@cratis/pi 7.32.0 → 7.34.0

package/package/corpus/skills/cratis-screenplay-render-and-gap-fill/references/delivery-protocol.md

@@ -1,5 +1,14 @@
 # Delivery protocol
 
+## Contents
+
+- 1. Inputs to collect before the first command
+- 2. Commands
+- 3. Reading results
+- 4. Customizations (bounded)
+- 5. Done check (before reporting)
+- 6. Stop and ask
+
 The render phase proves and publishes; it does not write business behaviour. Run one phase
 per tool call and read each result from its exit status, never from a grep of the log.
 
@@ -9,7 +18,8 @@ per tool call and read each result from its exit status, never from a grep of th
   identity"). A dirty flag is never a revision. Bind the whole run to it; if it changes, start over.
 - The **model root**. Use a dedicated folder: implementation attachments are read from it.
 - **Render inputs:** `--name` (application identity, required for plain source, a C# identifier),
-  `--project-name`, `--root-namespace`, `--target cratis`. Keep them identical across
+  `--project-name`, `--root-namespace`, `--target cratis`, and `--scope <Module[.Feature][.Slice]>` (repeatable) when
+  only an admitted part is delivered; record the scope list with the source identity. Keep them identical across
   re-renders; changing the name or target makes publication refuse as an identity change.
 - **Destination:** `.ai-work/screenplay/<model-slug>/render-probe/<App>` unless the user named another.
 - Which modeled screens, personas and seams exist (UI omission list, section 4).
@@ -19,6 +29,8 @@ per tool call and read each result from its exit status, never from a grep of th
 | Phase | Command | Result is |
 | --- | --- | --- |
 | Admission and publication | `cratis render <root> --name <App> --destination <dir> [--project-name <P>] [--root-namespace <N>] -o json` (forward every option recorded in section 1) | exit 0 published (receipt on stdout), 5 refused (diagnostics, nothing published), 1 missing input |
+| Drift or pending-change check | the same command plus `--check` (and `--scope`, `--force` as used) | no write, no recovery: exit 0 current, 6 `changes_pending`, 5 planning failure, refusal or pending recovery |
+| Bundled-binder check | `cratis screenplay validate --executable <root>` | exit 5 with "does not bind into an executable semantic model" when it does not; never renders or writes. Uses the bundled compiler (CLI 3.53.1 = Screenplay 4.137.0), not standalone 4.139.0 |
 | Debug build | `dotnet build <dir>/<Project>.csproj -c Debug` | the build's exit status |
 | Debug tests | `dotnet test <dir>/<Project>.csproj -c Debug --no-build` | the test runner's exit status plus per-test results |
 | List the generated classes | `dotnet test <dir>/<Project>.csproj -c Debug --no-build --list-tests` | the names to map to specifications |
@@ -38,7 +50,10 @@ file (for example `--logger "trx"` with a results directory under the probe fold
 - **Publication:** written, unchanged and removed counts, plus `recovered`. `refused` when a managed file
   was modified, an unmanaged file sits on a planned path, a modified stale file would be removed,
   or the manifest identity changed (`drift-and-ledger.md`). Ok means `recovered: false` and
-  `written + unchanged` equal to the artifact count.
+  `written + unchanged` equal to the artifact count (for a `--scope` render, the scope's artifacts: other
+  scopes' files are preserved and never counted; compare against the receipt's `owners`/`sources` for the
+  selected slices and the `orphaned` list). The receipt's `sources` (CLI 3.45.0 or later) map generated files back to
+  specifications and slices.
 - **Build:** Debug exit status. Classify each error location as `Customizations/`, managed or outside.
   An error in a managed file after a clean render is a renderer defect or an environment problem:
   report it, never patch the file.

package/package/corpus/skills/cratis-screenplay-render-and-gap-fill/references/drift-and-ledger.md

@@ -4,7 +4,7 @@
 The ownership manifest `.cratis-render.json` at the destination records `semanticRevision`
 (`rev1:<sha256>`), the target, the renderer, the application name and a hash per managed file.
 
-Facts verified with `cratis render` 3.28.2 on one model: the same files rendered under the names
+Facts verified with `cratis render` 3.28.2 on one model (historical probe; still how identity works): the same files rendered under the names
 `Marina` and `Harbour` gave different `semanticRevision` values, so **the application name is part
 of the revision**. The MCP workspace names the application after the model root folder (without
 `.screenplay/identities.json`), so its `modelRevision` is not comparable with a render's manifest
@@ -12,14 +12,31 @@ revision by assumption. Without `.screenplay/identities.json` it changes when th
 renamed (relocating the root while keeping its name does not); source positions and descriptions do
 not change it, and a file move changes it only if it changes logical placement or application identity.
 
