@ A read model declares what it **is** — nothing about what builds it. Whatever
 builds it points at it with `=>`, and **exactly one thing may**: two builders is
 error `PLAY0191`. See `cratis-screenplay-projections` for the builder side.
 
-Do not mark a read-model property `identifier`. The executable model infers the
-instance identifier from the `by` property of the keyed queries that return the
-read model in its own slice
-(`query InvoiceById => InvoiceSummary optional`, then `by invoiceId InvoiceId`
-on its own body line). Several queries
-over the same `by` property are fine; each must still have the shape the
-executable model admits, `=> <ReadModel> optional` with one caller-supplied `by`. A read
-model with no keyed query, or with keyed queries over different `by` properties,
-has no unambiguous identifier and does not bind (`PLAY0268`), and specifications
-cannot select an instance of it.
+Use trailing `key` on top-level read-model properties, never `identifier`.
+Explicit marks replace inference; otherwise a single-instance query's `by` supplies
+identity (all such queries must agree). Only with no single-instance identifier
+and an admitted list query does the binder infer an unambiguous `*Id`; queryless
+read models need an explicit `key`. See named keys below for collection-key exclusions.
+One explicit key binds byte-identically to equivalent inference. Several marks
+form a composite key, supplied by name in query/read
+`by` blocks. At Screenplay 4.135.0 composite keys and block queries remain
+**authoring-only** (PLAY0268, #599); the scalar optional snapshot shape binds.
+Read [named keys](references/named-keys.md) for complete examples, trigger/command
+reads, all-parts fixtures, PLAY0660–0662 and command-read-only PLAY0661 repair.
+A `=>` target resolving to an event is an event-target builder, not a read model;
+keep event and read-model names distinct (see projections' public-event targets).
 
 ## `query`
 
@@ -79,12 +82,12 @@ query ListInvoices => InvoiceListReadModel[]
   authorize IsAuthenticated
 ```
 
-⚠️ **A list query is design-only.** `=> RM[]`, `observable`, `filter`, `scoped to` and
-`performer` are valid model language, but neither the executable model nor Stage
-4.24.0 binds or renders them (`PLAY0268`). Model them when the application needs them,
-and keep a list the domain needs. A keyed `XById => RM optional` query with one `by` is
-the shape that binds, runs in specifications and renders, but adding it beside a list
-does not unblock anything: while a list remains, the whole application stays unbound.
+**Name the compiler and renderer.** At Screenplay 4.135.0, optional keyed queries
+and collection queries bind, including `observable`, with caller-supplied `by`
+or no `by` on a collection. Filters, scope, performer and context-derived `by`
+remain PLAY0268. The old Stage 4.24.0 list refusal is not a current compiler
+limitation; check the target renderer's admission separately. Keep a list the
+domain needs rather than inventing a keyed query solely to infer identity.
 
 Return-type forms after `=>`: `ReadModel`, `ReadModel optional`, `ReadModel[]`,
 each optionally prefixed `observable`. `ReadModel[] optional` permits an absent

package/package/corpus/skills/cratis-screenplay-read-surface/references/named-keys.md

@@ -0,0 +1,122 @@
+<!-- Copyright (c) Cratis. All rights reserved. -->
+<!-- Licensed under the MIT license. See LICENSE file in the project root for full license information. -->
+
+# Named read-model keys and complete lookups
+
+## Contents
+
+- Declare identity
+- Supply every part
+- Specifications and executable boundary
+- Repairs and evidence
+
+## Declare identity
+
+A trailing `key` on a top-level read-model property declares instance identity.
+One explicit mark replaces inference and binds byte-identically to the equivalent
+inferred identifier. Several marks declare a composite key. At 4.135.0, identity
+selection is:
+
+1. Explicit `key` marks take precedence over inference.
+2. Without marks, single-instance queries in the owning slice supply identity from
+   their `by` property; their distinct `by` names must identify one property.
