@cratis/pi 7.61.0 → 7.63.0

package/package/corpus/skills/cratis-screenplay-streams-and-consistency/references/consistency-and-concurrency.md

@@ -57,8 +57,8 @@ observed legacy check from verified atomic protection.
 | several command properties / constants | `require` | runs after property rules, before production |
 | a value across all sources | `unique <prop> on <Event>` | value owned by one source; same source may re-claim |
 | a fact at most once per source; mutually exclusive facts | `unique event` (+ `released by`) | covers simple lifecycle transitions |
-| state-dependent rule not reducible to the supported uniqueness/release semantics (a balance, capacity, "only if approved") | no protected decision read in `.play` today | state it as `reads` + `require … message`, mark NOT enforced, name the target enforcement (below) |
-| a view (read model) | an unguarded materialized read is not protection | views lag; `reads` is PLAY0271, `require` over views PLAY0268 at binding (expected in design mode) |
+| state-dependent rule (balance, capacity, "only if approved") | eligible `reads` + `require` under `command reads protected` (v25) | required absence rejects; matching intervening facts conflict. Payload-key fan-in, joins, reducers and other refused shapes remain target gaps |
+| a view (read model) | unguarded materialized reads are not protection | legacy command and trigger reads remain unprotected; Stage refuses protected reads (STAGE-ESM-044), so reference protection is not target realization |
 
 ## 3. Record each state-dependent rule that the model cannot enforce
 Never accept the caller's copy of the state: `currentStatus Status` on the command with
@@ -67,7 +67,13 @@ input (`confirmsX == true`) standing in for the rule. Never move the rule into `
 `implementation hint` prose; a description renders only as an XML doc comment (Stage#178), so prose alone leaves
 the rule unenforced in rendered scope.
 
-Right: write the rule as stated intent and mark it unenforced.
+First inspect [protected reads](../../cratis-screenplay-command-surface/references/protected-reads.md):
+opt eligible command reads into v25, retain absence/conflict specifications and verify
+target consistency separately. Stage admits v25 but refuses protected reads (STAGE-ESM-044). A payload-keyed
+fan-in such as the course-capacity example remains refused; the preamble is not a
+blanket admission of arbitrary projections.
+
+For legacy models without opt-in or refused shapes, write stated intent and mark it unenforced.
 - `reads <View> as x by …` plus `require <expr over x> message "…"` on the command (the
   `StateChange` slice in `streams-example.md`). Binding reports PLAY0271 / PLAY0268; that is
   expected in design mode, so keep the lines. Do not remove them to pass a tool.
@@ -101,9 +107,11 @@ another event source) in `Provide()`/`Handle()` and returning a validation resul
 at commit is reported as a concurrency violation. Equivalently a Chronicle decision-consistency
 read with a `concurrency` scope on the event source or stream. A passive read is fresh
 computation, not an atomic read-and-append; a plain materialized view and a validator are
-advisory. Protection covers only a single projection keyed directly by the event source id (routing key
-empty or `$eventSourceId`). Reducers, joins, children, nested sources and **event-property
-routing** (fan-in from many streams by a payload reference) are refused, and a concurrency scope
+advisory under Arc read protection `Off` (the default); under `On` (Arc 22.106.0 or later) the read
+model parameters of `Handle()` and of a validator constructor are guarded. Protection covers a single
+projection keyed directly by the event source id (routing key empty or `$eventSourceId`) and an
+unfiltered reducer without constructor dependencies. Filtered reducers, reducers with dependencies,
+joins, children, nested sources and **event-property routing** (fan-in from many streams by a payload reference) are refused, and a concurrency scope
 on the referenced source does not see appends made on other sources. A rule over such a view, for
 example a course capacity computed from enrolment streams, needs option a or b: write the
 deciding fact on the source that owns the state, or give each scarce item its own identity. Sources: Arc `Documentation/backend/csharp/chronicle/read-models/injecting-into-commands.md` (limits unchanged);

package/package/corpus/skills/cratis-screenplay-streams-and-consistency/references/multi-service-models.md

@@ -115,9 +115,10 @@ module Billing
   another reason each service has its own folder.
 - A capture keys on the incoming content, so the contract carries the identity
   the consumer keys on.
-- The producer's publication specification runs in the reference evaluator; the
-  consumer's capture over events binds but evaluates as typed Unsupported. Specify
-  the consumer's private behavior downstream of the capture.
+- Both sides run in the reference evaluator: the producer's publication
+  specification, and the consumer's capture over events, which a specification
+  drives by presenting the consumed public event (`when append <Event>`;
+  Requires Screenplay 4.171.0).
 - Syntax, publication semantics and the full rules: read
   `cratis-screenplay-automations-and-translations`
   `references/public-events-and-direction.md`.

package/package/corpus/skills/cratis-screenplay-streams-and-consistency/references/streams-example.md

@@ -1,5 +1,12 @@
 # Example: streams, constraints and a recorded rule
 
+Legacy control: no `command reads protected` preamble is declared. The course-capacity
+payload-key fan-in remains refused even with opt-in; eligible active-enrolment reads
+can protect under v25, but reads plus concurrency cannot combine (PLAY0783). Read
+[protected reads](../../cratis-screenplay-command-surface/references/protected-reads.md)
+for admission and Stage's protected-read refusal (STAGE-ESM-044). The legacy diagnostics below describe this
+control, not a blanket refusal of command reads.
+
 A complete design-mode model for course enrolment. It shows one business identity per stream,
 cross-stream references as payload, three kinds of uniqueness constraint, a state-dependent
 rule recorded as **NOT enforced in the model today**, a declared `concurrency` scope, and an

package/package/corpus/skills/cratis-screenplay-toolchain/SKILL.md

@@ -8,12 +8,9 @@ license: MIT
 
 Read [preferred syntax](references/preferred-syntax.md) when writing or reviewing `.play`.
 
