@cratis/pi 7.91.0 → 7.92.0

package/package/corpus/product-sync.json

@@ -171,9 +171,9 @@
         }
       ],
       "synced": {
-        "version": "4.231.0",
+        "version": "4.232.0",
         "date": "2026-10-19",
-        "by": "Cratis/AI#808"
+        "by": "Cratis/AI#823"
       },
       "covers": {
         "skills": [

package/package/corpus/skills/cratis-screenplay-command-surface/references/inline-events.md

@@ -80,6 +80,9 @@ MCP can declare a missing produced event (`PLAY0166`), add explicit routing
 (`PLAY0478`), remove a redundant pin (`PLAY0471`), or remove an inline identifier
 copy (`PLAY0469`). The last **changes the event contract**, retires a property,
 refuses affected consumers/opaque implementations and is not fix-all. It does
-not establish that stored data is safe to migrate. Use
+not establish that stored data is safe to migrate; for a contract that may have been
+stored, `propose-property` `remove` with `newGeneration: true` extracts the event and
+drafts a new generation (a source draft, never deployment ready; requires Screenplay
+4.232.0, `screenplay --version`). Use
 `cratis-screenplay-model-authoring` for discovery, preview, extraction and rename.
 

package/package/corpus/skills/cratis-screenplay-model-authoring/SKILL.md

@@ -175,7 +175,7 @@ Choose formatting and disclose dropped comments before apply:
 
 ## Repair or extract before rewriting
 
-Read `read-workspace` with `view: "repairs"` at the same revision as diagnostics and pass the repair to `propose-repair`; use `propose-extract-inline-event` before adding generations. `PLAY0469` changes the event contract, so ask about stored contracts first. No automatic generation-evolution repair ships. `PLAY0479`: migrate optionality spelling with `PreserveTrivia`. `eventNeverPersisted: true` cannot unfreeze admitted revisions. Differing event pins carry `storedName` in ESM v16, shared by all generations and unique (PLAY0472). Read [references/repairs.md](references/repairs.md) when fixing `PLAY0166`, `PLAY0478`, `PLAY0516` or `PLAY0683`, or admitting a [release baseline](references/release-baseline.md). Read [references/destination-intent-repair.md](references/destination-intent-repair.md) when `PLAY0470` needs a repair.
+Read `read-workspace` with `view: "repairs"` at the same revision as diagnostics and pass the repair to `propose-repair`; use `propose-extract-inline-event` before adding generations, or let a `remove` with `newGeneration: true` extract the inline event itself, as [property links](references/property-links.md) describes. `PLAY0469` changes the event contract, so ask about stored contracts first. No automatic generation-evolution repair ships. `PLAY0479`: migrate optionality spelling with `PreserveTrivia`. `eventNeverPersisted: true` cannot unfreeze admitted revisions. Differing event pins carry `storedName` in ESM v16, shared by all generations and unique (PLAY0472). Read [references/repairs.md](references/repairs.md) when fixing `PLAY0166`, `PLAY0478`, `PLAY0516` or `PLAY0683`, or admitting a [release baseline](references/release-baseline.md). Read [references/destination-intent-repair.md](references/destination-intent-repair.md) when `PLAY0470` needs a repair.
 
 ## Choose a readable layout
 

package/package/corpus/skills/cratis-screenplay-model-authoring/references/mcp-tools.md

