@cratis/pi 7.62.0 → 7.63.0

package/package/corpus/skills/cratis-screenplay-command-surface/references/shop-generation.md

@@ -1,22 +1,30 @@
 <!-- Copyright (c) Cratis. All rights reserved. -->
 <!-- Licensed under the MIT license. See LICENSE file in the project root for full license information. -->
 
-# The shop in Screenplay: keep the release boundary
+# The shop in Screenplay: generated values
+
+## Contents
+
+- Choosing a strategy
+- When not to generate
+- Sources
 
 ## Choosing a strategy
 
 Use the same vocabulary as the [Fundamentals/Arc shop](../../cratis-fundamentals-concept/references/shop-generation.md),
 but only the released language realization: CustomerId is `cus_` + uppercase
-ULID, OrderId is `typeid "order"`, and InviteCode is NanoID. Their strategies
+ULID, OrderId is `typeid "order"`, and InviteCode is NanoID. InvoiceNumber uses
+a readable date/checksum pattern; TicketNumber is an Int pickup-ticket value. Their strategies
 belong to concepts; command properties only say `generated`/`generated identifier`.
 The existing [strategy reference](generated-values-and-responses.md) owns exact
 encodings, entropy, MCP edits, fixtures and freshness.
 
-**Context-dependent generation is not released in Screenplay.** The OrderId below
-is time-ordered TypeID, not Arc's received-time/tenant factory contract; Stage
-emits a wall-clock `New()`. Passed-through GenerationContext in Arc source
-recovery describes that strategy shape, not equivalent clock/tenant semantics.
-Context-member/rule recovery stays in code.
+Requires Screenplay 4.172.0 or later (`screenplay --version`) for pattern/random/rule
+and checksum validation (ESM v21); older compilers refuse them with PLAY0268.
+`generate rule Name` can attach code with Now/Tenant context, but the reference
+runner never executes it: pin the whole String result. TypeID itself has no
+tenant slot. Context-member factory recovery still stays in code. Stage's
+time-ordered factories use the command receipt, not an invented wall-clock value.
 
 The shop's ApiKey remains a **secret**. In .NET its factory is `Bytes(32)` and its
 concept is `[NotAudited]`. It is never an identifier (event-source IDs are plaintext
@@ -35,6 +43,11 @@ concept OrderId : String
 concept InviteCode : String
   generate nanoid
 concept ApiKey : String secret
+concept InvoiceNumber : String
+  generate pattern "INV-{yyyy}{MM}-#{7}" checksum luhn
+  validate checksum luhn
+concept TicketNumber : Int
+  generate random 100000..999999
 module Shop
   feature Customers
     slice StateChange Register
@@ -58,22 +71,39 @@ module Shop
           inviteCode = "abcdefghijklmnopqrstu"
   feature Orders
     slice StateChange Place
+      constraint UniqueInvoiceNumber
+        unique invoiceNumber on OrderPlaced
+      constraint UniquePickupTicket
+        unique pickupTicket on OrderPlaced
       command PlaceOrder
         orderId OrderId generated identifier
+        invoiceNumber InvoiceNumber generated
+        pickupTicket TicketNumber generated
         produces event OrderPlaced
+          invoiceNumber InvoiceNumber = invoiceNumber
+          pickupTicket TicketNumber = pickupTicket
         returns orderId
       specification PlacesWithPinnedValue
+        given clock "2026-10-02T09:00:00Z"
         when PlaceOrder
           for "order_0000000000e008000000000000"
+          generated invoiceNumber = "INV-202610-00000004"
+          generated pickupTicket = 123456
         then OrderPlaced
           for "order_0000000000e008000000000000"
+          invoiceNumber = "INV-202610-00000004"
+          pickupTicket = 123456
         then returns "order_0000000000e008000000000000"
 ```
 
 Each property is server-owned, not a client-minted input. The ApiKey declaration
 is not permission to replace its secret contract with an ordinary random String.
-No `given clock` is used: pin the whole value. A seed/clock does not draw a
-portable ULID or TypeID fixture. A v15 duplicate-source specification should
+The invoice date segments use the pinned UTC clock; it does not draw a portable
+ULID or TypeID fixture. Checksum validation is authored separately from generation.
+Dates/check digits add no entropy. The short invoice and ticket values use
+single-property unique constraints; neither is a generated identifier. Whole-source
+freshness protects the OrderId destination, not every generated payload value.
+A duplicate-source specification should
 expect Concurrency with no new facts or response, not a regenerated ID.
 
 ## When not to generate
@@ -83,10 +113,13 @@ idempotency keys, authorization, gapless invoice numbers or proof of projection
 readiness. A reference InviteCode is not automatically a credential; if possession
 confers access, protect it as a secret and do not claim this generated String
 example realizes that credential behavior. Never drop ApiKey's secret marker to
-make its generation bind/render. Pattern/random/rule execution, context rules,
-sequence allocation and secret generation stay explicit upstream gaps.
