@cratis/pi 7.62.0 → 7.64.0

package/package/corpus/product-sync.json

@@ -46,7 +46,7 @@
         ],
         "rules": []
       },
-      "notes": "Source-checked Stage v4.103.0: exact ESM v1-v17 and v19, not v18 or v20. Snapshot/live collection queries, identity-mapping all projections, stored event names, event-id publication checks, release-baseline warnings, command clock/receipt-time generation, conditional and multi-command slices, generated text constraints, no-event and bounded redelivery specs, refusal branches. Query concept validation still uses primitive workaround; Stage#370 is not released. CLI v3.62.0 bundles Stage 4.99.0, not 4.103.0. No new render/browser/Docker probe."
+      "notes": "Source-checked Stage v4.103.0: exact ESM v1-v17 and v19, not v18 or v20 (v18 admitted from 4.106.0 and v20 from 4.109.0, taught with Requires lines; 4.104-4.108 not otherwise reviewed). Snapshot/live collection queries, identity-mapping all projections, stored event names, event-id publication checks, release-baseline warnings, command clock/receipt-time generation, conditional and multi-command slices, generated text constraints, no-event and bounded redelivery specs, refusal branches. Query concept validation still uses primitive workaround; Stage#370 released in 4.106.0. CLI v3.62.0 bundles Stage 4.99.0, not 4.103.0. Generated-values-only delta checked at v4.127.0: v21/all-Proven unpinned specs from 4.115.0, warning/info generated rules 4.117.0, checksum validation 4.118.0, pattern/random factories/Host/executor 4.119.0; generate rule still STAGE-ESM-028. Language admission reconciled at the same v4.127.0 tag: exact v1-v21 and v23-v25 pairs; v22/v26 and mixed pairs -016, protected reads -044, atomic mode -043, described bodies STAGE-IMPL-002 even Stub mode; v24 first admitted 4.124.0 (absent 4.123.0). Other deltas not reviewed; synced unchanged. No new render/browser/Docker probe."
     },
     {
       "id": "arc",
@@ -99,7 +99,7 @@
           "vertical-slices.md"
         ]
       },
-      "notes": "Whole-product floor unchanged at 22.100.0. Focused read-protection coverage, Arc 22.106.0-22.108.0: ReadProtectionMode Off, Measure and On (MSBuild property, assembly and command attributes, runtime MaximumMode cap), read-model parameters of Handle and validator constructors guarded under On, [LookUpBy], [Unprotected(\"why\")], per-stream read models on routed commands, Measure report, ReadChanged and ReadIncomplete refusals, and CommandScenario selecting decision mode automatically. the caller severity threshold (X-Allowed-Severity, [BlockOnValidationSeverity]) and the Error floor for commands declared On (22.108.0). [ProtectedDecision] and DecisionRead<T> retained as the per-command opt-in. The other 22.101.0-22.108.0 changes were not reviewed. Prior notes: scoped completion and routing validation, generated-target freshness, observable scenarios, asynchronous execution scopes, read-model diagnostics, ordered reactor refusal handling and ICommandExceptionMapper. No new runtime probe."
+      "notes": "Whole-product floor unchanged at 22.100.0. Focused read-protection coverage, Arc 22.106.0-22.108.0: ReadProtectionMode Off, Measure and On (MSBuild property, assembly and command attributes, runtime MaximumMode cap), read-model parameters of Handle and validator constructors guarded under On, [LookUpBy], [Unprotected(\"why\")], per-stream read models on routed commands, Measure report, ReadChanged and ReadIncomplete refusals, and CommandScenario selecting decision mode automatically. the caller severity threshold (X-Allowed-Severity, [BlockOnValidationSeverity]) and the Error floor for commands declared On (22.108.0). [ProtectedDecision] and DecisionRead<T> retained as the per-command opt-in. The other 22.101.0-22.108.0 changes were not reviewed. Prior notes: scoped completion and routing validation, generated-target freshness, observable scenarios, asynchronous execution scopes, read-model diagnostics, ordered reactor refusal handling and ICommandExceptionMapper. Generated-values-only delta checked at v22.107.1: 22.104.0 enforces every concept-rule severity and carries Fundamentals 7.25.0; 22.107.0 recovers pattern/random/checksum and self-contained String generation rules, with v21 caps and fixture validation. No new runtime probe."
     },
     {
       "id": "ai",
@@ -171,9 +171,9 @@
         }
       ],
       "synced": {
-        "version": "4.188.0",
+        "version": "4.199.0",
         "date": "2026-10-16",
-        "by": "Cratis/AI#706"
+        "by": "Cratis/AI#735"
       },
       "covers": {
         "skills": [
@@ -201,7 +201,7 @@
         ],
         "rules": []
       },