+3. Only when no single-instance query supplies an identifier **and** an admitted
+   collection/list query exists does the binder consider conventional `*Id` names
+   (case-sensitive). It first excludes collection-query `by` properties: if exactly
+   one candidate remains, that is the identifier; otherwise it uses all `*Id`
+   candidates and requires exactly one. An admitted list query here is a collection
+   query without context-derived `by`, filters, scope or performer.
+
+A projection-only/queryless read model needs an explicit `key`: a lone `*Id`
+property alone does not infer identity. Never use the command's `identifier`
+modifier on a read model.
+
+A key part is required and noncollection; it cannot also be `optional`, `generated`,
+`identifier` or `subject`. A single key may have a composite type, but parts of a
+multipart key must be scalar. Declaration order is display order, not identity:
+Chronicle's object keys are not ordered, encoded event stream ids.
+
+Choose a composite key when independent coordinates identify the business view,
+such as resource and reporting period. Prefer the natural single id when the view
+is one entity's state. Do not concatenate parts into an invented string id merely
+to pass binding; keep the truthful model and report the capability gap. Read-model
+keys do not supply projection routes: align each PDL `from ... key` mapping with
+the declared view identity (projection keys are a separate contract).
+
+## Supply every part
+
+A scalar query keeps `by name Type` on its own body line. A composite query has a
+bare `by` header and at least two distinct `name Type [from source]` children.
+Do not combine scalar and block forms. A single-instance lookup must supply every
+key part exactly once, with the declared types; collection queries may narrow by
+a subset but still have their separate executable-query limitations.
+
+A command or reaction trigger read uses a child `by` block of `part = source`.
+Sources are required, noncollection property paths with compatible nominal types,
+not literals. Trigger reads map from the trigger's declared values. The historical
+single `reads View by value` form remains available for a single key.
+
+This complete authoring-only example declares all lookup parts:
+
+```screenplay
+concept ResourceId : Uuid
+concept Period : String
+module Reporting
+  feature Months
+    slice StateView Totals
+      readmodel ResourceMonth
+        resourceId ResourceId key
+        period Period key
+        hours Decimal
+      query FindMonth => ResourceMonth optional
+        by
+          resourceId ResourceId
+          period Period
+    slice StateChange CloseMonth
+      command CloseMonth
+        resourceId ResourceId identifier
+        period Period
+        reads ResourceMonth as totals
+          by
+            resourceId = resourceId
+            period = period
+        produces event MonthClosed
+          for resourceId
+          period Period = period
+```
+
+Screen `data ... via query ... by value`, forms and navigation remain scalar
+lookups: they cannot supply a composite single-instance key (PLAY0661). Do not
+invent UI tuple syntax. Context-derived query parts do not become caller inputs;
+keep tenant/subject ownership at the runtime boundary, not in editable UI filters.
+
+## Specifications and executable boundary
+
+`given readmodel` and `then readmodel` state every key part (PLAY0351 if missing).
+A composite absence fixture uses an object with every named part. Query result
+assertions may omit keys when arguments already select the instance.
+
+At Screenplay 4.135.0, composite read-model keys, query `by` blocks and fixtures
+over those views remain authoring-only: binding reports PLAY0268 citing
+Screenplay#599 (still open). They do not reference-execute or render. This is not
+ESM v10 admission; v10 covers reaction identity, production routes and observer
+filters. Command reads independently remain unprotected/unadmitted (PLAY0271).
+A single explicit key does bind; Stage admission still depends on the complete
+model and projection/query shape, not just the key modifier.
+
+## Repairs and evidence
+
+- PLAY0660: fix key owner, modifier or type; no automatic repair.
+- PLAY0661: supply missing parts. The typed repair covers **command reads only**
+  when each missing part has one same-named compatible source. It preserves
+  authored mappings and refuses ambiguity; queries/trigger reads are not repaired.
