@cratis/pi 7.33.0 → 7.34.0

package/package/corpus/skills/cratis-screenplay-scenario-coverage/references/invoicing-dues-design.md

@@ -14,8 +14,9 @@ replaced by prose. The runnable counterpart, which holds no stored-state rule, i
 `invoicing-dues-example.md`; `scenario-examples.md` copies `ReversingAReceivedPayment` from here.
 
 The excerpt's Stage API-availability comment describes the historical Stage 4.24.x
-scaffold. Stage 4.51.3 pins Arc 22.50.5/Chronicle 19.32.0: protected-read APIs are
-available to gap-fill, not emitted protection or `.play` rule admission. The
+scaffold. Stage 4.73.1 pins Arc 22.68.0/Chronicle 19.45.0: protected-read APIs are
+available to gap-fill (the "not in a Stage-rendered application" comment in the source is
+superseded), not emitted protection or `.play` rule admission. The
 original compiled source is retained unchanged.
 
 ```screenplay expect PLAY0516 test=unbound
@@ -24,7 +25,7 @@ original compiled source is retained unchanged.
 // blockers), so this model compiles but is not executable; the specifications below do not run. The runnable counterpart
 // is invoicing-dues-example.md.
 // Target enforcement of every rule here: Arc [ProtectedDecision] with DecisionRead<T> (Arc v22.39.0
-// or later, not in a Stage-rendered application), or a Chronicle DCB; Screenplay#129/#209.
+// or later, not in a Stage-rendered application), or a Chronicle DCB; Screenplay#129.
 
 concept InvoiceId : Uuid
 concept MemberId : Uuid
@@ -107,7 +108,7 @@ module Invoicing
       event PaymentReceived
 
     slice StateChange SettleOrVoidInvoice
-      description "An invoice ends either settled or voided, never both (SettleOrVoid, enforced at append). NOT enforced in the model today: that the invoice exists and is still open (settling) and that only an open, unpaid invoice may be voided. Stated as `reads OpenInvoice` + `require` (PLAY0271/PLAY0268 at binding; Screenplay#129/#209). Target: Arc [ProtectedDecision] with DecisionRead, or a Chronicle DCB. Requirements to test in the target: settling an unknown invoice is rejected; voiding a paid invoice is rejected; voiding an open invoice succeeds."
+      description "An invoice ends either settled or voided, never both (SettleOrVoid, enforced at append). NOT enforced in the model today: that the invoice exists and is still open (settling) and that only an open, unpaid invoice may be voided. Stated as `reads OpenInvoice` + `require` (PLAY0271/PLAY0268 at binding; Screenplay#129). Target: Arc [ProtectedDecision] with DecisionRead, or a Chronicle DCB. Requirements to test in the target: settling an unknown invoice is rejected; voiding a paid invoice is rejected; voiding an open invoice succeeds."
       command SettleInvoice
         invoiceId InvoiceId identifier
         reads OpenInvoice as invoice by invoiceId   // stated intent, unprotected (PLAY0271 at binding)

package/package/corpus/skills/cratis-screenplay-scenario-coverage/references/invoicing-dues-example.md

@@ -259,6 +259,7 @@ module Invoicing
         amount    Decimal
       query OpenInvoiceById => OpenInvoice optional
         by invoiceId InvoiceId
+      query ListOpenInvoices => OpenInvoice[]
       projection OpenInvoices => OpenInvoice
         from InvoiceIssued
           invoiceId = $eventSourceId
@@ -338,6 +339,34 @@ module Invoicing
           arguments
             invoiceId = "9c1f0a52-6a4e-4b1c-9f55-0d2c7b8e1a01"
 
+      specification OpenInvoicesListHoldsTheIssuedInvoice
+        description "The unkeyed list query returns one row per open invoice; each row states the read-model identifier."
+        given caller
+          authenticated
+          role "Accounts"
+        given InvoiceIssued
+          for "9c1f0a52-6a4e-4b1c-9f55-0d2c7b8e1a01"
+          member = "6f1c2a8e-0b1d-4d55-9a3e-2f6a7c1d0e11"
+          amount = 130
+        then query ListOpenInvoices
+          result
+            invoiceId = "9c1f0a52-6a4e-4b1c-9f55-0d2c7b8e1a01"
+            member    = "6f1c2a8e-0b1d-4d55-9a3e-2f6a7c1d0e11"
+            amount    = 130
+
+      specification OpenInvoicesListIsEmptyAfterPayment
+        description "A paid invoice leaves the list: a query with no result block is the empty list."
+        given caller
+          authenticated
+          role "Accounts"
+        given InvoiceIssued
+          for "9c1f0a52-6a4e-4b1c-9f55-0d2c7b8e1a01"
+          member = "6f1c2a8e-0b1d-4d55-9a3e-2f6a7c1d0e11"
+          amount = 130
+        when append PaymentReceived
+          for "9c1f0a52-6a4e-4b1c-9f55-0d2c7b8e1a01"
+        then query ListOpenInvoices
+
     slice StateChange TopUpCredit
       description "Adds credit to a member. Why an amount above zero: a zero top-up changes nothing and hides a mistake."
       command TopUpCredit
@@ -412,6 +441,6 @@ module Invoicing
 - The command that reverses a payment, the refund reaction and their specifications
   (`ReversingAReceivedPayment`, `RequestingARefundAfterAReversal`) are in
   `invoicing-dues-design.md`, because the command needs a stored-state rule.
-- The query answers "absent" with no `result` block; the whole-list query and the `OpenInvoices`
-  list view in the excerpts are design-mode expectations (list queries compile but do not bind at
-  4.66.0, PLAY0268, `cratis-screenplay-toolchain`, so they are retained as design-mode expectations): see `view-and-story-specs.md`.
+- The query answers "absent" with no `result` block. The `ListOpenInvoices` list query and its two
+  specifications bind and run (list queries bind since Screenplay 4.105.0; they compiled but did
+  not bind at 4.66.0); only `filter`, `scoped to` and `performer` queries stay design-mode: see `view-and-story-specs.md`.

package/package/corpus/skills/cratis-screenplay-scenario-coverage/references/provenance.md

@@ -15,15 +15,14 @@ Source: TrogonStack/agentskills at `7b249d3ee42d8b7e11fa564141ebd5fbc37aadf1`, M
 | same file, Quality Checklist and Gherkin Best Practices (explicit givens, explicit outcomes, named reasons), and its Workflow sections 1-5 (command, state validation, view, error path, compensation) | `SKILL.md` "Quality checklist", `references/scenario-examples.md` "Good and bad forms" and categories | Mapped onto `.play` specification style (exact events, pinned messages, `for`, one behavior per spec) |
 | same file, Scenario Organization (happy path, validation, state violation, duplicates, alternatives, error handling, compensation) | `references/scenario-catalogue.md` ordering, `references/scenario-examples.md` categories | Extended with denial, competing claim, ordering, evolution and view types |
 
-## Adapted closely (Martin Dilger and Nebulit GmbH, with agreement)
+## Adapted closely (Martin Dilger and Nebulit GmbH)
 
 Source: https://github.com/Nebulit-GmbH/agentic-engineer at commit `07b0f30648d663cb588d7e2c7aa031af9dfc21f2`,
-by Martin Dilger and Nebulit GmbH (https://nebulit.de). The repository carries no licence file; this material
-is adapted with the agreement of Martin Dilger and Nebulit GmbH.
+by Martin Dilger and Nebulit GmbH (https://nebulit.de), used with the explicit consent of Martin Dilger and Nebulit GmbH.
 
 | Source file | Used in | How |
 |---|---|---|
-| `.claude/skills/eventmodeling-elaborating-scenarios/SKILL.md`: Interview Phase, Workshop Facilitation Guide, Multi-Role Review, Common Workshop Mistakes, Tips for Rapid Creation | `SKILL.md` "Interview phase", `references/scenario-workshop.md` | Text shared with TrogonStack's version (rows above, MIT; rationale, "what if" capture and multi-role review passages are not Nebulit-only); the Nebulit file is recorded here for completeness. Time-boxes and per-command quotas still deliberately dropped |
