@cratis/pi 7.61.0 → 7.63.0

package/package/corpus/agents/spec-writer.md

@@ -89,14 +89,14 @@ public class and_all_information_is_valid : Specification
 #endif
 ```
 
-(`CommandScenario` event assertions are extension methods keyed by command + event type — `await _scenario.ShouldHaveAppendedEvent<TCommand, TEvent>(eventSourceId[, predicate])`; seed prior state through `_scenario.Given.ForEventSource(id).Events(...)` or `_scenario.Services`. The mode matters: in legacy mode `Given` materializes an in-memory read-model dictionary only, so constraint preconditions go through `EventScenario`'s `Given`; in `UseDecisionReads()` mode `Given` writes to the scenario's real log and `EventScenario` is unavailable (accessing it throws), so seed everything through `Given`. Check which mode the spec's scenario uses; see `specs.scenarios.csharp.md` and `cratis-application-slice-specifications`.)
+(`CommandScenario` event assertions are extension methods keyed by command + event type — `await _scenario.ShouldHaveAppendedEvent<TCommand, TEvent>(eventSourceId[, predicate])`; seed prior state through `_scenario.Given.ForEventSource(id).Events(...)` or `_scenario.Services`. The mode matters: in legacy mode `Given` materializes an in-memory read-model dictionary only, so constraint preconditions go through `EventScenario`'s `Given`; in decision mode (selected automatically from the command's read-protection mode and dependencies) `Given` writes to the scenario's real log and `EventScenario` is unavailable (accessing it throws), so seed everything through `Given`. Check which mode the spec's scenario uses; see `specs.scenarios.csharp.md` and `cratis-application-slice-specifications`.)
 
 ### What to specify
 
 0. **Every contract specification first** — one spec each, named after it, using the contract's example values. Then add the code-derived cases below that the contract lacks and report them as proposals for the contract (the `.play` model when one covers the slice, otherwise the agreed outline); never present them as contract coverage. A `.play` specification maps to a plain-call spec for a pure decision, with a scenario added where the pipeline, validation, constraints or projections matter; never edit, skip or delete a spec derived from the contract to make code pass — change the code or return an edit request.
 1. **Happy path** — succeeds, correct event(s) appended.
 2. **Each validation failure** — assert **both** `ShouldNotBeSuccessful()` and `ShouldHaveValidationErrors()`. Do not assert on message strings by default; assert exact text only when that wording is the specified behavior, and name that behavior in the fact. Violate **only** the rule the spec is named after (build the command valid in every other respect), or a neighbouring rule makes it pass.
-3. **Business-rule violations** — each `Result<,>` rejection / guarded decision condition. Plain injection is advisory; for `[ProtectedDecision]` or stream decisions use `UseDecisionReads()` with seeded events and competing appends, not pinned models.
+3. **Business-rule violations** — each `Result<,>` rejection / guarded decision condition. Plain injection under `Off` is advisory; for read protection `On`, `[ProtectedDecision]` or stream decisions use `new CommandScenario<T>()` with seeded events, `AppendConcurrently` and `ShouldHaveValidationErrorBecauseOf(ValidationResultReason.ConcurrencyViolation)`, not pinned models and not `UseDecisionReads()`.
 4. **Constraint violations** — `ShouldHaveConstraintViolationFor(name)` via `EventScenario`.
 5. **Authorization** — `ShouldNotBeAuthorized()` (an unauthorized result has no validation errors).
 6. **Repeat execution**, when a reactor invokes the command — the same command twice for the same source; specify whether the second is rejected, a no-op, or appends again.

package/package/corpus/harnesses/copilot/instructions/application-profile.instructions.md

@@ -32,7 +32,7 @@ Pick exactly one type per slice folder — determined by what the slice *does*.
 
 | Type | What it does | Contents |
 | --- | --- | --- |
-| **State Change** | Accepts a command, appends events | Command + validator + event(s); optional `[Passive]` for a current read; a rule that must hold under concurrency needs a decision read or constraint (see the `cratis-chronicle-decision-reads` skill, `references/choosing-how-a-rule-holds.md`) |
+| **State Change** | Accepts a command, appends events | Command + validator + event(s); optional `[Passive]` for a current read; a rule that must hold under concurrency needs read protection `On`, a stream decision or a constraint (see the `cratis-chronicle-decision-reads` skill, `references/choosing-how-a-rule-holds.md`) |
 | **State View** | Builds a queryable read model from events | `[ReadModel]` + projection mappings or reducer code + static query method(s) on the record |
 | **Automation** | Reacts to events, calls external systems / `ICommandPipeline`, or returns follow-up commands/events (including to another stream) | Reactor only |
 | **Translation** | Takes data from outside our own facts (an external system or another service) and records it as our facts | An adapter at the boundary, often a reactor |
@@ -46,7 +46,7 @@ Commands are imperative intents (`Register`, `Create`); the slice folder is the
 Tagged **[contract]** (framework-enforced) or **[convention]** (house default). Mechanics and examples live in `vertical-slices.md`.
 
 1. **[contract] Model-bound — no controllers.** Commands are `[Command]` records with a public instance `Handle()` (Arc analyzers enforce this); queries are `static` methods on `[ReadModel]` records; projections/constraints/authorization use attributes. Arc generates the HTTP surface. For read-model style follow rule 11's ladder; for constraints use `IConstraint` when attributes cannot express the rule.
-2. **[contract] Command validation & data flow.** Put command rejection in `CommandValidator<T>`, global value invariants in `ConceptValidator<T>`, and fetched/computed handler data in **`Provide()`** (runs after validation/authorization; may short-circuit with `ValidationResult.Error` / `Result<TProvided, ValidationResult>`). Keep `Handle()` focused on event construction. For a state-dependent rule that must hold **under concurrency**, enroll a guarded stream decision (`IStreamReads`/`StreamDecision`) or use `[ProtectedDecision]` with an admitted `DecisionRead<T>`; plain injected models remain advisory. Return a typed rejection via `Result<TEvent, ValidationResult>` where needed; the result alone adds no guard. **Throwing from `Provide()`/`Handle()` is an exception (HTTP 500), not a validation rejection** — throw only for genuinely exceptional conditions, never for normal business rejection.
+2. **[contract] Command validation & data flow.** Put command rejection in `CommandValidator<T>`, global value invariants in `ConceptValidator<T>`, and fetched/computed handler data in **`Provide()`** (runs after validation/authorization; may short-circuit with `ValidationResult.Error` / `Result<TProvided, ValidationResult>`). Keep `Handle()` focused on event construction. For a state-dependent rule that must hold **under concurrency**, start new code with read protection `On` (`<CratisReadProtection>On</CratisReadProtection>`): put the rule in a `CommandValidator<T>` with the read model as a constructor parameter and return the events from `Handle()`. Use a constraint for uniqueness, a per-stream read model or `IStreamReads`/`StreamDecision` for one stream, an aggregate for a rich lifecycle; `[ProtectedDecision]` with `DecisionRead<T>` is the older per-command opt-in. Under `Off` (the default when nothing is set) a validator over a plain read is a hint, not a guard. Return a typed rejection via `Result<TEvent, ValidationResult>` where needed; the result alone adds no guard. **Throwing from `Provide()`/`Handle()` is an exception (HTTP 500), not a validation rejection** — throw only for genuinely exceptional conditions, never for normal business rejection.