-      "notes": "Standalone 4.188.0 and byte-identical compiler contract pinned. Cratis/AI#706: application navigation regions (module inherit, extend or override), toolbar slice buttons, blueprint template references and sample data packs in cratis-screenplay-ui-composition (references/application-shell.md), with the canonical shell vector and the rejection codes PLAY0710-PLAY0722 and PLAY0740-PLAY0765. Examples moved to the executable-state rules since 4.164: translator reactions in an Automation slice beside the Translate slice (PLAY0694) and the first record of a capture key appended with `when added`. Earlier: Standalone 4.164.0 and byte-identical compiler contract pinned. Cratis/AI#663: one origin per capture (PLAY0687). #668: executable no-event/redelivery v17. #684: concept query-argument validation in every version and query-error assertions v18. #681: executable refusal branches and refusal values v19. #666: proposal summary/severity counts and exact structural source proposals. Generated-concept rules select v20 with PLAY0688/0689 proofs and derived-matches repair; generated secrets and preview strategies remain refused. Release-baseline from-esm admission reads storedName. Standalone binding is not renderer admission: Stage 4.103.0 admits v1-v17 and v19; CLI 3.62.0 bundles Screenplay 4.159.0 / Stage 4.99.0 and renders through v16. Prior evidence remains unless superseded; no new renderer, Docker or browser probe."
+      "notes": "Standalone 4.199.0 and byte-identical compiler contract pinned. Cratis/AI#735: chronological Date/DateTime ordering in command conditions and command/property literal validation (ESM v26), UTC tick precision and pre-rule offset validation; then matching remains ordinal. Source-checked Screenplay v4.199.0 commands, diagnostics, interoperability and specifications documentation plus decision 0087. Stage v4.127.1 still refuses v26 with STAGE-ESM-016 (stage-rendering.md and SemanticVersionFeatures.Supports); no render/runtime probe. Cratis/AI#576: prior mechanical compiler catch-up. Language batch #717/#722/#723/#724/#720/#728/#734 teaches atomic reaction batches (v22), described payload handlers (v23), portable linear matching, ordinal text rules (v24), protected command reads (v25), diagnostic arguments and event-source invokes mappings. Facts read at Screenplay v4.198.0 and introducing tags; Stage v4.127.0 admits exact v1-v21 and v23-v25 pairs but refuses v22/v26 and mixed pairs (STAGE-ESM-016), protected reads (044), atomic mode (043) and described handlers (STAGE-IMPL-002), even Stub mode. Stage text rules execute/render; no new renderer/runtime probe or Stage pin uplift. Cratis/AI#706: application navigation regions (module inherit, extend or override), toolbar slice buttons, blueprint template references and sample data packs in cratis-screenplay-ui-composition (references/application-shell.md), with the canonical shell vector and the rejection codes PLAY0710-PLAY0722 and PLAY0740-PLAY0765. Examples moved to the executable-state rules since 4.164: translator reactions in an Automation slice beside the Translate slice (PLAY0694) and the first record of a capture key appended with `when added`. Earlier: Standalone 4.164.0 and byte-identical compiler contract pinned. Cratis/AI#663: one origin per capture (PLAY0687). #668: executable no-event/redelivery v17. #684: concept query-argument validation in every version and query-error assertions v18. #681: executable refusal branches and refusal values v19. #666: proposal summary/severity counts and exact structural source proposals. Generated-concept rules select v20 with PLAY0688/0689 proofs and derived-matches repair; generated secrets and preview strategies remain refused. Release-baseline from-esm admission reads storedName. Standalone binding is not renderer admission: Stage 4.103.0 admits v1-v17 and v19; CLI 3.62.0 bundles Screenplay 4.159.0 / Stage 4.99.0 and renders through v16. Prior evidence remains unless superseded; no new renderer, Docker or browser probe."
     },
     {
       "id": "scene",
@@ -381,9 +381,9 @@
         }
       ],
       "synced": {
-        "version": "7.23.0",
-        "date": "2026-10-12",
-        "by": "Cratis/AI#620"
+        "version": "7.25.0",
+        "date": "2026-10-15",
+        "by": "Cratis/AI#576"
       },
       "covers": {
         "skills": [
@@ -399,7 +399,7 @@
           "concepts.md"
         ]
       },
-      "notes": "Floor uses direct source verification, not a peer-dependency minimum. Initial historical floor recorded on 2026-10-12 by Cratis/AI#619; date records this inventory, not a new product verification."
+      "notes": "Source-checked v7.25.0: IGeneratable/IGeneratableInContext, GenerationContext, UUID/ULID/TypeID/NanoID/bytes and finite GenerateValue.Pattern overloads with optional Checksum, inclusive Int64 Integer, and HasValidChecksum. Pattern date segments use captured UTC time; check digits add no entropy or authorization and do not automatically add validation. No Stage version uplift or generated-secret admission is implied."
     },
     {
       "id": "components",