+| `.claude/skills/eventmodeling-elaborating-scenarios/SKILL.md`: Interview Phase, Workshop Facilitation Guide, Multi-Role Review, Common Workshop Mistakes, Tips for Rapid Creation | `SKILL.md` "Interview phase", `references/scenario-workshop.md` | Text shared with TrogonStack's version (rows above, MIT; rationale, "what if" capture and multi-role review passages are not Nebulit-only); the Nebulit file is recorded here for completeness. Time-boxes and the three-to-five quota are kept only as optional pacing (`scenario-workshop.md` "Optional pacing"), subordinate to the coverage matrix |
 | same file: GWT vs. Storyline decision rule, Workflow 0 (decide per read model before drafting any payload; one reused schema may indicate a skipped judgment), todo lists as the prime storyline candidate, repeated event type as a driver | `SKILL.md` Procedure 5, `references/view-and-story-specs.md` "Worked family: a todo list" | Restored from #493 and adapted closely; storylines become lifecycle families of independent specs because Screenplay has no multi-step specification (Screenplay#394); storyline JSON, beats and layout dropped (board transport) |
 | same file: Scenario Types (seven questions, "not a good/bad pair", skip only for a domain reason) | `references/scenario-catalogue.md` | Idea; our own, broader catalogue kept |
 | same file: Quality Checklist (no command has only two scenarios; read models a separate, equally mandatory pass; why behind rules documented) | `SKILL.md` "Quality checklist" | Adapted closely; board posting and `expectEmptyList` items dropped |

package/package/corpus/skills/cratis-screenplay-scenario-coverage/references/scenario-catalogue.md

@@ -45,7 +45,7 @@ name them as unfinished.
   order, with full payloads and `for`. See `ReservingAGuestBerth`.
 - Traps: asserting a subset of events (lists are exact); leaving out `given caller` on a gated
   command; omitting `for` so the event lands on an allocated source.
-- Generated values and responses (ESM v7, standalone Screenplay 4.68.0; syntax in `cratis-screenplay-specifications`):
+- Generated values and responses (ESM v7, standalone Screenplay 4.68.0 and later; syntax in `cratis-screenplay-specifications`):
   when the command has a `generated` property, the happy path supplies its fixtures (`for` on the generated
   identifier, `generated <name> = <value>`); only when the command declares a response does it assert
   `then returns` (a return expectation without a response is rejected at compile time). Add the failing
@@ -90,11 +90,11 @@ name them as unfinished.
   spec, not `then denied`); denial only when the whole gate is false.
 - Ownership policies (`claim ... matches subject|<property>`): the denial gives the right role
   and a claim with another value (`claim "ownerId" = "<other id>"`); the success spec gives the
-  matching value. Both are needed. Ownership checks on Uuid-backed identifiers do not render
-  today (STAGE-ESM-015): note it.
+  matching value. Both are needed. Ownership checks on text, Uuid, Date and DateTime subjects render at Stage 4.73.1;
+  other subjects are STAGE-ESM-015: note it.
 - Traps: `then error` for a denial; a denial spec whose inputs also break a rule (it still
-  denies, but reads ambiguously); trusting a `cratis run` sandbox answer (it enforces neither
-  authorization nor validation); counting another command's denial.
+  denies, but reads ambiguously); trusting a `cratis run` sandbox answer (the default engine's enforcement is unverified here;
+  the opt-in semantic engine enforces both but reads forgeable caller headers, so it is no security boundary); counting another command's denial.
 
 ## 4. State violation
 - Ask: "After which earlier facts must this request be refused?"
@@ -151,7 +151,8 @@ name them as unfinished.
   all conditions are false the unconditional productions still occur. See
   `RecordingACleanDeparture` (only `BoatDeparted`) and `RecordingADepartureWithDamage` (both).
 - Zero new facts: a command whose productions are all conditional may be accepted with no
-  facts. There is no `then no events` syntax. A command spec with no `then` events but with a
+  facts. `then no events` parses but binding refuses it with PLAY0268 (#433): state the zero-fact outcome through a
+  read-model or query assertion, and an action with no outcome at all does not bind. A command spec with no `then` events but with a
   view or query assertion is still executable as a zero-fact check: the runner compares the
   command's facts with the (empty) expected list by exact count, so any fact produced fails it
   (Screenplay v4.66.0). Write it that way, name it for the zero-fact outcome, and keep the view

package/package/corpus/skills/cratis-screenplay-scenario-coverage/references/scenario-examples.md

@@ -12,8 +12,8 @@
 
 Compact examples for each scenario category, in one invoicing domain so the shapes compare
 easily. Every excerpt below is copied verbatim from the complete document in
-`invoicing-dues-example.md`, which compiles with warnings as errors and whose 21 specifications
-pass in the reference evaluator; it also holds the declarations the excerpts depend on. The two
+`invoicing-dues-example.md`, which compiles with warnings as errors and whose 23 specifications
+pass in the reference evaluator (standalone 4.139.0); it also holds the declarations the excerpts depend on. The two
 compensation excerpts in section 4 come from `invoicing-dues-design.md` instead: that document
 holds the stored-state rules (`reads` + `require`), compiles but does not bind (PLAY0271,
 PLAY0268), so its specifications are design mode and do not run. A second
@@ -207,4 +207,4 @@ specification MemberCreditAccumulatesTopUps
 A list query asserts one `result` block per expected row (count and order are exact), and the
 empty-list intent is a separate claim from a keyed row being absent (`view-and-story-specs.md`
 "Removal is a positive obligation"). The backing example proves the keyed forms only; whole-list
-queries stay design-mode expectations and are recorded as such in the coverage matrix.
+queries are executable too (`ListOpenInvoices` in the backing example); only `filter`, `scoped to` and `performer` queries stay design-mode expectations recorded in the coverage matrix.

package/package/corpus/skills/cratis-screenplay-scenario-coverage/references/scenario-workshop.md

@@ -9,7 +9,7 @@
 - Multi-role check (before leaving the room)
 - Common mistakes
 - Tips for rapid capture
-- Rules of thumb, deliberately different from the source guide
+- Optional pacing
 
 Use this when scenarios are written together with business people, developers and testers
 instead of by one author. The facilitation structure is adapted from the Workshop Facilitation
@@ -38,7 +38,7 @@ specification with that name exists in the model.
 - Outcome lists from discovery and slice design (Cannot lines, "only if" rules, refusals,
   competition candidates, endings) as seeds.
 - One card per command or view, with the twelve matrix columns as prompts. A timer per card is
-  optional; a card is finished when every column holds a value (see Rules of thumb), not when
+  optional; a card is finished when every column holds a value (see Optional pacing), not when
   the time is up.
 
 ## During: one command at a time
@@ -106,8 +106,16 @@ four approvals. Record who actually answered each question.
 - End with the open questions listed, owner and date, and the matrix saved as the workshop
   record.
 
-## Rules of thumb, deliberately different from the source guide
-The source guide time-boxes 15-20 minutes per command and aims at three to five scenarios per
-command. Neither is a rule here: a command with three rules, a gate, two constraints and a
-conditional production needs the scenarios its declarations create, and a quota would drop
-cases. Time-box the discussion, never the matrix; unfinished cells stay `open`.
+## Optional pacing