+**First probe: `cratis render <root> --name <App> --destination <dir> --check`** (CLI 3.44.0 or later; add
+the `--scope` list used for delivery). It plans against the real destination, writes nothing and runs
+no recovery: exit 0 current, 6 changes pending, 5 planning failure, refusal or pending recovery.
+Documentation edits also change managed-file hashes, so they show as pending changes. `--check`
+replaces the throwaway `-drift` render below; the manifest comparison stays as a cross-check.
+
 Compare in this order:
 1. **Source identity** (`cratis-screenplay-modeling-lifecycle` `references/verdicts-and-modes.md`):
    compute it for the current model and compare it with the identity recorded when the output was
    rendered. Equal: the same model bytes, whatever git says. Different: the output is behind the model.
-2. **Manifest revision:** render the current model with the **same** `--name` and inputs into a
+2. **Manifest revision** (when `--check` is not available): render the current model with the **same** `--name` and inputs into a
    fresh probe folder (`.../render-probe/<App>-drift`) and compare its manifest `semanticRevision`
    with the published one. Equal: no semantic change since publication. Different: re-render and review the receipt.
 3. Equal revisions prove neither customization conformance nor faithful UI.
+4. **Hand-written scope against the accepted model:** `cratis screenplay conform <model-root> --project <path>`
+   (CLI 3.42.0 or later; Arc, Marten and Critter Stack code) compares the declarations recovered from
+   code with the model by exact structural address. Exit 0 no blocking findings, 1 defects (code-only
+   declarations, shape mismatches), 2 could not run or incomplete coverage; model-only members are
+   informational. It is **structural drift evidence only**, never a behavioral equivalence verdict and
+   never V4 or V5; it needs the same generation options (`--domain`, `--feature-root`, `--module`,
+   `--skip-segments`, `--modules-from-namespace-roots`) that reproduce the authored placement, or
+   everything looks missing. MSBuild evaluates the project (use a trusted clone) and the bundle's
+   `Cratis.Arc.Screenplay` is 22.54.0, so recovery behaves like that adapter. It does not replace
+   `cratis-application-slice-conformance`, which reconciles specifications, rules and behavior.
+   Whether it is meaningful on a Stage-rendered application is unverified.
 
 Use the same toolchain as the render; revisions from another Screenplay version are not
 comparable by assumption. A dirty git flag or commit is context, never a revision.

package/package/corpus/skills/cratis-screenplay-render-and-gap-fill/references/gap-fill-handoff.md

@@ -1,5 +1,13 @@
 # Gap-fill hand-off to `slice-implementer`
 
+## Contents
+
+- One scope per brief
+- What comes back
+- Rules the model states only in prose
+- Automation and Translate scope
+- Re-delivery
+
 For scope the renderer rejects (case C in `SKILL.md`) and for hand-written scope next to a
 generated base (case B). The render phase reports the capability boundary; the implementer
 authors the code with the `.play` slice and its specifications as the contract. Contract
@@ -61,13 +69,13 @@ ambiguous addresses; contracts are never inferred from names.
 A rule that exists only in a description, or a state-dependent rule the model marks as not
 enforced, is unenforced in generated scope. List it in the ledger as a target requirement. In
 hand-written code it needs an atomic enforcement point: a protected read or a concurrency scope
-(Stage 4.51.3 rendered apps have Arc 22.50.5/Chronicle 19.32.0: protected-read APIs
+(Stage 4.73.1 rendered apps scaffold Arc 22.68.0/Chronicle 19.45.0: protected-read APIs
 are available to gap-fill, with projection/key admission and active enrollment), or a Chronicle constraint. A stale view or
 a caller-supplied status is not enforcement.
 
 ## Automation and Translate scope
-Stage 4.24 renders no Automation or Translate slice, so the whole automation is gap-fill, written
-against the slice and its specifications. The realization follows the actual construct and
+Stage (4.73.1) renders no Automation or Translate slice and no reaction or capture, so the whole
+automation is gap-fill, written against the slice and its specifications. The realization follows the actual construct and
 trigger, not the slice label: a capture is an ingestion adapter, an event reaction (including a
 translator reaction) is a reactor, a clock or application trigger is a scheduler or host signal. Where they are
 registered depends on the case. Case B (a generated base exists, and the user authorized the
@@ -77,12 +85,22 @@ not bind a modeled reaction or capture. Case C (no generated application): there
 composition conventions (`rules/vertical-slices.md`, `cratis-chronicle-reactor`).
 Declare the trusted actor with reaction `runs as system role "<Role>"`
 (standalone 4.125.0, ESM v10); `given caller` is not an invocation actor.
-Historical CLI 3.41.0's older compiler rejected the syntax. CLI 3.50.0/Stage 4.67.0
-reaches v10 construct admission but still refuses reaction identity
-(STAGE-ESM-034); previous CLI 3.46.1 admitted through v7 only. Gap-fill retains the declared role and uses Arc
+Historical CLI 3.41.0's older compiler rejected the syntax. The pinned CLI/Stage pair
+(`cratis-screenplay-toolchain/references/versions.md`) reaches v10 construct admission but still refuses reaction identity
+(STAGE-ESM-034). Gap-fill retains the declared role and uses Arc
 `[ExecuteCommandsAsSystem]` for returned commands. Checked model and diagnostics:
 captures-and-reactions `references/invocation-identity.md`.
 
+A reaction that both produces events and invokes commands keeps its single modeled form
+(`STAGE-ESM-037` is Stage's refusal, not a model defect). Hand-write one reactor returning the events
+and the commands: on Arc 22.72.0 or later (the Stage 4.73.1 scaffold pins Arc 22.68.0, whose command handler accepts a collection only when every element is a command, so a rendered app needs a proven dependency override) the runtime appends the events first as one batch, then
+runs the commands in order, with no transaction across the two effects; a failing command stops the
+later ones but keeps the committed events, and a retry can append the events again, so make the
+handler idempotent (`[OnceOnly]` and the failure behavior in `cratis-chronicle-reactor`). Return a
+stable array or list. The Stage scaffold pins Arc 22.68.0, so raise the version through
+`Customizations/Dependencies.props` only after a restore and build proves it. Never split the
+reaction or drop an effect to dodge rendering.
+
 ## Re-delivery
 The work list is the full in-scope contract delta since the ledger's last verified source
 identity (specifications, rules, mappings, realization notes), then the whole contract is

package/package/corpus/skills/cratis-screenplay-render-and-gap-fill/references/provenance.md

@@ -10,11 +10,10 @@
 - Three delivery cases (admission failure, generated base plus authorized gap-fill, fully
   hand-written delivery) and the whole-model rule: from the #493 plan review of render versus gap-fill.
 
