@cratis/pi 7.61.0 → 7.63.0

package/package/corpus/skills/cratis-screenplay-model-authoring/references/mcp-tools.md

@@ -166,8 +166,12 @@ exists only for authored `generate`; an implicit UUID default has no block.
 | --- | --- |
 | `strategy` | Authored strategy name |
 | `modifiers` | Only set `prefix`, `case`, `size`, `alphabet`, `count`, `encoding`; omitted defaults are not filled in |
-| `previewArguments` | Present only for authored `pattern`, `checksum`, `range`, `rule`; each is `{value, executable: false}` |
-| `entropyBits` | Exact random bits, or null for unknown strategy/invalid entropy inputs |
+| `arguments` | Authored `pattern`, `checksum`, `rule` strings and `range: {text, minimum, maximum}` with exact Int64 endpoints; malformed range retains text only. Replaces `previewArguments`. |
+| `supportCount` | Exact JSON integer for assessed pattern/random distinct support; preserve large numbers without floating-point rounding. Dates use minimum conditioned support over the compiler's 100-year UTC horizon. |
+| `entropyBits` | Built-in random bits; pattern/random use log2(supportCount). Null for opaque rule implementations or invalid/unsupported inputs. |
+| `derivedPattern` | Anchored strategy-derived regex, or null; pattern expressions are deterministic and bounded, but date/checksum digit runs describe shape, not arithmetic containment. |
+| `derivedPatternUnknownReason` | Reason when derivedPattern is null; never invent a regex from it. |
+| `rules` | Authored-order entries: rule kind, line/column, status proven/refuted/unproven; witness for refuted, reason for unproven. diagnosticCode only for reported PLAY0688/0689; repair PLAY0688 only for a reported refuted declarative rule. |
 | `entropyUnknownReason` | Present only when entropy is unknown |
 | `valuesAtOnePercentCollision` | JSON number estimating the 1% birthday collision count, or null; scientific notation can exceed client floating-point range |
 | `executable` | `status`, `diagnosticCodes`, and `reason` only for `notAssessed` |
@@ -178,7 +182,10 @@ and no such error exists; otherwise `notAssessed`, with a reason that whole-mode
 binding failed. `diagnosticCodes` contains only errors at these declaration locations.
 An empty list is not admission; low-entropy property diagnostics require workspace
 inspection. Invalid alphabets/non-positive sizes or counts yield null estimates
-with `entropyUnknownReason`, preserving compiler diagnostics. Time, prefixes,
+with `entropyUnknownReason`, preserving compiler diagnostics. Pattern support
+budget exhaustion (PLAY0691) or empty support on a scanned date (PLAY0692) also
+leaves estimates null with the compiler's reason; an opaque `rule` has unknown,
+not zero, entropy. Time, prefixes,
 case and encoding add no randomness; the compiler, details and repairs share
 `GenerationEntropy`, not an agent's parallel estimate.
 
@@ -191,8 +198,9 @@ source document under the same revision/review contract. Canonical printing
 retains `generate`. Review `read-proposal` changes and `view: "executable-diagnostics"`,
 run candidate specifications where executable, then explicitly `apply`.
 Authoring acceptance does not imply executable readiness: `sequence` reports
-PLAY0682; `pattern`/`random`/`rule` and generated-concept validation rules report
-PLAY0268. Do not retype a refused proposal to bypass those diagnostics.
+PLAY0682; generated secrets still report PLAY0268, rule proofs PLAY0688/0689,
+and finite-support failures PLAY0691/0692. Pattern/random/rule and checksum
+validation bind as ESM v21. Do not retype a refused proposal to bypass diagnostics.
 
 `screenplay_repair_capabilities` advertises PLAY0683/PLAY0684. Discover concrete
 verified actions with `read-workspace view: "repairs"` at the diagnostic revision:
@@ -211,10 +219,40 @@ concept; uniqueness changes append-time behavior. Review every changed document
 before applying; discovery/proposal write nothing. The saved-file VS Code repair
 picker does not expose these entropy actions.
 
-PLAY0688 repair replaces a refuted generated-concept rule with the strategy-derived
-`matches` pattern. Review it as a validation change for input/stored values too.
-PLAY0689 is an unproven warning, not proof; checksum repairs remain unadmitted.
-MCP does not generate values.
+Read `generation.rules[]` instead of parsing diagnostic prose: `refuted` names
+the violating `witness`; `unproven` explains its `reason`; `proven` needs no diagnostic.
+A refuted result without `diagnosticCode` means the compiler did not check that
+rule (for example, a UUID concept unused by generated command properties), so
+there is no reported repair. Proof status is not executable admission, and
+passing samples do not prove containment.
+
+To add a rule the strategy satisfies, put `derivedPattern` into a typed `matches`
+proposal preserving other concept members. If null, read
+`derivedPatternUnknownReason` and keep the intended invariant; do not fabricate
+an expression. PLAY0688 repair replaces a refuted generated-concept rule with
+the strategy-derived matches pattern. Discover its subject through
+`read-workspace view: "repairs"`, then `propose-repair` with both revisions and
+canonical formatting. Review input/stored-value effects, not just generation.
+For a checksum pattern the same proposal explicitly adds the declared checksum
+validation if absent. Ambiguous/unbounded derived regexes have no repair.
+PLAY0689 is an Unproven warning, not proof; MCP never generates values.
+For an opaque generation rule, inspect `read-workspace view:
+"implementation-requirements"` for its ValueGeneration requirement; the reference
+runner consumes a pinned String and never executes its attached body.
+Requires Screenplay 4.181.1 (`screenplay --version`) for the language-neutral
+version-1 ValueGeneration context contract (Now instant, Tenant portable ID,
+String result); older Cratis C# bindings cannot compile all context-aware bodies.
+The provider selects the binding, not the fence tag: Cratis C# uses Fundamentals'
+`Cratis.Concepts.GenerationContext`; BCL-only C# hosts can use Screenplay's record.
+Portable bodies use Now, tenant interpolation/string assignment and BCL types.
+Passing context to `GenerateValue.*`, constructing/naming the context type or
+reading `Tenant.Value` is target-bound, not a shared language contract. See
+[context reference](https://github.com/Cratis/Screenplay/blob/main/Documentation/screenplay/context.md).
+
+Requires Screenplay 4.173.0 or later (`screenplay --version`) for `arguments`,
+exact support, derived patterns and `rules[]`; older servers can expose
+`previewArguments` and omit proofs. Discover schemas and diagnostics instead of
+assuming these fields. Reference: [generation details](https://github.com/Cratis/Screenplay/blob/main/Documentation/screenplay/mcp/reference.md#generated-values-and-responses).
 
