@cratis/pi 7.32.0 → 7.34.0

package/package/corpus/skills/cratis-screenplay-model-authoring/references/property-links.md

@@ -0,0 +1,126 @@
+<!-- Copyright (c) Cratis. All rights reserved. -->
+<!-- Licensed under the MIT license. See LICENSE file in the project root for full license information. -->
+
+# Inspect a property's chain before changing it
+
+## Contents
+
+- Address and query
+- Read evidence, not just a count
+
+Screenplay 4.138.0 released property-path evidence in `find-references` and
+`dependencies`; this guidance was checked against 4.139.0. Discover installed
+`tools/list`: CLI 3.53.1's 4.137.0 bundle predates it. These are read-only
+inspection tools, not a property-change planner.
+
+## Address and query
+
+Use `kind: "Property"`, case-sensitive. Append the member to its owner's exact
+logical address: `Owner.member`. For an event this selects the current generation;
+`Owner.generationN.member` selects a historical shape, whose target details carry
+`historical: true`. Properties are not returned in declaration listings: locate
+the owner and inspect its properties first.
+
+On the command-surface [enum example](../../cratis-screenplay-command-surface/references/enum-numbers.md),
+first inspect the event with `find-references`:
+
+```json
+{
+  "address": "Invoicing.Issuing.SendingInvoice.InvoiceSent",
+  "kind": "Event"
+}
+```
+
+At 4.139.0 this returns two references (`produces`, `thenEvent`), with top-level
+`totalCount: 2`, `references` and empty `ambiguous`, `incomplete`, `wrongKind`
+arrays. The event response has no `complete` field. Query its property separately:
+
+```json
+{
+  "address": "Invoicing.Issuing.SendingInvoice.InvoiceSent.status",
+  "kind": "Property"
+}
+```
+
+Then query direct mapping counterparts with `dependencies`:
+
+```json
+{
+  "address": "Invoicing.Issuing.SendingInvoice.InvoiceSent.status",
+  "kind": "Property",
+  "direction": "outgoing"
+}
+```
+
+Both tools accept `offset`, `limit` and `expectedSourceRevision`; echo the first
+response's `sourceRevision` on continuation pages. `dependencies` additionally
+accepts `direction: "incoming"` (default), `descendants` and `document`. It follows
+**direct mapping counterparts only**, not a transitive property chain or runtime
+impact. Query each resolved counterpart separately when walking a longer chain.
+
+## Read evidence, not just a count
+
+`find-references` returns top-level `references`, `ambiguous`, `incomplete`,
+`complete`, `totalCount`, `offset`, `nextOffset` and `coverage`. Ambiguous/incomplete
+rows contain `reference` and `candidates`. `dependencies` instead has
+`page.items`, each carrying `reference`, `resolution` and `targets`, with paging
+inside `page`; `complete` and `coverage` stay at the top level.
+
+Each property reference retains `owner`, `location`, `role`, `reasons` and
+`otherEnd` (the link's resolved other end, or null). For outgoing dependencies,
+navigate `targets`, not an assumed interpretation of `otherEnd`. Evidence roles are:
+
+| Role | Meaning |
+| --- | --- |
+| `mapping-source`, `mapping-target` | Explicit production, capture append or projection mapping end |
+| `automap` | Derived case-insensitive projection link |
+| `condition` | Declarative condition, including query filters and policy readers |
+| `key` | Lookup/read, projection/join/removal/parent, constraint or stream-id key |
+| `screen-binding` | Screen/form field use |
+| `fixture`, `assertion` | Specification/example assignment or expected value |
+| `response` | Command response property source |
+| `opaque` | Text names the property; code is not resolved |
+| `unclassified` | Conservative backstop found a name occurrence outside classified links |
+
+### Observed result on the compiled example (4.139.0)
+
+The property `find-references` response has `success: true`, `complete: false`,
+`totalCount: 3`, `nextOffset: null`: two resolved references (`mapping-target`
+on the command's `status = status`, and `assertion` on `then InvoiceSent`),
+and one `incomplete` entry. Its `reference.role` is `unclassified`, located at the
+specification's command-input `status` assignment, with `reference.reasons`:
+
+```json
+["Property name occurs in referencing declaration text without a classified link."]
+```
+
+Outgoing `dependencies` also reports `success: true`, `complete: false` and
+`page.totalCount: 1`. Its resolved `page.items[0]` has a `mapping-source`
+reference; `targets[0].address` is
+`Invoicing.Issuing.SendingInvoice.SendInvoice.status`, while the reference's
+`otherEnd.address` is the queried event property. The property's completeness
+covers all indexed evidence even when the chosen direction's page has only a
+resolved link. The workspace had `sourceSuccess: true`, no source diagnostics
+and `readiness.executableReady: true`: compilation success does not imply
+complete property evidence.
+
+**`complete: false` is never a successful empty list.** Inspect every ambiguous
+or incomplete row and its `reasons`/candidates, even when resolved `references`
+is empty. `success` describes compilation, not completeness. Opaque occurrences,
+unresolved counterparts, nested composite paths, legacy command reads and external
+source items can leave incomplete evidence. The backstop counts whole-word names
+case-insensitively in relevant typed source and comments, including quoted text;
+same-named properties in unrelated declarations do not affect completeness.
+External code contents and registrations remain outside coverage even with
+`complete: true`; authored links do not prove executable admission.
+
+Before a rename/removal: pin the revision, inspect incoming readers and outgoing
+counterparts, page to completion, resolve uncertainties, then choose the supported
+identity-safe edit route with the connection owner. Never infer safe deletion from
+zero resolved hits or edit every same-named field. An event-property change still
+needs a persisted-contract evolution decision; the catalog is not storage evidence.
+
+Source/output authority: `v4.139.0:Documentation/screenplay/mcp/reference.md`
+(property links), `Source/DotNET/Screenplay.Mcp/McpPropertyDependencies.cs`,
+`McpToolSchemas.cs`, and decision 0044's released prerequisite index. The planner
+phases in that decision are not release evidence.