+make its generation bind/render. A pattern is not gapless/sequential numbering;
+check digits catch typos, not forgery. ESM v21 binds and reference-executes with
+pins. Requires Stage 4.118.0 for checksum validation and 4.119.0 for pattern/random
+rendering; older renderers refuse those constructs. `generate rule` still refuses
+STAGE-ESM-028. Sequence allocation and secret generation stay explicit gaps.
 
-## Tagged evidence
+## Sources
 
 Screenplay `Documentation/screenplay/generated-values/choosing.md`,
 `Documentation/screenplay/generated-values.md`,

package/package/corpus/skills/cratis-screenplay-command-surface/references/text-and-match-rules.md

@@ -0,0 +1,119 @@
+<!-- Copyright (c) Cratis. All rights reserved. -->
+<!-- Licensed under the MIT license. See LICENSE file in the project root for full license information. -->
+
+# Literal text rules and portable matching
+
+## Contents
+
+- Literal text rules
+- Portable `matches`
+- Studio replacements and public check APIs
+
+## Literal text rules
+
+Requires Screenplay 4.184.0 or later (`screenplay --version`) for literal text rules and pattern admission checks; older compilers do not admit these rule forms.
+
+Prefer a literal rule over a regex when the requirement is plain text. Complete example:
+
+```screenplay
+concept InvoiceReference : String
+  validate
+    contains "-"
+    not contains " "
+    starts with "INV-"
+    ends with "-NOK"
+```
+
+These concept/command-property rules select ESM v24. They compare UTF-16 code units
+ordinally, without case folding or normalization. Use one non-enum text value and a
+quoted literal operand, not a property, collection or regex. An absent optional
+value passes; add `not empty` to require presence. An empty operand makes `contains`,
+`starts with` and `ends with` pass, and `not contains` fail for present text.
+Equality and inequality remain `== "x"` and `!= "x"`.
+
+This is not condition grammar: `contains`/`starts with` in `require`, `produces when`
+or reaction `where` remain PLAY0268. Those conditions admit scalar equality and
+numeric ordering, not the property text rules.
+
+Requires Stage 4.124.0 for v24 text-rule admission (`cratis --version` identifies the CLI bundle); older renderers refuse v24 with STAGE-ESM-016.
+
+Stage admits v24 and executes these four rules on its Host and specification
+executor, rendering ordinal UTF-16 comparisons without regex or a Screenplay
+runtime dependency. The legacy EventModel syntax engine drops these rules; use
+semantic admission, never infer support from that engine's output.
+
+## Portable `matches`
+
+Requires Screenplay 4.183.0 or later (`screenplay --version`); older compilers use platform matching and may accept nonportable constructs.
+
+A quoted pattern is a flagless JavaScript expression restricted to a portable linear
+dialect, not arbitrary ECMAScript or .NET regex. It searches any substring unless
+anchored. Screenplay uses its own Thompson automaton, without timeout or host-engine
+settings. Syntax remains `matches "^INV-[0-9]{6}$"` or `matches email`.
+
+| Admitted | Meaning |
+| --- | --- |
+| Literals, `.`, `^`, `$`, alternation | `$` is strict end of input, not before a final newline |
+| `(…)`, `(?:…)`, `(?<name>…)` | ASCII names `[A-Za-z_][A-Za-z0-9_]*`; duplicate names only in disjoint alternatives; names that can match together report PLAY0367 |
+| Classes, negation, single-character ranges | Unions/complements use set semantics |
+| `\d \D \w \W \s \S` | `\d` is ASCII digits, `\w` ASCII letters/digits/underscore |
+| `\t \n \r \f \v`, `\0` not before a digit, `\xHH`, `\uHHHH` | UTF-16 code-unit escapes |
+| Escaped syntax characters and `\/` | `\-` also inside a class |
+| `* + ? {n} {n,} {n,m}` and lazy forms | No stacked quantifiers |
+
+`\s` includes U+00A0, U+FEFF and Unicode line/paragraph separators; it excludes
+U+0085. Dot excludes LF, CR, U+2028 and U+2029. `\w` excludes U+0130.
+`matches email` is conservative, not RFC 5322: one `@`, nonempty local part without
+whitespace/`@`, and at least two nonempty domain parts without whitespace/`@`.
+A no-break space therefore fails email validation. Other bare names report PLAY0366.
+
+PLAY0367 means invalid syntax, including stacked quantifiers. PLAY0699 means a
+construct outside the dialect: lookarounds, backreferences, word boundaries,
+Unicode properties, code-point escapes, control/octal/identity escapes, .NET-only
+anchors/options/class subtraction, empty classes, stray brackets, class escapes as
+range endpoints, or non-ASCII group names. Use explicit classes, UTF-16/hex escapes,
+`^`/`$`, or a literal text rule where equivalent. A length-only lookahead can become
+an anchored counted repeat; there is no general lookaround replacement.