 Requires Screenplay 4.164.0 or later (`screenplay --version`) for generated-rule proofs and PLAY0688 repair; older servers lack this action. The CLI-bundled MCP can lack
 this generation summary and the entropy repairs. Existing typed concept proposals predate the
@@ -453,6 +491,11 @@ inspect authored links, not code execution or a transitive runtime graph.
 
 ## Dependencies and intent inventories
 
+Diagnostic subjects use code plus typed `arguments`, not parsed messages. This applies
+to `diagnostics`, executable diagnostics and proposal introducedExecutableErrors.
+Read [diagnostic arguments](../../cratis-screenplay-toolchain/references/diagnostic-arguments.md)
+for optional subjects, declaration paths and PLAY0524 step indices.
+
 `dependency-graph` edges point consumer → producer. Views: `edges`, `cycles`,
 `order`, `unresolved`, `declarations`; `from`/`to` select slice/feature/module
 aggregation (`to` also accepts context). `scope`, `direction`, `kinds` and
@@ -479,7 +522,12 @@ Workspace views `named-rule-intents`/`named-rule-intent-details` cover CommandNa
 only, including pending hints without a requirement ID. Details select either
 `subject` or attached `requirementId`, not both. `handler-intents` and
 `handler-intent-details` cover CommandHandler only; handler details select
-`requirementId`. All page ordered hints, not implementation correctness. Continue
+`requirementId`. A handler entry's `executableReady` means successful v23 binding
+with a matching Pending requirement, not a supplied body; `admission` is described,
+refused or authoring-only. `implementation-requirements` exposes ordered hints and
+provisional/ambiguous flags. Edit HandlerSyntax/ImplementationSyntax/ImplementationHintSyntax
+through `propose-ast` with Authoring validation, preview then apply; unwrapping
+pending metadata is refused. All page ordered hints, not implementation correctness. Continue
 with `expectedRevision` and `expectedCatalogRevision`; provisional owner IDs are
 not authoritative. Edit hints through reviewed `propose-ast`.
 

package/package/corpus/skills/cratis-screenplay-model-authoring/verification.json

@@ -137,7 +137,8 @@
     },
     {
       "kind": "skill-contains",
-      "value": "cratis screenplay mcp <model-folder>"
+      "value": "cratis screenplay mcp <model-folder>",
+      "file": "references/mcp-loop.md"
     },
     {
       "kind": "skill-contains",
@@ -174,7 +175,8 @@
     },
     {
       "kind": "skill-contains",
-      "value": "registered Git worktree"
+      "value": "registered Git worktree",
+      "file": "references/mcp-loop.md"
     },
     {
       "kind": "skill-contains",

package/package/corpus/skills/cratis-screenplay-model-review/SKILL.md

@@ -127,11 +127,8 @@ rejected state and its evidence.
 Optional, on request, all read-only and yielding edit requests: a subject's information journey (`references/model-inventory-report.md`), a resilience pass (`references/stressor-analysis.md`) and a slice-by-slice walkthrough (`references/walkthrough.md`).
 
 ## Quick self-check (modeler, P4; about ten minutes)
-Eleven yes/no checks the modeler runs on its own work before P5 (V1 clean, no dropped constructs,
-every event production has `for`, every field has an origin, every command a reachable authorized
-origin, NOT-enforced rules marked, coverage matrix filled, personas with their denials, rationale in
-`documentation`, open questions as anchored notes, every Automation with pending work). Any "no" is
-fixed or explained before P5. The list: [quick self-check](references/quick-self-check.md).
+Read [quick self-check](references/quick-self-check.md) before P5 for the eleven
+modeler checks. Fix or explain every "no"; this is not the independent review.
 
 ## Business-question pass (explain brief)
 Be a sharp business analyst seeing the domain fresh: walk each persona's journey and ask only what a domain person must decide, in plain language with no engineering words (could a non-technical product owner read it and immediately understand what is being asked?), anchored to a place in the model, at most 12 questions (zero is valid). Method, element prompts and the model-word translation table: `references/business-questions.md`. A behavior walk in the Stage sandbox (`cratis-stage-rendering-and-sandbox`) is a separate, optional check; its findings arrive here as review findings.

package/package/corpus/skills/cratis-screenplay-model-review/references/anti-patterns.md

