@cratis/pi 7.31.0 → 7.33.0

package/package/corpus/skills/cratis-screenplay-automations-and-translations/SKILL.md

@@ -40,8 +40,8 @@ identity, effect and pending-work contract at that point; do not postpone it to
 - Reaction `runs as system role "<Role>"` declares an invocation actor (ESM v10).
   Without it the invoke has no caller. Historical CLI 3.41.0's 4.114.0 compiler
   rejected the syntax (PLAY0137); previous CLI 3.46.1 refused ESM v10
-  at render admission (CLI-RENDER-004). CLI 3.50.0 reaches Stage 4.67.0's
-  construct admission, which still refuses reaction identity (STAGE-ESM-034). Checked model/diagnostics: captures-and-reactions
+  at render admission (CLI-RENDER-004). The pinned CLI/Stage pair (toolchain
+  `references/versions.md`) reaches construct admission, which still refuses reaction identity (STAGE-ESM-034). Checked model/diagnostics: captures-and-reactions
   `references/invocation-identity.md`.
 
 ## Effect guarantees and recovery traps

package/package/corpus/skills/cratis-screenplay-automations-and-translations/references/audit-format.md

@@ -12,7 +12,7 @@ technique: partial work stays visible and nothing is skipped because it looked r
 Result is `complete` only when every column is filled or says why it does not apply (for example
 "direct effect: immediate, internal, cannot fail"). `open` names the unresolved decision and who
 answers. `blocked` names the actual capability gap with intended behavior. For example,
-CLI 3.50.0 admits ESM v10 to Stage 4.67.0 construct checks, where reaction identity
+the pinned CLI/Stage pair (toolchain `references/versions.md`) admits ESM v10 to construct checks, where reaction identity
 is refused with STAGE-ESM-034. Previous CLI 3.46.1 refused v10 at the version gate
 with CLI-RENDER-004; do not report that historical refusal as the current gap.
 

package/package/corpus/skills/cratis-screenplay-automations-and-translations/references/automation-patterns.md

@@ -72,8 +72,8 @@ Screenplay 4.125.0 declares the actor with reaction-level `runs as system role
 "<Role>"` (ESM v10); without it a gated invocation has no caller and denies.
 `given caller` is not an invocation actor. Role requirements remain enforced;
 claim conditions for this system principal remain unknown. Historical CLI 3.41.0's
-older compiler rejected the syntax (PLAY0137). CLI 3.50.0 bundles Screenplay 4.131.0 / Stage 4.67.0 and reaches v10
-construct admission, but reaction identity still refuses STAGE-ESM-034.
+older compiler rejected the syntax (PLAY0137). The pinned CLI/Stage pair (toolchain
+`references/versions.md`) reaches v10 construct admission, but reaction identity still refuses STAGE-ESM-034.
 Previous CLI 3.46.1 refused v10 at its version gate; see toolchain `references/versions.md`.
 Use the checked model in captures-and-reactions `references/invocation-identity.md`.
 Arc gap-fill uses `[ExecuteCommandsAsSystem("<role>")]` for returned commands,

package/package/corpus/skills/cratis-screenplay-automations-and-translations/references/provenance.md

@@ -44,8 +44,8 @@ binds); tool-qualified verdict text; the trusted-actor text now names `[ExecuteC
 `reactions.md`, `ReactionIdentityParser.cs`, `ReactionRefusalValidator.cs` and the
 binder's v10 selection; the checked scenario passed reference execution. CLI
 3.41.0's older parser and Stage 4.51.3's v7 planner were historical target limits.
-Previous CLI 3.46.1 refused v10 at its version gate. CLI 3.50.0 bundles
-Screenplay 4.131.0/Stage 4.67.0, reaches v10 construct checks, and still refuses
-reaction identity with STAGE-ESM-034; see toolchain `references/versions.md`.
+Previous CLI 3.46.1 refused v10 at its version gate. The pinned CLI/Stage pair
+(toolchain `references/versions.md`) reaches v10 construct checks and still
+refuses reaction identity with STAGE-ESM-034.
 Public/direction forms and routes/filters follow Screenplay v4.135.0 decisions
 0049–0051 and 0060–0066, not the older inbound-only translation scope.

package/package/corpus/skills/cratis-screenplay-automations-and-translations/references/public-events-and-direction.md

@@ -124,8 +124,8 @@ ESM v9 shipped in Screenplay 4.117.0 and is selected only by use of public event
 origins, direction, event-target builders or events-source captures. At 4.135.0,
 publication reference scenarios execute; imported shapes still refuse binding.
 Stage 4.52.0 (previous CLI 3.46.1) audits only through v7: CLI-RENDER-004 precedes
-its STAGE-ESM-016 version refusal. CLI 3.50.0/Stage 4.67.0 reaches construct
-admission through v10 but still refuses publication (STAGE-ESM-032), foreign
+its STAGE-ESM-016 version refusal. The pinned CLI/Stage pair (toolchain `references/versions.md`)
+reaches construct admission through v10 but still refuses publication (STAGE-ESM-032), foreign
 events/events-source captures (STAGE-ESM-033); source admission is not rendering.
 