+
+Limits are 1,000 decoded UTF-16 code units and 3,000 expanded nodes. Literals,
+classes, anchors and each optional/loop/alternative choice point count one. Counted
+repeats multiply their body by the upper bound (unbounded: lower bound plus one),
+adding optional/loop choices. `x{1500}` counts 1,500; `a{0,1500}` and `(a*){1500}`
+count 3,000. Exceeding either limit reports PLAY0699 before automaton construction.
+
+Older serialized ESM retains authored pattern bytes and loads, but invalid/refused
+patterns plan as UnsupportedValidation and generation checks report Unproven;
+re-authoring reports PLAY0367/PLAY0699.
+Browser matching remains advisory: JavaScript may backtrack even on admitted
+`(a+)+$`. The server-side linear check is authoritative.
+
+## Studio replacements and public check APIs
+
+Only exact escaped-literal Studio shapes desugar with warning PLAY0787, not PLAY0699:
+
+| Decoded pattern (`L` is an escaped literal) | Replacement |
+| --- | --- |
+| `^(?![\s\S]*L)` | `not contains "literal"` |
+| `L(?![\s\S])` | `ends with "literal"` |
+| `^L(?![\s\S])` | `== "literal"` |
+| `^(?!L$)` or `^(?!L(?![\s\S]))` | `!= "literal"` |
+
+Recognition requires a lossless escape/decode round trip: Studio v1 uses
+.NET Regex.Escape; v2 escapes `\ ^ $ . | ? * + ( ) [ ] { } /`. Other lookarounds
+remain refused. Plain `L`, `^L`, `^L$` and `L$` are unchanged. Syntax retains the
+original text, while binding stores the ordinal rule. Old ESM evaluates these exact
+patterns as replacements without changing bytes. The editor quick fix and MCP
+`propose-repair` migrate to literal rules preserving message/severity; preview the
+revision-bound canonical-formatting proposal before explicit apply.
+
+C#: `Cratis.Screenplay.Semantics.PortableMatchPattern.Check(pattern)`.
+TypeScript: import `checkPortableMatchPattern` from `@cratis/screenplay-compiler`.
+Both return PortableMatchCheck: status, code, construct, UTF-16 offset in the decoded
+pattern, suggestion, description and optional replacement `{ kind, value }`.
+Statuses are Admitted, Deprecated, Refused, Invalid (lowercase strings in TypeScript).
+Admitted has no code; Deprecated is PLAY0787, Refused PLAY0699, Invalid PLAY0367.
+Replacement kinds are Equal, NotEqual, Contains, NotContains, StartsWith, EndsWith.
+Checking never executes a pattern or constructs a platform regex.
+
+Validate with `screenplay <root> --warnaserror`, then execute acceptance/refusal
+examples through `screenplay test <root>`; source validation alone is not a rule test.

package/package/corpus/skills/cratis-screenplay-command-surface/references/validate-rules.md

@@ -10,9 +10,18 @@
 | `== <v>` / `!= <v>` | `currency == "NOK"`, `status != draft` |
 | `length == <n>` | `currency length == 3` |
 | `matches email` | the only named pattern; any other name is `PLAY0366` |
-| `matches "<regex>"` | ECMAScript; matches **any substring** unless anchored with `^…$`; an invalid pattern is `PLAY0367` |
+| `matches "<regex>"` | Portable linear dialect; any substring unless anchored `^…$`; invalid syntax PLAY0367, refused constructs PLAY0699 |
+| `contains "<text>"` / `not contains "<text>"` | Ordinal substring presence/absence on scalar non-enum text |
+| `starts with "<text>"` / `ends with "<text>"` | Ordinal prefix/suffix; quoted literal operands, not conditions |
 | `all > <v>` / `all >= <v>` | `lines.quantity all > 0` |
 | `rule <Name>` | `orgNumber rule BeAValidOrganizationNumber` |
+| `checksum luhn|mod11|mod97` | String concept `validate checksum luhn`; validates supplied/stored values too |
+
+Requires Screenplay 4.172.0 or later (`screenplay --version`) for checksum rules
+(ESM v21); older compilers refuse them with PLAY0268. A pattern's `checksum`
+modifier generates check digits but does not add validation. Check digits catch
+typos, not forgery. For generated-concept proof statuses, deterministic regex
+limits and PLAY0688 repairs, read [generated rules](generated-values-and-responses.md#generated-concept-rules-esm-v20).
 
 ## `not empty` means non-blank text
 
@@ -60,9 +69,10 @@ validate
 
 A bodied rule or fenced block on a validation, rule or policy binds as opaque code
 (ESM v3): the reference runner reports it unsupported, and a target must supply the
-implementation. Two exceptions never bind: the command `handler`, and a `file`
-constraint (the binder records the requirement, then rejects it with `PLAY0268`;
-only `unique` constraints bind).
+implementation. Attached command handlers and `file` constraints remain PLAY0268
+(only `unique` constraints bind). Pending command handlers beside unconditional
+`produces` instead bind as described commands; see [described handlers](described-handlers.md).
+Literal text rules, portable patterns and Studio desugaring: [text and match rules](text-and-match-rules.md).
