@cratis/pi 7.35.0 → 7.36.1

package/package/corpus/product-sync.json

@@ -166,9 +166,9 @@
         }
       ],
       "synced": {
-        "version": "4.141.0",
+        "version": "4.142.0",
         "date": "2026-10-12",
-        "by": "Cratis/AI#620"
+        "by": "Cratis/AI#597"
       },
       "covers": {
         "skills": [

package/package/corpus/skills/cratis-screenplay-command-surface/SKILL.md

@@ -32,7 +32,7 @@ Pins: toolchain `references/versions.md`; sources below. Compilation is not exec
 - `4.66.0` (`c89198b`): `handler`, code attachments, `persona` and compliance binding (`Semantics/SemanticModelBinder*.cs`, `Diagnostics/DiagnosticCodes.cs`).
 - `4.68.0` (`79801bf`): generated-value/response rule probes (ESM v7).
 - `4.127.0`: identity and compliance syntax (`identity.md`, `context.md`, `concepts.md`, `purposes.md`, `events.md`, `diagnostics.md`).
-- `4.141.0`: v13 compliance admission/refusals: `references/compliance.md`.
+- `4.141.0`: v13 compliance admission; rechecked at `4.142.0`: `references/compliance.md`.
 
 "Parses" and "runs" are different claims. The executable profile, and what
 each construct binds to, is in the `cratis-screenplay-model-authoring` language
@@ -57,13 +57,10 @@ concept InvoiceStatus : Enum
 The seven primitives are `Uuid`, `String`, `Int`, `Decimal`, `Bool`, `Date` and
 `DateTime`. `Enum` is **not** one of them — it is a separate concept kind, which
 is why the compiler says *expected … or Enum* rather than listing it among them.
-Use bare `pii` for personal data (`personal` is the same marker) and `secret`
-for operational secrets. **Compliance is inherited** from concepts, including
-nested uses. Standalone 4.141.0 admits v13 compliance; the CLI does not. Residual
-PLAY0268 refusals are in the reference below; keep protection. `pii personal` is redundant and warns PLAY0653. Legacy `@pii`,
-`sensitive` and `@sensitive` remain accepted with PLAY0565 information and a repair.
-Read [compliance and purposes](references/compliance.md) for reasons, special/criminal
-qualifiers, secret scopes, provider mappings, purpose declarations and coverage checks.
+Use bare `pii` (`personal` alias) and `secret` on concepts; **Compliance is inherited**.
+Keep protection even when a compiler or renderer refuses it. Read
+[compliance and purposes](references/compliance.md) for ESM v13, binder-only refusals,
+consumer ceilings, marker repairs, reasons, scopes and provider limits.
 
 **Identifiers cannot be personal data or secrets.** PLAY0515 is a source error
 for command identifiers, typed `for` destinations, event-source identities,

package/package/corpus/skills/cratis-screenplay-command-surface/references/compliance.md

@@ -10,7 +10,7 @@
 - Declare the use separately
 - Identify the person, not the stream
 
-Authority: Screenplay v4.141.0 `concepts.md`, `events.md`,
+Authority: Screenplay v4.142.0 `concepts.md`, `events.md`,
 `Semantics/SemanticModelBinder.Compliance.cs` and `SemanticModelValidator.Compliance.cs`;
 processing-purpose guidance retains v4.127.0 evidence; decisions 0041 and 0068. These declarations do not establish lawful
 processing or enforce retention. Check provider support separately.
@@ -61,19 +61,21 @@ new event generation.
 
 C# provider mapping: `pii` → `[PII]`; `secret` → `[Encrypted]` + `[NotAudited]`;
 `pii secret` → `[PII]` only (Chronicle refuses `[PII]` with `[Encrypted]`, CHR0053).
-Standalone Screenplay 4.141.0 admits these markers, qualifiers and scopes as
-ESM v13. Optional concept `compliance` applies through command, event, read-model,
+Standalone Screenplay 4.142.0 binds optional concept `compliance` as ESM v13
+(first released in 4.141.0), carrying markers, qualifiers and scopes. It applies
+through command, event, read-model,
 composite and response type references, including collection elements. Bare `pii`
 writes `{"personal":{}}`; `secret scope namespace` writes
 `{"secret":{"scope":"namespace"}}`. With both markers, personal protection
-wins and no secret scope is stored. Reasons stay report-only (PLAY0270).
+wins and no secret scope is stored; reasons stay report-only PLAY0270.
 Unmarked models keep their exact executable bytes and revision. The reference
 evaluator runs marked models with unchanged outcomes but tests neither encryption
 nor erasure. Consumers must explicitly admit v13 and realize the protection;
-CLI 3.53.1's 4.137.0 compiler still refuses markers, and Stage 4.76.0 admits only
-through v12. Never remove protection to fit either tool.
+CLI 3.53.1 bundles Screenplay 4.137.0, which refuses markers; standalone Stage
+4.76.0 admits only through v12 (Stage#345 tracks v13 admission). Never remove protection to fit either tool.
 
-PLAY0268 still refuses compliance on enum or event-source/stream identity concepts.
+Enum and identity concepts still refuse PLAY0268 at binding only (identity means
+event-source/stream identity); source validation alone cannot report this binder diagnostic.
 It also refuses an event combining personal values or explicitly
 `secret scope subject` values with an explicit event-property `subject` mark,
 including nested composite and collection uses: subject lineage is not admitted.
@@ -99,7 +101,7 @@ none of SP0061 to SP0063, so the CLI shows none of them; check the generator pac
   Set `ScreenplayOptions.AuthoringOnlyConstructs = true` (CLI adapter flag
   `--authoring-only-constructs`) to state `secret scope namespace` or
   `secret scope global` in the concept body. Subject stays implicit. Scope
-  was syntax-only on this generator's compiler. With standalone 4.141.0,
+  was syntax-only on this generator's compiler. With standalone 4.142.0,
   protected concepts instead select ESM v13; this does not upgrade the generator
   or the CLI bundle.
   `pii secret` gets no scope because the providers ignore it.

package/package/corpus/skills/cratis-screenplay-command-surface/verification.json

@@ -4,7 +4,13 @@
   "fixtures": [],
   "assertions": [
     { "kind": "play-compiles" },
-    { "kind": "skill-contains", "value": "PLAY0653" },
+    { "kind": "skill-contains", "value": "optional concept `compliance` as ESM v13", "file": "references/compliance.md" },
+    { "kind": "skill-contains", "value": "PLAY0268 at binding only", "file": "references/compliance.md" },
+    { "kind": "skill-contains", "value": "reasons stay report-only PLAY0270", "file": "references/compliance.md" },
+    { "kind": "skill-contains", "value": "Stage#345", "file": "references/compliance.md" },
+    { "kind": "skill-contains", "value": "CLI 3.53.1 bundles Screenplay 4.137.0", "file": "references/compliance.md" },
+    { "kind": "skill-contains", "value": "Enum and identity", "file": "references/compliance.md" },
+    { "kind": "skill-contains", "value": "PLAY0653", "file": "references/compliance.md" },
     { "kind": "skill-contains", "value": "personal` is an alias of `pii", "file": "references/compliance.md" },
     { "kind": "skill-contains", "value": "report-only (PLAY0270)", "file": "references/compliance.md" },
     { "kind": "skill-contains", "value": "--check purposes", "file": "references/compliance.md" },

package/package/corpus/skills/cratis-screenplay-event-modeling/SKILL.md

@@ -135,7 +135,7 @@ What binds depends on **which tool** you ask, so name the tool and its version:
   protected against stale state. A reaction trigger's `reads` that only `invokes` is
   report-only intent (`PLAY0270`); one that `produces` directly fails binding (`PLAY0268`).
 - `persona` declarations are report-only and never block; bare `pii` and `secret`
-  concepts bind as ESM v13 on standalone 4.141.0, but still block the pinned CLI.
+  concepts bind as ESM v13 on standalone 4.142.0 (since 4.141.0), but still block the pinned CLI.
   Enum/identity compliance and protected events with explicit subject marks remain
   refused (PLAY0268); see command-surface `references/compliance.md`. Keep protection.
 - Generated values/responses bind and reference-execute as v7; sources, streams

package/package/corpus/skills/cratis-screenplay-event-modeling/references/parsed-not-runnable.md

@@ -4,6 +4,8 @@ Checked at Screenplay v4.139.0: `SemanticModelBinder.cs`, `Versions.cs`,
 `Documentation/screenplay/{commands,operations,event-sources,reactions,tool,interoperability}.md`.
 The binder selects v8 for event routes, v10 for declared reaction identity, v11 for retained
 exact-lowered Double-mode literals and v12 for non-positional enum numbers.
+Compliance checked against 4.142.0 `SemanticModelBinder.Compliance.cs` and
+`SemanticModelValidator.Compliance.cs`; it selects v13 (first released in 4.141.0).
 Pins and consumer boundaries: toolchain `references/versions.md`.
 