 Source: Screenplay `v4.135.0:Documentation/screenplay/fixtures/public-events.play`,

package/package/corpus/skills/cratis-screenplay-captures-and-reactions/SKILL.md

@@ -75,8 +75,8 @@ Read [invocation identity](references/invocation-identity.md) for the checked
 scenario, claim/unknown semantics and PLAY0647–0652/0557 diagnostics.
 
 Historical CLI 3.41.0's 4.114.0 compiler rejected this source with PLAY0137.
-Previous CLI 3.46.1 refused v10 (CLI-RENDER-004); CLI 3.50.0 reaches
-Stage 4.67.0's construct admission, still refusing identity (STAGE-ESM-034).
+Previous CLI 3.46.1 refused v10 (CLI-RENDER-004); the pinned CLI/Stage pair (toolchain
+`references/versions.md`) reaches construct admission, still refusing identity (STAGE-ESM-034).
 Target realization is gap-fill, using Arc `[ExecuteCommandsAsSystem]` for returned commands. Without that attribute
 Arc supplies no principal and `[Authorize]`/`[Roles]` deny. Each invoked command
 is atomic, not the whole cascade; earlier accepted facts remain after a later refusal.

package/package/corpus/skills/cratis-screenplay-captures-and-reactions/references/invocation-identity.md

@@ -71,8 +71,8 @@ module Work
 
 Historical CLI 3.41.0 bundled Screenplay 4.114.0, which did not parse `runs as`:
 the example's `cratis screenplay validate --executable --warnings-as-errors`
-returned PLAY0137, exit 5. This is not a current parser claim. CLI 3.50.0 bundles
-Screenplay 4.131.0/Stage 4.67.0 and reaches v10 construct admission, but
+returned PLAY0137, exit 5. This is not a current parser claim. The pinned CLI/Stage pair
+(`cratis-screenplay-toolchain/references/versions.md`) reaches v10 construct admission, but
 reaction identity still refuses STAGE-ESM-034. Previous CLI 3.46.1/Stage 4.52.0
 audited through v7 only (`references/versions.md` in toolchain).
 Clock/application-trigger identities have no Stage Arc realization either.

package/package/corpus/skills/cratis-screenplay-command-surface/SKILL.md

@@ -75,6 +75,10 @@ scalar/composite stream-id types and nested route mapping sources, including leg
 markers. Keep a surrogate identity and carry protected data in the payload.
 Chronicle likewise rejects `[PII]`/`[Encrypted]` identifiers (CHR0034/CHR0052).
 
+Read [enum numbers](references/enum-numbers.md) for `draft = 1`, unique int32
+all-or-none pins, stored/public identity safety, `enum-pinning`, ESM v12 and the
+CLI/Stage gap. Unnumbered enums keep positions; specifications use names.
+
 ⚠️ **Enum trap.** A value literally named `validate` is read as an empty validate
 block. Write `@validate` for the value; the compiler warns when it sees the
 ambiguity.
@@ -368,8 +372,8 @@ Four contexts, and **what each omits is load-bearing** — when writing a code b
 ## Verify
 
 - [ ] Validate the complete model root with warnings as errors; name the tool,
-      version and result. Current pins: standalone 4.135.0 / CLI 3.50.0; bundle
-      compatibility and execution are separate checks.
+      version and result. Pins: toolchain `references/versions.md`;
+      bundle compatibility and execution are separate checks.
 - [ ] No unintended `PLAY0478` or `PLAY0479` information remains.
 - [ ] At most one command property carries `identifier`, and no event property does.
 - [ ] Format rules live on the `concept`; state-dependent rules are specifications.
@@ -385,10 +389,8 @@ Four contexts, and **what each omits is load-bearing** — when writing a code b
       runnable or renderable without saying which tool admits it.
 - [ ] No event carries an optional property covering two situations.
 
-Read `cratis-screenplay-toolchain/references/versions.md` when selecting a compiler or determining which executable or renderable subset admits a construct.
-
-Versions, tool capabilities and the executable and renderable subsets: `cratis-screenplay-toolchain` (`references/versions.md`). Where a construct sits in the
-method: `cratis-screenplay-modeling-lifecycle` and `cratis-screenplay-slice-design`.
+Compiler pins and admission: `cratis-screenplay-toolchain/references/versions.md`.
+Method: `cratis-screenplay-modeling-lifecycle` and `cratis-screenplay-slice-design`.
 
 ## Route near misses
 

package/package/corpus/skills/cratis-screenplay-command-surface/references/compliance.md

@@ -6,6 +6,7 @@
 ## Contents
 
 - Classify the value on its concept
+- Recover classification from C# with Arc 22.70.0
 - Declare the use separately
 - Identify the person, not the stream
 
@@ -63,6 +64,45 @@ This mapping is not admission: either marker, including qualifiers and scopes,
 still blocks executable binding with PLAY0268. Subject lineage is a different
 role, described below.
 