-## Adapted closely (Martin Dilger and Nebulit GmbH, with agreement)
+## Adapted closely (Martin Dilger and Nebulit GmbH)
 
 Source: https://github.com/Nebulit-GmbH/agentic-engineer at commit `07b0f30648d663cb588d7e2c7aa031af9dfc21f2`,
-by Martin Dilger and Nebulit GmbH (https://nebulit.de). The repository carries no licence file; this material
-is adapted with the agreement of Martin Dilger and Nebulit GmbH.
+by Martin Dilger and Nebulit GmbH (https://nebulit.de), used with the explicit consent of Martin Dilger and Nebulit GmbH.
 
 | Source file | Used in | How |
 |---|---|---|

package/package/corpus/skills/cratis-screenplay-render-and-gap-fill/references/renderability-gate.md

@@ -7,17 +7,20 @@ The admitted subset itself (what Stage renders, member by member) is owned by
 probe reports and choosing what to do. Do not copy the code table here.
 
 ## Pipeline that produces the codes
-1. The CLI compiles and binds the model with its **bundled** Screenplay (4.66.0 in cratis 3.28.2,
-   ESM up to v6; 4.60.1, ESM up to v5, before 3.28.2). Binding errors are `PLAY0268` (outside the admitted vertical), `PLAY0269`
+1. The CLI compiles and binds the **whole** model with its **bundled** Screenplay (4.137.0 in
+   cratis 3.53.1, ESM up to v10 for rendering; older bundles bound less). Binding is never scoped:
+   any binding error blocks even a `--scope` render. Binding errors are `PLAY0268` (outside the admitted vertical), `PLAY0269`
    (deferred), `PLAY0270` (report-only information), `PLAY0271` (legacy semantics) and `PLAY0273`
    (a specification shape).
 2. Execution planning builds the plan and can emit `PLAN-*` diagnostics before Stage runs.
 3. Stage plans the target and admits or rejects each member: `STAGE-ESM-0xx`; profile and path
-   problems `STAGE-CRATIS-0xx`. An ESM v4 model with an evolved event is reported with Stage's
-   own `STAGE-ESM-026` (Stage 4.24.2 admits v4 but not evolved events); the CLI adds nothing
-   since 3.28.3 (3.28.2 also reported `CLI-RENDER-003`, and refused a v4 model
-   with `STAGE-ESM-016` on its bundled Stage 4.24.1).
-4. Any error anywhere publishes nothing: the run ends with exit 5 and the diagnostics.
+   problems `STAGE-CRATIS-0xx`. An evolved event is reported with Stage's own `STAGE-ESM-026`
+   (still refused at Stage 4.73.1); the CLI adds nothing. Stage admits ESM v1 to v10 by version and
+   refuses each construct it does not render with its own code (`-024`, `-027` to `-037`).
+4. Any error in the selected scope publishes nothing: the run ends with exit 5 and the diagnostics.
+   Without `--scope` the scope is the whole application. With `--scope`, `PLAN-*` problems in
+   unselected slices are warnings and `STAGE-ESM-*` refusals in unselected slices do not block;
+   binding problems and application-level declarations still do.
 
 The standalone `screenplay` tool can report V3 ready where the bundled binder refuses (newer
 ESM). Only the probe answers renderability. `PLAY0270` entries are information, not blockers.
@@ -26,8 +29,8 @@ ESM). Only the probe answers renderability. `PLAY0270` entries are information,
 
 | Class | Meaning | Typical examples (each verified in `admission.md`) | Action |
 | --- | --- | --- | --- |
-| **Model fix (in mode)** | the model is in, or the user chose, renderable mode and breaks its own subset in a way that has a renderable equivalent with the same meaning | a `produces` whose `for` is not the command identifier; one `StateChange` slice with two commands (`STAGE-ESM-004`); two projections for one read model (`-007`); a policy without `authenticated` (`-015`) | edit request to the modeler session with address, change and rationale |
-| **Capability gap** | the intended meaning needs a construct Stage does not render yet | list, observable and filtered queries (`PLAY0268` "must declare one caller-supplied 'by'", `-010`); Automation and Translate slices (`PLAY0268` "not admitted by ESM v1", `-001`, Stage#79); reactions, clocks, captures and triggers (v6, `-016`); generated values and responses (v7: `-016`, and `PLAY0268` on the bundled 4.66.0; tracked in Stage#201); evolved events (`STAGE-ESM-026`); conditional `produces when` (`-006`); `reads` (`PLAY0271`); code validation (`-005`); opaque policies (`-015`); compliance attributes (`PLAY0268` "require portable data-subject semantics"); a command `handler` (`PLAY0268`) | keep the model; ledger entry; options a to c in `SKILL.md`; link the Stage issue |
+| **Model fix (in mode)** | the model is in, or the user chose, renderable mode and breaks its own subset in a way that has a renderable equivalent with the same meaning | a `produces` whose `for` is not the command identifier; one `StateChange` slice with two commands (`STAGE-ESM-004`); two projections for one read model (`-007`); a policy Stage cannot express portably (`-015`; role-only and opaque pure policies render at 4.73.1) | edit request to the modeler session with address, change and rationale |
+| **Capability gap** | the intended meaning needs a construct Stage does not render yet | a snapshot list query (`-010`; observable lists and keyed or unkeyed lists bind and observable lists render), and `filter`, `scoped to`, `performer` queries (`PLAY0268`); Automation and Translate slices (`-001`/`-024`, Stage#79); reactions, clocks, captures and triggers (`-024`); a reaction that both produces and invokes (`-037`: keep it whole and hand-write one reactor on Arc 22.72.0 or later (the scaffold pins 22.68.0: a proven override), never split it; Stage#207); generated values and responses (`-028`/`-029`, Stage#175); `then no readmodel` (`-027`); evolved events (`STAGE-ESM-026`); conditional `produces when` (`-006`); `reads` (`PLAY0271`); code validation (`-005`); compliance attributes (`PLAY0268` "require portable data-subject semantics"); a command `handler` (`PLAY0268`) | keep the model; ledger entry; options a to c in `SKILL.md`; link the Stage issue |
 | **Tool skew** | the bundled compiler disagrees with documented semantics | the false `PLAY0285` on reaction cascades from a cratis before 3.28.2 bundle (cli#242); codes the standalone compiler does not raise | record in the session state and the ledger; never "fix" a correct model |
 | **Environment** | not the model | restore failures, missing SDK, a destination that is not writable | fix the environment or report blocked |
 