+A workshop that has to finish in a fixed time can use the source guide's pacing as a starting
+point, subordinate to the matrix:
+- About 15 to 20 minutes per command for the first pass, with a timer per card. A command with
+  few rules is quicker; one with several rules, a gate and constraints takes longer.
+- Three to five scenarios per command is a typical range for a simple command, not a quota.
+- Keep the rhythm of the "During" steps: capture, read back, move on. Parallel pairs take
+  different commands, then read back together.
+
+The matrix, not the clock, decides when a card is finished. A command with three rules, a gate,
+two constraints and a conditional production needs the scenarios its declarations create, and a
+quota would drop cases. Time-box the discussion, never the matrix; unfinished cells stay `open`
+and their owner and date go in the open-question list.

package/package/corpus/skills/cratis-screenplay-scenario-coverage/references/spec-forms-by-mode.md

@@ -16,12 +16,13 @@ Typed example/override forms: `cratis-screenplay-specifications`
 | `given readmodel` | yes | yes (complete instance with key) | only as the query-only lookup below |
 | `when append <Event>` | yes | yes | no |
 | `then readmodel` / `then query` (keyed `ById`, `arguments`, `result`) | yes | yes | yes |
-| `then query` on list, filtered or observable queries | yes | no (query does not bind) | no |
+| `then query` on an unfiltered list or a list narrowed by one `by` key (observable too) | yes | yes since 4.105.0: no `arguments` for an unkeyed list, one `result` per row stating the read-model identifier, no `result` = empty list | observable lists render, a non-observable list is `STAGE-ESM-010` (Stage 4.73.1) |
+| `then query` on `filter`, `scoped to`, `performer` or `by ... from` queries | yes | no: PLAY0268 at binding | no |
 | `then no readmodel <RM> for "<key>"` | yes | yes | no |
 | `when query` -> `then result` / `then no result` | yes | yes | same as `then query`: only the query-only cases below |
-| `given clock` / `when clock`, `when trigger`, `given`/`when capture` | yes | Screenplay 4.61 or later yes (standalone, cratis 3.28.2 or later); a cratis before 3.28.2 bundle no (see versions.md) | no |
+| `given clock` / `when clock`, `when trigger`, `given`/`when capture` | yes | yes (standalone and any current cratis; history: a cratis before 3.28.2 bundle no, see versions.md) | no |
 | Command spec listing reaction cascade events | yes (v6 semantics) | false PLAY0285 on a cratis before 3.28.2 bundle only; see SKILL.md "Version skew" | no (no reactions) |
-| `generated <name> = <value>` under `when`, `then returns` (ESM v7) | yes | yes on standalone Screenplay 4.68.0 or later; not on the 4.66.0 bundled in cratis 3.28.x (`PLAY0268`) | historically no at Stage 4.24.x; check current target admission |
+| `generated <name> = <value>` under `when`, `then returns` (ESM v7) | yes | yes on standalone Screenplay 4.68.0 or later and the current cratis bundle (history: PLAY0268 on the 4.66.0 bundled in cratis 3.28.x) | no: Stage 4.73.1 admits v7 but refuses generated values (STAGE-ESM-028) and responses / `then returns` (STAGE-ESM-029); the spec pins the contract of a hand-written command |
 | `then events in any order` | yes | yes | yes |
 | Event `stream` / `no stream`, typed `for` and stream ids | yes | ESM v8 at 4.125.0 | The pinned CLI reaches Stage route checks (toolchain `references/versions.md`); routed read-model/query replay can still refuse STAGE-ESM-030 |
 | Typed examples and overrides | yes | expanded and type-checked before binding; required fields remain required | depends on expanded contract, not fixture reuse |
@@ -34,8 +35,8 @@ Typed example/override forms: `cratis-screenplay-specifications`
 
 ## Design mode
 Write the full intended behaviour, including scenarios the executable subset cannot run
-(list views; clock, trigger and capture scenarios when only a cratis before 3.28.2
-bundle is available). Mark each such spec in the coverage matrix as
+(filtered, scoped and performer-backed views; clock, trigger and capture scenarios when only a
+cratis before 3.28.2 bundle is available). Mark each such spec in the coverage matrix as
 `gap: <reason>` for the narrower modes so the verification and render phases know what will not execute.
 
 ## Executable mode
@@ -53,7 +54,7 @@ bundle is available). Mark each such spec in the coverage matrix as
 - Specs use given events, a command `when`, and then events / readmodel / query / error /
   denied. No `when append` or `then no readmodel`. `given readmodel` appears only in the
   query-only lookup below.
-- Query-only specs (no command `when`) are admitted by Stage v4.24.0 in exactly two cases, and
+- Query-only specs (no command `when`) are admitted by Stage v4.24.0 in exactly two cases (a v4.24.0 reading, not re-probed at 4.73.1), and
   `when query` and `then query` are the same case: Screenplay normalises `when query` to the
   `then query` model, so the spelling never decides admission.
   - Denial: `given caller` (no role claims), no given events or read models, one query under a
@@ -68,7 +69,7 @@ bundle is available). Mark each such spec in the coverage matrix as
   executable, not renderable).
 - Prove projections with `given` events + `when <Command>` + `then query` (or `then readmodel`).
   Removal has no admitted form: record it as a gap for renderable scope.
-- A `then error` must name a constraint or rule that is actually rendered. Stage v4.24.0 admits
+- A `then error` must name a constraint or rule that is actually rendered. Stage v4.24.0 (historical reading) admits
   a value constraint only when each target is a single, required, text-typed property (not
   composite, optional, collection or nontext), and rejects a command that produces more than one
   event affected by the same value constraint (claims or releases) in one batch. The number of

package/package/corpus/skills/cratis-screenplay-scenario-coverage/references/view-and-story-specs.md

@@ -59,8 +59,9 @@ candidate for a family. Walk one row through three states (`OpenInvoices`: empty
 `InvoiceIssued`, empty again after `PaymentReceived`) as three independent specs, each with its
 own full givens. The excerpt is copied from `invoicing-dues-example.md`; the last spec asserts
 both that the stored row is gone and that the keyed query returns nothing. The whole-list query
-(no key) is a design-mode expectation here: a list-query collection check does not run on the
-reference route, so record it in the matrix rather than asserting it.
+(no key) is executable too (Screenplay 4.105.0 or later): `invoicing-dues-example.md` adds
+`ListOpenInvoices => OpenInvoice[]` with one spec that expects one `result` row and one that
+expects the empty list after `PaymentReceived`. Only `filter`, `scoped to` and `performer` queries stay design-mode.
 The source document also asserts the other terminal outcomes (`InvoiceVoided`, `InvoiceSettled`) the same way; they are not copied here.
 ```screenplay excerpt parent=references/invoicing-dues-example.md#1
 specification OpenInvoicesLifecycle1Empty
@@ -119,8 +120,9 @@ Keep three claims apart:
 - a query returns no rows: `then query` without `result`, or `when query` + `then no result`;
 - a list-valued property is empty: assert that property as `[]`.
 List-query results use repeated `result` blocks; count and order are exact. A keyed lookup does
-not prove an entire list is empty. Keep the list contract in design mode and record the
-execution/rendering limit.
+not prove an entire list is empty: assert the unkeyed list query itself (an unkeyed query takes no
+`arguments`; each `result` row states the read-model identifier, else PLAY0351). A snapshot list does not render
+(`STAGE-ESM-010`, Stage 4.73.1); an `observable` list does. Record that rendering limit.
 