-Which tool to run, what its result means, and what each tool can and cannot admit. This
-skill answers "does it compile, bind, render, and which compiler said so". The method
-(what to model, in which order, with which gates) lives in
-`cratis-screenplay-modeling-lifecycle`; construct syntax lives in the construct skills
-(`cratis-screenplay-command-surface`, `-projections`, `-read-surface`,
-`-captures-and-reactions`, `-specifications`, `-ui-composition`).
+This skill owns tool selection, verdict meaning and admission. Modeling method
+lives in `cratis-screenplay-modeling-lifecycle`; construct syntax lives in command,
+projection, read-surface, capture/reaction, specification and UI skills.
 
 ## Locate the model
 
@@ -28,7 +25,11 @@ bundled in the CLI are different releases, and the bundled one can be older; a c
 standalone tool binds may be refused or unrendered through the CLI. Capabilities that need a
 minimum release carry a one-line `Requires ...` note in the reference that teaches them.
 
-For exact diagnostic codes, MCP names/parameters and standalone CLI options, search the large published [references/screenplay-contract.json](references/screenplay-contract.json), named by [references/screenplay-contract.version](references/screenplay-contract.version), rather than loading it in full. Locate a diagnostic by its exact `code` (for example `"code": "PLAY0029"`), a tool by its exact `name` (for example `"name": "read-workspace"`), or a command in `cliCommands`; read the matched object for retirement, parameters or options. [references/screenplay-contract-exceptions.json](references/screenplay-contract-exceptions.json) records reasoned exceptions for superseded statements; it does not change the current contract.
+Search [screenplay-contract.json](references/screenplay-contract.json), not its
+whole contents, for exact diagnostic `code`, tool `name` or `cliCommands` options.
+Its version is [screenplay-contract.version](references/screenplay-contract.version).
+Read [contract exceptions](references/screenplay-contract-exceptions.json) when a
+superseded statement needs context; exceptions do not change the contract.
 
 ## Ground rules
 
@@ -101,8 +102,11 @@ changes with the root folder name.
   lists and lists narrowed by one `by` key (observable too) bind; caller-supplied equality
   filters on collections bind as ESM v14. Context `from`, single-result
   filters, opaque `scoped to`/`performer` and composite `by` remain PLAY0268. Read
-  read-surface [equality filters](../cratis-screenplay-read-surface/references/equality-filters.md). No handler (PLAY0268, with or without `implementation`/`hint`); `reads` and
-  `concurrency` do not bind (PLAY0271); concept compliance binds as v13 (precise refusals: command-surface `references/compliance.md`);
+  read-surface [equality filters](../cratis-screenplay-read-surface/references/equality-filters.md).
+  Pending handlers beside unconditional productions bind as described commands (v23),
+  but reached bodies are Unsupported; attached handlers remain PLAY0268.
+  Eligible protected reads opt into v25; legacy reads and `concurrency` retain PLAY0271.
+  Concept compliance binds as v13 (precise refusals: command-surface `references/compliance.md`);
   generated values and `returns` responses bind (ESM v7, `references/generated-responses-example.md`). Read [references/executable-example.md](references/executable-example.md) when you need a small StateChange and StateView model that binds executable, [references/pdl-example.md](references/pdl-example.md) when writing projection forms that bind and run, and [references/automation-translate-example.md](references/automation-translate-example.md) when writing Automation and Translate slices (ESM v6).
 - **Renderable** (V5): `references/renderable-subset.md` has the admission table. The CLI admits through
   its newest known ESM version to construct checks; supported UUID/String
@@ -119,18 +123,22 @@ changes with the root folder name.
   Composite view keys remain authoring-only (PLAY0268), while one explicit
   `key` binds. Read `references/production-routes-and-filters.md` and read-surface
   `references/named-keys.md`.
-- **Enum numbers (v12):** non-positional enum numbers bind; canonical
-  `numbers` parallels `values`. Positional pins preserve earlier executable
-  bytes/version. Specifications still use names. Stage admits v12 and emits `Member = N`. Syntax:
-  command-surface `references/enum-numbers.md`; errors PLAY0667–0670 and opt-in
-  `enum-pinning` hint PLAY0671: `references/diagnostics.md`.
-- **Concept strategies (v15):** concept strategies and Guarded freshness; strict fixture shapes,
-  no silent retry. Read [references/generation-strategies-example.md](references/generation-strategies-example.md)
-  and command-surface `references/generated-values-and-responses.md` for supported strategies/refusals.
-- **v17–v20:** recovery/no-event assertions (v17), query Validation errors (v18),
-  invocation refusal branches (v19), generated-concept rules (v20). Read
-  `references/executable-subset.md` when choosing a version; specifications and
-  command-surface references own examples. Newer binding is not render admission.
+- **Enum numbers (v12):** read command-surface `references/enum-numbers.md` for
+  pins, stored numbers and Stage output; `references/diagnostics.md` owns PLAY0667–0671.
+- **Concept strategies (v15):** read
+  [generation strategies](references/generation-strategies-example.md) for Guarded
+  freshness and strict fixtures, and command-surface
+  `references/generated-values-and-responses.md` for strategy/refusal depth.
+- **v17–v21:** recovery/no-events (v17), query Validation errors (v18), refusal
+  branches (v19), generated-concept proofs (v20), pattern/random/rule/checksum (v21).
+  Read `references/executable-subset.md` for version prerequisites and
+  `references/diagnostics.md` for proof/support failures. Binding is not rendering.
+  Tool/renderer authors: read [references/generation-checks.md](references/generation-checks.md)
+  when discovering strategy options, checking one concept or value, or consuming rule proofs.
+- **v22–v25:** read [language admission](references/language-admission.md) for atomic
+  batches, described handlers, text rules, protected reads and Stage refusals.
+  Read [diagnostic arguments](references/diagnostic-arguments.md) for MCP/JSON subjects:
+  code and typed arguments, never message parsing.
 - **Caller/compliance metadata:** `$identity` aliases caller built-ins;
   additional identity details are metadata and executable reads still refuse.
   Bare `pii`/`secret` replace legacy spellings; `pii personal` repeats one marker
@@ -186,7 +194,7 @@ Read [references/diagnostics.md](references/diagnostics.md) when a PLAY, STAGE o
 11. Declare an event once, in its producing slice.
 12. Quoted `import "glob"` is your own files; unquoted `import Ctx.Event` is a foreign
     contract and does not bind.
-13. A handler never binds; `numbers exact` never binds; descriptions render only as XML doc comments, never as behavior.
+13. Pending described handlers bind but do not execute their bodies; attached handlers and `numbers exact` do not bind. Descriptions render as XML doc comments, not behavior.
 