 ## Which ESM version a model needs
@@ -17,6 +19,8 @@ Pins and consumer boundaries: toolchain `references/versions.md`.
 - v9 for public-event contracts; v10 for reaction `runs as system` identity.
 - v11 for exact lowering of qualifying Double-mode number literals; v12 for non-positional
   enum member numbers (`cratis-screenplay-command-surface` `references/enum-numbers.md`).
+- v13 for concept `pii`/`personal` and `secret`, personal qualifiers and secret scopes.
+  Reasons remain report-only PLAY0270; binding proves neither encryption nor erasure.
 - Operations/systems, the exact numeric **source mode** (`numbers exact`) and refusal/redelivery
   remain unadmitted (PLAY0268). Version allocation is not inferred from an older planning decision.
 
@@ -25,7 +29,7 @@ Pins and consumer boundaries: toolchain `references/versions.md`.
 | Construct | Standalone disposition (v4.125.0/v4.139.0 evidence; compliance updated at v4.141.0) |
 | --- | --- |
 | `persona`, domain/authentication metadata | Report-only; unknown named policies remain source defects |
-| Compliance concepts | Bare `pii`/`secret`, qualifiers and scope bind as v13 at 4.141.0; enum/identity compliance and protected events with explicit subject marks refuse PLAY0268. The pinned CLI still refuses markers; never remove protection |
+| Compliance concepts | Bare `pii`/`personal` and `secret`, qualifiers and scope bind as v13 (4.142.0 checked); enum/identity compliance and events combining personal or explicitly subject-scoped secret values with an explicit `subject` mark refuse PLAY0268 at binding only. CLI 3.53.1's 4.137.0 bundle still refuses markers; Stage 4.76.0 admits only through v12 (Stage#345). Never remove protection |
 | Identity details / processing purposes / event subject | Report-only metadata (4.127.0); executable detail reads refuse PLAY0268, not source declaration errors |
 | Composite stream ids | v8 routing; complete named parts/canonical comparisons, PLAY0515 refuses protected keys/sources; not a legacy text split |
 | Command reads/concurrency | Legacy unprotected decisions, PLAY0271 |

package/package/corpus/skills/cratis-screenplay-legacy-extraction/references/generate-notes.md

@@ -166,7 +166,7 @@ without adding `secret`; an existing `pii` classification remains.
   the same way. Set `ScreenplayOptions.AuthoringOnlyConstructs = true` (CLI
   adapter option `--authoring-only-constructs`) to emit `secret scope namespace`
   or `secret scope global` in the concept body. This was syntax-only on that
-  compiler; standalone 4.141.0 instead admits concept compliance as ESM v13.
+  compiler; standalone 4.142.0 admits concept compliance as ESM v13 (since 4.141.0).
   That upgrade does not change the older generator or CLI bundle.
 - A concept also marked `[PII]` becomes `pii secret`, with no emitted scope:
   the C# providers render only `[PII]`; Chronicle rejects `[PII]` combined with

package/package/corpus/skills/cratis-screenplay-model-authoring/SKILL.md

@@ -21,7 +21,7 @@ same model root or workspace export to all checks. Workflow:
 
 ## Verified product sources
 
-Screenplay v4.141.0: planner in `references/property-links.md`;
+Screenplay v4.142.0: add/rename/remove planner in `references/property-links.md`;
 compliance in command-surface `references/compliance.md`. Other MCP evidence:
 v4.139.0 `Documentation/screenplay/mcp/`.
 Discover installed tools and schemas; CLI bundles can differ from the standalone
@@ -40,14 +40,10 @@ directory when it holds `.play` files). Only when it answers that no root was gi
 or that several roots are offered, pass `path`: the folder holding the project's `.play` files, otherwise the
 folder the user names. Without a project, the server works in `Documents/Screenplay`
 in the user's home folder, so do not invent a location. A root fixed at launch
-can switch only to the corresponding model folder in a registered Git worktree
-of the same repository. Pass the worktree checkout or exact model directory as
-`path`; unrelated roots return `RootChangeRefused`. Switching clears proposals
-and uses the destination's own identity state and journal; nothing migrates.
-Submodules and `--separate-git-dir` checkouts require another connection.
-
-Prefer a fixed root; the historical dynamic-roots bug and connection procedure
-are in [MCP loop](references/mcp-loop.md). Send `initialize` and
+can switch only to the same model folder in a registered Git worktree of the
+same repository; rules and refusals are in [MCP loop](references/mcp-loop.md).
+
+Prefer a fixed root (dynamic-roots history: [MCP loop](references/mcp-loop.md)). Send `initialize` and
 `notifications/initialized` before any tool call, then discover `tools/list`
 schemas rather than relying on a remembered count.
 
@@ -83,7 +79,7 @@ can keep that entry point; use the project's supported installation channel.
    of `.play` files is one application, not independent files.
 2. Use `search-declarations`, `declaration-details`, `find-references` and
    `dependencies` to locate the owning declaration and affected references.
-   Before a property rename/removal, read [property links](references/property-links.md):
+   Before a property change, read [property links](references/property-links.md):
    `kind: "Property"`, `Owner.member` / `Owner.generationN.member`, direct mappings.
    `complete: false` is incomplete evidence, never a successful empty list.
 3. Read diagnostics and coverage limitations. Use `dependency-graph` for container
@@ -135,9 +131,10 @@ and applies; others send an edit request ([MCP loop](references/mcp-loop.md)).
 3. Prefer `propose-rename` for supported logical renames: it coordinates fragments,
    repairs proven references and preserves assigned identities. Never substitute
    global string replacement for an explicit refusal.
-4. Use `propose-source` for whole text or `propose-ast` for typed edits
-   (Authoring defaults); `propose` is executable-only. Batch changes;
-   details: `references/mcp-tools.md`.
+4. Prefer `propose-property` for property add/rename/remove, not hand-composed
+   `propose-ast` batches. Inspect the chain and never guess past a refusal:
+   [property links](references/property-links.md). Otherwise use `propose-source`
+   (whole text) or `propose-ast` (typed edits); `propose` is executable-only.
 5. Keep reference policy `Safe`. Use `Draft` only for deliberately requested
    unresolved model debt and report that debt; it does not waive structural,
    identity or binding-protection checks.
@@ -173,15 +170,9 @@ files, 8 MiB total, 2 MiB per file, 1 MiB structured result, 200 items or 192 Ki
 per page. Excluded directories: `.git`, `.ai-work`, `.screenplay`, `bin`, `obj`,
 `node_modules`.
 
-Formatting is explicit. Prefer `PreserveTrivia` for identifier, literal-value and
-whole-mapping edits; it rewrites only the changed span. Structural edits (add,
-remove, move) need `CanonicalizeTouchedDocuments`, which keeps attached comments
-and the authored member order within a document but normalizes whitespace and
-blank lines. Before applying, check the proposal's `droppedCommentCount`; when it
-is not zero, read `read-proposal` with `view: "dropped-comments"` and disclose
-each lost comment (`PLAY0288` also reports their count and lines). Untouched
-documents retain exact bytes. A printer that loses requested structural fields
-rejects the plan.
+Choose formatting explicitly and disclose dropped comments before applying;
+read [formatting and limits](references/mcp-loop.md#formatting-and-limits) for
+`PreserveTrivia`, canonical consent, comment review and byte preservation.
 
 `identityMigrationIssues`: read the [MCP loop](references/mcp-loop.md).
 
