@cratis/pi 7.32.0 → 7.34.0

package/package/corpus/skills/cratis-screenplay-modeling-lifecycle/references/provenance.md

@@ -11,7 +11,7 @@ sections, in this order:
    not empty, the skill `LICENSE` carries the "Third-party notices" section with the **complete**
    MIT text (copyright line, permission notice and disclaimer). Closely adapted material is
    attributed to the source it came from, not to a neighboring one.
-2. **Adapted closely (Martin Dilger and Nebulit GmbH, with agreement).** One row per item taken from Martin Dilger and Nebulit GmbH's
+2. **Adapted closely (Martin Dilger and Nebulit GmbH).** One row per item taken from Martin Dilger and Nebulit GmbH's
    agentic-engineer: source file, where it is used, how. Mark "idea; our wording kept" where only
    the idea was taken. The skill `LICENSE` carries the Nebulit notice.
 3. **Method lineage.** Public method sources (books, talks, standards), cited as sources of ideas.
@@ -34,11 +34,10 @@ full notice is in this skill's `LICENSE` ("Third-party notices").
 | same file, "Mid-Workflow Entry" | `SKILL.md`, `phases.md` "Resume mid-workflow" | Entry points table and identity recomputation added |
 | same file, "Final Output" and "Quality Checklist" | `phases.md` "Final output" and "Quality checklist (closing)" | Items rewritten around Screenplay verdicts, specifications and review |
 
-## 2. Adapted closely (Martin Dilger and Nebulit GmbH, with agreement)
+## 2. Adapted closely (Martin Dilger and Nebulit GmbH)
 
 Source: https://github.com/Nebulit-GmbH/agentic-engineer at commit `07b0f30648d663cb588d7e2c7aa031af9dfc21f2`,
-by Martin Dilger and Nebulit GmbH (https://nebulit.de). The repository carries no licence file; this material
-is adapted with the agreement of Martin Dilger and Nebulit GmbH.
+by Martin Dilger and Nebulit GmbH (https://nebulit.de), used with the explicit consent of Martin Dilger and Nebulit GmbH.
 
 | Source file | Used in | How |
 |---|---|---|
@@ -55,6 +54,28 @@ is adapted with the agreement of Martin Dilger and Nebulit GmbH.
 | `.claude/skills/update-prompt-status/SKILL.md` and kit "exactly two status updates per prompt" | `references/per-turn-protocol.md` step 7 | Idea; one start marker and one closing outcome per turn, our wording |
 | `.claude/skills/eventmodeling-core-rules/SKILL.md`: modeling and critic postures never mixed; a known refusal is a documented rule | `SKILL.md` "Modes", "Do not cut corners to save tokens or effort" | Idea; our wording kept |
 | `.claude/skills/connect/SKILL.md`: discover capabilities once per session | `SKILL.md` "Run protocol", `references/identity-and-edits.md` | Idea; our wording kept |
+| `.claude/skills/eventmodeling-core-rules/SKILL.md`: modes (modeling versus critic), element definitions and naming, causality, role catalog, field lineage, open question versus decided failure, offline-first, anti-patterns, structural shapes, quick self-check | `references/core-rules-digest.md` | Adapted closely as a one-page card translated to `.play` constructs. Not adopted: lanes, the single-issuer command rule, linked copies, the translation chain with a never-closing todo list, "read model never drives command validation" (Screenplay `reads` + `require`), the update-feeding-read-model procedure; "bed" is a candidate signal here, not an always-flag |
+
+## Not adopted from agentic-engineer (rejected, with reasons)
+
+Recorded once here for the whole method family, checked against the same commit
+(`07b0f30648d663cb588d7e2c7aa031af9dfc21f2`). A rejection stays rejected unless a released Screenplay or
+Chronicle capability removes its reason.
+
+| Source file or topic | Reason |
+|---|---|
+| `connect`, `learn-eventmodelers-api`, `load-slice`, `update-prompt-status`, and the 24 `references/api-fallback.md` files | Transport and credentials for the eventmodelers board. The Screenplay MCP server (`cratis screenplay mcp`) is the only transport; its tool catalog is `cratis-screenplay-model-authoring` `references/mcp-tools.md` and the root is `mcpServers.screenplay.root` in `.cratis/ai.json` |
+| `place-element`, `html-screen`, `storyboard-screen`, `discover-storyboard` HTML reconstruction | Board lanes, columns, cells and HTML or wireframe rendering. Screenplay screens are declarative and Stage renders them; a recreated page is never evidence |
+| `.agent-modeling-kit/README.md`, `lib/config.js`, `package.json`, `package-lock.json`, root `CLAUDE.md` and `README.md` | Board runtime, config walk, package stubs and an Emmett/Postgres/Express/Flyway template; Chronicle and Arc are the runtime here |
+| `.agent-modeling-kit/CLAUDE.md` and `AGENTS.md`: `<promise>`, progress file, board prompt queue, post-question-and-continue autonomy | Board-specific loop control. Our per-turn protocol and stop-or-assume keep the useful parts, and Cratis stops for consequential unknowns |
+| `eventmodeling-designing-event-models/references/examples.md` | The order example embeds a calculated `total` event field and a generic domain; Cratis examples are compiled |
+| Single issuer per command; a screen wired to more than one command always fails; "the bed" as an always-flag | Screenplay commands may have several origins and a screen several actions; the shape stays a candidate signal |
+| "A read model never drives command validation" | Screenplay commands declare `reads` and `require`; a decision uses stored state only through declared `reads` |
+| Compulsory todo list per automation; never-closing translation queue; every trigger is an event | Direct reactions, clock and application triggers and `capture` are supported; a translation holding pending work gets a terminal disposition |
+| "Default gracefully" and log-and-drop for missing external data | Defaults are never fabricated and failures are recorded facts |
+| Linked copies, backward-arrow handling, `session:` field mappings, `validate_model` batch calls | Board mechanics; caller identity is `context` and the model has no columns |
+| "No natural end" red flag, event-granularity tip, archival splits, `no computed fields` as an absolute | Long-lived identities are normal here, generic update events are defects, and decided calculations are facts |
+| Emmett decide/evolve structure, `processor.ts`, processor ids and locks, DLQ store, SQL operations, Flyway, Testcontainers, `routes.ts` | A different runtime; Chronicle and Arc own delivery, projection and transport |
 