package/package/corpus/skills/cratis-screenplay-model-authoring/references/screen-authoring-workflow.md

@@ -148,10 +148,9 @@ Historical verified public vector and executable checks:
   `cratis/stage:4.52.0` and which bundled Screenplay 4.127.0. Published since,
   and not verified by this vector: Scene 4.17.0, Screenplay 4.133.1, Stage 4.64.0,
   previous CLI 3.46.1 (bundling Screenplay 4.130.0, then-default Stage 4.52.0) and
-  Studio 0.152.2. Current pins are CLI 3.50.0 (Screenplay 4.131.0 / Stage 4.67.0)
-  and standalone Screenplay 4.135.0; see toolchain `references/versions.md`.
-  Compiler claims from this `cratis` probe are 4.127.0 claims, not current CLI
-  3.50.0/Screenplay 4.131.0 claims;
+  Studio 0.152.2. Current pins: `cratis-screenplay-toolchain/references/versions.md`.
+  Compiler claims from this `cratis` probe are 4.127.0 claims, not current
+  bundled-compiler claims;
 - fixture root: `Source/DotNET/Screenplay.CanonicalCorpus/Corpus/ScreenComposition/v1/source/folder`
   in the Screenplay repository;
 - Screenplay repo tool (available checkout): `dotnet run --project Source/DotNET/Tool

package/package/corpus/skills/cratis-screenplay-model-authoring/verification.json

@@ -6,7 +6,7 @@
     { "kind": "play-compiles" },
     {
       "kind": "skill-contains",
-      "value": "Screenplay v4.135.0"
+      "value": "Screenplay v4.139.0"
     },
     {
       "kind": "skill-contains",

package/package/corpus/skills/cratis-screenplay-model-review/LICENSE

@@ -35,5 +35,5 @@ SOFTWARE.
 
 This skill also adapts material from agentic-engineer by Martin Dilger and Nebulit GmbH
 (https://github.com/Nebulit-GmbH/agentic-engineer, commit 07b0f30648d663cb588d7e2c7aa031af9dfc21f2;
-https://nebulit.de), used with the agreement of Martin Dilger and Nebulit GmbH. That repository
-carries no licence file; the adapted material remains credited to Martin Dilger and Nebulit GmbH.
+https://nebulit.de), used with the explicit consent of Martin Dilger and Nebulit GmbH. The adapted
+material remains credited to Martin Dilger and Nebulit GmbH.

package/package/corpus/skills/cratis-screenplay-model-review/SKILL.md

@@ -17,7 +17,7 @@ adapted to `.play` declarations (`references/provenance.md`).
 ## When / when not
 - Use: P4 self-check; P5 independent review; auditing an existing or extracted model; reviewing a
   proposal or edit request before it is applied; checking a model before rendering; checking a
-  code diff in a repository with a model for model-first drift (checklist R1).
+  code diff in a repository with a model for model-first drift (checklist R1; `conform` is structural only).
 - Not for: changing the model (return findings; the modeler or the main session edits); writing
   missing specs (`cratis-screenplay-scenario-coverage`); designing slices
   (`cratis-screenplay-slice-design`); stream and invariant redesign
@@ -31,11 +31,10 @@ adapted to `.play` declarations (`references/provenance.md`).
 |---|---|---|
 | Screenplay | `v4.66.0` (`c89198b`) | MCP catalog (29 tools: `describe-application`, `search-declarations`, `dependencies`, `find-assertion-gaps`, `read-workspace`, `declaration-details`) in `Source/DotNET/Screenplay.Mcp/McpToolCatalog.cs`; diagnostics PLAY0029, PLAY0191, PLAY0268, PLAY0271, PLAY0350, PLAY0381, PLAY0469 in `Source/DotNET/Screenplay/Diagnostics/DiagnosticCodes.cs`; decision 0008 (one data subject per event) |
 | Screenplay | `v4.127.0` | `find-specification-obligations` (SPEC001–SPEC008 authored presence), `find-modeling-smells` (SMELL001–SMELL005 advisory questions); neither proves executed behavior or complete lineage |
-| Screenplay | `v4.131.0` | `semantic-diff` source objects and revision-pinned pages: `Source/DotNET/Screenplay.Mcp/{McpRevisionDiff,McpWorkspaces.Comparison,McpToolCatalog}.cs`, `Documentation/screenplay/mcp/reference.md`; previous CLI 3.46.1 predates these; CLI 3.50.0 bundles them |
+| Screenplay | `v4.131.0` | `semantic-diff` source objects and revision-pinned pages: `Source/DotNET/Screenplay.Mcp/{McpRevisionDiff,McpWorkspaces.Comparison,McpToolCatalog}.cs`, `Documentation/screenplay/mcp/reference.md`; previous CLI 3.46.1 predates these |
 | cratis CLI | `v3.28.3` | bundles Screenplay 4.66.0 and Stage 4.24.2; see the toolchain skill |
 
-The full pin table lives in `cratis-screenplay-toolchain` `references/versions.md`; do not copy
-it here. Compilation (V1) does not establish reference execution.
+Historical sources; pins (v4.139.0: 39 tools): toolchain `references/versions.md`. Compilation (V1) does not establish reference execution.
 