@@ -64,8 +64,8 @@ the problem, the checks it violates, the fix, all pinned to one declaration.
 | Undeclared removal/append event | `remove with` or capture `append` names an undeclared event | V1 warns (PLAY0166, a failure under warnings as errors); binding fails PLAY0273 | C (executable) / D | declare or fix the name; run V3 |
 | Gated command invoked by a reaction without a declared actor | reaction `invokes` a command under a caller policy and has no `runs as system role "<Role>"` that satisfies the gate | the invocation carries no caller: rejected at run time | D (major) | declare `runs as system role "<Role>"` with the least-privilege role the gate admits (ESM v10, Screenplay 4.125.0; Stage 4.89.1 renders role/authenticated trusted actors, but claim-reading/opaque gates still refuse STAGE-ESM-034 and need gap-fill) or record another trusted-path decision - never just delete the gate. A matching `runs as system role` is the admitted trusted path, not a defect |
 | `reads` + `produces` reaction | reaction both reads a view and produces | fails binding | C (executable) | invoke a command, or produce without reads |
-| `reads` treated as protection | rule "checked" because the command or reaction `reads` a view | `reads` enforces nothing | D (major) | keep or introduce `reads <View>` + `require ... message` as stated intent, mark it NOT enforced in the slice `description`, name the target (`[ProtectedDecision]` + `DecisionRead<T>`, Chronicle DCB, or a constraint where it fits); checklist E3 |
-| Caller-supplied state rule | `require currentStatus == "open"` where the caller sends `currentStatus` | the caller decides its own permission | D (major) | read the stored state with `reads`; keep or introduce `reads <View>` + `require ... message` as stated intent, mark it NOT enforced in the slice `description`, name the target (`[ProtectedDecision]` + `DecisionRead<T>`, Chronicle DCB, or a constraint where it fits); checklist E3 |
+| Unadmitted read claimed protected | rule "checked" by legacy command or trigger reads | no protected contract or target realization | D (major) | opt eligible command reads into `command reads protected` (v25); inspect shape, absence and conflict cases. Stage refuses protected reads (STAGE-ESM-044); distinguish reference protection from target evidence; checklist E3 |
+| Caller-supplied state rule | `require currentStatus == "open"` where the caller sends `currentStatus` | the caller decides its own permission | D (major) | read authoritative stored state through admitted protected reads and `require`; mark legacy/refused shapes and target realization as gaps; checklist E3 |
 | `severity warning` as soft rule | rule meant to warn but still rejects | blocks valid requests | C semantics | remove or make it a real rule |
 | Relay events | `*Synced`, `*Forwarded` events that only move data | noise, not facts | D | translate once into a business fact |
 | External event driving a worker directly | captured external record invokes commands with no local fact | no audit of what was learned | D | append a local fact in `Translate`; automate from it |

package/package/corpus/skills/cratis-screenplay-model-review/references/checklist.md

@@ -123,7 +123,7 @@ the format in `worked-example.md`.
 |---|---|---|---|
 | E1 | Value formats on `concept`s; input rules on the command; uniqueness as `constraint`; access as `authorize` | declarations | D |
 | E2 | Every refusal has a message a person understands; constraint messages copied verbatim in specs | `message`, specs | D |
-| E3 | A state-dependent rule is `reads <View>` + `require <expr> message "..."` as stated intent, and the slice `description` marks it NOT enforced in the model today (PLAY0268/0271 at binding expected in design mode) with its target named (`[ProtectedDecision]` + `DecisionRead<T>`, Chronicle DCB / `concurrency` scope, or a constraint). Not: caller-supplied copies of state, attestation booleans (`confirmsX == true`), rules in `handler` / `implementation hint` prose, or `reads` treated as protection | slice `description`, `require`, `handler` | D (faking or hiding = major) |
+| E3 | A state-dependent rule uses `reads` + `require` over authoritative state: eligible reads opt into `command reads protected` (v25), with required absence and decide/commit conflict cases. Legacy/refused reads are marked unenforced with a named target. Stage refuses protected reads (STAGE-ESM-044); reference protection is not target realization. Not: caller-supplied copies of state, attestation booleans (`confirmsX == true`), rules in `handler` / `implementation hint` prose, or `reads` treated as protection | slice `description`, `require`, `handler` | D (faking or hiding = major) |
 | E4 | `severity warning` is not used as "soft" validation (it still rejects) | validate lines | C semantics |
 | E5 | Preconditions are explicit; nothing relies on "obviously you can't" | descriptions, specs | Q |
 | E6 | Each invariant has an atomic enforcement point (name the storage provider where constraint admission matters); the race loser's outcome is specified | constraints, specs | D |
@@ -147,7 +147,7 @@ PLAY0516 moves preserve executable bytes/identities. Source: Screenplay
 | F2 | No impossible sequence (a fact that requires one that can never precede it) | constraints, specs | D |
 | F3 | Cancellation, failure and correction paths exist where the business has them | slices | Q |
 | F4 | Automations: trigger, todo/work item if work can be pending, a closing fact, retry and once-only story | reactions, views | D (`cratis-screenplay-automations-and-translations`) |
-| F5 | External facts enter through `Translate`; in-app follow-ups through `Automation` | slice kinds | C semantics |
+| F5 | External facts enter through `Translate`; in-app follow-ups through separate `Automation` slices. Keep a capture in Translate, move reactions to its local appends out (PLAY0694 for directionless/unrouted co-location, including child/nested appends; PLAY0616 for explicit inbound). PLAY0694 is a warning that fails `--warnaserror`, with no automatic split | slice kinds, capture appends and reaction triggers | C semantics |
 | F6 | No cycle where fact A's reaction needs fact B and B's needs A, or two features each wait on the other | reactions, MCP `dependencies` | D (redesign the boundary) |
 | F7 | Each slice's consumed events and their producing slices are known; a slice calls another's command only through `invokes` | reactions, `reads` | Q |
 | F8 | Every Automation has a pending-work view (a todo list: membership is the pending work), or a written reason a direct effect needs none (immediate, internal, cannot fail). A "simple relay" is not exempt from the question | reactions, `reads`, views | D |

package/package/corpus/skills/cratis-screenplay-model-review/references/quick-self-check.md