@@ -39,19 +42,21 @@ ESM). Only the probe answers renderability. `PLAY0270` entries are information,
 - A refusal never licenses dropping a specification, an event generation or a protection.
 - Group codes by construct and count, report the first few with their `file(line,col)` location,
   and keep the full JSON in the probe folder. Do not paste the list.
-- One error blocks the whole application. Say how many slices are affected, and which slices
-  would render if the blockers were removed (from the locations), marked as an estimate.
+- One error blocks the selected scope. Say how many slices are affected, and which slices
+  would render if the blockers were removed (from the locations), marked as an estimate; offer a
+  `--scope` render of the admitted slices as an option, never a silently thinner render.
 - Admission can pass and a Debug test still fail. Admission is never a passing test; see
   `cratis-stage-rendering-and-sandbox` `references/render-example.md`.
 
 ## Stage issues to cite in ledger entries
-Read at the time of writing (all open): portable query semantics Stage#58 (list, observable and
-filtered queries); Automation and Translate slices Stage#79; mapping expressions and projection
-blocks Stage#117; modeled authentication Stage#120; event generation v4 Stage#165; per-persona
-screens Stage#194. Check that an issue is still open before citing
+Read as open against Stage 4.73.1: portable query semantics Stage#58; Automation and Translate
+slices Stage#79; mapping expressions and projection blocks Stage#117; modeled authentication
+Stage#120; per-persona screens Stage#194; evolved events Stage#204; mixed reaction effects Stage#207;
+generated values and responses Stage#175. Closed: event generation Stage#165, descriptions as code docs
+Stage#178, ESM v7 Stage#201. Check that an issue is still open before citing
 it, and cite only numbers you have just read. A closed issue is a trigger to probe again.
 
 ## Reference outcomes
 - The complete marina model of `cratis-stage-rendering-and-sandbox` `references/render-example.md`:
-  admission ok, 30 artifacts, Debug build ok, 7 tests passed (cratis 3.28.2).
+  admission ok, 30 artifacts, Debug build ok, 7 tests passed (cratis 3.28.2; on 3.53.1 admission and publication gave 56 artifacts, build and tests not re-run).
 - The model in `worked-example.md`: admission refused with 2 blocking `PLAY0268` diagnostics, nothing published.

package/package/corpus/skills/cratis-screenplay-render-and-gap-fill/references/worked-example.md

@@ -8,14 +8,16 @@
 - Decision and ledger entry
 - The report
 
-A marina model with one renderable command and one list view. The model compiles; `cratis render`
-refuses it, so nothing is published. The example shows how to classify, decide and report.
+A marina model with one renderable command and one snapshot list view. The model compiles and binds;
+`cratis render` refuses it, so nothing is published. The example shows how to classify, decide and
+report. Probed with the standalone compiler 4.139.0 and cratis 3.53.1 (scratch model, observed); the
+earlier 3.28.2 outcome (two `PLAY0268` binding errors) is history.
 
 ## The model
 
 ```screenplay
 // cratis-screenplay-render-and-gap-fill: complete model for the refused-render example.
-// Compiles with warnings as errors; `cratis render` 3.28.2 refuses the list query.
+// Compiles with warnings as errors; `cratis render` 3.53.1 refuses the snapshot list query (STAGE-ESM-010).
 domain Harbour.Marina
 
 concept BerthId : Uuid
@@ -65,42 +67,44 @@ module Berths
 
 ## The probe
 
-Source identity recorded first (`<commit>+<digest>`), tools named: `screenplay 4.66.0`, `cratis 3.28.2`.
-V1 passed on both. Then:
+Source identity recorded first (`<commit>+<digest>`), tools named: `screenplay 4.139.0`, `cratis 3.53.1`.
+V1 passed; the specification passes in `screenplay test`. Then:
 