 ## 3. Method lineage
 

package/package/corpus/skills/cratis-screenplay-modeling-lifecycle/references/reasoning-notes.md

@@ -14,8 +14,8 @@ PLAY0477 retained for events. Specifications accept `description`, not documenta
 put their longer reasoning on the owning slice. Projections/screens do not accept it.
 Canonical printing retains documentation on its owner. It is report-only (PLAY0270),
 absent from executable bytes and `modelRevision`; edits change source identity
-(`verdicts-and-modes.md`). Neither description nor documentation is rendered as code
-(Stage#178): model the rule first, never treat prose as enforcement.
+(`verdicts-and-modes.md`). Neither description nor documentation reaches rendered code except as XML doc
+comments (Stage#178 closed): model the rule first, never treat prose as enforcement.
 
 Cover, briefly and only where real:
 1. Scope: the business process and the identities its streams are keyed by.

package/package/corpus/skills/cratis-screenplay-modeling-lifecycle/references/verdicts-and-modes.md

@@ -18,7 +18,7 @@ defines what each result means and how to report it. Do not copy version facts h
 
 | Result | Evidence | Does NOT prove |
 |---|---|---|
-| V1 authorable | folder-mode validate with warnings as errors. The standalone compiler includes imports in folder and file mode; the pinned `cratis` CLI (v3.28.2) file validation still ignores imports (cli#244, probed), so folder mode is the cross-tool check | semantics, binding, specs |
+| V1 authorable | folder-mode validate with warnings as errors. The standalone compiler includes imports in folder and file mode; `cratis` CLI 3.28.2 file validation ignored imports (cli#244, probed); since 3.28.4 (PR #258) it compiles the file with its imports, but folder mode stays the recommended cross-tool check | semantics, binding, specs |
 | V2 executable diagnostics | the executable model reports no diagnostics for the scope | that any spec runs or passes |
 | V3 binding-ready | the model binds to the executable semantic model | that any spec runs or passes |
 | V4 reference specs run | the reference execution route only: engine, and per `.play` specification passed / failed / unsupported / cancelled | rendering, generated code, build or target tests |

package/package/corpus/skills/cratis-screenplay-modeling-lifecycle/references/vocabulary-map.md

@@ -18,10 +18,10 @@ speaks in them; never model board mechanics (lanes, node ids, positions).
 | Chapter / workflow | `feature` | feature folder | vertical slices |
 | Slice | `slice` (one behaviour, not one artifact of each kind) | vertical slice folder | vertical slices |
 | Scenario (Given/When/Then) | `specification` | generated spec class `when_<spec_name>` (Debug) or hand-written C# specs | `cratis-screenplay-specifications`; C# spec skills |
-| Storyline (ordered beats) | a **family** of specifications sharing example data, each one transition (no storyline syntax at the verified Screenplay v4.66.0) | several spec classes | specifications |
+| Storyline (ordered beats) | a **family** of specifications sharing example data, each one transition (no storyline syntax at Screenplay 4.139.0) | several spec classes | specifications |
 | Field validation | concept `validate` (every use) / command `validate`, `require` | `ConceptValidator<T>` / `CommandValidator<T>` | command validation |
 | Role permission ("Cannot") | `policy` + `authorize` + `then denied` spec; ownership via `claim ... matches subject` | `[Authorize(Policy)]`, generated policies | authorization |
-| Precondition on stream state | `reads` + `require` as stated intent, not enforced at the verified Screenplay v4.66.0 (target: Arc `[ProtectedDecision]` + `DecisionRead<T>`, or Chronicle DCB; APIs available to gap-fill in Stage 4.51.3's Arc 22.50.5/Chronicle 19.32.0, not emitted protection) | decision over a guarded read | command validation |
+| Precondition on stream state | `reads` + `require` as stated intent, not enforced at Screenplay 4.139.0 (target: Arc `[ProtectedDecision]` + `DecisionRead<T>`, or Chronicle DCB; APIs available to gap-fill in Stage 4.73.1's scaffold of Arc 22.68.0/Chronicle 19.45.0, not emitted protection) | decision over a guarded read | command validation |
 | Generated id (`derived:uuid4()`) | `generated` (authorable, not executable) | id supplied before `Handle()` | commands |
 | External system / outbound call | `Translate` slice (inbound); `system`/`operation` (authorable, not executable) or Automation (outbound) | `ICommandOperation` / reactor | operations, reactors |
 | HTML mockup | `screen` Level 1 + board (`visualize-model`) | default Scene composition | ui composition |
@@ -42,8 +42,9 @@ Screenplay meaning, and when you meet the older usage, translate it and say so.
 - Screenplay **`reaction`**: the construct that models it (`when` trigger, optional `where`,
   `invokes` a command or `produces` events).
 - Chronicle **reactor**: C# observer, usually for side effects; it does not by itself define
-  business decisions. A Screenplay reaction is authorable and bindable, but Stage `v4.24.2` renders no Automation or
-  Translate slice: the reactor and command are gap-fill code.
+  business decisions. A Screenplay reaction is authorable and bindable, but Stage 4.73.1 renders no Automation or
+  Translate slice: the reactor and command are gap-fill code. A reaction that both produces events and invokes commands is
+  refused by Stage (`STAGE-ESM-037`); Arc 22.72.0 and later run one reactor returning events and commands (the Stage scaffold's Arc 22.68.0 needs a proven override), so keep the reaction whole.
 
