@cratis/pi 7.90.1 → 7.92.0

package/package/corpus/product-sync.json

@@ -171,9 +171,9 @@
         }
       ],
       "synced": {
-        "version": "4.216.0",
-        "date": "2026-10-18",
-        "by": "Cratis/AI#784"
+        "version": "4.232.0",
+        "date": "2026-10-19",
+        "by": "Cratis/AI#823"
       },
       "covers": {
         "skills": [

package/package/corpus/skills/cratis-screenplay-command-surface/SKILL.md

@@ -272,7 +272,7 @@ Chronicle's constraints enforce **uniqueness only**; use one when two concurrent
 ## `policy` and `persona`
 
 A policy has **exactly one** `require` line (`PLAY0441`) **or** one implementation, never both (`PLAY0440`). Read [references/policy-persona-seed.md](references/policy-persona-seed.md) when
-declaring a policy, a persona, or a `seed` block.
+declaring a policy (including `require anonymous` for a deliberately public command or query), a persona, or a `seed` block.
 
 ## Event data subject
 

package/package/corpus/skills/cratis-screenplay-command-surface/references/inline-events.md

@@ -80,6 +80,9 @@ MCP can declare a missing produced event (`PLAY0166`), add explicit routing
 (`PLAY0478`), remove a redundant pin (`PLAY0471`), or remove an inline identifier
 copy (`PLAY0469`). The last **changes the event contract**, retires a property,
 refuses affected consumers/opaque implementations and is not fix-all. It does
-not establish that stored data is safe to migrate. Use
+not establish that stored data is safe to migrate; for a contract that may have been
+stored, `propose-property` `remove` with `newGeneration: true` extracts the event and
+drafts a new generation (a source draft, never deployment ready; requires Screenplay
+4.232.0, `screenplay --version`). Use
 `cratis-screenplay-model-authoring` for discovery, preview, extraction and rename.
 

package/package/corpus/skills/cratis-screenplay-command-surface/references/policy-persona-seed.md

@@ -1,5 +1,12 @@
 # Policies, personas and seed
 
+## Contents
+
+- `policy` and `persona`
+- Anonymous policy
+- Policy negation
+- `seed`
+
 ## `policy` and `persona`
 
 ```screenplay
@@ -20,7 +27,7 @@ persona Accountant
   policy IsAccountant
 ```
 
-Condition atoms: `authenticated`, `role "<name>"`, and
+Condition atoms: `authenticated`, `anonymous`, `role "<name>"`, and
 `claim "<name>" matches subject | "<value>" | <path>`. A policy has **exactly one**
 `require` line — continue the condition on deeper-indented lines instead of adding
 a second (`PLAY0441`) — **or** one implementation (a tagged ` ```csharp ` block or
@@ -29,6 +36,51 @@ runner; a code policy binds as opaque ESM v3 and needs a target to evaluate it.
 A `persona` is authoring metadata: the binder reports it as information `PLAY0270`
 (report-only) and it does not block binding; an unknown policy it lists is an error.
 
+## Anonymous policy
+
+Requires Screenplay 4.231.0 (ESM v31; `screenplay --version`); older compilers reject
+`require anonymous`. A policy with `require anonymous` exposes a public command or
+query, such as sign-up. The condition always holds, for callers with and without an
+identity alike. Only a model that declares one selects v31.
+
+```screenplay
+concept SubscriberId : Uuid
+concept EmailAddress : String
+policy PublicAccess
+  require anonymous
+module Newsletter
+  feature Signup
+    slice StateChange SubscribeToNewsletter
+      command SubscribeToNewsletter
+        subscriberId SubscriberId identifier
+        email EmailAddress
+        authorize PublicAccess
+        produces event SubscriberSignedUp
+          email EmailAddress = email
+      specification SubscribingWithoutAnIdentity
+        when SubscribeToNewsletter
+          subscriberId = "3fa85f64-5717-4562-b3fc-2c963f66afa6"
+          email = "ada@example.com"
+        then SubscriberSignedUp
+          email = "ada@example.com"
+```
+
+`anonymous` must be the command's or query's whole effective authorization:
+
+| Code | Refused |
+| --- | --- |
+| PLAY0804 | combined with another condition in `require` |
+| PLAY0805 | negated; write `authenticated` instead |
+| PLAY0806 | combined with another policy in `authorize` |
+| PLAY0807 | under or above another module, feature, command or query gate |
+
+A specification of such a command or query may omit `given caller`; every other
+authorized specification still needs one (`PLAY0389`).
+
+**Security:** `anonymous` declares a public surface on purpose. Never use it to make a
+model compile or to silence a missing-`authorize` or caller finding; model the real
+policy instead, because a generated application renders it as an open endpoint.
+
 ## Policy negation
 