 ## Gate
 

package/package/corpus/skills/cratis-screenplay-toolchain/references/cheat-sheet-example.md

@@ -2,7 +2,9 @@
 
 One complete document with every construct family. Design mode, not executable. Prose rules: [cheat-sheet.md](cheat-sheet.md); what binds: [executable-subset.md](executable-subset.md).
 
-Binding blockers: unquoted import, `reads` (PLAY0271), `starts with`. Caller-supplied collection equality filters bind as ESM v14; context and single-result filters remain blocked. Executable shapes are in the sibling examples. `RecordingAPayment` lists the `InvoiceClosed` cascade; an older bundled compiler rejected it with a false PLAY0285 ("outcome cannot be produced by 'RecordPayment'").
+Binding blockers in this legacy control without protected-read opt-in: unquoted
+import, legacy `reads` (PLAY0271), condition-only `starts with` (PLAY0268).
+Property/concept text rules bind v24; eligible protected reads bind v25. Caller-supplied collection equality filters bind as ESM v14; context and single-result filters remain blocked. Executable shapes are in the sibling examples. `RecordingAPayment` lists the `InvoiceClosed` cascade; an older bundled compiler rejected it with a false PLAY0285 ("outcome cannot be produced by 'RecordPayment'").
 
 Concept compliance itself binds as ESM v13; reasons remain report-only PLAY0270. Stage renders v13 concept
 protection. Binder-only PLAY0268 refusals and subject-lineage limits: command-surface `references/compliance.md`.

package/package/corpus/skills/cratis-screenplay-toolchain/references/cheat-sheet.md

@@ -10,11 +10,23 @@
 - `$context.` paths (command `produces`)
 - `$eventContext.` (projections)
 - PDL quick reference (most forms are compiled in `pdl-example.md` or `cheat-sheet-example.md`; `remove via join` and `$eventContext.occurred` are not)
+- Generated values and proofs
 - Specification forms
 
 Released boundary forms: `public event X`, `event X from "store"`, Translate
 `direction inbound|outbound`, event-target `projection/reducer P => PublicEvent`,
-and capture `source events` with `from ForeignEvent` select v9. Read
+and capture `source events` with `from ForeignEvent` select v9.
+For event captures, present `given <FromEvent>` / `when append <FromEvent>`, not
+capture records (PLAY0701). The key must be required on every `from` event, never
+a context key (PLAY0700). PLAY0701 repairs only an unambiguous single-`from` capture;
+PLAY0700 has no automatic repair.
+Requires Screenplay 4.171.0 or later (`screenplay --version`); older runners do not
+deliver these events to captures.
+A directionless Translate reacting without a `from` route to its own capture's
+append warns PLAY0694 (fails `--warnaserror`): move the reaction to Automation,
+keeping the capture in Translate. No automatic split.
+Requires Screenplay 4.176.0 or later; older compilers leave that shape unchecked.
+Read
 [public contracts](../../cratis-screenplay-automations-and-translations/references/public-events-and-direction.md).
 View properties use trailing `key`; multipart `by` query/read blocks remain
 PLAY0268, not v10. Read [named keys](../../cratis-screenplay-read-surface/references/named-keys.md).
@@ -71,9 +83,14 @@ remain unadmitted. Compile and test each relevant fixture with the chosen tool.
   require that position. Source preambles precede declarations.
 - Strings: `"..."`, escapes `\" \\ \n \r \t`; other backslashes kept (regex `"^INV-\d{6}$"` works).
 - Structured values: single-line JSON, quoted keys (`[{"sku": "A-1", "quantity": 2}]`).
+- Literal property/concept text rules use `contains`, `not contains`, `starts with`,
+  `ends with` with quoted operands (v24, ordinal UTF-16). Portable `matches` refuses
+  nonportable constructs with PLAY0699; exact Studio patterns warn PLAY0787.
+  Read command-surface [text and match rules](../../cratis-screenplay-command-surface/references/text-and-match-rules.md).
 - One condition grammar (policy `require`, `produces when`, `require`, reaction `where`): `and`
   binds tighter than `or`; operators `== != > >= < <= contains`, `starts with`; claims use
-  `claim "x" matches "v"` (not `==`: PLAY0120).
+  `claim "x" matches "v"` (not `==`: PLAY0120). Text operators here are condition-only
+  authoring syntax (PLAY0268 at binding), not the admitted property text rules.
 - Keyword escape `@name` for properties named `tag`, `authorize`, `produces`, `reads`, `file`,
   `validate` (enum value), `sequence`, `occurred`, `causedBy`, `namespace`, `correlation`,
   `causation`, and projection `key`/`parent`/`with`.
@@ -153,6 +170,34 @@ collections (path below them: PLAY0297 E). Unknown member: PLAY0295/0296 W.
 - One `every`/`all` block per level for the executable model (else PLAY0268).
 - Templates (`` `${a}` ``) and `$causedBy` parse but do not bind (PLAY0268).
 