 ## Scenario vs specification
 "Scenario" is the Event Modeling example and the scenario *types* `cratis-screenplay-scenario-coverage` uses for

package/package/corpus/skills/cratis-screenplay-projections/SKILL.md

@@ -35,7 +35,8 @@ source is the single flow model.
 The update follows `commands.md`, `events.md` and `mcp/authoring-tools.md` at
 that main commit (after v4.52.0); no PDL example changes in this update.
 
-Checked against the Screenplay repository at tag `v4.31.0` (commit `355dffb`):
+Originally checked against the Screenplay repository at tag `v4.31.0` (commit `355dffb`; the
+projection grammar was re-read at v4.139.0 for headers and dynamic keys):
 `Documentation/screenplay/projections/` (including `semantic-model.md`, `keys.md`
 and `variants.md`), `readmodels.md`, `diagnostics.md` and decisions 0001 and 0002.
 Every example below compiles with that version's compiler. Reverify before
@@ -88,8 +89,11 @@ Read [observer filters](../cratis-screenplay-toolchain/references/production-rou
 
 ## Projection-level directives
 
-`no automap`, `sequence <name>`, `file <path>`. `sequence` is a realization
-concern and does not bind to the executable model.
+`description "..."` (or a fenced text block) on the projection header (report-only `PLAY0270`; variants
+and nested blocks take none), `no automap`, `sequence <name>`, `file <path>`. `sequence` is a realization
+concern and does not bind to the executable model. A mapping target may end in a dynamic dictionary
+key, `count eventCountByType.$eventContext.eventType.id` (one entry per distinct value); only
+`$eventContext` resolves there, any other `$` text is a literal key with warning `PLAY0299`.
 
 ⚠️ **Do not write `key` on the projection.** It parses, but neither Chronicle nor
 the executable model routes any event by it, and it is not a default for the
@@ -328,8 +332,8 @@ What the executable model does with it (ESM v3):
 - The body is an opaque attachment identified by a content hash, never compiled
   or run by Screenplay. The reference runner cannot compute reducer state, so a
   specification that reads a reducer-built read model reports unsupported and
-  never passes. A target must supply the transition. Stage 4.24.0 admits only pure reducer bodies
-(Roslyn allowlist); an impure body is gap-fill code, and the model stays the contract.
+  never passes. A target must supply the transition. Stage (4.73.1) admits only pure reducer bodies
+(Roslyn allowlist, `STAGE-ESM-019`/`-022`); an impure body is gap-fill code, and the model stays the contract.
 
 **Prefer a projection where one will do.** A reducer is code, and code is the part
 of a document a reader cannot check at a glance.

package/package/corpus/skills/cratis-screenplay-projections/references/pdl-grammar.md

@@ -10,7 +10,9 @@
 
 Checked against `Documentation/screenplay/projections/{grammar,semantic-model,keys,variants}.md`
 and `Source/DotNET/Screenplay/Parsing/ProjectionParser.cs` at Screenplay tag
-`v4.31.0` (commit `355dffb`).
+`v4.31.0` (commit `355dffb`); the header `description` and the dynamic dictionary-key target
+(`Target = ["@"] Path [DynamicKey]`, `DynamicKey = "." "$eventContext" "." EventContextPath`) were added in
+later releases and re-read at v4.139.0.
 
 The grammar says what **parses**. It does not say what an event does at runtime:
 Chronicle's lowering decides that (Screenplay decision 0001), and the
@@ -143,7 +145,7 @@ LiteralKeyword  = "literal", " ", Literal ;   (* parsed at the Expr level *)
 | `PLAY0190` | A reducer rule body opens with an unknown word |
 | `PLAY0191` | A read model is built by more than one projection or reducer |
 | `PLAY0192` | A read model is declared more than once |
-| `PLAY0295`–`PLAY0299` | An `$eventContext` path the event-context catalog does not have |
+| `PLAY0295`–`PLAY0299` | An `$eventContext` path the event-context catalog does not have; `PLAY0299` also warns when a dynamic dictionary key uses a `$` source other than `$eventContext` |
 | `PLAY0380` | Chronicle drops part of a construct: `all` below the top level, or `automap` on a joined event |
 | `PLAY0381` | A projection-level `key` routes no event |
 | `PLAY0382`–`PLAY0385` | Variant errors: no `enters on`, shared mapping missing on a variant, duplicate variant name, entering event claimed twice |

package/package/corpus/skills/cratis-screenplay-read-surface/LICENSE

@@ -1,2 +1,9 @@
 Copyright (c) Cratis. All rights reserved.
 Licensed under the MIT license. See LICENSE file in the project root for full license information.
+
+Third-party notices
+
+This skill adapts material from agentic-engineer by Martin Dilger and Nebulit GmbH
+(https://github.com/Nebulit-GmbH/agentic-engineer, commit 07b0f30648d663cb588d7e2c7aa031af9dfc21f2;
+https://nebulit.de), used with the explicit consent of Martin Dilger and Nebulit GmbH. The adapted
+material remains credited to Martin Dilger and Nebulit GmbH. See references/provenance.md.

package/package/corpus/skills/cratis-screenplay-read-surface/SKILL.md

@@ -150,7 +150,8 @@ pushing; without the marker a query is one-shot, which is the default and what
 most reads are. The marker qualifies only *how* the result arrives, so it composes
 with `[]`, `optional`, `by`, `filter`, `authorize` and a `performer`, and a screen binds
 to a live query exactly as it binds to a one-shot one. The delivery itself is the
-target runtime's: the executable model does not bind observable queries.
+target runtime's: the executable model binds `observable` queries (delivery `live`) that
+have no `filter`, `scoped to` or `performer`.
 