 ## Ordering, lag and rebuild
 - **Out of order across sources**: if a joined or cross-context fact can arrive first, add a

package/package/corpus/skills/cratis-screenplay-slice-design/LICENSE

@@ -31,5 +31,5 @@ SOFTWARE.
 
 This skill also adapts material from agentic-engineer by Martin Dilger and Nebulit GmbH
 (https://github.com/Nebulit-GmbH/agentic-engineer, commit 07b0f30648d663cb588d7e2c7aa031af9dfc21f2;
-https://nebulit.de), used with the agreement of Martin Dilger and Nebulit GmbH. That repository
-carries no licence file; the adapted material remains credited to Martin Dilger and Nebulit GmbH.
+https://nebulit.de), used with the explicit consent of Martin Dilger and Nebulit GmbH. The adapted
+material remains credited to Martin Dilger and Nebulit GmbH.

package/package/corpus/skills/cratis-screenplay-slice-design/SKILL.md

@@ -81,9 +81,9 @@ report and slice `documentation`, and continue.
    over stored state is written as `reads <View>` + `require ... message "..."` and marked
    **NOT enforced in the model today** in the slice `description`, with its target named (Arc
    `[ProtectedDecision]` + `DecisionRead<T>` on Arc 22.39.0+ (available to gap-fill
-   code with Stage 4.51.3's Arc 22.50.5/Chronicle 19.32.0); Chronicle DCB; or a constraint). Never copy state
-   into the command as input or hide a rule in `handler` / hint prose; descriptions are not
-   rendered (Stage#178). Fill the **refusal inventory**: success, each distinct refusal with
+   code with Stage 4.73.1's Arc 22.68.0/Chronicle 19.45.0); Chronicle DCB; or a constraint). Never copy state
+   into the command as input or hide a rule in `handler` / hint prose; descriptions reach code
+   only as XML comments (Stage#178). Fill the **refusal inventory**: success, each distinct refusal with
    layer and message, and the denied persona.
 4. **Name and shape the event.** Past tense, the specific change that became true
    (`LockerRelocated`, `VolumeCorrected`); never `XUpdated`/`Changed`/`Edited`/`Saved`/
@@ -265,6 +265,7 @@ Examples compile with `screenplay` 4.68.0 `--warnaserror` and `cratis screenplay
 - `references/command-inventory.md` - command card, interview questions, refusal inventory.
 - `references/review-questions.md` - design review questions.
 - `references/rule-layers.md` - rule placement, executable authorization, PII.
+- `references/derived-condition-events.md` - read when a computed condition might deserve its own event: the test, who produces it, which causes to fold.
 - `references/field-lineage.md` - origins per element, matrix, reason lines, chain edits.
 - `references/read-model-design.md` - components, fan-in, list vs keyed, singletons, scope.
 - `references/slicing.md` - slice naming, dependencies, state table, generic edits, coverage,

package/package/corpus/skills/cratis-screenplay-slice-design/references/command-inventory.md