 ## Interview phase
 Skip if the brief names the scope, the mode and the review kind.
@@ -65,7 +64,7 @@ model's behalf.
    `dependencies direction=incoming` for orphans. The verdict lines are independent: a V1 pass is
    necessary, never sufficient. Opt into completeness with `--check` or MCP
    `checks` for bindings, input surfaces, field origins, query keys, event consumers
-   and navigation; whole-source errors skip these checks. Record selected families,
+   navigation and personas (PLAY0574-0576); whole-source errors skip these. Record selected families,
    skipped status and coverage limits, never a vacuous pass. Any line without
    evidence is "not run: reason".
 3. **Element sweep** (phase 1, mechanical, before any judgement). One line per gated element, event,
@@ -255,10 +254,11 @@ verdict follows the rules in `references/report-template.md`.
 ## References (load on demand)
 - Review public leaks, direction, complete keys and effective routes with [public/key/route checks](references/public-keys-and-routes.md).
 - Read `references/checklist.md` when performing the element sweep and phased audit; it contains eleven phases, 89 checks, tiers and evidence sources.
-- Read `references/anti-patterns.md` when investigating an anti-pattern signal; it gives the signal, why it matters, tier and Screenplay fix.
-- Read `references/report-template.md` when classifying findings, deciding the verdict, writing the report or conducting a re-review; it defines report, severity and verdict rules.
-- Read `references/worked-example.md` when an example of the sweep, lineage or report is needed, or when checking the complete examples; it contains a seeded model, sweep notes, a filled report and the fixed model.
+- Read `references/anti-patterns.md` when investigating an anti-pattern signal.
+- Read `references/report-template.md` when classifying findings, deciding the verdict, writing the report or conducting a re-review.
+- Read `references/worked-example.md` when an example of the sweep, lineage or report is needed, or when checking the complete examples: seeded model, filled report, fixed model.
 - Read `references/review-questions.md` when gathering evidence for subject-specific checks or distinguishing facts from views; it contains questions per subject and domain examples.
+- Read `references/model-inventory-report.md` when asked for a read-only inventory of an existing model.
 - Read `references/business-questions.md` when conducting the business-question pass; it contains the explainer journey method, prompts and word translation.
 
 ## Lineage

package/package/corpus/skills/cratis-screenplay-model-review/references/anti-patterns.md

@@ -61,8 +61,8 @@ the problem, the checks it violates, the fix, all pinned to one declaration.
 | Dropped construct | PLAY0029 warning; misspelled keyword or `type` inside a slice | the construct is silently ignored | C | fix the keyword; validate with warnings as errors |
 | Missing `for` | an event production (`produces <Event>` or `produces event`) without `for`. Not operation productions: they are authorable design intent, belong to commands, and take no event `for`, tags or routing | runtimes disagree on the destination | C (executable) / D | `for <identifier>` |
 | Unbuilt read-model field | field no projection maps and AutoMap cannot fill | always empty; not reported by the compiler | D | map it or remove it |
-| Undeclared removal/append event | `remove with` or capture `append` names an undeclared event | passes V1, fails binding (V2/V3, PLAY0273) | C (executable) / D | declare or fix the name; run V3 |
-| Gated command invoked by a reaction without a declared actor | reaction `invokes` a command under a caller policy and has no `runs as system role "<Role>"` that satisfies the gate | the invocation carries no caller: rejected at run time | D (major) | declare `runs as system role "<Role>"` with the least-privilege role the gate admits (ESM v10, Screenplay 4.125.0; previous CLI 3.46.1 refused v10 with CLI-RENDER-004, so gap-fill) or record another trusted-path decision - never just delete the gate. A matching `runs as system role` is the admitted trusted path, not a defect |
+| Undeclared removal/append event | `remove with` or capture `append` names an undeclared event | V1 warns (PLAY0166, a failure under warnings as errors); binding fails PLAY0273 | C (executable) / D | declare or fix the name; run V3 |
+| Gated command invoked by a reaction without a declared actor | reaction `invokes` a command under a caller policy and has no `runs as system role "<Role>"` that satisfies the gate | the invocation carries no caller: rejected at run time | D (major) | declare `runs as system role "<Role>"` with the least-privilege role the gate admits (ESM v10, Screenplay 4.125.0; Stage 4.73.1 refuses `runsAs` with STAGE-ESM-034 and every reaction model, so gap-fill) or record another trusted-path decision - never just delete the gate. A matching `runs as system role` is the admitted trusted path, not a defect |
 | `reads` + `produces` reaction | reaction both reads a view and produces | fails binding | C (executable) | invoke a command, or produce without reads |
 | `reads` treated as protection | rule "checked" because the command or reaction `reads` a view | `reads` enforces nothing | D (major) | keep or introduce `reads <View>` + `require ... message` as stated intent, mark it NOT enforced in the slice `description`, name the target (`[ProtectedDecision]` + `DecisionRead<T>`, Chronicle DCB, or a constraint where it fits); checklist E3 |
 | Caller-supplied state rule | `require currentStatus == "open"` where the caller sends `currentStatus` | the caller decides its own permission | D (major) | read the stored state with `reads`; keep or introduce `reads <View>` + `require ... message` as stated intent, mark it NOT enforced in the slice `description`, name the target (`[ProtectedDecision]` + `DecisionRead<T>`, Chronicle DCB, or a constraint where it fits); checklist E3 |

package/package/corpus/skills/cratis-screenplay-model-review/references/checklist.md