 ```text
 $ cratis render <model-root> --name Marina --destination .ai-work/screenplay/marina/render-probe/Marina -o json
-exit 5, nothing published
-PLAY0268 hire.play(38,7)  Read model 'BerthEntry' must have one unambiguous keyed query to identify
-                          instances in the first ESM v1 vertical.
-PLAY0268 hire.play(41,7)  Query 'AllBerths' must declare one caller-supplied 'by' argument in the
-                          first ESM v1 vertical.
+exit 5, nothing published ("planning reported 1 error(s)")
+STAGE-ESM-010  Query 'AllBerths' is neither an optional snapshot lookup by identifier nor an
+               observable collection query the renderer can preserve.
 (+ four PLAY0270 information entries: authoring metadata, not blockers)
 ```
 
+The list query binds (a list narrowed by nothing, or by one `by` key, is admitted by the binder);
+Stage refuses it because it is a snapshot, not an observable collection.
+
 ## Classification
 
 | Diagnostic | Class | Why |
 | --- | --- | --- |
-| `PLAY0268` `AllBerths` | capability gap | the business question is "show all berths"; Stage renders only a keyed optional lookup (Stage#58) |
-| `PLAY0268` `BerthEntry` keyed query | capability gap (same cause) | it follows from the missing keyed query |
+| `STAGE-ESM-010` `AllBerths` | capability gap | the business question is "show all berths" as a snapshot list; Stage renders a keyed optional snapshot lookup or an **observable** collection (Stage#58 tracks portable query semantics) |
 
-Both blockers sit in one slice, `Berths/Reservations/BerthRegister`; `ReserveBerth` would pass on
-its own (an estimate: the rest of the model was not probed alone, and a partial render does
-not exist). The tempting "model fix" is a keyed `BerthById` lookup in place of the list. That
-changes what the harbour master can see, so it is a **modeling decision for the user**, never a
-renderer workaround. Here the user keeps the list.
+The blocker sits in one slice, `Berths/Reservations/BerthRegister`; `ReserveBerth` renders on its
+own: `cratis render ... --scope Berths.Reservations.ReserveBerth` published 46 artifacts to a scratch
+destination (observed; the whole model still compiled and bound, and the plain scaffold was added
+because the destination had no manifest). Two tempting "model fixes" exist: a keyed `BerthById`
+lookup, or marking the list `observable`. The first changes what the harbour master can see; the
+second changes delivery from a snapshot to a live subscription. Both are **modeling decisions for
+the user**, never renderer workarounds. Here the user keeps the snapshot list.
 
 ## Decision and ledger entry
 
-Case A, then case C for the list: the user keeps the full model, `ReserveBerth` and the view are
-delivered by hand, and the model stays the contract.
+Case A, then case B for `ReserveBerth` (rendered with `--scope`) and case C for the list: the user keeps
+the full model, the view is delivered by hand, and the model stays the contract.
 
 ```text
-F1  scope: Berths/Reservations/BerthRegister (spec: none yet) ; Berths/Reservations/ReserveBerth (ReservingABerth)
-    blocking codes: PLAY0268 x2 (list query, keyed query)
+F1  scope: Berths/Reservations/BerthRegister (spec: none yet)
+    blocking codes: STAGE-ESM-010 x1 (snapshot list query)
     class: capability gap          decision: implementer (user, <date>)
-    fallback location: src/Marina.Application/Berths/    spec mapping: ReservingABerth -> to be written
+    fallback location: src/Marina.Application/Berths/    spec mapping: none yet (BerthRegister has no specification)
     revisit trigger: Stage#58 (portable query semantics)  last verified: <source identity>
 ```
 
@@ -112,12 +116,12 @@ what the reference execution route supports).
 ## The report
 