+## Recover classification from C# with Arc 22.70.0
+
+Reverse generation is not the C# provider mapping above. Source authority: Arc
+`v22.70.0:Documentation/backend/csharp/generating-a-screenplay.md` (Operational
+secrets), `Source/DotNET/Screenplay/Emission/Concepts/ConceptSyntaxBuilder.cs`
+and `Source/DotNET/Screenplay/Analysis/Types/PersonalDataMarkings.cs`.
+Check the generator package actually loaded; the CLI's bundle may be older.
+
+- Both `[Encrypted]` and `[NotAudited]` must be on the concept to recover
+  `secret`. Partial or member-specific markings report SP0058 (Information),
+  without adding `secret`; existing `pii` remains.
+- For `[Encrypted(EncryptionScope.Namespace)]` or Global plus `[NotAudited]`,
+  default output keeps bare `secret` and reports SP0061 (Information), naming
+  the unstated scope. It therefore implies Subject, not the source scope.
+  Set `ScreenplayOptions.AuthoringOnlyConstructs = true` (CLI adapter flag
+  `--authoring-only-constructs`) to state `secret scope namespace` or
+  `secret scope global` in the concept body. Subject stays implicit. Scope
+  is syntax-only: it raises no ESM version and grants no executable admission.
+  `pii secret` gets no scope because the providers ignore it.
+- A property or positional constructor parameter marked `[PII]` on a non-concept
+  type reports SP0062 (Information); the marking is not stated and no concept
+  is invented. Preserve the source protection, record the loss, and introduce a
+  personal-data concept in source or the intentional candidate.
+- Member `[PII]` promotes an existing concept to `pii` across all its uses.
+  SP0063 (Information) lists unmarked analyzed uses when the concept itself
+  lacks `[PII]`. Review that widening: explicitly classify the concept if the
+  meaning is shared, or separate personal and nonpersonal meanings into distinct
+  concepts. No SP0063 is reported if the concept is marked or all analyzed uses
+  are marked. Never remove protection merely to silence the diagnostic.
+- Protected identity concepts keep their identities/routes but lose their
+  annotations with SP0059 (Information, now worded `pii/secret`); record the
+  protection loss and use a surrogate identity, not a declassified payload value.
+
+Reasons, special/criminal qualifiers and purposes are not inferred. Changing
+scope for persisted events still needs a new generation. Every diagnostic is a
+loss or review item, including Information; see legacy-extraction
+[generate notes](../../cratis-screenplay-legacy-extraction/references/generate-notes.md)
+for the self-check contract and compiler-upgrade handling.
+
 ## Declare the use separately
 
 ```screenplay

package/package/corpus/skills/cratis-screenplay-command-surface/references/context.md

@@ -105,7 +105,7 @@ Checked at Screenplay 4.127.0: `$identity.<property>` is the same caller value a
 is supported, not deprecated. Historical `cratis` CLI 3.41.0 bundled Screenplay 4.114.0, which predated both:
 its parser rejected a top-level `identity` block (`PLAY0001`), and with `--executable` it read a
 `$identity.<property>` mapping as a raw expression (`PLAY0268`). Those checks used standalone 4.127.0;
-they are not current CLI 3.50.0/Screenplay 4.131.0 parser claims. Check current renderer
+they are not current parser claims; compiler pins are in toolchain `references/versions.md`. Check current renderer
 admission separately before choosing caller mappings. Built-ins are `id`, `name`, `userName`,
 `isAuthenticated`, `roles`, `claims.<name>` (everything after `claims.` is opaque).
 Bare `$identity` reports PLAY0152; unknown properties report PLAY0155. Only

package/package/corpus/skills/cratis-screenplay-command-surface/references/enum-numbers.md

@@ -0,0 +1,93 @@
+<!-- Copyright (c) Cratis. All rights reserved. -->
+<!-- Licensed under the MIT license. See LICENSE file in the project root for full license information. -->
+
+# Explicit enum member numbers
+
+Authoring shipped in Screenplay 4.137.0; non-positional executable numbers shipped
+in 4.139.0 as ESM v12 (decision 0065). The model owns member identity, not the renderer.
+
+```screenplay
+domain EnumNumbers
+
+concept InvoiceId : Uuid
+concept InvoiceStatus : Enum
+  draft = 1
+  sent = 4
+  cancelled = -1
+
+module Invoicing
+  feature Issuing
+    slice StateChange SendingInvoice
+      command SendInvoice
+        invoiceId InvoiceId identifier
+        status InvoiceStatus
+        produces InvoiceSent
+          for invoiceId
+          status = status
+      event InvoiceSent
+        status InvoiceStatus
+      specification Sending
+        when SendInvoice
+          invoiceId = "6f9619ff-8b86-d011-b42d-00c04fc964ff"
+          status = "sent"
+        then InvoiceSent
+          for "6f9619ff-8b86-d011-b42d-00c04fc964ff"
+          status = "sent"
+```
+
+## Source rules
+
+- Number **all members or none**; there is no implicit continuation after a pin.
+- Numbers are unique whole int32 values, from -2147483648 through 2147483647.
+  Gaps and negative numbers are allowed; aliases and flags semantics are not.
+- Write decimal digits with an optional minus sign: no leading zeros, fraction,
+  exponent or plus sign. `-0` prints canonically as `0`.
+- Escape a keyword member as usual, for example `@validate = 7`.
+- Unnumbered enums retain zero-based positional meaning. Descriptions and