@@ -168,19 +168,19 @@ Nebulit (`provenance.md`).
 | Id | Check | Evidence | Tier |
 |---|---|---|---|
 | G1 | Every command has at least one reachable and authorized origin, and no command is attributed to a generic "User" | screen `action`, forms, reactions, persona policies | D |
-| G2 | Personas have a purpose and say what they cannot do; read-only roles are legitimate; every persona has at least one command or one view | `persona` descriptions | D |
+| G2 | Personas have a purpose and say what they cannot do; read-only roles are legitimate; every persona has at least one command or one view (mechanical evidence: `--check personas`, PLAY0574 to PLAY0576) | `persona` descriptions | D |
 | G3 | Persona policy lists cover every gate on the path (module, feature, construct) | policies | C semantics (board placement) |
 | G4 | A command invoked by a reaction is not gated by a caller policy, unless a trusted-path decision is recorded | reactions, `authorize` | D (silent = major) |
 | G5 | Row scoping (whose data) is part of the view, not a filter the caller supplies | queries | D |
 | G6 | Every persona Cannot line resolves to an executable gate (`authorize` policy, or ownership `claim "x" matches subject\|<command property>`) and a `then denied` spec whose caller is synthesized with `given caller as <Persona>` or explicitly carries the effective-gate roles/claims; otherwise recorded as a gap. Persona text is intent only | personas, policies, specs | D |
 | G7 | Every command and query under an inherited module/feature `authorize` has its own `then denied` spec; authorization shared by a feature is declared at feature/module level so new paths inherit it | policies, specs | D |
-| G8 | Ownership checks against a Uuid-backed identifier are not renderable today (STAGE-ESM-015): noted | policies | C (renderable mode) |
+| G8 | Ownership/claim targets are a supported scalar (text, Uuid, Date or DateTime render; a numeric or Boolean target is always denied; other shapes and a command without exactly one identifier are STAGE-ESM-015 at Stage 4.73.1): noted | policies | C (renderable mode) |
 
 ## Phase 10. Views, queries and screens (4 checks, H1-H4)
 | Id | Check | Evidence | Tier |
 |---|---|---|---|
 | H1 | Query shape follows the business view (list where people scan; lookup where they open one) | queries, screens | D |
-| H2 | Executable scope: one keyed `=> RM optional` query with `by` named like a read-model property, and the projection routes by the same identity (a `from` key or an event property, or `$eventSourceId`; `$eventSourceId` is not mandated). Renderable scope only: Stage-specific identity limits (Stage 4.24 admits a one-instance projection with an optional keyed snapshot query) | queries, projections | C (executable); C (render admission, renderable only) |
+| H2 | Executable scope: a keyed `=> RM optional` query with `by` named like a read-model property, or an unfiltered / one-`by` list (`=> RM[]`, observable too; `filter`, `scoped to`, `performer` do not bind), and the projection routes by the same identity (a `from` key or an event property, or `$eventSourceId`; `$eventSourceId` is not mandated). Renderable scope only: Stage-specific identity limits (Stage 4.73.1 renders a keyed optional snapshot lookup and observable collection queries; any other query is `STAGE-ESM-010`) | queries, projections | C (executable); C (render admission, renderable only) |
 | H3 | One builder per read model; projection `key` only on `from` | projections | C |
 | H4 | Screens show one actor's point of view; a form submits one command | screens, forms | D |
 
@@ -192,7 +192,7 @@ artifact is `N/A: <reason>`.
 
 | Id | Check (the rejected pattern) | Signal to look for | Severity |
 |---|---|---|---|
-| R1 | Code-first change that silently outranks accepted model intent | behaviour added in code with no `.play` counterpart; the model edited to match existing code; the model left stale after a code change | major (critical when the code contradicts a protection) |
+| R1 | Code-first change that silently outranks accepted model intent | behaviour added in code with no `.play` counterpart; the model edited to match existing code; the model left stale after a code change; optional structural evidence: `cratis screenplay conform <model-root> --project <path>` (CLI 3.42.0+, exit 0/1/2, exact structural addresses only, never a behavioral or V4 verdict; MSBuild runs, so a trusted clone) | major (critical when the code contradicts a protection) |
 | R2 | A diagram, board or document in place of executable semantics | a rule only in a board note, a description or a wiki page; no property, validation, constraint or spec behind it (E8) | major |
 | R3 | Claims of universal low-code, lossless recovery or target parity | words like "fully generated", "lossless", "any target" in a report or description | minor; major when it hides a gap |
 | R4 | Framework machinery in the domain vocabulary (saga, aggregate, passive objects, HTTP or broker detail) or syntax wanted because a framework API is common | declarations named after saga, handler classes, topics, endpoints; a request to add language syntax to mirror a framework API | minor; major when it shapes the model |

package/package/corpus/skills/cratis-screenplay-model-review/references/model-inventory-report.md

@@ -0,0 +1,75 @@
+# Model inventory report
+
+Use this for a read-only "what is in this model and where are the gaps" report on an
+existing, extracted or inherited `.play` model, before or without a full checklist run. It is
+the inventory the audit pass in `SKILL.md` produces, in a fixed shape a maintainer can read
+in a minute. It never changes the model. Adapted from Martin Dilger and Nebulit GmbH's
+analyze-existing-model (see `provenance.md`), with board, status and placement steps replaced by
+the Screenplay MCP views.
+
+## Gather (read-only)
+1. Scope. A named module narrows the report to that module; otherwise report the whole
+   model, one block per module. If the named module does not exist, say so and list the modules
+   that do.
+2. Structure: `describe-application` (view `summary`) gives modules, features and slices by kind.
+3. Elements: counts of `event`, `command`, `readmodel`, `screen`, `reaction` and `trigger`
+   per module from `search-declarations`; fall back to the source files when a view is
+   unavailable and say which.
+4. Specifications: `find-assertion-gaps` for slices without an assertion; `find-specification-obligations`
+   for obligations with no matching specification. These read authored examples, not executed
+   coverage (`../../cratis-screenplay-model-authoring/references/mcp-tools.md`).
+5. Gaps and orphans: `find-references` and `dependencies` for declarations referenced by nothing;
+   `find-modeling-smells` for the candidate shapes.
+
+## Report
+```
+## Model inventory: <model root or module>
+Inspected: <date>, Screenplay <tool version>, source identity <revision>
+
+### Modules (n)
+- <module>: <n> features, <n> slices
+
+### Elements (per module)
+| Kind | Count |
+|---|---|
+| event | |
+| command | |
+| readmodel | |
+| screen | |
+| reaction / trigger | |
+| capture | |
+
+### Specification coverage
+- n of total slices have at least one assertion (pct)
+- Without: <names, at most 10, then "and N more">
+
+### Structural gaps (per slice)
+<slice: what is missing>, or "none"
+
+### Orphans
+<declarations nothing references>, or "none"
+
+### Shapes
+<left chair, right chair, bed, shelf only as candidates that held up against the domain; see
+anti-patterns.md>, or "none"
+
+### Summary
+<2 to 4 sentences: maturity, the most important gap or risk, one concrete suggestion>
+```
+
+## Structural gaps to look for
+| Slice kind | Expect | Flag when missing |
+|---|---|---|
+| StateChange | an origin (screen action, form, or reaction), a `command`, at least one `event` | any of the three |
+| StateView | a `readmodel` with a projection (or reducer) and a `query` or screen that reads it | projection or reader |
+| Automation | a `reaction` or `trigger` and what it produces or invokes | either |
+| Translate | inbound: a `capture` or a translating reaction, and the private events it produces; outbound: a reaction or an event-target projection/reducer publishing the public event contract (no capture) | the direction's source or the produced or published events |
+
+Do not flag a gap the documentation or the slice name marks intentional (an internal slice
+with no screen). Judge unintentional gaps against the slice title, and surface only those.
+Orphans that a documented terminal reason explains are not findings.
+
+## Not carried over
+Slice status counts (`Planned`, `InProgress`, `Done`) are not in the report: `.play` has no
+status field. Delivery status lives in the GitHub issue or `STATE.md`. An orphan that a board
+tool could not see is skipped with a note, never guessed.