 Paging, sorting and change-set delivery for queries are accepted as Screenplay
 decision 0010 but **not in the language yet**. Do not invent syntax for them.
@@ -173,13 +174,14 @@ on the header line is a declaration error, not a shorthand.
 
 ### What runs
 
-In the Screenplay 4.66.0 executable model, only the keyed snapshot shape binds:
-`=> <ReadModel> optional` with one caller-supplied `by` argument and no `observable`,
-`filter`, `scoped to` or `performer`. Anything else, including `=> <ReadModel>`
-and `=> <ReadModel>[]`, reports `PLAY0268`. Its `authorize` gate runs before
+In the Screenplay 4.139.0 executable model (admitted since 4.105.0) these bind: a keyed
+`=> <ReadModel> optional` with one caller-supplied `by` argument, an unfiltered list
+`=> <ReadModel>[]`, a list narrowed by one caller-supplied `by` key, and the `observable`
+form of each. `filter`, `scoped to`, `performer`, `by ... from` and composite `by` report
+`PLAY0268`, as does a single non-optional `=> <ReadModel>`. Its `authorize` gate runs before
 the lookup, ANDed with module and feature gates; a denied caller gets
 `Unauthorized`. Pin that with a `given caller` fixture and `then denied` (see
-`cratis-screenplay-specifications`). Model the richer query shapes when the
+`cratis-screenplay-specifications`). Model `filter`, `scoped to` and `performer` shapes when the
 application needs them; just do not claim the reference runner exercised them.
 
 ## `screen` — three levels
@@ -192,8 +194,10 @@ commands and screens it names are declared elsewhere.
 ```screenplay excerpt
 screen InvoiceList
   data InvoiceListReadModel[] via query ListInvoices
-  action RegisterInvoice
-    navigate to RegisterInvoiceScreen
+  section registerInvoiceInput
+    title "Register invoice"
+    on click
+      navigate to RegisterInvoiceScreen
   action CancelInvoice
 ```
 
@@ -307,8 +311,12 @@ binding failures are errors.
 Read `references/versions.md` in `cratis-screenplay-toolchain` when choosing a tool, checking versions, or assessing executable and renderable subsets. Where a construct sits in the
 method: `cratis-screenplay-modeling-lifecycle` and `cratis-screenplay-slice-design`.
 
+Read [screen patterns](references/screen-patterns.md) when deciding whether a screen is an input, status or error-state screen and which `data` and `action` lines it needs.
+
 ## Route near misses
 
+Attribution and licences: `references/provenance.md`.
+
 - How events fill the read model: `cratis-screenplay-projections`.
 - Layouts, templates, forms, component bindings, toolbars, outlets, contributions, packages and themes: `cratis-screenplay-ui-composition`.
 - Asserting query results: `cratis-screenplay-specifications`.

package/package/corpus/skills/cratis-screenplay-read-surface/references/provenance.md

@@ -0,0 +1,21 @@
+# Provenance
+
+## Adapted closely (Martin Dilger and Nebulit GmbH)
+
+Source: https://github.com/Nebulit-GmbH/agentic-engineer at commit `07b0f30648d663cb588d7e2c7aa031af9dfc21f2`,
+by Martin Dilger and Nebulit GmbH (https://nebulit.de), used with the explicit consent of Martin Dilger
+and Nebulit GmbH. The notice is in this skill's `LICENSE`.
+
+| Source file | Used in | How |
+|---|---|---|
+| `.claude/skills/eventmodeling-storyboarding-events/SKILL.md`, "Common Patterns": input screen, status screen, error state | `references/screen-patterns.md` | Adapted closely and mapped to `screen`, `data`, `action` and `specification` (`then error`); one screen per column, lanes, actor perspective rows and mandatory rendering not adopted; the example is compiled with Screenplay 4.139.0 |
+
+Not adopted: HTML screen reconstruction and wireframe sketching (`html-screen`, `storyboard-screen`), which are board
+mechanics; Screenplay screens are declarative and Stage renders them.
+
+## Other lineage
+
+- Screenplay language documentation and the released tool, pinned in `cratis-screenplay-toolchain`
+  `references/versions.md`: the `readmodel`, `query` and `screen` constructs.
+- Event Modeling (Adam Dymitruk) and Martin Dilger, *Understanding Eventsourcing*: the screen as the point where
+  a person reads a view and decides.

package/package/corpus/skills/cratis-screenplay-read-surface/references/screen-patterns.md

