@cratis/pi 7.61.0 → 7.63.0

package/package/corpus/skills/cratis-arc-command/references/decisions-and-routing.md

@@ -15,61 +15,100 @@ Source: Arc. These features require `Cratis.Arc.Chronicle`.
 
 ## Pick the guarded read
 
-Plain injected read models and `IReadModels.GetInstanceById` are advisory,
-materialized or passive. A `Result<TEvent, ValidationResult>` rejects a request
-but does not enroll a guard. Uniqueness and create-once belong to a Chronicle
-constraint, not to any read. For the routing steps, the matrix and the traps read
+Under read protection `On` (`<CratisReadProtection>On</CratisReadProtection>`, or
+`[ReadProtection(ReadProtectionMode.On)]` on a command), a read model that is a
+parameter of `Handle()` or of a `CommandValidator<T>` constructor is read fresh from
+the event log and guards the command's append. `Off` is the default when nothing is
+set; under `Off` and `Measure` those reads are plain, a hint that guards nothing.
+A `Result<TEvent, ValidationResult>` rejects a request but does not enroll a guard.
+Uniqueness and create-once belong to a Chronicle constraint, not to any read. For the
+routing by rule shape, the matrix and the traps read
 [choosing how a rule holds](../../cratis-chronicle-decision-reads/references/choosing-how-a-rule-holds.md).
 