 Stage renders pure reducer transitions and opaque policy bodies, but refuses command and
 concept code validations and rule predicates (STAGE-ESM-005): those are gap-fill code. Prefer a
 declarative rule when one can say it. What binds and what the executable model rejects (Date and

package/package/corpus/skills/cratis-screenplay-command-surface/verification.json

@@ -4,6 +4,11 @@
   "fixtures": [],
   "assertions": [
     { "kind": "play-compiles" },
+    { "kind": "skill-contains", "value": "Unsupported (`ImplementationBody`)", "file": "references/described-handlers.md" },
+    { "kind": "skill-contains", "value": "including Stub mode", "file": "references/described-handlers.md" },
+    { "kind": "skill-contains", "value": "DecisionStateChanged", "file": "references/protected-reads.md" },
+    { "kind": "skill-contains", "value": "checkPortableMatchPattern", "file": "references/text-and-match-rules.md" },
+    { "kind": "skill-contains", "value": "U+00A0", "file": "references/text-and-match-rules.md" },
     { "kind": "skill-contains", "value": "screenplay_declaration_details", "file": "references/generated-values-and-responses.md" },
     { "kind": "skill-contains", "value": "do not hand-edit the text", "file": "references/generated-values-and-responses.md" },
     { "kind": "skill-contains", "value": "A CLI-bundled MCP can lack this summary", "file": "references/generated-values-and-responses.md" },
@@ -42,7 +47,7 @@
     },
     {
       "kind": "skill-contains",
-      "value": "`produces` and `handler` are mutually exclusive"
+      "value": "A file/code `handler` cannot coexist with `produces`"
     },
     {
       "kind": "skill-contains",
@@ -54,11 +59,11 @@
     },
     {
       "kind": "skill-contains",
-      "value": "`reads` is not a protected read"
+      "value": "command reads protected"
     },
     {
       "kind": "skill-contains",
-      "value": "Adding a\n`concurrency` block does not fix this"
+      "value": "reads/concurrency cannot combine (PLAY0783)"
     },
     {
       "kind": "skill-contains",
@@ -93,6 +98,8 @@
       "value": "Generated identifiers need Uuid or String backing and at least 64 random bits.", "file": "references/generated-values-and-responses.md"
     },
     { "kind": "skill-contains", "value": "Generated values and responses (ESM v7 and v15)" },
+    { "kind": "skill-contains", "value": "names that can match together report PLAY0367", "file": "references/text-and-match-rules.md" },
+    { "kind": "skill-contains", "value": "or reaction `where` remain PLAY0268", "file": "references/text-and-match-rules.md" },
     { "kind": "skill-contains", "value": "Generated values are not request inputs", "file": "references/generated-values-and-responses.md" },
     { "kind": "skill-contains", "value": "Generated-concept validation rules select ESM v20", "file": "references/generated-values-and-responses.md" },
     { "kind": "skill-contains", "value": "PLAY0688 and a violating example", "file": "references/generated-values-and-responses.md" },

package/package/corpus/skills/cratis-screenplay-event-modeling/SKILL.md

@@ -108,7 +108,7 @@ The independent verdicts V1 to V5 that report them are in
 `cratis-screenplay-modeling-lifecycle`.
 
 What binds depends on **which tool** you ask, so name the tool and its version:
-Read [references/parsed-not-runnable.md](references/parsed-not-runnable.md) (section "What binds depends on which tool") when stating what a tool binds or renders (`reads`/`concurrency` fail with `PLAY0271`; `persona` declarations are report-only; an older bundle reports *Slice '<name>' of type '<type>' is not admitted by ESM v1.*).
+Read [references/parsed-not-runnable.md](references/parsed-not-runnable.md) (section "What binds depends on which tool") when stating what a tool binds or renders (legacy reads and `concurrency` fail with `PLAY0271`; protected command reads opt into v25; `persona` declarations are report-only; an older bundle reports *Slice '<name>' of type '<type>' is not admitted by ESM v1.*).
 
 The ESM versions, the full disposition table and the Step 7 clock example's binding
 result are in [references/parsed-not-runnable.md](references/parsed-not-runnable.md)
@@ -169,19 +169,19 @@ compile or will not be safe. Both are deliberate.
 
 - **A command may read state.** The generic method forbids `ReadModel -> Command`
   edges. Screenplay ships `reads <ReadModel> [as <alias>] [by <property>]` so the
-  model shows what a state-dependent decision consulted. **It is not a protected
-  (open limitation):** nothing checks at append time that the state is still current,
-  the executable model rejects `reads` and `concurrency` (`PLAY0271`), and adding
-  `concurrency` does not make the decision safe .