 `not <condition>` is a portable ESM v7 policy-condition

package/package/corpus/skills/cratis-screenplay-legacy-extraction/SKILL.md

@@ -133,7 +133,7 @@ chain per slice before handoff (`references/evidence-table-template.md`, "Tracea
    `cratis-screenplay-slice-design` for slices, `cratis-screenplay-streams-and-consistency` for
    identity and invariants). To move an already authored slice or feature to its right parent, use
    the MCP `propose-move` tool (identity-preserving; it refuses identity loss, collisions and
-   captures) rather than retyping the declarations (`cratis-screenplay-model-authoring`):
+   name capture (a reference that would resolve to a different declaration); it also moves a single declaration between slices from Screenplay 4.230.0) rather than retyping the declarations (`cratis-screenplay-model-authoring`):
    - one StateChange per decision a person or system makes; events are facts experts recognise;
      consequences (counters, denormalised copies) become projections; an automation only when
      evidence shows a separate decision; no generic names (`Update/Edit/Save<Noun>`, `<Noun>Updated`): split by intent;

package/package/corpus/skills/cratis-screenplay-model-authoring/SKILL.md

@@ -175,7 +175,7 @@ Choose formatting and disclose dropped comments before apply:
 
 ## Repair or extract before rewriting
 
-Read `read-workspace` with `view: "repairs"` at the same revision as diagnostics and pass the repair to `propose-repair`; use `propose-extract-inline-event` before adding generations. `PLAY0469` changes the event contract, so ask about stored contracts first. No automatic generation-evolution repair ships. `PLAY0479`: migrate optionality spelling with `PreserveTrivia`. `eventNeverPersisted: true` cannot unfreeze admitted revisions. Differing event pins carry `storedName` in ESM v16, shared by all generations and unique (PLAY0472). Read [references/repairs.md](references/repairs.md) when fixing `PLAY0166`, `PLAY0478`, `PLAY0516` or `PLAY0683`, or admitting a [release baseline](references/release-baseline.md). Read [references/destination-intent-repair.md](references/destination-intent-repair.md) when `PLAY0470` needs a repair.
+Read `read-workspace` with `view: "repairs"` at the same revision as diagnostics and pass the repair to `propose-repair`; use `propose-extract-inline-event` before adding generations, or let a `remove` with `newGeneration: true` extract the inline event itself, as [property links](references/property-links.md) describes. `PLAY0469` changes the event contract, so ask about stored contracts first. No automatic generation-evolution repair ships. `PLAY0479`: migrate optionality spelling with `PreserveTrivia`. `eventNeverPersisted: true` cannot unfreeze admitted revisions. Differing event pins carry `storedName` in ESM v16, shared by all generations and unique (PLAY0472). Read [references/repairs.md](references/repairs.md) when fixing `PLAY0166`, `PLAY0478`, `PLAY0516` or `PLAY0683`, or admitting a [release baseline](references/release-baseline.md). Read [references/destination-intent-repair.md](references/destination-intent-repair.md) when `PLAY0470` needs a repair.
 