@@ -76,7 +76,7 @@ Rules for filling it:
   as a gap. Persona description text is intent only.
 - A refusal that depends on stored state is a row marked **NOT enforced in the model today**
   with its target (Arc `[ProtectedDecision]` + `DecisionRead<T>` where Arc 22.39.0 or later is
-  available, including Stage 4.51.3's rendered package set for gap-fill, not emitted
+  available, including Stage 4.73.1's rendered package set for gap-fill, not emitted
   protection; Chronicle DCB, or a
   constraint). It still gets a spec row, because the intended behaviour is the contract.
 - A decided refusal never goes to open questions: it goes here, then to scenarios.
@@ -102,7 +102,7 @@ Rules for filling it:
 | AssignLocker | caller is not an attendant | `authorize IsAttendant` | denied: Customer | RefusingACustomerAssigningALocker |
 | AssignLocker | locker already has a request | constraint `OneRequestPerLocker` | "The locker is already assigned" | AppendingASecondAssignmentOfALocker (`when append`: the command's own `require` would reject first) |
 | AssignLocker | request already has a locker | constraint `OneLockerPerRequest` | "The request already has a locker" | gap |
-| AssignLocker | locker is not free | `reads` + `require`, NOT enforced today | "The locker is not free"; target: `[ProtectedDecision]` (Arc 22.39.0+; available to Stage 4.51.3 gap-fill, not emitted protection) or DCB on the locker stream | RejectingASecondAssignmentOfALocker (pins the message; blocked until the target exists) |
+| AssignLocker | locker is not free | `reads` + `require`, NOT enforced today | "The locker is not free"; target: `[ProtectedDecision]` (Arc 22.39.0+; available to Stage 4.73.1 gap-fill, not emitted protection) or DCB on the locker stream | RejectingASecondAssignmentOfALocker (pins the message; blocked until the target exists) |
 | AssignLocker | request is not waiting | `reads` + `require`, NOT enforced today | "The request is not waiting for a locker" | gap (same) |
 | LockerById, ListLockers | caller is anonymous | module `authorize IsAuthenticated` | denied: no caller | RefusingAnAnonymousLockerLookup, RefusingAnAnonymousLockerList |
 | RequestById | caller is anonymous | module `authorize IsAuthenticated` | denied: no caller | RefusingAnAnonymousRequestLookup |

package/package/corpus/skills/cratis-screenplay-slice-design/references/derived-condition-events.md

@@ -0,0 +1,68 @@
+# Derived-condition events
+
+Read this when a view computes a condition that something else in the process might act on
+("is this berth free right now", "has this application reached its next stage"), or when a read
+model draws on many events and you ask whether one named fact is hiding behind them. It is a
+business-modeling question, separate from the fan-in signal in `read-model-design.md`. Adapted
+from Martin Dilger and Nebulit GmbH's orchestrating skill (see `provenance.md`), translated to
+`reaction` and `produces`.
+
+## The question
+
+**Is this fact worth a new event?**
+
+A derived condition earns its own event when both hold:
+1. A domain expert would recognize and name it in its own right ("the berth was released"), not
+   just as a field someone computes.
+2. A later step needs it: another automation would react to it, another module would subscribe,
+   or a downstream process must start from it.
+
+If both hold, record it as its own event and let the projection and the downstream steps consume
+that event, instead of recomputing the condition from several raw events everywhere.
+
+If the condition is only displayed and nothing would ever act on it, it stays a read-model field
+derived from the raw events, however wide the resulting fan-in looks. No new event is needed.
+
+## It is not a fan-in fix
+A read model that ends up fed by many events is at most a prompt to ask the question; it is never
+the reason to answer it either way. The question is worth asking whatever the event count. Wide
+fan-in on one field is handled by the checks in `read-model-design.md` ("Fan-in per field").
+
+## Who produces the event
+The derived fact is established by something that notices the condition, so it is produced by an
+Automation slice: a `reaction` that listens for the raw events that can cause the outcome and
+`produces` the new event (or `invokes` a command that does). Decide the shape by the usual
+automation test (`cratis-screenplay-automations-and-translations`):
+- An immediate, internal, always-possible reaction needs no pending-work view when its reason is
+  recorded.
+- Work that can wait, retry, fail or need people gets a pending-work view and a terminal fact, as
+  for any automation.
+- A reaction that both `reads` and `produces` directly fails binding (`PLAY0268`, decision 0006).
+  When deriving the condition needs stored state, the reaction `invokes` a command that holds the
+  `reads` and the decision, and that command produces the event. A reaction that `produces`
+  directly may decide only from the triggering event's own fields.
+
+## Fold only redundant causes
+The causes of a derived condition usually fall into two groups:
+- **Redundant for the outcome.** Several events that mean the same thing to the business
+  (`BerthReservationReleased`, `BoatDeparted`, `BerthReturnedFromRepair` all mean "the berth is
+  free again"). These are safe to consolidate: one `BerthMarkedFree` collapses N reasons into one
+  reusable signal without losing information.
+- **Distinct meanings the business still tells apart.** `BerthReserved`, `BoatArrived`,
+  `BerthSentForRepair`, `BerthWithdrawn` each say why the berth is not free. Do not collapse them
+  into a generic `BerthMarkedUnavailable`: that erases the why, and a downstream consumer may need
+  it. Leave them as separate events; the fan-in that remains is not a defect, it means the events
+  are individually meaningful.
+
+Collapsing the second group is the modeling mistake, not the wide fan-in. Never rename or merge
+persisted events to tidy a view (`cratis-screenplay-streams-and-consistency` `references/evolution.md`).
+
+## Do not record clock-relative state
+"Overdue", "expired" and "due in 3 days" change with the clock, not with a fact. Store the
+deadline and compare at the query or screen edge. Record an event only when passing the deadline
+is itself a business fact (a fee charged, a reminder sent), produced by a clock-triggered
+reaction. See `read-model-design.md`, "No clock-relative state".
+
+## Record the decision
+Where the reason matters later, put it in the owning slice's `documentation`: which derived
+condition, why it is (or is not) a fact worth an event, and which causes were folded and why.