@@ -8,7 +8,8 @@ About ten minutes, before the independent review.
 4. Every read-model field has an origin; every event has a consumer or terminal reason.
 5. Every command has a reachable, authorized origin (screen or form action, or a reaction to an event, clock or application trigger; a capture appends facts and a command after it is reached through a reaction).
 6. No gated command is invoked by a reaction without a recorded trusted-path decision.
-7. State-dependent rules are `reads` + `require ... message` marked NOT enforced; no
+7. State-dependent rules use admitted protected command reads plus `require`, or
+   record the legacy/refused shape and target gap; no
    caller-supplied state, attestation boolean (`confirmsX == true`) or handler/hint prose.
 8. Coverage matrix filled; every `n/a` has a domain reason.
 9. Persona text says what each role cannot do, each line backed by a gate and a `then denied`

package/package/corpus/skills/cratis-screenplay-model-review/references/review-questions.md

@@ -37,8 +37,9 @@ needs; a "no" is a finding only when it has a business consequence.
 
 ## For each slice and the model as a whole
 1. Does each slice depend on other slices only through event contracts, `invokes` and explicitly
-   recorded cross-slice `reads` of another slice's view (F7)? A `reads` is unprotected (a
-   stored-state rule over it stays not enforced) and couples the slice to that view's interface:
+   recorded cross-slice `reads` of another slice's view (F7)? Check protected-command
+   opt-in/admission and absence/conflict cases separately from target realization;
+   legacy and trigger reads remain unprotected. The view interface is a dependency:
    check that it is recorded, not implied.
 2. Could two people work on two slices at the same time without reading each other's
    declarations, given only the events' fields (A8)?

package/package/corpus/skills/cratis-screenplay-modeling-lifecycle/references/principles.md

@@ -11,7 +11,7 @@ instruction for the work, not background reading. Skills that restate one cite i
 6. **Keep semantic identity independent of names, paths, layout and generated symbols.** Commit the identity catalog with the model.
 7. **Keep unsupported intent visible.** Return a precise gap and its owning issue; never weaken the model so rendering passes.
 8. **Write specifications with intent, including rejection and denial.** Never report an unexecuted or unsupported scenario as passed.
-9. **Treat state reads as a correctness boundary.** Do not claim protection until the opted-in contract and the target support exist.
+9. **Treat state reads as a correctness boundary.** Eligible command reads opt into `command reads protected` (v25); legacy/trigger reads remain unprotected. Stage refuses protected reads (STAGE-ESM-044), not the v25 pair: reference absence/conflict guarantees and verified target realization are different claims.
 10. **Separate event-source identity from event payload and choose destinations explicitly.**
 11. **Persisted event shape changes are evolution, never cleanup.** Keep historical generations.
 12. **Model external work as business intent.** Provider interfaces and transport mechanics stay out of the language.

package/package/corpus/skills/cratis-screenplay-modeling-lifecycle/references/vocabulary-map.md

@@ -21,7 +21,7 @@ speaks in them; never model board mechanics (lanes, node ids, positions).
 | Storyline (ordered beats) | a **family** of specifications sharing example data, each one transition (no storyline syntax) | several spec classes | specifications |
 | Field validation | concept `validate` (every use) / command `validate`, `require` | `ConceptValidator<T>` / `CommandValidator<T>` | command validation |
 | Role permission ("Cannot") | `policy` + `authorize` + `then denied` spec; ownership via `claim ... matches subject` | `[Authorize(Policy)]`, generated policies | authorization |
-| Precondition on stream state | `reads` + `require` as stated intent, not enforced (target: Arc `[ProtectedDecision]` + `DecisionRead<T>`, or Chronicle DCB; APIs available to gap-fill in the Arc and Chronicle the Stage scaffold pins, not emitted protection) | decision over a guarded read | command validation |
+| Precondition on stream state | `command reads protected` + eligible `reads`/`require` (v25 reference protection); legacy/refused reads remain stated intent. Stage refuses protected reads (STAGE-ESM-044); target Arc `[ProtectedDecision]` + `DecisionRead<T>` or Chronicle DCB needs separate verification | decision over a guarded read | command validation |
 | Generated id (`derived:uuid4()`) | `generated` (authorable, not executable) | id supplied before `Handle()` | commands |
 | External system / outbound call | `Translate` slice (inbound); `system`/`operation` (authorable, not executable) or Automation (outbound) | `ICommandOperation` / reactor | operations, reactors |
 | HTML mockup | `screen` Level 1 + board (`visualize-model`) | default Scene composition | ui composition |

package/package/corpus/skills/cratis-screenplay-read-surface/SKILL.md

@@ -263,9 +263,8 @@ choosing a whole action list rather than one labeled command, use block-form
 **Inside out:** the slice, then the enclosing feature, then the module, then the
 document. The innermost match wins.
 
-That rule exists because a generated document cannot make every name unique — one
-real application declares 76 queries under 37 distinct names, with `All` appearing
-21 times. Two sibling slices can each declare `All`, and each screen gets its own.
+Sibling slices may each declare `All`; each screen resolves its own query.
+Read `references/named-keys.md` when query scope affects identity inference.
 
 Reach across slices by qualifying with **any trailing part** of the scope.
 Excerpt: `Queue` and `Deviations` are sibling slices that each declare `All`.

package/package/corpus/skills/cratis-screenplay-read-surface/references/named-keys.md

@@ -100,7 +100,9 @@ Composite read-model keys, query `by` blocks and fixtures
 over those views remain authoring-only: binding reports PLAY0268 citing
 Screenplay#599 (still open). They do not reference-execute or render. This is not
 ESM v10 admission; v10 covers reaction identity, production routes and observer
-filters. Command reads independently remain unprotected/unadmitted (PLAY0271).
+filters. Eligible command reads separately opt into v25 with `command reads protected`;
+legacy reads remain PLAY0271, and composite keys are still refused (PLAY0781 ByParts).
+See command-surface [protected reads](../../cratis-screenplay-command-surface/references/protected-reads.md).
 A single explicit key does bind; Stage admission still depends on the complete
 model and projection/query shape, not just the key modifier.
 

package/package/corpus/skills/cratis-screenplay-render-and-gap-fill/SKILL.md

@@ -32,6 +32,12 @@ Tool versions are covered in `cratis-screenplay-toolchain` `SKILL.md`; read it b
   (the user); Stage internals and the sandbox (`cratis-stage-rendering-and-sandbox`); judging
   hand-written code against its slice (`cratis-application-slice-conformance`).
 