package/package/corpus/skills/cratis-screenplay-model-review/references/provenance.md

@@ -12,11 +12,10 @@ MIT, Copyright (c) 2025 Straw Hat, LLC. The complete notice is in this skill's `
 | `eventmodeling-validating-event-models` | `checklist.md` T (allowed and refused transitions per entity), C7 and C8 (unique semantics, corrections name what they correct), F3, G (role attribution and coverage), D and E (read models serve real queries, regenerable), `report-template.md` (critical and warning findings, completeness table) | Adapted; the command-state rule is not adopted as such (Screenplay decisions read stored state through `reads`; see `anti-patterns.md`) |
 | `eventmodeling-checking-completeness` | `checklist.md` A (origin and destination for every field, every command input, every read-model field), A8 (step contracts), G (role coverage), `references/worked-example.md` (field-trace format) | Adapted; matrices replaced by lineage over `.play` declarations |
 
-## Adapted closely (Martin Dilger and Nebulit GmbH, with agreement)
+## Adapted closely (Martin Dilger and Nebulit GmbH)
 
 Source: https://github.com/Nebulit-GmbH/agentic-engineer at commit `07b0f30648d663cb588d7e2c7aa031af9dfc21f2`,
-by Martin Dilger and Nebulit GmbH (https://nebulit.de). The repository carries no licence file; this material
-is adapted with the agreement of Martin Dilger and Nebulit GmbH.
+by Martin Dilger and Nebulit GmbH (https://nebulit.de), used with the explicit consent of Martin Dilger and Nebulit GmbH.
 
 | Source file | Used in | How |
 |---|---|---|
@@ -24,7 +23,7 @@ is adapted with the agreement of Martin Dilger and Nebulit GmbH.
 | `.claude/skills/eventmodeling-designing-automation-chains/SKILL.md`: every automation needs a todo list, translation versus worker, redundant second stage, no status field, closing path, quality checklist | `checklist.md` F8 to F12 and the automation-chain audit, `report-template.md` "Automation chains", `review-questions.md` | Restored from #493 (the automation-chain audit) as review checks translated to `Automation` and `Translate` slices. Not adopted: a translation's todo list is never closed; here a translation holding real pending work needs a terminal disposition (the audit format of `cratis-screenplay-automations-and-translations`), and an artificial never-closing queue is flagged instead |
 | `.claude/skills/eventmodeling-core-rules/SKILL.md`: Critic Mode, Flow and Causality, Open Questions vs. Decided Failures, Offline-First Thinking | `SKILL.md` "Procedure" (stance), `checklist.md` E9 and F13, `report-template.md` "Defect or business question?", `review-questions.md` | Adapted closely; the single-issuer command rule, lanes, linked copies and board mechanics are not adopted |
 | `.claude/skills/handle-comment/SKILL.md`: one remark per node with a kind, resolving means answering | `SKILL.md` "Findings" | Adapted; the board place, resolve and delete actions are dropped, the remark is a finding pinned to one declaration |
-| `.claude/skills/analyze-existing-model/SKILL.md`: spec coverage with names, structural gaps per slice type, summary in 2 to 4 sentences | `SKILL.md` "Audit pass", `report-template.md` Inventory | Now adapted closely; slice status breakdown dropped (Screenplay has none) |
+| `.claude/skills/analyze-existing-model/SKILL.md`: spec coverage with names, structural gaps per slice type, summary in 2 to 4 sentences | `SKILL.md` "Audit pass", `report-template.md` Inventory, `model-inventory-report.md` (gather steps, report shape, structural-gap table) | Adapted closely; board and slice-status steps replaced by the Screenplay MCP views, slice status breakdown dropped (Screenplay has none), `validate_model` replaced by `find-modeling-smells` and `find-assertion-gaps` |
 | `.claude/skills/eventmodeling-validating-event-models/SKILL.md`, `-checklist/SKILL.md`: event-entity mapping (Check 6.2), report with blockers and next steps, common issues, closing questions that gate the verdict | `checklist.md` B2, `report-template.md` Verdict, `review-questions.md` | Martin Dilger and Nebulit GmbH's changes to the TrogonStack base, adapted; the "exactly one issuer" and "screen wired to more than one command always fails" rules are not adopted (Screenplay commands may have several origins and a screen several actions) |
 | `.claude/skills/eventmodeling-checking-completeness/SKILL.md`: field matrix, slice coverage, "search before calling data missing" | `checklist.md` A1 to A8 | Already adapted from the TrogonStack base (role coverage is TrogonStack's, credited above); Martin Dilger and Nebulit GmbH's slice-border and linked-copy checks are not adopted (no columns or linked copies in `.play`) |
 

package/package/corpus/skills/cratis-screenplay-model-review/references/public-keys-and-routes.md