package/package/corpus/skills/cratis-application-slice-conformance/SKILL.md

@@ -44,7 +44,7 @@ This skill is a method: it names no API of its own. When the Screenplay skills a
 | --- | --- |
 | Where each rule lives (validator, `Provide()`, handler result, constraint, exception) | `rules/vertical-slices.md` "The decision matrix"  |
 | A customization never makes a rejected model renderable; managed output is never hand-edited | Stage (`Customizations/` is the unmanaged seam; managed output is regenerated) |
-| A command `handler` never binds (PLAY0268), so that slice is gap-fill with the model as contract | Screenplay (diagnostic PLAY0268) |
+| Attached command handlers remain unbound (PLAY0268); pending handlers with unconditional productions bind v23 as described commands, but reached bodies are Unsupported ImplementationBody and Stage refuses STAGE-IMPL-002 even in Stub mode | Screenplay and Stage; use the model as the gap-fill contract |
 
 ## Procedure
 

package/package/corpus/skills/cratis-arc-command/references/generated-values.md

@@ -24,7 +24,10 @@ For the current threaded example, read [shop commands](shop-generation.md) and
 [shop concepts](../../cratis-fundamentals-concept/references/shop-generation.md).
 Those declarations show:
 CustomerId (`cus_` + ULID), context-aware TypeID OrderId, NanoID InviteCode and
-secret bytes ApiKey. They allocate responses, not events or persisted entities.
+secret bytes ApiKey, readable InvoiceNumber (pattern/checksum) and Int64 pickup
+TicketNumber (`Integer`). The latter helpers require Fundamentals 7.25.0; inspect
+`dotnet list package --include-transitive` before use and retain existing factories
+on older packages. They allocate responses, not events or persisted entities.
 For a real Chronicle stream identity use `EventSourceId<T>`; return `(id, event)`
 to append and return the stream ID, or use an explicit event-source wrapper.
 