+## Language modes that block target delivery
+
+Read [language admission](../cratis-screenplay-toolchain/references/language-admission.md)
+for v22–v25: Stage refuses atomic batches, described bodies (even Stub mode) and
+protected reads. Preserve contracts; reference success is not target realization.
+
 ## Interview phase
 **Skip if** the request names the model root, the application name, the destination and the
 decision on non-renderable scope. Otherwise ask only what is missing:
@@ -143,9 +149,8 @@ Adapters and non-renderable scope follow the contract rules of `cratis-applicati
   the Arc/Chronicle set in `cratis-stage-rendering-and-sandbox` `references/rendered-application.md`; API availability alone is not verified enforcement.
 - Adapters that call outside systems follow `cratis-engineering-effect-boundaries`; slice
   specifications follow `cratis-application-slice-specifications`.
-- Realization notes are the explicit realization requirements stated in a slice `description` or `documentation`
-  (definition: `cratis-application-slice-conformance`, `references/contract-and-precedence.md`).
-  Executable parts (specifications, mappings, constraints) win over prose, and a contradicting description is a model defect to report.
+- Read conformance's `references/contract-and-precedence.md` for realization-note
+  authority. Executable contract wins over prose; report contradictions.
 
 ## Rules
 

package/package/corpus/skills/cratis-screenplay-render-and-gap-fill/references/gap-fill-handoff.md

@@ -105,6 +105,14 @@ stable array or list. The Stage scaffold pins an older Arc, so raise the version
 `Customizations/Dependencies.props` only after a restore and build proves it. Never split the
 reaction or drop an effect to dodge rendering.
 
+Preserve declared `reaction batches atomic` boundaries: each trigger occurrence's
+direct productions and each selected refusal branch are separate batches, with
+invoked commands independent. Stage refuses v22 (STAGE-ESM-016) and atomic mode
+in admitted v23–v25 (STAGE-ESM-043); the declaration is not external-effect deduplication.
+For described handlers, hand off only payload computation under the v23 result
+contract; Stage STAGE-IMPL-002 means no stubs, even Stub mode. Protected v25 reads
+refuse STAGE-ESM-044 despite version admission and need target admission/enrollment tests; ordinary injection never supplies protection.
+
 ## Re-delivery
 The work list is the full in-scope contract delta since the fallback record's last verified source
 identity (specifications, rules, mappings, realization notes), then the whole contract is

package/package/corpus/skills/cratis-screenplay-render-and-gap-fill/references/renderability-gate.md

@@ -14,8 +14,10 @@ probe reports and choosing what to do. Do not copy the code table here.
 2. Execution planning builds the plan and can emit `PLAN-*` diagnostics before Stage runs.
 3. Stage plans the target and admits or rejects each member: `STAGE-ESM-0xx`; profile and path
    problems `STAGE-CRATIS-0xx`. An evolved event is reported with Stage's own `STAGE-ESM-026`
-   (still refused); the CLI adds nothing. Stage admits exact ESM v1–v17 and v19 pairs, not v18/v20; CLI admission remains bounded by its bundled renderer and
-   refuses each construct it does not render with its own code (see Stage's current code table, including `-024`, `-027`, `-028`, `-030` to `-041`).
+   (still refused); the CLI adds nothing. Read the owning Stage admission table and
+   toolchain `references/renderable-subset.md` for exact pairs and version minimums;
+   CLI admission remains bounded by its bundled renderer. Each unsupported construct
+   has its own code; version admission is not construct support.
 4. Any error in the selected scope publishes nothing: the run ends with exit 5 and the diagnostics.
    Without `--scope` the scope is the whole application. With `--scope`, `PLAN-*` problems in
    unselected slices are warnings and `STAGE-ESM-*` refusals in unselected slices do not block;
@@ -28,8 +30,8 @@ ESM). Only the probe answers renderability. `PLAY0270` entries are information,
 