+- PLAY0662: fix shape, duplicate/unknown parts or incompatible sources; no repair.
+- Read-model property rename remains unsupported until its mapping chain can be
+  preserved. Use the model-authoring proposal/preview/apply contract, not a text
+  shortcut around an identity-preserving refusal.
+
+Source: Screenplay `v4.135.0:Documentation/screenplay/{readmodels,queries,commands,reactions,specifications}.md`,
+`fixtures/named-read-model-keys.play`, decision 0060, and
+`Source/DotNET/Screenplay/Semantics/SemanticModelBinder.ReadModels.cs` (identity inference).
+Its authoring delivery shipped
+in 4.129.0; that release did not deliver #599's executable composite-key contract.

package/package/corpus/skills/cratis-screenplay-read-surface/verification.json

@@ -3,6 +3,9 @@
   "input": "Declare a Screenplay query and the screen that binds to it.",
   "fixtures": [],
   "assertions": [
+    { "kind": "skill-contains", "value": "query FindMonth", "file": "references/named-keys.md" },
+    { "kind": "skill-contains", "value": "command reads only", "file": "references/named-keys.md" },
+    { "kind": "skill-contains", "value": "remain authoring-only", "file": "references/named-keys.md" },
     { "kind": "play-compiles" },
     { "kind": "skill-contains", "value": "main `fd18129`" },
     { "kind": "skill-contains", "value": "filter status     InvoiceStatus optional" },

package/package/corpus/skills/cratis-screenplay-render-and-gap-fill/SKILL.md

@@ -25,9 +25,9 @@ Version pins live once in `cratis-screenplay-toolchain` `references/versions.md`
 
 | Source | Pin | Used for |
 | --- | --- | --- |
-| cratis CLI | `3.46.1` (`v3.46.1`) | Source-checked `Directory.Packages.props`: Stage 4.52.0, Screenplay 4.130.0, `Cratis.Arc.Screenplay` 22.54.0, Chronicle 19.32.0, Fundamentals 7.22.8; default runtime image `cratis/stage:4.52.0`. No new render/browser probe. UI-profile rejection (`CLI-RENDER-007` to `CLI-RENDER-010`) and render-then-recover shipped in 3.41.0 (Cratis/cli#301). Historical screens release vector: 3.40.7 (`af9f18e`) with `cratis/stage:4.51.1`. Reading baselines: 3.40.3, 3.39.0 and 3.28.3 (`8b43fef`) |
-| Stage | `4.52.0` (CLI 3.46.1 default) | Executed on CLI 3.43.0. Admission (`STAGE-ESM-*`, and `PLAY0268` render refusals surfaced by the CLI), ownership manifest, `Customizations/` seams, Debug-only specifications, guarded actions (`STAGE-SCENE-ACTION-001`) and interactions (`STAGE-SCENE-INTERACTION-001`) were source-checked at 4.51.3. Older baselines: 4.49.5, 4.43.0 and `v4.24.2` (`32dcac4`) |
-| Screenplay | bundled `4.130.0`; standalone `4.131.0` | Standalone compiler for V1 to V3; binding codes `PLAY0268` and code-attachment rules were read at `v4.66.0`. Historical CLI 3.41.0 probes used bundled 4.114.0; current `cratis` compiler claims require checking 4.130.0 |
+| cratis CLI | `3.50.0` (`v3.50.0`) | Source-checked `Directory.Packages.props`: Stage 4.67.0, Screenplay 4.131.0, `Cratis.Arc.Screenplay` 22.54.0, Chronicle 19.32.0, Fundamentals 7.22.8; default runtime image `cratis/stage:4.67.0`. Previous CLI 3.46.1 used Stage 4.52.0/Screenplay 4.130.0. No new render/browser probe. UI-profile rejection (`CLI-RENDER-007` to `CLI-RENDER-010`) and render-then-recover shipped in 3.41.0 (Cratis/cli#301). Historical screens release vector: 3.40.7 (`af9f18e`) with `cratis/stage:4.51.1`. Reading baselines: 3.40.3, 3.39.0 and 3.28.3 (`8b43fef`) |