 ## Choose a readable layout
 

package/package/corpus/skills/cratis-screenplay-model-authoring/references/mcp-loop.md

@@ -218,7 +218,7 @@ connection. Passing `open-workspace.path` does **not** avoid it, because the err
 | Edit class | Examples | Route |
 | --- | --- | --- |
 | Address-preserving | descriptions; bodies of rules and expressions; mappings between members that already exist; any edit that adds, removes or renames no addressed element. Also every edit in a model with no `.screenplay/identities.json` except persisted names | bounded text edit of the `.play` file, then compile the folder; or `propose-ast` |
-| Catalog-changing (identity file present) | add, remove or rename a declaration (slice, command, event, read model, projection, ...), a property of a command, event, read model, composite type or trigger, a query, a query argument or a specification; create, delete, rename or move a mapped `.play` document (McpState refuses reopening with `IdentityMappingConflict`; use document operations in `propose-ast`); rename, remove or move an event, command, read model, constraint, module, feature or slice; move declarations between files (slices and features across logical parents: `propose-move`); contract evolution of a persisted event (new generation, property added, removed or retyped) | `propose-rename` or a reviewed `propose-ast`; never a blind text rename. Renaming a constraint resets its uniqueness index: ask first unless the request names it, then report the reset. A persisted event rename needs `id "OldName"` (added by default) |
+| Catalog-changing (identity file present) | add, remove or rename a declaration (slice, command, event, read model, projection, ...), a property of a command, event, read model, composite type or trigger, a query, a query argument or a specification; create, delete, rename or move a mapped `.play` document (McpState refuses reopening with `IdentityMappingConflict`; use document operations in `propose-ast`); rename, remove or move an event, command, read model, constraint, module, feature or slice; move declarations between files (slices and features across logical parents, and single declarations between slices: `propose-move`); contract evolution of a persisted event (new generation, property added, removed or retyped) | `propose-rename` or a reviewed `propose-ast`; never a blind text rename. Renaming a constraint resets its uniqueness index: ask first unless the request names it, then report the reset. A persisted event rename needs `id "OldName"` (added by default) |
 | Concept `generate` | set/change/remove strategy and modifiers | `propose-ast` replaces `ConceptSyntax.generation` (`GenerationSyntax`; omit/null to remove), or reviewed `propose-source`; never hand-edit `generate` text. Preserve other concept members and inspect executable diagnostics: sequence PLAY0682, generated secrets PLAY0268, generated-rule proofs PLAY0688/0689, finite-support failures PLAY0691/0692. Pattern/random/rule and checksum validation bind as ESM v21 (Requires Screenplay 4.172.0, `screenplay --version`; older compilers refuse PLAY0268). Read `mcp-tools.md#concept-generation` for `arguments`, exact support and `rules[]`, not parsed diagnostic prose. |
 | Repair | `PLAY0166`, `0478`, `0469`, `0471`, `0479`, `0516`, `0563`, `0564`, `0565`, `0614`, `0653`, `0683`, `0684` (and recipe-only `0397`); `PLAY0470` only with author intent ([destination intent repair](destination-intent-repair.md)) | `propose-repair` with `formatting`; PLAY0166/0478 may pin attachment evidence (`pinRepairEvidence` and `expectedRepairEvidenceRevision`), never fix-all PLAY0478 |
 | Inline event extraction | `produces event ...` to a declared event | `propose-extract-inline-event` |

package/package/corpus/skills/cratis-screenplay-model-authoring/references/mcp-tools.md

@@ -25,7 +25,7 @@
 - Formatting and recovery limits
 - Code attachments
 
-The standalone MCP server lists 44 tools (including the MCP-Apps visualization tool); `tools/list` is the authority for the installed server.
+The standalone MCP server lists 46 tools from Screenplay 4.228.0 (including the MCP-Apps visualization tool); `tools/list` is the authority for the installed server, and the CLI-bundled MCP (`cratis screenplay mcp`) can be an older Screenplay that lacks newer tools.
 