+## Generated values and proofs
+
+Choose readable invoice/order references with `generate pattern "INV-{yyyy}{MM}-#{7}" checksum luhn`
+on a String concept and author `validate checksum luhn` separately. `#`, `?`, `*`
+mean digit, uppercase letter, letter-or-digit; ASCII classes and repeats up to
+64 are finite. UTC segments are `{yyyy}`, `{yy}`, `{MM}`, `{dd}`. Int
+`generate random 100000..999999` is inclusive; `generate rule Name` attaches one
+file/tagged fence with Now/Tenant context and unknown entropy. These are ESM v21.
+Requires Screenplay 4.172.0 (`screenplay --version`) for these constructs; older compilers report PLAY0268.
+Sequence and generated secrets remain refused.
+
+Generated-concept rules select v20 (older compilers refuse them with PLAY0268): Proven silent, Refuted PLAY0688 plus witness, Unproven PLAY0689
+plus reason. Finite support exhaustion is PLAY0691, empty support on a scanned
+date PLAY0692, not a proof warning. MCP rules[]/derivedPattern support typed
+matches/PLAY0688 repair proposals.
+Requires Screenplay 4.173.0 for those MCP fields; older servers omit them.
+See [generation example](generation-strategies-example.md).
+
+Pin whole identifiers with `for`, other values with named `generated`; pins obey
+shape and rules. `given clock` fixes all UTC pattern date segments, not randomness;
+without it only digit widths are checked. Patterns are not gapless sequences or
+secrets; check digits catch typos, not forgery. Short payload codes need uniqueness,
+generated source destinations need freshness. Read
+[Stage admission](../../cratis-stage-rendering-and-sandbox/references/admission.md)
+for v21 admission, all-Proven unpinned specs and the separate prerequisites for
+warning/info rules, checksum validation and pattern/random rendering.
+`generate rule` remains STAGE-ESM-028. Reference binding is not rendering.
+
 ## Specification forms
 Full list with semantics: `Documentation/screenplay/specifications.md`. Compiled in the
 examples: `given caller` (+`authenticated`, `role`), `given clock`, `given <Event> for`,

package/package/corpus/skills/cratis-screenplay-toolchain/references/diagnostic-arguments.md

@@ -0,0 +1,60 @@
+<!-- Copyright (c) Cratis. All rights reserved. -->
+<!-- Licensed under the MIT license. See LICENSE file in the project root for full license information. -->
+
+# Read diagnostic subjects from arguments
+
+Requires Screenplay 4.194.0 or later (`screenplay --version`) for typed diagnostic arguments; older diagnostics may omit the field.
+
+Use code plus declared `arguments` to identify subjects, never parse message text.
+Messages are display prose and may be reworded. Published names, kinds, meanings
+and optionality are permanent; tolerate unknown names and keyword values.
+Missing `arguments` remains readable; no subjects is `{}`; optional subjects are
+omitted when unavailable. This changes neither text output nor ESM version.
+
+The `screenplay` MCP server's `diagnostics`, `read-workspace` executable diagnostics,
+proposal `diagnostics` and `introducedExecutableErrors[].arguments`, plus the CLI's
+JSON output, expose the same structure. Resolve the harness-native tool name from
+the listing; this is not a new diagnostic tool. C# exposes Diagnostic.Arguments.
+
+```json
+{
+  "specification": { "kind": "specification", "path": ["Billing", "Invoices", "SendReminder", "Overdue"] },
+  "step": { "kind": "keyword", "value": "when" },
+  "stepIndex": { "kind": "index", "value": 0 },
+  "property": { "kind": "text", "value": "amount" }
+}
+```
+
+Each argument is keyed by name. `text` is verbatim authored text, `keyword` a stable
+never-localized language spelling, `index` a zero-based number. A declaration uses
+its declaration kind as `kind` (for example `specification`) and `path`, not a
+`value`: module if present, features outermost first, slice if present, declaration
+name; never repeat a slice's own name. Specification names are authored names;
+a separate `case` names an expansion. Argument order is immaterial.
+
+## Codes with declared subjects
+
+`?` denotes optional. Except where marked, arguments are text.
+
+| Code | Arguments |
+| --- | --- |
+| PLAY0044, PLAY0075, PLAY0101, PLAY0518 | `text` |
+| PLAY0351 | `readmodel`, `property` |
+| PLAY0468 | `query?`, `argument` |
+| PLAY0514, PLAY0519 | `property` |
+| PLAY0520 | `example`, `type?`, `kind?` (keyword: event, command, readmodel, concept, type, example) |
+| PLAY0521 | `example` |
+| PLAY0522 | `example`, `kind`, `expectedKind` (both keyword: event, command, readmodel) |
+| PLAY0523 | `example`, `type`, `property?` |
+| PLAY0524 | `specification` (declaration), `step` (keyword), `stepIndex` (index), `property`, `type`, `example?`, `case?`, `parameter?` |
+| PLAY0525, PLAY0526 | `example` |
+| PLAY0583 | `case?`, `parameter?`, `type?`, `text?` |
+
+For PLAY0524, `step` is given, given readmodel, when, when append or then.
+`stepIndex` counts every authored given/when/then clause once across all forms,
+not nested lines, synthesized callers or defaults. Example/case expansion retains
+that position. Read the missing property and its type directly, navigate the
+specification path and optional case, then repair the effective fixture; do not
+infer these from a translated message. Codes outside this table may have no
+subjects, including PLAY0198. Check the published contract for the code rather
+than assuming every diagnostic names a declaration.

package/package/corpus/skills/cratis-screenplay-toolchain/references/diagnostics.md

@@ -14,6 +14,7 @@
 - Structural completeness and timeline checks
 - Editor versus C# verdicts
 - Consistency errors (V1: the model contradicts itself)
+- Batches, described handlers, text rules and protected reads
 - Binding (V2 and V3) - see `executable-subset.md` for the full table
 - Frequent errors
 - Render admission (V5): `STAGE-*`, `CLI-RENDER-*`, `STAGE-CRATIS-*`
@@ -55,7 +56,7 @@ Legacy compliance spellings (`@pii`/`@sensitive`) do not evade PLAY0515.
 