+| Stage | `4.67.0` (CLI 3.50.0 default) | Source-checked, not executed as a new vector. Previous Stage 4.52.0 was executed on CLI 3.43.0. Admission (`STAGE-ESM-*`, and `PLAY0268` render refusals surfaced by the CLI), ownership manifest, `Customizations/` seams, Debug-only specifications, guarded actions (`STAGE-SCENE-ACTION-001`) and interactions (`STAGE-SCENE-INTERACTION-001`) were source-checked at 4.51.3. Older baselines: 4.49.5, 4.43.0 and `v4.24.2` (`32dcac4`) |
+| Screenplay | bundled `4.131.0`; standalone `4.135.0` | Standalone compiler for V1 to V3; binding codes `PLAY0268` and code-attachment rules were read at `v4.66.0`. Historical CLI 3.41.0 probes used bundled 4.114.0; current `cratis` compiler claims require checking 4.131.0 |
 | Rendered apps (historical check) | Arc `22.50.5`, Chronicle `19.32.0`, Scene packages | Stage 4.51.3 scaffold; `[ProtectedDecision]` / `DecisionRead<T>` available to gap-fill, not emitted enforcement. Embedded reverse extraction disabled; verify generated packages before claiming exact Scene runtime parity |
 
 Historical facts retain their checked tags; current pins are source-checked, not new runtime probes.
@@ -77,9 +77,12 @@ the model, hand-write the command and its response with the model (and its fixtu
 specifications) as the contract, and report V3 from the standalone tool and V5 as `not run: no render`.
 
 Models with event sources, streams or command routes bind and reference-execute as ESM v8 on standalone
-Screenplay 4.125.0, so report V3 and V4 from that tool. They are still case A or C for rendering: current CLI 3.46.1
-refuses models above ESM v7 with `CLI-RENDER-004`, so hand-write the code with the model as the
-contract (`cratis-screenplay-toolchain` `references/sources-and-streams.md`).
+Screenplay 4.125.0, so report V3 and V4 from that tool. Previous CLI 3.46.1 refused above v7 with CLI-RENDER-004. Current CLI 3.50.0/Stage
+4.67.0 reaches v8 route checks and construct admission through v10. Public publication,
+foreign events/event captures and v10 reaction identity/filters/production overrides
+still receive typed refusals; reducer filters render. Keep refused scope as case A/C,
+never infer target support from binding. Read Stage's `references/admission.md` and
+toolchain `references/sources-and-streams.md`.
 
 Two rules hold in every case: a customization never makes a rejected model renderable, and
 a whole-application V5 is never claimed from a subset. The CLI renders whole applications

package/package/corpus/skills/cratis-screenplay-render-and-gap-fill/references/gap-fill-handoff.md

@@ -77,9 +77,9 @@ not bind a modeled reaction or capture. Case C (no generated application): there
 composition conventions (`rules/vertical-slices.md`, `cratis-chronicle-reactor`).
 Declare the trusted actor with reaction `runs as system role "<Role>"`
 (standalone 4.125.0, ESM v10); `given caller` is not an invocation actor.
-Historical CLI 3.41.0's older compiler rejected the syntax. Current CLI 3.46.1
-bundles Screenplay 4.130.0 / Stage 4.52.0 but still admits through v7 only
-(CLI-RENDER-004 for v10). Gap-fill retains the declared role and uses Arc
+Historical CLI 3.41.0's older compiler rejected the syntax. CLI 3.50.0/Stage 4.67.0
+reaches v10 construct admission but still refuses reaction identity
+(STAGE-ESM-034); previous CLI 3.46.1 admitted through v7 only. Gap-fill retains the declared role and uses Arc
 `[ExecuteCommandsAsSystem]` for returned commands. Checked model and diagnostics:
 captures-and-reactions `references/invocation-identity.md`.