package/package/corpus/skills/cratis-screenplay-slice-design/references/field-lineage.md

@@ -21,7 +21,7 @@ event field goes nowhere, ask why it is recorded (audit and history are valid an
 | the user types or picks it | screen `action`, form or dialog input | default for business decisions |
 | shown before the user acts | form `populate via query` from a read model | the read model must exist and be traced |
 | the instance being acted on | the `identifier` property, carried from the screen row or route | |
-| allocated by the runtime | `Type generated` on a required `Uuid`-backed concept (ESM v7: binds and runs on standalone Screenplay 4.68.0, `PLAY0268` on the 4.66.0 bundled in cratis 3.28.x, not rendered by Stage 4.24.2; no concept rules) | never a request input or form field; no policy, rule or requirement may read it (`PLAY0273`); return it with `returns`; where a tool cannot bind it, executable scope needs explicit allocation |
+| allocated by the runtime | `Type generated` on a required `Uuid`-backed concept (ESM v7: binds and runs on standalone Screenplay 4.68.0 and later, including the 4.137.0 bundled in CLI 3.53.1 (`PLAY0268` on the 4.66.0 bundled in cratis 3.28.x); Stage 4.73.1 refuses it with STAGE-ESM-028; no concept rules) | never a request input or form field; no policy, rule or requirement may read it (`PLAY0273`); return it with `returns`; where a tool cannot bind it, executable scope needs explicit allocation |
 | an outside party | capture field `$.x` or a reaction trigger value | `cratis-screenplay-automations-and-translations` |
 | the caller | not an input: `$context.identity.*` in `produces`; who may act in `authorize`; "acting on own X" is a claim policy matched to the identifier or a command property | never trust a caller-supplied "who am I" |
 

package/package/corpus/skills/cratis-screenplay-slice-design/references/provenance.md

@@ -1,8 +1,7 @@
 # Provenance
 
 Sources are pinned. TrogonStack/agentskills is MIT, Copyright (c) 2025 Straw Hat, LLC (full
-notice in this skill's `LICENSE`). agentic-engineer by Martin Dilger and Nebulit GmbH carries no licence file; its material is adapted with
-the agreement of Martin Dilger and Nebulit GmbH (see *Adapted closely* below).
+notice in this skill's `LICENSE`). agentic-engineer by Martin Dilger and Nebulit GmbH is used with their explicit consent (see *Adapted closely* below).
 Event Modeling practice (Adam Dymitruk, Martin Dilger) is cited as practice; no text taken.
 
 | Item | Source | Licence | Treatment | Where in this skill |
@@ -15,11 +14,10 @@ Event Modeling practice (Adam Dymitruk, Martin Dilger) is cited as practice; no
 | Slice dependency record (events consumed, producing slice) | TrogonStack/agentskills@7b249d3:.../eventmodeling-slicing-event-models/SKILL.md | MIT | ADAPT as a table | references/slicing.md |
 | Generic-edit ban, rule coverage, state-transition table, rule layers, refusal inventory, worked example | Cratis/AI corpus (original) | MIT | original | references/*.md |
 
-## Adapted closely (Martin Dilger and Nebulit GmbH, with agreement)
+## Adapted closely (Martin Dilger and Nebulit GmbH)
 
 Source: https://github.com/Nebulit-GmbH/agentic-engineer at commit `07b0f30648d663cb588d7e2c7aa031af9dfc21f2`,
-by Martin Dilger and Nebulit GmbH (https://nebulit.de). The repository carries no licence file; this material
-is adapted with the agreement of Martin Dilger and Nebulit GmbH.
+by Martin Dilger and Nebulit GmbH (https://nebulit.de), used with the explicit consent of Martin Dilger and Nebulit GmbH.
 
 | Source file | Used in | How |
 |---|---|---|
@@ -39,3 +37,5 @@ is adapted with the agreement of Martin Dilger and Nebulit GmbH.
 | `eventmodeling-designing-event-models/SKILL.md`: events as past-tense business facts, causality, state transitions | `SKILL.md` step 4; `references/slicing.md` state-transition table | idea; our own wording kept (our table is stricter) |
 | `storyboard-screen/SKILL.md`, `html-screen/SKILL.md`, `place-element/SKILL.md` | none | not adopted: board and HTML rendering mechanics; screen field mapping `derived:` already in `references/field-lineage.md` |
 | `.build-kit/.slices/restaurant/*/slice.json` | none in this skill | patterns only; passed to scenario coverage (spec example values that vary one rule) |
+| `.claude/skills/eventmodeling-identifying-outputs/SKILL.md`, "Common Patterns": status, list, timeline and processor-decision view patterns | `references/read-model-design.md` "Common view patterns" | Adapted closely as a table over `readmodel`, projection and `query`; the pseudo-code blocks became prose |
+| `.claude/skills/eventmodeling-orchestrating-event-modeling/SKILL.md`, "Recognizing a dedicated business event behind a derived condition": the "is this fact worth a new event" test, producing it by automation, fold only redundant causes, display-only conditions stay projections | `references/derived-condition-events.md` | Adapted closely; the todo-list translation pattern became a `reaction` that `produces` (a pending-work view only when the work can wait, retry or fail); the >3-events heuristic stays in `read-model-design.md`; board placement, 0,0-node scans and `validate_model` batch calls not adopted |

package/package/corpus/skills/cratis-screenplay-slice-design/references/read-model-design.md

@@ -5,6 +5,7 @@
 - Start from the consumer
 - The typical slice pattern
 - Events or views
+- Common view patterns
 - Components
 - Fan-in per field
 - Builder and freshness
@@ -71,6 +72,22 @@ and a recovery contract, or a pending-work view; only an immediate, internal, al
 effect may leave no trace
 (`cratis-screenplay-automations-and-translations`).
 