 | Class | Meaning | Typical examples (each verified in `admission.md`) | Action |
 | --- | --- | --- | --- |
-| **Model fix (in mode)** | the model is in, or the user chose, renderable mode and breaks its own subset in a way that has a renderable equivalent with the same meaning | a `produces` whose `for` is not the command identifier; one `StateChange` slice with two commands (`STAGE-ESM-004`); two projections for one read model (`-007`); a policy Stage cannot express portably (`-015`; role-only and opaque pure policies render) | edit request to the modeler session with address, change and rationale |
-| **Capability gap** | the intended meaning needs a construct Stage does not render yet | a snapshot list query (`-010`; observable lists and keyed or unkeyed lists bind and observable lists render), DateTime equality filters and required parameters after optional filters (`-010`); context/single-result filters, opaque `scoped to`/`performer` and composite `by` remain PLAY0268; Translate, clocks, captures, non-event triggers and opaque reaction bodies (`-024`); claim-reading/opaque `runs as` gates (`-034`), legacy `from` (`-035`), mixed effects in one handler (`-037`, retries can duplicate events; keep it whole), unsupported reaction mappings (`-039`); unsupported generated types/result combinations (`-028`/`-038`); `then no readmodel` (`-027`); evolved events (`STAGE-ESM-026`); conditional `produces when` (`-006`); `reads` (`PLAY0271`); code validation (`-005`); protected identities/enums (`-040`), non-text secrets (`-041`) or unadmitted explicit subject lineage (`PLAY0268`); a command `handler` (`PLAY0268`) | keep the model; fallback record entry; options a to c in `SKILL.md`; link the Stage issue |
+| **Model fix (in mode)** | the model is in, or the user chose, renderable mode and breaks its own subset in a way that has a renderable equivalent with the same meaning | a `produces` whose `for` is not the command identifier; two projections for one read model (`-007`); a policy Stage cannot express portably (`-015`; role-only and opaque pure policies render) | edit request to the modeler session with address, change and rationale |
+| **Capability gap** | the intended meaning needs a construct Stage does not render yet | DateTime equality filters and required parameters after optional filters (`-010`); context/single-result filters, opaque `scoped to`/`performer` and composite `by` remain PLAY0268; Translate, clocks, captures, non-event triggers and opaque reaction bodies (`-024`); claim-reading/opaque `runs as` gates (`-034`), legacy `from` (`-035`), mixed effects in one handler (`-037`, retries can duplicate events; keep it whole), unsupported reaction mappings (`-039`); unsupported generated types/result combinations (`-028`/`-038`); `then no readmodel` (`-027`); evolved events (`STAGE-ESM-026`); unsupported expression/enum production conditions (`-006`; supported conditional productions render); legacy reads (`PLAY0271`), protected reads (STAGE-ESM-044 despite v25 admission); code validation (`-005`); protected identities/enums (`-040`) or unadmitted explicit subject lineage (`PLAY0268`); attached command handlers (PLAY0268), described handlers (v23, STAGE-IMPL-002 even Stub mode), atomic mode (STAGE-ESM-016 for v22, STAGE-ESM-043 in admitted v23–v25) | keep the model; fallback record entry; options a to c in `SKILL.md`; link the Stage issue |
 | **Tool skew** | the bundled compiler disagrees with documented semantics | the false `PLAY0285` on reaction cascades from an older bundle; codes the standalone compiler does not raise | record in the session state and the fallback record; never "fix" a correct model |
 | **Environment** | not the model | restore failures, missing SDK, a destination that is not writable | fix the environment or report blocked |
 

package/package/corpus/skills/cratis-screenplay-scenario-coverage/SKILL.md

@@ -7,11 +7,10 @@ license: MIT
 # Screenplay scenario coverage
 
 ## Purpose
-Turn designed slices into specifications that pin behaviour a business person would argue
-about. Decide **which** situations need a specification before writing any (coverage matrix),
-then write them with consistent example data in the form the chosen mode admits. Situations the
-language cannot express today are recorded, not faked. Grammar and outcome comparison live in
-`cratis-screenplay-specifications`; this skill owns coverage and method.
+Decide **which** situations need specifications in a coverage matrix, then use
+consistent example data and mode-admitted forms. Record inexpressible cases; never
+fake them. This skill owns coverage; `cratis-screenplay-specifications` owns grammar
+and outcome comparison.
 
 ## When / when not
 - Use: the scenario phase of `cratis-screenplay-modeling-lifecycle`; adding or changing a
@@ -33,11 +32,9 @@ Use it to seed, never replace, the matrix. Multi-step storylines remain unavaila
 lifecycle families emulate them.
 
 ## Interview phase
-**Skip if** the brief already states the coverage depth (rules, denials, state violations,
-retries, races), the critical rules with an allowed and a refused example each, how the specs
-will be used (reference only, executable, rendered and tested) and who validates them.
-Critical questions, one at a time, with follow-ups:
-Ask only what is missing: depth, known rules and edge cases (one allowed and the nearest refused request per rule), intended use (decides admitted forms), and who validates. Read [references/interview-batch.md](references/interview-batch.md) for the four questions and follow-ups.
+Ask only what is missing: coverage depth, allowed/refused rule examples, intended
+execution mode and who validates. Read [interview prompts](references/interview-batch.md)
+when these inputs are unsettled; skip answered questions.
 
 **Unattended:** assume visibly, never invent a rule, and record who actually answered; an agent asking itself four kinds of question is not four approvals.
 
@@ -64,23 +61,22 @@ Ask only what is missing: depth, known rules and edge cases (one allowed and the
    existing intentional fixtures (`references/scenario-catalogue.md` "Example data"). Shared
    fixtures may live as typed `example`s in another document beside the declarations they type
    (`cratis-screenplay-specifications` `references/examples-and-routes.md`).
-7. **Draft commands**: happy path, each rule, denial, duplicates and retries, competing claims,
-   state violations, alternative branches, compensation, external failure, evolution. In each
-   rejection vary only the value under test. Use typed `parameter`/named `case`
-   tables for a shared validation matrix, not for unrelated behaviors; rows are
-   cases, not typed fixture `example`s. `given caller as <Persona>` supplies one
-   authenticated policy witness for success/denial; use explicit callers for
-   anonymous/ownership or unsynthesizable personas. Syntax and complete model:
-   `cratis-screenplay-specifications` `references/persona-callers-and-cases.md`.
+7. **Draft commands** for each applicable scenario type below. Vary only the value
+   under test in a rejection. Read specifications'
+   [persona callers and cases](../cratis-screenplay-specifications/references/persona-callers-and-cases.md)
+   when sharing a validation matrix or choosing synthesized versus explicit callers;
+   cases are not fixture examples and do not group unrelated behaviors.
 8. **Separate view pass**: population, each update, accumulation, removal (with a surviving
    row), absence, ordering. Mark lifecycle branches. Views combining sources must
    tolerate any arrival order. Pin a child before its parent (Requires Screenplay 4.149.1 or later):
    given child, then parent, then read model; "parent never arrives" leaves the
    child absent. Evidence/example: `references/view-and-story-specs.md`.
-9. **State-dependent rules**: `reads <View>` + `require <expr> message "..."` as stated intent,
-   marked **NOT enforced in the model today** in the slice `description` (binding reports
-   PLAY0268/0271: expected in design mode; Screenplay#129), target named (Arc
-   `[ProtectedDecision]` + `DecisionRead<T>`, Chronicle DCB, or a constraint). Forbidden:
+9. **State-dependent rules**: use `reads` plus `require` over authoritative state;
+   eligible views opt into `command reads protected` (v25). Cover present/absent reads,
+   refusal and denial; matching decide/commit changes are conflicts, not refusals.
+   Read [protected reads](../cratis-screenplay-command-surface/references/protected-reads.md)
+   for admission and Stage refusal; legacy/refused shapes remain marked unenforced
+   with a named target mechanism. Forbidden:
    caller-supplied copies of state in `require`, boolean attestation inputs (`confirmsX ==
    true`) and rules hidden in `handler`/hint prose. Never drop an unresolved given or assertion
    to make a spec compile: record the blocked case and continue.
@@ -101,11 +97,10 @@ when specifying malformed keys/filters versus valid absence (ESM v18).
 Requires Screenplay 4.157.0 (`screenplay --version`) for v17, 4.161.0 for query
 validation/error assertions; older tools do not execute these contracts.
 