@@ -296,7 +287,7 @@ that the code compiles or behaves. Read `references/mcp-tools.md#code-attachment
   clean run is not a bound or executable result.
 - Operations/`numbers exact` remain unadmitted; routes bind as v8, public
   boundaries v9, identity/overrides/filters v10, qualifying non-route Double
-  literals v11, enum numbers v12, compliance v13 (4.141.0;
+  literals v11, enum numbers v12, compliance v13 (since 4.141.0;
   limits: command-surface `references/compliance.md`).
   CLI 3.53.1/Stage 4.73.1 bundle 4.137.0 and do not admit v12. Never drop or stub source contracts to bind.
 - Distinguish authoring acceptance from `executableReady`; unsupported backend

package/package/corpus/skills/cratis-screenplay-model-authoring/references/mcp-loop.md

@@ -13,6 +13,7 @@
 - Identity state (`.screenplay/identities.json`)
 - Read-only views worth knowing
 - Failures (use `failureKind`, never message text)
+- Formatting and limits
 - Provenance
 
 The working loop for the session that owns the model connection: connect, orient,
@@ -106,7 +107,7 @@ the server sends `roots/list` and serves `tools/list` after the reply).
    `find-specification-obligations` (presence, not execution), use
    `find-modeling-smells` as questions needing a domain consequence, and compare
    generated/curated exported snapshots with `semantic-diff`.
-   Before renaming/removing a property, use `find-references`/`dependencies`
+   Before a property change, use `find-references`/`dependencies`
    `kind: "Property"` (4.138.0+) and `Owner.member` or historical event
    `Owner.generationN.member`. Follow direct mapping counterparts one query at a
    time; inspect incomplete/ambiguous evidence and `reasons`. `complete: false`
@@ -117,7 +118,11 @@ the server sends `roots/list` and serves `tools/list` after the reply).
 4. Choose the edit route (next section). For typed edits: `syntax-schema` for the
    node kind, then `read-ast` with `includeContent` for revision-bound handles.
    Never invent a handle.
-5. Propose one coherent change (a slice works best): `propose-source` for whole
+5. Prefer `propose-property` for supported property add/rename/remove chains,
+   not hand-composed `propose-ast` batches; inspect `incomplete`, `needsDecision`
+   and `chainCandidates` before choosing sources, fixtures or event evolution.
+   Exact arguments and decisions: [property links](property-links.md).
+   Otherwise propose one coherent change (a slice works best): `propose-source` for whole
    `.play` text, `propose-ast` for focused typed edits, with
    `validation: "Authoring"`, `referencePolicy: "Safe"` (`Draft` only for
    deliberate, reported gaps), `formatting: "PreserveTrivia"` for value and mapping
@@ -251,6 +256,18 @@ or create a fallback folder to bypass the conflict.
 
 See "Failures (use `failureKind`, never message text)" in SKILL.md.
 
+## Formatting and limits
+
+Formatting is explicit. Prefer `PreserveTrivia` for identifier, literal-value and
+whole-mapping edits; it rewrites only the changed span. Structural edits (add,
+remove, move) need `CanonicalizeTouchedDocuments`, which keeps attached comments
+and the authored member order within a document but normalizes whitespace and
+blank lines. Before applying, check the proposal's `droppedCommentCount`; when it
+is not zero, read `read-proposal` with `view: "dropped-comments"` and disclose
+each lost comment (`PLAY0288` also reports their count and lines). Untouched
+documents retain exact bytes. A printer that loses requested structural fields
+rejects the plan.
+
 ## Provenance
 
 The structure of this loop (ownership, edit-request shape, failure handling) is

package/package/corpus/skills/cratis-screenplay-model-authoring/references/mcp-tools.md

@@ -59,9 +59,15 @@ the [MCP loop](mcp-loop.md).
 
 `propose` is the executable-only whole-document interface. Prefer `propose-source`
 for whole `.play` text, `propose-ast` for focused typed edits, and `propose-rename`
-for proved logical renames. Standalone 4.140.0 adds `propose-property` for explicit
-property rename/removal selections, AutoMap preservation and event-generation
-choices; read [property evidence and planning](property-links.md) before proposing. A
+for proved logical renames. Prefer `propose-property` over hand-composed AST
+batches for property chains: rename/remove shipped in 4.140.0, add in 4.142.0.
+Add takes `owner`, `expectedOwnerName`, `name`, `type`, `optional`,
+`hops` (`{at, name}` or `{at, value}`) and `fixtureValue`, plus both revision guards.
+Missing sources/required fixture values refuse `SourcesRequired`/`FixtureValueRequired`;
+off-chain hops refuse `HopNotOnChain`, nested feeds `UnsupportedPropertySpan`.
+Read `property.needsDecision` and `property.chainCandidates`, select an event
+evolution mode even for optional additions, and review before applying.
+Exact arguments, AutoMap and fixture rules: [property evidence and planning](property-links.md). A
 source-only authoring proposal may be accepted while `executableReady` is false.
 That is not permission to claim the application runs.
 
@@ -274,7 +280,7 @@ limits. Continue with `expectedSourceRevision`.
 
 From 4.138.0, `find-references` and `dependencies` accept `kind: "Property"`
 and `Owner.member`, or historical event `Owner.generationN.member`. Before a
-rename/removal, read [property links](property-links.md) for exact query/result
+property change, read [property links](property-links.md) for exact query/result
 shapes, roles, direct counterpart traversal, revision paging and `complete: false`
 with `reasons`. Incomplete evidence is never a successful empty list. These tools
 inspect authored links, not code execution or a transitive runtime graph.

package/package/corpus/skills/cratis-screenplay-model-authoring/references/property-links.md

@@ -7,13 +7,14 @@
 
 - Address and query
 - Read evidence, not just a count
-- Propose a property change (4.140.0)
+- Propose a property change (4.142.0)
+- Add with explicit sources and fixtures
 
 Screenplay 4.138.0 released property-path evidence in `find-references` and
 `dependencies`; this guidance was checked against 4.139.0. Discover installed
 `tools/list`: CLI 3.53.1's 4.137.0 bundle predates it. These are read-only
-inspection tools. Standalone 4.140.0 adds the separate `propose-property` planner
-below; the CLI bundle has neither capability.
+inspection tools. Standalone 4.140.0 adds the separate `propose-property` rename/remove planner;
+4.142.0 adds `add`. The CLI bundle has neither capability.
 
 ## Address and query
 
@@ -116,7 +117,7 @@ same-named properties in unrelated declarations do not affect completeness.
 External code contents and registrations remain outside coverage even with
 `complete: true`; authored links do not prove executable admission.
 
-Before a rename/removal: pin the revision, inspect incoming readers and outgoing
+Before a property change: pin the revision, inspect incoming readers and outgoing
 counterparts, page to completion, resolve uncertainties, then choose the supported
 identity-safe edit route with the connection owner. Never infer safe deletion from
 zero resolved hits or edit every same-named field. An event-property change still
@@ -126,7 +127,12 @@ Source/output authority: `v4.139.0:Documentation/screenplay/mcp/reference.md`
 (property links), `Source/DotNET/Screenplay.Mcp/McpPropertyDependencies.cs`,
 `McpToolSchemas.cs`, and decision 0044's released prerequisite index. The planner's release evidence is separate below.
 
-## Propose a property change (4.140.0)
+## Propose a property change (4.142.0)
+
+Use `propose-property`, not hand-composed `propose-ast` batches, for supported
+add/rename/remove changes along a proven chain. For add, inspect existing
+producer/consumer properties and mapping blocks first; the new property has no
+reference address yet.
 
 Read the target property handle with `read-ast`, then call `propose-property`
 with `expectedRevision`, `expectedCatalogRevision`, `action: "rename"|"remove"`,
@@ -134,7 +140,7 @@ with `expectedRevision`, `expectedCatalogRevision`, `action: "rename"|"remove"`,
 or `alsoRemove` entries are `{ "target": <handle>, "expectedName": <name> }`.
 Select only intended command, current-event and non-key read-model properties:
 chain membership establishes eligibility, not permission to edit every field.
-Off-chain selections refuse atomically. Historical generations, inline events,
+Off-chain selections refuse atomically (`HopNotOnChain`). Historical generations, inline events,
 keys, opaque or incomplete links and unsupported spans refuse rather than guess.
 
 Rename repairs proven references and fixtures. Renaming only a command input
@@ -144,7 +150,13 @@ Removal refuses while readers remain. Removed expected values disclose
 refuses `AmbiguousPropertyReference`, not a false assertion-preservation verdict.
 Unrelated same-named fields appear in `property.notChanged`.
 
-For any selected event property, choose exactly one mode: `newGeneration: true`
+Read `property.needsDecision` for refusal reasons and located candidates;
+`property.chainCandidates` lists unselected chain members, not automatic edits.
+A refusal returns `success: false` and no writable partial candidate. Missing an
+event mode returns `EventContractChangeRequiresDecision`; do not bypass it by
+text editing or claiming the catalog proves non-persistence.
+
+For any selected event property (including optional additions), choose exactly one mode: `newGeneration: true`
 appends N+1 and preserves history; `eventNeverPersisted: true` edits current N in
 place and requires actual knowledge that it was never stored. Neither flag selects
 additional events. New generations require transformations before Chronicle deployment.
@@ -159,7 +171,42 @@ have equal revisions. `[]` means no accepted planned event edits, not success;
 there is no singular `property.generation`. `deployableWithoutTransformation`
 and `esmVersionKnown` are independent of authoring acceptance.
 