@@ -0,0 +1,130 @@
+<!-- Copyright (c) Cratis. All rights reserved. -->
+<!-- Licensed under the MIT license. See LICENSE file in the project root for full license information. -->
+
+# Screen patterns
+
+## Contents
+
+- Input screen
+- Status screen
+- Error state
+- A complete example
+- What a screen pattern is not
+
+Three screen shapes recur in almost every model. Decide which one a screen is before declaring
+its `data` and `action` lines; the shape tells you which read model and which command it needs.
+Adapted from Martin Dilger and Nebulit GmbH's storyboarding patterns (see `provenance.md`),
+translated to `screen`, `data`, `action` and `specification`.
+
+## Input screen
+
+The person fills in a form, submits, and a fact is recorded.
+
+- The form fields are the command's inputs; a field the person should not supply (their own
+  identity, the tenant) comes from context, not the form (`cratis-screenplay-command-surface`
+  `references/context.md`).
+- The submit is `action <Command>` on the screen. The screen needs no read model when it is a
+  blank creation form; when it shows current state before the person acts (the berth's
+  availability, the amount still owed), it also needs `data <ReadModel> via query <Query>`.
+- After success the person lands somewhere meaningful: `navigate to <Screen>` on the action, or the
+  list that now contains the new item. Where the person goes next is part of the story, so name it.
+
+## Status screen
+
+The person looks at where something stands and decides what to do next.
+
+- `data <ReadModel> via query <Query> [by <param>]` supplies the current state, built from the
+  events so far. Every field shown has a source in that read model.
+- The available actions depend on state. A static `action` line is always offered; an action that
+  must differ by state is a guarded action (`references/guarded-actions.md`), never prose.
+- A status screen with no incoming view is a gap; only a blank creation form is exempt.
+
+## Error state
+
+The person acts and the command is refused: no event is recorded, a message is shown, and the
+person can retry or choose another action.
+
+- The refusal is not drawn on the screen. It is behavior, pinned by a `specification` with
+  `then error` (a rule) or `then denied` (a gate), and by the command's `validate` and `require`
+  messages, which are the text the person sees.
+- Name the way out. After a refusal the person can correct the input and submit again, or take a
+  different action on the same screen. If neither is possible, the slice has a dead end; record
+  it as an open question.
+- Do not add a screen per error. One screen with its refusal specifications covers the states.
+
+## A complete example
+
+A berth booking form that shows availability (input screen over a view), a booking list that
+shows state (status screen), and the refusal pinned by a specification (error state).
+
+```screenplay
+domain Harbourlight.Berths
+
+concept BookingId : Uuid
+concept BerthName : String
+  validate
+    not empty  message "A berth needs a name"
+
+policy IsAuthenticated
+  require authenticated
+
+module Berths
+  description "Berth bookings for one marina"
+  authorize IsAuthenticated
+  feature Bookings
+    slice StateChange BookBerth
+      description "A skipper books a berth"
+      command BookBerth
+        bookingId BookingId identifier
+        berth BerthName
+        produces BerthBooked
+          for bookingId
+          berth = berth
+      event BerthBooked
+        berth BerthName
+      screen BookBerthScreen
+        title "Book a berth"
+        action BookBerth
+          navigate to OpenBookingsScreen
+      specification BookingABerth
+        given caller
+          authenticated
+        when BookBerth
+          bookingId = "3b0c7a14-5d2e-4f61-8a9b-0c1d2e3f4a01"
+          berth = "Pier 2, berth 14"
+        then BerthBooked
+          for "3b0c7a14-5d2e-4f61-8a9b-0c1d2e3f4a01"
+          berth = "Pier 2, berth 14"
+      specification BookingWithoutABerthNameIsRefused
+        given caller
+          authenticated
+        when BookBerth
+          bookingId = "3b0c7a14-5d2e-4f61-8a9b-0c1d2e3f4a02"
+          berth = ""
+        then error "A berth needs a name"
+
+    slice StateView OpenBookings
+      description "The harbour office lists the bookings that hold a berth"
+      readmodel OpenBooking
+        bookingId BookingId
+        berth BerthName
+      query ListOpenBookings => OpenBooking[]
+      projection OpenBookings => OpenBooking
+        from BerthBooked
+          bookingId = $eventSourceId
+          berth = berth
+      screen OpenBookingsScreen
+        title "Open bookings"
+        data OpenBooking[] via query ListOpenBookings
+        action BookBerth
+```
+
+## What a screen pattern is not
+
+- Not a column or a lane: a screen is a declaration in a slice, not a position on a timeline.
+  One screen per step is not a rule; a screen hosts every action the person can reasonably take
+  there, and an action may be reachable from several screens.
+- Not a mockup: a drawn page is never evidence for the model, and a Level 1 screen is a data and
+  action contract that a renderer or a person fills in (`cratis-screenplay-ui-composition`).
+- Not mandatory to render: a screen that stays design-only is still a contract for lineage and
+  review.

package/package/corpus/skills/cratis-screenplay-read-surface/verification.json

@@ -16,7 +16,7 @@
     { "kind": "skill-contains", "value": "The tenant is the default and stays unstated" },
     { "kind": "skill-contains", "value": "belongs on a `from` parameter, never on a `filter`" },
     { "kind": "skill-contains", "value": "warnings, not errors" },
-    { "kind": "skill-contains", "value": "the executable model does not bind observable queries" },
+    { "kind": "skill-contains", "value": "the executable model binds `observable` queries" },
     { "kind": "skill-contains", "value": "A compiling query is not evidence that access control works" },
     { "kind": "skill-contains", "value": "decision 0010 but **not in the language yet**" }
   ]

package/package/corpus/skills/cratis-screenplay-render-and-gap-fill/LICENSE

@@ -5,5 +5,5 @@ Third-party notices
 
 This skill adapts material from agentic-engineer by Martin Dilger and Nebulit GmbH
 (https://github.com/Nebulit-GmbH/agentic-engineer, commit 07b0f30648d663cb588d7e2c7aa031af9dfc21f2;
-https://nebulit.de), used with the agreement of Martin Dilger and Nebulit GmbH. That repository
-carries no licence file; the adapted material remains credited to Martin Dilger and Nebulit GmbH.
+https://nebulit.de), used with the explicit consent of Martin Dilger and Nebulit GmbH. The adapted
+material remains credited to Martin Dilger and Nebulit GmbH.