 ```text
-Mode: renderable (user chose)   Source: <commit>+<digest>   tools: screenplay 4.66.0, cratis 3.28.2
-V1 authorable:  pass (1 file, screenplay 4.66.0; cratis validate also pass)
-V2 diagnostics: not run: no MCP in this session (the bundled binder's PLAY0268 came from the render probe)
-V3 binding:     blocked: PLAY0268 x2 (cratis 3.28.2 bundled binder)
-V4 specs:       not run: no reference execution route in this toolchain (1 specification written, none run)
-V5 admission:   refused, 2 blocking diagnostics (list query), nothing published
+Mode: renderable (user chose)   Source: <commit>+<digest>   tools: screenplay 4.139.0, cratis 3.53.1
+V1 authorable:  pass (1 file, screenplay 4.139.0)
+V2 diagnostics: not run: no MCP in this session
+V3 binding:     pass (cratis validate --executable, bundled 4.137.0)
+V4 specs:       pass (screenplay test 4.139.0: 1 executed, 1 passed)
+V5 admission:   refused, 1 blocking diagnostic (STAGE-ESM-010), nothing published; scoped to Berths.Reservations.ReserveBerth: not part of this report
 V5 publication: not run: admission refused
 V5 build:       not run: nothing published
 V5 tests:       not run: nothing published
@@ -125,8 +129,9 @@ UI omissions:   not applicable (no render)
 Hand-off:       F1 to slice-implementer (brief: paths and addresses; contract: the .play slice and its
                 specifications; conformance: cratis-application-slice-conformance)
 Edit request:   BerthRegister needs a specification for the list (address, expected rows)
+Note:           a --scope render of ReserveBerth is a separate V5 result with its own scope line
 ```
 
-When the list query later renders, probe again with the same inputs. If it does, plan the
+When the list query later renders (for example after Stage ships snapshot lists), probe again with the same inputs. If it does, plan the
 migration from hand-written files to managed output with the user before re-rendering; a hand
 file on a planned path makes publication refuse.

package/package/corpus/skills/cratis-screenplay-scenario-coverage/LICENSE

@@ -32,5 +32,5 @@ SOFTWARE.
 
 This skill also adapts material from agentic-engineer by Martin Dilger and Nebulit GmbH
 (https://github.com/Nebulit-GmbH/agentic-engineer, commit 07b0f30648d663cb588d7e2c7aa031af9dfc21f2;
-https://nebulit.de), used with the agreement of Martin Dilger and Nebulit GmbH. That repository
-carries no licence file; the adapted material remains credited to Martin Dilger and Nebulit GmbH.
+https://nebulit.de), used with the explicit consent of Martin Dilger and Nebulit GmbH. The adapted
+material remains credited to Martin Dilger and Nebulit GmbH.

package/package/corpus/skills/cratis-screenplay-scenario-coverage/SKILL.md

@@ -24,9 +24,9 @@ language cannot express today are recorded, not faked. Grammar and outcome compa
   `cratis-specification-by-example`); a full audit (`cratis-screenplay-model-review`).
 
 ## Verified product sources
-Screenplay v4.66.0 (`c89198b`) and v4.68.0 (`79801bf`, ESM v7 fixtures and `then returns`):
-`Documentation/screenplay/specifications.md` and the standalone compiler; `cratis` 3.28.2 and
-3.28.3 bundle Screenplay 4.66.0 (before 3.28.2 it bundled 4.60.1). The full pin table and the probes are in
+Screenplay v4.66.0 (`c89198b`) and v4.68.0 (`79801bf`, ESM v7 fixtures and `then returns`) were the
+original sources; released behavior was re-read at v4.139.0 (`Documentation/screenplay/specifications.md`,
+`queries.md`, the standalone compiler). Current pins, the bundle and the probes are in
 `cratis-screenplay-toolchain` `references/versions.md`. At Screenplay v4.127.0,
 MCP `find-specification-obligations` derives SPEC001–SPEC008 from declarations;
 met means matching authored presence, not full coverage or passing execution.
@@ -84,7 +84,7 @@ question is not four approvals.
    row), absence, ordering. Mark lifecycle branches as branches.
 9. **State-dependent rules**: `reads <View>` + `require <expr> message "..."` as stated intent,
    marked **NOT enforced in the model today** in the slice `description` (binding reports
-   PLAY0268/0271: expected in design mode; Screenplay#129/#209), target named (Arc
+   PLAY0268/0271: expected in design mode; Screenplay#129), target named (Arc
    `[ProtectedDecision]` + `DecisionRead<T>`, Chronicle DCB, or a constraint). Forbidden:
    caller-supplied copies of state in `require`, boolean attestation inputs (`confirmsX ==
    true`) and rules hidden in `handler`/hint prose. Never drop an unresolved given or assertion
@@ -187,6 +187,7 @@ production route failure, matching/wrong source/stream and unrouted facts;
 see toolchain `references/production-routes-and-filters.md`.
 
 ## Version skew: reaction cascades and false PLAY0285
+(History: the 3.53.1 bundle carries Screenplay 4.137.0, so this skew no longer applies to it.)
 Under ESM v6 a command spec's `then` lists the events reactions cascade from it. The compiler
 bundled in `cratis` before 3.28.2 (Screenplay 4.60.1) reported a **false PLAY0285** for such
 a spec (cli#242); the standalone `screenplay` 4.66.0 and `cratis` 3.28.2 accept it (probed).

package/package/corpus/skills/cratis-screenplay-scenario-coverage/references/berth-reservations.md

@@ -10,7 +10,7 @@ Complete, compiled design-mode model (marina guest berths) showing a coverage ma
 // Screens and personas are out of scope here (cratis-screenplay-slice-design). This is the canonical design-mode
 // example: stored-state rules (the reservation must be live) are stated as `reads BerthBooking`
 // + `require ... message` and marked NOT enforced in the slice descriptions, with their target
-// named. Binding reports PLAY0271/PLAY0268 for them (expected; Screenplay#129/#209): such a model
+// named. Binding reports PLAY0271/PLAY0268 for them (expected; Screenplay#129): such a model
 // is design-complete but not binding-ready, and that is reported, never "fixed" by deleting the
 // rules. The past-date rule (`night >= today`) is declarative too: ESM v1 has no runtime date,
 // so binding reports PLAY0268 on it (recorded as blocked, not moved into prose); the rule and its rejection

package/package/corpus/skills/cratis-screenplay-scenario-coverage/references/invoicing-dues-design.md

@@ -14,8 +14,9 @@ replaced by prose. The runnable counterpart, which holds no stored-state rule, i
 `invoicing-dues-example.md`; `scenario-examples.md` copies `ReversingAReceivedPayment` from here.
 
 The excerpt's Stage API-availability comment describes the historical Stage 4.24.x
-scaffold. Stage 4.51.3 pins Arc 22.50.5/Chronicle 19.32.0: protected-read APIs are
-available to gap-fill, not emitted protection or `.play` rule admission. The
+scaffold. Stage 4.73.1 pins Arc 22.68.0/Chronicle 19.45.0: protected-read APIs are
+available to gap-fill (the "not in a Stage-rendered application" comment in the source is
+superseded), not emitted protection or `.play` rule admission. The
 original compiled source is retained unchanged.
 
 ```screenplay expect PLAY0516 test=unbound
@@ -24,7 +25,7 @@ original compiled source is retained unchanged.
 // blockers), so this model compiles but is not executable; the specifications below do not run. The runnable counterpart
 // is invoicing-dues-example.md.
 // Target enforcement of every rule here: Arc [ProtectedDecision] with DecisionRead<T> (Arc v22.39.0
-// or later, not in a Stage-rendered application), or a Chronicle DCB; Screenplay#129/#209.
+// or later, not in a Stage-rendered application), or a Chronicle DCB; Screenplay#129.
 
 concept InvoiceId : Uuid
 concept MemberId : Uuid
@@ -107,7 +108,7 @@ module Invoicing
       event PaymentReceived
 
     slice StateChange SettleOrVoidInvoice
-      description "An invoice ends either settled or voided, never both (SettleOrVoid, enforced at append). NOT enforced in the model today: that the invoice exists and is still open (settling) and that only an open, unpaid invoice may be voided. Stated as `reads OpenInvoice` + `require` (PLAY0271/PLAY0268 at binding; Screenplay#129/#209). Target: Arc [ProtectedDecision] with DecisionRead, or a Chronicle DCB. Requirements to test in the target: settling an unknown invoice is rejected; voiding a paid invoice is rejected; voiding an open invoice succeeds."
+      description "An invoice ends either settled or voided, never both (SettleOrVoid, enforced at append). NOT enforced in the model today: that the invoice exists and is still open (settling) and that only an open, unpaid invoice may be voided. Stated as `reads OpenInvoice` + `require` (PLAY0271/PLAY0268 at binding; Screenplay#129). Target: Arc [ProtectedDecision] with DecisionRead, or a Chronicle DCB. Requirements to test in the target: settling an unknown invoice is rejected; voiding a paid invoice is rejected; voiding an open invoice succeeds."
       command SettleInvoice
         invoiceId InvoiceId identifier
         reads OpenInvoice as invoice by invoiceId   // stated intent, unprotected (PLAY0271 at binding)

package/package/corpus/skills/cratis-screenplay-scenario-coverage/references/invoicing-dues-example.md