-Authority: Screenplay `v4.140.0:Source/DotNET/Screenplay.Mcp/McpWorkspaces.Property.cs`,
+## Add with explicit sources and fixtures
+
+Read the declaration's original `read-ast` handle. Send `action: "add"`, both
+revision guards, `owner`, `expectedOwnerName`, `name` (new unqualified member),
+`type` (authored type text, not a concept declaration), and optional `optional`
+(default false). Use the flag, not an optional suffix in `type`.
+
+`hops` defaults to `[]`: each entry has an original `at` handle and exactly one
+of `name` or `value`. `{at, name}` adds the same type at a connected declaration;
+`{at, value}` supplies a value expression at a `produces`, `from` or capture
+`append` block. Every selected event producer/read-model consumer needs an
+explicit mapping decision or compatible same-named AutoMap source. Never infer
+a business expression. Existing property names and off-chain hops refuse.
+Add does not accept `target`, `expectedName`, `newName`, `alsoRename` or `alsoRemove`;
+add-only fields are invalid for rename/remove.
+
+For a required addition with existing fixtures/assertions, supply `fixtureValue`
+as **literal source text**, for example `"\"normal\""` for a String value. The
+planner adds it to existing specification steps, examples and query results;
+`optional: true` adds no fixture values. A literal is not proof of behavior:
+inspect the assertions and run `run-specifications` on the retained proposal.
+
+| Refusal | Response |
+| --- | --- |
+| `SourcesRequired` | Select missing producer/consumer mappings from the located candidates; do not guess sources |
+| `FixtureValueRequired` | Supply the intended required literal fixture value; do not weaken assertions |
+| `HopNotOnChain` | Remove or correct the off-chain selection; never edit same-named unrelated fields |
+| `UnsupportedPropertySpan` | Preserve source and report unsupported nested feeds/expressions or shared spans; do not flatten the model to bypass refusal |
+
+Use `CanonicalizeTouchedDocuments` for additions. Review `property.changed`
+(`added`, `fixtureAdded`), decisions, chain candidates and generations, exact
+bytes, dropped comments, identities and semantic diff before ordinary `apply`.
+Even an optional event addition needs the same explicit evolution mode above.
+
+Authority: Screenplay `v4.142.0:Source/DotNET/Screenplay.Mcp/McpWorkspaces.Property.cs`,
 `Screenplay/Workspaces/WorkspaceProperty{Request,Plan,Safety,Report}.cs`,
-`WorkspacePropertyAssertionProvenance.cs`, `WorkspaceEventGenerations.cs`, and
-`Documentation/screenplay/mcp/authoring-tools.md`; decision 0067.
+`WorkspacePropertyAdd{Plan,Edits}.cs`, `WorkspacePropertyAssertionProvenance.cs`,
+`WorkspaceEventGenerations.cs`, and `Documentation/screenplay/mcp/{edit,reference,authoring-tools}.md`;
+the published contract's `mcpTools` entry for `propose-property`; decisions 0067 and 0044.

package/package/corpus/skills/cratis-screenplay-model-authoring/references/screen-authoring-workflow.md

@@ -168,10 +168,12 @@ Historical verified public vector and executable checks:
 - render (`cratis render <corpus-folder> --name ScreenComposition --destination
   <dir> -o json`) with CLI 3.43.0 publishes the corpus; the browser acceptance
   run on CLI 3.40.7 passed 51 assertions (Cratis/Screenplay#605);
-- still refused by design: guarded Close (`STAGE-SCENE-ACTION-001`) and
-  double-click (`STAGE-SCENE-INTERACTION-001`); still pending: Studio production
-  Play proof (test-account decision). UI-profile rejection and render-then-recover
-  shipped in Cratis/cli#301.
+- guarded Close and double-click: refused with `STAGE-SCENE-ACTION-001` and
+  `STAGE-SCENE-INTERACTION-001` on this historical vector, rendered and run since
+  Stage 4.65 (live browser run on CLI 3.53.1 with `cratis/stage:4.73.1`,
+  Cratis/Screenplay#671); the codes remain for a guard Stage cannot evaluate. Studio
+  production Play proof is a separate vector (Cratis/Screenplay#173). UI-profile
+  rejection and render-then-recover shipped in Cratis/cli#301.
 
 ## Replay the workflow in CI without a Screenplay checkout
 

package/package/corpus/skills/cratis-screenplay-model-authoring/verification.json

@@ -4,11 +4,25 @@
   "fixtures": [],
   "assertions": [
     { "kind": "play-compiles" },
+    { "kind": "skill-contains", "value": "propose-property" },
+    { "kind": "skill-contains", "value": "not hand-composed `propose-ast` batches", "file": "references/property-links.md" },
+    { "kind": "skill-contains", "value": "`incomplete`, `needsDecision`", "file": "references/mcp-loop.md" },
+    { "kind": "skill-contains", "value": "`property.chainCandidates`", "file": "references/property-links.md" },
+    { "kind": "skill-contains", "value": "EventContractChangeRequiresDecision", "file": "references/property-links.md" },
+    { "kind": "skill-contains", "value": "action: \"add\"", "file": "references/property-links.md" },
+    { "kind": "skill-contains", "value": "`expectedOwnerName`", "file": "references/property-links.md" },
+    { "kind": "skill-contains", "value": "{at, name}", "file": "references/property-links.md" },
+    { "kind": "skill-contains", "value": "{at, value}", "file": "references/property-links.md" },
+    { "kind": "skill-contains", "value": "`fixtureValue`", "file": "references/property-links.md" },
+    { "kind": "skill-contains", "value": "SourcesRequired", "file": "references/property-links.md" },
+    { "kind": "skill-contains", "value": "FixtureValueRequired", "file": "references/property-links.md" },
+    { "kind": "skill-contains", "value": "HopNotOnChain", "file": "references/property-links.md" },
+    { "kind": "skill-contains", "value": "UnsupportedPropertySpan", "file": "references/property-links.md" },
     { "kind": "skill-contains", "value": "weakensAssertion: true", "file": "references/property-links.md" },
     { "kind": "skill-contains", "value": "property.generations", "file": "references/property-links.md" },
     {
       "kind": "skill-contains",
-      "value": "Screenplay v4.141.0"
+      "value": "Screenplay v4.142.0"
     },
     {
       "kind": "skill-contains",
@@ -92,7 +106,8 @@
     },
     {
       "kind": "skill-contains",
-      "value": "`view: \"dropped-comments\"`"
+      "value": "`view: \"dropped-comments\"`",
+      "file": "references/mcp-loop.md"
     },
     {
       "kind": "skill-contains",

package/package/corpus/skills/cratis-screenplay-read-surface/references/guarded-actions.md

@@ -77,7 +77,9 @@ second command. Screens remain outside portable ESM execution. A downstream
 renderer must explicitly admit guarded selection or report unsupported behavior,
 not approximate it as a plain action. Checked at historical CLI 3.41.0: its bundled
 screen renderer reported unsupported guarded actions with STAGE-SCENE-ACTION-001; source compilation alone
-cannot establish usable controls.
+cannot establish usable controls. Since Stage 4.65 a guard comparing `item.<field>` with a literal is
+rendered and evaluated at runtime (public CLI 3.53.1 with `cratis/stage:4.73.1`, Cratis/Screenplay#671);
+STAGE-SCENE-ACTION-001 remains for a guard Stage cannot evaluate.
 