 The supported CLI launch is `cratis screenplay mcp <model-root>`, or `cratis screenplay mcp`
 alone inside a project, where the CLI locates the model (the project's `.play` files, else
@@ -50,16 +50,26 @@ the [MCP loop](mcp-loop.md).
 | Group | Tools | Intent |
 | --- | --- | --- |
 | Understanding | `describe-application`, `search-declarations`, `find-declaration`, `declaration-details` | Navigate logical hierarchy and inspect bounded details |
-| References and examples | `find-references`, `dependencies`, `dependency-graph`, `find-fixtures`, `find-assertion-gaps`, `find-specification-obligations`, `find-modeling-smells`, `semantic-diff` | Inspect declared relationships and authored examples, not executed coverage |
+| References and examples | `find-references`, `dependencies`, `dependency-graph`, `find-fixtures`, `find-assertion-gaps`, `find-specification-obligations`, `find-modeling-smells`, `trace-lineage`, `semantic-diff` | Inspect declared relationships and authored examples, not executed coverage |
 | Source and validation | `diagnostics`, `ui-profiles`, `read-document`, `merged-document`, `syntax-schema` | Read exact source or typed structure and diagnose problems |
 | Workspace inspection | `open-workspace`, `read-workspace`, `read-ast`, `workspace-state`, `export-workspace`, `repair-capabilities` | Obtain current identities, handles, readiness, code attachment requirements, source-map locations, durable-state status and the repair catalog |
 | Visual (MCP-Apps hosts only) | `visualize-model` | Draw the board for the model or a `proposalId`; its `sketch` argument previews a what-if of whole documents. Reads only |
-| Planning | `propose-source`, `propose-ast`, `propose-rename`, `propose-move`, `propose-repair`, `propose-property`, `propose-number-enum-members`, `propose-extract-inline-event`, `propose`, `recommend-layout`, `expand-layout` | Produce validated, reviewable candidates without writing them |
+| Planning | `propose-source`, `propose-ast`, `propose-rename`, `propose-move`, `propose-repair`, `propose-property`, `propose-number-enum-members`, `propose-extract-inline-event`, `propose-inline-event`, `propose`, `recommend-layout`, `expand-layout` | Produce validated, reviewable candidates without writing them |
 | Review | `read-proposal`, `discard-proposal` | Inspect exact changes, dropped comments and proposed attachments, or abandon a connection-local proposal |
 | Reference execution | `run-specifications` | Run the workspace or a retained proposal candidate read-only; not attached code or target tests |
 | Effects | `apply`, `recover-workspace` | Apply an accepted plan or explicitly recover an interrupted write |
 
-`propose-move` moves a slice to another feature, or a feature to another module or feature, keeping identities: copy the `target` and `newParent` `{kind, parts}` addresses from the identity inventory and pass `expectedRevision` and `expectedCatalogRevision`. It repairs qualified references and `depends on`, and refuses identity loss, capture, collisions, descendant destinations, inherited authorization or screen-interaction changes and glob imports; review `moveReport` (`identityMigrations`, `referenceRepairs`, `fragmentsMoved`). It does not rename events, change pins or move files, and declaration moves between slices are deferred. Use it for legacy re-slicing instead of retyping declarations. Its report document fields are plain strings, not nested identity objects.
+`propose-move` moves a slice to another feature, a feature to another module or feature, or a single command, event, read model, projection, query, reaction or capture to another slice, keeping identities: copy the `target` and `newParent` `{kind, parts}` addresses from the identity inventory (`newParent` is the destination slice for a declaration) and pass `expectedRevision` and `expectedCatalogRevision`. It repairs qualified references and `depends on`, and refuses identity loss, collisions, descendant destinations, name capture (a reference that would resolve to a different declaration), inherited authorization or screen-interaction changes and glob imports; review `moveReport` (`identityMigrations`, `referenceRepairs`, `fragmentsMoved`, and `specificationsCarried` for a declaration). It does not rename events, change pins or move files. Use it for legacy re-slicing instead of retyping declarations. Its report document fields are plain strings, not nested identity objects.
+
+A declaration move follows these rules:
+
+- A specification that covers only the moved declaration moves with it. A specification covers a declaration when it is a matching specification of one of its `find-specification-obligations` obligations, or when its `when` step names it; a `given` or `then` reference alone is not coverage.
+- The move is refused when a specification also covers a declaration that stays, when an obligation the source slice met would no longer be met or the move would introduce an unmet obligation, on a name collision, for an inline declaration (such as an inline `produces event`), a declaration written in more than one fragment, a standalone specification, screen, constraint or module, and when an unqualified reference would resolve differently. Qualify that reference first.
+- Screen `execute`, `refresh` and `navigate to` targets that name the declaration are repaired, not moved.
+- Slice-level events named by `produces` do not travel with a command, and a projection's `from` may name an event declared in another slice; move such an event with its own `propose-move` only when it should change slices. A command's inline events go with it.
+- Event names and pins stay untouched, and assigned identities follow the declaration.
+
+Requires Screenplay 4.230.0 (`screenplay --version`) for declaration moves; older servers move only slices and features.
 