+  validation blocks still work. Specifications, fixtures, validation operands
+  and conditions use **member names**, never their numbers.
+
+PLAY0667 reports mixed numbering, PLAY0668 duplicate numbers, PLAY0669 an
+out-of-int32 value and PLAY0670 malformed number syntax. None has an automatic
+repair: correcting a stored identity needs an author decision.
+
+## When to pin
+
+Pin enums used in persisted events or a stable public contract, or when retaining
+numbers extracted from an existing system. Before reordering, inserting or removing
+members, establish the **stored** numbers first; numbering an already reordered list
+would preserve the wrong meaning. Never renumber a published member or reuse its
+number for another meaning. Pinning does not prove old readers accept a removed member.
+
+A short-lived enum used only by command inputs or views may remain positional.
+Ordinary compilation does not demand pins. Opt into `--check enum-pinning`
+(or `PLAY0671` or `all`) for an Information hint on wholly unnumbered enums used
+by event properties, including through composite types. MCP `diagnostics` uses
+`checks: "enum-pinning"`. The hint suggests `propose-number-enum-members`, which
+pins current positions; it is a refactoring, not a correctness repair. Read
+model-authoring `references/mcp-tools.md` for the revision-checked proposal loop.
+
+## Executable contract and consumer boundary
+
+ESM v12 adds an optional canonical **last** `numbers` array parallel to `values`.
+For the concept above, `values` is `["draft", "sent", "cancelled"]` and `numbers`
+is `[1, 4, -1]`. Non-positional numbers select v12. Pins equal to `0..n-1` are
+retained in source/AST but omitted from ESM, preserving the previous executable
+version, bytes and revision; unnumbered enums also preserve their old bytes.
+
+Strict reading rejects `numbers` in older versions, without enum values, with a
+length mismatch, duplicates, non-int32 entries or a positional array (non-canonical).
+Programmatic validation enforces the same contract. Specifications still compare
+names; numbers are neither alternative fixture values nor flags.
+
+Consumers must **explicitly admit v12**. CLI 3.53.1 and Stage 4.73.1 both bundle
+Screenplay 4.137.0: `cratis render`/Stage do not admit v12 yet. A model with
+non-positional numbers compiles and binds with standalone Screenplay >= 4.139.0,
+but does not render through that CLI. Do not remove its pins to pass rendering;
+report the consumer gap. See toolchain `references/versions.md`.
+
+Sources checked at `v4.139.0`: `Documentation/screenplay/concepts.md`,
+`interoperability.md`, `diagnostics.md`, `mcp/authoring-tools.md`, decision 0065,
+`Semantics/Versions.cs`, `SemanticModelValidator.EnumMemberNumbers.cs` and the
+source-backed `EnumMemberNumbersCorpus.V12` (under `Source/DotNET/`). Consumer
+pins: CLI `v3.53.1:Directory.Packages.props`, Stage `v4.73.1:Directory.Packages.props`.

package/package/corpus/skills/cratis-screenplay-command-surface/references/generated-values-and-responses.md

@@ -1,9 +1,8 @@
 ## Generated values and responses (ESM v7)
 
 A `generated` command property and `returns` response bind and reference-execute
-as ESM v7 (checked at 4.68.0). Current pins are standalone Screenplay 4.135.0
-and CLI 3.50.0 (bundled Screenplay 4.131.0/Stage 4.67.0); `cratis-screenplay-toolchain`
-`references/versions.md` owns the table. CLI#261 is closed: CLI now admits v7
+as ESM v7 (checked at 4.68.0). Current pins:
+`cratis-screenplay-toolchain/references/versions.md`. CLI#261 is closed: CLI now admits v7
 to Stage planning. The historical CLI 3.41.0 v7 canonical corpus received Stage
 generated-value and response refusals STAGE-ESM-028/029. Do not turn this into a blanket compiler
 refusal or promise a render from binding alone. Preserve the contract for gap-fill
@@ -45,7 +44,7 @@ Rules (all read at `v4.68.0`):
 
 Operations remain authorable/unadmitted (PLAY0268). Named event sources,
 streams and command/specification routes instead bind and reference-execute as
-ESM v8 at 4.125.0; CLI 3.50.0 reaches Stage construct admission through v10,
+ESM v8 at 4.125.0; the pinned CLI (toolchain `references/versions.md`) reaches Stage admission through v10,
 not blanket target support. Syntax/MCP acceptance alone is not execution. Source/stream
 forms and realization boundary: `cratis-screenplay-toolchain`
 `references/sources-and-streams.md`. Do not infer further syntax or provider

package/package/corpus/skills/cratis-screenplay-event-modeling/SKILL.md

@@ -139,8 +139,9 @@ What binds depends on **which tool** you ask, so name the tool and its version:
   standalone 4.125.0. Use `screenplay test` or MCP `run-specifications` for V4.
   Operations/systems, exact numbers and refusal/redelivery remain unadmitted.
   Historical CLI 3.41.0 rejected `runs as` syntax and its Stage 4.51.3 check
-  refused generated values/responses with STAGE-ESM-028/029. CLI 3.50.0 bundles
-  Screenplay 4.131.0/Stage 4.67.0; v10 reaches construct admission, not full support.
+  refused generated values/responses with STAGE-ESM-028/029. For the pinned CLI/Stage pair
+  (`cratis-screenplay-toolchain/references/versions.md`), v10 reaches construct
+  admission, not full support.
   Source/binding admission and target realization are separate gates.
 
 The ESM versions, the full disposition table and the Step 7 clock example's binding