 ## Public events and translation direction
 
-All are errors. These constructs bind as ESM v9, except public/foreign imports without local shapes (PLAY0268).
+PLAY0607–0620 are errors. These constructs bind as ESM v9, except public/foreign imports without local shapes (PLAY0268).
 
 | Code | Meaning / fix |
 | --- | --- |
@@ -80,6 +81,18 @@ or non-Translate direction. Repair discovery uses `repair-capabilities`, workspa
 `repairs`, then revision-checked `propose-repair`; do not guess a direction.
 See automations-and-translations `references/public-events-and-direction.md`.
 
+| Code | Severity | Meaning / fix |
+| --- | --- | --- |
+| PLAY0694 | W | An unrouted reaction in a directionless Translate consumes an event its own capture appends (root, children or nested). Keep the capture here and move the reaction to a separate Automation slice with its specs. No automatic repair; `--warnaserror` fails. Other slices' captures and reactions with a `from` route do not trigger this check; explicit inbound local-event consumption is PLAY0616. |
+| PLAY0700 | E | Event-capture `key` is not required on every `from` event, or uses a `$` context key. Choose a required content property or deliberately change the source contracts; no repair. |
+| PLAY0701 | E | `given capture` / `when capture` names a capture over events. Present `given <FromEvent>` / `when append <FromEvent>`. A compiler-authored repair exists only for exactly one `from` event; several are ambiguous. Review the specification repair individually; no fix-all or pinned evidence. |
+
+Requires Screenplay 4.171.0 or later (`screenplay --version`) for PLAY0700/0701
+and event delivery to captures; older runners do not execute that delivery.
+Requires Screenplay 4.176.0 or later for PLAY0694; older compilers leave the
+legacy directionless co-location unchecked. Full capture execution and ordering:
+automations-and-translations `references/public-events-and-direction.md`.
+
 ## Explicit enum member numbers
 
 Source errors; the pins bind as ESM v12:
@@ -290,12 +303,43 @@ or V4 execution. Run the CLI or MCP for those verdicts.
 | PLAY0287 | producer/capture/spec assigns a field the event lacks |
 | PLAY0291-0294 | bad single-line JSON / unknown key / wrong shape / duplicate key |
 
+## Batches, described handlers, text rules and protected reads
+
+Use code and typed subjects from [diagnostic arguments](diagnostic-arguments.md), not
+message parsing, for codes that declare arguments. Other messages still explain
+refusal reasons. Read [language admission](language-admission.md) before changing modes.
+
+| Code | Meaning / fix |
+| --- | --- |
+| PLAY0693 | Duplicate/conflicting/invalid atomic batch declaration; keep one application-root declaration, do not remove intended atomicity |
+| PLAY0695 (I) | Described handler admitted; a target must supply its payload body |
+| PLAY0696 | Pending handler without productions, including response-only; declare unconditional productions |
+| PLAY0697 | Conditional productions under pending intent; result v1 needs unconditional events |
+| PLAY0698 | Pending intent plus another handler; retain one |
+| PLAY0699 | Pattern outside portable dialect or over 1,000 UTF-16 units / 3,000 expanded nodes; rewrite the refused construct |
+| PLAY0780 | Invalid placement/repetition of `command reads protected`; declare once at root |
+| PLAY0781 | Protected read shape/key refused; inspect the closed reason, never downgrade to an unguarded read |
+| PLAY0782 | Omitted `by` without command identifier; declare the lookup input |
+| PLAY0783 | Command combines reads and concurrency; choose the intended boundary |
+| PLAY0784 | Unknown read/property path; reference a declared read or alias |
+| PLAY0785 | Ambiguous view path; use distinct aliases on repeated reads |
+| PLAY0786 (I) | Eligible legacy model; preview typed preamble repair, individually review absence/conflict semantics |
+| PLAY0787 (W) | Exact deprecated Studio text-rule pattern; repair to literal rule or equality, preserving message/severity |
+| STAGE-ESM-043 | Atomic mode not realized, even in admitted v23–v25; retain declaration and gap-fill |
+| STAGE-ESM-044 | Protected reads not realized despite v25 version admission; keep protection and gap-fill |
+| STAGE-IMPL-002 | Described handler body not realized by Stage, even Stub mode; no stubs emitted |
+
+Invalid match syntax remains PLAY0367. Property/concept text rules bind v24;
+`contains`/`starts with` in conditions only still fail PLAY0268. Stage rejects
+v22/v26 and mixed pairs with STAGE-ESM-016; v23–v25 admission does not implement
+bodies, batches or protected reads (STAGE-ESM-044).
+
 ## Binding (V2 and V3) - see `executable-subset.md` for the full table
 | Code | Meaning | Fix |
 |---|---|---|
-| PLAY0268 | construct the ESM cannot represent; read the message for the construct (`executable-subset.md` lists the common ones: handler, list or observable query, `pii`, `produces when` over read models, v6 constructs on an older bundled compiler) | stay in design mode, or change the construct if the domain allows; never strip `pii`/authorization |
+| PLAY0268 | construct the ESM cannot represent; read the message for the construct (`executable-subset.md` lists attached handlers, unsupported query shapes, protected enum/identity concepts, read paths without opt-in or in conditions, and older bundled-compiler limits) | stay in design mode, or change the construct if the domain allows; never strip `pii`/authorization |
 | PLAY0269 / 0270 | UI deferred / authoring metadata (I) | none |
-| PLAY0271 | legacy `reads` or a `concurrency` block keeps its legacy meaning and cannot bind (error) | design gap; a constraint for uniqueness; protected decisions are a target requirement |
+| PLAY0271 | legacy `reads` or a `concurrency` block keeps its legacy meaning and cannot bind (error) | opt eligible command reads into v25 with reviewed preamble repair; `concurrency` remains unbound; uniqueness uses a constraint, target realization stays separate |
 | PLAY0273 | incoherent: ambiguous `for`, property not on event revision, operand type mismatch, derived `$eventContext` path | fix the reference |
 | PLAY0350 | `null` in command/event value | Chronicle semantics (nullable event properties are CHR0012; an optional fact is a separate event), not only a binder limitation: specs cannot state an absent command/event value. Omit the value or record a capability gap; whether the optional detail is really a separate fact is a review question, not this code's fix |
 | PLAY0351 | given/then readmodel lacks the key property | add the keyed query's `by` property |
@@ -336,10 +380,26 @@ or V4 execution. Run the CLI or MCP for those verdicts.
 | PLAY0683/0684 | PLAY0683: generated non-identifier below 64 random bits warns (a single-property unique constraint suppresses it); PLAY0684: generated identifier below 64 random bits is an error |
 | PLAY0687 | capture `source events` spans multiple origins; split into one capture per origin (event store) |
 | PLAY0688 | generated strategy refutes a concept rule; read its violating example, align the rule/strategy or review the derived-`matches` repair |
-| PLAY0689 (W) | generated-concept rule proof is undecided; reason names regex fragment/budget/opaque limits. Never treat a warning as proof |
+| PLAY0689 (W) | generated-concept rule proof is undecided; reason names regex fragment/budget/opaque limits or ambiguity. Only deterministic matches patterns prove containment; passing samples prove nothing |
+| PLAY0691 | finite pattern support cannot be counted within the generation budget; simplify the strategy, never treat it as an Unproven rule warning or redraw |
+| PLAY0692 | pattern support is empty for some valid UTC date in the compiler's next-100-year horizon; repair the pattern/checksum contract, never sample around it |
 | PLAY0685 | own response name used under execute failure; outer successful responses remain available. UI composition `references/response-continuations.md` |
 | PLAY0289 | (binding) no documents: empty root |
 