 Requires Screenplay 4.211.0 (`screenplay --version`) for string conflict/move-report document fields and independent reference-edit batches; older servers can emit objects and refuse independent remove/add batches. Upgrade before relying on this contract.
 
@@ -309,7 +319,7 @@ with `view: "diagnostics"`, then `view: "repairs"` at the current revision.
 | `PLAY0166` | Declare a missing command-produced event in its slice. Infer known command-path types (retaining concepts) or `$context.occurred` as `DateTime`; refuse uncertain/conflicting shapes, imports, existing declarations, cross-file producers and parser-invalid workspaces. |
 | `PLAY0478` | Add `for <identifier>` to a plain production. Both models must be executable; refuse a version change or retargeting another production. This changes routing: accept only if the identifier, not allocation, is intended; `canFixAll: false`. |
 | `PLAY0471` | Remove a redundant event id only with unchanged executable model, catalog and comments. |
-| `PLAY0469` | Remove an inline same-source identifier property and mapping, retiring its semantic address. This changes the contract; `canFixAll` is false. Refuse other consumers, opaque impact, changed routing or comment loss. Plain contracts get guidance only. |
+| `PLAY0469` | Remove an inline same-source identifier property and mapping, retiring its semantic address. This changes the contract; `canFixAll` is false. Refuse other consumers, opaque impact, changed routing or comment loss. Plain contracts get guidance only. For a contract that may have been stored, use `propose-property` `remove` with `newGeneration: true` instead. |
 | `PLAY0479` | Migrate one optional type spelling, or all in a document, preserving syntax and trivia. Exclude `query Q => observable?`. |
 | `PLAY0563/0564` | Expand a one-line interaction alternative / turn a strict item `where` into one block-form `when`. Individual review, canonical formatting, no pinned evidence; refuse comment loss. Opaque non-item-condition text has no PLAY0564 repair. |
 | `PLAY0614` | Declare Translate direction only when exactly one inbound/outbound interpretation fits public metadata; never change event visibility to make a repair fit. |
@@ -347,6 +357,27 @@ tags and identities survive; canonical ESM must stay byte-identical and every
 comment must survive exactly once. Extract before adding `generation`, not after
 making the document parser-invalid. This is a refactoring, not a diagnostic repair.
 