@@ -319,7 +319,7 @@ with `view: "diagnostics"`, then `view: "repairs"` at the current revision.
 | `PLAY0166` | Declare a missing command-produced event in its slice. Infer known command-path types (retaining concepts) or `$context.occurred` as `DateTime`; refuse uncertain/conflicting shapes, imports, existing declarations, cross-file producers and parser-invalid workspaces. |
 | `PLAY0478` | Add `for <identifier>` to a plain production. Both models must be executable; refuse a version change or retargeting another production. This changes routing: accept only if the identifier, not allocation, is intended; `canFixAll: false`. |
 | `PLAY0471` | Remove a redundant event id only with unchanged executable model, catalog and comments. |
-| `PLAY0469` | Remove an inline same-source identifier property and mapping, retiring its semantic address. This changes the contract; `canFixAll` is false. Refuse other consumers, opaque impact, changed routing or comment loss. Plain contracts get guidance only. |
+| `PLAY0469` | Remove an inline same-source identifier property and mapping, retiring its semantic address. This changes the contract; `canFixAll` is false. Refuse other consumers, opaque impact, changed routing or comment loss. Plain contracts get guidance only. For a contract that may have been stored, use `propose-property` `remove` with `newGeneration: true` instead. |
 | `PLAY0479` | Migrate one optional type spelling, or all in a document, preserving syntax and trivia. Exclude `query Q => observable?`. |
 | `PLAY0563/0564` | Expand a one-line interaction alternative / turn a strict item `where` into one block-form `when`. Individual review, canonical formatting, no pinned evidence; refuse comment loss. Opaque non-item-condition text has no PLAY0564 repair. |
 | `PLAY0614` | Declare Translate direction only when exactly one inbound/outbound interpretation fits public metadata; never change event visibility to make a repair fit. |
@@ -362,9 +362,12 @@ Requires Screenplay 4.228.0 (`screenplay --version`) for `propose-inline-event`.
 `propose-inline-event` is the inverse: it folds a slice-level event with exactly one
 production into an inline event on that production, takes the same `subject`,
 revisions and `formatting: "CanonicalizeTouchedDocuments"`, and preserves executable
-bytes and identities. It refuses when the fold could change meaning (a conditional
-production, public or external event, cross-slice use, handlers, lost comments or any
-other reference to the event).
+bytes and identities. Use it to undo an extraction when the event has one producer and
+no other consumer. It refuses when the fold could change meaning: a conditional
+production (`when`), incomplete mappings, generations, an external origin or public
+event, cross-slice or cross-document use, opaque or handler text, comments that would
+be lost, or any reference other than the single production. Read the refusal and
+leave the event standalone; never work around it with text edits.
 
 Requires Screenplay 4.223.0 (`screenplay --version`) for `trace-lineage`.
 

package/package/corpus/skills/cratis-screenplay-model-authoring/references/property-links.md

@@ -8,6 +8,7 @@
 - Address and query
 - Read evidence, not just a count
 - Propose a property change
+- Remove from an inline event
 - Add with explicit sources and fixtures
 
 Property-path evidence in `find-references` and `dependencies` is read-only inspection.
@@ -140,8 +141,10 @@ with `expectedRevision`, `expectedCatalogRevision`, `action: "rename"|"remove"`,
 or `alsoRemove` entries are `{ "target": <handle>, "expectedName": <name> }`.
 Select only intended command, current-event and non-key read-model properties:
 chain membership establishes eligibility, not permission to edit every field.
-Off-chain selections refuse atomically (`HopNotOnChain`). Historical generations, inline events,
+Off-chain selections refuse atomically (`HopNotOnChain`). Historical generations,
 keys, opaque or incomplete links and unsupported spans refuse rather than guess.
+Inline events refuse `InlineEventRequiresExtraction` unless the action is `remove`
+with `newGeneration: true` (see [inline events](#remove-from-an-inline-event)).
 
 Rename repairs proven references and fixtures. Renaming only a command input
 keeps the event payload name; broken AutoMap links become explicit mappings.
@@ -175,6 +178,24 @@ have equal revisions. `[]` means no accepted planned event edits, not success;
 there is no singular `property.generation`. `deployableWithoutTransformation`
 and `esmVersionKnown` are independent of authoring acceptance.
 