package/package/corpus/skills/cratis-screenplay-render-and-gap-fill/SKILL.md

@@ -9,9 +9,10 @@ license: MIT
 ## Purpose
 
 Act as a **capability probe and deterministic delivery verifier**, not as a code author.
-`cratis render` takes the whole application: if any reachable construct is outside what Stage
-admits, that run publishes nothing. This skill finds out what renders, publishes it, proves it
-builds and that its generated specifications pass, and reports everything else honestly.
+`cratis render` compiles and binds the whole model, then admits the selected scope (the whole
+application, or `--scope` modules, features and slices): if any construct in that scope is outside
+what Stage admits, that run publishes nothing. This skill finds out what renders, publishes it,
+proves it builds and that its generated specifications pass, and reports everything else honestly.
 Behaviour the renderer rejects is delivered by `slice-implementer` with the `.play` model as
 the contract, never smuggled into `Customizations/`.
 
@@ -21,23 +22,24 @@ rule is in `cratis-screenplay-modeling-lifecycle` ("Decide the level first"); it
 
 ## Verified product sources
 
-Version pins live once in `cratis-screenplay-toolchain` `references/versions.md`. Read that file before selecting the compiler and renderer versions for delivery.
-
-| Source | Pin | Used for |
-| --- | --- | --- |
-| cratis CLI | `3.50.0` (`v3.50.0`) | Source-checked `Directory.Packages.props`: Stage 4.67.0, Screenplay 4.131.0, `Cratis.Arc.Screenplay` 22.54.0, Chronicle 19.32.0, Fundamentals 7.22.8; default runtime image `cratis/stage:4.67.0`. Previous CLI 3.46.1 used Stage 4.52.0/Screenplay 4.130.0. No new render/browser probe. UI-profile rejection (`CLI-RENDER-007` to `CLI-RENDER-010`) and render-then-recover shipped in 3.41.0 (Cratis/cli#301). Historical screens release vector: 3.40.7 (`af9f18e`) with `cratis/stage:4.51.1`. Reading baselines: 3.40.3, 3.39.0 and 3.28.3 (`8b43fef`) |
-| Stage | `4.67.0` (CLI 3.50.0 default) | Source-checked, not executed as a new vector. Previous Stage 4.52.0 was executed on CLI 3.43.0. Admission (`STAGE-ESM-*`, and `PLAY0268` render refusals surfaced by the CLI), ownership manifest, `Customizations/` seams, Debug-only specifications, guarded actions (`STAGE-SCENE-ACTION-001`) and interactions (`STAGE-SCENE-INTERACTION-001`) were source-checked at 4.51.3. Older baselines: 4.49.5, 4.43.0 and `v4.24.2` (`32dcac4`) |
-| Screenplay | bundled `4.131.0`; standalone `4.135.0` | Standalone compiler for V1 to V3; binding codes `PLAY0268` and code-attachment rules were read at `v4.66.0`. Historical CLI 3.41.0 probes used bundled 4.114.0; current `cratis` compiler claims require checking 4.131.0 |
-| Rendered apps (historical check) | Arc `22.50.5`, Chronicle `19.32.0`, Scene packages | Stage 4.51.3 scaffold; `[ProtectedDecision]` / `DecisionRead<T>` available to gap-fill, not emitted enforcement. Embedded reverse extraction disabled; verify generated packages before claiming exact Scene runtime parity |
-
-Historical facts retain their checked tags; current pins are source-checked, not new runtime probes.
-`cratis render` was run at 3.28.2 and 3.28.3 for the worked example
-(`references/worked-example.md`); with public CLI 3.43.0 it was run over the canonical
-`ScreenComposition` corpus and published successfully, and an MCP-edited copy was rendered, run and
-checked in the browser; the CLI 3.40.7 browser acceptance run passed 51 assertions
-(Cratis/Screenplay#605). The AI repository's `screenplay-mcp-transcript.ts`
-harness proves the real stdio proposal/apply path against the packaged CLI. The renderer facts are owned by `cratis-stage-rendering-and-sandbox`;
-this skill links them and never restates the admission table.
+Version pins live once in `cratis-screenplay-toolchain` `references/versions.md`; read it before
+selecting the compiler and renderer for delivery. Current pair: CLI 3.53.1 bundling Screenplay
+4.137.0 and Stage 4.73.1 (the standalone compiler is newer, 4.139.0). Render options (`--scope`,
+`--check`, `--package-set`) and exit codes were read at cli `v3.53.1` `Documentation/reference/screenplay.md`
+and `cratis render --help`; admission at Stage `v4.73.1`. Stage's scaffold pins Arc 22.68.0 and
+Chronicle 19.45.0, which are not the latest releases (`cratis-stage-rendering-and-sandbox`
+`references/rendered-application.md`). Source reading is not a new render run.
+
+Runs: the worked example (`references/worked-example.md`) was probed with cratis 3.53.1 (observed; the
+3.28.2/3.28.3 runs are history). With public CLI 3.43.0 (Stage 4.52.0) the canonical `ScreenComposition`
+corpus was rendered and published successfully, and an MCP-edited copy was rendered, run and checked in
+the browser; the CLI 3.40.7 browser acceptance run passed 51 assertions (Cratis/Screenplay#605). The AI
+repository's `screenplay-mcp-transcript.ts` harness proves the real stdio proposal/apply path against the
+packaged CLI. Guarded Close actions (`STAGE-SCENE-ACTION-001`) and double-click interactions
+(`STAGE-SCENE-INTERACTION-001`) are refused and recorded as unsupported, never emulated. UI-profile
+rejection (`CLI-RENDER-007` to `-010`) and render-then-recover shipped in 3.41.0 (Cratis/cli#301). The
+renderer facts are owned by `cratis-stage-rendering-and-sandbox`; this skill links them and never
+restates the admission table.
 
