@cratis/pi 7.61.0 → 7.63.0

package/package/corpus/skills/cratis-screenplay-command-surface/references/validate-rules.md

@@ -10,9 +10,18 @@
 | `== <v>` / `!= <v>` | `currency == "NOK"`, `status != draft` |
 | `length == <n>` | `currency length == 3` |
 | `matches email` | the only named pattern; any other name is `PLAY0366` |
-| `matches "<regex>"` | ECMAScript; matches **any substring** unless anchored with `^…$`; an invalid pattern is `PLAY0367` |
+| `matches "<regex>"` | Portable linear dialect; any substring unless anchored `^…$`; invalid syntax PLAY0367, refused constructs PLAY0699 |
+| `contains "<text>"` / `not contains "<text>"` | Ordinal substring presence/absence on scalar non-enum text |
+| `starts with "<text>"` / `ends with "<text>"` | Ordinal prefix/suffix; quoted literal operands, not conditions |
 | `all > <v>` / `all >= <v>` | `lines.quantity all > 0` |
 | `rule <Name>` | `orgNumber rule BeAValidOrganizationNumber` |
+| `checksum luhn|mod11|mod97` | String concept `validate checksum luhn`; validates supplied/stored values too |
+
+Requires Screenplay 4.172.0 or later (`screenplay --version`) for checksum rules
+(ESM v21); older compilers refuse them with PLAY0268. A pattern's `checksum`
+modifier generates check digits but does not add validation. Check digits catch
+typos, not forgery. For generated-concept proof statuses, deterministic regex
+limits and PLAY0688 repairs, read [generated rules](generated-values-and-responses.md#generated-concept-rules-esm-v20).
 
 ## `not empty` means non-blank text
 
@@ -60,9 +69,10 @@ validate
 
 A bodied rule or fenced block on a validation, rule or policy binds as opaque code
 (ESM v3): the reference runner reports it unsupported, and a target must supply the
-implementation. Two exceptions never bind: the command `handler`, and a `file`
-constraint (the binder records the requirement, then rejects it with `PLAY0268`;
-only `unique` constraints bind).
+implementation. Attached command handlers and `file` constraints remain PLAY0268
+(only `unique` constraints bind). Pending command handlers beside unconditional
+`produces` instead bind as described commands; see [described handlers](described-handlers.md).
+Literal text rules, portable patterns and Studio desugaring: [text and match rules](text-and-match-rules.md).
 Stage renders pure reducer transitions and opaque policy bodies, but refuses command and
 concept code validations and rule predicates (STAGE-ESM-005): those are gap-fill code. Prefer a
 declarative rule when one can say it. What binds and what the executable model rejects (Date and

package/package/corpus/skills/cratis-screenplay-command-surface/verification.json

@@ -4,6 +4,11 @@
   "fixtures": [],
   "assertions": [
     { "kind": "play-compiles" },
+    { "kind": "skill-contains", "value": "Unsupported (`ImplementationBody`)", "file": "references/described-handlers.md" },
+    { "kind": "skill-contains", "value": "including Stub mode", "file": "references/described-handlers.md" },
+    { "kind": "skill-contains", "value": "DecisionStateChanged", "file": "references/protected-reads.md" },
+    { "kind": "skill-contains", "value": "checkPortableMatchPattern", "file": "references/text-and-match-rules.md" },
+    { "kind": "skill-contains", "value": "U+00A0", "file": "references/text-and-match-rules.md" },
     { "kind": "skill-contains", "value": "screenplay_declaration_details", "file": "references/generated-values-and-responses.md" },
     { "kind": "skill-contains", "value": "do not hand-edit the text", "file": "references/generated-values-and-responses.md" },
     { "kind": "skill-contains", "value": "A CLI-bundled MCP can lack this summary", "file": "references/generated-values-and-responses.md" },
@@ -42,7 +47,7 @@
     },
     {
       "kind": "skill-contains",
-      "value": "`produces` and `handler` are mutually exclusive"
+      "value": "A file/code `handler` cannot coexist with `produces`"
     },
     {
       "kind": "skill-contains",
@@ -54,11 +59,11 @@
     },
     {
       "kind": "skill-contains",
-      "value": "`reads` is not a protected read"
+      "value": "command reads protected"
     },
     {
       "kind": "skill-contains",
-      "value": "Adding a\n`concurrency` block does not fix this"
+      "value": "reads/concurrency cannot combine (PLAY0783)"
     },
     {
       "kind": "skill-contains",
@@ -93,6 +98,8 @@
       "value": "Generated identifiers need Uuid or String backing and at least 64 random bits.", "file": "references/generated-values-and-responses.md"
     },
     { "kind": "skill-contains", "value": "Generated values and responses (ESM v7 and v15)" },
+    { "kind": "skill-contains", "value": "names that can match together report PLAY0367", "file": "references/text-and-match-rules.md" },
+    { "kind": "skill-contains", "value": "or reaction `where` remain PLAY0268", "file": "references/text-and-match-rules.md" },
     { "kind": "skill-contains", "value": "Generated values are not request inputs", "file": "references/generated-values-and-responses.md" },
     { "kind": "skill-contains", "value": "Generated-concept validation rules select ESM v20", "file": "references/generated-values-and-responses.md" },
     { "kind": "skill-contains", "value": "PLAY0688 and a violating example", "file": "references/generated-values-and-responses.md" },

package/package/corpus/skills/cratis-screenplay-event-modeling/SKILL.md

@@ -108,7 +108,7 @@ The independent verdicts V1 to V5 that report them are in
 `cratis-screenplay-modeling-lifecycle`.
 
 What binds depends on **which tool** you ask, so name the tool and its version:
-Read [references/parsed-not-runnable.md](references/parsed-not-runnable.md) (section "What binds depends on which tool") when stating what a tool binds or renders (`reads`/`concurrency` fail with `PLAY0271`; `persona` declarations are report-only; an older bundle reports *Slice '<name>' of type '<type>' is not admitted by ESM v1.*).
+Read [references/parsed-not-runnable.md](references/parsed-not-runnable.md) (section "What binds depends on which tool") when stating what a tool binds or renders (legacy reads and `concurrency` fail with `PLAY0271`; protected command reads opt into v25; `persona` declarations are report-only; an older bundle reports *Slice '<name>' of type '<type>' is not admitted by ESM v1.*).
 
 The ESM versions, the full disposition table and the Step 7 clock example's binding
 result are in [references/parsed-not-runnable.md](references/parsed-not-runnable.md)
@@ -169,19 +169,19 @@ compile or will not be safe. Both are deliberate.
 
 - **A command may read state.** The generic method forbids `ReadModel -> Command`
   edges. Screenplay ships `reads <ReadModel> [as <alias>] [by <property>]` so the
-  model shows what a state-dependent decision consulted. **It is not a protected
-  (open limitation):** nothing checks at append time that the state is still current,
-  the executable model rejects `reads` and `concurrency` (`PLAY0271`), and adding
-  `concurrency` does not make the decision safe .
-  Write a state-dependent rule as `reads <View>` plus `require <expr> message "..."`
-  and mark it in the slice `description` as **not enforced in the model today**,
-  naming the target that must enforce it (Arc `[ProtectedDecision]` with
-  `DecisionRead<T>`, Chronicle's dynamic consistency boundary, or a constraint where
-  one fits). Model uniqueness as a `unique` constraint. Never copy state into a
+  model shows what a state-dependent decision consulted. Application-root
+  `command reads protected` admits eligible command reads as v25: absent state
+  rejects and matching decide/commit changes conflict. Read
+  [protected reads](../cratis-screenplay-command-surface/references/protected-reads.md)
+  for the strict shape and paths. Legacy reads remain PLAY0271; `concurrency` is
+  not protection and cannot combine with protected reads. Stage refuses protected reads
+  (STAGE-ESM-044), not v25 itself: name target enforcement separately rather than claiming a render.
+  Write state-dependent rules as `reads` plus `require` with an indented message;
+  mark refused shapes as unenforced and name the intended target mechanism. Model uniqueness as a `unique` constraint. Never copy state into a
   command input, add an attestation flag, or hide the rule in `handler` prose. Do not
   use `reads` to fetch data the command could carry as input. A reaction trigger
-  declares the views an automation decides from with the same `reads`, and the same
-  caveat applies.
+  declares consulted views with `reads`, but trigger reads remain unprotected;
+  decide in an invoked command instead.
 - **Some validation *does* belong in the model.** The generic method routes format
   rules to the type system. Screenplay's type system *is* the `concept`, and a
   concept carries its own `validate` block - so a format rule lives on the concept

package/package/corpus/skills/cratis-screenplay-event-modeling/references/parsed-not-runnable.md

@@ -34,7 +34,7 @@ Tool versions and consumer boundaries: toolchain `SKILL.md`.
 | Compliance concepts | Bare `pii`/`personal` and `secret`, qualifiers and scope bind as v13; enum/identity compliance and events combining personal or explicitly subject-scoped secret values with an explicit `subject` mark refuse PLAY0268 at binding only. A CLI bundle that admits v13 binds markers; Stage renders v13 protection, not protected identities/enums or subject lineage. Never remove protection |
 | Identity details / processing purposes / event subject | Report-only metadata; executable detail reads refuse PLAY0268, not source declaration errors |
 | Composite stream ids | v8 routing; complete named parts/canonical comparisons, PLAY0515 refuses protected keys/sources; not a legacy text split |
-| Command reads/concurrency | Legacy unprotected decisions, PLAY0271 |
+| Command reads/concurrency | Eligible reads opt into v25 with `command reads protected`; legacy reads/concurrency retain PLAY0271; Stage refuses protected reads (STAGE-ESM-044), not the v25 pair |
 | Invokes-only trigger reads | Report-only, not protected state; direct production with reads refuses |
 | Generated values/responses | v7 binding/reference execution; v15 strategies/strict fixtures/freshness. Stage renders supported UUID/String strategies, responses and fixtures; unsupported types/combinations remain -028/-038 |
 | Sources/streams and command/specification routes | v8 binding/reference execution; the CLI (toolchain `references/renderable-subset.md`) reaches Stage checks through its bundled ceiling (v16 without v17 support) |
@@ -70,8 +70,10 @@ accepted proposal or parsed node with a running application.
 - `Automation` and `Translate` slices, reactions, captures and triggers bind (ESM v6) on the
   standalone tool and a CLI bundle that admits v6. (An older bundle
   reports *Slice '<name>' of type '<type>' is not admitted by ESM v1.*) Stage renders supported event-triggered Automation, not Translate/captures or non-event triggers.
-- `reads` and `concurrency` on a command do not bind (`PLAY0271`), so no decision is
-  protected against stale state. A reaction trigger's `reads` that only `invokes` is
+- Eligible command reads bind/reference-execute with `command reads protected`
+  (v25); legacy reads and `concurrency` remain PLAY0271. Read command-surface
+  [protected reads](../../cratis-screenplay-command-surface/references/protected-reads.md)
+  for admission, absence/conflicts and Stage refusal. A reaction trigger's `reads` that only `invokes` is
   report-only intent (`PLAY0270`); one that `produces` directly fails binding (`PLAY0268`).
 - `persona` declarations are report-only and never block; bare `pii` and `secret`
   concepts bind as ESM v13 (Requires Screenplay 4.141.0 or later); Stage renders admitted v13 protection.

package/package/corpus/skills/cratis-screenplay-event-modeling/verification.json

@@ -45,7 +45,11 @@
     },
     {
       "kind": "skill-contains",
-      "value": "It is not a protected"
+      "value": "command reads protected"
+    },
+    {
+      "kind": "skill-contains",
+      "value": "Legacy reads remain PLAY0271"
     },
     {
       "kind": "skill-contains",

package/package/corpus/skills/cratis-screenplay-legacy-extraction/SKILL.md

@@ -137,8 +137,8 @@ chain per slice before handoff (`references/evidence-table-template.md`, "Tracea
    - one StateChange per decision a person or system makes; events are facts experts recognise;
      consequences (counters, denormalised copies) become projections; an automation only when
      evidence shows a separate decision; no generic names (`Update/Edit/Save<Noun>`, `<Noun>Updated`): split by intent;
-   - refusals, state-dependent rules (`reads` + `require`, marked **NOT enforced in the model
-     today** with the target named), unique indexes and preserved `pii` / `secret` protection:
+   - refusals, state-dependent rules (`reads` + `require` with eligible protected-read
+     opt-in; legacy/refused shapes marked unenforced and target realization named), unique indexes and preserved `pii` / `secret` protection:
      `references/rule-modeling.md`. Every role gate has `authorize` plus a `then denied` spec,
      else a recorded gap; rules you cannot express truthfully are recorded one by one, never
      fabricated.

package/package/corpus/skills/cratis-screenplay-legacy-extraction/references/evidence-table-template.md

@@ -57,7 +57,7 @@ Example rows:
 | id | source | locator | observed fact | technical shape | strength | classification | gen. disposition | candidate | decision | decided by | verdict |
 |---|---|---|---|---|---|---|---|---|---|---|---|
 | E1 | dynamic | capture 0007, `POST /api/checkins` | taking in a coat writes two tables | insert `Checkins`; update `Hooks(occupied)`; 201 x41, 409 x3 | Observed | intent (take in) + consequence (hook) | n/a | `TakeInCoat` -> `CoatTakenIn`; occupancy via projection | change | proposed | not asked |
-| E2 | code | `CheckinService.cs` | 409 when the hook is already free, message "That coat is not on a hook" | throws `ConflictException` | Read | intent (rule) | n/a | `reads CoatStatus` + `require`, NOT enforced today (target: protected decision or Chronicle `concurrency` scope); no executable error spec, recorded in LOSS.md | keep | proposed | not asked |
+| E2 | code | `CheckinService.cs` | 409 when the hook is already free, message "That coat is not on a hook" | throws `ConflictException` | Read | intent (rule) | n/a | legacy control: `reads CoatStatus` + `require` without protected opt-in; inspect v25 admission, record refused shape/Stage target gap in LOSS.md | keep | proposed | not asked |
 | E3 | static | `static.play`, SP0016 at `CheckinValidator` | validation rule held to a condition is emitted unconditionally; the condition is lost | `When(x => x.IsVip)` | Exact (loss) | unknown | Lowered without its condition (semantic mismatch, reported by SP0016) | none yet | undecided | - | question Q4: when does the rule really apply? read `CheckinValidator` and ask an expert |
 | E4 | dynamic | uncorrelated txn, `Hooks` nightly 02:00 | hook flags reset without a command | update `Hooks(*)` daily | Observed | unexplained | n/a | none | undecided | - | question Q5 |
 

package/package/corpus/skills/cratis-screenplay-legacy-extraction/references/generated-recovery.md

@@ -24,6 +24,20 @@ Each recovery below has its own gate; use the adapter that has the one you rely
 
 - Requires Arc.Screenplay 22.78.0 or later for `[GeneratedValue]` Handle parameters whose `New()` is a UUID v4 form, for the `generated identifier` and response they produce, and for scenario pins (`for` / `generated`). Before it none of this is recovered. From 22.78.0 until 22.86.0 any other strategy keeps its source form and reports SP0073.
 - Requires Arc.Screenplay 22.86.0 or later to recover UUIDv7, ULID, TypeID, NanoID, `Bytes` and hex strategies as concept `generate` lines (ESM v15) and a passed-through `GenerationContext`.
+- Requires Arc.Screenplay 22.101.0 for generated-concept validator recovery (ESM
+  v20); check `dotnet list package --include-transitive`. Older adapters withhold
+  generation on rule-bearing concepts. Recovery covers only a fully recovered,
+  non-opaque default validator: Proven rules emit, Unproven rules remain with
+  SP0078, Refuted rules withhold generation with SP0073 and a counterexample.
+  Generation is also withheld with SP0073 (rules kept) when the validator is
+  unreadable, conditional or names a predicate (`rule <Name>`), when a UUID
+  concept has any validator, when the concept carries `pii` or `secret`, and
+  below a v20 cap.
+- Requires Arc.Screenplay 22.107.0 for pattern/random, checksum validation and
+  self-contained String generation-rule recovery (ESM v21); older adapters leave
+  those factories in code with SP0073. A v20-or-lower cap withholds generation
+  and dependent values/mappings/responses/destinations/scenarios, preserving
+  checksum validation as a source attachment rather than dropping it.
 
 Tagged evidence:
 
@@ -38,24 +52,30 @@ Tagged evidence:
 Use the [same shop vocabulary](../../cratis-screenplay-command-surface/references/shop-generation.md):
 CustomerId (`cus_` + ULID), OrderId (TypeID), InviteCode (NanoID), ApiKey (secret
 Bytes(32) with .NET `[NotAudited]`). Do not claim exact recovery of every factory:
-the custom `cus_` interpolation is not a recognized single factory call;
-TypeID can recover a passed-through context's strategy, not equivalent receipt-time/
-tenant behavior. Context-member bodies and generated secrets remain unreleased
-Screenplay scope. Preserve ApiKey's protection and source code, not an unprotected
+a custom `cus_` interpolation may recover as a self-contained String rule, not as
+an inferred built-in prefix strategy. TypeID recovers a passed-through context's
+strategy, not proof of equivalent receipt-time/tenant behavior. Context-member
+String bodies can recover under the v21 gate; generated secrets stay in code.
+Recovered rule fixtures supply a String result without reference execution of the body. Preserve ApiKey's protection and source code, not an unprotected
 replacement String. The intentional candidate can author the released customer
 prefix strategy with an explicit target decision, separate from as-is proof.
 
 Recover the strategy the source proves; do not choose a replacement because a
 factory is named `New()`. Use the existing [strategy reference](../../cratis-screenplay-command-surface/references/generated-values-and-responses.md)
-for meaning and shapes, then the forms below for parameter factories, literal pins
+for meaning and shapes (including readable InvoiceNumber patterns and random Int
+TicketNumber values), then the forms below for parameter factories, literal pins
 and retained source pointers.
 
 ## When not to
 
 Do not infer generation for client-supplied IDs, deduplication keys or gapless
 invoice numbers, or turn an observed secret into a random String. Preserve
-protection and unrecovered code; rule/context-member bodies are not executable
-strategies. Report missing pins, withheld productions/scenarios and version caps
+protection and unrecovered code. A pattern is not a gapless/sequential allocator
+or secret; check digits detect typos, not forgery. Low-entropy payload codes need
+uniqueness separate from source freshness. Arc recovery does not imply rendering:
+Requires Stage 4.118.0 for checksum validation and 4.119.0 for pattern/random;
+older renderers refuse them. `generate rule` still refuses STAGE-ESM-028.
+Report missing pins, withheld productions/scenarios and version caps
 as losses, not successful recovery. Sources: Arc
 `Documentation/backend/csharp/generating-a-screenplay.md`;
 Screenplay `Documentation/screenplay/generated-values/choosing.md`.
@@ -65,8 +85,8 @@ Screenplay `Documentation/screenplay/generated-values/choosing.md`.
 The UUID v4 forms, pins and the identifier/response rules in this section need Arc.Screenplay 22.78.0 or later; the other strategies in the list below need 22.86.0 or later.
 
 A `[GeneratedValue]` Handle parameter becomes a generated command property only
-for a required scalar Uuid/String concept with a proven strategy and no validator,
-validation rules or compliance markers. Its explicit attribute name, otherwise
+for a required scalar Uuid/String or signed Int32/Int64 random concept with a proven strategy and no compliance
+markers. Validator rules recover under the v20 gate above, not by deleting them. Its explicit attribute name, otherwise
 parameter name, becomes the property name. A directly returned event-source
 identity (alone or beside an event) adds `generated identifier` and a response;
 a direct `EventForEventSourceId(parameter, event)` target adds the identifier
@@ -85,10 +105,26 @@ Constructors/conversions must forward the primitive unchanged. Recoverable calls
 - `RandomNumberGenerator.GetHexString(...)` → hex bytes only with an even literal
   character count; preserve its requested casing.
 
-A passed-through `GenerationContext` parameter is readable for UUIDv7/ULID/TypeID;
-reading `context.Now` or `context.Tenant` is not. Helper calls, multi-statement
-bodies, computed/invalid arguments and rule/pattern/random execution stay in code
-with SP0073. Never invent a rule body or implementation-file reference.
+Under the v21 recovery gate, literal `GenerateValue.Pattern(pattern[, checksum])`
+and its passed-through context overload recover `generate pattern`; dated patterns
+require that context overload. `GenerateValue.Integer(min, max)` recovers inclusive
+signed Int64 `random`; an Int32 concept needs exactly one `(int)` cast with both
+bounds inside Int32. Invalid/computed arguments, unsigned backing and extra casts
+stay in code with SP0073. Screenplay checks pattern support, proofs and entropy.
+
+An unconditional default validator's `Must(v => GenerateValue.HasValidChecksum(v,
+Checksum.Luhn))` recovers `validate checksum luhn` (also Mod11/Mod97). None,
+conditional predicates and arbitrary helper predicates are not checksum rules.
+
+A self-contained String factory can instead recover `generate rule <Concept>New`
+with an inline `csharp` body, stripping only proven forwarding constructions.
+Literal/primitive locals, `context.Now`, `context.Tenant`, string, Math, Convert,
+Guid, RandomNumberGenerator and GenerateValue are allowlisted; multi-statement
+bodies can qualify. Compound time-based calls must pass the captured context.
+Private helpers, fields, DI, aliases/static imports, ambient time, raw Default
+comparisons and external dependencies remain SP0073; no file fallback is invented.
+This is the Cratis C# binding to Fundamentals' GenerationContext, not a universal
+runtime type. Opaque entropy is unknown, so a rule cannot supply an identifier.
 The concept owns `generate`; each command property only marks generation.
 Use the shared [strategy reference](../../cratis-screenplay-command-surface/references/generated-values-and-responses.md)
 for exact encodings, ranges, entropy and admission, rather than duplicating them.
@@ -119,7 +155,8 @@ resolved adapter version, diagnostic, retained/withheld form and open question:
 
 | Diagnostic | Loss to reconcile |
 | --- | --- |
-| SP0073 | Unproven strategy/body/arguments, or non-default strategy above the ESM cap; no replacement strategy inferred. |
+| SP0073 | Unproven strategy/body/arguments, refuted generated-concept rule with witness, or generation above the ESM cap; no replacement strategy inferred. |
+| SP0078 | Generated-concept rule proof is Unproven; preserve the rule and reason, not a claim of Proven generation. |
 | SP0052 | Unadmitted generated value, dependent response or pre-generation protection stays in code; local-generation fallback is not parameter recovery. |
 | SP0012 | A required payload mapping or condition needs an unavailable value/read: withhold the whole production, never prune it into an incomplete fact. An optional blocked mapping can be omitted alone. |
 | SP0039 | Missing/unreadable pins, unrecoverable source identities or outcomes withhold the whole scenario. Name what was lost. |

package/package/corpus/skills/cratis-screenplay-legacy-extraction/references/intent-example.md

@@ -1,5 +1,10 @@
 # Intentional candidate example
 
+Legacy control: this candidate deliberately omits `command reads protected`, so its
+unenforced markers are about this source. Eligible command reads can instead opt
+into v25; inspect all reads before migration and keep target realization separate.
+Read [protected reads](../../cratis-screenplay-command-surface/references/protected-reads.md).
+
 A complete, compiling example of what extraction produces: one legacy write that touched two
 tables (`Checkins`, `Hooks`) is re-sliced into a single decision event plus a projection. The
 numbers in the slice descriptions (`E1`, `E6`, `Q3`) are evidence ids and open questions from

package/package/corpus/skills/cratis-screenplay-legacy-extraction/references/loss-report-template.md

@@ -35,7 +35,8 @@ and the question raised.
 ## Rules not enforced or not expressible today
 One line per rule, named individually (never one generic platform caveat): the rule, its
 evidence row, the invariant and consistency risk, and the target enforcement. State-dependent
-checks are written as `reads` + `require` and marked NOT enforced in the slice description;
+checks use `reads` + `require`: eligible reads opt into v25 protection, while legacy/refused
+shapes are marked unenforced and Stage realization remains a separate gap;
 date rules and opaque policies that no declaration can state stay in the slice `documentation` and here.
 
 ## Unknowns and undecided target decisions

package/package/corpus/skills/cratis-screenplay-legacy-extraction/references/rule-modeling.md

@@ -12,9 +12,12 @@
 
 ## State-dependent rules
 A rule that depends on stored state (current status, existing records, balances) is written
-as `reads <View>` + `require <expr> message "…"` and the slice description says it is **NOT
-enforced in the model today** (PLAY0268/0271 at binding are expected in design mode).
-Name the invariant, the race it leaves open, and the target:
+as `reads <View>` plus `require` with an indented message. Opt eligible views into
+application-root `command reads protected` (v25); test present/absent state and rule
+refusal, and matching decide/commit conflicts. Read
+[protected reads](../../cratis-screenplay-command-surface/references/protected-reads.md)
+for admission and Stage's refusal. For legacy/refused shapes, mark the rule unenforced.
+Name the invariant, the race it leaves open and the target realization:
 `[ProtectedDecision]` + `DecisionRead<T>` (Arc 22.39.0 and later; available to gap-fill
 in Stage's rendered package set, not automatically emitted), or a Chronicle
 `concurrency` scope on the event source or stream, or a constraint where one fits. Forbidden: caller-supplied copies of state

package/package/corpus/skills/cratis-screenplay-legacy-extraction/references/signal-to-intent.md

@@ -71,7 +71,7 @@ files on it. Each hop has a typical yield:
 
 | Path | Hops | What to take from it |
 |---|---|---|
-| Write | entry point (route, handler, form action), input model and validation, service, entity, repository, schema or migration, response and error mapping | the command name and inputs; `validate` rules with their exact messages; state-dependent checks (`reads` plus `require`, NOT enforced); unique indexes; the error mapping gives the `then error` text and the legacy HTTP code for the slice `documentation` |
+| Write | entry point (route, handler, form action), input model and validation, service, entity, repository, schema or migration, response and error mapping | the command name and inputs; `validate` rules with their exact messages; state-dependent checks (`reads` plus `require`, eligible protected opt-in or recorded legacy/refused shape and target gap); unique indexes; the error mapping gives the `then error` text and the legacy HTTP code for the slice `documentation` |
 | Read | entry point, query or repository, response model, paging and filter conventions | the read-model shape and query arguments (`by`, `filter`); which caller may narrow what |
 | Background | listeners, after-commit hooks, message consumers, schedulers, outbox relays | reaction or translation candidates; say "none found" when there is none |
 

package/package/corpus/skills/cratis-screenplay-model-authoring/SKILL.md

@@ -40,25 +40,18 @@ editing concept generation or `generated identifier`.
 
 ## When not to
 
-The same reference separates inputs, credentials and context/secret generation that is not available.
+For generation proofs/PLAY0688 repairs, read [generation details](references/mcp-tools.md#concept-generation):
+use `rules[]`, not parsed diagnostics (Requires Screenplay 4.173.0,
+`screenplay --version`; older servers omit proofs).
 
 ## Locate and connect
 
 Use the declared `screenplay` MCP server (for example `open-workspace`).
 
-Never ask the user which folder to use before trying. Call `open-workspace` with no
-arguments first: a server started without a fixed root binds the folder the host or
-launch directory offers (the client's single workspace root, else the working
-directory when it holds `.play` files). Only when it answers that no root was given,
-or that several roots are offered, pass `path`: the folder holding the project's `.play` files, otherwise the
-folder the user names. Without a project, the server works in `Documents/Screenplay`
-in the user's home folder, so do not invent a location. A root fixed at launch
-can switch only to the same model folder in a registered Git worktree of the
-same repository; rules and refusals are in [MCP loop](references/mcp-loop.md).
-
-Prefer a fixed root (dynamic-roots history: [MCP loop](references/mcp-loop.md)). Send `initialize` and
-`notifications/initialized` before any tool call, then discover `tools/list`
-schemas rather than relying on a remembered count.
+Never ask the user which folder to use before trying `open-workspace` without
+arguments; do not invent a root. Read [MCP loop](references/mcp-loop.md) when connecting or switching roots;
+it owns fallback discovery, fixed-root limits and the initialization protocol.
+Discover `tools/list` schemas rather than relying on a remembered count.
 
 
 Look first for the project's existing `.play` files: their folder is the model.
@@ -71,20 +64,12 @@ explanatory Markdown belongs in repository documentation.
 `mcp-servers.json` declares the Screenplay server; supported client registration
 is owned by the Cratis CLI, which preserves other servers and user configuration.
 
-The CLI entry point is:
-
-```shell
-cratis screenplay mcp <model-folder>
-```
+The CLI-bundled MCP can be older than the standalone tool: discover schemas.
+Read [MCP loop](references/mcp-loop.md) for launch options. Use the supported
+channel, not another global tool, Docker or copied managed configuration.
 
-The CLI-bundled MCP can be older than the standalone tool and lack newer capabilities, such as the generation summary and entropy repairs.
-Discover installed capabilities. Do not ask for a second global .NET tool, Docker
-or hand-copied managed MCP configuration. Installation/status must confirm adapter
-support and no conflicts.
-
-If the MCP is unavailable, report that gap. Do not claim compiler-validated AST
-editing while falling back to regex. Existing standalone `screenplay mcp` users
-can keep that entry point; use the project's supported installation channel.
+If MCP is unavailable, report it; regex edits are not compiler-validated AST
+editing. Existing standalone `screenplay mcp` users may retain that entry point.
 
 ## Understand before editing
 
@@ -96,7 +81,9 @@ can keep that entry point; use the project's supported installation channel.
    `kind: "Property"`, `Owner.member` / `Owner.generationN.member`, direct mappings.
    `complete: false` is incomplete evidence, never a successful empty list.
    Edit through MCP proposals, not hand-edited text; [generation](references/mcp-tools.md#concept-generation).
-3. Read diagnostics and coverage limitations. Use `dependency-graph` for container
+3. Read diagnostics and coverage limitations. Identify subjects by code and typed
+   `arguments`, never by parsing message text. Read [diagnostic arguments](../cratis-screenplay-toolchain/references/diagnostic-arguments.md)
+   for kinds, PLAY0524 step paths/indices, unknown fields and older responses. Use `dependency-graph` for container
    edges, declared-dependency coverage, cycles and advisory order; the board's
    dependency-map toggle exposes this evidence visually. Unknown or ambiguous
    bindings are not an empty, successful dependency graph.
@@ -114,6 +101,13 @@ Keep reads scoped to the relevant module, feature, slice or document. Do not
 request a whole merged AST when a bounded declaration/property query answers the
 question. Size-limit refusals require narrower reads, not truncation.
 
+## Application modes and described handler intent
+
+Start new models with `reaction batches atomic`; preserve it through proposals.
+Read [language admission](../cratis-screenplay-toolchain/references/language-admission.md)
+for atomic/protected modes and Stage refusals. Read [intent inventories](references/mcp-tools.md#dependencies-and-intent-inventories)
+for handler views: `executableReady` means binding, not an implemented body.
+
 ## Compare models
 
 For a `main` comparison, pass a worktree `path` to `semantic-diff`, not two

package/package/corpus/skills/cratis-screenplay-model-authoring/references/choosing-generation.md

@@ -7,14 +7,21 @@
 
 Follow the [threaded shop model](../../cratis-screenplay-command-surface/references/shop-generation.md):
 CustomerId (`cus_` + ULID), OrderId (TypeID) and InviteCode (NanoID) are released
-strategies. ApiKey stays secret without executable generation. Neither the
-OrderId's Arc received-time/tenant context nor ApiKey's .NET Bytes(32) secret
-factory can be promised as Screenplay generation today.
+strategies. InvoiceNumber uses a readable pattern/checksum and TicketNumber an
+Int pickup-ticket range. ApiKey stays secret without executable generation.
+An attached generation rule can use Now/Tenant, but the reference runner consumes
+pinned Strings rather than executing its implementation.
 
 For a server-owned new value, choose implicit UUID for an ordinary identity,
 UUIDv7 for time-ordered UUIDs, ULID for compact time-ordered text, TypeID for
 recognizable typed text, NanoID for opaque text, or bytes for an exact random-bit
-budget. Inspect entropy separately from executable admission; prefixes add no
+budget. Choose `pattern` for readable references (dates/check digits add no
+entropy), `random` for bounded Int values, `rule` only when an opaque implementation
+is needed.
+
+Requires Screenplay 4.172.0 (`screenplay --version`) for these v21 constructs; older compilers refuse PLAY0268.
+
+Inspect entropy separately from executable admission; prefixes add no
 random bits and identifiers need at least 64. Time-ordered is not strict
 millisecond ordering. Use the existing [strategy and MCP reference](../../cratis-screenplay-command-surface/references/generated-values-and-responses.md),
 not a per-property strategy: the concept owns `generate`, the command property
@@ -23,7 +30,13 @@ says `generated identifier` or `generated`.
 ## When not to
 
 Do not replace client-minted inputs, authorization, idempotency keys or a gapless
-invoice allocator with generation. Secret generation, pattern/random/rule execution
-and generated-concept rule consistency are not released capabilities. Preserve
-refused rules instead of deleting them or inventing a repair.
+invoice allocator with generation. Patterns are not sequential/gapless allocators
+or secrets; check digits detect typos, not forgery. Use a unique constraint for
+short payload codes, and retain whole-source freshness for generated destinations.
+Secret generation and sequence allocation remain refused. Inspect authored-order
+MCP `rules[]` and `derivedPattern` for rule proofs and reviewed PLAY0688 repair;
+never delete a business invariant to silence PLAY0689. Read
+[Stage admission](../../cratis-stage-rendering-and-sandbox/references/admission.md)
+for checksum validation and pattern/random rendering prerequisites.
+`generate rule` remains STAGE-ESM-028, so model admission does not promise rendering.
 Sources: `Documentation/screenplay/generated-values/choosing.md` and `Documentation/screenplay/generated-values.md` in `Cratis/Screenplay`.

package/package/corpus/skills/cratis-screenplay-model-authoring/references/language-reference.md

@@ -260,16 +260,21 @@ See read-surface `references/named-keys.md` for the collection-key exclusion alg
 | Information only, never blocks | `persona` (report-only: `PLAY0270`, the policies it lists must exist), `authentication`, `domain`, `seed`, descriptions and `file` provenance. A persona does not block binding and does not change behavior, so state persona scope in a description or a policy the model uses |
 | Binds as ESM v7 (`PLAY0268` on a compiler that stops before v7) | `generated` properties and `returns` responses, generated fixtures and `then returns`: bound and executed by the reference runner; a policy, rule or requirement that references a generated value is `PLAY0273`, and generated-concept rules select v20 with PLAY0688/0689 proof diagnostics. Stage renders supported UUID/String strategies, scalar/named responses and fixtures; unsupported types/result combinations remain `-028`/`-038` |
 | Authorable, not executable (PLAY0268) | Systems/operations, the `numbers exact` source mode (PLAY0268; exact lowering of qualifying Double literals is the admitted v11) remain unadmitted |
-| Concept generation strategies (ESM v15) | Required scalar generatable Uuid/String concepts; concept-owned uuid/uuidv7/ulid/typeid/nanoid/bytes strategies and admitted modifiers. Strict fixture encoding; Guarded whole-source freshness rejects Concurrency with no append/retry. Generated secrets, pattern/random/rule and sequence remain refused; generated-concept rules select v20. Stage renders supported strategies: command-surface `references/generated-values-and-responses.md` |
+| Concept generation strategies (ESM v15) | Required scalar generatable Uuid/String concepts; concept-owned uuid/uuidv7/ulid/typeid/nanoid/bytes strategies and admitted modifiers. Strict fixture encoding; Guarded whole-source freshness rejects Concurrency with no append/retry. Generated secrets and sequence remain refused; generated-concept rules select v20, pattern/random/rule and checksum validation select v21. Stage renders supported strategies: command-surface `references/generated-values-and-responses.md` |
 | Response-name UI continuations (no ESM change) | Form submit and execute-success scopes, own failure PLAY0685, nested shadowing and outer success in inner failure; field/parameter precedence. An older bundled compiler lacks resolution; Scene runtime binding remains downstream. UI composition `references/response-continuations.md` |
 | Collection equality filters (ESM v14) | Caller-supplied `filter name Type [optional]`, no `from`, matching a same-named scalar primitive/concept/enum read-model property with the same nominal type. AND with `by`; optional omission does not narrow, supplied null is refused. PLAY0468 covers unknown/repeated/missing required spec arguments; result rows compare by read-model/key regardless of order. Read read-surface `references/equality-filters.md` for the compiled example and renderer ceilings |
 | Recovery and no-event assertions (ESM v17) | `when redelivered` delivers one given occurrence to one reaction without append; `then no events` checks no new facts, excluding append input. Requires Screenplay 4.157.0 or later (`screenplay --version`); older compilers report PLAY0268. |
 | Query Validation rejection (ESM v18) | Exactly one queried call plus one `then error`, no other action/result/denial. Concept key/supplied filters validate after authorization in every version. Requires Screenplay 4.161.0 or later (`screenplay --version`); older runners may answer absence. |
 | Invocation refusal branches (ESM v19) | Ordered first-match `on refused` productions or acknowledgement, `$refusal` values; bare refusal excludes authorization. Requires Screenplay 4.160.0 or later (`screenplay --version`); older compilers report PLAY0268. |
-| Generated-concept rules (ESM v20) | Proven rules bind, Refuted PLAY0688 errors, Unproven PLAY0689 warnings; fixtures obey shape and rules. Requires Screenplay 4.164.0 or later (`screenplay --version`); older compilers report PLAY0268. |
+| Generated-concept rules (ESM v20) | Proven rules bind silently, Refuted PLAY0688 errors include a witness, Unproven PLAY0689 warnings include a reason; deterministic regex containment only, not passing samples. Fixtures obey shape and rules. Requires Screenplay 4.164.0 or later (`screenplay --version`); older compilers report PLAY0268. |
+| Finite generation and attachments (ESM v21) | String pattern with optional Luhn/Mod11/Mod97 checksum, inclusive Int random range, attached String generation rule with language-neutral Now/Tenant context and String result, String checksum validation. Requires Screenplay 4.172.0 (`screenplay --version`); older compilers report PLAY0268. PLAY0691 is support-budget exhaustion, PLAY0692 empty support on a scanned date. Pin date fixtures with given clock. Requires Stage 4.118.0 for checksum validation and 4.119.0 for pattern/random rendering; older renderers refuse them. `generate rule` remains STAGE-ESM-028; see command-surface `references/generated-values-and-responses.md`. |
+| Atomic reaction batches (ESM v22) | Root `reaction batches atomic`; direct productions per occurrence and selected refusal branches are separate batches, commands independent; Stage refuses v22 and atomic mode |
+| Described handlers (ESM v23) | Pending implementation beside unconditional produces; payload-only contract, reached body Unsupported ImplementationBody; Stage STAGE-IMPL-002 even Stub mode |
+| Ordinal text rules (ESM v24) | contains/not contains/starts with/ends with on scalar non-enum text properties; quoted literals, not conditions; Stage semantic engines execute/render |
+| Protected command reads (ESM v25) | Root `command reads protected`; eligible read paths in requirements and production mappings, absence Validation, concurrent matching facts Conflict; Stage admits v25 but refuses protected reads STAGE-ESM-044 |
 | Current routing and actor admission | Sources/streams and command/specification routes bind and reference-execute as v8; reaction `runs as system role` supplies the invocation actor as v10. Whole-workspace binding determines executable availability; CLI/Stage realization remains separate |
-| Blocks binding (`PLAY0268`) | enum/identity compliance and events combining personal or explicitly subject-scoped secret values with explicit subject marks; a compiler that stops before v13 refuses all `pii`/`secret` concepts ("compliance attributes require portable data-subject semantics"), while v13 binds them and Stage renders protection; command `handler` (never binds; a command cannot declare both `produces` and `handler`, `PLAY0035`), bare `rule <Name>`, `require` or conditions over read-model paths, dates and `today` in comparisons, `$context.tenant`/claims/roles/causation in `produces`, `$env` conditions, `file` constraints, unquoted `import` of an external contract, a read model with neither explicit `key` nor unambiguous query-based identity as described above (composite keys remain unadmitted), queries with context `from` sources (typed query context is unadmitted), single-result filters (collections only), `scoped to` (opaque scope), `performer` (opaque implementation) or composite `by` blocks; optional keyed and collection queries, including caller-supplied equality filters and observable delivery, bind, `$causedBy` and templates in projections |
-| Blocks binding (`PLAY0271`, legacy meaning) | Command `reads` and `concurrency` |
+| Blocks binding (`PLAY0268`) | enum/identity compliance and events combining personal or explicitly subject-scoped secret values with explicit subject marks; a compiler that stops before v13 refuses all `pii`/`secret` concepts ("compliance attributes require portable data-subject semantics"), while v13 binds them and Stage renders protection; attached command `handler` (PLAY0035 beside productions; pending described intent instead binds v23), bare `rule <Name>`, read paths without protected opt-in or in unsupported positions such as `produces when`, dates and `today` in comparisons, `$context.tenant`/claims/roles/causation in `produces`, `$env` conditions, `file` constraints, unquoted `import` of an external contract, a read model with neither explicit `key` nor unambiguous query-based identity as described above (composite keys remain unadmitted), queries with context `from` sources (typed query context is unadmitted), single-result filters (collections only), `scoped to` (opaque scope), `performer` (opaque implementation) or composite `by` blocks; optional keyed and collection queries, including caller-supplied equality filters and observable delivery, bind, `$causedBy` and templates in projections |
+| Blocks binding (`PLAY0271`, legacy meaning) | Command reads without protected opt-in and `concurrency`; combined protected reads/concurrency is PLAY0783 |
 | Deferred (`PLAY0269`, information) | Screens, layouts, templates, forms, contributions, UI profiles, themes, behaviors and `on`/`uses` |
 | Metadata only (`PLAY0270`, information) | `domain`, `seed`, `persona`, trigger and other descriptions, and `file` provenance on declarations |
 
@@ -301,8 +306,9 @@ and routes bind and reference-execute as v8; reaction identity as v10.
 Use standalone `screenplay test` or MCP `run-specifications` for a reference
 verdict, and independently check CLI/Stage admission. Never drop a contract to bind.
 Generated values and `returns` are not in this group: they bind as ESM v7.
-Protected reads and `derive`/`provide` (not admitted by any supported ESM version) have no documented
-syntax: do not teach or invent one. Affected-instance declarations and query paging/sorting/change-set delivery
+Protected command reads have documented v25 opt-in; see command-surface
+`references/protected-reads.md`. `derive`/`provide` remain undocumented and
+unadmitted: do not invent syntax. Affected-instance declarations and query paging/sorting/change-set delivery
 remain unavailable here. Event `subject` is report-only authoring metadata;
 public events/origin are admitted as ESM v9 (not provider realization).
 Purpose declarations, references and processing records are authoring metadata,

package/package/corpus/skills/cratis-screenplay-model-authoring/references/mcp-loop.md

@@ -24,6 +24,14 @@ defined by `cratis-screenplay-modeling-lifecycle`. Discover the installed tool s
 
 ## Connect
 
+Never ask which folder to use before trying `open-workspace` with no arguments.
+Without a fixed root, it binds the client's single workspace root, else a launch
+directory holding `.play` files. Only after a no-root or multiple-roots response,
+pass `path`: the folder holding the project's models, otherwise the folder the
+user names. Without a project the server uses `Documents/Screenplay` in the user's
+home; do not invent a location. A fixed root can switch only to the same model
+folder in a registered Git worktree of the same repository.
+
 1. Launch with a **fixed root**: `screenplay mcp <model-folder>`, or
    `cratis screenplay mcp <model-folder>`, or `cratis screenplay mcp` inside a
    project, where the CLI locates the model (the project's `.play` files, else `Source/`
@@ -210,7 +218,7 @@ connection. Passing `open-workspace.path` does **not** avoid it, because the err
 | --- | --- | --- |
 | Address-preserving | descriptions; bodies of rules and expressions; mappings between members that already exist; any edit that adds, removes or renames no addressed element. Also every edit in a model with no `.screenplay/identities.json` except persisted names | bounded text edit of the `.play` file, then compile the folder; or `propose-ast` |
 | Catalog-changing (identity file present) | add, remove or rename a declaration (slice, command, event, read model, projection, ...), a property of a command, event, read model, composite type or trigger, a query, a query argument or a specification; create, delete, rename or move a mapped `.play` document (McpState refuses reopening with `IdentityMappingConflict`; use document operations in `propose-ast`); rename, remove or move an event, command, read model, constraint, module, feature or slice; move declarations between files (slices and features across logical parents: `propose-move`); contract evolution of a persisted event (new generation, property added, removed or retyped) | `propose-rename` or a reviewed `propose-ast`; never a blind text rename. Renaming a constraint resets its uniqueness index: ask first unless the request names it, then report the reset. A persisted event rename needs `id "OldName"` (added by default) |
-| Concept `generate` | set/change/remove strategy and modifiers | `propose-ast` replaces `ConceptSyntax.generation` (`GenerationSyntax`; omit/null to remove), or reviewed `propose-source`; never hand-edit `generate` text. Preserve other concept members and inspect executable diagnostics: sequence PLAY0682, preview strategies PLAY0268, generated-rule proofs PLAY0688/0689. |
+| Concept `generate` | set/change/remove strategy and modifiers | `propose-ast` replaces `ConceptSyntax.generation` (`GenerationSyntax`; omit/null to remove), or reviewed `propose-source`; never hand-edit `generate` text. Preserve other concept members and inspect executable diagnostics: sequence PLAY0682, generated secrets PLAY0268, generated-rule proofs PLAY0688/0689, finite-support failures PLAY0691/0692. Pattern/random/rule and checksum validation bind as ESM v21 (Requires Screenplay 4.172.0, `screenplay --version`; older compilers refuse PLAY0268). Read `mcp-tools.md#concept-generation` for `arguments`, exact support and `rules[]`, not parsed diagnostic prose. |
 | Repair | `PLAY0166`, `0478`, `0469`, `0471`, `0479`, `0516`, `0563`, `0564`, `0565`, `0614`, `0653`, `0683`, `0684` (and recipe-only `0397`) | `propose-repair` with `formatting`; PLAY0166/0478 may pin attachment evidence (`pinRepairEvidence` and `expectedRepairEvidenceRevision`), never fix-all PLAY0478 |
 | Inline event extraction | `produces event ...` to a declared event | `propose-extract-inline-event` |
 | Parser-invalid document | no editable handles | `propose-source` `replace-document` with corrected source, or typed `propose-ast` document replacement |