-  Write a state-dependent rule as `reads <View>` plus `require <expr> message "..."`
-  and mark it in the slice `description` as **not enforced in the model today**,
-  naming the target that must enforce it (Arc `[ProtectedDecision]` with
-  `DecisionRead<T>`, Chronicle's dynamic consistency boundary, or a constraint where
-  one fits). Model uniqueness as a `unique` constraint. Never copy state into a
+  model shows what a state-dependent decision consulted. Application-root
+  `command reads protected` admits eligible command reads as v25: absent state
+  rejects and matching decide/commit changes conflict. Read
+  [protected reads](../cratis-screenplay-command-surface/references/protected-reads.md)
+  for the strict shape and paths. Legacy reads remain PLAY0271; `concurrency` is
+  not protection and cannot combine with protected reads. Stage refuses protected reads
+  (STAGE-ESM-044), not v25 itself: name target enforcement separately rather than claiming a render.
+  Write state-dependent rules as `reads` plus `require` with an indented message;
+  mark refused shapes as unenforced and name the intended target mechanism. Model uniqueness as a `unique` constraint. Never copy state into a
   command input, add an attestation flag, or hide the rule in `handler` prose. Do not
   use `reads` to fetch data the command could carry as input. A reaction trigger
-  declares the views an automation decides from with the same `reads`, and the same
-  caveat applies.
+  declares consulted views with `reads`, but trigger reads remain unprotected;
+  decide in an invoked command instead.
 - **Some validation *does* belong in the model.** The generic method routes format
   rules to the type system. Screenplay's type system *is* the `concept`, and a
   concept carries its own `validate` block - so a format rule lives on the concept

package/package/corpus/skills/cratis-screenplay-event-modeling/references/parsed-not-runnable.md

@@ -34,7 +34,7 @@ Tool versions and consumer boundaries: toolchain `SKILL.md`.
 | Compliance concepts | Bare `pii`/`personal` and `secret`, qualifiers and scope bind as v13; enum/identity compliance and events combining personal or explicitly subject-scoped secret values with an explicit `subject` mark refuse PLAY0268 at binding only. A CLI bundle that admits v13 binds markers; Stage renders v13 protection, not protected identities/enums or subject lineage. Never remove protection |
 | Identity details / processing purposes / event subject | Report-only metadata; executable detail reads refuse PLAY0268, not source declaration errors |
 | Composite stream ids | v8 routing; complete named parts/canonical comparisons, PLAY0515 refuses protected keys/sources; not a legacy text split |
-| Command reads/concurrency | Legacy unprotected decisions, PLAY0271 |
+| Command reads/concurrency | Eligible reads opt into v25 with `command reads protected`; legacy reads/concurrency retain PLAY0271; Stage refuses protected reads (STAGE-ESM-044), not the v25 pair |
 | Invokes-only trigger reads | Report-only, not protected state; direct production with reads refuses |
 | Generated values/responses | v7 binding/reference execution; v15 strategies/strict fixtures/freshness. Stage renders supported UUID/String strategies, responses and fixtures; unsupported types/combinations remain -028/-038 |
 | Sources/streams and command/specification routes | v8 binding/reference execution; the CLI (toolchain `references/renderable-subset.md`) reaches Stage checks through its bundled ceiling (v16 without v17 support) |
@@ -70,8 +70,10 @@ accepted proposal or parsed node with a running application.
 - `Automation` and `Translate` slices, reactions, captures and triggers bind (ESM v6) on the
   standalone tool and a CLI bundle that admits v6. (An older bundle
   reports *Slice '<name>' of type '<type>' is not admitted by ESM v1.*) Stage renders supported event-triggered Automation, not Translate/captures or non-event triggers.
-- `reads` and `concurrency` on a command do not bind (`PLAY0271`), so no decision is
-  protected against stale state. A reaction trigger's `reads` that only `invokes` is
+- Eligible command reads bind/reference-execute with `command reads protected`
+  (v25); legacy reads and `concurrency` remain PLAY0271. Read command-surface
+  [protected reads](../../cratis-screenplay-command-surface/references/protected-reads.md)
+  for admission, absence/conflicts and Stage refusal. A reaction trigger's `reads` that only `invokes` is
   report-only intent (`PLAY0270`); one that `produces` directly fails binding (`PLAY0268`).
 - `persona` declarations are report-only and never block; bare `pii` and `secret`
   concepts bind as ESM v13 (Requires Screenplay 4.141.0 or later); Stage renders admitted v13 protection.

package/package/corpus/skills/cratis-screenplay-event-modeling/verification.json

@@ -45,7 +45,11 @@
     },
     {
       "kind": "skill-contains",
-      "value": "It is not a protected"
+      "value": "command reads protected"
+    },
+    {
+      "kind": "skill-contains",
+      "value": "Legacy reads remain PLAY0271"
     },
     {
       "kind": "skill-contains",

package/package/corpus/skills/cratis-screenplay-legacy-extraction/SKILL.md

@@ -137,8 +137,8 @@ chain per slice before handoff (`references/evidence-table-template.md`, "Tracea
    - one StateChange per decision a person or system makes; events are facts experts recognise;
      consequences (counters, denormalised copies) become projections; an automation only when
      evidence shows a separate decision; no generic names (`Update/Edit/Save<Noun>`, `<Noun>Updated`): split by intent;
-   - refusals, state-dependent rules (`reads` + `require`, marked **NOT enforced in the model
-     today** with the target named), unique indexes and preserved `pii` / `secret` protection:
+   - refusals, state-dependent rules (`reads` + `require` with eligible protected-read
+     opt-in; legacy/refused shapes marked unenforced and target realization named), unique indexes and preserved `pii` / `secret` protection:
      `references/rule-modeling.md`. Every role gate has `authorize` plus a `then denied` spec,
      else a recorded gap; rules you cannot express truthfully are recorded one by one, never
      fabricated.