@@ -16,7 +16,7 @@ Add these to the element sweep, with evidence pinned to the declaration:
 - Is the view identity explicitly marked `key` or unambiguously inferred? Does each
   single-instance query/read supply every part exactly once, with compatible types,
   and do state fixtures contain all parts? Do PDL keys align with the view's key?
-  Composite view keys still refuse binding at 4.135.0 (PLAY0268, #599); compilation
+  Composite view keys still refuse binding at 4.139.0 (PLAY0268, #599); compilation
   is not executable evidence. Read read-surface `references/named-keys.md`.
 - Does a production override replace the whole source/stream/id route, rather than
   assume partial inheritance? Is its `for` destination still explicit and compatible?

package/package/corpus/skills/cratis-screenplay-model-review/references/worked-example.md

@@ -12,8 +12,9 @@
 A small model with one seeded design defect, reviewed in critic mode. The model file is
 `berths.play`; line numbers below refer to it. The report follows `report-template.md` and is
 shortened: it shows the flagged checks of each phase and elides the passing ones, which a real
-report lists in full. The model compiles in design mode: the `ListBerths` list query blocks V3
-(`PLAY0268`), which is why the report below does not run V3.
+report lists in full. The model compiles and, on the standalone 4.139.0 tool, binds and runs one specification (the
+`ListBerths` list query binds since Screenplay 4.105.0). The report works in design mode, so it
+does not run V3 or V4.
 
 ## The model under review
 
@@ -171,7 +172,7 @@ Confidence: medium (design mode; V2 to V5 not run)
 
 ## After the fix
 The same scope after the modeler applied the edit request and added denial specifications.
-The review is re-run only on the changed scope. The query contract is unchanged: no edit request asked for a different query, so `ListBerths => BerthSummary[]` stays. This document compiles (design mode), but the list query blocks V3 (binding reports PLAY0268, a query must declare one caller-supplied `by` argument), so its specifications do not run here. Adding a keyed `BerthById` next to the list would not unblock binding; replacing the list would change the contract and needs its own domain-justified edit request.
+The review is re-run only on the changed scope. The query contract is unchanged: no edit request asked for a different query, so `ListBerths => BerthSummary[]` stays. This document compiles and binds, and its four specifications pass in `screenplay test` (4.139.0). Replacing the list with a keyed lookup would change the contract and needs its own domain-justified edit request. Stage 4.73.1 would refuse the snapshot list (`STAGE-ESM-010`); only an `observable` list or a keyed lookup renders.
 
 ```screenplay
 concept BerthId : Uuid

package/package/corpus/skills/cratis-screenplay-modeling-lifecycle/LICENSE

@@ -33,5 +33,5 @@ SOFTWARE.
 
 This skill also adapts material from agentic-engineer by Martin Dilger and Nebulit GmbH
 (https://github.com/Nebulit-GmbH/agentic-engineer, commit 07b0f30648d663cb588d7e2c7aa031af9dfc21f2;
-https://nebulit.de), used with the agreement of Martin Dilger and Nebulit GmbH. That repository
-carries no licence file; the adapted material remains credited to Martin Dilger and Nebulit GmbH.
+https://nebulit.de), used with the explicit consent of Martin Dilger and Nebulit GmbH. The adapted
+material remains credited to Martin Dilger and Nebulit GmbH.

package/package/corpus/skills/cratis-screenplay-modeling-lifecycle/SKILL.md

@@ -43,7 +43,7 @@ an unproven pass.
 | An accepted model covers the scope | **Model** | Change the `.play`, verify V1-V3, review, then render or gap-fill |
 | Opted in, but this scope has no model yet | **Model** | New behavior starts in discovery, then slice design |
 | A computed rule inside a modeled slice | **Model + code attachment** | `csharp`/`file` block; it binds only as the construct allows (`cratis-screenplay-model-authoring`) |
-| Scope Stage cannot render yet, including every modeled automation and translation (Stage `v4.24.2` renders neither; the whole behavior is gap-fill, not just its outside call) | **Gap-fill code** | Hand-written; the `.play` slice and specs are the contract. `cratis-screenplay-render-and-gap-fill` separates an authorized existing generated base from fully hand-written delivery |
+| Scope Stage cannot render yet, including every modeled automation and translation (Stage 4.73.1 renders neither; the whole behavior is gap-fill, not just its outside call; a reaction that produces and invokes stays one reaction, `STAGE-ESM-037`, hand-written as one reactor on Arc 22.72.0 or later) | **Gap-fill code** | Hand-written; the `.play` slice and specs are the contract. `cratis-screenplay-render-and-gap-fill` separates an authorized existing generated base from fully hand-written delivery |
 | Outside call, transport or credentials | **Adapter code** | `Customizations/` or the host, applying `cratis-engineering-effect-boundaries` |
 | Infrastructure, clients, framework-profile repositories, brownfield not opted in | **Code** | Arc, Chronicle, spec and React skills; trivial changes keep the proportional-delegation policy |
 
@@ -210,10 +210,12 @@ labelled as such. The user decides whether it is enough
 | Critic review, business-question pass | `cratis-screenplay-model-review` |
 | Existing system into a model | `cratis-screenplay-legacy-extraction` |
 | Render, gap-fill, fallback, drift | `cratis-screenplay-render-and-gap-fill` |
+| Estimate, order or split delivery of an accepted model | `cratis-screenplay-delivery-planning` |
 
 Construct mechanics stay in the `cratis-screenplay-*` construct skills; term clashes:
 `references/vocabulary-map.md`; worked example: `references/worked-example.md`; done checklist: `references/phases.md`.
 Read `references/worked-example.md` when needing an example of reasoning documentation, constraints, and decided rejections.
+Read `references/core-rules-digest.md` when you need the one-page card of element names, causality, open-question-versus-decided-failure and the anti-patterns to reject early.
 
 ## Gate
 Done when: the mode's "done when" holds with fresh verdict lines; every open question has an
@@ -221,13 +223,13 @@ address and assumption; every decided rejection is a specification; no protectio
 the packet opens with `Outcome:`; STATE.md is current.
 
 ## Verified product sources
-Full pin table: `cratis-screenplay-toolchain/references/versions.md`. Read `cratis-screenplay-toolchain/references/versions.md` when selecting or reverifying tool versions. Used here: Screenplay
+Full pin table: `cratis-screenplay-toolchain/references/versions.md`. Read `cratis-screenplay-toolchain/references/versions.md` when selecting or reverifying tool versions. Current pins (Stage 4.73.1, cratis CLI 3.53.1 and the rest) are in that file. Older source reads used here: Screenplay
 `v4.66.0` (`c89198b`): `Source/DotNET/Tool/Program.cs` (`--warnaserror`, folder mode),
 `Source/DotNET/Screenplay/Semantics/SemanticModelBinder.cs:209-216` (personas are report-only),
 `Documentation/screenplay/{constraints,specifications}.md`, `mcp/reference.md` (`modelRevision`);
-cratis CLI `v3.28.3` (`cratis screenplay validate --warnings-as-errors`, bundled Screenplay 4.66.0);
-Stage `v4.24.2` (admits ESM v1-v4 and refuses evolved events with `STAGE-ESM-026`); opt-in key `mcpServers.screenplay.root` in cratis CLI `v3.28.3`
-`Documentation/reference/screenplay-mcp.md`. The worked example compiles with both tools.
+cratis CLI `v3.28.3` (`cratis screenplay validate --warnings-as-errors`; bundled Screenplay 4.66.0 then, 4.137.0 in 3.53.1);
+opt-in key `mcpServers.screenplay.root` in cratis CLI `v3.28.3`
+`Documentation/reference/screenplay-mcp.md`. The 4.66.0 and 3.28.3 reads are historical, not current pins. The worked example compiles with the standalone tool.
 ## Verify
 ```shell
 screenplay <model-folder> --warnaserror --no-color