package/package/corpus/skills/cratis-screenplay-event-modeling/references/parsed-not-runnable.md

@@ -28,7 +28,7 @@ Pins and consumer boundaries: toolchain `references/versions.md`.
 | Command reads/concurrency | Legacy unprotected decisions, PLAY0271 |
 | Invokes-only trigger reads | Report-only, not protected state; direct production with reads refuses |
 | Generated values/responses | v7 binding/reference execution; historical Stage 4.51.3 check: member refusals STAGE-ESM-028/029 |
-| Sources/streams and command/specification routes | v8 binding/reference execution; CLI 3.50.0 reaches Stage construct checks through v10 |
+| Sources/streams and command/specification routes | v8 binding/reference execution; the pinned CLI (toolchain `references/versions.md`) reaches Stage checks through v10 |
 | Declared reaction invocation actor | v10 binding/reference execution; older CLI parser PLAY0137; Stage planner refuses v10 |
 | Operations/systems, exact numbers, refusal/redelivery | Source accepted; whole binding refuses PLAY0268 |
 | UI | Authoring/deferred metadata; runtime support is a separate consumer contract |

package/package/corpus/skills/cratis-screenplay-legacy-extraction/SKILL.md

@@ -41,6 +41,7 @@ v19.32.0): `cratis-screenplay-toolchain` `references/versions.md`. Checked at th
 | --- | --- |
 | `generate` options, no default-file certainty (stdout when `--file` is absent), spec-project exclusion by name, `CLI0005/0009/0014-0017` | cli `v3.28.2:Source/Cli/Commands/Screenplay/{GenerateScreenplayCommand,GenerateScreenplaySettings,ScreenplayProjectSelection,ScreenplayDiagnosticCodes}.cs` |
 | `SP0016` (rule in code, computed message, `When`/`Unless` written as unconditional), `SP0024` (source did not compile) | Arc `v22.50.5:Source/DotNET/Screenplay/ScreenplayDiagnosticCodes.cs`, `Documentation/backend/csharp/generating-a-screenplay.md` |
+| Non-default secret scope in authoring mode, SP0061–SP0063, self-check contract on compiler upgrades | Arc `v22.70.0:Documentation/backend/csharp/generating-a-screenplay.md`, `Source/DotNET/Screenplay/Verification/ExpectedBindingDiagnostics.cs`; `references/generate-notes.md` |
 | `prologue start` is an interactive wizard that writes `cratis-prologue.json`; `interpret` resolves its language model from the Prologue file, then the global CLI configuration (cli#241 open) | cli `v3.28.2:Source/Cli/Commands/Prologue/{StartPrologueCommand,LlmOptionsResolver}.cs`, `Documentation/reference/prologue.md` |
 | Extractor effects (CDC enable, publication and replication slot), POST/PUT/DELETE only, 2 s correlation window, interpret payload (uncapped model outline and names, observed lists capped at 50, schema tables capped per schema observation), existing slot/publication reused; cleanup missing (Prologue#37) | Prologue `ad4bbe7:Source/Extractor/Sources/**`, `Source/Configuration/*`, `Source/Interpretation/EvidenceFormatter.cs` |
 | `then error`, `then denied`, `unique ... released by` | Screenplay `v4.66.0:Documentation/screenplay/{specifications,constraints}.md` |
@@ -154,8 +155,9 @@ chain per slice before handoff (evidence template); never manufacture references
      `unique ... on <every event that sets it>` with `released by`
      (`references/rule-modeling.md`);
    - preserve personal-data/secret protection and authorization found in code,
-     using bare `pii` / `secret` (4.127.0); deprecated marker repairs keep legal
-     notes intact, never guess a purpose or basis. Derive purpose/use/retention
+     using `pii` / `secret` and evidenced secret scope; Arc 22.70.0 recovery
+     losses (SP0061–SP0063) need review (`references/generate-notes.md`).
+     Deprecated marker repairs keep legal notes intact, never guess a purpose or basis. Derive purpose/use/retention
      declarations only from evidence or expert decisions; run `--check purposes`
      and inspect the processing record as prompts, not a legal verdict. Keep
      hand-joined legacy ids scalar; never infer composite parts by splitting text.

package/package/corpus/skills/cratis-screenplay-legacy-extraction/references/generate-notes.md

@@ -7,6 +7,8 @@
 - Coverage (what a provider reads)
 - Diagnostics are the loss list
 - Arc recovery and authoring-only options
+- Arc 22.70.0 compliance recovery
+- Generated-document self-check on compiler upgrades
 - Reading the output cheaply
 
 Flags verified with `cratis screenplay generate --help` on the version recorded in
@@ -17,9 +19,16 @@ cratis-screenplay-toolchain `references/versions.md`; behaviour from the cratis
 Screenplay.CritterStack `v0.24.0`. Version-specific capability facts belong in cratis-screenplay-toolchain
 `references/versions.md`.
 
-Current CLI is 3.50.0, with Screenplay 4.131.0 / Stage 4.67.0 /
-Arc.Screenplay 22.54.0 / Chronicle 19.32.0 / Fundamentals 7.22.8
-(`references/versions.md` in the toolchain; standalone Screenplay is 4.135.0).
+For the current standalone compiler and CLI bundle, use the toolchain's
+[version table](../../cratis-screenplay-toolchain/references/versions.md).
+The compliance and self-check sections below are source-checked at Arc 22.70.0
+(`Documentation/backend/csharp/generating-a-screenplay.md`,
+`Analysis/Types/{ConceptRegistry,PersonalDataMarkings,TypesTheDocumentCannotName}.cs`,
+`Emission/Concepts/ConceptSyntaxBuilder.cs`, `Emission/ProtectedIdentityAnnotations.cs`
+and `Verification/ExpectedBindingDiagnostics.cs` under `Source/DotNET/Screenplay/`).