-**Once, idempotent, exactly once are different claims.** A `unique event` constraint proves the
-*fact* occurs once per event source; it does not make *command handling* idempotent (a retry is
-rejected, not answered with success), and nothing in the model proves an *external effect* (an
-email, a payment) happens exactly once. Say which of the three a spec proves; record the rest as
-target requirements.
+**Once, idempotent, exactly once are different claims.** `unique event` proves a once-only fact,
+not successful retry handling or an exactly-once external effect. Name the claim
+proved and keep other guarantees as target requirements; recovery cases are in
+`references/scenario-catalogue.md`.
 
 ## Rules
 ### Compiler contracts
@@ -116,7 +111,8 @@ target requirements.
   or query spec needs `given caller` or `given caller as <Persona>` (module and feature gates count); an authorized scenario
   gets no inferred fixture (PLAY0389). Unauthorized is never `then error`.
 - Duplicate and competing specs use `when <Command>`; `when append` is for projection and
-  automation triggers, and for a constraint the command's own validation would reject first.
+  automation triggers, consumed public events driving captures, and for a
+  constraint the command's own validation would reject first.
 - `null` only for optional read-model properties; constraint messages are copied verbatim.
 - Executable-only binding checks (PLAY0350/0352/0388/0389/0273) do not show in V1: run V3.
 
@@ -126,6 +122,8 @@ target requirements.
   (denial), `<View>LifecycleN<State>` for families.
 - `for` on every given, appended and expected event (plain `produces <Name>` too; inline `produces event` omits it), and on the `when` command where the
   destination matters. A competing-claim given needs a *different* `for`.
+  Foreign event fixtures feeding a capture may omit `for`; supplied `for` is
+  opaque source text, not the capture's content key.
 - Format rules belong on a `concept`: give each concept rule representative acceptance,
   rejection and boundary specs once (through one command that carries it), not on every use;
   never `n/a` automatically. Include a whitespace-only rejection for text `not empty`:
@@ -149,7 +147,16 @@ Read [references/review-questions.md](references/review-questions.md) for the ra
 
 ## Public-event coverage (ESM v9)
 
-Outbound publication needs `when append <private>` and `then <PublicEvent>`. Read [references/public-event-coverage.md](references/public-event-coverage.md) when specifying public events or routed producers and observers.
+Outbound publication needs `when append <private>` and `then <PublicEvent>`.
+Captures over public events use `given <FromEvent>` / `when append <FromEvent>`,
+not capture records (PLAY0701). Read [references/public-event-coverage.md](references/public-event-coverage.md)
+when specifying public events or routed producers and observers.
+
+Record captures distinguish first sight from updates: first root/child/nested
+records are added only, so field guards need `given capture` for the same key.
+Use a separate `when added` append when initial observations should produce a fact.
+Read captures-and-reactions `references/record-capture-specifications.md` for the
+prerequisite and runnable cases. Include first, changed and unchanged rows in the matrix.
 
 ## Version skew: reaction cascades and false PLAY0285
 Under ESM v6 a command spec's `then` lists the events reactions cascade from it; an older `cratis` bundle reports a **false PLAY0285** for it. Never delete the reaction. Read [references/version-skew.md](references/version-skew.md) when a spec with cascade events reports PLAY0285 or the bundled compiler is older than the standalone tool.

package/package/corpus/skills/cratis-screenplay-scenario-coverage/references/berth-reservations.md