 Authority: Screenplay `v4.125.0:Documentation/screenplay/screens.md`;
 CLI `v3.41.0:Documentation/reference/screenplay.md` for renderer disposition.

package/package/corpus/skills/cratis-screenplay-render-and-gap-fill/SKILL.md

@@ -35,8 +35,9 @@ Runs: the worked example (`references/worked-example.md`) was probed with cratis
 corpus was rendered and published successfully, and an MCP-edited copy was rendered, run and checked in
 the browser; the CLI 3.40.7 browser acceptance run passed 51 assertions (Cratis/Screenplay#605). The AI
 repository's `screenplay-mcp-transcript.ts` harness proves the real stdio proposal/apply path against the
-packaged CLI. Guarded Close actions (`STAGE-SCENE-ACTION-001`) and double-click interactions
-(`STAGE-SCENE-INTERACTION-001`) are refused and recorded as unsupported, never emulated. UI-profile
+packaged CLI. Guarded Close actions and double-click interactions were refused (`STAGE-SCENE-ACTION-001`,
+`STAGE-SCENE-INTERACTION-001`) on that vector; since Stage 4.65 they render and run, and the codes
+remain for a guard Stage cannot evaluate, which is never emulated (Cratis/Screenplay#671). UI-profile
 rejection (`CLI-RENDER-007` to `-010`) and render-then-recover shipped in 3.41.0 (Cratis/cli#301). The
 renderer facts are owned by `cratis-stage-rendering-and-sandbox`; this skill links them and never
 restates the admission table.

package/package/corpus/skills/cratis-screenplay-streams-and-consistency/SKILL.md

@@ -156,7 +156,7 @@ option, mark it `ASSUMED` in the slice or module `documentation` and in the sess
   block compiles but is PLAY0271 at binding. Keep both when they state real intent; they are not
   protection. `description` text never reaches rendered code: a rule that lives only in prose is
   unenforced there.
-- `pii` and `secret` bind as ESM v13 on standalone 4.141.0, not the pinned CLI;
+- `pii` and `secret` bind as ESM v13 on standalone 4.142.0 (since 4.141.0), not the pinned CLI;
   enum/identity compliance and protected events with explicit subject marks still
   refuse PLAY0268 (command-surface `references/compliance.md`). Legacy markers are
   deprecated (PLAY0565). Never remove protection to pass a tool. PLAY0515 also refuses

package/package/corpus/skills/cratis-screenplay-streams-and-consistency/references/streams-example.md

@@ -8,14 +8,14 @@ active-state view with removal. Read it with `consistency-and-concurrency.md` (s
 The model compiles at 4.127.0 (V1, warnings as errors) but is not binding-ready by design:
 `reads` and the `concurrency` block are PLAY0271, and `require` over a view is PLAY0268.
 The `pii` concept failed binding on that compiler and still fails on the pinned CLI,
-but binds as v13 on standalone 4.141.0. Keep those lines: they state real intent.
+but binds as v13 on standalone 4.142.0 (since 4.141.0). Keep those lines: they state real intent.
 
 ```screenplay expect PLAY0516 test=unbound
 // cratis-screenplay-streams-and-consistency: complete design-mode example (V1 with --warnings-as-errors).
 // Shows: one business identity per stream, cross-stream references as payload, uniqueness
 // constraints (single, composite with release, unique event), a recorded state-dependent rule
 // that Screenplay cannot enforce, a declared concurrency scope, and an active-state view with removal.
-// Historical/CLI binding probes refuse compliance; standalone 4.141.0 binds this pii concept as v13, the
+// Historical/CLI binding probes refuse compliance; standalone 4.142.0 binds this pii concept as v13 (since 4.141.0), the
 // concurrency block and `reads` are PLAY0271, `require` over a view is PLAY0268. Keep them: they state
 // real intent. The capacity rule is NOT enforced in the model today (see the slice description).
 

package/package/corpus/skills/cratis-screenplay-toolchain/SKILL.md

@@ -22,7 +22,7 @@ files is one application: always check the folder, never one file of it.
 
 When choosing or upgrading a tool, or checking version-specific capabilities, read `references/versions.md`; it is the only version table, and other skills point to it. For exact diagnostic codes, MCP names/parameters and standalone CLI options, search the large published [references/screenplay-contract.json](references/screenplay-contract.json), pinned by [references/screenplay-contract.version](references/screenplay-contract.version), rather than loading it in full. Locate a diagnostic by its exact `code` (for example `"code": "PLAY0029"`), a tool by its exact `name` (for example `"name": "read-workspace"`), or a command in `cliCommands`; read the matched object for retirement, parameters or options. [references/screenplay-contract-exceptions.json](references/screenplay-contract-exceptions.json) records reasoned exceptions for historical statements; it does not change the current contract.
 
-The standalone pin is Screenplay 4.141.0.
+The standalone pin is Screenplay 4.142.0.
 CLI and bundled package pins: `references/versions.md`. The single version table records
 released source evidence and historical probes separately; do not relabel an old
 render/browser result as a probe of the current packages.
@@ -31,7 +31,7 @@ Historical screens-release evidence: CLI 3.40.7 / Stage 4.51.1 / bundled
 Screenplay 4.114.0 opened the canonical corpus with `executableReady true`
 and the stdio transcript exposed 37 tools; standalone language 4.122.0 was
 recorded in that vector. These retained results are not a rerun on CLI 3.53.1
-or Screenplay 4.141.0.
+or Screenplay 4.142.0.
 
 ## Ground rules
 
@@ -44,7 +44,7 @@ or Screenplay 4.141.0.
 3. **Pick the compiler deliberately and name it.** Standalone `screenplay` for
    current language checks and reference specifications; `cratis` for rendering
    and generation. Bundled and standalone versions differ (CLI 3.53.1 bundles 4.137.0;
-   the standalone pin is 4.141.0). Report both tool and
+   the standalone pin is 4.142.0). Report both tool and
    version, rather than transferring a verdict across releases.
 4. **Know the mode** (design, executable, renderable) and write from its subset.
 5. **Capability is not correctness.** The tool you ran decides what is accepted today; the
@@ -90,7 +90,7 @@ V2 and V3 need MCP (V3 alone can also be read from `cratis screenplay validate -
 server with a fixed root when the tool is older than 4.63.2 (the roots bug hit 4.63.1 and the
 4.60.1 bundled by cratis before 3.28.2; 4.66.0 and later and cratis 3.28.2 are fine). A subagent without MCP reports "V2 not run: no MCP in this agent".
 
-One line per verdict, tool first, for example `V1 pass (screenplay 4.141.0, 3 files)` and
+One line per verdict, tool first, for example `V1 pass (screenplay 4.142.0, 3 files)` and
 `V3 blocked: PLAY0268 x3 (filter query, enum compliance)`. Name the source identity (commit plus the digest from
 the source-identity helper (`cratis-screenplay-modeling-lifecycle` `references/verdicts-and-modes.md` "Source identity")) the verdict ran on; keep it apart from the MCP
 `modelRevision`, which is semantic and, without `.screenplay/identities.json`,
@@ -103,7 +103,7 @@ changes with the root folder name.
 - **Executable** (binds, V3): `references/executable-subset.md`. Optional keyed lookups, unfiltered
   lists and lists narrowed by one `by` key (observable too); `filter`, `scoped to`, `performer` and composite `by` do not bind; no handler (PLAY0268, with or without `implementation`/`hint`); `reads` and
   `concurrency` do not bind (PLAY0271); concept compliance binds as v13 on standalone
-  4.141.0, not the pinned CLI (precise refusals: command-surface `references/compliance.md`);
+  4.142.0 (since 4.141.0), not the pinned CLI (precise refusals: command-surface `references/compliance.md`);
   v6 constructs bind on Screenplay 4.61 or
   later (standalone, and cratis 3.28.2 or later); generated values and `returns` responses bind (ESM v7)
   from Screenplay 4.68.0 (also in the current CLI bundle) (`references/generated-responses-example.md`). Read [references/executable-example.md](references/executable-example.md) when you need a small StateChange and StateView model that binds executable, [references/pdl-example.md](references/pdl-example.md) when writing projection forms that bind and run, and [references/automation-translate-example.md](references/automation-translate-example.md) when writing Automation and Translate slices (ESM v6).

package/package/corpus/skills/cratis-screenplay-toolchain/references/cheat-sheet-example.md

@@ -4,6 +4,12 @@ One complete document with every construct family. Design mode, not executable.
 
 Binding blockers: unquoted import, `reads` (PLAY0271), `starts with`, a `filter` query (lists and observable lists bind). Executable shapes are in the sibling examples. The bare-marker fence compiles warning-free on standalone 4.127.0; the earlier legacy-marker version compiled on 4.66.0 and CLI 3.28.2. `RecordingAPayment` lists the `InvoiceClosed` cascade, which the cratis 3.27.1 bundle (4.60.1) rejected with a false PLAY0285 ("outcome cannot be produced by 'RecordPayment'"); 3.28.2 accepts it.
 
+Concept compliance itself binds as ESM v13 on standalone 4.142.0 (first released
+in 4.141.0); reasons remain report-only PLAY0270. CLI 3.53.1 bundles Screenplay
+4.137.0, which refuses markers; standalone Stage 4.76.0 admits only through v12
+(Stage#345). Binder-only PLAY0268
+refusals and subject-lineage limits: command-surface `references/compliance.md`.
+
 ```screenplay test=unbound
 // Design-mode cheat-sheet: every construct family; compiles warning-free on the standalone tool.
 domain Acme.Invoicing                      // optional; first line when present
@@ -12,7 +18,7 @@ import Customers.CustomerRegistered        // unquoted = another bounded context
 
 concept InvoiceId : Uuid                   // primitives: Uuid String Int Decimal Bool Date DateTime Enum
 concept PaymentId : Uuid
-concept Email : String pii                 // v13 on standalone 4.141.0; refuses on pinned CLI
+concept Email : String pii                 // v13 since 4.141.0; current standalone 4.142.0 binds; pinned CLI refuses
   pii reason "Identifies a person"
   validate
     not empty  message "An email is required"

package/package/corpus/skills/cratis-screenplay-toolchain/references/diagnostics.md