package/package/corpus/skills/cratis-screenplay-legacy-extraction/references/evidence-table-template.md

@@ -57,7 +57,7 @@ Example rows:
 | id | source | locator | observed fact | technical shape | strength | classification | gen. disposition | candidate | decision | decided by | verdict |
 |---|---|---|---|---|---|---|---|---|---|---|---|
 | E1 | dynamic | capture 0007, `POST /api/checkins` | taking in a coat writes two tables | insert `Checkins`; update `Hooks(occupied)`; 201 x41, 409 x3 | Observed | intent (take in) + consequence (hook) | n/a | `TakeInCoat` -> `CoatTakenIn`; occupancy via projection | change | proposed | not asked |
-| E2 | code | `CheckinService.cs` | 409 when the hook is already free, message "That coat is not on a hook" | throws `ConflictException` | Read | intent (rule) | n/a | `reads CoatStatus` + `require`, NOT enforced today (target: protected decision or Chronicle `concurrency` scope); no executable error spec, recorded in LOSS.md | keep | proposed | not asked |
+| E2 | code | `CheckinService.cs` | 409 when the hook is already free, message "That coat is not on a hook" | throws `ConflictException` | Read | intent (rule) | n/a | legacy control: `reads CoatStatus` + `require` without protected opt-in; inspect v25 admission, record refused shape/Stage target gap in LOSS.md | keep | proposed | not asked |
 | E3 | static | `static.play`, SP0016 at `CheckinValidator` | validation rule held to a condition is emitted unconditionally; the condition is lost | `When(x => x.IsVip)` | Exact (loss) | unknown | Lowered without its condition (semantic mismatch, reported by SP0016) | none yet | undecided | - | question Q4: when does the rule really apply? read `CheckinValidator` and ask an expert |
 | E4 | dynamic | uncorrelated txn, `Hooks` nightly 02:00 | hook flags reset without a command | update `Hooks(*)` daily | Observed | unexplained | n/a | none | undecided | - | question Q5 |
 

package/package/corpus/skills/cratis-screenplay-legacy-extraction/references/generated-recovery.md

@@ -24,6 +24,20 @@ Each recovery below has its own gate; use the adapter that has the one you rely
 
 - Requires Arc.Screenplay 22.78.0 or later for `[GeneratedValue]` Handle parameters whose `New()` is a UUID v4 form, for the `generated identifier` and response they produce, and for scenario pins (`for` / `generated`). Before it none of this is recovered. From 22.78.0 until 22.86.0 any other strategy keeps its source form and reports SP0073.
 - Requires Arc.Screenplay 22.86.0 or later to recover UUIDv7, ULID, TypeID, NanoID, `Bytes` and hex strategies as concept `generate` lines (ESM v15) and a passed-through `GenerationContext`.
+- Requires Arc.Screenplay 22.101.0 for generated-concept validator recovery (ESM
+  v20); check `dotnet list package --include-transitive`. Older adapters withhold
+  generation on rule-bearing concepts. Recovery covers only a fully recovered,
+  non-opaque default validator: Proven rules emit, Unproven rules remain with
+  SP0078, Refuted rules withhold generation with SP0073 and a counterexample.
+  Generation is also withheld with SP0073 (rules kept) when the validator is
+  unreadable, conditional or names a predicate (`rule <Name>`), when a UUID
+  concept has any validator, when the concept carries `pii` or `secret`, and
+  below a v20 cap.
+- Requires Arc.Screenplay 22.107.0 for pattern/random, checksum validation and
+  self-contained String generation-rule recovery (ESM v21); older adapters leave
+  those factories in code with SP0073. A v20-or-lower cap withholds generation
+  and dependent values/mappings/responses/destinations/scenarios, preserving
+  checksum validation as a source attachment rather than dropping it.
 
 Tagged evidence:
 
@@ -38,24 +52,30 @@ Tagged evidence:
 Use the [same shop vocabulary](../../cratis-screenplay-command-surface/references/shop-generation.md):
 CustomerId (`cus_` + ULID), OrderId (TypeID), InviteCode (NanoID), ApiKey (secret
 Bytes(32) with .NET `[NotAudited]`). Do not claim exact recovery of every factory:
-the custom `cus_` interpolation is not a recognized single factory call;
-TypeID can recover a passed-through context's strategy, not equivalent receipt-time/
-tenant behavior. Context-member bodies and generated secrets remain unreleased
-Screenplay scope. Preserve ApiKey's protection and source code, not an unprotected
+a custom `cus_` interpolation may recover as a self-contained String rule, not as
+an inferred built-in prefix strategy. TypeID recovers a passed-through context's
+strategy, not proof of equivalent receipt-time/tenant behavior. Context-member
+String bodies can recover under the v21 gate; generated secrets stay in code.