 3. **[contract] Event-source id resolution:** `ICanProvideEventSourceId` first; else the first qualifying property in declaration order — an `EventSourceId`/`EventSourceId<T>`-derived value *or* a `[Key]` property (no priority between them; two candidates is `ARCCHR0002`); else Arc generates one. A value actually used as a Chronicle stream identity derives from `EventSourceId<T>` with the underlying `IComparable` primitive — never `ConceptAs<Guid>` for that stream identity. `NotSet`, `New()`, and primitive→derived-id operators are optional domain/API conveniences, not Chronicle requirements; typed empty/zero values are real specified stream IDs, not `EventSourceId.Unspecified`.
 4. **[contract] Events never carry the event-source id** — it is implicit in the event context.
 5. **[contract] `[Key]` / `[Subject]` are distinct.** `[Key]` is for event-source/read-model/projection key resolution; `[Subject]` is compliance identity only. Don't put either on an `EventSourceId<T>` value (it already is both); use them only for non-`EventSourceId<T>` values.

package/package/corpus/harnesses/copilot/instructions/glossary.instructions.md

@@ -38,8 +38,8 @@ One precise line per load-bearing term, so the same word means the same thing ev
 - **Observation command** — a command whose input comes from outside the model's own decisions (webhook, poll, sweep, retry, classifier). It compares with current state and appends nothing when nothing changed; looking is not a fact.
 - **Signal event** — an event appended only to make a reactor do something (`…Requested`, `…Started`, `…Skipped`). Not a domain fact; use a job, state machine, command operation or `ICommandPipeline`.
 - **Constraint** — `IConstraint`; an **append-time** invariant (uniqueness / concurrency) enforced at the event-store level.
-- **DCB (Dynamic Consistency Boundary)** — enforcing a state-dependent rule under concurrency over explicitly enrolled event-state reads: stream decisions/exact scopes or protected, admitted projection decision reads. Plain injected models and `Result<TEvent, ValidationResult>` alone are advisory, not a guard.
-- **Consistency boundary** — the scope within which an invariant holds atomically (an event source, a routed stream, or the event state enrolled by an admitted protected decision read).
+- **DCB (Dynamic Consistency Boundary)** — enforcing a state-dependent rule under concurrency over explicitly enrolled event-state reads: read-model parameters under Arc read protection `On`, stream decisions/exact scopes, or protected, admitted projection decision reads. Plain injected models under `Off` (the default) and `Result<TEvent, ValidationResult>` alone are advisory, not a guard.
+- **Consistency boundary** — the scope within which an invariant holds atomically (an event source, a routed stream, or the event state enrolled by an admitted protected read).
 - **EventForEventSourceId** — self-describing wrapper to append an event to a **specific** (cross-stream) event source, from a command `Handle()` or from a reactor handler (reactor support has shipped since Chronicle 15.35). It carries the event stream type and id, source type, subject, occurred time, tags and causation, so it is also how a reactor sets those explicitly.
 - **ReactorDelivery** — the identity of one delivery of one event to one reactor partition; declare it as a handler parameter and Chronicle passes it in. Stable across a replay and across recovering a failed partition, so a receipt kept under its `Id` is what makes a side effect survive re-delivery. An identity, not a guarantee — Chronicle does not know whether the effect ran.
 

package/package/corpus/harnesses/copilot/instructions/specs.scenarios.csharp.instructions.md

@@ -117,10 +117,13 @@ arguments?, paging?, sorting?)`; `Observe(...)` returns `QueryObservation.Initia
 and buffered `Next()`. Configure principal/policies in `Services`; schemes fail
 closed without HTTP. Chronicle query `Given` can seed keyed models/events.
 
-For guarded commands use `UseDecisionReads()` **before** seeding events. Given
-state, guarded reads and appends share one real in-process log, unlike legacy
-mode above. Pinned models cannot supply guards. Use `OnRoute(route)` and
-`AppendConcurrently` to prove conflicts; `ShouldHaveCompletedStream` proves
+For guarded commands use plain `new CommandScenario<T>()`: it selects the decision
+mode from the command's read-protection mode and dependencies (`UseDecisionReads()`
+is hidden and unnecessary). Given state, guarded reads and appends share one real
+in-process log, unlike legacy mode above; an `Off` command with no protected
+dependency stays in legacy mode. Pinned models cannot supply guards. Use `OnRoute(route)` and
+`AppendConcurrently` with `ShouldHaveValidationErrorBecauseOf(ValidationResultReason.ConcurrencyViolation)`
+to prove conflicts (there is no `scenario.AppendConditions`); `ShouldHaveCompletedStream` proves
 completion and `DecisionReadAdmissions.ShouldAdmitDecisionReadsIn(assembly)`
 checks admission. See **cratis-application-slice-specifications**,
 `references/query-and-decision-scenarios.md`, for sources and limitations.

package/package/corpus/harnesses/copilot/instructions/vertical-slices.instructions.md

@@ -89,7 +89,7 @@ The command carries input from the caller. `Handle()` is defined directly on the
 | Reusable value invariant (length, format, range) | `ConceptValidator<T>` on the concept type |
 | Command-input / cross-field / pre-handler rule (incl. injected read-model/service/identity checks) | `CommandValidator<TCommand>` with `RuleFor(...)` |
 | Handler needs fetched/computed data before it can build the event | `Provide()` — fetches the data; may validate it and short-circuit |
-| State-dependent rule that must hold **under concurrency** | `IStreamReads`/`StreamDecision` for one stream, or `[ProtectedDecision]` + `DecisionRead<T>` for admitted projected state; plain injection is advisory |
+| State-dependent rule that must hold **under concurrency** | Read protection `On`: the read model as a `CommandValidator<T>` constructor (or `Handle()`) parameter; a per-stream read model or `IStreamReads`/`StreamDecision` for one stream; an aggregate for a rich lifecycle. `[ProtectedDecision]` + `DecisionRead<T>` is the older per-command opt-in. Under `Off` (default) injection is a hint |
 | Uniqueness | Chronicle `[Unique]` / `IConstraint` (race-safe) — not a read-model pre-check |
 | Genuinely exceptional failure (bug, missing infra) | `throw` a domain exception |
 
@@ -183,13 +183,21 @@ Three attributes scope an append broad→narrow, and each one *also* (only with
 
 Each attribute always tags the appended events (visible in `EventContext`). **Only when the command also carries `concurrency: true`** does each dimension join the server-side `ConcurrencyScope` (plus the event source id), with the optimistic strategy supplying the expected tail sequence number. A command **without** `concurrency: true` contributes no scope of its own, and the append falls to whatever concurrency strategy the event sequence is configured with — by default the optimistic one, scoped to the event source. So the attribute chooses *which dimensions* bound the check, not whether a check happens at all. Reach for it on high-contention state transitions where a stale read would let two commands both "win" — it narrows the boundary so appends that are genuinely independent stop colliding (concurrency failures surface on `CommandResult`/`AppendResult`). Adopt it deliberately per behavior, not as a blanket default.
 
-At Arc v22.75.0, prefer `IStreamReads.ForCommand()` in `Provide()` and return
-`StreamDecision.Append(...)` when deciding over one routed stream. For projected
-state use `[ProtectedDecision]` + `DecisionRead<T>`; plain injection and keyed
-reads are advisory, including in `Handle()`. Protected projections must be
-Chronicle-admitted (direct source key, known events; not reducers, joins, children
-or passive shapes); validators must be parameterless and certified by Arc.
-Exact returned scopes replace automatic `concurrency: true` capture.
+New code sets `<CratisReadProtection>On</CratisReadProtection>` (Arc 22.106.0).
+Under `On`, a read-model parameter of `Handle()` or of a `CommandValidator<T>`
+constructor is read fresh and guards the append; the state rule goes in the
+validator. Two entities: two parameters, `[LookUpBy(nameof(Cmd.Prop))]` on the
+second, `IEnumerable<EventForEventSourceId>` returned. One stream inside a source:
+a per-stream read model (`[ReadModel, EventStream<TSource>("Stream")]`) on a command
+routed with `[EventSource<TSource>("Stream")]` and `[EventStreamId("{Prop}")]`, or
+`IStreamReads.ForCommand()` in `Provide()` returning `StreamDecision.Append(...)`.
+A deliberate advisory read is `[Unprotected("why")]`. Models must be admitted
+(source-keyed projection with a string or Guid `Id`, or an unfiltered reducer
+without constructor dependencies); joins, children and event-property keys are
+refused. Under `Off` (the default) injection and keyed reads are advisory,
+including in `Handle()`; `[ProtectedDecision]` + `DecisionRead<T>` is the older
+per-command opt-in and still works. Exact returned scopes replace automatic
+`concurrency: true` capture. Refusals: [choosing how a rule holds](../../../skills/cratis-chronicle-decision-reads/references/choosing-how-a-rule-holds.md).
 
 `[EventStreamId("{ReportingScopeId}:{Period}")]` resolves command property values
 after validation; concepts supply their underlying values. An interface can
@@ -296,7 +304,7 @@ query reference for versioned behavior and composition trade-offs.
 
 ### Choosing read-model access in command-side code **[convention]**
 
-Ladder, first that fits: (1) advisory direct read-model injection — only when keyed by the command's own event-source id; (2) a `[Passive]` projection; (3) `IReadModels.GetInstanceById<T>((EventSourceId)key)` for a different/derived key; (4) a materialized projection. A lookup *interface* is justified **only** for a genuine non-key search (e.g. find-by-email) — never to wrap a keyed `GetInstanceById`.
+Ladder, first that fits: (1) direct read-model injection — guarded under read protection `On`, advisory under `Off`; keyed by the command's own event-source id, or by `[LookUpBy]`; (2) a `[Passive]` projection; (3) `IReadModels.GetInstanceById<T>((EventSourceId)key)` for a different/derived key; (4) a materialized projection. A lookup *interface* is justified **only** for a genuine non-key search (e.g. find-by-email) — never to wrap a keyed `GetInstanceById`.
 
 **[contract] Passive state is not sink state.** `IMongoCollection<T>` cannot
 compute a passive read model; any leftover documents are not maintained state.
@@ -408,14 +416,15 @@ Redaction is a system-event request that removes payload availability from the e
 
 ## Cross-slice patterns **[convention]**
 
-Cross-slice access is **read-only and goes through Chronicle** — inject another slice's read model (validator/`Provide()`/`Handle()`), read by explicit key with `IReadModels.GetInstanceById`, mark a `[Passive]` projection for a current read (a rule that must hold under concurrency needs a decision read or constraint, see the `cratis-chronicle-decision-reads` skill's `references/choosing-how-a-rule-holds.md`), or react to its events. **Never** instantiate or DI another slice's command/handler/service.
+Cross-slice access is **read-only and goes through Chronicle** — inject another slice's read model (validator/`Provide()`/`Handle()`), read by explicit key with `IReadModels.GetInstanceById`, mark a `[Passive]` projection for a current read (a rule that must hold under concurrency needs read protection `On`, a stream decision or a constraint, see the `cratis-chronicle-decision-reads` skill's `references/choosing-how-a-rule-holds.md`), or react to its events. **Never** instantiate or DI another slice's command/handler/service.
 
 **DCB (Dynamic Consistency Boundary):** the boundary is the event state explicitly
 enrolled in guarded decisions, not every model a command reads. Use stream
-reads/exact scopes or `[ProtectedDecision]` + admitted `DecisionRead<T>`;
-plain validator/`Provide()`/`Handle()` injection is advisory. Stream-level
+reads/exact scopes or read-model parameters under read protection `On`
+(`[ProtectedDecision]` + `DecisionRead<T>` is the older per-command opt-in);
+validator/`Provide()`/`Handle()` injection under `Off` is advisory. Stream-level
 `concurrency: true` scopes are another explicit boundary, not protection for an
-arbitrary snapshot. Specify conflicts with `UseDecisionReads()` and actual seeded
+arbitrary snapshot. Specify conflicts with `AppendConcurrently` and actual seeded
 events, not pinned models.
 
 ## Dialogs

package/package/corpus/product-sync.json

@@ -46,7 +46,7 @@
         ],
         "rules": []
       },
-      "notes": "Source-checked Stage v4.103.0: exact ESM v1-v17 and v19, not v18 or v20. Snapshot/live collection queries, identity-mapping all projections, stored event names, event-id publication checks, release-baseline warnings, command clock/receipt-time generation, conditional and multi-command slices, generated text constraints, no-event and bounded redelivery specs, refusal branches. Query concept validation still uses primitive workaround; Stage#370 is not released. CLI v3.62.0 bundles Stage 4.99.0, not 4.103.0. No new render/browser/Docker probe."
+      "notes": "Source-checked Stage v4.103.0: exact ESM v1-v17 and v19, not v18 or v20 (v18 admitted from 4.106.0 and v20 from 4.109.0, taught with Requires lines; 4.104-4.108 not otherwise reviewed). Snapshot/live collection queries, identity-mapping all projections, stored event names, event-id publication checks, release-baseline warnings, command clock/receipt-time generation, conditional and multi-command slices, generated text constraints, no-event and bounded redelivery specs, refusal branches. Query concept validation still uses primitive workaround; Stage#370 released in 4.106.0. CLI v3.62.0 bundles Stage 4.99.0, not 4.103.0. Generated-values-only delta checked at v4.127.0: v21/all-Proven unpinned specs from 4.115.0, warning/info generated rules 4.117.0, checksum validation 4.118.0, pattern/random factories/Host/executor 4.119.0; generate rule still STAGE-ESM-028. Language admission reconciled at the same v4.127.0 tag: exact v1-v21 and v23-v25 pairs; v22/v26 and mixed pairs -016, protected reads -044, atomic mode -043, described bodies STAGE-IMPL-002 even Stub mode; v24 first admitted 4.124.0 (absent 4.123.0). Other deltas not reviewed; synced unchanged. No new render/browser/Docker probe."
     },
     {
       "id": "arc",
@@ -81,6 +81,7 @@
           "cratis-arc-observable-query-http",
           "cratis-arc-query-paging",
           "cratis-arc-react-page",
+          "cratis-chronicle-decision-reads",
           "cratis-chronicle-read-model",
           "cratis-code-review",
           "cratis-lens-browser-extension",
@@ -98,7 +99,7 @@
           "vertical-slices.md"
         ]
       },
-      "notes": "Release-tag delta through 22.100.0: scoped completion and routing validation, generated-target freshness (including direct unit-of-work writes and nested commands), observable scenarios, asynchronous execution scopes, read-model diagnostics, ordered reactor refusal handling and ICommandExceptionMapper. Existing context generation/self-reduction guidance retained; Screenplay extraction deltas handed to its owning lane. No new runtime probe."
+      "notes": "Whole-product floor unchanged at 22.100.0. Focused read-protection coverage, Arc 22.106.0-22.108.0: ReadProtectionMode Off, Measure and On (MSBuild property, assembly and command attributes, runtime MaximumMode cap), read-model parameters of Handle and validator constructors guarded under On, [LookUpBy], [Unprotected(\"why\")], per-stream read models on routed commands, Measure report, ReadChanged and ReadIncomplete refusals, and CommandScenario selecting decision mode automatically. the caller severity threshold (X-Allowed-Severity, [BlockOnValidationSeverity]) and the Error floor for commands declared On (22.108.0). [ProtectedDecision] and DecisionRead<T> retained as the per-command opt-in. The other 22.101.0-22.108.0 changes were not reviewed. Prior notes: scoped completion and routing validation, generated-target freshness, observable scenarios, asynchronous execution scopes, read-model diagnostics, ordered reactor refusal handling and ICommandExceptionMapper. Generated-values-only delta checked at v22.107.1: 22.104.0 enforces every concept-rule severity and carries Fundamentals 7.25.0; 22.107.0 recovers pattern/random/checksum and self-contained String generation rules, with v21 caps and fixture validation. No new runtime probe."
     },
     {
       "id": "ai",
@@ -170,9 +171,9 @@
         }
       ],
       "synced": {
-        "version": "4.188.0",
+        "version": "4.198.0",
         "date": "2026-10-16",
-        "by": "Cratis/AI#706"
+        "by": "Cratis/AI#576"
       },
       "covers": {
         "skills": [
@@ -200,7 +201,7 @@
         ],
         "rules": []
       },
-      "notes": "Standalone 4.188.0 and byte-identical compiler contract pinned. Cratis/AI#706: application navigation regions (module inherit, extend or override), toolbar slice buttons, blueprint template references and sample data packs in cratis-screenplay-ui-composition (references/application-shell.md), with the canonical shell vector and the rejection codes PLAY0710-PLAY0722 and PLAY0740-PLAY0765. Examples moved to the executable-state rules since 4.164: translator reactions in an Automation slice beside the Translate slice (PLAY0694) and the first record of a capture key appended with `when added`. Earlier: Standalone 4.164.0 and byte-identical compiler contract pinned. Cratis/AI#663: one origin per capture (PLAY0687). #668: executable no-event/redelivery v17. #684: concept query-argument validation in every version and query-error assertions v18. #681: executable refusal branches and refusal values v19. #666: proposal summary/severity counts and exact structural source proposals. Generated-concept rules select v20 with PLAY0688/0689 proofs and derived-matches repair; generated secrets and preview strategies remain refused. Release-baseline from-esm admission reads storedName. Standalone binding is not renderer admission: Stage 4.103.0 admits v1-v17 and v19; CLI 3.62.0 bundles Screenplay 4.159.0 / Stage 4.99.0 and renders through v16. Prior evidence remains unless superseded; no new renderer, Docker or browser probe."
+      "notes": "Standalone 4.198.0 and byte-identical compiler contract pinned. Cratis/AI#576: mechanical compiler catch-up. Language batch #717/#722/#723/#724/#720/#728/#734 teaches atomic reaction batches (v22), described payload handlers (v23), portable linear matching, ordinal text rules (v24), protected command reads (v25), diagnostic arguments and event-source invokes mappings. Facts read at Screenplay v4.198.0 and introducing tags; Stage v4.127.0 admits exact v1-v21 and v23-v25 pairs but refuses v22/v26 and mixed pairs (STAGE-ESM-016), protected reads (044), atomic mode (043) and described handlers (STAGE-IMPL-002), even Stub mode. Stage text rules execute/render; no new renderer/runtime probe or Stage pin uplift. Cratis/AI#706: application navigation regions (module inherit, extend or override), toolbar slice buttons, blueprint template references and sample data packs in cratis-screenplay-ui-composition (references/application-shell.md), with the canonical shell vector and the rejection codes PLAY0710-PLAY0722 and PLAY0740-PLAY0765. Examples moved to the executable-state rules since 4.164: translator reactions in an Automation slice beside the Translate slice (PLAY0694) and the first record of a capture key appended with `when added`. Earlier: Standalone 4.164.0 and byte-identical compiler contract pinned. Cratis/AI#663: one origin per capture (PLAY0687). #668: executable no-event/redelivery v17. #684: concept query-argument validation in every version and query-error assertions v18. #681: executable refusal branches and refusal values v19. #666: proposal summary/severity counts and exact structural source proposals. Generated-concept rules select v20 with PLAY0688/0689 proofs and derived-matches repair; generated secrets and preview strategies remain refused. Release-baseline from-esm admission reads storedName. Standalone binding is not renderer admission: Stage 4.103.0 admits v1-v17 and v19; CLI 3.62.0 bundles Screenplay 4.159.0 / Stage 4.99.0 and renders through v16. Prior evidence remains unless superseded; no new renderer, Docker or browser probe."
     },
     {
       "id": "scene",
@@ -322,7 +323,7 @@
         ],
         "rules": []
       },
-      "notes": "Release-tag delta through 19.65.0: explicit artifacts, collection observation, redelivery scenarios, webhook generation pins, enrollment contributors, seed ownership, reconnect readiness and hosting/storage fixes. Existing self-reduction guidance retained; publication eligibility corrected and forwarded-tag boundary recorded. No new kernel/transport probe."
+      "notes": "Whole-product floor unchanged at 19.65.0. Focused read-protection coverage, Chronicle 19.68.0-19.71.x: admitted reducers (unfiltered, no constructor dependencies, 19.68.0), per-stream read models with [EventStream<TSource>], IUnitOfWork.EnforceReadProtection, AllowReads and GetAppendConditions, CHR0062-CHR0064. The other 19.66.0-19.71.x changes were not reviewed. Prior notes: explicit artifacts, collection observation, redelivery scenarios, webhook generation pins, enrollment contributors, seed ownership, reconnect readiness and hosting/storage fixes. No new kernel/transport probe."
     },
     {
       "id": "arc-go",
@@ -380,9 +381,9 @@
         }
       ],
       "synced": {
-        "version": "7.23.0",
-        "date": "2026-10-12",
-        "by": "Cratis/AI#620"
+        "version": "7.25.0",
+        "date": "2026-10-15",
+        "by": "Cratis/AI#576"
       },
       "covers": {
         "skills": [
@@ -398,7 +399,7 @@
           "concepts.md"
         ]
       },
-      "notes": "Floor uses direct source verification, not a peer-dependency minimum. Initial historical floor recorded on 2026-10-12 by Cratis/AI#619; date records this inventory, not a new product verification."
+      "notes": "Source-checked v7.25.0: IGeneratable/IGeneratableInContext, GenerationContext, UUID/ULID/TypeID/NanoID/bytes and finite GenerateValue.Pattern overloads with optional Checksum, inclusive Int64 Integer, and HasValidChecksum. Pattern date segments use captured UTC time; check digits add no entropy or authorization and do not automatically add validation. No Stage version uplift or generated-secret admission is implied."
     },
     {
       "id": "components",

package/package/corpus/prompts/add-business-rule.prompt.md

@@ -16,7 +16,7 @@ Enforce a new rule on an existing command. Invoke the **cratis-arc-command-valid
 - Reusable value invariant → `ConceptValidator<T>`.
 - Command-input / cross-field / pre-handler rule → `CommandValidator<T>`.
 - Handler needs fetched data first → `Provide()`.
-- State rule that must hold **under concurrency** → enroll a stream decision with `IStreamReads`/`StreamDecision`, or use `[ProtectedDecision]` with an admitted `DecisionRead<T>`; plain read-model injection and `Result<TEvent, ValidationResult>` alone add no guard. Specify the race with `UseDecisionReads()` and seeded events, not pinned models.
+- State rule that must hold **under concurrency** → new code sets read protection `On` (`<CratisReadProtection>On</CratisReadProtection>`): the read model is a `CommandValidator<T>` constructor parameter and `Handle()` returns the events; add `[LookUpBy]` for a second entity, a per-stream read model or `IStreamReads`/`StreamDecision` for one stream. `[ProtectedDecision]` with `DecisionRead<T>` is the older per-command opt-in. Under `Off` (the default) a validator over a plain read is a hint, and `Result<TEvent, ValidationResult>` alone adds no guard. Specify the race with `AppendConcurrently` and seeded events, not pinned models.
 - Uniqueness → `[Unique]` / `IConstraint`.
 
 > **Never throw for normal business rejection** — a throw is HTTP 500, not a validation error. Recoverable rejection is a `ValidationResult` / `Result<,>`. Add a spec for the failure case (assert both not-successful and has-validation-errors). The skill carries the detail; don't duplicate it here.

package/package/corpus/rules/application-profile.md

@@ -31,7 +31,7 @@ Pick exactly one type per slice folder — determined by what the slice *does*.
 
 | Type | What it does | Contents |
 | --- | --- | --- |
-| **State Change** | Accepts a command, appends events | Command + validator + event(s); optional `[Passive]` for a current read; a rule that must hold under concurrency needs a decision read or constraint (see the `cratis-chronicle-decision-reads` skill, `references/choosing-how-a-rule-holds.md`) |
+| **State Change** | Accepts a command, appends events | Command + validator + event(s); optional `[Passive]` for a current read; a rule that must hold under concurrency needs read protection `On`, a stream decision or a constraint (see the `cratis-chronicle-decision-reads` skill, `references/choosing-how-a-rule-holds.md`) |
 | **State View** | Builds a queryable read model from events | `[ReadModel]` + projection mappings or reducer code + static query method(s) on the record |
 | **Automation** | Reacts to events, calls external systems / `ICommandPipeline`, or returns follow-up commands/events (including to another stream) | Reactor only |
 | **Translation** | Takes data from outside our own facts (an external system or another service) and records it as our facts | An adapter at the boundary, often a reactor |
@@ -45,7 +45,7 @@ Commands are imperative intents (`Register`, `Create`); the slice folder is the
 Tagged **[contract]** (framework-enforced) or **[convention]** (house default). Mechanics and examples live in `vertical-slices.md`.
 
 1. **[contract] Model-bound — no controllers.** Commands are `[Command]` records with a public instance `Handle()` (Arc analyzers enforce this); queries are `static` methods on `[ReadModel]` records; projections/constraints/authorization use attributes. Arc generates the HTTP surface. For read-model style follow rule 11's ladder; for constraints use `IConstraint` when attributes cannot express the rule.
-2. **[contract] Command validation & data flow.** Put command rejection in `CommandValidator<T>`, global value invariants in `ConceptValidator<T>`, and fetched/computed handler data in **`Provide()`** (runs after validation/authorization; may short-circuit with `ValidationResult.Error` / `Result<TProvided, ValidationResult>`). Keep `Handle()` focused on event construction. For a state-dependent rule that must hold **under concurrency**, enroll a guarded stream decision (`IStreamReads`/`StreamDecision`) or use `[ProtectedDecision]` with an admitted `DecisionRead<T>`; plain injected models remain advisory. Return a typed rejection via `Result<TEvent, ValidationResult>` where needed; the result alone adds no guard. **Throwing from `Provide()`/`Handle()` is an exception (HTTP 500), not a validation rejection** — throw only for genuinely exceptional conditions, never for normal business rejection.
+2. **[contract] Command validation & data flow.** Put command rejection in `CommandValidator<T>`, global value invariants in `ConceptValidator<T>`, and fetched/computed handler data in **`Provide()`** (runs after validation/authorization; may short-circuit with `ValidationResult.Error` / `Result<TProvided, ValidationResult>`). Keep `Handle()` focused on event construction. For a state-dependent rule that must hold **under concurrency**, start new code with read protection `On` (`<CratisReadProtection>On</CratisReadProtection>`): put the rule in a `CommandValidator<T>` with the read model as a constructor parameter and return the events from `Handle()`. Use a constraint for uniqueness, a per-stream read model or `IStreamReads`/`StreamDecision` for one stream, an aggregate for a rich lifecycle; `[ProtectedDecision]` with `DecisionRead<T>` is the older per-command opt-in. Under `Off` (the default when nothing is set) a validator over a plain read is a hint, not a guard. Return a typed rejection via `Result<TEvent, ValidationResult>` where needed; the result alone adds no guard. **Throwing from `Provide()`/`Handle()` is an exception (HTTP 500), not a validation rejection** — throw only for genuinely exceptional conditions, never for normal business rejection.
 3. **[contract] Event-source id resolution:** `ICanProvideEventSourceId` first; else the first qualifying property in declaration order — an `EventSourceId`/`EventSourceId<T>`-derived value *or* a `[Key]` property (no priority between them; two candidates is `ARCCHR0002`); else Arc generates one. A value actually used as a Chronicle stream identity derives from `EventSourceId<T>` with the underlying `IComparable` primitive — never `ConceptAs<Guid>` for that stream identity. `NotSet`, `New()`, and primitive→derived-id operators are optional domain/API conveniences, not Chronicle requirements; typed empty/zero values are real specified stream IDs, not `EventSourceId.Unspecified`.
 4. **[contract] Events never carry the event-source id** — it is implicit in the event context.
 5. **[contract] `[Key]` / `[Subject]` are distinct.** `[Key]` is for event-source/read-model/projection key resolution; `[Subject]` is compliance identity only. Don't put either on an `EventSourceId<T>` value (it already is both); use them only for non-`EventSourceId<T>` values.

package/package/corpus/rules/glossary.md

@@ -37,8 +37,8 @@ One precise line per load-bearing term, so the same word means the same thing ev
 - **Observation command** — a command whose input comes from outside the model's own decisions (webhook, poll, sweep, retry, classifier). It compares with current state and appends nothing when nothing changed; looking is not a fact.
 - **Signal event** — an event appended only to make a reactor do something (`…Requested`, `…Started`, `…Skipped`). Not a domain fact; use a job, state machine, command operation or `ICommandPipeline`.
 - **Constraint** — `IConstraint`; an **append-time** invariant (uniqueness / concurrency) enforced at the event-store level.
-- **DCB (Dynamic Consistency Boundary)** — enforcing a state-dependent rule under concurrency over explicitly enrolled event-state reads: stream decisions/exact scopes or protected, admitted projection decision reads. Plain injected models and `Result<TEvent, ValidationResult>` alone are advisory, not a guard.
-- **Consistency boundary** — the scope within which an invariant holds atomically (an event source, a routed stream, or the event state enrolled by an admitted protected decision read).
+- **DCB (Dynamic Consistency Boundary)** — enforcing a state-dependent rule under concurrency over explicitly enrolled event-state reads: read-model parameters under Arc read protection `On`, stream decisions/exact scopes, or protected, admitted projection decision reads. Plain injected models under `Off` (the default) and `Result<TEvent, ValidationResult>` alone are advisory, not a guard.
+- **Consistency boundary** — the scope within which an invariant holds atomically (an event source, a routed stream, or the event state enrolled by an admitted protected read).
 - **EventForEventSourceId** — self-describing wrapper to append an event to a **specific** (cross-stream) event source, from a command `Handle()` or from a reactor handler (reactor support has shipped since Chronicle 15.35). It carries the event stream type and id, source type, subject, occurred time, tags and causation, so it is also how a reactor sets those explicitly.
 - **ReactorDelivery** — the identity of one delivery of one event to one reactor partition; declare it as a handler parameter and Chronicle passes it in. Stable across a replay and across recovering a failed partition, so a receipt kept under its `Id` is what makes a side effect survive re-delivery. An identity, not a guarantee — Chronicle does not know whether the effect ran.
 

package/package/corpus/rules/specs.scenarios.csharp.md

@@ -116,10 +116,13 @@ arguments?, paging?, sorting?)`; `Observe(...)` returns `QueryObservation.Initia
 and buffered `Next()`. Configure principal/policies in `Services`; schemes fail
 closed without HTTP. Chronicle query `Given` can seed keyed models/events.
 
-For guarded commands use `UseDecisionReads()` **before** seeding events. Given
-state, guarded reads and appends share one real in-process log, unlike legacy
-mode above. Pinned models cannot supply guards. Use `OnRoute(route)` and
-`AppendConcurrently` to prove conflicts; `ShouldHaveCompletedStream` proves
+For guarded commands use plain `new CommandScenario<T>()`: it selects the decision
+mode from the command's read-protection mode and dependencies (`UseDecisionReads()`
+is hidden and unnecessary). Given state, guarded reads and appends share one real
+in-process log, unlike legacy mode above; an `Off` command with no protected
+dependency stays in legacy mode. Pinned models cannot supply guards. Use `OnRoute(route)` and
+`AppendConcurrently` with `ShouldHaveValidationErrorBecauseOf(ValidationResultReason.ConcurrencyViolation)`
+to prove conflicts (there is no `scenario.AppendConditions`); `ShouldHaveCompletedStream` proves
 completion and `DecisionReadAdmissions.ShouldAdmitDecisionReadsIn(assembly)`
 checks admission. See **cratis-application-slice-specifications**,
 `references/query-and-decision-scenarios.md`, for sources and limitations.

package/package/corpus/rules/vertical-slices.md

@@ -88,7 +88,7 @@ The command carries input from the caller. `Handle()` is defined directly on the
 | Reusable value invariant (length, format, range) | `ConceptValidator<T>` on the concept type |
 | Command-input / cross-field / pre-handler rule (incl. injected read-model/service/identity checks) | `CommandValidator<TCommand>` with `RuleFor(...)` |
 | Handler needs fetched/computed data before it can build the event | `Provide()` — fetches the data; may validate it and short-circuit |
-| State-dependent rule that must hold **under concurrency** | `IStreamReads`/`StreamDecision` for one stream, or `[ProtectedDecision]` + `DecisionRead<T>` for admitted projected state; plain injection is advisory |
+| State-dependent rule that must hold **under concurrency** | Read protection `On`: the read model as a `CommandValidator<T>` constructor (or `Handle()`) parameter; a per-stream read model or `IStreamReads`/`StreamDecision` for one stream; an aggregate for a rich lifecycle. `[ProtectedDecision]` + `DecisionRead<T>` is the older per-command opt-in. Under `Off` (default) injection is a hint |
 | Uniqueness | Chronicle `[Unique]` / `IConstraint` (race-safe) — not a read-model pre-check |
 | Genuinely exceptional failure (bug, missing infra) | `throw` a domain exception |
 
@@ -182,13 +182,21 @@ Three attributes scope an append broad→narrow, and each one *also* (only with
 
 Each attribute always tags the appended events (visible in `EventContext`). **Only when the command also carries `concurrency: true`** does each dimension join the server-side `ConcurrencyScope` (plus the event source id), with the optimistic strategy supplying the expected tail sequence number. A command **without** `concurrency: true` contributes no scope of its own, and the append falls to whatever concurrency strategy the event sequence is configured with — by default the optimistic one, scoped to the event source. So the attribute chooses *which dimensions* bound the check, not whether a check happens at all. Reach for it on high-contention state transitions where a stale read would let two commands both "win" — it narrows the boundary so appends that are genuinely independent stop colliding (concurrency failures surface on `CommandResult`/`AppendResult`). Adopt it deliberately per behavior, not as a blanket default.
 
-At Arc v22.75.0, prefer `IStreamReads.ForCommand()` in `Provide()` and return
-`StreamDecision.Append(...)` when deciding over one routed stream. For projected
-state use `[ProtectedDecision]` + `DecisionRead<T>`; plain injection and keyed
-reads are advisory, including in `Handle()`. Protected projections must be
-Chronicle-admitted (direct source key, known events; not reducers, joins, children
-or passive shapes); validators must be parameterless and certified by Arc.
-Exact returned scopes replace automatic `concurrency: true` capture.
+New code sets `<CratisReadProtection>On</CratisReadProtection>` (Arc 22.106.0).
+Under `On`, a read-model parameter of `Handle()` or of a `CommandValidator<T>`
+constructor is read fresh and guards the append; the state rule goes in the
+validator. Two entities: two parameters, `[LookUpBy(nameof(Cmd.Prop))]` on the
+second, `IEnumerable<EventForEventSourceId>` returned. One stream inside a source:
+a per-stream read model (`[ReadModel, EventStream<TSource>("Stream")]`) on a command
+routed with `[EventSource<TSource>("Stream")]` and `[EventStreamId("{Prop}")]`, or
+`IStreamReads.ForCommand()` in `Provide()` returning `StreamDecision.Append(...)`.
+A deliberate advisory read is `[Unprotected("why")]`. Models must be admitted
+(source-keyed projection with a string or Guid `Id`, or an unfiltered reducer
+without constructor dependencies); joins, children and event-property keys are
+refused. Under `Off` (the default) injection and keyed reads are advisory,
+including in `Handle()`; `[ProtectedDecision]` + `DecisionRead<T>` is the older
+per-command opt-in and still works. Exact returned scopes replace automatic
+`concurrency: true` capture. Refusals: [choosing how a rule holds](../skills/cratis-chronicle-decision-reads/references/choosing-how-a-rule-holds.md).
 
 `[EventStreamId("{ReportingScopeId}:{Period}")]` resolves command property values
 after validation; concepts supply their underlying values. An interface can
@@ -295,7 +303,7 @@ query reference for versioned behavior and composition trade-offs.
 
 ### Choosing read-model access in command-side code **[convention]**
 
-Ladder, first that fits: (1) advisory direct read-model injection — only when keyed by the command's own event-source id; (2) a `[Passive]` projection; (3) `IReadModels.GetInstanceById<T>((EventSourceId)key)` for a different/derived key; (4) a materialized projection. A lookup *interface* is justified **only** for a genuine non-key search (e.g. find-by-email) — never to wrap a keyed `GetInstanceById`.
+Ladder, first that fits: (1) direct read-model injection — guarded under read protection `On`, advisory under `Off`; keyed by the command's own event-source id, or by `[LookUpBy]`; (2) a `[Passive]` projection; (3) `IReadModels.GetInstanceById<T>((EventSourceId)key)` for a different/derived key; (4) a materialized projection. A lookup *interface* is justified **only** for a genuine non-key search (e.g. find-by-email) — never to wrap a keyed `GetInstanceById`.
 
 **[contract] Passive state is not sink state.** `IMongoCollection<T>` cannot
 compute a passive read model; any leftover documents are not maintained state.
@@ -407,14 +415,15 @@ Redaction is a system-event request that removes payload availability from the e
 
 ## Cross-slice patterns **[convention]**
 
-Cross-slice access is **read-only and goes through Chronicle** — inject another slice's read model (validator/`Provide()`/`Handle()`), read by explicit key with `IReadModels.GetInstanceById`, mark a `[Passive]` projection for a current read (a rule that must hold under concurrency needs a decision read or constraint, see the `cratis-chronicle-decision-reads` skill's `references/choosing-how-a-rule-holds.md`), or react to its events. **Never** instantiate or DI another slice's command/handler/service.
+Cross-slice access is **read-only and goes through Chronicle** — inject another slice's read model (validator/`Provide()`/`Handle()`), read by explicit key with `IReadModels.GetInstanceById`, mark a `[Passive]` projection for a current read (a rule that must hold under concurrency needs read protection `On`, a stream decision or a constraint, see the `cratis-chronicle-decision-reads` skill's `references/choosing-how-a-rule-holds.md`), or react to its events. **Never** instantiate or DI another slice's command/handler/service.
 
 **DCB (Dynamic Consistency Boundary):** the boundary is the event state explicitly
 enrolled in guarded decisions, not every model a command reads. Use stream
-reads/exact scopes or `[ProtectedDecision]` + admitted `DecisionRead<T>`;
-plain validator/`Provide()`/`Handle()` injection is advisory. Stream-level
+reads/exact scopes or read-model parameters under read protection `On`
+(`[ProtectedDecision]` + `DecisionRead<T>` is the older per-command opt-in);
+validator/`Provide()`/`Handle()` injection under `Off` is advisory. Stream-level
 `concurrency: true` scopes are another explicit boundary, not protection for an
-arbitrary snapshot. Specify conflicts with `UseDecisionReads()` and actual seeded
+arbitrary snapshot. Specify conflicts with `AppendConcurrently` and actual seeded
 events, not pinned models.
 
 ## Dialogs

package/package/corpus/skills/cratis-application-slice-conformance/SKILL.md

@@ -44,7 +44,7 @@ This skill is a method: it names no API of its own. When the Screenplay skills a
 | --- | --- |
 | Where each rule lives (validator, `Provide()`, handler result, constraint, exception) | `rules/vertical-slices.md` "The decision matrix"  |
 | A customization never makes a rejected model renderable; managed output is never hand-edited | Stage (`Customizations/` is the unmanaged seam; managed output is regenerated) |
-| A command `handler` never binds (PLAY0268), so that slice is gap-fill with the model as contract | Screenplay (diagnostic PLAY0268) |
+| Attached command handlers remain unbound (PLAY0268); pending handlers with unconditional productions bind v23 as described commands, but reached bodies are Unsupported ImplementationBody and Stage refuses STAGE-IMPL-002 even in Stub mode | Screenplay and Stage; use the model as the gap-fill contract |
 
 ## Procedure
 

package/package/corpus/skills/cratis-application-slice-specifications/SKILL.md

@@ -201,9 +201,10 @@ produces. Pin an instance only when the events would be noise.
 Both builder methods return `void`; there is nothing to await.
 
 That is **legacy** read-model mode: seeded events populate an in-memory model,
-not the append log. For protected or stream decisions call `UseDecisionReads()`
-before seeding; actual events and decisions then share one in-process log.
-Pinned models cannot supply decision guards. Read
+not the append log. A command under read protection `On`, with a per-stream model or
+with `[ProtectedDecision]` selects the decision mode itself (no `UseDecisionReads()`
+call); actual events and decisions then share one in-process log. Pinned models
+cannot supply decision guards. Read
 [query and decision scenarios](references/query-and-decision-scenarios.md) when
 specifying query pipelines, routed conflicts, projection admission or completion.
 

package/package/corpus/skills/cratis-application-slice-specifications/references/query-and-decision-scenarios.md

@@ -54,9 +54,18 @@ integration setup: scenario pins do not replace arbitrary stores.
 
 ## Guarded decisions
 
-Call `new CommandScenario<TCommand>().UseDecisionReads()` before seeding. This
-mode shares **one real in-process event log** among given events, guarded reads,
-constraints and returned appends. Seed actual events, not pinned read models.
+Create `new CommandScenario<TCommand>()`. It selects Chronicle's in-process decision
+mode from the command's read-protection mode and dependencies (for example under
+`On`, or with a per-stream read model); do not call `UseDecisionReads()`, which is
+hidden and unnecessary. This mode shares **one real in-process event log** among
+given events, guarded reads, constraints and returned appends. Seed actual events
+(`Given.ForEventSource(id).Events(...)`, or `.OnRoute(route).Events(...)`); protected
+reads fold the log and ignore a pinned `.ReadModel(m)`, which only pins an advisory
+(plain) read. Assert a lost race with
+`result.ShouldHaveValidationErrorBecauseOf(ValidationResultReason.ConcurrencyViolation)`
+after `scenario.AppendConcurrently(id, events...)`. There is no
+`scenario.AppendConditions`. An `Off` command with no protected dependency stays in
+legacy mode.
 `Given.ForEventSource(id).OnRoute(route).Events(...)` preserves routing;
 `scenario.EventRoutes.For<TSource>(stream).WithStreamId(...)` creates the route.
 Queue interference using `AppendConcurrently(id, route, event)` and assert a

package/package/corpus/skills/cratis-arc-authentication-authorization-and-identity/SKILL.md

@@ -159,11 +159,15 @@ protect plain HTTP snapshots, waits and long polls; older versions leave them un
 
 ### Validators are not an authorization boundary
 
-A `[ProtectedDecision]` command runs only certified, parameterless validators and
-refuses validators with constructor dependencies. A permission or ownership rule
-that depends on state does not belong in a validator (or in an `[Unprotected]`
-one): put it in `Provide()`/`Handle()` with `DecisionRead<T>` or `IDecisionReads`,
-and see the command-validation and Chronicle guidance.
+Authorization runs before validation, so a caller who may not act never reaches a
+validator. Express who may act through policies, roles and `[Authorize]`, not a
+validator. A state rule ("the order is still open") belongs in a
+`CommandValidator<T>` with the read model as a constructor parameter; under read
+protection `On` that read guards the append, under `Off` (the default) it is a
+hint, and in an `[Unprotected]` command it is advisory. A state-dependent
+permission or ownership rule (this member owns the order) may sit there too, with
+the same limit. Under `[ProtectedDecision]` without `On`, only a parameterless
+validator runs; see the command-validation and Chronicle guidance.
 
 Read [authorization](references/authorization.md) for the guest rules, evaluation
 order, the two baselines, default access under Arc's two hosting models, the
@@ -250,8 +254,9 @@ To run locally with an identity, supply the forwarded headers yourself — see
   method directly.
 - Observable queries that serve private or revocable data have an emission guard
   backed by current session and membership state.
-- Permission and ownership rules in `[ProtectedDecision]` commands live in
-  `Provide()`/`Handle()`, not in validators.
+- State-dependent permission and ownership rules are guarded: read protection `On`
+  with the read model in the validator or handler, or `[ProtectedDecision]` commands
+  with the rule in `Provide()`/`Handle()`. Under `Off` they are hints.
 - Discovery endpoints (`/.cratis/commands`, `/.cratis/queries`,
   `/.cratis/identity-details/schema`, `/.cratis/users`, `/.cratis/tenants`) are
   tested under Production settings; introspection is restricted or disabled where it

package/package/corpus/skills/cratis-arc-authentication-authorization-and-identity/references/authorization.md

@@ -319,17 +319,17 @@ privileged.
 
 ## Protected decisions and validators
 
-A `[ProtectedDecision]` command (`Cratis.Arc.Chronicle.ReadModels`) runs only
-certified, parameterless validators and **refuses** a validator whose constructor
-takes dependencies (a read model, `DecisionRead<T>`, `IDecisionReads`, any
-service). So an authorization or ownership rule put in such a validator — or in an
-`[Unprotected]` command's validator — is **not decision-safe**. Put
-state-dependent permission and ownership rules in `Provide()` or `Handle()` using
-`DecisionRead<T>` or `IDecisionReads`, and route to the validation and Chronicle
-guidance. Arc constructs/certifies discoverable parameterless validators;
-factory-supplied or altered rules fail closed. Keep static/service-locator state
-out of them too: certification is not proof of input purity. Validators that
-read decision state are a known limitation.
+Under read protection `On`, the read models in a convention-registered
+`CommandValidator<T>` constructor are read fresh and guard the command's append, so
+a state-dependent permission or ownership rule written there is decision-safe. Under
+`Off` (the default) and `Measure` the same validator reads a plain model: a hint. In
+an `[Unprotected]` command (or a model or method marked `[Unprotected("why")]`) the
+read is advisory, so the rule is **not decision-safe**. A `[ProtectedDecision]`
+command without `On` runs only certified, parameterless validators and refuses a
+validator whose constructor takes dependencies; put such a rule in `Provide()` or
+`Handle()` using `DecisionRead<T>` or `IDecisionReads`. Hand-registered scoped,
+singleton, factory or instance validators are refused under `On`. Keep
+static/service-locator state out of validators: a guard covers reads Arc can see.
 Source: [protected validator boundary](https://github.com/Cratis/Arc/blob/main/Documentation/backend/csharp/chronicle/read-models/injecting-into-commands.md).
 
 ## Analyzer diagnostics

package/package/corpus/skills/cratis-arc-command/SKILL.md

@@ -175,8 +175,9 @@ silently takes the first declared. Implement `ICanProvideEventSourceId`.
 
 Read [decisions and routing](references/decisions-and-routing.md) when a command
 needs guarded state, stream-id templates, definition-backed routes, event tags or
-post-commit `CompleteStream`. Plain read-model injection remains advisory;
-`Result<,>` and `concurrency: true` are not protection; see
+post-commit `CompleteStream`. A read-model parameter guards the append only under
+read protection `On`; under `Off` (the default) it is advisory. `Result<,>` and
+`concurrency: true` are not protection; see
 [choosing how a rule holds](../cratis-chronicle-decision-reads/references/choosing-how-a-rule-holds.md).
 A returned `EventForEventSourceId` route wins over command context.