@@ -259,6 +259,7 @@ module Invoicing
         amount    Decimal
       query OpenInvoiceById => OpenInvoice optional
         by invoiceId InvoiceId
+      query ListOpenInvoices => OpenInvoice[]
       projection OpenInvoices => OpenInvoice
         from InvoiceIssued
           invoiceId = $eventSourceId
@@ -338,6 +339,34 @@ module Invoicing
           arguments
             invoiceId = "9c1f0a52-6a4e-4b1c-9f55-0d2c7b8e1a01"
 
+      specification OpenInvoicesListHoldsTheIssuedInvoice
+        description "The unkeyed list query returns one row per open invoice; each row states the read-model identifier."
+        given caller
+          authenticated
+          role "Accounts"
+        given InvoiceIssued
+          for "9c1f0a52-6a4e-4b1c-9f55-0d2c7b8e1a01"
+          member = "6f1c2a8e-0b1d-4d55-9a3e-2f6a7c1d0e11"
+          amount = 130
+        then query ListOpenInvoices
+          result
+            invoiceId = "9c1f0a52-6a4e-4b1c-9f55-0d2c7b8e1a01"
+            member    = "6f1c2a8e-0b1d-4d55-9a3e-2f6a7c1d0e11"
+            amount    = 130
+
+      specification OpenInvoicesListIsEmptyAfterPayment
+        description "A paid invoice leaves the list: a query with no result block is the empty list."
+        given caller
+          authenticated
+          role "Accounts"
+        given InvoiceIssued
+          for "9c1f0a52-6a4e-4b1c-9f55-0d2c7b8e1a01"
+          member = "6f1c2a8e-0b1d-4d55-9a3e-2f6a7c1d0e11"
+          amount = 130
+        when append PaymentReceived
+          for "9c1f0a52-6a4e-4b1c-9f55-0d2c7b8e1a01"
+        then query ListOpenInvoices
+
     slice StateChange TopUpCredit
       description "Adds credit to a member. Why an amount above zero: a zero top-up changes nothing and hides a mistake."
       command TopUpCredit
@@ -412,6 +441,6 @@ module Invoicing
 - The command that reverses a payment, the refund reaction and their specifications
   (`ReversingAReceivedPayment`, `RequestingARefundAfterAReversal`) are in
   `invoicing-dues-design.md`, because the command needs a stored-state rule.
-- The query answers "absent" with no `result` block; the whole-list query and the `OpenInvoices`
-  list view in the excerpts are design-mode expectations (list queries compile but do not bind at
-  4.66.0, PLAY0268, `cratis-screenplay-toolchain`, so they are retained as design-mode expectations): see `view-and-story-specs.md`.
+- The query answers "absent" with no `result` block. The `ListOpenInvoices` list query and its two
+  specifications bind and run (list queries bind since Screenplay 4.105.0; they compiled but did
+  not bind at 4.66.0); only `filter`, `scoped to` and `performer` queries stay design-mode: see `view-and-story-specs.md`.

package/package/corpus/skills/cratis-screenplay-scenario-coverage/references/provenance.md

@@ -15,15 +15,14 @@ Source: TrogonStack/agentskills at `7b249d3ee42d8b7e11fa564141ebd5fbc37aadf1`, M
 | same file, Quality Checklist and Gherkin Best Practices (explicit givens, explicit outcomes, named reasons), and its Workflow sections 1-5 (command, state validation, view, error path, compensation) | `SKILL.md` "Quality checklist", `references/scenario-examples.md` "Good and bad forms" and categories | Mapped onto `.play` specification style (exact events, pinned messages, `for`, one behavior per spec) |
 | same file, Scenario Organization (happy path, validation, state violation, duplicates, alternatives, error handling, compensation) | `references/scenario-catalogue.md` ordering, `references/scenario-examples.md` categories | Extended with denial, competing claim, ordering, evolution and view types |
 
-## Adapted closely (Martin Dilger and Nebulit GmbH, with agreement)
+## Adapted closely (Martin Dilger and Nebulit GmbH)
 
 Source: https://github.com/Nebulit-GmbH/agentic-engineer at commit `07b0f30648d663cb588d7e2c7aa031af9dfc21f2`,
-by Martin Dilger and Nebulit GmbH (https://nebulit.de). The repository carries no licence file; this material
-is adapted with the agreement of Martin Dilger and Nebulit GmbH.
+by Martin Dilger and Nebulit GmbH (https://nebulit.de), used with the explicit consent of Martin Dilger and Nebulit GmbH.
 