+Recovered rule fixtures supply a String result without reference execution of the body. Preserve ApiKey's protection and source code, not an unprotected
 replacement String. The intentional candidate can author the released customer
 prefix strategy with an explicit target decision, separate from as-is proof.
 
 Recover the strategy the source proves; do not choose a replacement because a
 factory is named `New()`. Use the existing [strategy reference](../../cratis-screenplay-command-surface/references/generated-values-and-responses.md)
-for meaning and shapes, then the forms below for parameter factories, literal pins
+for meaning and shapes (including readable InvoiceNumber patterns and random Int
+TicketNumber values), then the forms below for parameter factories, literal pins
 and retained source pointers.
 
 ## When not to
 
 Do not infer generation for client-supplied IDs, deduplication keys or gapless
 invoice numbers, or turn an observed secret into a random String. Preserve
-protection and unrecovered code; rule/context-member bodies are not executable
-strategies. Report missing pins, withheld productions/scenarios and version caps
+protection and unrecovered code. A pattern is not a gapless/sequential allocator
+or secret; check digits detect typos, not forgery. Low-entropy payload codes need
+uniqueness separate from source freshness. Arc recovery does not imply rendering:
+Requires Stage 4.118.0 for checksum validation and 4.119.0 for pattern/random;
+older renderers refuse them. `generate rule` still refuses STAGE-ESM-028.
+Report missing pins, withheld productions/scenarios and version caps
 as losses, not successful recovery. Sources: Arc
 `Documentation/backend/csharp/generating-a-screenplay.md`;
 Screenplay `Documentation/screenplay/generated-values/choosing.md`.
@@ -65,8 +85,8 @@ Screenplay `Documentation/screenplay/generated-values/choosing.md`.
 The UUID v4 forms, pins and the identifier/response rules in this section need Arc.Screenplay 22.78.0 or later; the other strategies in the list below need 22.86.0 or later.
 
 A `[GeneratedValue]` Handle parameter becomes a generated command property only
-for a required scalar Uuid/String concept with a proven strategy and no validator,
-validation rules or compliance markers. Its explicit attribute name, otherwise
+for a required scalar Uuid/String or signed Int32/Int64 random concept with a proven strategy and no compliance
+markers. Validator rules recover under the v20 gate above, not by deleting them. Its explicit attribute name, otherwise
 parameter name, becomes the property name. A directly returned event-source
 identity (alone or beside an event) adds `generated identifier` and a response;
 a direct `EventForEventSourceId(parameter, event)` target adds the identifier
@@ -85,10 +105,26 @@ Constructors/conversions must forward the primitive unchanged. Recoverable calls
 - `RandomNumberGenerator.GetHexString(...)` → hex bytes only with an even literal
   character count; preserve its requested casing.
 
-A passed-through `GenerationContext` parameter is readable for UUIDv7/ULID/TypeID;
-reading `context.Now` or `context.Tenant` is not. Helper calls, multi-statement
-bodies, computed/invalid arguments and rule/pattern/random execution stay in code
-with SP0073. Never invent a rule body or implementation-file reference.
+Under the v21 recovery gate, literal `GenerateValue.Pattern(pattern[, checksum])`
+and its passed-through context overload recover `generate pattern`; dated patterns
+require that context overload. `GenerateValue.Integer(min, max)` recovers inclusive
+signed Int64 `random`; an Int32 concept needs exactly one `(int)` cast with both
+bounds inside Int32. Invalid/computed arguments, unsigned backing and extra casts
+stay in code with SP0073. Screenplay checks pattern support, proofs and entropy.
+
+An unconditional default validator's `Must(v => GenerateValue.HasValidChecksum(v,
+Checksum.Luhn))` recovers `validate checksum luhn` (also Mod11/Mod97). None,
+conditional predicates and arbitrary helper predicates are not checksum rules.
+
+A self-contained String factory can instead recover `generate rule <Concept>New`
+with an inline `csharp` body, stripping only proven forwarding constructions.
+Literal/primitive locals, `context.Now`, `context.Tenant`, string, Math, Convert,
+Guid, RandomNumberGenerator and GenerateValue are allowlisted; multi-statement
+bodies can qualify. Compound time-based calls must pass the captured context.
+Private helpers, fields, DI, aliases/static imports, ambient time, raw Default
+comparisons and external dependencies remain SP0073; no file fallback is invented.
+This is the Cratis C# binding to Fundamentals' GenerationContext, not a universal
+runtime type. Opaque entropy is unknown, so a rule cannot supply an identifier.
 The concept owns `generate`; each command property only marks generation.