+Requires Screenplay 4.228.0 (`screenplay --version`) for `propose-inline-event`.
+
+`propose-inline-event` is the inverse: it folds a slice-level event with exactly one
+production into an inline event on that production, takes the same `subject`,
+revisions and `formatting: "CanonicalizeTouchedDocuments"`, and preserves executable
+bytes and identities. Use it to undo an extraction when the event has one producer and
+no other consumer. It refuses when the fold could change meaning: a conditional
+production (`when`), incomplete mappings, generations, an external origin or public
+event, cross-slice or cross-document use, opaque or handler text, comments that would
+be lost, or any reference other than the single production. Read the refusal and
+leave the event standalone; never work around it with text edits.
+
+Requires Screenplay 4.223.0 (`screenplay --version`) for `trace-lineage`.
+
+`trace-lineage` takes a read-model property `address` and returns a paged tree
+(`limit`, `offset`) from the property through projection or reducer mappings, joins and
+child mappings to the event property, then to the producing command property or capture
+source. A broken hop is reported where the chain breaks, several sources appear as
+branches and code the model cannot see into is marked opaque. It is read-only and
+advisory.
+
 Requires Screenplay 4.153.0 or later (`screenplay --version`) for `propose-rename` to consult release-baseline mutability; before it, `propose-rename` pins the previous effective name without a baseline.
 
 `propose-rename` consults release-baseline mutability: without a

package/package/corpus/skills/cratis-screenplay-model-authoring/references/property-links.md

@@ -8,6 +8,7 @@
 - Address and query
 - Read evidence, not just a count
 - Propose a property change
+- Remove from an inline event
 - Add with explicit sources and fixtures
 
 Property-path evidence in `find-references` and `dependencies` is read-only inspection.
@@ -140,8 +141,10 @@ with `expectedRevision`, `expectedCatalogRevision`, `action: "rename"|"remove"`,
 or `alsoRemove` entries are `{ "target": <handle>, "expectedName": <name> }`.
 Select only intended command, current-event and non-key read-model properties:
 chain membership establishes eligibility, not permission to edit every field.
-Off-chain selections refuse atomically (`HopNotOnChain`). Historical generations, inline events,
+Off-chain selections refuse atomically (`HopNotOnChain`). Historical generations,
 keys, opaque or incomplete links and unsupported spans refuse rather than guess.
+Inline events refuse `InlineEventRequiresExtraction` unless the action is `remove`
+with `newGeneration: true` (see [inline events](#remove-from-an-inline-event)).
 
 Rename repairs proven references and fixtures. Renaming only a command input
 keeps the event payload name; broken AutoMap links become explicit mappings.
@@ -175,6 +178,24 @@ have equal revisions. `[]` means no accepted planned event edits, not success;
 there is no singular `property.generation`. `deployableWithoutTransformation`
 and `esmVersionKnown` are independent of authoring acceptance.
 
+## Remove from an inline event
+
+Requires Screenplay 4.232.0 (`screenplay --version`) for inline-event removal;
+older releases refuse inline events.
+
+`action: "remove"` with `newGeneration: true` on an inline event extracts it to its
+owning slice in the same proposal (explicit `CanonicalizeTouchedDocuments` consent
+required) and drafts generation N+1 without the member and its mappings. Generation N
+keeps the member; the contract identity and property identities stay. This is how to
+retire a command identifier copied into a stored event payload (`PLAY0469`).
+Without `newGeneration`, an inline event still refuses `InlineEventRequiresExtraction`:
+extract it first with `propose-extract-inline-event`.
+
+The report adds `evolutionDraft` (true when any selected event uses `newGeneration`)
+and `extractedInlineEvents` (always an array). An evolution draft is source only: no
+migrator is declared and `deployableWithoutTransformation` stays false. Never present
+it as migration, deployment or replay ready; Chronicle still needs a transformation.
+
 ## Add with explicit sources and fixtures
 
 Read the declaration's original `read-ast` handle. Send `action: "add"`, both

package/package/corpus/skills/cratis-screenplay-model-authoring/references/repairs.md