+They require that generator release, not an older bundled adapter;
+a standalone compiler upgrade does not upgrade the generator.
+
 Option/admission evidence checked at CLI 3.41.0: released
 `GenerateScreenplaySettings.cs`, `ArcScreenplayGeneration.cs`, v7 planning specs
 and `Documentation/reference/screenplay.md`; older diagnostic probes below keep
@@ -107,6 +116,65 @@ Handler/reaction bodies, unresolved conditions and unproven origins still need
 source review. Do not infer generation/evolution/absence-assertion coverage from
 a package upgrade; read diagnostics and reconcile each recovered scenario.
 
+## Arc 22.70.0 compliance recovery
+
+A concept with both `[Encrypted]` and `[NotAudited]` becomes `secret`.
+Encryption or audit suppression alone, or only on a member, does not establish
+that concept-wide contract: SP0058 (Information) reports the partial marking
+without adding `secret`; an existing `pii` classification remains.
+
+- Subject scope, omitted or explicit, stays bare `secret`.
+- `[Encrypted(EncryptionScope.Namespace)]` plus `[NotAudited]` on the concept
+  emits bare `secret` by default and SP0061 (Information) names the unstated
+  `namespace` scope: the document instead implies Subject scope. Global behaves
+  the same way. Set `ScreenplayOptions.AuthoringOnlyConstructs = true` (CLI
+  adapter option `--authoring-only-constructs`) to emit `secret scope namespace`
+  or `secret scope global` in the concept body. Scope is syntax-only and does
+  not raise the ESM version; it does not make protected concepts executable.
+- A concept also marked `[PII]` becomes `pii secret`, with no emitted scope:
+  the C# providers render only `[PII]`; Chronicle rejects `[PII]` combined with
+  `[Encrypted]`. Do not add a scope the provider ignores.
+
+Member `[PII]` is read from properties and matching positional constructor
+parameters. Two losses that previously needed manual detection now have
+Information diagnostics:
+
+| Code | What the document says or loses | Resolve in source or the intentional candidate |
+| --- | --- | --- |
+| SP0062 | `[PII]` on a non-concept member (for example, a String) is not stated; the diagnostic names `Type.Member`. No concept is invented. | Introduce a personal-data concept with evidence-backed meaning; keep the original protection and record the lost marking until resolved. |
+| SP0063 | A member marking promotes its concept to `pii` everywhere; the diagnostic lists unmarked analyzed uses that acquire that classification. | Review every listed use. If all carry personal data, make the concept-wide classification explicit; if meanings differ, separate the concepts rather than remove `pii`. |
+
+SP0063 is absent when the concept itself has `[PII]` or every analyzed use is
+marked. Its list covers analyzed uses, not proof of all runtime use sites.
+Reasons, special/criminal qualifiers and processing purposes are not inferred.
+
+SP0059 (Information) reports that an identity concept's `pii/secret` annotations
+were left off because Screenplay rejects protected identifiers, destinations and
+stream ids (PLAY0515). The identity/route is retained, not the protection. Record
+that loss and design a surrogate identity; never treat the generated omission as
+authority to remove source protection. SP0058/SP0059 now say `secret` and
+`pii/secret`, not the deprecated `sensitive`/`@pii` vocabulary.
+See command-surface [compliance](../../cratis-screenplay-command-surface/references/compliance.md)
+for classification and persisted-event scope changes.
+
+## Generated-document self-check on compiler upgrades
+
+Arc compiles and binds its printed document. `ExpectedBindingDiagnostics` tolerates
+only exact known admission-limit messages (PLAY0268) and the permitted legacy
+consistency messages (PLAY0271), not every diagnostic with those codes.
+The loaded compiler's contract must list the code as neither retired nor reserved
+and include Error among its supported severities. A missing, retired, reserved or
+non-error-only code loses the exemption even if an old message still matches.
+Changed or unknown messages also fail closed.
+
+After upgrading Screenplay, rerun generation and inspect the self-check instead
+of carrying forward an old waiver. Unexpected binding errors become SP0056
+(Warning for standalone generation, Information for embedded generation); Arc's
+end-to-end gate rejects any SP0056 regardless of severity. Resolve a changed
+admission contract or report a generator defect; do not strip protection or widen
+the exemption. This check is distinct from a clean source-validation result and
+does not prove the model renders or executes.
+
 ## Reading the output cheaply
 1. V1 on `.ai-work/screenplay/<model-slug>/legacy/static` (folder mode) with the tool and
    command `cratis-screenplay-toolchain` selects, named with its version; record counts, do

package/package/corpus/skills/cratis-screenplay-model-authoring/SKILL.md

@@ -6,30 +6,27 @@ license: MIT
 
 # Author a Screenplay model through its AST
 
-Screenplay describes an information system as one declarative document set.
-Prefer the Screenplay MCP tools to hand-edited text and throwaway regex scripts:
-the compiler already knows declarations, references, hierarchy and source ownership.
+Prefer the Screenplay MCP tools to text/regex edits: the compiler owns declaration,