package/package/corpus/skills/cratis-screenplay-modeling-lifecycle/references/core-rules-digest.md

@@ -0,0 +1,131 @@
+# Core rules digest
+
+## Contents
+
+- Two postures, never mixed in one pass
+- Elements and names
+- Causality
+- Roles
+- Field lineage
+- Open question versus decided failure
+- Offline-first lens
+- Anti-patterns to reject early
+- Structural shapes (candidates)
+- Quick self-check
+
+A one-page card of the element, naming and causality rules that every modeling phase
+relies on. It restates what the construct and phase skills own, in one place, so a session
+does not reopen five skills to check a name. When this card and a construct skill differ, the
+construct skill and the compiler win. Adapted from Martin Dilger and Nebulit GmbH's
+eventmodeling-core-rules (see `provenance.md`), translated to `.play` constructs.
+
+## Two postures, never mixed in one pass
+- **Modeling.** Discovery, slice design, authoring. Build the process as completely as you can.
+  Flag a naming slip or an incomplete precondition and move on; do not stall the step on it.
+- **Critic.** Review (`cratis-screenplay-model-review`). Apply every rule strictly and report every
+  violation; do not soften a finding because the model mostly works, and do not quietly add
+  missing structure on the model's behalf. Findings go in the report, not into the model.
+
+A modeling pass is not the place for a full audit, and a critic pass never edits.
+
+## Elements and names
+| Construct | Means | Name it | Reject |
+|---|---|---|---|
+| `event` | A business fact that already happened; immutable; a correction is a new event | Past tense, business language: `BerthReserved`, `PaymentAuthorized` | UI or machinery: `SidebarOpened`, `ApiCalled`, `ResponseReceived` |
+| `command` | Business intent from a caller; can be refused; on success produces one or more events | Imperative: `ReserveBerth`, `CancelSubscription` | Queries and UI actions: `LoadOrders`, `FetchData`, `OpenDialog` |
+| `readmodel` (+ `query`) | A projection of events shaped for one question; optional for any given command | A noun phrase for the data: `BerthAvailability`, `InvoiceList` | Implementation words: `...Projector`, `...Repository` |
+| `screen` | What a user sees and can act on | What a user would call it: `Dashboard`, `ReservationsPage` | `...Component`, `...View` internals |
+| `reaction` / `trigger` | An automated actor reacting to an event, a clock or an application signal | What it does: `BillingScheduler`, `BerthReleaser` | Handler or service names |
+| `persona` | A named role with Does / Reads / Cannot | A role in domain language | A generic "User" |
+
+An event holds captured or decided facts. A running total, an average or a status that is only
+recomputed from other events is a `readmodel`, not an event. A calculation that was actually
+decided at a point in time (a quoted price, an approved amount) is a fact and belongs in the
+event; say which it is.
+
+## Causality
+- Every locally produced event has a modeled producer that is reachable and motivated: whatever
+  the language lets produce it, for example a command or reaction `produces`, a capture, or an
+  event-target projection or reducer publishing an outbound public event. A foreign event
+  declared with `from` is produced by its owning system, not locally. The examples are not a
+  closed list; the construct skills and checklist F13 in `cratis-screenplay-model-review` decide.
+- Every command has a reachable, authorized origin, for example a screen or form action, or a
+  reaction to an event, a clock or an application trigger (not a closed list; F13 decides). A
+  command may have several origins and a screen several actions; judge each origin on its own.
+- A process starts at a screen or form action (a blank creation form counts), at a reaction to a
+  modeled event, a clock or application trigger, or at a capture appending outside facts; never at
+  an unmotivated command.
+- Two state changes in a row need something that triggers the second (a screen, or a reaction).
+- Connections read forward: what a later step needs from an earlier one is an event or a read
+  model that already exists. When a later event must change what an earlier view shows, the
+  projection of that view consumes the later event; do not draw a backward dependency.
+- Slices connect through events and views. Common transitions: StateView to StateChange,
+  StateChange to StateView, StateChange to Automation, Automation to StateChange, Automation to
+  StateView, Translate to StateView, Translate to Automation. Judge a connection by checklist
+  F13 in `cratis-screenplay-model-review`, not by this list.
+
+## Roles
+Every persona has a name in domain language, what it does, what it reads, and what it cannot do,
+and each "Cannot" is backed by an `authorize` gate and a `then denied` specification, or recorded
+as a gap. No command is attributed to a generic "User". A persona that never acts and never reads
+anything is decorative, not modeled. See `cratis-screenplay-discovery` `references/personas-and-causes.md`.
+