@@ -19,8 +19,11 @@ from silently changing the reviewed candidate.
   new timeline findings; evidence pinning is unsupported for this repair.
 - `PLAY0469` removes an inline identifier payload copy: it **changes the event
   contract**, refuses consumer/opaque impact, has no fix-all, and the catalog does
-  not prove events were persisted, so ask about stored contracts first.
-  No automatic generation-evolution repair ships.
+  not prove events were persisted, so ask about stored contracts first. For a
+  contract that may have been stored, use `propose-property` `remove` with
+  `newGeneration: true` instead: it drafts a new generation (see
+  [property planning](property-links.md#remove-from-an-inline-event)).
+  The repair itself never drafts a generation.
 - `PLAY0479`: migrate optionality spelling with `PreserveTrivia`; document scope
   migrates all occurrences together. Keep the `query Q => observable?` exception.
 - `PLAY0470` is repaired only from an author-supplied destination intent, never

package/package/corpus/skills/cratis-screenplay-model-review/SKILL.md

@@ -63,7 +63,10 @@ model's behalf.
    refused change needs a `then error` spec; each command missing from the table is investigated.
 5. **Lineage and completeness** (phase 3). Backward: every read-model field to an event field,
    `$eventSourceId`, literal or documented derivation, to a command input, `$context`, capture field
-   or literal, to the screen, reaction or integration that supplies it. AutoMap fills same-named
+   or literal, to the screen, reaction or integration that supplies it. Trace a field with the
+   `screenplay` MCP server's `trace-lineage` tool (paged tree, breaks, branches and opaque hops
+   are reported) rather than stitching `dependencies` calls; confirm each hop in the model.
+   Requires Screenplay 4.223.0 (`screenplay --version`); on older releases use `dependencies`. AutoMap fills same-named
    fields silently: count them. Forward: every event to a consumer or a terminal reason; every
    command input to an event field or a rule. Before calling data missing, search the model.
 6. **Phased checklist** (phases 4-10): ownership, event quality, events versus views, rules and

package/package/corpus/skills/cratis-screenplay-model-review/references/checklist.md

@@ -173,7 +173,7 @@ Nebulit (`provenance.md`).
 | G4 | A command invoked by a reaction is not gated by a caller policy, unless a trusted-path decision is recorded | reactions, `authorize` | D (silent = major) |
 | G5 | Row scoping (whose data) is part of the view, not a filter the caller supplies | queries | D |
 | G6 | Every persona Cannot line resolves to an executable gate (`authorize` policy, or ownership `claim "x" matches subject\|<command property>`, or a Uuid `require <command property> == <protected read path>`) and a `then denied` spec whose caller is synthesized with `given caller as <Persona>` or explicitly carries the effective-gate roles/claims; otherwise recorded as a gap. Persona text is intent only | personas, policies, specs | D |
-| G7 | Every command and query under an inherited module/feature `authorize` has its own `then denied` spec; authorization shared by a feature is declared at feature/module level so new paths inherit it | policies, specs | D |
+| G7 | Every command and query under an inherited module/feature `authorize` has its own `then denied` spec; authorization shared by a feature is declared at feature/module level so new paths inherit it. `require anonymous` is flagged on anything the business did not name public; it must be the whole authorization, preferably in a separate public module, and is not the same as omitting `authorize` | policies, specs | D (major when it exposes another person's data) |
 | G8 | Ownership/claim targets are a supported scalar (text, Uuid, Date or DateTime render; a numeric or Boolean target is always denied; other shapes and a command without exactly one identifier are STAGE-ESM-015): noted | policies | C (renderable mode) |
 