+Requires Screenplay 4.164.0 (`screenplay --version`) for PLAY0688/0689 (ESM v20),
+4.172.0 for finite generation PLAY0691/0692 and checksum validation (v21); older
+compilers refuse those constructs with PLAY0268. A refuted rule's PLAY0688 repair
+uses the strategy-derived matches pattern (and declared checksum validation if
+absent). Inspect MCP `rules[]` for status/witness/reason and only use a repair
+when diagnosticCode/repair is reported. Pattern/random/rule no longer refuse
+PLAY0268; generated secrets still do. Requires Stage 4.109.0 for v20, 4.115.0
+for v21 admission/all-Proven unpinned specs, 4.117.0 for warning/info rules,
+4.118.0 for checksum validation and 4.119.0 for pattern/random. Older renderers
+refuse those constructs or require pins even for Proven rules. Bad pins fail
+STAGE-ESM-011; unpinned Unproven/Refuted rules fail -038; opaque rules fail -005
+before pin evaluation. `generate rule` remains -028; checksum remains -042 only
+on legacy syntax paths. Tool-author checks: [generation checks](generation-checks.md).
+
 Fix order: E at V1 -> W at V1 -> silent-gap check -> V2 codes (if the mode needs V3).
 Report each as `code file:line one-line meaning`; never paste more than about 30 lines.
 
@@ -358,7 +418,7 @@ Publication STAGE-ESM-032, foreign facts/event captures 033, claim-reading/opaqu
 | STAGE-ESM-004 / 006 / 013 | a `StateChange` without commands; `produces` that cannot render (expression/enum conditions, literal or computed mappings, duplicate tags); event-context value other than `$context.occurred` (reactions: `$context.causedBy.*`, `$context.eventSourceId`) |
 | STAGE-ESM-005 / 015 | code rule or code validation bodies; authorization Stage cannot render exactly (role-claim URIs, nested or unresolved opaque policies, opaque-policy subjects that are not text, Uuid, Date or DateTime). Role-only, authenticated, opaque pure policies and Uuid/Date/DateTime/text claim targets render |
 | STAGE-ESM-007 / 009 / 010 / 017 | projection shape (one projection or reducer per read model, affected-instance key, unsupported query shapes, keys, unsupported `all` mappings, event-context values) |
-| STAGE-ESM-011 | specification shape not rendered (`when append` outside the single-hop reaction subset, command specifications that cascade into reactions, composite values, an unauthenticated caller carrying roles or claims, v15 fixtures that do not match their strategy). Command scenarios and single-hop reaction appends render |
+| STAGE-ESM-011 | specification shape not rendered (`when append` outside the single-hop reaction subset, command specifications that cascade into reactions, composite values, an unauthenticated caller carrying roles or claims, generated fixtures that do not match their strategy shape or concept rules). Command scenarios and single-hop reaction appends render |
 | STAGE-ESM-014 | constraint shape (multi-claim in one command, optional or composite targets) |
 | STAGE-ESM-019/022 | reducer or opaque pure policy body outside the pure allowlist |
 | STAGE-ESM-024 | interval, schedule, application, startup and shutdown triggers, opaque reaction bodies, captures, Translate, clock/trigger/capture specifications |

package/package/corpus/skills/cratis-screenplay-toolchain/references/executable-subset.md

@@ -24,7 +24,8 @@ non-route Double literals (exact lowering of Double-mode literals) as v11, non-p
 numbers as v12, concept compliance as v13, caller-supplied collection equality filters as v14,
 concept generation strategies and freshness as v15, stored event names as v16,
 no-event assertions/redelivery as v17, query-error specifications as v18,
-invocation refusal branches as v19 and generated-concept rules as v20. Always name
+invocation refusal branches as v19, generated-concept rules as v20, and finite
+pattern/random/rule generation plus checksum validation as v21. Always name
 the tool with a V2 or V3 result. When tool and documentation disagree, the tool decides
 current capability; the documentation and the domain decide intended correctness. Record
 the gap, never strip the model to pass. Use the actual binder before promoting an older
@@ -38,6 +39,10 @@ never bind (`verdicts.md`).
 Complete examples that bind live in `executable-example.md`, `pdl-example.md` (projections),
 `automation-translate-example.md` (ESM v6) and `generated-responses-example.md` (ESM v7).
 