+reference, hierarchy and source evidence for the declarative document set.
 
 Screenplay remains experimental. **Valid source is not necessarily executable.**
 It does not generate or run an application; Stage owns rendering/runtime admission.
 When selecting construct syntax or distinguishing source validity from execution, read the [language reference](references/language-reference.md) for constructs,
 the executable profile and a complete compiled model.
 
-For screen-heavy work, keep the parity contract explicit:
-discover the installed UI node schemas, propose/apply with revisions, then pass the
-same model root or workspace export to validate/render/runtime checks. The full
-workflow is `references/screen-authoring-workflow.md`; the UI syntax/support-level
-contract is in `cratis-screenplay-ui-composition`.
+For screens: discover UI schemas, propose/apply with revisions, then pass the
+same model root or workspace export to all checks. Workflow:
+`references/screen-authoring-workflow.md`; syntax/support:
+`cratis-screenplay-ui-composition`.
 
 ## Verified product sources
 
-Current authoring/MCP guidance follows Screenplay v4.135.0
+Current authoring/MCP guidance follows Screenplay v4.139.0
 `Documentation/screenplay/mcp/`, `ast-authoring.md`, `folders.md`, `vscode.md`.
 Discover installed tools and schemas; CLI bundles can differ from the standalone
 tool. Pins are in `cratis-screenplay-toolchain` `references/versions.md`.
-Historical connection/binding probes below remain labeled 4.66.0; the complete
-registration example was compiled/tested at 4.68.0, not reclassified as a current
-execution probe. Earlier source attribution is in `references/provenance.md`.
+Historical probes remain 4.66.0; registration example compilation/execution
+remains 4.68.0. Attribution: `references/provenance.md`.
 
 ## Locate and connect
 
@@ -54,12 +51,10 @@ are in [MCP loop](references/mcp-loop.md). Send `initialize` and
 schemas rather than relying on a remembered count.
 
 
-Look first for the project's existing `.play` files: the folder holding them is the
-model. A new model goes under the repository's `Source/` or `src/` folder, else in a
-`Screenplay/` folder at the repository root; never under `.cratis/`, which holds
-configuration and the shared AI corpus only. This is the
-conventional home for consumer-owned `.play` source. The source is the single flow model;
-keep explanatory Markdown in the owning repository's documentation.
+Look first for the project's existing `.play` files: their folder is the model.
+New models go in `Source/` or `src/`, else root `Screenplay/`, never `.cratis/`
+(configuration/shared corpus only). The source is the single flow model;
+explanatory Markdown belongs in repository documentation.
 
 `cratis ai install` manages `.cratis/ai/`, never model files. Select the
 `cratis/screenplay` profile in the project's AI configuration. The corpus-owned
@@ -87,6 +82,9 @@ can keep that entry point; use the project's supported installation channel.
    of `.play` files is one application, not independent files.
 2. Use `search-declarations`, `declaration-details`, `find-references` and
    `dependencies` to locate the owning declaration and affected references.
+   Before a property rename/removal, read [property links](references/property-links.md):
+   `kind: "Property"`, `Owner.member` / `Owner.generationN.member`, direct mappings.
+   `complete: false` is incomplete evidence, never a successful empty list.
 3. Read diagnostics and coverage limitations. Use `dependency-graph` for container
    edges, declared-dependency coverage, cycles and advisory order; the board's
    dependency-map toggle exposes this evidence visually. Unknown or ambiguous
@@ -209,6 +207,10 @@ from silently changing the reviewed candidate.
   migrates all occurrences together. Keep the `query Q => observable?` exception.
 - Compliance repairs PLAY0565/0653: [MCP tool guide](references/mcp-tools.md).
 
+`propose-number-enum-members` pins an unnumbered enum to current positions.
+Opt-in MCP `checks: "enum-pinning"` / `--check enum-pinning` (PLAY0671) hints at
+stored enums, not correctness repairs. Arguments/review: `references/mcp-tools.md`.
+
 Use `propose-extract-inline-event` on the inline `EventSyntax` handle before adding
 a generation (canonical formatting consent; refuses comment loss; no reverse
 operation). Event `propose-rename` pins `id "<old name>"` by default; use
@@ -293,7 +295,8 @@ that the code compiles or behaves. Read `references/mcp-tools.md#code-attachment
   clean run is not a bound or executable result.
 - Operations/`numbers exact` remain unadmitted; routes bind as v8, public
   boundaries v9, identity/overrides/filters v10, qualifying non-route Double
-  literals v11. CLI 3.50.0 reaches Stage checks through v10. Never drop or stub source contracts to bind.
+  literals v11, non-positional enum numbers v12 (standalone 4.139.0).
+  CLI 3.53.1/Stage 4.73.1 bundle 4.137.0 and do not admit v12. Never drop or stub source contracts to bind.
 - Distinguish authoring acceptance from `executableReady`; unsupported backend
   capabilities are not a reason to drop source constructs or invent stubs.
 - If execution is intended, validate with the owning downstream runtime as well.
@@ -306,12 +309,9 @@ The ordinary CLI remains useful for whole-folder validation:
 cratis screenplay validate <model-folder> --warnings-as-errors
 ```
 