@@ -1,5 +1,11 @@
 # Berth reservations: worked example
 
+This is a legacy control without `command reads protected`; the unprotected-read
+markers below describe that control, not all command reads. Eligible views can opt
+into v25; the date-rule blocker still remains. Read
+[protected reads](../../cratis-screenplay-command-surface/references/protected-reads.md)
+for admission and Stage's protected-read refusal (STAGE-ESM-044).
+
 Complete, compiled design-mode model (marina guest berths) showing a coverage matrix turned into specifications: happy path, one rejection per rule, authorization denial, duplicate and retry, competing claim, state violation, alternative branches, compensation and a view lifecycle family. The matrix for it is in `coverage-matrix.md`; the catalogue (`scenario-catalogue.md`) names its specifications.
 
 ```screenplay test=unbound

package/package/corpus/skills/cratis-screenplay-scenario-coverage/references/invoicing-dues-design.md

@@ -1,6 +1,13 @@
 # Invoicing and dues: design-mode document for the stored-state rules
 
-**Design mode, not binding-ready by design.** This document states the stored-state rules of the
+**Legacy control without `command reads protected`, not binding-ready by design.**
+Read [protected reads](../../cratis-screenplay-command-surface/references/protected-reads.md)
+for the opt-in alternative. Do not insert the preamble blindly: every read must meet
+finite event-source-keyed admission with removals. A v25 reference pass still does not
+render protected reads: Stage admits v25 but refuses them with STAGE-ESM-044. The comments and unenforced markers below describe
+this legacy control, not a general limit on command reads.
+
+**Design mode.** This document states the stored-state rules of the
 invoicing example as the skill requires (`reads <View>` + `require ... message`, marked NOT
 enforced in the slice `description`, target named). It compiles (V1, warnings as errors) but
 does not bind, and the only blockers are `reads` (PLAY0271) and `require` over
@@ -17,7 +24,7 @@ The excerpt's Stage API-availability comment describes the historical Stage 4.24
 scaffold. Stage 4.73.1's scaffold pins an Arc/Chronicle set (see the Stage skill's `references/rendered-application.md`): protected-read APIs are
 available to gap-fill (the "not in a Stage-rendered application" comment in the source is
 superseded), not emitted protection or `.play` rule admission. The
-original compiled source is retained unchanged.
+capture uses separate first-sight/update appends, with its local-event follow-up in Automation.
 
 ```screenplay expect PLAY0516 test=unbound
 // Scenario coverage design-mode example: stored-state rules of invoicing club dues (complete document).
@@ -89,6 +96,10 @@ module Invoicing
           outcome = outcome translate
             "C" => captured
             "D" => declined
+        append PaymentGatewayResultReceived
+          when added
+            outcome = $.outcome
+            reason  = $.reason
         append PaymentGatewayResultReceived
           when outcome
             outcome = $.outcome
@@ -96,15 +107,15 @@ module Invoicing
       event PaymentGatewayResultReceived
         outcome GatewayOutcome
         reason  String
-      event PaymentReceived
 
-    slice Automation TranslatePaymentGatewayResults
+    slice Automation RecordPaymentOutcome
       description "Gives PaymentReceived its producer: the translator reacts to the provider's external fact"
       reaction ReceivedTranslator
         when PaymentGatewayResultReceived
           outcome
           produces PaymentReceived
         where outcome == "captured"
+      event PaymentReceived
 
     slice StateChange SettleOrVoidInvoice
       description "An invoice ends either settled or voided, never both (SettleOrVoid, enforced at append). NOT enforced in the model today: that the invoice exists and is still open (settling) and that only an open, unpaid invoice may be voided. Stated as `reads OpenInvoice` + `require` (PLAY0271/PLAY0268 at binding; Screenplay#129). Target: Arc [ProtectedDecision] with DecisionRead, or a Chronicle DCB. Requirements to test in the target: settling an unknown invoice is rejected; voiding a paid invoice is rejected; voiding an open invoice succeeds."

package/package/corpus/skills/cratis-screenplay-scenario-coverage/references/invoicing-dues-example.md

@@ -13,8 +13,10 @@ destination-type information; a reaction can also consume events from a capture
 
 **Scope.** This document is the runnable demonstration only. It deliberately holds no rule that
 depends on stored state (the invoice must exist, only an open invoice may be voided, a reversal
-needs a received payment, `reads` + `require`): those rules cannot bind or run at Screenplay
-4.66.0 (PLAY0271, PLAY0268) and are stated in the design-mode document `invoicing-dues-design.md`,
+needs a received payment, `reads` + `require`): the legacy design control lacks
+`command reads protected` and retains PLAY0271/PLAY0268. Eligible reads can opt into
+v25; see command-surface protected-read admission and Stage refusal. The rules stay
+in the design-mode document `invoicing-dues-design.md`,
 never in prose here. It shows the category shapes; for a coverage example see `berth-reservations.md`.
 
 ```screenplay
@@ -208,27 +210,13 @@ module Invoicing
           when added
             outcome = $.outcome
             reason  = $.reason
+        append PaymentGatewayResultReceived
+          when outcome
+            outcome = $.outcome
+            reason  = $.reason
       event PaymentGatewayResultReceived
         outcome GatewayOutcome
         reason  String
-      event PaymentReceived
-      event PaymentDeclined
-        reason String
-
-    slice Automation TranslatePaymentGatewayResults
-      description "Our facts from the provider's: the translators react to the external fact the Translate slice records"
-      reaction ReceivedTranslator
-        when PaymentGatewayResultReceived
-          outcome
-          produces PaymentReceived
-        where outcome == "captured"
-      reaction DeclinedTranslator
-        when PaymentGatewayResultReceived
-          outcome
-          reason
-          produces PaymentDeclined
-            reason = reason
-        where outcome == "declined"
 
       specification TranslatingADeclinedCardResult
         when capture PaymentGatewayResults
@@ -243,6 +231,23 @@ module Invoicing
           for "9c1f0a52-6a4e-4b1c-9f55-0d2c7b8e1a01"
           reason = "Card declined"
 
+    slice Automation RecordPaymentOutcome
+      reaction ReceivedTranslator
+        when PaymentGatewayResultReceived
+          outcome
+          produces PaymentReceived
+        where outcome == "captured"
+      reaction DeclinedTranslator
+        when PaymentGatewayResultReceived
+          outcome
+          reason
+          produces PaymentDeclined
+            reason = reason
+        where outcome == "declined"
+      event PaymentReceived
+      event PaymentDeclined
+        reason String
+
     slice StateView OpenInvoices
       description "Todo list: membership means 'still to collect'; there is no status flag."
       readmodel OpenInvoice