+## Remove from an inline event
+
+Requires Screenplay 4.232.0 (`screenplay --version`) for inline-event removal;
+older releases refuse inline events.
+
+`action: "remove"` with `newGeneration: true` on an inline event extracts it to its
+owning slice in the same proposal (explicit `CanonicalizeTouchedDocuments` consent
+required) and drafts generation N+1 without the member and its mappings. Generation N
+keeps the member; the contract identity and property identities stay. This is how to
+retire a command identifier copied into a stored event payload (`PLAY0469`).
+Without `newGeneration`, an inline event still refuses `InlineEventRequiresExtraction`:
+extract it first with `propose-extract-inline-event`.
+
+The report adds `evolutionDraft` (true when any selected event uses `newGeneration`)
+and `extractedInlineEvents` (always an array). An evolution draft is source only: no
+migrator is declared and `deployableWithoutTransformation` stays false. Never present
+it as migration, deployment or replay ready; Chronicle still needs a transformation.
+
 ## Add with explicit sources and fixtures
 
 Read the declaration's original `read-ast` handle. Send `action: "add"`, both

package/package/corpus/skills/cratis-screenplay-model-authoring/references/repairs.md

@@ -19,8 +19,11 @@ from silently changing the reviewed candidate.
   new timeline findings; evidence pinning is unsupported for this repair.
 - `PLAY0469` removes an inline identifier payload copy: it **changes the event
   contract**, refuses consumer/opaque impact, has no fix-all, and the catalog does
-  not prove events were persisted, so ask about stored contracts first.
-  No automatic generation-evolution repair ships.
+  not prove events were persisted, so ask about stored contracts first. For a
+  contract that may have been stored, use `propose-property` `remove` with
+  `newGeneration: true` instead: it drafts a new generation (see
+  [property planning](property-links.md#remove-from-an-inline-event)).
+  The repair itself never drafts a generation.
 - `PLAY0479`: migrate optionality spelling with `PreserveTrivia`; document scope
   migrates all occurrences together. Keep the `query Q => observable?` exception.
 - `PLAY0470` is repaired only from an author-supplied destination intent, never

package/package/corpus/skills/cratis-screenplay-model-review/SKILL.md

@@ -63,7 +63,10 @@ model's behalf.
    refused change needs a `then error` spec; each command missing from the table is investigated.
 5. **Lineage and completeness** (phase 3). Backward: every read-model field to an event field,
    `$eventSourceId`, literal or documented derivation, to a command input, `$context`, capture field
-   or literal, to the screen, reaction or integration that supplies it. AutoMap fills same-named
+   or literal, to the screen, reaction or integration that supplies it. Trace a field with the
+   `screenplay` MCP server's `trace-lineage` tool (paged tree, breaks, branches and opaque hops
+   are reported) rather than stitching `dependencies` calls; confirm each hop in the model.
+   Requires Screenplay 4.223.0 (`screenplay --version`); on older releases use `dependencies`. AutoMap fills same-named
    fields silently: count them. Forward: every event to a consumer or a terminal reason; every
    command input to an event field or a rule. Before calling data missing, search the model.
 6. **Phased checklist** (phases 4-10): ownership, event quality, events versus views, rules and

package/package/corpus/skills/cratis-screenplay-model-review/references/checklist.md

@@ -173,7 +173,7 @@ Nebulit (`provenance.md`).
 | G4 | A command invoked by a reaction is not gated by a caller policy, unless a trusted-path decision is recorded | reactions, `authorize` | D (silent = major) |
 | G5 | Row scoping (whose data) is part of the view, not a filter the caller supplies | queries | D |
 | G6 | Every persona Cannot line resolves to an executable gate (`authorize` policy, or ownership `claim "x" matches subject\|<command property>`, or a Uuid `require <command property> == <protected read path>`) and a `then denied` spec whose caller is synthesized with `given caller as <Persona>` or explicitly carries the effective-gate roles/claims; otherwise recorded as a gap. Persona text is intent only | personas, policies, specs | D |
-| G7 | Every command and query under an inherited module/feature `authorize` has its own `then denied` spec; authorization shared by a feature is declared at feature/module level so new paths inherit it | policies, specs | D |
+| G7 | Every command and query under an inherited module/feature `authorize` has its own `then denied` spec; authorization shared by a feature is declared at feature/module level so new paths inherit it. `require anonymous` is flagged on anything the business did not name public; it must be the whole authorization, preferably in a separate public module, and is not the same as omitting `authorize` | policies, specs | D (major when it exposes another person's data) |
 | G8 | Ownership/claim targets are a supported scalar (text, Uuid, Date or DateTime render; a numeric or Boolean target is always denied; other shapes and a command without exactly one identifier are STAGE-ESM-015): noted | policies | C (renderable mode) |
 