 ## Phase 10. Views, queries and screens (4 checks, H1-H4)

package/package/corpus/skills/cratis-screenplay-read-surface/SKILL.md

@@ -77,6 +77,11 @@ query ListInvoices => InvoiceListReadModel[]
   authorize IsAuthenticated
 ```
 
+A deliberately public query (no identity needed) uses a policy with `require anonymous`
+as its whole authorization, ideally in a separate public module; leaving `authorize` off
+is not the same thing. Rules and diagnostics:
+[anonymous policy](../cratis-screenplay-command-surface/references/policy-persona-seed.md#anonymous-policy).
+
 **Name the compiler and renderer.** Optional keyed queries and collection queries
 bind, including `observable`. Caller-supplied equality
 filters on collections bind as ESM v14; `from`, single-result filters, `scoped to`,
@@ -305,7 +310,7 @@ binding failures are errors.
 - [ ] `observable` is present exactly where the caller should see changes without
       asking again.
 - [ ] Every authorized query has a specification with `given caller`, including a
-      `then denied` case.
+      `then denied` case (a query authorized only by an anonymous policy may omit `given caller`).
 - [ ] Each read model has exactly one builder and every field traces to an event.
 - [ ] A reducer-built view's `by` type matches its events' event-source identity (`PLAY0690`).
 - [ ] No screen reference is left ambiguous or unresolved.

package/package/corpus/skills/cratis-screenplay-specifications/references/vocabulary.md

@@ -54,6 +54,10 @@ The complete model with these specifications is in read-surface `references/name
 
 ## Parse and binding diagnostics
 
+A command or query authorized only by an anonymous policy may omit `given caller`;
+every other authorized specification needs one (PLAY0389). See
+[anonymous policy](../../cratis-screenplay-command-surface/references/policy-persona-seed.md#anonymous-policy).
+
 PLAY0358 is a syntax error; PLAY0388 also occurs at parse time for extra text
 after `then denied`. PLAY0350, PLAY0352, PLAY0388 for mixed outcomes, PLAY0389 and
 the one-rejection rule PLAY0273 occur only at binding. Source validation alone

package/package/corpus/skills/cratis-screenplay-streams-and-consistency/SKILL.md

@@ -100,7 +100,9 @@ Unattended work takes the conservative option and marks it `ASSUMED` in model
 ## Rules
 **Compiler contracts** (diagnostics; capability per tool in the toolchain `references/executable-subset.md`)
 - `identifier` on an event property is PLAY0019; the source id is never payload by declaration.
-  Copying it as a payload value is PLAY0469 (information, warning for inline events).
+  Copying it as a payload value is PLAY0469 (information, warning for inline events);
+  for a possibly stored contract, retire it as an evolution draft with `propose-property`
+  `remove` + `newGeneration: true`, not by editing the event in place (model-authoring [property planning](../cratis-screenplay-model-authoring/references/property-links.md#remove-from-an-inline-event)).
 - In the executable model a production's `for` must resolve to the command's scalar identifier:
   one command writes one stream declaratively; described handlers bind v23 but
   their payload-only contract does not grant arbitrary destinations.

package/package/corpus/skills/cratis-screenplay-toolchain/references/language-admission.md

@@ -18,6 +18,7 @@ exact language/semantic pairs; binding, reference execution and rendering are se
 | v28 | `==`/`!=` between Uuid values in command `require` and `produces when` | Uuid properties, Uuid concepts and identities, canonical literals; protected read paths in `require` only | v28 refused STAGE-ESM-016 |
 | v29 | `decimals <= N`; `add`/`subtract` by `a * b`; a concept mapped to another concept over the same primitive (decision 0098) | Decimal-places rule on a Decimal concept or property; the exact decimal product; the conversion is admitted only when the target declares no rule or compliance the source does not, never for enums, composites or optional into required | v29 refused until Stage admits it |
 | v30 | A command `produces ... for <required scalar property>` (several event sources); a specification `given generated <Command>.<property> = <value>` (decision 0098) | Several sources in one accepted command; pinned generated values for reaction-invoked commands, taken in authored order | v30 refused until Stage admits it |
+| v31 | A policy `require anonymous` for a public command or query | A deliberately public surface; the policy is the whole effective authorization | v31 refused until Stage admits it |
 
 Constructs of decision 0098 with no executable-model content need no version: application-level toolbar buttons in the layout's `navigation topbar` region (`button <id> title "..." slice <Slice>` with an optional indented `authorize <Policy>`), a command specification that states the public event its outbound Translate slice publishes (no more false `PLAY0285`), and a capture over events that copies a list (`lines = $.lines`) or fans out with `children lines identified by sku`. Check `screenplay --version` against the release that admitted v29 and v30 before relying on them.