+## Field lineage
+Every command input, event property and read-model field has an origin (user input, caller
+context, a prior event property, a decided derivation, or an external payload) and, where it
+matters, a destination. A field with no origin is a gap to resolve, not a detail to fill in later.
+See `cratis-screenplay-slice-design` `references/field-lineage.md`.
+
+## Open question versus decided failure
+- **Open question.** Genuinely undecided. It goes in session state (`STATE.md`) or the review
+  report and stays open until someone answers it. Resolving means answering.
+- **Decided failure.** A rejection or error whose behavior is already decided ("payment fails,
+  refuse, no event"). Model it as a `specification` with `then error` or `then denied`. It is
+  permanent specified behavior, not a note waiting on an answer.
+
+A decided failure left as an open note looks unresolved when it is not. When counting
+completeness, only a genuinely unanswered question is a gap; a decided failure needs its
+specification.
+
+## Offline-first lens
+Model the business process as it would run without software first: who acts, what triggers each
+action, what information they need before acting. Question any step that exists only because of
+the system (a loading state, a cache refresh, a session check); it is not a business step and
+does not belong on the timeline. The anti-patterns below are what skipping this looks like.
+
+## Anti-patterns to reject early
+- **Data-loading commands.** `LoadOrders` is a query; model a `readmodel` and a `query`.
+- **UI-interaction events.** `ButtonClicked` is UI state; model it only if the business cares.
+- **Technical events.** `ApiCalled` describes machinery; find the business outcome underneath.
+- **Recomputed events.** A value that changes whenever its source data changes is a read-model field.
+
+## Structural shapes (candidates)
+Check these only when the model's wiring is visible; a count over the threshold is a prompt to
+think, not a finding.
+- **Screen with several commands** (the bed). Check each action is a distinct decision the user
+  already made on that screen. Screenplay allows several actions on a screen; the signal is a
+  single submit that quietly settles several things.
+- **Command with more than two events** (left chair). One business outcome that fans out, or a
+  command doing two jobs? Ask whether the events always happen together.
+- **Read model fed by more than three events** (right chair). One coherent picture, or a view
+  answering several questions? Ask whether the fields describe one thing.
+- **Slice with many more specifications than its neighbors** (shelf). Genuinely complex, or
+  quietly covering a neighbor's ground? Read what the extra specifications cover.
+
+Use plain descriptions in anything a business stakeholder reads; the shape names are shorthand
+for modelers. The full signal, consequence and fix per shape is in
+`cratis-screenplay-model-review` `references/anti-patterns.md`.
+
+## Quick self-check
+- [ ] Every event is past tense and a business fact.
+- [ ] Every command is imperative intent, not a data load.
+- [ ] Every read model is named for its data.
+- [ ] No event carries a value that is only recomputed from other events.
+- [ ] Every command has a reachable, authorized origin.
+- [ ] Every process starts at a screen or form action, a reaction, a clock or application trigger, or a capture.
+- [ ] No two state changes are chained without a trigger between them.
+- [ ] Every persona has a Cannot line backed by a gate and a denial specification, or a recorded gap.
+- [ ] Every decided failure is a specification; every open question is in session state.
+
+This is the fast pass; the full audit is `cratis-screenplay-model-review`
+`references/checklist.md`, and the closing quality checklist is in `references/phases.md`.

package/package/corpus/skills/cratis-screenplay-modeling-lifecycle/references/phases.md

@@ -127,7 +127,7 @@ phase, a decision important enough that a later reader could misread the model (
 - **Input**: the accepted identity.
 - **Carry-forward**: the admission result; render output and named gaps in `Customizations/`;
   non-renderable scope handed to a code agent with the model as contract, plus a fallback record
-  naming the blocking codes. Automations and translations are not rendered at the pinned Stage version, so the whole behavior is gap-fill. Three cases stay distinct: admission failure (nothing rendered); an
+  naming the blocking codes. Automations and translations are not rendered at the pinned Stage version (4.73.1), so the whole behavior is gap-fill (a reaction that produces and invokes keeps its one modeled form; `STAGE-ESM-037` is Stage's refusal, not a reason to split it). Three cases stay distinct: admission failure (nothing rendered); an
   existing generated base plus separately authorized gap-fill; fully hand-written delivery.
 - **Gate**: V5 sub-results, or a fallback entry per non-renderable scope. A customization never
   makes a rejected model renderable; no whole-application V5 from a subset.