@@ -32,14 +35,19 @@ Keep existing/client-chosen identifiers and references on command properties.
 Services and read models remain ordinary dependencies, not generated values.
 UUID generation does not establish authorization, secrecy, idempotency, storage
 freshness, or gapless/sequential numbering. Use the domain's authoritative
-allocation mechanism for invoice numbers, not a random UUID strategy.
+allocation mechanism for gapless/sequential invoice numbers, not a random strategy.
+A pattern supplies a readable reference, not an allocator or secret; check digits
+catch typos, not forgery. The concept validator can call
+`GenerateValue.HasValidChecksum(value, Checksum.Luhn)` alongside shape checks;
+pinning bypasses generation, never validation. Keep short-code uniqueness separate.
 
 ## Resolution, validation and captures
 
 `GeneratedValueAttribute` targets parameters only. Use it on a command's public
 instance `Handle()`, not a property, constructor or `Provide()` parameter.
-The type must be non-nullable and implement `IGeneratable<TSelf>` for itself;
-a raw `Guid`, nullable concept or by-reference parameter is invalid. Use domain
+The type must be non-nullable and implement `IGeneratable<TSelf>` or
+`IGeneratableInContext<TSelf>` for itself; a raw `Guid`, nullable concept or
+by-reference parameter is invalid. Use domain
 concepts; the runtime's type check is the self-generatable interface contract.
 
 `[GeneratedValue]` uses the parameter name. `[GeneratedValue("customerId")]` keeps the
@@ -52,10 +60,11 @@ invoking `Handle()`. Neither a provided value nor a DI registration overrides a
 generated parameter. Unmarked parameters retain their normal resolution.
 
 Discoverable concept validators run with the command's scoped provider and
-cancellation token. Errors produce `GeneratedValueRejected`, an exception
+cancellation token. A failed rule produces `GeneratedValueRejected`, an exception
 outcome in `CommandResult`: a server-generation defect, not a request-validation
-400. Warnings/information allow execution. Fix the strategy or invariant; do not
-turn the defect into a user rejection or disable validation to make it pass.
+400. Requires Arc 22.104.0 for rejection at every severity, including Warning and
+Information; older runtimes let those severities execute. Fix the strategy or
+invariant; do not turn the defect into a user rejection or disable validation.
 
 Validated values enter `CommandContext.GeneratedValues` in parameter-resolution
 order. Each capture has zero-based `Order`, `Name`, declared `Type` and `Value`;
@@ -73,7 +82,7 @@ handler-construction checks remain for declarations compiled without analyzers.
 
 | Diagnostic | Severity | Fix |
 | --- | --- | --- |
-| ARC0022 | Error | Use a non-nullable type implementing `IGeneratable<TSelf>` for itself; no raw `Guid` or by-reference parameter. |
+| ARC0022 | Error | Use a non-nullable type implementing `IGeneratable<TSelf>` or `IGeneratableInContext<TSelf>` for itself; no raw `Guid` or by-reference parameter. |
 | ARC0023 | Error | Move the attribute to a non-static command `Handle()` parameter, not `Provide()`, a read model or controller. |
 | ARC0024 | Error | Give each generated parameter a non-empty unique name; comparison is case-sensitive. |
 | ARC0025 | Warning | Remove a redundant provided value of the generated type, or remove the attribute if `Provide()` should supply it. An unmarked parameter can still consume that provided type. |
@@ -126,7 +135,13 @@ Source: `Source/DotNET/Arc.Core/Commands/ModelBound/GeneratedValueAttribute.cs`,
 `Source/DotNET/Testing/Commands/CommandScenarioGeneratedValueExtensions.cs`.
 