+For atomic batches (v22), described handlers (v23), ordinal text rules (v24) and
+protected reads (v25), read [language admission](language-admission.md). A later
+version alone does not enable either application opt-in.
+
 ## Caller and compliance boundary
 
 `$identity.id`/`.name`/`.userName` are aliases of the admitted
@@ -168,11 +173,14 @@ fixtures and `then returns`. Unsupported generated types (`-028`) and result com
 `references/generated-values-and-responses.md`.
 Complete examples: `generated-responses-example.md`, `generation-strategies-example.md`.
 
-- A generated property is command-only, required, scalar and a generatable concept backed by Uuid or String;
-  bare primitives, optional and collection types are invalid. Uuid has implicit `uuid`; String needs a strategy.
+- A generated property is command-only, required, scalar and a generatable concept backed by Uuid/String,
+  or Int with `random` (v21). Bare primitives, optional and collection types are invalid.
+  Uuid has implicit `uuid`; String needs a strategy. Generated identifiers remain Uuid/String only.
   Explicit serialized generation selects v15, with strict fixture encoding and whole-source freshness for all
-  generated destinations. `pattern`, `random`, `rule`, `sequence` and generated secrets remain unadmitted;
-  generated-concept rules bind as v20 with proof diagnostics PLAY0688/0689.
+  generated destinations. Sequence and generated secrets remain refused.
+  Generated-concept rules bind as v20 with proof diagnostics PLAY0688/0689;
+  pattern/random/rule and checksum validation bind as v21. PLAY0691 is uncountable
+  support within budget; PLAY0692 is empty support on a scanned UTC date.
   See command-surface `references/generated-values-and-responses.md` and `generation-strategies-example.md`. Modifier order is `Type optional generated identifier`.
 - Generated values are not request inputs, form fields, invocation arguments or ordinary `when` values. Generation
   runs after authorization and validation and before productions, so a denial or a validation failure never
@@ -180,7 +188,10 @@ Complete examples: `generated-responses-example.md`, `generation-strategies-exam
 - A policy (including inherited or composed ones and the implicit `subject` of a generated identifier), a property
   rule or a requirement that references a generated value reports `PLAY0273`; reference input properties only. A
   generated property whose concept declares rules selects v20; refuted rules report
-  PLAY0688 and unproven rules warn PLAY0689. Opaque execution needs a target.
+  PLAY0688 with a witness and Unproven rules warn PLAY0689 with a reason. Proven
+  rules bind silently; matches containment requires deterministic patterns, not
+  passing samples. Opaque validation needs a target. Opaque generation rules use
+  pinned String results without executing their bodies.
   A reaction mapping into a generated property is invalid.
 - Responses: `returns <property>` is scalar; bare `returns` opens an ordered record of `<name> [<Type>] = <property>` fields
   over direct properties of the same command (collections, read aliases, arithmetic and whole read models are not
@@ -198,14 +209,25 @@ Complete examples: `generated-responses-example.md`, `generation-strategies-exam
 - A reaction-invoked command that reaches generation is `Unsupported(IdentityAllocation)`; response-only commands run
   and discard the response. Generated values give no idempotency, retry or deduplication guarantee.
 
-Requires Screenplay 4.68.0 or later (`screenplay --version`) for generated values and responses (ESM v7), and 4.147.0 or later for concept generation strategies and freshness (ESM v15); older compilers refuse them with PLAY0268.
+Requires Screenplay 4.68.0 or later (`screenplay --version`) for generated values and responses (ESM v7), 4.147.0 for strategies/freshness (v15), 4.164.0 for generated-concept rules (v20), and 4.172.0 for pattern/random/rule/checksum (v21); older compilers refuse the respective constructs with PLAY0268.
+
+Pins satisfy both strategy shape and concept rules; failure is Rejected(Contract),
+not an input error or redraw. Pin date segments with `given clock`; without it the
+runner checks digit widths only. Generation checksum does not add validation:
+author `validate checksum` for arithmetic. Requires Stage 4.109.0 for v20,
+4.115.0 for v21 admission/all-Proven unpinned specs, 4.117.0 for warning/info rules,
+4.118.0 for checksum validation and 4.119.0 for pattern/random rendering; older
+renderers refuse those constructs or require rule-bearing pins even when Proven.
+Unproven/Refuted rules still need pins (-038), bad pins fail -011, and
+`generate rule` remains -028. Do not remove rules or classification to render.
 
 ## Released public boundaries and observer routes
 
 Public/origin events, explicit Translate direction, event-target builders and
-`source events` captures bind as ESM v9. Publication folds execute;
-source-event captures and reached opaque event-target reducers return typed
-Unsupported. Public/foreign imports still lack a local shape and refuse PLAY0268.
+`source events` captures bind as ESM v9. Publication folds execute, and so do
+captures over events (Requires Screenplay 4.171.0; a specification presents the
+consumed event with `given <Event>` / `when append <Event>`); reached opaque
+event-target reducers return typed Unsupported. Public/foreign imports still lack a local shape and refuse PLAY0268.
 See automations-and-translations `references/public-events-and-direction.md`.
 Production overrides and reaction/reducer filters bind and select v10;
 filters match routed source/stream names only. Read
@@ -231,9 +253,15 @@ Requires Screenplay 4.117.0 or later (`screenplay --version`) for ESM v9, 4.129.
 
 ## Code attachments (what binds, what never does)
 
+Pending `handler implementation` beside unconditional `produces` binds as a described
+command (v23). Its payload-only body returns Unsupported ImplementationBody when reached;
+denial/validation specs still run. Read [language admission](language-admission.md) for
+v22–v25 and [described handlers](../../cratis-screenplay-command-surface/references/described-handlers.md)
+for the result contract. Attached handlers remain unbound.
+
 Inline fences (`csharp`, `typescript`, `react`, `html`, `sql`) and `file <path>` attach
 code to an owner. Three kinds block binding (PLAY0268, V3 blocked, no specification runs):
-the command `handler`, the `file` constraint (see below) and a query `performer`
+the attached command `handler`, the `file` constraint (see below) and a query `performer`
 ("uses delivery, filtering, scope, or implementation behavior outside the first ESM v1
 vertical"). Everything else binds as an **opaque requirement** that needs a target to
 execute: reducer transitions, rule predicates, command and concept code validation, policy
@@ -246,22 +274,22 @@ bodies still leave their owner non-executable.
   can only declare uniqueness: declare it with `unique ...`, and put other rules in command
   validation or a `require` condition.
 
-- A command `handler` **never binds**: PLAY0268 "Command '<n>' handler requires a
-  constrained implementation attachment." This holds with a `file`, with a fence, and with
-  `implementation` or `hint` (including a pending intent with no payload). On a handler,
-  `implementation` and `hint` are authoring intent: no execution, lock or confirmation.
+- A file/fenced command `handler` remains PLAY0268, wrapped or direct. A pending
+  intent instead selects v23 with unconditional productions (PLAY0695 information).
+  Missing productions use PLAY0696, conditional ones PLAY0697, duplicate handlers PLAY0698.
+  Hints are not executable code, locks or confirmation.
 - A command property named rule also accepts an `implementation` block (ordered
   `hint` lines, at most one `file` or tagged fence). With a source attached it binds like a
   direct source; hints-only or empty is pending intent: valid source, PLAY0268 at binding.
   The block is rejected on concept rules, built-in property rules and whole-command
   `require`/`validate` bodies.
-- A handler therefore makes the slice non-executable and non-renderable: it is gap-fill
-  with the model as the contract.
+- A reached described body is Unsupported, not a passing specification; Stage refuses
+  it with STAGE-IMPL-002, even in Stub mode. Deliver its body as authorized gap-fill.
 - Stage admits only pure reducer bodies (Roslyn allowlist, STAGE-ESM-019 and 022);
   code validation is refused (STAGE-ESM-005). Opaque pure policies render.
 - The reference runner returns Unsupported for the opaque bodies that do bind (rule and
   policy predicates, code validation, reducer transitions); a specification that needs one
-  never passes. Handlers, file constraints and query performers (and reaction effects on a trigger with
+  never passes. Attached handlers, file constraints and query performers (and reaction effects on a trigger with
   `reads`) are different: they leave the whole model unbound, so no specification runs at
   all.
 
@@ -274,13 +302,13 @@ bodies still leave their owner non-executable.
 | `pii` or `secret` on a concept | PLAY0268 | Older compilers refuse it outright. Current compilers admit v13 except enum/identity compliance and events mixing personal or explicitly subject-scoped secret values with explicit subject marks; see `compliance.md` in command-surface references |
 | `query` with a composite `by` block, or `by ... from` context-derived arguments | PLAY0268 | composite `by` blocks remain unadmitted. An optional scalar snapshot lookup, an unfiltered list (`RM[]`) and a list narrowed by one caller-supplied `by` key bind, in their `observable` form too |
 | Context `from`, single-result filters, `scoped to`, `performer` queries | PLAY0268 | Typed query context, filtering of single results, opaque scope and query implementation remain unadmitted; each refusal names its reason. Caller-supplied collection equality filters bind as v14. `observable` goes in the return position (`=> observable RM[]`); as a body line it is PLAY0048 |
-| `contains` or `starts with` in conditions | PLAY0268 | equality and numeric ordering only |
+| `contains` or `starts with` in conditions only | PLAY0268 | `require`/`produces when` conditions admit equality and numeric ordering only; property/concept text rules bind as v24 |
 | Date or DateTime comparison, `today` | PLAY0268 | no runtime date value |
 | Rule on a nested path (`lines.qty all > 0`) | PLAY0268 | put the rule on the nested value's concept |
-| `require` or `produces when` over a read-model path | PLAY0268 | needs decision-consistent reads |
-| `reads <View> ...` on a command | PLAY0271 (error) | legacy, cannot imply decision consistency |
+| Read paths without protected opt-in, or in `produces when` | PLAY0268 | v25 admits single-level paths only in `require` and produced-event mappings |
+| Legacy `reads <View> ...` on a command | PLAY0271 (error) | `command reads protected` opts eligible views into v25; see command-surface protected reads |
 | `concurrency` block on a command | PLAY0271 (error) | "concurrency metadata keeps its legacy meaning and cannot bind to ESM v1" |
-| `handler` (see above) | PLAY0268 | gap-fill |
+| File/inline `handler` (see above) | PLAY0268 | pending described handlers instead bind v23; body execution and rendering remain gaps |
 | `$context.tenant`, roles, claims, causation | PLAY0268 | no portable scalar counterpart |
 | Arithmetic or raw expression in a `produces` mapping | PLAY0268 | |
 | Template `` `${x}` `` or `$causedBy` in a projection | PLAY0268 | |