+## Common view patterns
+
+Four shapes recur. Name the one a view is before choosing its fields, so the consumer and the
+events line up.
+
+| Pattern | Events feeding it | The view holds | Used for |
+|---|---|---|---|
+| Status view | The lifecycle events of one instance (booked, confirmed, arrived, cancelled) | The accumulated current state of that instance | A screen that shows where one thing stands and which actions are available |
+| List view | Create, change and end events of many instances | One summary row per instance, with the fields people filter, sort or search by | Worklists, search, filtering; end events either `remove with` the row or set a status literal (see "Omissions are decisions") |
+| Timeline or history view | Any events that carry a time | A chronological list, one entry per event, kept apart from the status view | History and audit trail; keep a growing history in its own view, never inside the status view |
+| Processor decision view | The state-changing events a reaction cares about | Current state only, nothing a person would read | A `reaction` or `trigger` that reads it to decide the next action; a reaction that also `produces` directly cannot `reads` it (`PLAY0268`), so it `invokes` a command that holds the `reads` (a pending-work view is this pattern for work that can wait, retry or fail) |
+
+The patterns describe what the view is for, not new syntax: each is a `readmodel`, a projection
+and, where a person or caller reads it, a `query`. A view that fits two patterns at once is
+usually two views.
+
 ## Components
 
 - A component is an area of a screen a person would describe as one thing ("the locker list",

package/package/corpus/skills/cratis-screenplay-slice-design/references/rule-layers.md

@@ -1,7 +1,7 @@
 # Rule layers
 
-Put each rule in the lowest layer where it is true for every caller. Descriptions never reach
-rendered code (Stage#178): a rule that exists only in prose is unenforced in rendered scope.
+Put each rule in the lowest layer where it is true for every caller. Descriptions reach rendered
+code only as XML doc comments (Stage#178): a rule that exists only in prose is unenforced in rendered scope.
 
 | Rule is about | Layer | Notes |
 |---|---|---|
@@ -9,13 +9,13 @@ rendered code (Stage#178): a rule that exists only in prose is unenforced in ren
 | a predicate that is not a comparison (checksum, registry format) | `rule <Name>` on the property or concept | design mode; blocks V3 (PLAY0268) |
 | this command's own inputs | command `validate` / `require` | a rule that applies only sometimes is an implication: `require a == false or b > c` |
 | who may ask | `authorize` with a policy (role, claim, authenticated) | enclosing gates combine with AND and run first. Gates every command and query in a feature shares go on the feature or module so a new path inherits them |
-| whose instance | policy `claim "x" matches subject` (the command identifier) or `matches <command property>` | executable; renders only for text-backed subjects (Uuid: STAGE-ESM-015) |
+| whose instance | policy `claim "x" matches subject` (the command identifier) or `matches <command property>` | executable; renders for text, Uuid, Date and DateTime subjects; an authorized command needs exactly one identifier (STAGE-ESM-015 otherwise) |
 | uniqueness, once-only facts | `constraint` (`unique ... on`, `unique event`) | append-time; the constraint name is its identity |
-| stored state (record exists, balance, current status) | `reads <View>` + `require <expr> message "..."` | stated intent, **NOT enforced in the model today** (PLAY0268/0271 at binding are expected in design mode; Screenplay#129/#209). Name the target: Arc `[ProtectedDecision]` + `DecisionRead<T>` (Arc 22.39.0 or later), Chronicle DCB (`concurrency` scope), or a constraint |
+| stored state (record exists, balance, current status) | `reads <View>` + `require <expr> message "..."` | stated intent, **NOT enforced in the model today** (PLAY0268/0271 at binding are expected in design mode; Screenplay#129). Name the target: Arc `[ProtectedDecision]` + `DecisionRead<T>` (Arc 22.39.0 or later), Chronicle DCB (`concurrency` scope), or a constraint |
 
 An unguarded materialized read is unsafe for a protected decision; a guarded read is the
 supported route. Availability: `[ProtectedDecision]` and `DecisionRead<T>` exist in
-Stage 4.51.3's Arc 22.50.5/Chronicle 19.32.0 package set, but Stage does not emit
+Stage 4.73.1's Arc 22.68.0/Chronicle 19.45.0 package set, but Stage does not emit
 protected decisions. Gap-fill must use an admitted projection/key shape and active
 unit-of-work enrollment; do not edit managed dependencies. Keep the `.play` rule
 NOT enforced until its target enforcement is separately verified. Forbidden: caller-supplied copies of state in `require`, boolean attestation
@@ -33,7 +33,7 @@ second caller with another claim value.
 
 Command property values are, by default, recorded in the causation chain of the events they
 produce, so treat them as permanent. Newer Chronicle versions can omit causation properties
-(`CausationPropertyRetention.Omit`, Chronicle v19.32.0); Stage 4.51.3 rendered apps pin 19.32.0.
+(`CausationPropertyRetention.Omit`, Chronicle v19.32.0); Stage 4.73.1 rendered apps pin 19.45.0 (the latest Chronicle is 19.50.0).
 Verify the actual auditing and retention configuration before relying on omission, and never
 audit secrets. Classify personal values as bare `pii` and operational secrets as
 `secret` on their concepts, never the identifier concept. Use a surrogate identity

package/package/corpus/skills/cratis-screenplay-slice-design/references/worked-example.md

@@ -19,8 +19,8 @@ and record lineage reasoning in fenced Markdown `documentation` (`field-lineage.
 The historical source below stays unchanged; it is not the current placement recipe.
 