 

package/package/corpus/skills/cratis-screenplay-render-and-gap-fill/verification.json

@@ -38,7 +38,7 @@
     },
     {
       "kind": "skill-contains",
-      "value": "case A or C for rendering"
+      "value": "Keep refused scope as case A/C"
     },
     {
       "kind": "skill-contains",

package/package/corpus/skills/cratis-screenplay-scenario-coverage/SKILL.md

@@ -175,6 +175,17 @@ target requirements.
 - After a correction or backdated fact, does the view still say something true?
 - Cross-context views: are the real source contracts resolved, or is missing evidence a gap?
 
+## Public-event coverage (ESM v9)
+
+Outbound publication needs `when append <private>` and `then <PublicEvent>`:
+complete state, incomplete state, unchanged repeat, changed instance, separate
+source ids and the exported field boundary. Reference publication is executable;
+source-event captures and reached opaque event-target reducers are typed
+Unsupported. Read automations-and-translations `references/public-events-and-direction.md`.
+For routed producers/observers, cover override versus inherited route, skipped
+production route failure, matching/wrong source/stream and unrouted facts;
+see toolchain `references/production-routes-and-filters.md`.
+
 ## Version skew: reaction cascades and false PLAY0285
 Under ESM v6 a command spec's `then` lists the events reactions cascade from it. The compiler
 bundled in `cratis` before 3.28.2 (Screenplay 4.60.1) reported a **false PLAY0285** for such

package/package/corpus/skills/cratis-screenplay-scenario-coverage/references/spec-forms-by-mode.md

@@ -5,7 +5,7 @@ The subsets themselves (what binds, what renders) are owned by `cratis-screenpla
 says what that means for writing specs. A form outside the chosen mode is never deleted from a
 design model: keep it and record the gap. The detailed Stage 4.24.x rows below
 retain historical admission evidence; current pins are standalone Screenplay
-4.131.0 / CLI 3.46.1 (Screenplay 4.130.0 / Stage 4.52.0). Run actual target admission instead of assuming old restrictions carry over.
+4.135.0 / CLI 3.50.0 (Screenplay 4.131.0 / Stage 4.67.0). Run actual target admission instead of assuming old restrictions carry over.
 Typed example/override forms: `cratis-screenplay-specifications`
 `references/examples-and-routes.md`.
 
@@ -23,7 +23,7 @@ Typed example/override forms: `cratis-screenplay-specifications`
 | Command spec listing reaction cascade events | yes (v6 semantics) | false PLAY0285 on a cratis before 3.28.2 bundle only; see SKILL.md "Version skew" | no (no reactions) |
 | `generated <name> = <value>` under `when`, `then returns` (ESM v7) | yes | yes on standalone Screenplay 4.68.0 or later; not on the 4.66.0 bundled in cratis 3.28.x (`PLAY0268`) | historically no at Stage 4.24.x; check current target admission |
 | `then events in any order` | yes | yes | yes |
-| Event `stream` / `no stream`, typed `for` and stream ids | yes | ESM v8 at 4.125.0 | CLI 3.46.1 refuses models above v7 before planning |
+| Event `stream` / `no stream`, typed `for` and stream ids | yes | ESM v8 at 4.125.0 | CLI 3.50.0 reaches Stage route checks; routed read-model/query replay can still refuse STAGE-ESM-030 |
 | Typed examples and overrides | yes | expanded and type-checked before binding; required fields remain required | depends on expanded contract, not fixture reuse |
 | `given operation ... fails`, `then operation`, `then compensated` | yes | unadmitted PLAY0268 | gap-fill |
 | Refusal branches, `when redelivered`, `then no events` | yes | unadmitted PLAY0268 | gap-fill |