@@ -173,7 +173,7 @@ escapes `%`/`|`, not an inferred split of legacy text.
 Identity declarations and event `subject` are metadata; reading a declared
 `$identity` detail in executable clauses is PLAY0268. `runs as` is admitted as
 ESM v10 in the current standalone, not a current PLAY0268 gap. At standalone
-4.141.0, concept compliance binds as v13; enum/identity compliance and protected
+4.142.0, concept compliance binds as v13 (since 4.141.0); enum/identity compliance and protected
 events with explicit subject marks still refuse PLAY0268. CLI 3.53.1's 4.137.0
 bundle retains the blanket marker refusal; purpose metadata is PLAY0270. See command-surface
 `references/compliance.md` and `references/context.md` for syntax and limits.

package/package/corpus/skills/cratis-screenplay-toolchain/references/doc-contradictions.md

@@ -14,6 +14,12 @@ the released grammar/tool and successful purpose probes take precedence. The sam
 page's legacy `@pii` mentions do not change bare `pii`/`secret` canonical syntax;
 legacy forms compile with PLAY0565 information, duplicates with PLAY0653 warning.
 Event `subject` remains report-only, despite accepted future lineage work.
+Rechecked at 4.142.0: concept `pii`/`personal` and `secret` bind as v13, while
+reasons stay PLAY0270 report-only. PLAY0268 at binding only rejects enum/identity
+compliance and events mixing personal or explicitly subject-scoped secret values
+with an explicit `subject` mark. CLI 3.53.1 bundles Screenplay 4.137.0, which
+refuses markers; standalone Stage 4.76.0 admits only through v12 (Stage#345). These are distinct boundaries,
+not a reason to remove protection.
 
 `D/` is Screenplay `Documentation/screenplay/` at **v4.66.0**; line numbers were re-read at
 that tag. Rule: the compiler you ran decides what the tool accepts today; the documentation
@@ -42,7 +48,7 @@ read from source or documentation.
 | 14 | `$causedBy` | not evaluable (#4119), not ESM | showcase only |
 | 15 | literal keys | `key literal "global"` vs `key "global"` | both compile; prefer `literal` |
 | 16 | query admission | `D/queries.md:74` now says live, filtered, scoped and performer queries are not admitted | the binder also rejects collection queries and a missing `by`, which stay undocumented [probed] |
-| 17 | `@pii` | `D/concepts.md:3,33` "Chronicle applies `@pii` and `@sensitive` rules automatically" | the historical binder rejected any compliance attribute (PLAY0268); standalone 4.141.0 instead admits concept compliance as v13 with narrower enum/identity/subject-lineage refusals (command-surface `references/compliance.md`). Keep protection; the pinned CLI still reports V3 blocked. `@sensitive` means an operational secret (`[Encrypted]` + `[NotAudited]`; Screenplay decision 0034); the historically probed tools (standalone 4.68.0, bundle 4.66.0) do **not** report `PLAY0515` (`@pii` from 4.69.1, `@sensitive` from 4.84.1): there only Chronicle catches either attribute on an event-source identifier, at build time of the generated code (CHR0034 for `@pii`, CHR0052 for `@sensitive`) |
+| 17 | `@pii` | `D/concepts.md:3,33` "Chronicle applies `@pii` and `@sensitive` rules automatically" | the historical binder rejected any compliance attribute (PLAY0268); standalone 4.142.0 admits concept compliance as v13 (since 4.141.0) with narrower enum/identity/subject-lineage refusals (command-surface `references/compliance.md`). Keep protection; the pinned CLI still reports V3 blocked. `@sensitive` means an operational secret (`[Encrypted]` + `[NotAudited]`; Screenplay decision 0034); the historically probed tools (standalone 4.68.0, bundle 4.66.0) do **not** report `PLAY0515` (`@pii` from 4.69.1, `@sensitive` from 4.84.1): there only Chronicle catches either attribute on an event-source identifier, at build time of the generated code (CHR0034 for `@pii`, CHR0052 for `@sensitive`) |
 | 18 | read-model identity | `D/readmodels.md:32` "from the keyed query" | at 4.135.0 explicit `key` wins; else single-instance queries agree on one read-model `by` property; only with none and an admitted list query does conventional `*Id` inference run (collection-key exclusions: read-surface `references/named-keys.md`). Queryless views need explicit `key` |
 | 19 | `$strings` constraint messages | `D/constraints.md:31` vs `D/internationalization.md:55` | the compiler keeps the key; realization localizes |
 | 20 | composite key braces | optional in the EBNF; both forms in docs | both fine |

package/package/corpus/skills/cratis-screenplay-toolchain/references/executable-subset.md

@@ -2,7 +2,7 @@
 
 ## Contents
 
-- Caller and compliance boundary (4.141.0)
+- Caller and compliance boundary (4.142.0)
 - Admitted on both compilers
 - Admitted from Screenplay 4.61 (ESM v6): standalone tool and cratis 3.28.2 or later
 - Generated values and responses (ESM v7): standalone 4.68.0 or later; the cratis 3.53.1 bundle binds them too
@@ -21,7 +21,7 @@ reaction refusals/redelivery remain unadmitted. Use the actual
 binder before promoting an older probe to a current capability claim.
 
 What the binder admits, and what it refuses with which code. The answer depends on the
-compiler version: the standalone tool (4.141.0) binds through v13; the compiler bundled in cratis
+compiler version: the standalone tool (4.142.0) binds through v13; the compiler bundled in cratis
 3.53.1 (4.137.0) binds ESM through v10 for rendering and refuses non-positional enum numbers at
 binding; older bundles (4.66.0 in cratis 3.28.x, admitting v1 to v6; 4.60.1 before 3.28.2, v1 to v5)
 are history.
@@ -40,7 +40,7 @@ Complete examples that bind live in `executable-example.md` (both compilers),
 (ESM v6; standalone tool and cratis 3.28.2 or later) and `generated-responses-example.md`
 (ESM v7; standalone tool 4.68.0 or later, and the cratis 3.53.1 bundle).
 
-## Caller and compliance boundary (4.141.0)
+## Caller and compliance boundary (4.142.0)
 
 `$identity.id`/`.name`/`.userName` are aliases of the admitted
 `$context.identity` produces-mapping values. Authentication status, roles and
@@ -50,12 +50,12 @@ readiness. Executable reads of declared `$identity.<detail>` do (PLAY0268);
 `$context.identity` remains built-ins only. Purposes and event `subject` marks
 are metadata (PLAY0270), not source resolution, retention or subject propagation.
 Bare `pii`/`personal` and `secret` concepts, scopes and qualifiers bind as v13
-on standalone 4.141.0; CLI 3.53.1's 4.137.0 bundle still refuses them. Enum/identity
+on standalone 4.142.0; CLI 3.53.1 bundles Screenplay 4.137.0, which refuses markers. Enum/identity
 compliance and events mixing protected values with explicit subject marks remain
 refused; see command-surface `references/compliance.md` for the precise boundary.
 Legacy spellings compile with PLAY0565 information; duplicates warn PLAY0653.
 Never remove protection. Reference execution proves neither encryption nor erasure.
-Authority: v4.141.0 `SemanticModelBinder.Compliance.cs`, `concepts.md`, `events.md`;
+Authority: v4.142.0 `SemanticModelBinder.Compliance.cs`, `concepts.md`, `events.md`;
 caller and purpose guidance retains v4.127.0 `context.md`, `identity.md`, `purposes.md`.
 