 The excerpt's Stage availability note is historical (Stage 4.24.x, Arc 22.25.0).
-Stage 4.51.3 pins Arc 22.50.5/Chronicle 19.32.0, so protected-read APIs are available
-to gap-fill; this neither admits these `.play` rules nor proves target protection.
+Stage 4.73.1 pins Arc 22.68.0/Chronicle 19.45.0, so protected-read APIs are available
+to gap-fill (the compiled description below saying they are "not available in Stage-rendered apps" is superseded); this neither admits these `.play` rules nor proves target protection.
 The original compiled excerpt is retained unchanged.
 
 ```screenplay expect PLAY0516 test=unbound
@@ -168,7 +168,7 @@ module Lockers
         then denied
 
     slice StateChange AssignLocker
-      description "The attendant gives one waiting request one free locker. Constraints enforce one holder per locker and one locker per request at append time. The state rules (the locker is installed and free, the request exists and is still waiting) are written as reads plus require: stated intent, NOT enforced in the model today (PLAY0268/0271 at binding are expected in design mode; Screenplay#129 and #209). Target enforcement: Arc [ProtectedDecision] with DecisionRead<T> (Arc 22.39.0 or later; not available in Stage-rendered apps, where this stays a capability gap), or a Chronicle DCB concurrency scope on the locker stream; the constraints stay as the backstop."
+      description "The attendant gives one waiting request one free locker. Constraints enforce one holder per locker and one locker per request at append time. The state rules (the locker is installed and free, the request exists and is still waiting) are written as reads plus require: stated intent, NOT enforced in the model today (PLAY0268/0271 at binding are expected in design mode; Screenplay#129). Target enforcement: Arc [ProtectedDecision] with DecisionRead<T> (Arc 22.39.0 or later; not available in Stage-rendered apps, where this stays a capability gap), or a Chronicle DCB concurrency scope on the locker stream; the constraints stay as the backstop."
       command AssignLocker
         lockerId  LockerId identifier
         requestId RequestId

package/package/corpus/skills/cratis-screenplay-specifications/SKILL.md

@@ -124,7 +124,8 @@ for synthesis refusals, selection, provenance and a complete passing model.
 | `then events in any order` | compare the new events without regard to order |
 | `then readmodel <ReadModelType> [exactly]` | read-model state afterwards — must state the identifier |
 | `then no readmodel <ReadModelType> for <key>` | exactly that keyed instance is absent (v4.66.0); the key is concrete and typed |
-| `then query <Query> [exactly]` | query results for explicit `arguments`; one `result` per row; none means empty |
+| `then query <Query> [exactly]` | query results for explicit `arguments` (none for an unkeyed list); one `result` per row, each stating the identifier; none means empty |
+| `file <path>` | optional, once: the repository-relative file realizing the specification |
 | `then error "<message>"` | a validation or constraint rejection, for that reason; a localized rule is pinned by its quoted key, `then error "$strings.<key>"` |
 | `then error` | a validation or constraint rejection, reason unnamed |
 | `then denied` | an authorization denial (`Unauthorized`) |
@@ -158,7 +159,7 @@ Rules the binder enforces:
 - **`null` only in optional read-model values.** A `null` in a command or event
   value is `PLAY0350`: an optional fact is a separate event.
 
-`PLAY0358` is a syntax error. `PLAY0350`, `PLAY0352`, `PLAY0388`, `PLAY0389` and
+`PLAY0358` is a syntax error (`PLAY0388` also at parse time for extra text after `then denied`). `PLAY0350`, `PLAY0352`, `PLAY0388` (mixed with another outcome), `PLAY0389` and
 the one-rejection rule (`PLAY0273`) are reported only when the model binds, so
 `screenplay --warnaserror` does not show them. Check executable diagnostics
 (the MCP authoring tools) as well.
@@ -221,8 +222,9 @@ stream ids are not guessed. Read [examples and routes](references/examples-and-r
 
 `given operation ... fails`, `then operation` and `then compensated` describe
 future external-work behavior. Reaction refusal branches, `when redelivered`
-and `then no events` are also authoring-only: compile them, but report their
-PLAY0268 binding refusal instead of an executed result. Preserve the contract.
+and `then no events` (PLAY0268, #433) are also authoring-only: compile them, but report their
+PLAY0268 binding refusal instead of an executed result. Preserve the contract; a read-model or
+query assertion states a zero-fact outcome.
 
 ## Rejections and denials say different things
 

package/package/corpus/skills/cratis-screenplay-specifications/references/examples-and-routes.md

@@ -88,7 +88,8 @@ cannot be changed back to a wildcard. Literal compatibility/route contradiction
 checks use resolved source/stream types, not guessed text (PLAY0547–PLAY0551).
 At Screenplay 4.127.0, route literals must be nonempty, well-formed NFC text
 (refused, not normalized); Double integer ids are within ±(2^53−1), while Exact
-has no such bound but remains unadmitted. Invalid specification routes report
+has no such bound but the `numbers exact` source mode remains unadmitted (PLAY0268; exact lowering of
+qualifying Double literals is the separate, admitted v11). Invalid specification routes report
 PLAY0549. Contradictions compare canonical scalar ids and every composite part,
 so UUID casing is immaterial. Composite mappings supply each named part once,
 using literals only; encoding escapes `%`/`|` and preserves declaration order.

package/package/corpus/skills/cratis-screenplay-specifications/references/generated-fixtures.md

@@ -1,7 +1,8 @@
 ## Generated fixtures and return expectations (ESM v7)
 
-Standalone `screenplay` 4.68.0 or later binds and runs these; the cratis CLI 3.28.3 (bundled 4.66.0) does not
-bind them, and Stage does not render ESM v7 yet (`STAGE-ESM-016`, tracked in Stage#201), so they pin the
+Standalone `screenplay` 4.68.0 or later binds and runs these, and so does the current cratis bundle (the
+cratis 3.28.3 bundle, 4.66.0, did not); Stage 4.73.1 admits ESM v7 but refuses generated values
+(`STAGE-ESM-028`) and responses (`STAGE-ESM-029`; Stage#175), so they pin the
 contract of a hand-written command. The model and rules are in `cratis-screenplay-command-surface`; the
 complete example is `cratis-screenplay-toolchain` `references/generated-responses-example.md`. Read that file when writing generated-value fixtures or scalar and record return expectations and needing a complete reference-executable model.
 

package/package/corpus/skills/cratis-screenplay-specifications/references/persona-callers-and-cases.md

@@ -37,6 +37,9 @@ denial still uses `then denied`; a visitor persona is not an anonymous caller.
 
 ## Case tables
 
+Two diagnostics to know: `PLAY0588` (warning) for a declared parameter no step references, and `PLAY0585`
+(error) when an optional parameter feeds a required target.
+
 Use tables for validation matrices whose steps stay the same. Rows are **cases**,
 not examples: `example` means a named typed fixture. This complete model's five
 expanded specifications pass in the 4.127.0 reference runner: