@cratis/pi 7.61.0 → 7.63.0

package/package/corpus/skills/cratis-screenplay-scenario-coverage/references/public-event-coverage.md

@@ -4,9 +4,20 @@ Coverage for public events and routed producers.
 
 Outbound publication needs `when append <private>` and `then <PublicEvent>`:
 complete state, incomplete state, unchanged repeat, changed instance, separate
-source ids and the exported field boundary. Reference publication is executable;
-source-event captures and reached opaque event-target reducers are typed
-Unsupported. Read automations-and-translations `references/public-events-and-direction.md`.
+source ids and the exported field boundary. Reference publication and admitted
+source-event captures execute; reached opaque event-target reducers remain typed
+Unsupported. Read automations-and-translations `references/public-events-and-direction.md`
+for the prerequisite and complete typed capture specifications.
+
+For `source events`, use `given <FromEvent>` / `when append <FromEvent>`, not
+`given capture` / `when capture` (PLAY0701). Cover first added, unchanged overlays,
+updates after ordered givens, properties retained across different event types,
+and independent keys. The key must be required on every source event, not a
+context key (PLAY0700); optional foreign fixture `for` is not that key.
+Assertions list all follow-up facts, never the input append itself. Mixed capture
+and reaction expectations may need `then events in any order`; this is not proof
+of observer order or redelivery deduplication. Children/nested over events and
+context members other than `occurred` are not admitted execution.
 For routed producers/observers, cover override versus inherited route, skipped
 production route failure, matching/wrong source/stream and unrouted facts;
 see toolchain `references/production-routes-and-filters.md`.

package/package/corpus/skills/cratis-screenplay-scenario-coverage/references/scenario-examples.md

@@ -15,8 +15,10 @@ easily. Every excerpt below is copied verbatim from the complete document in
 `invoicing-dues-example.md`, which compiles with warnings as errors and whose 23 specifications
 pass in the reference evaluator; it also holds the declarations the excerpts depend on. The two
 compensation excerpts in section 4 come from `invoicing-dues-design.md` instead: that document
-holds the stored-state rules (`reads` + `require`), compiles but does not bind (PLAY0271,
-PLAY0268), so its specifications are design mode and do not run. A second
+holds stored-state rules as a legacy control without `command reads protected`, so
+it compiles but does not bind (PLAY0271/PLAY0268) and its design specs do not run.
+Eligible reads can instead opt into v25; inspect admission and keep Stage refusal
+separate (command-surface [protected reads](../../cratis-screenplay-command-surface/references/protected-reads.md)). A second
 complete example, with competing claims and denial fixtures, is `berth-reservations.md`. The category structure and the good/bad contrast follow the worked
 examples in `eventmodeling-elaborating-scenarios` by TrogonStack and by Martin Dilger and Nebulit GmbH (`provenance.md`), translated to
 Screenplay specifications.
@@ -104,7 +106,11 @@ in `invoicing-dues-design.md`; it is never prose and never a spec that pretends
 ## 3. External failure: the capture, then the retry
 Two separate obligations. First, the **capture specification**: concrete external input in, our
 facts out. The provider's refusal is a fact (never a `then error`), kept in the provider's
-vocabulary and then translated.
+vocabulary; a separate Automation records the local outcome. The capture uses
+`when added` for first sight and a separate `when outcome` for updates. An update
+spec needs `given capture` with the same key's earlier record; the first record's
+fields are not modifications (root, child or nested). See captures-and-reactions
+`references/record-capture-specifications.md` for runnable first/update/repeat cases.
 ```screenplay excerpt parent=references/invoicing-dues-example.md#1
 specification TranslatingADeclinedCardResult
   when capture PaymentGatewayResults

package/package/corpus/skills/cratis-screenplay-scenario-coverage/references/spec-forms-by-mode.md

@@ -21,7 +21,8 @@ Typed example/override forms: `cratis-screenplay-specifications`
 | Context `from`, single-result filters, `scoped to`, `performer` or composite `by` | yes | PLAY0268: query context, collection-only filtering, opaque scope/implementation or multipart lookup are unadmitted | no |
 | `then no readmodel <RM> for "<key>"` | yes | yes | no |
 | `when query` -> `then result` / `then no result` | yes | yes | same as `then query`: only the query-only cases below |
-| `given clock` / `when clock`, `when trigger`, `given`/`when capture` | yes | yes (standalone and any cratis whose compiler admits v6; an older bundle does not, see toolchain `references/executable-subset.md`) | no |
+| `given clock` / `when clock`, `when trigger`, record-source `given`/`when capture` | yes | yes (standalone and any cratis whose compiler admits v6; an older bundle does not, see toolchain `references/executable-subset.md`) | no |
+| Event-source capture fixtures | `given <FromEvent>` / `when append <FromEvent>`, not capture records (PLAY0701) | admitted root capture behavior executes; see `public-event-coverage.md` for prerequisites and limits | separate target admission |
 | Command spec listing reaction cascade events | yes (v6 semantics) | false PLAY0285 on an older cratis bundle only; see SKILL.md "Version skew" | no: STAGE-ESM-011; generated CommandScenario does not settle reactions |
 | `generated <name> = <value>` under `when`, `then returns` (ESM v7) | yes | yes on a compiler that admits v7 (PLAY0268 on an older bundle) | yes on Stage for supported UUID/String strategies and v15 freshness and scalar/named responses; unsupported types/combinations remain -028/-038 |
 | v15 generation strategy fixtures and used-source rejection | yes | strict encoding/size/case/version/variant; Contract for invalid pins, Concurrency for reused source | supported strategies/freshness render; invalid pins refuse -011, unpinned unordered/projected assertions -038; source: command-surface `references/generated-values-and-responses.md` |
@@ -35,7 +36,10 @@ Typed example/override forms: `cratis-screenplay-specifications`
 | Composite (JSON) values in specs | yes | yes | no |
 | Rules over dates or `today`, nested paths | spec them in design | rule does not bind: `recorded` | `recorded` |
 | Bodied rules, code policies | spec them | spec reported **unsupported**, never passed | no |
-| Command handlers, `file` constraints, query `performer`s | spec them in design | blocked: PLAY0268 at binding, no spec runs (V3 blocked) | no |
+| Pending described command handlers (v23) | specify intent | binds; denial/validation execute, body-reaching specs Unsupported ImplementationBody; all-Unsupported is not green | STAGE-IMPL-002 even Stub mode |
+| Attached command handlers, `file` constraints, query `performer`s | spec them in design | blocked: PLAY0268 at binding, no spec runs (V3 blocked) | no |
+| Atomic reaction mode (v22) | declare for new models | failed batch adds no facts or view changes; earlier batches/commands remain; `then error` alone is insufficient | v22 STAGE-ESM-016; mode in admitted v23–v25 STAGE-ESM-043 |
+| Protected command reads (v25) | declare opt-in for eligible reads | absence Validation; matching intervening facts Conflict; race vectors are not a new spec construct | protected reads STAGE-ESM-044; v25 pair admitted |
 
 Requires Screenplay 4.105.0 or later (`screenplay --version`) for list-query specifications, and 4.143.0 or later for collection equality filters (ESM v14).
 
@@ -49,7 +53,7 @@ older cratis bundle is available). Mark each such spec in the coverage matrix as
 `gap: <reason>` for the narrower modes so the verification and render phases know what will not execute.
 
 ## Executable mode
-- Every gated spec has `given caller`; every given/expected event has `for`, and so does every plain `produces <Name>` (inline `produces event` omits it and defaults to the identifier).
+- Every gated spec has `given caller`; local given/expected events have `for`, and so does every plain `produces <Name>` (inline `produces event` omits it and defaults to the identifier). Foreign event fixtures driving captures may omit `for`; a supplied value is opaque source text, not the capture key.
 - Each read model has one key shared by its keyed `=> RM optional` queries; the identifier equals
   the projection's effective key (`cratis-screenplay-slice-design` `references/read-model-design.md`
   decision table). View specs assert through a keyed query.

package/package/corpus/skills/cratis-screenplay-slice-design/SKILL.md

@@ -157,7 +157,9 @@ When `.screenplay/identities.json` exists, adding, removing or renaming an addre
 Slice design is done when these hold; otherwise report what is open.
 
 - [ ] Every command: origin reachable and authorized; every input traced; rules placed by
-      layer; stored-state rules recorded NOT enforced with a named target; no form-verb name.
+      layer; stored-state rules use admitted protected reads, or name the refused shape
+      and target gap; no form-verb name. Read [protected reads](../cratis-screenplay-command-surface/references/protected-reads.md)
+      for opt-in and Stage refusal; reference protection is not target realization.
 - [ ] Every command has a refusal inventory (success, each refusal with layer and message,
       denied persona); every gated command and query has a `then denied` row.
 - [ ] Every event is past tense, a specific change, and consumed or justified.

package/package/corpus/skills/cratis-screenplay-slice-design/references/command-inventory.md

@@ -171,13 +171,13 @@ Rules for filling it:
 | AssignLocker | caller is not an attendant | `authorize IsAttendant` | denied: Customer | RefusingACustomerAssigningALocker |
 | AssignLocker | locker already has a request | constraint `OneRequestPerLocker` | "The locker is already assigned" | AppendingASecondAssignmentOfALocker (`when append`: the command's own `require` would reject first) |
 | AssignLocker | request already has a locker | constraint `OneLockerPerRequest` | "The request already has a locker" | gap |
-| AssignLocker | locker is not free | `reads` + `require`, NOT enforced today | "The locker is not free"; target: `[ProtectedDecision]` (Arc 22.39.0+; available to Stage 4.73.1 gap-fill, not emitted protection) or DCB on the locker stream | RejectingASecondAssignmentOfALocker (pins the message; blocked until the target exists) |
-| AssignLocker | request is not waiting | `reads` + `require`, NOT enforced today | "The request is not waiting for a locker" | gap (same) |
+| AssignLocker | locker is not free | Legacy example lacks protected-read opt-in; inspect v25 admission and Stage gap | "The locker is not free"; target: `[ProtectedDecision]` (Arc 22.39.0+; available to Stage 4.73.1 gap-fill, not emitted protection) or DCB on the locker stream | RejectingASecondAssignmentOfALocker (pins the message; blocked until the target exists) |
+| AssignLocker | request is not waiting | Legacy example lacks protected-read opt-in; inspect v25 admission and Stage gap | "The request is not waiting for a locker" | gap (same) |
 | LockerById, ListLockers | caller is anonymous | module `authorize IsAuthenticated` | denied: no caller | RefusingAnAnonymousLockerLookup, RefusingAnAnonymousLockerList |
 | RequestById | caller is anonymous | module `authorize IsAuthenticated` | denied: no caller | RefusingAnAnonymousRequestLookup |
 
-The gaps are the hand-off: most are cheap rejection specs, and two are blocked on a target the
-model cannot express yet. A model whose inventory shows no gaps at design time has probably
+The gaps are the hand-off: most are cheap rejection specs, and two need protected-read admission plus separately verified target realization;
+the legacy example has not opted into v25. A model whose inventory shows no gaps at design time has probably
 not been asked the refusal questions.
 
 ## Common mistakes

package/package/corpus/skills/cratis-screenplay-slice-design/references/rule-layers.md

@@ -11,14 +11,16 @@ code only as XML doc comments (Stage#178): a rule that exists only in prose is u
 | who may ask | `authorize` with a policy (role, claim, authenticated) | enclosing gates combine with AND and run first. Gates every command and query in a feature shares go on the feature or module so a new path inherits them |
 | whose instance | policy `claim "x" matches subject` (the command identifier) or `matches <command property>` | executable; renders for text, Uuid, Date and DateTime subjects; an authorized command needs exactly one identifier (STAGE-ESM-015 otherwise) |
 | uniqueness, once-only facts | `constraint` (`unique ... on`, `unique event`) | append-time; the constraint name is its identity |
-| stored state (record exists, balance, current status) | `reads <View>` + `require <expr> message "..."` | stated intent, **NOT enforced in the model today** (PLAY0268/0271 at binding are expected in design mode). Name the target: Arc `[ProtectedDecision]` + `DecisionRead<T>` (Requires Arc 22.39.0 or later), Chronicle DCB (`concurrency` scope), or a constraint |
+| stored state (record exists, balance, current status) | `reads <View>` + `require` with an indented message | opt eligible reads into `command reads protected` (v25); absence Validation, matching intervening facts Conflict. Legacy/refused shapes stay stated intent with a named target mechanism |
 
 An unguarded materialized read is unsafe for a protected decision; a guarded read is the
 supported route. Availability: `[ProtectedDecision]` and `DecisionRead<T>` exist in
 the Arc/Chronicle package set Stage scaffolds (see the Stage skill's `references/rendered-application.md`), but Stage does not emit
 protected decisions. Gap-fill must use an admitted projection/key shape and active
 unit-of-work enrollment; do not edit managed dependencies. Keep the `.play` rule
-NOT enforced until its target enforcement is separately verified. Forbidden: caller-supplied copies of state in `require`, boolean attestation
+target enforcement separate from reference semantics until target tests verify it.
+Read [protected command reads](../../cratis-screenplay-command-surface/references/protected-reads.md)
+for admission and Stage's protected-read refusal (STAGE-ESM-044); never remove protection to obtain rendering. Forbidden: caller-supplied copies of state in `require`, boolean attestation
 inputs (`confirmsX == true`), rules in `handler` / implementation-hint prose.
 
 ## Authorization is executable

package/package/corpus/skills/cratis-screenplay-slice-design/references/slicing.md

@@ -97,14 +97,15 @@ module Moorings
 Record, per slice, the events it consumes and which slice produces each. This is for
 orientation, not a build order: view specifications use synthetic `given` events, so slices
 are built and checked independently. A command or reaction may consult another slice's view
-(`reads`; unprotected in `.play`, see `rule-layers.md`). A slice never calls another slice's
+(`reads`; eligible command reads can opt into v25 protection, trigger reads cannot;
+see `rule-layers.md` for target gaps). A slice never calls another slice's
 command except through `invokes`. Dependencies run in one direction; a cycle through events
 means the story is a feedback loop that belongs in an `Automation` slice.
 
 The contract between slices is events: slice B depends on slice A because B's command, rule
 or view needs an event A produces. Two other edges are supported and recorded explicitly, never
-implied: `reads <View>` from another slice (unprotected, so a stored-state rule over it stays
-NOT enforced, `rule-layers.md`) and `invokes <Command>` from a reaction. No shared state or
+implied: `reads <View>` from another slice (declare protected-command opt-in and
+admission, or mark the legacy/refused shape and target gap, `rule-layers.md`) and `invokes <Command>` from a reaction. No shared state or
 other direct call. Name each
 slice after its element (the command, the view, the automation, the translation (capture or translator reaction)), not a broader feature name
 that spans several. Per slice, record:

package/package/corpus/skills/cratis-screenplay-slice-design/references/worked-example.md

@@ -1,13 +1,13 @@
 # Worked example: parcel lockers (design mode)
 
-One complete model for `cratis-screenplay-slice-design`. It is in **design mode**: V1 clean
-(compiles with warnings as errors); V3 is blocked on purpose by the `ListLockers` list query
-(`PLAY0268` at binding); `given clock` also failed binding on a cratis before 3.28.2 bundle (3.28.2 binds it)
-(`cratis-screenplay-toolchain` `SKILL.md`). Personas and screens are informational.
-The stored-state rules in `AssignLocker` (`reads` + `require`) are intent, not enforced today,
-and they also fail binding on their own: `PLAY0271` on each `reads`, and `PLAY0268` because the
-`require` operands (`locker.assigned`, `request.state`) must be command properties. So this
-document is design mode as a whole: V3 is blocked twice over and no specification runs here.
+One complete legacy design-mode control for `cratis-screenplay-slice-design`, without
+`command reads protected`. Its reads and read paths retain PLAY0271/PLAY0268, so no
+specification runs here. List queries and clock fixtures bind on an admitting compiler;
+they are not the remaining blocker. Personas and screens are informational.
+Eligible command reads can opt into v25; inspect every projection/key/removal before
+migration and retain Stage's separate refusal (STAGE-ESM-044; the v25 pair itself is admitted). Read
+[protected reads](../../cratis-screenplay-command-surface/references/protected-reads.md).
+The unenforced descriptions below refer to this legacy control, not all command reads.
 The specifications still seed every read-model source (`LockerInstalled`, `LockerRequested`,
 complete givens) so they are the right form once binding is possible.
 Lineage matrix: `field-lineage.md`. State-transition table and rule coverage: `slicing.md`.

package/package/corpus/skills/cratis-screenplay-specifications/SKILL.md

@@ -40,41 +40,46 @@ Screenplay's reference runner executes specifications against an immutable
 in-memory world: no Arc, no Chronicle, no database, no network. Every downstream
 target has one normalized behavior to match.
 
-- It runs the capabilities the execution plan admits: declarative validation
-  and `require` over command properties, conditional production, literal tags,
-  declarative policies, `unique` constraints, and projections as Chronicle
-  lowers them. The `cratis-screenplay-model-authoring` language reference lists
-  what binds and what the plan admits.
-- Binding is not admission. These projection constructs bind, but the plan
-  refuses them: a projection-level `remove via join`; `all` beside removals,
-  `children` or `nested`; a `join`, `children` or `remove via join` inside
-  `nested`; and any `$eventContext.<path>` other than `eventSourceId`, such as
-  `$eventContext.occurred`. The limits apply at every ESM version.
-- A specification that needs **opaque code** — a bodied reducer, a rule with a
-  body, a fenced `validate` block, a code policy, or (ESM v6) a reached reaction
-  body — returns **unsupported** and
-  never passes. Authorization is evaluated first, so a `then denied` case still
-  runs when a portable policy decides it. Other specifications in the model run
-  normally.
-- Unsupported reachable declarative constructs block the whole execution plan
-  rather than running partially: no specification in the model runs, including
-  the ones that never touch the refused construct.
-- Reactions: before ESM v6 they never run, not even after `when append`. From ESM
-  v6 they run after every action, as in "Reactions and
-  cascades" ([references/reactions-and-cascades.md](references/reactions-and-cascades.md)). A compiler that stops before ESM v6 fails `when clock`, `when trigger`
-  and `when capture` binding with `PLAY0268`, and so reactions and captures.
-- Children defer until their parent exists; an ambiguous parent still fails closed.
-  [Child ordering](references/child-ordering.md): specs and routing caveat.
-
-  Requires Screenplay 4.149.1 or later (`screenplay --version`) for child deferral.
-- A rejected individual command or append leaves the world unchanged; an accepted
-  one commits once, then the read models and queries are compared. There is no
-  scenario-wide transaction in v6: when a later effect of a cascade or capture
-  rejects, the earlier accepted facts and their projections remain.
-
-Unsupported is not passed. Report it as "needs a target", not as green. "Specified"
-and "bound" are never "passing": run the reference CLI/MCP route or the owning
-target tests, and name the engine, version and expected/discovered selection.
+Binding is not plan admission. Read model-authoring's
+[language reference](../cratis-screenplay-model-authoring/references/language-reference.md)
+when distinguishing executable declarations, refused projection shapes and opaque
+code. Reached opaque code is **unsupported**, never passed; portable denial may
+still execute before it. Unsupported declarative constructs block the whole plan,
+not just the specifications that touch them.
+
+Read [reactions and cascades](references/reactions-and-cascades.md) when testing
+ESM v6 actions; older compilers fail reaction/capture binding with PLAY0268.
+Read [child ordering](references/child-ordering.md) for deferral;
+an ambiguous parent still fails closed.
+Requires Screenplay 4.149.1 or later (`screenplay --version`) for child deferral; older runners do not defer.
+
+A rejected command/append leaves the world unchanged; an accepted one commits
+before comparing views. V6 has no scenario-wide transaction: later cascade
+failure does not roll back earlier accepted facts. Atomic mode boundaries are below.
+
+Unsupported is not passed. Name a target. Run CLI/MCP reference execution
+or target tests; name engine, version and expected/discovered selection.
+
+## Batches, described bodies, protected reads and text rules
+
+- With `reaction batches atomic`, assert no facts from a failed direct-production or
+  selected refusal-branch batch and unchanged views through evaluator world assertions,
+  not only `then error`. `then no events` is acceptance and cannot accompany an error. Earlier
+  accepted batches/invoked commands remain; legacy absence retains per-fact appends.
+  Read [atomic boundaries](../cratis-screenplay-captures-and-reactions/references/atomic-batches-and-source-mappings.md).
+- A described handler binds v23, but reaching its body returns Unsupported
+  ImplementationBody, naming command/RequirementId and emitting no events. Denial and
+  validation cases still run; an all-Unsupported run is never green. Read
+  [described handlers](../cratis-screenplay-command-surface/references/described-handlers.md).
+- Protected command reads opt into v25. Test present/absent state and rule refusal;
+  matching decide/commit changes are Conflict / DecisionStateChanged, not validation
+  refusal. Race vectors are not new specification syntax. Read
+  [protected reads](../cratis-screenplay-command-surface/references/protected-reads.md).
+- Literal text rules use ordinal UTF-16 comparison (v24); matches uses a portable
+  linear matcher, not platform regex. Old invalid/refused patterns plan as
+  UnsupportedValidation, not a successful check. Read
+  [text and match rules](../cratis-screenplay-command-surface/references/text-and-match-rules.md)
+  for boundary values and PLAY0699/0787. Reference success is not Stage admission.
 
 ## Descriptions, persona callers and case tables
 
@@ -102,8 +107,7 @@ Rules the binder enforces:
 - **`then result` and `then no result` need `when query`**, and `when query`
   needs one of them, `then denied` or a sole validation `then error` (`PLAY0465`). Each argument is a `by` or
   `filter` parameter of the query (`PLAY0468`).
-- **A clock instant is ISO 8601 with an offset or `Z`**, such as
-  `"2026-10-05T08:00:00Z"` (`PLAY0461`); `given clock` appears at most once.
+- **A clock instant is ISO 8601 with an offset or `Z`** (PLAY0461); one `given clock` maximum.
 - **`then` contains either events or an error — never both.** A rejection
   specification has exactly one rejection and no success outcome.
 - **`then denied` stands alone**: not with events, errors or state assertions
@@ -114,10 +118,8 @@ Rules the binder enforces:
 - **`null` only in optional read-model values.** A `null` in a command or event
   value is `PLAY0350`: an optional fact is a separate event.
 
-`PLAY0358` is a syntax error (`PLAY0388` also at parse time for extra text after `then denied`). `PLAY0350`, `PLAY0352`, `PLAY0388` (mixed with another outcome), `PLAY0389` and
-the one-rejection rule (`PLAY0273`) are reported only when the model binds, so
-`screenplay --warnaserror` does not show them. Check executable diagnostics
-(the MCP authoring tools) as well.
+V1 does not report binding-only outcome errors; read `references/vocabulary.md`
+for parse-versus-bind diagnostics and check executable diagnostics too.
 
 ## How outcomes are compared
 
@@ -154,12 +156,12 @@ Read [references/reactions-and-cascades.md](references/reactions-and-cascades.md
 
 ## Published-event specifications (released ESM v9)
 
-Use `when append <PrivateEvent>` then `then <PublicEvent>` for outbound publication,
-not `then readmodel`. The follow-up event list is exhaustive and ordered. Read
-[publication example and fold cases](../cratis-screenplay-automations-and-translations/references/public-events-and-direction.md).
-Events-source captures and reached opaque event-target reducers return typed
-Unsupported, not a pass. Composite view fixtures need every key part but remain
-unadmitted (PLAY0268); see read-surface `references/named-keys.md`.
+Use `when append <PrivateEvent>` then `then <PublicEvent>`, not `then readmodel`;
+follow-up events are exhaustive and ordered. Read
+[publication and fold cases](../cratis-screenplay-automations-and-translations/references/public-events-and-direction.md)
+when specifying outbound facts or event-source captures: it owns the minimum
+compiler, PLAY0700/0701, key folding and Unsupported boundaries. Composite view
+fixtures remain unadmitted; see read-surface `references/named-keys.md`.
 
 ## Reusable fixtures, routes and recovery intent
 

package/package/corpus/skills/cratis-screenplay-specifications/references/actions-beyond-commands.md

@@ -7,7 +7,17 @@ A slice is not always set off by a command. Name what does:
 | A view no event builds - its query has a `performer` | `given readmodel` …, `when query <Query>`, `then result` / `then no result` |
 | An automation driven by the clock | `given clock "<instant>"`, `when clock "<later instant>"` |
 | An automation driven by an application trigger | `when trigger <Trigger>` with the values it carries |
-| A translation driven by a capture | `given capture <Capture>` (the record as it was), `when capture <Capture>` (as it is now) |
+| A translation driven by a record capture | `given capture <Capture>` (the record as it was), `when capture <Capture>` (as it is now) |
+| A capture with `source events` | `given <FromEvent>`, `when append <FromEvent>`; capture-record fixtures are PLAY0701 |
+
+A first record is `added` only, including child and nested records; field-change,
+`and`/`or` and transition guards need earlier state for the same key. For first sight
+add a separate `when added` append; for an update seed `given capture`. Requires
+Screenplay 4.175.0 or later (`screenplay --version`); older record evaluators treat
+first-record fields as changed. Complete cases: captures-and-reactions
+[record capture specifications](../../cratis-screenplay-captures-and-reactions/references/record-capture-specifications.md).
+Event captures use the typed event fixtures and overlay rules in
+[public event captures](../../cratis-screenplay-automations-and-translations/references/public-events-and-direction.md).
 
 Use `given clock`, never `given time`, to state the scenario occurrence time and
 assert a value mapped from `$context.occurred`. In a command's `produces`, that

package/package/corpus/skills/cratis-screenplay-specifications/references/generated-fixtures.md

@@ -1,31 +1,42 @@
-## Generated fixtures and return expectations (ESM v7 and v15)
+# Generated fixtures and return expectations
 
-### Choosing a strategy
+## Contents
+
+- Choosing a strategy
+- When not to
+- Fixtures and outcomes
+
+## Choosing a strategy
 
 Use the [shop example](../../cratis-screenplay-command-surface/references/shop-generation.md):
 pin CustomerId (`cus_` + ULID), OrderId (TypeID) and InviteCode (NanoID) as
 whole values. ApiKey stays secret with no executable generation; do not write a
 passing issuance spec that invents its .NET Bytes(32) factory in Screenplay.
-OrderId pins do not realize Arc's received-time/tenant context either.
+Pin InvoiceNumber's whole date/checksum reference and TicketNumber's integral
+pickup-ticket value too; do not use numeric text for Int fixtures.
 
 Choose the concept's strategy for the job, then pin a whole value matching it:
 `for` for its generated identifier, named `generated` fixtures for other values.
 Use the shared [strategy reference](../../cratis-screenplay-command-surface/references/generated-values-and-responses.md)
-for UUID, time-ordered, typed/opaque text and byte-budget choices and exact shapes.
-`given clock` supplies `$context.occurred`, not a generated time-ordered ID;
+for UUID, time-ordered, typed/opaque text, byte budgets, finite patterns and Int
+range choices and exact shapes.
+`given clock` supplies `$context.occurred` and pattern UTC date segments, not a generated time-ordered ID;
 a seed is not a portable fixture.
 
-### When not to
+## When not to
 
 Pins do not prove randomness, authorization, idempotency, storage freshness or
 secret safety. Client-minted IDs stay inputs; gapless invoice numbering needs an
-allocator, not a random fixture. Pattern/random/rule and secret generation remain
-unadmitted. Source: Screenplay
+allocator, not a random fixture or pattern. Check digits catch typos, not forgery;
+short payload codes need uniqueness enforcement separate from source freshness.
+Pattern/random/rule and checksum validation bind as v21. Stage renders
+pattern/random/checksum under the version gates below; `generate rule` remains
+STAGE-ESM-028. Generated secrets remain refused. Source: Screenplay
 `Documentation/screenplay/generated-values/choosing.md`.
 
-### Fixtures and outcomes
+## Fixtures and outcomes
 
-A compiler that admits ESM v7 binds and runs these; Stage renders supported UUID/String generation strategies,
+A compiler that admits ESM v7 binds and runs these; Stage renders supported UUID/String and Int random generation strategies,
 scalar/named responses, fixtures and `then returns`. Unsupported types/result combinations
 remain `STAGE-ESM-028`/`-038`; preserve refused specifications as gap-fill contracts. The model and rules are in `cratis-screenplay-command-surface`; the
 complete threaded model is the linked shop example. The excerpt below belongs
@@ -62,17 +73,37 @@ specification RegistersWithPinnedValues
   own destinations. For commands without a generated identifier `when ... for` keeps the destination assertion.
   UUID fixtures require canonical lowercase hyphenated form. From v15, pins must also match
   exact strategy size, case, UUID version/variant and zero trailing encoding bits; invalid pins are
-  Contract rejections. Earlier models check canonical UUID type, not its version.
+  Contract rejections. A generated concept with rules selects v20 and checks pins
+  against both shape and rules, including implicit UUID. Rule failures are
+  `Rejected(Contract)` with `Generated fixture '<property>' fails concept '<Concept>' rules`,
+  never client validation failures or redraws. Earlier rule-free implicit-UUID
+  models check canonical UUID type, not its version.
 - A serialized concept generation strategy selects v15 and Guarded whole-source freshness for all
   generated destinations, including implicit UUIDs. Reusing a generated source with existing facts
-  rejects the entire command with Concurrency, without append, response or silent retry. Below v15
-  fixtures retain legacy reuse. See the complete [strategy example](../../cratis-screenplay-toolchain/references/generation-strategies-example.md)
+  rejects the entire command with Concurrency, without append, response or silent retry.
+  Models without a serialized strategy retain legacy reuse even when rules select v20. See the complete [strategy example](../../cratis-screenplay-toolchain/references/generation-strategies-example.md)
   and command-surface `references/generated-values-and-responses.md` for tagged sources.
-- `given clock` supplies `$context.occurred`; it does not synthesize UUIDv7, ULID or
-  TypeID from that instant. Pin the whole identifier, never a seed. Stage's
-  time-ordered factories use wall clock, not command-receipt time, and its clock
-  specifications remain unsupported. Sources: Screenplay
+- `given clock` supplies `$context.occurred` and requires all pattern date segments
+  to match the same UTC instant, including offset rollover and leap days. Without
+  a clock the reference runner checks digit widths, never today's wall clock.
+  Checksum pins check arithmetic only with an authored `validate checksum` rule;
+  a generation modifier alone checks suffix shape. It does not synthesize UUIDv7,
+  ULID or TypeID: pin the whole identifier, never a seed. Stage time-ordered
+  factories use receipt time; admitted command clock specs render. Sources: Screenplay
   `Documentation/screenplay/generated-values/choosing.md`; Stage
   `Documentation/reference/generated-values-rendering.md`.
+- Attached generation bodies are not run: pin the resulting String;
+  an opaque validator still yields Unsupported. Stage allows unpinned rendered
+  generation only when every concept rule is Proven and the expectations support
+  relational captures. Unproven/Refuted rules need pins (-038); invalid pins fail
+  STAGE-ESM-011. Opaque/unsupported rules refuse -005 before pin evaluation.
+  Screenplay's reference runner and Stage's independent executor always need pins.
 - A reaction-invoked command that reaches generation is `Unsupported(IdentityAllocation)` (no fixture channel); a
   response-only command runs and its response is discarded.
+
+Requires Screenplay 4.164.0 (`screenplay --version`) for v20 rule-bearing generated pins, 4.172.0 for v21 finite/rule strategies; older compilers refuse PLAY0268.
+Requires Stage 4.95.0 for command clock specs and 4.109.0 for v20 rule-bearing pins; older renderers refuse those shapes.
+Requires Stage 4.115.0 for v21 admission/all-Proven unpinned rendering, 4.117.0
+for warning/info generated-concept rules, 4.118.0 for checksum validation and
+4.119.0 for pattern/random. Older renderers require rule-bearing pins or refuse
+the respective rules/strategies with -038/-042/-028. `generate rule` remains -028.

package/package/corpus/skills/cratis-screenplay-specifications/references/vocabulary.md

@@ -1,3 +1,6 @@
+<!-- Copyright (c) Cratis. All rights reserved. -->
+<!-- Licensed under the MIT license. See LICENSE file in the project root for full license information. -->
+
 # The specification vocabulary
 
 This reference holds the given/when/then construct table and the enumeration and DateTime literal rules.
@@ -17,7 +20,7 @@ This reference holds the given/when/then construct table and the enumeration and
 | `given clock "<instant>"` | the ISO 8601 instant the scenario happens at |
 | `when clock "<instant>"` | the clock reaches an instant; scheduled reactions that are due run |
 | `when trigger <Trigger>` | an application trigger fires with the values beneath it |
-| `given capture` / `when capture <Capture>` | an earlier and the current record of a capture's source |
+| `given capture` / `when capture <Capture>` | earlier/current records for non-event sources; for `source events` use typed `given <Event>` / `when append <Event>` (PLAY0701) |
 | `generated <name> = <value>` | beneath `when <Command>`: the fixture for a generated property other than the identifier (ESM v7); `for` beneath the `when` supplies the generated identifier |
 | `then returns [<value>]` | the command's response (ESM v7): `then returns "<uuid>"` for a scalar, `then returns` with named `field = value` lines for a subset of a record |
 | `then <EventType>` | an expected new event |
@@ -32,6 +35,16 @@ This reference holds the given/when/then construct table and the enumeration and
 | `for <value>` | the event source of a `given`/`then` event, or of the `when` command or appended event |
 | `<property> = <value>` | a literal, `null`, or a one-line JSON-shaped object or list: `lines = [{"sku":"A-1","quantity":2}]` |
 
+## Parse and binding diagnostics
+
+PLAY0358 is a syntax error; PLAY0388 also occurs at parse time for extra text
+after `then denied`. PLAY0350, PLAY0352, PLAY0388 for mixed outcomes, PLAY0389 and
+the one-rejection rule PLAY0273 occur only at binding. Source validation alone
+will not report them: check executable diagnostics as well. Clock instants need
+an ISO 8601 offset or `Z`, for example `"2026-10-05T08:00:00Z"` (PLAY0461).
+
+## Literal spellings
+
 An enumeration value binds whether it is written bare
 (`status = sent`), qualified (`status = InvoiceStatus.sent`) or quoted, and a
 `DateTime` value binds as a plain ISO 8601 instant (`"2026-10-05T08:00:00Z"`).

package/package/corpus/skills/cratis-screenplay-streams-and-consistency/SKILL.md

@@ -26,17 +26,15 @@ Read [references/product-sources.md](references/product-sources.md) when checkin
 - Not for: projection and query syntax, reactions and captures, writing the specifications
   themselves (`cratis-screenplay-scenario-coverage`), Chronicle C# mechanics
   (`cratis-chronicle-event-modeling`). See Route near misses.
-- Model-first applies: when an accepted model covers the scope, change the model and its
-  specifications, not code. Do not weaken authorization, `pii` or rules to make a model compile.
+- Apply model-first per `cratis-screenplay-modeling-lifecycle`; never weaken
+  authorization, `pii` or rules to compile.
 
 ## Interview phase
-**Skip if** the user or the model already states the stream identities, who owns each module, how
-much autonomy each side has, the external systems, and rough growth. Otherwise ask only what is
-missing, one question at a time, with options. **Unattended:** assume the most conservative
-option, mark it `ASSUMED` in the slice or module `documentation` and in the session `STATE.md`
-(`.ai-work/screenplay/<model-slug>/STATE.md`), and continue.
-
-Ask only what is missing: (1) instance - what real-world thing the stream is about; (2) competition - what must never happen when two people act at once; (3) retry - what a repeated request should see; (4) ownership; (5) growth; (6) change - whether the event was ever stored in a running system. Read [references/interview-batch.md](references/interview-batch.md) for each question's follow-up; ownership options are in `references/boundaries.md`.
+Read [interview prompts](references/interview-batch.md) when identity, competition,
+retry, ownership, growth or stored-event history is unsettled. Ask only missing
+questions, one at a time; ownership options are in `references/boundaries.md`.
+Unattended work takes the conservative option and marks it `ASSUMED` in model
+`documentation` and `.ai-work/screenplay/<model-slug>/STATE.md`.
 
 ## Procedure
 1. **Establish identity and membership.** For every `concept XId` used as an `identifier`, write
@@ -87,14 +85,10 @@ Ask only what is missing: (1) instance - what real-world thing the stream is abo
    (PLAY0270), not runtime propagation or generated C# `[Subject]`. Without a
    supplied subject, the runtime defaults to the event source; see command-surface
    `references/compliance.md` for allowed types and the policy/encryption distinction.
-5. **Plan evolution** with `references/evolution.md`: classify each event change (additive,
-   meaning change, rename, removal, split or merge) and write its compatibility scenarios before
-   editing. Admit the **release baseline** in the release job; admitted
-   revisions need `newGeneration`. Modes/CLI/MCP: `references/evolution.md`.
-   Pin persisted/public enum member numbers before reordering or removing members (`references/evolution.md`, "Enum member numbers").
-
-   Renames and other identity-affecting edits are made by the identity owner (the
-   identity procedure in `cratis-screenplay-modeling-lifecycle`).
+5. **Plan evolution**: read `references/evolution.md` before editing stored contracts
+   for change classification, compatibility scenarios and enum-number safety.
+   After release-baseline admission, revisions need `newGeneration`. Identity-affecting edits belong to the
+   identity owner (`cratis-screenplay-modeling-lifecycle`).
 6. **Test ownership and interfaces** with `references/boundaries.md`: ownership interview,
    interface and processor inventory, one real interaction walked across each boundary, coupling
    check. Keep team, module, stream and deployment boundaries distinct; inbound facts via
@@ -108,15 +102,19 @@ Ask only what is missing: (1) instance - what real-world thing the stream is abo
 - `identifier` on an event property is PLAY0019; the source id is never payload by declaration.
   Copying it as a payload value is PLAY0469 (information, warning for inline events).
 - In the executable model a production's `for` must resolve to the command's scalar identifier:
-  one command writes one stream declaratively (a handler is never admitted).
+  one command writes one stream declaratively; described handlers bind v23 but
+  their payload-only contract does not grant arbitrary destinations.
 - Constraint names are application-wide identities (PLAY0392); properties must be declared
   directly on the event (PLAY0391); never mix event and property rules under one name (PLAY0135);
   `ignore casing` is not allowed on `unique event` (PLAY0393).
 - Generations are declared in full, numbered 1..N without gaps, in the same slice (PLAY0446-0448); `id` pins are shared by all generations and unique application-wide (PLAY0472); `storedName` needs ESM v16. See `references/evolution.md` ("Generations, pins and storedName diagnostics").
 
-- `reads` is PLAY0271 and `require` over read-model paths is PLAY0268 at binding. A `concurrency`
-  block compiles but is PLAY0271 at binding. Keep both when they state real intent; they are not
-  protection. `description` text never reaches rendered code: a rule that lives only in prose is
+- Application-root `command reads protected` admits eligible reads and single-level
+  requirement/mapping paths (v25). Absence rejects, matching decide/commit changes
+  conflict. Legacy reads remain PLAY0271/PLAY0268; `concurrency` remains unbound and
+  combining it with protected reads is PLAY0783. Read
+  [protected reads](../cratis-screenplay-command-surface/references/protected-reads.md)
+  for admission and Stage's STAGE-ESM-044 protected-read refusal (the v25 pair itself is admitted). `description` text never reaches rendered code: a rule that lives only in prose is
   unenforced there.
 - `pii` and `secret` bind as ESM v13;
   enum/identity compliance and protected events with explicit subject marks still
@@ -144,6 +142,12 @@ Requires Chronicle 19.59.6 or later (19.59.3 for the InMemory provider) for the
 - Give each invariant an authoritative atomic decision point and inspect every path that could
   violate it. A constraint violation rejects that command's whole append set; a reaction cascade
   is not one transaction. Declared semantics are not a passed concurrency test.
+- New models declare `reaction batches atomic`: direct productions per trigger
+  occurrence and each selected refusal branch are separate batches; invoked commands
+  stay independent. Legacy absence retains per-fact appends. Stage refuses v22
+  with STAGE-ESM-016 and atomic mode in admitted v23–v25 with STAGE-ESM-043. Read
+  [atomic boundaries](../cratis-screenplay-captures-and-reactions/references/atomic-batches-and-source-mappings.md)
+  when defining failure rollback; batching is not redelivery deduplication.
 - Match duplicate protection to scope. A property constraint lets a source re-claim its own
   value; use `unique event` for a fact that is genuinely once-only in its lifecycle, without
   blocking legitimate repeated operations just to make retries safe.

package/package/corpus/skills/cratis-screenplay-streams-and-consistency/references/boundaries.md

@@ -80,8 +80,8 @@ For each affected boundary, identify:
 
 Use declaration addresses, not copies of payloads. Per slice, also record the events it consumes
 and which slice produces them, for orientation, not as a build order. A command or reaction may
-consult another slice's view (`reads`; unprotected in `.play`, see `consistency-and-concurrency.md`
-section 3); a slice calls another slice's command only through `invokes`.
+consult another slice's view (`reads`; eligible commands opt into v25 protection,
+trigger reads cannot; see `consistency-and-concurrency.md` section 3 for target gaps); a slice calls another slice's command only through `invokes`.
 
 ### Responsibility matrix and ownership timeline
 One compact matrix per feature shows who owns what; the timeline shows where a fact crosses.