 Use the shared [strategy reference](../../cratis-screenplay-command-surface/references/generated-values-and-responses.md)
 for exact encodings, ranges, entropy and admission, rather than duplicating them.
@@ -119,7 +155,8 @@ resolved adapter version, diagnostic, retained/withheld form and open question:
 
 | Diagnostic | Loss to reconcile |
 | --- | --- |
-| SP0073 | Unproven strategy/body/arguments, or non-default strategy above the ESM cap; no replacement strategy inferred. |
+| SP0073 | Unproven strategy/body/arguments, refuted generated-concept rule with witness, or generation above the ESM cap; no replacement strategy inferred. |
+| SP0078 | Generated-concept rule proof is Unproven; preserve the rule and reason, not a claim of Proven generation. |
 | SP0052 | Unadmitted generated value, dependent response or pre-generation protection stays in code; local-generation fallback is not parameter recovery. |
 | SP0012 | A required payload mapping or condition needs an unavailable value/read: withhold the whole production, never prune it into an incomplete fact. An optional blocked mapping can be omitted alone. |
 | SP0039 | Missing/unreadable pins, unrecoverable source identities or outcomes withhold the whole scenario. Name what was lost. |

package/package/corpus/skills/cratis-screenplay-legacy-extraction/references/intent-example.md

@@ -1,5 +1,10 @@
 # Intentional candidate example
 
+Legacy control: this candidate deliberately omits `command reads protected`, so its
+unenforced markers are about this source. Eligible command reads can instead opt
+into v25; inspect all reads before migration and keep target realization separate.
+Read [protected reads](../../cratis-screenplay-command-surface/references/protected-reads.md).
+
 A complete, compiling example of what extraction produces: one legacy write that touched two
 tables (`Checkins`, `Hooks`) is re-sliced into a single decision event plus a projection. The
 numbers in the slice descriptions (`E1`, `E6`, `Q3`) are evidence ids and open questions from

package/package/corpus/skills/cratis-screenplay-legacy-extraction/references/loss-report-template.md

@@ -35,7 +35,8 @@ and the question raised.
 ## Rules not enforced or not expressible today
 One line per rule, named individually (never one generic platform caveat): the rule, its
 evidence row, the invariant and consistency risk, and the target enforcement. State-dependent
-checks are written as `reads` + `require` and marked NOT enforced in the slice description;
+checks use `reads` + `require`: eligible reads opt into v25 protection, while legacy/refused
+shapes are marked unenforced and Stage realization remains a separate gap;
 date rules and opaque policies that no declaration can state stay in the slice `documentation` and here.
 
 ## Unknowns and undecided target decisions

package/package/corpus/skills/cratis-screenplay-legacy-extraction/references/rule-modeling.md

@@ -12,9 +12,12 @@
 
 ## State-dependent rules
 A rule that depends on stored state (current status, existing records, balances) is written
-as `reads <View>` + `require <expr> message "…"` and the slice description says it is **NOT
-enforced in the model today** (PLAY0268/0271 at binding are expected in design mode).
-Name the invariant, the race it leaves open, and the target:
+as `reads <View>` plus `require` with an indented message. Opt eligible views into
+application-root `command reads protected` (v25); test present/absent state and rule
+refusal, and matching decide/commit conflicts. Read
+[protected reads](../../cratis-screenplay-command-surface/references/protected-reads.md)
+for admission and Stage's refusal. For legacy/refused shapes, mark the rule unenforced.
+Name the invariant, the race it leaves open and the target realization:
 `[ProtectedDecision]` + `DecisionRead<T>` (Arc 22.39.0 and later; available to gap-fill
 in Stage's rendered package set, not automatically emitted), or a Chronicle
 `concurrency` scope on the event source or stream, or a constraint where one fits. Forbidden: caller-supplied copies of state

package/package/corpus/skills/cratis-screenplay-legacy-extraction/references/signal-to-intent.md

@@ -71,7 +71,7 @@ files on it. Each hop has a typical yield:
 
 | Path | Hops | What to take from it |
 |---|---|---|
-| Write | entry point (route, handler, form action), input model and validation, service, entity, repository, schema or migration, response and error mapping | the command name and inputs; `validate` rules with their exact messages; state-dependent checks (`reads` plus `require`, NOT enforced); unique indexes; the error mapping gives the `then error` text and the legacy HTTP code for the slice `documentation` |
+| Write | entry point (route, handler, form action), input model and validation, service, entity, repository, schema or migration, response and error mapping | the command name and inputs; `validate` rules with their exact messages; state-dependent checks (`reads` plus `require`, eligible protected opt-in or recorded legacy/refused shape and target gap); unique indexes; the error mapping gives the `then error` text and the legacy HTTP code for the slice `documentation` |
 | Read | entry point, query or repository, response model, paging and filter conventions | the read-model shape and query arguments (`by`, `filter`); which caller may narrow what |
 | Background | listeners, after-commit hooks, message consumers, schedulers, outbox relays | reaction or translation candidates; say "none found" when there is none |