-- For one stream, inject `IStreamReads` into `Provide`, call `ForCommand()`, and
-  return `StreamDecision.Append(...)` from `Handle`. It returns
-  `EventsWithConcurrencyScopes`, retaining the read route and exact tail. A
-  competing append conflicts, including two competing first appends.
-- For projected state, opt in with `[ProtectedDecision]` in
-  `Cratis.Arc.Chronicle.ReadModels`, then inject `DecisionRead<T>` into
-  `Provide`/`Handle` (`Exists`/`Instance`). Command-aware `IDecisionReads.Get<T>`
-  enrolls reads of other keys. Only Chronicle-admitted direct event-source-keyed
-  projections with a known event-type set qualify; reducers, joins, children,
-  open-ended event types and incomplete definitions are refused. Arc certifies parameterless
-  validators it constructs; constructor dependencies and uncertified instances
-  are refused: a protected command's discoverable validator needs exactly one
-  public parameterless constructor, otherwise the command fails with HTTP 500.
-  The decision model needs an `Id` property, an event-source key and a flat
-  projection; self-reducing models are refused like reducers. When the command has
-  two or more key candidates, implement `ICanProvideEventSourceId`: `[Key]` does
-  not silence `ARCCHR0002`, and Arc silently keys by the first eligible property
-  in declaration order. Keep all decision state out of validators, including
-  static members and service locators. `[Unprotected]` on the command opts out; never
-  combine it with `[ProtectedDecision]`. A parameter-level marker acknowledges
-  tooling, not a runtime opt-out. `Validate` is advisory, not a commit promise.
-- `concurrency: true` on the routing attributes is **not** a guard for the
-  decision: Arc reads the narrowed tail after `Handle`, so it only widens or
-  narrows the window the default check covers. Exact returned scopes replace
-  automatic capture; remove the flags when returning `EventsWithConcurrencyScopes`
-  (ARCCHR0016). The default check also reads the tail after `Handle`, and the first
-  append into a scope is unchecked unless `CheckFirstAppendIntoAScope` is set.
+Requires Arc 22.106.0 for read protection. Older Arc has only the per-command
+`[ProtectedDecision]` path below.
+
+- **One entity's state.** Put the rule in a validator with the read model as a
+  constructor parameter; `Handle()` returns the events. The key is
+  `[LookUpBy(nameof(Cmd.Prop))]` on the parameter (`Cratis.Arc.Commands`), else the
+  single command property whose type equals the model's `Id` type, else the
+  command's event source id. Several matching properties fail with
+  `AmbiguousReadModelLookup` (500): add `[LookUpBy]`.
+- **Two entities.** Two read-model parameters, the second with `[LookUpBy]`;
+  `Handle()` returns `IEnumerable<EventForEventSourceId>`, one event per entity,
+  appended atomically. Use a distinct event type per entity.
+- **One stream inside a source.** A per-stream read model
+  (`[ReadModel, EventStream<TSource>("Transactions")]`, `Cratis.Chronicle.ReadModels`)
+  as a plain parameter, on a command routed `[EventSource<TSource>("Transactions")]`
+  and `[EventStreamId("{Month}")]`; otherwise `ReadModelStreamNotOnCommandRoute`
+  (500, analyzer ARCCHR0037). It is folded from that one stream and key-only reads
+  are refused. For raw events of a short stream, inject `IStreamReads` into
+  `Provide`, call `ForCommand()`, and return `StreamDecision.Append(...)` from
+  `Handle` (`EventsWithConcurrencyScopes`); a competing append conflicts, including
+  two competing first appends.
+- **Computed key or another stream or source.** Command-aware `IDecisionReads.Get<T>`
+  in `Provide()`, including the stream overloads.
+- **Rich lifecycle.** An aggregate root, with `Commit()` returned last. Under `On`,
+  an aggregate and a protected read of the same source are refused
+  (`ReadAndAggregateOnSameSource`); a different source is fine.
+- **Editing conflict.** Return `EventsWithConcurrencyScopes` built from the revision
+  the client sent. `concurrency: true` on the routing attributes is **not** a guard
+  for the decision: Arc reads the narrowed tail after `Handle`. Remove the flags
+  when returning exact scopes (ARCCHR0016). The default check also reads the tail
+  after `Handle`, and the first append into a scope is unchecked unless
+  `CheckFirstAppendIntoAScope` is set.
+- **No guard needed.** A hint or a rare violation: mark a deliberate advisory read
+  `[Unprotected("why")]` (`Cratis.Arc.Chronicle.ReadModels`; on a method it covers
+  the body, not injected parameters), or repair with a reactor.
+
+Under `On`, `IReadModels`, `IMongoCollection`, detached reads and immediate appends
+through an injected `IEventLog` are refused; take the model as a parameter and
+return the events. Admitted models: event-source-keyed model-bound or declarative
+projections with a string or Guid `Id`, and unfiltered reducers without constructor
+dependencies except `ILogger<T>` (self-reducing models are exempt). Joins and
+children, event-property keys, Pinned delivery, filtered reducers, reducers with
+dependencies and other event sequences fail with `ReadCannotBeProtected` (500)
+unless marked `[Unprotected("why")]`. Validators with read models must be
+convention-registered (transient).
+
+When the command has two or more key candidates, implement `ICanProvideEventSourceId`:
+`[Key]` does not silence `ARCCHR0002`, and Arc silently keys by the first eligible
+property in declaration order.
+
+A lost race is HTTP 400 with a validation result of reason `concurrencyViolation`,
+`reasonDetail` `ReadChanged` and `state` `{ readModel, key }`. Arc and Chronicle do
+not re-run the command; the client submits it again. Every other refusal is 500:
+change the code.
+
+### Per-command opt-in: `[ProtectedDecision]`
+
+`[ProtectedDecision]` (`Cratis.Arc.Chronicle.ReadModels`) with `DecisionRead<T>`
+(`Exists`/`Instance`) is the older per-command opt-in. It still works and is not
+obsolete; do not describe `On` as making it redundant. Use it for a command in a
+project that is not on `On`. Without `On`, only a parameterless validator runs: a
+discoverable validator needs exactly one public parameterless constructor,
+otherwise the command fails with HTTP 500. Keep decision state out of validators
+there, including static members and service locators. `[Unprotected]` on the
+command opts out; never combine it with `[ProtectedDecision]`
+(`CommandCannotBeBothProtectedAndUnprotected`).
 
 Requires Arc 22.81.0 for stream-scoped `IDecisionReads.Get<T>`,
 `GetDetached<T>` and `AdmitForStream<T>` to participate in command protection,
-caching and enrollment. Older Arc refuses these stream reads inside commands;
-check the Arc package version before choosing this path. `[Unprotected]` command
-reads are unguarded, not refused.
+caching and enrollment. Older Arc refuses these stream reads inside commands.
 
 Do not manually append or commit to bypass the owner-capable unit of work.
 The guard detects every matching event appended after its boundary, whoever wrote
 it, but it protects only guarded decisions: an unguarded writer deciding on the
 same facts can still append on stale state, so the rule holds only when every
-deciding writer is guarded or the rule is a constraint. Protection does not guard an unguarded writer's own decision (a plain read,
-`[Unprotected]` or a direct append), external state, revisions, redactions,
-migrations, changes to projection definitions or writes that bypass the kernel's
-serialized append path. Protection is per command and
-opt-in; an unmarked command keeps its plain reads, and a conflict is returned as a
-`ConcurrencyViolation` validation result with no automatic retry. A protected command that
-stages no events commits an empty guarded batch: current kernels validate the
-enrolled reads (a scope with an actual boundary or expecting no matching event) and write nothing, while a kernel that rejects an empty batch
-raises `DecisionReadValidateOnlyNotSupported` (HTTP 500), so cover it with an
-integration specification. In contrast, `StreamDecision.Append([])`
-returns no scopes: use it only for an identical retry, not a rejected request.
+deciding writer is guarded or the rule is a constraint. Outside the guard:
+`[Unprotected]` reads, `Off` mode, external state, revisions and redactions,
+migrations, changes to projection definitions and writes that bypass the kernel's
+serialized append path. A protected command that stages no events commits an empty
+guarded batch: current kernels validate the enrolled reads and write nothing, while
+a kernel that rejects an empty batch raises `DecisionReadValidateOnlyNotSupported`
+(HTTP 500), so cover it with an integration specification. In contrast,
+`StreamDecision.Append([])` returns no scopes: use it only for an identical retry,
+not a rejected request.
 
 ## Definition-backed routes and templates
 
@@ -125,12 +164,17 @@ source id/type and stream route; reactor tuples/collections cannot mix it with e
 
 ## Decision specifications
 
-Call `new CommandScenario<T>().UseDecisionReads()` before seeding events.
-`Given.ForEventSource(id).OnRoute(route).Events(...)` and
-`AppendConcurrently(id, route, ...)` share one real in-process log. Pinned models
-cannot supply guards. Assert a real nonempty decision conflicts on the intended
-route, and that an independent route is not over-guarded.
-`ShouldHaveCompletedStream(type, id)` asserts completion;
+`new CommandScenario<T>()` selects the in-process decision log from the command's
+read-protection mode and dependencies (under `On`, with a per-stream model or
+`[ProtectedDecision]`); `UseDecisionReads()` is hidden and unnecessary. An `Off`
+command with no protected dependency stays in the legacy mode with pinned read
+models, which cannot prove a race. Seed with `Given.ForEventSource(id).Events(...)`,
+`.OnRoute(route).Events(...)`, queue a competing append with
+`AppendConcurrently(id, events...)` (or `AppendConcurrently(id, route, ...)`) and
+assert `result.ShouldHaveValidationErrorBecauseOf(ValidationResultReason.ConcurrencyViolation)`.
+There is no `scenario.AppendConditions`. Guarded state needs seeded events: protected reads ignore a pinned `.ReadModel(m)` (which only pins an advisory plain read) and `DecisionRead<T>` rejects it. Assert a
+real nonempty decision conflicts on the intended route, and that an independent
+route is not over-guarded. `ShouldHaveCompletedStream(type, id)` asserts completion;
 `ShouldHaveCompletedStream(ClosedStreamScope)` asserts the exact owner and route;
 `DecisionReadAdmissions.ShouldAdmitDecisionReadsIn(assembly)` checks projection
 admission in assembly-level specs.

package/package/corpus/skills/cratis-arc-command/references/fresh-identifiers.md

@@ -98,8 +98,11 @@ use an appropriate constraint or explicit concurrency scope for them.
 
 ## Specify the collision
 
-Use `new CommandScenario<TCommand>().UseDecisionReads()` **before seeding**, then
-`PinGeneratedValue(name, id)` and `Given.ForEventSource(id).Events(existingEvent)`.
+Use `new CommandScenario<TCommand>()`; it selects the in-process log from the
+command's read-protection mode and dependencies before seeding. If a seeded
+collision throws `GeneratedIdentifierCollisionRequiresDecisionReads`, the
+scenario stayed in legacy mode: call the compatibility switch `UseDecisionReads()`
+before seeding. Then `PinGeneratedValue(name, id)` and `Given.ForEventSource(id).Events(existingEvent)`.
 Assert the concurrency reason and collision detail, unchanged append tail and
 one handler execution. Also cover an empty source receiving two events through
 the chosen write API, an occupied source whose events belong to another stream,

package/package/corpus/skills/cratis-arc-command/references/generated-values.md

@@ -24,7 +24,10 @@ For the current threaded example, read [shop commands](shop-generation.md) and
 [shop concepts](../../cratis-fundamentals-concept/references/shop-generation.md).
 Those declarations show:
 CustomerId (`cus_` + ULID), context-aware TypeID OrderId, NanoID InviteCode and
-secret bytes ApiKey. They allocate responses, not events or persisted entities.
+secret bytes ApiKey, readable InvoiceNumber (pattern/checksum) and Int64 pickup
+TicketNumber (`Integer`). The latter helpers require Fundamentals 7.25.0; inspect
+`dotnet list package --include-transitive` before use and retain existing factories
+on older packages. They allocate responses, not events or persisted entities.
 For a real Chronicle stream identity use `EventSourceId<T>`; return `(id, event)`
 to append and return the stream ID, or use an explicit event-source wrapper.
 
@@ -32,14 +35,19 @@ Keep existing/client-chosen identifiers and references on command properties.
 Services and read models remain ordinary dependencies, not generated values.
 UUID generation does not establish authorization, secrecy, idempotency, storage
 freshness, or gapless/sequential numbering. Use the domain's authoritative
-allocation mechanism for invoice numbers, not a random UUID strategy.
+allocation mechanism for gapless/sequential invoice numbers, not a random strategy.
+A pattern supplies a readable reference, not an allocator or secret; check digits
+catch typos, not forgery. The concept validator can call
+`GenerateValue.HasValidChecksum(value, Checksum.Luhn)` alongside shape checks;
+pinning bypasses generation, never validation. Keep short-code uniqueness separate.
 
 ## Resolution, validation and captures
 
 `GeneratedValueAttribute` targets parameters only. Use it on a command's public
 instance `Handle()`, not a property, constructor or `Provide()` parameter.
-The type must be non-nullable and implement `IGeneratable<TSelf>` for itself;
-a raw `Guid`, nullable concept or by-reference parameter is invalid. Use domain
+The type must be non-nullable and implement `IGeneratable<TSelf>` or
+`IGeneratableInContext<TSelf>` for itself; a raw `Guid`, nullable concept or
+by-reference parameter is invalid. Use domain
 concepts; the runtime's type check is the self-generatable interface contract.
 
 `[GeneratedValue]` uses the parameter name. `[GeneratedValue("customerId")]` keeps the
@@ -52,10 +60,11 @@ invoking `Handle()`. Neither a provided value nor a DI registration overrides a
 generated parameter. Unmarked parameters retain their normal resolution.
 
 Discoverable concept validators run with the command's scoped provider and
-cancellation token. Errors produce `GeneratedValueRejected`, an exception
+cancellation token. A failed rule produces `GeneratedValueRejected`, an exception
 outcome in `CommandResult`: a server-generation defect, not a request-validation
-400. Warnings/information allow execution. Fix the strategy or invariant; do not
-turn the defect into a user rejection or disable validation to make it pass.
+400. Requires Arc 22.104.0 for rejection at every severity, including Warning and
+Information; older runtimes let those severities execute. Fix the strategy or
+invariant; do not turn the defect into a user rejection or disable validation.
 
 Validated values enter `CommandContext.GeneratedValues` in parameter-resolution
 order. Each capture has zero-based `Order`, `Name`, declared `Type` and `Value`;
@@ -73,7 +82,7 @@ handler-construction checks remain for declarations compiled without analyzers.
 
 | Diagnostic | Severity | Fix |
 | --- | --- | --- |
-| ARC0022 | Error | Use a non-nullable type implementing `IGeneratable<TSelf>` for itself; no raw `Guid` or by-reference parameter. |
+| ARC0022 | Error | Use a non-nullable type implementing `IGeneratable<TSelf>` or `IGeneratableInContext<TSelf>` for itself; no raw `Guid` or by-reference parameter. |
 | ARC0023 | Error | Move the attribute to a non-static command `Handle()` parameter, not `Provide()`, a read model or controller. |
 | ARC0024 | Error | Give each generated parameter a non-empty unique name; comparison is case-sensitive. |
 | ARC0025 | Warning | Remove a redundant provided value of the generated type, or remove the attribute if `Provide()` should supply it. An unmarked parameter can still consume that provided type. |
@@ -126,7 +135,13 @@ Source: `Source/DotNET/Arc.Core/Commands/ModelBound/GeneratedValueAttribute.cs`,
 `Source/DotNET/Testing/Commands/CommandScenarioGeneratedValueExtensions.cs`.
 
 Contextual generation (received time and tenant) and Fundamentals' additional strategies need a newer Arc; [sources and Clock/Tenant
-setup](shop-generation.md). Arc does not supply a native freshness/collision
-allocator or a pattern contract. Screenplay separately admits concept `generate`
-strategies and freshness; see `cratis-screenplay-command-surface/references/generated-values-and-responses.md`
-for that language contract and Stage's explicit scopes, not native Arc freshness support.
+setup](shop-generation.md). Generated parameter resolution is not a gapless or
+short-code collision allocator. Fundamentals owns pattern/checksum factories;
+Arc resolves these through the concept's generation interface, not strategy-specific
+`[GeneratedValue]` options. Requires Arc.Screenplay 22.107.0 for pattern/random,
+checksum and self-contained String-rule recovery; older adapters keep them in code.
+Requires Stage 4.118.0 for checksum validation and 4.119.0 for pattern/random
+rendering; older renderers refuse them. `generate rule` remains STAGE-ESM-028.
+Screenplay separately admits concept `generate` strategies and freshness; see `cratis-screenplay-command-surface/references/generated-values-and-responses.md`
+for that language contract and Stage's explicit scopes. Native Arc freshness is a
+separate policy; a factory alone is not a storage guard.

package/package/corpus/skills/cratis-arc-command/references/read-model-injection.md

@@ -7,10 +7,12 @@
 - Which provider owns a read model type
 
 Source: [read models in commands](https://github.com/Cratis/Arc/blob/main/Documentation/backend/csharp/chronicle/read-models/injecting-into-commands.md).
-Plain models and keyed reads are advisory, not concurrency guards. For protected
-reads use [decisions and routing](decisions-and-routing.md): opt into
-`[ProtectedDecision]` before taking `DecisionRead<T>`; constructor-injected
-validators are refused there.
+Under read protection `Off` (the default) and `Measure`, injected models and keyed
+reads are plain reads, not concurrency guards. Under `On`, a read-model parameter of
+`Handle()` or a validator constructor is guarded; `IReadModels.GetInstanceById` in a
+command is refused, so read another entity's model with a second parameter and
+`[LookUpBy(nameof(Cmd.Prop))]`. See [decisions and routing](decisions-and-routing.md)
+and, for per-command opt-in, `[ProtectedDecision]` with `DecisionRead<T>`.
 
 A read model can be injected into a `CommandValidator<T>` constructor, into
 `Provide()`, or into `Handle()`. Arc resolves it through an
@@ -26,7 +28,9 @@ error. The three shapes it takes:
    ambiguous;
 3. the id is generated inside `Handle()` and does not exist yet.
 
-In all three, read by explicit key in `Provide()`:
+In all three, under `Off` read by explicit key in `Provide()`; under `On` use a
+second parameter with `[LookUpBy]`, or `IDecisionReads.Get` in `Provide()` for a
+key computed there:
 
 ```csharp
 var other = await readModels.GetInstanceById<<Other>>((EventSourceId)<OtherId>);

package/package/corpus/skills/cratis-arc-command/references/shop-generation.md

@@ -13,8 +13,10 @@
 
 Use the [same shop concepts](../../cratis-fundamentals-concept/references/shop-generation.md):
 CustomerId is `cus_` + ULID; OrderId is context-aware TypeID; InviteCode is NanoID;
-ApiKey is secret `Bytes(32)` with `[NotAudited]`. The concept owns the factory,
-not a command property or a per-call random implementation.
+ApiKey is secret `Bytes(32)` with `[NotAudited]`. InvoiceNumber is a date/checksum
+pattern and TicketNumber an inclusive random Int64 pickup ticket. The concept owns
+the factory, not a command property or a per-call random implementation.
+Requires Fundamentals 7.25.0 for Pattern/Integer factories; check `dotnet list package --include-transitive`, upgrade or retain existing factories on older versions.
 
 The following complete command declarations depend on those Shop concepts and
 `Cratis.Arc.Core` / `Cratis.Arc.Chronicle`. They allocate response values only, not persisted entities or events;
@@ -87,16 +89,25 @@ and captured-time semantics, never one exact random suffix.
 - Existing/client-owned IDs stay command inputs; services/read models remain
   ordinary dependencies. Generation is not authorization or tenant isolation.
 - Randomness is not idempotency, storage freshness or a gapless invoice allocator.
-  Arc#3129 freshness is not delivered by this parameter API; Stage's v15 explicit
-  scopes are a separate realization.
+  Stage's explicit whole-source scopes protect generated destinations, not
+  every generated payload code; enforce payload uniqueness separately.
 - ApiKey is a credential, never a Chronicle stream ID: event-source IDs are plaintext
   metadata and cannot be encrypted. Identify the key with a separate `ApiKeyId` and keep
   ApiKey a secret value property. `[NotAudited]` protects
   causation only. Never log captures, return secrets on public endpoints, or
   append plaintext authentication credentials. Retain a hash; for retained
   operational secrets use `[Encrypted]` plus `[NotAudited]`.
-- Screenplay's generated context and secret execution remain unavailable. A
-  compiled Arc factory does not imply that it can recover or render as `.play`.
+- Readable patterns are not gapless/sequential invoice allocators or secrets;
+  check digits catch typos, not forgery. Short codes need uniqueness handling;
+  generation alone does not reserve a code.
+- Screenplay admits attached generation rules with Now/Tenant context, but its
+  reference evaluator only consumes pinned results. Generated secrets remain
+  refused. A compiled Arc factory does not imply that it can recover or render
+  as `.play`. Read [generated-value recovery](../../cratis-screenplay-legacy-extraction/references/generated-recovery.md)
+  for Arc.Screenplay prerequisites and refusal boundaries, and
+  [Stage admission](../../cratis-stage-rendering-and-sandbox/references/admission.md)
+  for checksum and pattern/random rendering prerequisites. `generate rule`
+  remains STAGE-ESM-028.
 
 ## Sources
 

package/package/corpus/skills/cratis-arc-command-validation/SKILL.md

@@ -59,14 +59,15 @@ another version.
 Which mechanism makes a rule hold under concurrent writers (constraint, protected
 decision, stream decision, aggregate, scope, reactor repair) is routed in
 [choosing how a rule holds](../cratis-chronicle-decision-reads/references/choosing-how-a-rule-holds.md).
-A validator is never that mechanism.
+A validator holds a state rule only when the project is on read protection `On`;
+under `Off` (the default) it is a hint, never the mechanism.
 
 | The rule is… | Put it in |
 | --- | --- |
 | A reusable value invariant — length, format, range | `ConceptValidator<T>` on the concept type |
 | Command input, cross-field, or a pre-handler check | `CommandValidator<TCommand>` with `RuleFor(...)` |
 | A dependency on data the handler must fetch first | `Provide()` — fetch, and short-circuit if unusable |
-| State-dependent and must hold **under concurrency** | Guard the read with `IStreamReads`/`StreamDecision`, or `[ProtectedDecision]` + `DecisionRead<T>`; return events through Arc |
+| State-dependent and must hold **under concurrency** | Under `On`, a `CommandValidator<T>` with the read model as a constructor parameter (Step 5); or `IStreamReads`/`StreamDecision`; return events through Arc. `[ProtectedDecision]` + `DecisionRead<T>` is the older per-command opt-in |
 | Uniqueness | A Chronicle constraint, never a command-side read |
 | A genuine defect or missing infrastructure | `throw` a domain exception |
 
@@ -119,11 +120,27 @@ public class TransferFundsValidator : CommandValidator<TransferFunds>
 - The validator is discovered by type — no registration.
 - Constructor dependencies (read models, services) are injected. A read model
   injected here resolves the same way as one injected into `Handle()`; see
-  Step 5 for what "the same way" actually means. A validator that reads state is
-  **advisory only**: it shows the state at validation time and guards nothing, so
-  use it for a friendly early message, never as the rule. A `[ProtectedDecision]`
-  command refuses a discoverable validator unless it has exactly one public
-  parameterless constructor (otherwise HTTP 500), so keep state rules out of it.
+  Step 5. **State rules ("may this proceed") belong here**, with the read model as a
+  constructor parameter. Under read protection `On` that read is fresh from the log
+  and guards the append: if an event of the model's types for that key arrives
+  after the read, nothing from the command is written. Under `Off` (the default
+  when nothing is set) and `Measure` the same validator reads a plain model: a hint
+  with a friendly message that guards nothing. Under `On` the validator must be
+  convention-registered (transient); hand-registered scoped, singleton, factory or
+  instance validators are refused. Under `[ProtectedDecision]` without `On`, a
+  discoverable validator needs exactly one public parameterless constructor
+  (otherwise HTTP 500).
+- **The caller can lower the severity threshold.** Model-bound commands accept
+  `X-Allowed-Severity` (`allowedSeverity`). Under `Off` and `Measure`, a caller
+  sending `3` (Error) removes Error results from validators, command filters and
+  `Provide()`, so `Handle()` runs and a validator's state rule can be skipped
+  unless the command declares
+  `[BlockOnValidationSeverity(ValidationResultSeverity.Error)]`
+  (`Cratis.Arc.Commands.ModelBound`). Requires Arc 22.108.0 for the `On` floor: a
+  command declared `On` blocks `Error` and `Unknown` whatever the caller sends; the
+  caller can relax only `Warning` and `Information`. Lowering
+  `ReadProtection:MaximumMode` at runtime does not remove the floor, and an explicit
+  attribute wins. Severity is not authorization.
 - **Omit the validator entirely when there are no rules.** An empty subclass is
   noise the reader has to check.
 - Single-property intrinsic rules belong on `ConceptValidator<T>` instead, so
@@ -159,53 +176,77 @@ public async Task<Result<Customer, ValidationResult>> Provide(IReadModels readMo
 
 ## Step 5 — Guard a concurrency-sensitive decision
 
-Plain read-model injection or `IReadModels.GetInstanceById` is **advisory**, even
-inside `Handle()` returning `Result<,>`: it enrolls no guard against a competing
-append. Choose the first boundary that fits:
-
-1. One routed stream: `Provide(IStreamReads reads) => reads.ForCommand()` returns
-   `Task<StreamDecision>`; `Handle(StreamDecision decision)` returns
-   `decision.Append(...)` (`EventsWithConcurrencyScopes`), guarding the read tail.
-2. Projected state: mark the command `[ProtectedDecision]` and take
-   `DecisionRead<T>` (`.Exists`/`.Instance`) or command-aware `IDecisionReads`.
-   Only Chronicle-admitted, direct event-source-keyed projections with known
-   event types qualify; reducers (including self-reducing models), joins, children and open-ended event
-   types are refused. The model needs an `Id` property.
-   Only parameterless validators constructed/certified by Arc run. Constructor
-   dependencies are refused; static/service-locator decision state is still your
-   responsibility. Command-level `[Unprotected]` opts out, not into safety.
-3. Stream-level automatic scopes: `concurrency: true` on routing attributes
-   (`EventStreamId`, `EventStreamType`, `EventSourceType`). It is **not** a guard
-   for the decision: like the default check it reads the tail after `Handle`.
-   Exact returned scopes take precedence; do not combine automatic capture with
-   exact scopes. A guard detects every matching event after its boundary, whoever
-   wrote it, but it protects only guarded decisions, so every writer that decides
-   on the rule needs one, or the rule must be a constraint.
-
-`ARCCHR0011/0012` flag unprotected reads and immediate append bypasses. Return
-events, never append them directly. Read
+Set read protection `On` for new code: `<CratisReadProtection>On</CratisReadProtection>`
+in the project (or `[ReadProtection(ReadProtectionMode.On)]` on one command). Under
+`On`, the read-model parameters of `Handle()` and of the validator constructor are
+the guard, so the state rule is a validator and `Handle()` returns the events.
+Requires Arc 22.106.0. Under `Off` (the default) a plain read guards nothing, even
+inside `Handle()` returning `Result<,>`. Choose the first boundary that fits:
+
+1. A unique value or create-once: a Chronicle constraint, not a read.
+2. One entity's state: a read-model parameter in the validator (this step's example).
+   Several entities: one parameter each, with `[LookUpBy(nameof(Command.Prop))]` on
+   a parameter whose key is not the command's event source id, and `Handle()`
+   returning `IEnumerable<EventForEventSourceId>` with a distinct event type per
+   entity.
+3. A limit inside one stream: a per-stream read model (`[EventStream<TSource>("…")]`)
+   on a command routed `[EventSource<TSource>("…")]` + `[EventStreamId("{Prop}")]`,
+   or `Provide(IStreamReads reads) => reads.ForCommand()` returning `StreamDecision`.
+4. An editing conflict: exact returned scopes from the revision the client sent.
+   `concurrency: true` on routing attributes is **not** a guard: like the default
+   check it reads the tail after `Handle`.
+5. Rich lifecycle: an aggregate; do not also read the same source.
+
+A read under `On` is refused, with HTTP 500, when it cannot be guarded exactly:
+`IReadModels`, `IMongoCollection`, detached reads, an injected `IEventLog.Append`,
+and models that are joins, event-property keyed, filtered or dependency-bearing
+reducers, Pinned or on another sequence (`ReadCannotBeProtected`; mark a deliberate
+advisory read `[Unprotected("why")]`). Several command properties with the model's
+`Id` type are `AmbiguousReadModelLookup`: add `[LookUpBy]`. A lost race is HTTP 400
+`concurrencyViolation` (`ReadChanged`): the client resubmits; Arc does not re-run
+the command. `[ProtectedDecision]` with `DecisionRead<T>` is the older per-command
+opt-in; it still works and is not obsolete. A guard protects only guarded
+decisions: every writer that decides on the rule needs one, or the rule must be a
+constraint.
+
+`ARCCHR0011` (Info, `Off` only) and `ARCCHR0012` flag plain reads and immediate
+append bypasses. Return events, never append them directly. Read
 [protected and stream decisions](../cratis-arc-command/references/decisions-and-routing.md)
-when choosing the guard. This handler excerpt assumes `CartSummary` is an
-admitted projection; domain types are the slice's existing types.
+and
+[choosing how a rule holds](../cratis-chronicle-decision-reads/references/choosing-how-a-rule-holds.md)
+when choosing the guard. The example assumes `CartSummary` is a model-bound
+projection with a `CartId Id`; domain types are the slice's existing types.
 
 ```csharp
-using Cratis.Monads;
-using Cratis.Arc.Chronicle.ReadModels;
+using Cratis.Arc.Commands;
+using Cratis.Arc.Commands.ModelBound;
+using FluentValidation;
 
 [Command]
-[ProtectedDecision]
 public record AddItemToCart(CartId CartId, ItemId ItemId)
 {
-    /// <summary>Adds the item; rejects when the cart already holds the maximum.</summary>
-    /// <param name="cart">The current cart summary, resolved by the command's event-source id.</param>
-    /// <returns>The event on success, or a validation error.</returns>
-    public Result<ItemAddedToCart, ValidationResult> Handle(DecisionRead<CartSummary> cart) =>
-        !cart.Exists
-            ? ValidationResult.Error("Cart must exist.")
-            : cart.Instance.ItemCount >= 3
-                ? ValidationResult.Error("A cart can hold at most 3 items.")
-                : new ItemAddedToCart(ItemId);
+    /// <summary>Adds the item.</summary>
+    /// <returns>The event.</returns>
+    public ItemAddedToCart Handle() => new(ItemId);
 }
+
+public class AddItemToCartValidator : CommandValidator<AddItemToCart>
+{
+    public AddItemToCartValidator(CartSummary? cart) =>
+        RuleFor(c => c.CartId)
+            .Must(_ => cart is { ItemCount: < 3 })
+            .WithMessage("The cart must exist and hold fewer than 3 items.");
+}
+```
+
+Use `Result<TEvent, ValidationResult>` from `Handle()` only when the rule needs a value
+computed there:
+
+```csharp
+public Result<ItemAddedToCart, ValidationResult> Handle(CartSummary? cart) =>
+    cart is not { ItemCount: < 3 }
+        ? ValidationResult.Error("A cart can hold at most 3 items.")
+        : new ItemAddedToCart(ItemId);
 ```
 
 - `Result<TSuccess, TError>` is `Cratis.Monads.Result<,>` from Cratis
@@ -214,6 +255,8 @@ public record AddItemToCart(CartId CartId, ItemId ItemId)
   statements above compile without wrapping.
 - **Return the error; never throw it.**
 - One parameter per logical read model; several reads mean several parameters.
+- Keep the fetch for a *computed* key in `Provide()` with `IDecisionReads.Get`;
+  under `On`, `IReadModels` there is refused.
 
 ⚠️ **Two things the resolution does *not* do.** It does not key off the
 `[ReadModel]` attribute — a read model becomes injectable because a Chronicle
@@ -245,9 +288,13 @@ where absence is *not* `null`.
 ## Step 6 — Specify the rejection
 
 Every rule gets a specification of its failure case, using
-`CommandScenario<TCommand>`. For protected reads, call `UseDecisionReads()`
-before seeding actual events; pinned read models cannot supply a guard. Queue a
-competing append on the relevant route and assert the conflict. Assert **both** that the command did not succeed
+`CommandScenario<TCommand>`. For guarded reads, `new CommandScenario<T>()`
+selects the in-process log from the command's mode and dependencies (do not call
+`UseDecisionReads()`). Seed real events with `Given.ForEventSource(id).Events(...)`
+(pinned read models cannot supply a guard), queue a competing
+`AppendConcurrently(id, events...)` and assert
+`ShouldHaveValidationErrorBecauseOf(ValidationResultReason.ConcurrencyViolation)`.
+For the ordinary rejection, assert **both** that the command did not succeed
 and that it failed *as a validation*:
 
 ```csharp
@@ -273,9 +320,9 @@ the fact. See
 - **The rule never fires.** The read-model type has no backing Chronicle
   projection, reducer, `DbSet<T>`, or MongoDB collection, so nothing registered
   it for command-side resolution.
-- **Two requests both win.** A plain read was mistaken for a protected decision;
-  moving it to `Handle()` or returning `Result<,>` does not guard it. Enroll a
-  stream/projection decision read, or use an append-time uniqueness constraint.
+- **Two requests both win.** The project is on `Off` (the default) or `Measure`, so
+  the validator read is a hint; moving it to `Handle()` or returning `Result<,>`
+  does not guard it. Set `On`, or use a stream decision or a constraint.
 - **`ARC0005` on build.** `Provide()` returns a value no `Handle()` parameter
   consumes.