 ## When to use / when not
 
@@ -64,30 +66,36 @@ assume an answer to 4, and record it as `blocked` for the user.
 | Case | Situation | What happens |
 | --- | --- | --- |
 | **A. Admission failure** | the probe reports blocking diagnostics | nothing was rendered or published by this run. Report the codes; the user chooses the next step (see "Procedure" 3) |
-| **B. Generated base plus authorized gap-fill** | an earlier admitted whole-model render exists and the user separately authorized hand-written scope, or a seam the model names needs an adapter | the generated output stays managed and untouched; hand-written code lives in `Customizations/` or a separate project (seam adapters by this skill, business gap-fill by `slice-implementer`), serves named model elements only, never claims render admission, and V5 is reported for the generated base **with its scope stated** |
+| **B. Generated base plus authorized gap-fill** | an admitted render (whole, or a `--scope` of the admitted slices) exists and the user separately authorized hand-written scope, or a seam the model names needs an adapter | the generated output stays managed and untouched; hand-written code lives in `Customizations/` or a separate project (seam adapters by this skill, business gap-fill by `slice-implementer`), serves named model elements only, never claims render admission, and V5 is reported for the generated base **with its scope stated** |
 | **C. Fully hand-written delivery** | the scope cannot render and no generated base is wanted | `slice-implementer` delivers it with the model as the contract (`references/gap-fill-handoff.md`); V5 is `not run: no render` |
 
-Evolved events (a model that selects ESM v4) are gap-fill too: Stage 4.24.2 admits the v4 model but refuses any evolved event and its dependent scope with `STAGE-ESM-026`, because it cannot render Chronicle event-type migrations yet (Stage#204). Events at their initial revision still render. Hand-write the evolved events and their migrations per `cratis-chronicle-event-type-migration`, with the model as the contract. The historical cratis CLI 3.28.3 bundled Stage 4.24.2 and reported an evolved event with `STAGE-ESM-026` (probed); 3.28.2 bundled Stage 4.24.1 (3.28.1 and earlier: 4.24.0) and refused a v4 model with `STAGE-ESM-016`.
+Evolved events are gap-fill too: Stage still refuses (4.73.1) any evolved event and its dependent scope with `STAGE-ESM-026`, because it cannot render Chronicle event-type migrations yet (Stage#204). Events at their initial revision still render. Hand-write the evolved events and their migrations per `cratis-chronicle-event-type-migration`, with the model as the contract.
 
-Generated command values and `returns` responses (ESM v7) bind and run in the reference runner on standalone
-Screenplay 4.68.0 (checked). In the historical CLI 3.41.0 check, ESM v7 reached Stage planning, and Stage 4.51.3
-refused generated values and responses with `STAGE-ESM-028`/`STAGE-ESM-029` (`cratis-screenplay-toolchain`
-`references/versions.md`). When target admission refuses these members, use case A or C: keep
+Generated command values and `returns` responses (ESM v7) bind and run in the reference runner on the standalone
+tool. Stage still refuses them with `STAGE-ESM-028`/`STAGE-ESM-029` (4.73.1). When target admission refuses these members, use case A or C: keep
 the model, hand-write the command and its response with the model (and its fixtures and `then returns`
 specifications) as the contract, and report V3 from the standalone tool and V5 as `not run: no render`.
 
-Models with event sources, streams or command routes bind and reference-execute as ESM v8 on standalone
-Screenplay 4.125.0, so report V3 and V4 from that tool. Previous CLI 3.46.1 refused above v7 with CLI-RENDER-004. Current CLI 3.50.0/Stage
-4.67.0 reaches v8 route checks and construct admission through v10. Public publication,
+Models with event sources, streams or command routes bind and reference-execute as ESM v8 on the standalone
+tool, so report V3 and V4 from that tool. The pinned CLI/Stage pair
+(`cratis-screenplay-toolchain/references/versions.md`) reaches v8 route checks
+and construct admission through v10. Public publication,
 foreign events/event captures and v10 reaction identity/filters/production overrides
 still receive typed refusals; reducer filters render. Keep refused scope as case A/C,
 never infer target support from binding. Read Stage's `references/admission.md` and
 toolchain `references/sources-and-streams.md`.
 
+**Mixed reaction effects.** A reaction that both `produces` events and `invokes` commands is refused by
+Stage (`STAGE-ESM-037`, Stage#207) although Arc 22.72.0 and later run one reactor returning events
+and commands (events appended first as one batch, then commands in order, no cross-effect
+transaction; a retry can repeat the events, so use `[OnceOnly]`/idempotent handling per
+`cratis-chronicle-reactor`). Keep the modeled reaction whole and gap-fill it as that one reactor; never
+split it or drop an effect to get a render. The scaffold pins Arc 22.68.0; whether a newer Arc
+override in `Customizations/Dependencies.props` restores next to it is unverified, so prove it with a restore and build.
+
 Two rules hold in every case: a customization never makes a rejected model renderable, and
-a whole-application V5 is never claimed from a subset. The CLI renders whole applications
-only; a dependency-closed scope selection does not exist, so do not fake one with an
-import-only root file.
+a whole-application V5 is never claimed from a subset. `--scope` renders an admitted part (the whole
+model still compiles and binds) and its V5 states the scope.
 
 ## Procedure
 
@@ -96,17 +104,21 @@ import-only root file.
    `references/verdicts-and-modes.md` "Source identity"), the model root, `--name`,
    `--project-name`, `--root-namespace` and target `cratis`. Take V1 and V3 from
    `cratis-screenplay-toolchain`; report each with tool and version. V3 from a different
-   compiler version does not prove the cratis-bundled binder admits the model (they agree on
-   4.66.0 and cratis 3.28.2; an older cratis bundle binds less).
+   compiler version does not prove the cratis-bundled binder admits the model (the bundle is
+   4.137.0, the standalone tool 4.139.0). `cratis screenplay validate --executable <root>` binds with
+   the bundled compiler and writes nothing: use it as the bundled-binder check (toolchain `references/verdicts.md`).
 2. **Probe.** `cratis render <model-root> --name <App> --destination <probe-dir> -o json`
-   (exit 0 published, 5 refused with nothing published, 1 missing input). Classify every
+   (exit 0 published, 5 refused with nothing published, 1 missing input); add `--check` to plan
+   against the destination without writing (exit 6 changes pending) and `--scope <Module.Feature.Slice>`
+   (repeatable) to render an admitted part. Classify every
    diagnostic with `references/renderability-gate.md`: model fix in the chosen mode,
    capability gap, tool skew or environment. Group by code and count; do not paste the list.
 3. **When admission fails** (case A) present the options, the user decides:
    (a) keep design mode and record the gaps; (b) narrow to renderable mode, where the modeler
    changes the model for business reasons and **without** removing protection (`pii`,
    authorization, rules); (c) deliver the non-renderable scope by hand (case C), with a ledger
-   entry (`references/drift-and-ledger.md`). Partial render does not exist.
+   entry (`references/drift-and-ledger.md`); (d) render the admitted part with `--scope` and gap-fill the rest
+   (case B).
 4. **Publish.** The probe destination by default. Another destination needs the user's intent;
    `--force` needs approval naming its effect and destination (a request that already names them
    counts). Read the receipt: written, unchanged, removed, `recovered`. `recovered: true` means
@@ -120,13 +132,13 @@ import-only root file.
    the generated types the adapter touches (bounded), write the adapter behind a small interface
    with no business decisions, rebuild, retest. Never edit a managed file; never add behaviour the
    model does not state. Detail: `references/delivery-protocol.md` section 4.
-7. **Report authored-UI parity.** On Stage 4.24, Stage renders the default composition only;
-   list each modeled screen, form, layout, template, toolbar, component, outlet, route, package/icon
-   use, theme and persona view as "not rendered". On a newer screens-capable Stage/CLI, require
-   explicit plan/runtime evidence for each authored UI element or a blocking diagnostic; silent
-   fallback to default composition is a failure.
-8. **Drift:** compare the published manifest's `semanticRevision` with a fresh render of the
-   current model under the same inputs (`references/drift-and-ledger.md`).
+7. **Report authored-UI parity.** Require explicit plan/runtime evidence for each authored screen,
+   form, layout, template, toolbar, component, outlet, route, package/icon use, theme and persona view,
+   or a blocking diagnostic or "not rendered" with the responsible tool version; silent fallback to
+   default composition is a failure (Stage 4.24 rendered the default composition only).
+8. **Drift:** `cratis render ... --check` (exit 6 pending); also compare the manifest's `semanticRevision`
+   with a fresh render under the same inputs. For hand-written scope, `cratis screenplay conform` gives
+   structural code-vs-model evidence (`references/drift-and-ledger.md`).
 9. **Hand off** the packet: verdict lines, spec mapping, edit requests for the modeler, ledger
    entries, UI omissions, learning candidates (at most 3).
 
@@ -140,8 +152,8 @@ Adapters and non-renderable scope follow the contract rules of `cratis-applicati
   (`cratis-application-slice-conformance` `references/build-prompts.md`).
 - One ledger scope per `slice-implementer` brief; the brief carries addresses and paths, not contents.
 - Model-enforced rules realized in code (state-dependent rules) need a protected read or
-  concurrency scope; never claim them from prose. Historically checked Stage 4.51.3 rendered apps have
-  Arc 22.50.5/Chronicle 19.32.0; API availability alone is not verified enforcement.
+  concurrency scope; never claim them from prose. Stage 4.73.1 rendered apps scaffold
+  Arc 22.68.0/Chronicle 19.45.0; API availability alone is not verified enforcement.
 - Adapters that call outside systems follow `cratis-engineering-effect-boundaries`; slice
   specifications follow `cratis-application-slice-specifications`.
 - Realization notes are the explicit realization requirements stated in a slice `description` or `documentation`
@@ -155,8 +167,9 @@ Adapters and non-renderable scope follow the contract rules of `cratis-applicati
 - This skill changes no model. Model fixes are edit requests (address, change, rationale) to the owning session.
 - Code reading is bounded: `Customizations/*`, the file and line a build or test error names,
   and the declared hooks. Never browse managed output, `bin/` or `obj/`.
-- `description` and `documentation` never reach rendered code. A rule stated only in prose is
-  unenforced there: ledger entry or target requirement, never "delivered".
+- `description` and `documentation` reach rendered code only as XML documentation comments (Stage#178),
+  never as behavior. A rule stated only in prose is unenforced: ledger entry or target requirement,
+  never "delivered".
 - The `cratis run` sandbox enforces neither validation nor authorization on its default engine; it
   is no evidence for denial behaviour.
 - Never remove `pii`, `secret`, authorization or rules to get a render through; report the gap.