 Contextual generation (received time and tenant) and Fundamentals' additional strategies need a newer Arc; [sources and Clock/Tenant
-setup](shop-generation.md). Arc does not supply a native freshness/collision
-allocator or a pattern contract. Screenplay separately admits concept `generate`
-strategies and freshness; see `cratis-screenplay-command-surface/references/generated-values-and-responses.md`
-for that language contract and Stage's explicit scopes, not native Arc freshness support.
+setup](shop-generation.md). Generated parameter resolution is not a gapless or
+short-code collision allocator. Fundamentals owns pattern/checksum factories;
+Arc resolves these through the concept's generation interface, not strategy-specific
+`[GeneratedValue]` options. Requires Arc.Screenplay 22.107.0 for pattern/random,
+checksum and self-contained String-rule recovery; older adapters keep them in code.
+Requires Stage 4.118.0 for checksum validation and 4.119.0 for pattern/random
+rendering; older renderers refuse them. `generate rule` remains STAGE-ESM-028.
+Screenplay separately admits concept `generate` strategies and freshness; see `cratis-screenplay-command-surface/references/generated-values-and-responses.md`
+for that language contract and Stage's explicit scopes. Native Arc freshness is a
+separate policy; a factory alone is not a storage guard.

package/package/corpus/skills/cratis-arc-command/references/shop-generation.md

@@ -13,8 +13,10 @@
 
 Use the [same shop concepts](../../cratis-fundamentals-concept/references/shop-generation.md):
 CustomerId is `cus_` + ULID; OrderId is context-aware TypeID; InviteCode is NanoID;
-ApiKey is secret `Bytes(32)` with `[NotAudited]`. The concept owns the factory,
-not a command property or a per-call random implementation.
+ApiKey is secret `Bytes(32)` with `[NotAudited]`. InvoiceNumber is a date/checksum
+pattern and TicketNumber an inclusive random Int64 pickup ticket. The concept owns
+the factory, not a command property or a per-call random implementation.
+Requires Fundamentals 7.25.0 for Pattern/Integer factories; check `dotnet list package --include-transitive`, upgrade or retain existing factories on older versions.
 
 The following complete command declarations depend on those Shop concepts and
 `Cratis.Arc.Core` / `Cratis.Arc.Chronicle`. They allocate response values only, not persisted entities or events;
@@ -87,16 +89,25 @@ and captured-time semantics, never one exact random suffix.
 - Existing/client-owned IDs stay command inputs; services/read models remain
   ordinary dependencies. Generation is not authorization or tenant isolation.
 - Randomness is not idempotency, storage freshness or a gapless invoice allocator.
-  Arc#3129 freshness is not delivered by this parameter API; Stage's v15 explicit
-  scopes are a separate realization.
+  Stage's explicit whole-source scopes protect generated destinations, not
+  every generated payload code; enforce payload uniqueness separately.
 - ApiKey is a credential, never a Chronicle stream ID: event-source IDs are plaintext
   metadata and cannot be encrypted. Identify the key with a separate `ApiKeyId` and keep
   ApiKey a secret value property. `[NotAudited]` protects
   causation only. Never log captures, return secrets on public endpoints, or
   append plaintext authentication credentials. Retain a hash; for retained
   operational secrets use `[Encrypted]` plus `[NotAudited]`.
-- Screenplay's generated context and secret execution remain unavailable. A
-  compiled Arc factory does not imply that it can recover or render as `.play`.
+- Readable patterns are not gapless/sequential invoice allocators or secrets;
+  check digits catch typos, not forgery. Short codes need uniqueness handling;
+  generation alone does not reserve a code.
+- Screenplay admits attached generation rules with Now/Tenant context, but its
+  reference evaluator only consumes pinned results. Generated secrets remain
+  refused. A compiled Arc factory does not imply that it can recover or render
+  as `.play`. Read [generated-value recovery](../../cratis-screenplay-legacy-extraction/references/generated-recovery.md)
+  for Arc.Screenplay prerequisites and refusal boundaries, and
+  [Stage admission](../../cratis-stage-rendering-and-sandbox/references/admission.md)
+  for checksum and pattern/random rendering prerequisites. `generate rule`
+  remains STAGE-ESM-028.
 