 ## Phase 10. Views, queries and screens (4 checks, H1-H4)

package/package/corpus/skills/cratis-screenplay-read-surface/SKILL.md

@@ -77,6 +77,11 @@ query ListInvoices => InvoiceListReadModel[]
   authorize IsAuthenticated
 ```
 
+A deliberately public query (no identity needed) uses a policy with `require anonymous`
+as its whole authorization, ideally in a separate public module; leaving `authorize` off
+is not the same thing. Rules and diagnostics:
+[anonymous policy](../cratis-screenplay-command-surface/references/policy-persona-seed.md#anonymous-policy).
+
 **Name the compiler and renderer.** Optional keyed queries and collection queries
 bind, including `observable`. Caller-supplied equality
 filters on collections bind as ESM v14; `from`, single-result filters, `scoped to`,
@@ -305,7 +310,7 @@ binding failures are errors.
 - [ ] `observable` is present exactly where the caller should see changes without
       asking again.
 - [ ] Every authorized query has a specification with `given caller`, including a
-      `then denied` case.
+      `then denied` case (a query authorized only by an anonymous policy may omit `given caller`).
 - [ ] Each read model has exactly one builder and every field traces to an event.
 - [ ] A reducer-built view's `by` type matches its events' event-source identity (`PLAY0690`).
 - [ ] No screen reference is left ambiguous or unresolved.

package/package/corpus/skills/cratis-screenplay-specifications/references/vocabulary.md

@@ -54,6 +54,10 @@ The complete model with these specifications is in read-surface `references/name
 
 ## Parse and binding diagnostics
 
+A command or query authorized only by an anonymous policy may omit `given caller`;
+every other authorized specification needs one (PLAY0389). See
+[anonymous policy](../../cratis-screenplay-command-surface/references/policy-persona-seed.md#anonymous-policy).
+
 PLAY0358 is a syntax error; PLAY0388 also occurs at parse time for extra text
 after `then denied`. PLAY0350, PLAY0352, PLAY0388 for mixed outcomes, PLAY0389 and
 the one-rejection rule PLAY0273 occur only at binding. Source validation alone

package/package/corpus/skills/cratis-screenplay-streams-and-consistency/SKILL.md

@@ -100,7 +100,9 @@ Unattended work takes the conservative option and marks it `ASSUMED` in model
 ## Rules
 **Compiler contracts** (diagnostics; capability per tool in the toolchain `references/executable-subset.md`)
 - `identifier` on an event property is PLAY0019; the source id is never payload by declaration.
-  Copying it as a payload value is PLAY0469 (information, warning for inline events).
+  Copying it as a payload value is PLAY0469 (information, warning for inline events);
+  for a possibly stored contract, retire it as an evolution draft with `propose-property`
+  `remove` + `newGeneration: true`, not by editing the event in place (model-authoring [property planning](../cratis-screenplay-model-authoring/references/property-links.md#remove-from-an-inline-event)).
 - In the executable model a production's `for` must resolve to the command's scalar identifier:
   one command writes one stream declaratively; described handlers bind v23 but
   their payload-only contract does not grant arbitrary destinations.

package/package/corpus/skills/cratis-screenplay-toolchain/references/screenplay-contract.version

@@ -1 +1 @@
-4.231.0
+4.232.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cratis/pi",
-  "version": "7.91.0",
+  "version": "7.92.0",
   "description": "Configuration-aware Cratis AI integration for Pi",
   "type": "module",
   "files": [