 | Source file | Used in | How |
 |---|---|---|
-| `.claude/skills/eventmodeling-elaborating-scenarios/SKILL.md`: Interview Phase, Workshop Facilitation Guide, Multi-Role Review, Common Workshop Mistakes, Tips for Rapid Creation | `SKILL.md` "Interview phase", `references/scenario-workshop.md` | Text shared with TrogonStack's version (rows above, MIT; rationale, "what if" capture and multi-role review passages are not Nebulit-only); the Nebulit file is recorded here for completeness. Time-boxes and per-command quotas still deliberately dropped |
+| `.claude/skills/eventmodeling-elaborating-scenarios/SKILL.md`: Interview Phase, Workshop Facilitation Guide, Multi-Role Review, Common Workshop Mistakes, Tips for Rapid Creation | `SKILL.md` "Interview phase", `references/scenario-workshop.md` | Text shared with TrogonStack's version (rows above, MIT; rationale, "what if" capture and multi-role review passages are not Nebulit-only); the Nebulit file is recorded here for completeness. Time-boxes and the three-to-five quota are kept only as optional pacing (`scenario-workshop.md` "Optional pacing"), subordinate to the coverage matrix |
 | same file: GWT vs. Storyline decision rule, Workflow 0 (decide per read model before drafting any payload; one reused schema may indicate a skipped judgment), todo lists as the prime storyline candidate, repeated event type as a driver | `SKILL.md` Procedure 5, `references/view-and-story-specs.md` "Worked family: a todo list" | Restored from #493 and adapted closely; storylines become lifecycle families of independent specs because Screenplay has no multi-step specification (Screenplay#394); storyline JSON, beats and layout dropped (board transport) |
 | same file: Scenario Types (seven questions, "not a good/bad pair", skip only for a domain reason) | `references/scenario-catalogue.md` | Idea; our own, broader catalogue kept |
 | same file: Quality Checklist (no command has only two scenarios; read models a separate, equally mandatory pass; why behind rules documented) | `SKILL.md` "Quality checklist" | Adapted closely; board posting and `expectEmptyList` items dropped |

package/package/corpus/skills/cratis-screenplay-scenario-coverage/references/scenario-catalogue.md

@@ -45,7 +45,7 @@ name them as unfinished.
   order, with full payloads and `for`. See `ReservingAGuestBerth`.
 - Traps: asserting a subset of events (lists are exact); leaving out `given caller` on a gated
   command; omitting `for` so the event lands on an allocated source.
-- Generated values and responses (ESM v7, standalone Screenplay 4.68.0; syntax in `cratis-screenplay-specifications`):
+- Generated values and responses (ESM v7, standalone Screenplay 4.68.0 and later; syntax in `cratis-screenplay-specifications`):
   when the command has a `generated` property, the happy path supplies its fixtures (`for` on the generated
   identifier, `generated <name> = <value>`); only when the command declares a response does it assert
   `then returns` (a return expectation without a response is rejected at compile time). Add the failing
@@ -90,11 +90,11 @@ name them as unfinished.
   spec, not `then denied`); denial only when the whole gate is false.
 - Ownership policies (`claim ... matches subject|<property>`): the denial gives the right role
   and a claim with another value (`claim "ownerId" = "<other id>"`); the success spec gives the
-  matching value. Both are needed. Ownership checks on Uuid-backed identifiers do not render
-  today (STAGE-ESM-015): note it.
+  matching value. Both are needed. Ownership checks on text, Uuid, Date and DateTime subjects render at Stage 4.73.1;
+  other subjects are STAGE-ESM-015: note it.
 - Traps: `then error` for a denial; a denial spec whose inputs also break a rule (it still
-  denies, but reads ambiguously); trusting a `cratis run` sandbox answer (it enforces neither
-  authorization nor validation); counting another command's denial.
+  denies, but reads ambiguously); trusting a `cratis run` sandbox answer (the default engine's enforcement is unverified here;
+  the opt-in semantic engine enforces both but reads forgeable caller headers, so it is no security boundary); counting another command's denial.
 
 ## 4. State violation
 - Ask: "After which earlier facts must this request be refused?"
@@ -151,7 +151,8 @@ name them as unfinished.
   all conditions are false the unconditional productions still occur. See
   `RecordingACleanDeparture` (only `BoatDeparted`) and `RecordingADepartureWithDamage` (both).
 - Zero new facts: a command whose productions are all conditional may be accepted with no
-  facts. There is no `then no events` syntax. A command spec with no `then` events but with a
+  facts. `then no events` parses but binding refuses it with PLAY0268 (#433): state the zero-fact outcome through a
+  read-model or query assertion, and an action with no outcome at all does not bind. A command spec with no `then` events but with a
   view or query assertion is still executable as a zero-fact check: the runner compares the
   command's facts with the (empty) expected list by exact count, so any fact produced fails it
   (Screenplay v4.66.0). Write it that way, name it for the zero-fact outcome, and keep the view

package/package/corpus/skills/cratis-screenplay-scenario-coverage/references/scenario-examples.md

@@ -12,8 +12,8 @@
 
 Compact examples for each scenario category, in one invoicing domain so the shapes compare
 easily. Every excerpt below is copied verbatim from the complete document in
-`invoicing-dues-example.md`, which compiles with warnings as errors and whose 21 specifications
-pass in the reference evaluator; it also holds the declarations the excerpts depend on. The two
+`invoicing-dues-example.md`, which compiles with warnings as errors and whose 23 specifications
+pass in the reference evaluator (standalone 4.139.0); it also holds the declarations the excerpts depend on. The two
 compensation excerpts in section 4 come from `invoicing-dues-design.md` instead: that document
 holds the stored-state rules (`reads` + `require`), compiles but does not bind (PLAY0271,
 PLAY0268), so its specifications are design mode and do not run. A second
@@ -207,4 +207,4 @@ specification MemberCreditAccumulatesTopUps
 A list query asserts one `result` block per expected row (count and order are exact), and the
 empty-list intent is a separate claim from a keyed row being absent (`view-and-story-specs.md`
 "Removal is a positive obligation"). The backing example proves the keyed forms only; whole-list
-queries stay design-mode expectations and are recorded as such in the coverage matrix.
+queries are executable too (`ListOpenInvoices` in the backing example); only `filter`, `scoped to` and `performer` queries stay design-mode expectations recorded in the coverage matrix.