 ## Admitted on both compilers
@@ -170,6 +170,14 @@ pins preserve the earlier executable version/bytes. The optional canonical last
 Consumers must admit v12 explicitly; CLI 3.53.1/Stage 4.73.1 do not. Syntax:
 command-surface `references/enum-numbers.md`; version contract: `versions.md`.
 
+Concept `pii`/`personal` and `secret`, qualifiers and scopes bind as optional
+`compliance` in ESM v13 from 4.141.0 (rechecked at 4.142.0). Reasons remain
+report-only PLAY0270; reference execution proves neither encryption nor erasure.
+Enum/identity concepts and an event combining personal or explicitly subject-scoped
+secret values with an explicit `subject` mark refuse PLAY0268 at binding only.
+CLI 3.53.1 bundles Screenplay 4.137.0, which refuses markers; standalone Stage
+4.76.0 admits only through v12 (Stage#345). Preserve protection, not a falsely green bind.
+
 ## Code attachments (what binds, what never does)
 
 Inline fences (`csharp`, `typescript`, `react`, `html`, `sql`) and `file <path>` attach
@@ -213,7 +221,7 @@ bodies still leave their owner non-executable.
 | --- | --- | --- |
 | `Automation` or `Translate` slice, `reaction`, `capture`, `trigger`; `given clock`, `when clock`, `when trigger`, `when capture` | PLAY0268 | **cratis before 3.28.2 bundles only** (4.60.1); messages in `versions.md` |
 | Unquoted `import Other.Contract` | PLAY0268 | external contract import is not bound |
-| `pii` or `secret` on a concept | PLAY0268 | Blanket refusal on CLI 3.53.1's 4.137.0 bundle only. Standalone 4.141.0 admits v13 except enum/identity compliance and events mixing personal or explicitly subject-scoped secret values with explicit subject marks; see `compliance.md` in command-surface references |
+| `pii` or `secret` on a concept | PLAY0268 | Blanket refusal on CLI 3.53.1's 4.137.0 bundle only. Standalone 4.142.0 admits v13 except enum/identity compliance and events mixing personal or explicitly subject-scoped secret values with explicit subject marks; see `compliance.md` in command-surface references |
 | `query` with a composite `by` block, or `by ... from` context-derived arguments | PLAY0268 | composite `by` blocks remain unadmitted (#599). An optional scalar snapshot lookup, an unfiltered list (`RM[]`) and a list narrowed by one caller-supplied `by` key bind, in their `observable` form too (since 4.105.0) |
 | `filter`, `scoped to`, `performer` queries | PLAY0268 | "uses delivery, filtering, scope, or implementation behavior outside the first ESM v1 vertical." `observable` is not the blocker: it goes in the return position (`=> observable RM[]`); as a body line it is PLAY0048 |
 | `contains` or `starts with` in conditions | PLAY0268 | equality and numeric ordering only |
@@ -256,8 +264,8 @@ bodies still leave their owner non-executable.
 Do not remove `pii`, `secret`, `authorize` or policies, list queries, automations or
 rules a domain needs just to make binding pass. Report `V3 blocked: <codes>` and record the
 slice in the gap list. A `pii` or `secret` marker selects v13 on standalone
-4.141.0, but blocks binding on the pinned CLI and exceeds Stage 4.76.0's v12
-ceiling. Either attribute on an identifier or typed destination is a source error
+4.142.0 (since 4.141.0). CLI 3.53.1 bundles Screenplay 4.137.0, which refuses
+markers; standalone Stage 4.76.0 admits only through v12 (Stage#345). Either attribute on an identifier or typed destination is a source error
 PLAY0515 on the current compiler (including stream-id parts and route mapping
 sources). Chronicle also rejects `[PII]`/`[Encrypted]` on event-source identifiers
 (CHR0034/CHR0052). Keep surrogate identity and protected payload separate.

package/package/corpus/skills/cratis-screenplay-toolchain/references/renderable-subset.md

@@ -56,8 +56,10 @@ version; each construct it does not render refuses with its own code before any
 | Evolved events | initial revisions only | `STAGE-ESM-026` (Stage#204) |
 | Descriptions, documentation | XML `<summary>`/`<remarks>` doc comments only (Stage#178 closed) | characters invalid in XML: `CLI-RENDER-005`; never behavior |
 
-Still bind-refused (not Stage): `reads` and `concurrency` (`PLAY0271`), command `handler`s, `pii`/`secret`
-(`PLAY0268`). Other rows of the table below that name 4.24 behavior are history.
+CLI 3.53.1 bundles Screenplay 4.137.0. That compiler refuses `reads` and
+`concurrency` (PLAY0271), command `handler`s and concept `pii`/`secret` markers
+(PLAY0268) at binding, before Stage admission. Rows below naming Stage 4.24
+behavior are historical.
 
 ## Historical: what Stage 4.24 admitted
 
@@ -89,9 +91,10 @@ whole automation is hand-written (gap-fill).
 
 At standalone 4.127.0, compliance uses bare `pii`/`secret` (legacy markers are
 accepted with PLAY0565 information); either still refuses binding on that compiler.
-Standalone 4.141.0 admits concept compliance as v13 with narrower refusals
-(command-surface `references/compliance.md`), but Stage 4.76.0 admits only through
-v12 and the pinned CLI still bundles 4.137.0. Identity blocks,
+Standalone 4.142.0 admits concept compliance as v13 (from 4.141.0) with narrower refusals
+(command-surface `references/compliance.md`). CLI 3.53.1 bundles Screenplay
+4.137.0, which refuses markers; standalone Stage 4.76.0 admits only through v12
+(Stage#345). Identity blocks,
 purposes and event `subject` are authoring metadata, not provider realization;
 executing identity detail reads still refuses PLAY0268. Current source/stream
 routes are admitted as v8, including composite ids, not the historical binding

package/package/corpus/skills/cratis-screenplay-toolchain/references/screenplay-contract.json

@@ -21491,11 +21491,18 @@
         "alsoRename",
         "eventNeverPersisted",
         "expectedName",
+        "expectedOwnerName",
+        "fixtureValue",
         "formatting",
+        "hops",
         "includeContent",
+        "name",
         "newGeneration",
         "newName",
+        "optional",
+        "owner",
         "target",
+        "type",
         "validation"
       ],
       "inputSchema": {
@@ -21510,6 +21517,7 @@
           "action": {
             "type": "string",
             "enum": [
+              "add",
               "rename",
               "remove"
             ]
@@ -21614,6 +21622,93 @@
             },
             "maxItems": 256
           },
+          "owner": {
+            "type": "object",
+            "properties": {
+              "revision": {
+                "type": "string"
+              },
+              "documentId": {
+                "type": "string"
+              },
+              "path": {
+                "type": "string"
+              }
+            },
+            "required": [
+              "revision",
+              "documentId",
+              "path"
+            ],
+            "additionalProperties": false
+          },
+          "expectedOwnerName": {
+            "type": "string"
+          },
+          "name": {
+            "type": "string"
+          },
+          "type": {
+            "type": "string"
+          },
+          "optional": {
+            "type": "boolean",
+            "default": false
+          },
+          "hops": {
+            "type": "array",
+            "items": {
+              "type": "object",
+              "properties": {
+                "at": {
+                  "type": "object",
+                  "properties": {
+                    "revision": {
+                      "type": "string"
+                    },
+                    "documentId": {
+                      "type": "string"
+                    },
+                    "path": {
+                      "type": "string"
+                    }
+                  },
+                  "required": [
+                    "revision",
+                    "documentId",
+                    "path"
+                  ],
+                  "additionalProperties": false
+                },
+                "name": {
+                  "type": "string"
+                },
+                "value": {
+                  "type": "string"
+                }
+              },
+              "required": [
+                "at"
+              ],
+              "additionalProperties": false,
+              "oneOf": [
+                {
+                  "required": [
+                    "name"
+                  ]
+                },
+                {
+                  "required": [
+                    "value"
+                  ]
+                }
+              ]
+            },
+            "maxItems": 256
+          },
+          "fixtureValue": {
+            "type": "string"
+          },
           "newGeneration": {
             "type": "boolean",
             "default": false
@@ -21685,6 +21780,26 @@
                 "expectedName"
               ]
             }
+          },
+          {
+            "if": {
+              "properties": {
+                "action": {
+                  "const": "add"
+                }
+              },
+              "required": [
+                "action"
+              ]
+            },
+            "then": {
+              "required": [
+                "owner",
+                "expectedOwnerName",
+                "name",
+                "type"
+              ]
+            }
           }
         ]
       }

package/package/corpus/skills/cratis-screenplay-toolchain/references/screenplay-contract.version

@@ -1 +1 @@
-4.141.0
+4.142.0

package/package/corpus/skills/cratis-screenplay-toolchain/references/verdicts.md

@@ -53,7 +53,7 @@ V3 are read from the MCP server or from a render, V1 and V5 from the CLIs.
 Needs an MCP connection (V2 and V3 belong to the session that owns MCP; a subagent without
 MCP reports `V2 not run: no MCP in this agent` unless the brief supplies fresh output). Without
 MCP, a binding check exists: `cratis screenplay validate --executable <root>` binds with the
-**bundled** compiler (CLI 3.53.1 bundles Screenplay 4.137.0, not the standalone 4.141.0), never
+**bundled** compiler (CLI 3.53.1 bundles Screenplay 4.137.0, not the standalone 4.142.0), never
 renders or writes files, and exits 5 with "The model does not bind into an executable semantic
 model" when it does not. Report it as `V3 (bundled 4.137.0 via cratis validate --executable)`; it
 gives binding errors, not the V2 `executable-diagnostics` view, so V2 stays MCP-only.
@@ -85,7 +85,13 @@ comparison needs it). Binding is what makes a model renderable at all. V3 means
 never "specifications pass".
 