-For end-to-end screen changes, record the MCP transcript in `.ai-work/` and then
-run the render/runtime checks with the exact same root or workspace export. A
-transcript that applies one source and renders another is not evidence; neither is
-a generated app that silently drops authored UI. Use the Screenplay-owned canonical
-corpus fixture path when it exists instead of copying `.play` examples into this
-repository.
+Record screen MCP transcripts in `.ai-work/`; render/runtime checks must use the
+same source, never an app that silently drops authored UI. Use the Screenplay-owned canonical
+corpus fixture path instead of copying available `.play` fixtures here.
 
 Check installed `tools/list` schemas: the CLI bundle can differ. Never invent
 commands, parameters, syntax nodes or downstream capabilities.

package/package/corpus/skills/cratis-screenplay-model-authoring/references/language-reference.md

@@ -65,6 +65,12 @@ qualifiers, secret scopes and validation. Legacy markers report PLAY0565 informa
 repeated header markers report PLAY0653 warning. Purposes declare the use/basis/retention
 separately; see command-surface `references/compliance.md`.
 
+Enum member `name = N` pins are unique int32 values, all members or none.
+Unnumbered enums retain positions. Non-positional numbers bind as ESM v12 from
+4.139.0; positional pins preserve older bytes/version. Fixtures and conditions
+still name members. Syntax, stored-number safety and consumer admission:
+command-surface `references/enum-numbers.md`.
+
 Projections and captures use their dedicated sub-grammars. Inline code uses a
 tagged fence (` ```csharp `); the older language-line form still parses with
 warning `PLAY0397`. Query the MCP's `syntax-schema` instead of inventing JSON

package/package/corpus/skills/cratis-screenplay-model-authoring/references/mcp-loop.md

@@ -106,6 +106,11 @@ the server sends `roots/list` and serves `tools/list` after the reply).
    `find-specification-obligations` (presence, not execution), use
    `find-modeling-smells` as questions needing a domain consequence, and compare
    generated/curated exported snapshots with `semantic-diff`.
+   Before renaming/removing a property, use `find-references`/`dependencies`
+   `kind: "Property"` (4.138.0+) and `Owner.member` or historical event
+   `Owner.generationN.member`. Follow direct mapping counterparts one query at a
+   time; inspect incomplete/ambiguous evidence and `reasons`. `complete: false`
+   is not an empty successful result. Shapes/roles: [property links](property-links.md).
 3. `open-workspace` and keep `revision` and `catalogRevision`. Opening writes
    nothing. With `identityPersistence: "root-local-on-apply"` the identities file
    is written only by `apply`.