 - Report the ESM version the model needs: `V3 ready (screenplay 4.139.0, ESM v6)`,
-  `V3 blocked: PLAY0268 x3 (filter query, pii) - design scope kept`.
+  `V3 blocked: PLAY0268 (enum compliance) - design scope kept`.
+  Bare `pii`/`personal` and `secret` bind as v13 on standalone 4.142.0; reasons
+  remain report-only PLAY0270. Enum/identity compliance and personal or explicitly
+  subject-scoped secret event values with an explicit `subject` mark still refuse
+  PLAY0268 at binding only. CLI 3.53.1 bundles Screenplay 4.137.0, which refuses
+  markers; standalone Stage 4.76.0 admits only through v12 (Stage#345).
+  V3 does not prove rendering.
 - A blocked V3 is not repaired by deleting protection or domain rules. Never remove `pii`,
   `secret`, authorization, list queries, automations or rules to reach V3; record the
   slice and the code in the gap list.

package/package/corpus/skills/cratis-screenplay-toolchain/references/versions.md

@@ -17,7 +17,7 @@ probe; older probes retain their original labels in the other references.
 
 | Source | Pin | Evidence |
 | --- | --- | --- |
-| Screenplay language, standalone tool and MCP | **4.141.0** (`8ce785e3`) | Released tag `v4.141.0` and its unchanged published contract; concept compliance/ESM v13 and the property-change planner |
+| Screenplay language, standalone tool and MCP | **4.142.0** (`e6439548`) | Released tag `v4.142.0` and its unchanged published contract; property additions join rename/remove, with concept compliance/ESM v13 retained |
 | cratis CLI | **3.53.1** | Released tag `v3.53.1`; source-checked, not a new render/browser probe |
 | Screenplay bundled by CLI | **4.137.0** | CLI `v3.53.1:Directory.Packages.props`; enum-number authoring, not v12 binding |
 | Stage bundled by CLI | **4.73.1** | Same file; Stage's own `Directory.Packages.props` also pins Screenplay 4.137.0 |
@@ -53,7 +53,7 @@ or renderer probes below as results from the newer bundle.
 
 ## Two compilers, one rule
 
-Standalone Screenplay 4.141.0 and CLI 3.53.1's 4.137.0 bundle are different releases.
+Standalone Screenplay 4.142.0 and CLI 3.53.1's 4.137.0 bundle are different releases.
 Prefer standalone for the current language checks; CLI owns generation, Prologue
 and rendering. Name the tool/version with every verdict. No verdict transfers
 between differing compilers without checking the same inputs there.
@@ -85,7 +85,7 @@ for identity-stable selection.
 
 ## Admission boundaries
 
-Screenplay `v4.141.0:Source/DotNET/Screenplay/Semantics/Versions.cs` supports
+Screenplay `v4.142.0:Source/DotNET/Screenplay/Semantics/Versions.cs` supports
 schema pairs through v13. Admission selects by use:
 
 - v7: generated values/responses and policy negation.
@@ -172,7 +172,7 @@ The Stage skill teaches the version-gated examples.
 
 At 4.127.0, `$identity` aliases built-in caller paths; declared identity details
 remain metadata and their executable reads report PLAY0268. Bare `pii`/`secret`
-bind as v13 on standalone 4.141.0, but still block binding on CLI 3.53.1's
+bind as v13 on standalone 4.142.0, but still block binding on CLI 3.53.1's
 4.137.0 bundle; `personal` aliases `pii`. Legacy markers are accepted with
 PLAY0565 information, duplicates warn PLAY0653. Event `subject` and processing
 purposes are report-only metadata (PLAY0270); purpose checks/reports do not prove

package/package/corpus/skills/cratis-screenplay-ui-composition/references/screen-composition-contract.md

@@ -54,10 +54,11 @@ All three levels hold for the canonical `ScreenComposition` corpus on the histor
   comments, deep links, stale-response handling and theme included. On CLI
   3.43.0 an agent-edited column was rendered, run and seen in the browser.
 
-Still true: a guarded Close action and a double-click interaction are refused
-(`STAGE-SCENE-ACTION-001`, `STAGE-SCENE-INTERACTION-001`, defined from Stage
-4.51 through 4.57) and recorded as unsupported, never emulated; Studio production
-Play proof is pending a test-account decision. Refusing an unresolvable UI
+Guarded Close and double-click: Stage refused both with `STAGE-SCENE-ACTION-001` and
+`STAGE-SCENE-INTERACTION-001` from Stage 4.51 through 4.57. Since Stage 4.65 they render and
+run (public CLI 3.53.1 with `cratis/stage:4.73.1`, Cratis/Screenplay#671); the codes remain the
+refusal for a guard Stage cannot evaluate, which is never emulated. Studio production Play
+proof is a separate vector (Cratis/Screenplay#173). Refusing an unresolvable UI
 profile and recovering a rendered application shipped in Cratis/cli#301. (History: on Stage 4.24.2 or
 cratis 3.28.x renderers authored screens were reported as omitted/default composition; Stage 4.73.1
 (CLI 3.53.1) renders navigation contributions and toolbars, and `CLI-RENDER-015`, which refused them, is retired.)
@@ -124,7 +125,8 @@ from parsing; do not publish an empty plain action as equivalent behavior.
 The complete checked model and conditions are in
 `cratis-screenplay-read-surface` `references/guarded-actions.md`, grounded in
 Screenplay v4.125.0 `screens.md`. Historical CLI 3.41.0/Stage 4.51.3 checks reported
-unsupported screen actions with STAGE-SCENE-ACTION-001, not proof of runtime selection.
+unsupported screen actions with STAGE-SCENE-ACTION-001; since Stage 4.65 a guard of the form
+`item.<field>` compared with a literal is evaluated at runtime (Cratis/Screenplay#671).
 
 ## Exposed template configuration
 

package/package/corpus/skills/cratis-stage-rendering-and-sandbox/SKILL.md

@@ -24,10 +24,10 @@ browser assertions passed, none blocked or pending (Cratis/Screenplay#605).
 Native command forms, required fields, scoped comments, deep links,
 stale-response handling and theme all pass there. On public CLI 3.43.0 (default
 `cratis/stage:4.52.0`) an agent-edited table column was rendered, run and seen in
-the browser. Two behaviors stay fail-closed by design: a guarded Close action
-(`STAGE-SCENE-ACTION-001`) and a double-click interaction
-(`STAGE-SCENE-INTERACTION-001`) are refused and recorded as unsupported
-capabilities, never emulated. Require a generated plan or artifact entry for every
+the browser. Guarded Close and guarded double-click run since
+Stage 4.65: on CLI 3.53.1 with `cratis/stage:4.73.1` Close shows only while the item is
+open and a double click navigates or notifies by row (Cratis/Screenplay#671). `STAGE-SCENE-ACTION-001` and `STAGE-SCENE-INTERACTION-001` still
+refuse a guard Stage cannot evaluate: no artifacts. Require a generated plan or artifact entry for every
 authored UI construct, and report every unsupported UI directive as a diagnostic.
 Silent fallback to a default screen is a failure, not a partial render.
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cratis/pi",
-  "version": "7.35.0",
+  "version": "7.36.1",
   "description": "Configuration-aware Cratis AI integration for Pi",
   "type": "module",
   "files": [