 ## Sources
 

package/package/corpus/skills/cratis-fundamentals-concept/SKILL.md

@@ -118,15 +118,23 @@ Sources and the complete shop example: [shop generation](references/shop-generat
 ## Choosing a strategy
 
 The shared shop uses CustomerId (`cus_` + ULID), context-aware OrderId (TypeID),
-InviteCode (NanoID), and secret ApiKey (`Bytes(32)`, `[NotAudited]` in its host).
+InviteCode (NanoID), readable InvoiceNumber (pattern with checksum), random Int64
+TicketNumber and secret ApiKey (`Bytes(32)`, `[NotAudited]` in its host).
 Read [choices, time/tenant context and protection](references/shop-generation.md).
 Requires Fundamentals 7.24.0 for these newer helpers; the earlier
 UUID examples remain supported.
+Requires Fundamentals 7.25.0 for `GenerateValue.Pattern(pattern, checksum)`, its
+`(pattern, context, checksum)` overload, `Integer(minimum, maximum)` and
+`HasValidChecksum(value, checksum)` (`dotnet list package --include-transitive`);
+older packages lack them. Read the shop reference for exact signatures and UTC
+patterns before using them; do not hand-roll checksum or random-range algorithms.
 
 ## When not to generate
 
 Client-supplied identities stay inputs; random generation is not idempotency or
-gapless numbering. UUIDs are not credentials. Byte generation can create a secret
+gapless/sequential numbering. Patterns are readable references, not allocators or
+secrets; check digits catch typos, not forgery. Short codes need collision handling
+and uniqueness/freshness enforcement appropriate to their role. UUIDs are not credentials. Byte generation can create a secret
 in Fundamentals, but audit suppression, authorized delivery and hash storage are separate
 host responsibilities; never treat randomness as protection.
 

package/package/corpus/skills/cratis-fundamentals-concept/references/shop-generation.md

@@ -15,12 +15,14 @@ A shop can use CustomerId (`cus_` + ULID) for
 recognizable time-ordered customer references, OrderId (TypeID) for typed order
 references, InviteCode (NanoID) for opaque invitation references, and ApiKey
 (`Bytes(32)`) for a 256-bit credential. UUID remains the ordinary identity choice;
-encoded bytes make an exact entropy budget explicit. Prefixes add no entropy.
+encoded bytes make an exact entropy budget explicit. InvoiceNumber uses a readable
+pattern with Luhn check digit; TicketNumber uses an inclusive random Int64 range
+for pickup tickets. Prefixes, dates and checksums add no entropy.
 UUIDv7/ULID/TypeID reveal time and are not monotonic within a millisecond.
 An invitation reference here is not by itself permission to join the shop; if
 possession is the authorization mechanism, treat it as a protected credential too.
 
-This complete concept excerpt requires `Cratis.Fundamentals` 7.24.0 or later and,
+This complete concept excerpt requires `Cratis.Fundamentals` 7.25.0 or later and,
 for the ApiKey audit attribute, `Cratis.Arc.Chronicle`. These are
 non-stream references; use `EventSourceId<string>` instead only if a concept
 actually identifies a Chronicle event source.
@@ -49,6 +51,17 @@ public record InviteCode(string Value) : ConceptAs<string>(Value), IGeneratable<
     public static InviteCode New() => new(GenerateValue.NanoId());
 }
 
+public record InvoiceNumber(string Value) : ConceptAs<string>(Value), IGeneratableInContext<InvoiceNumber>
+{
+    public static InvoiceNumber New(GenerationContext context) =>
+        new(GenerateValue.Pattern("INV-{yyyy}{MM}-#{7}", context, Checksum.Luhn));
+}
+
+public record TicketNumber(long Value) : ConceptAs<long>(Value), IGeneratable<TicketNumber>
+{
+    public static TicketNumber New() => new(GenerateValue.Integer(100000, 999999));
+}
+
 [NotAudited]
 public record ApiKey(string Value) : ConceptAs<string>(Value), IGeneratable<ApiKey>
 {
@@ -80,13 +93,39 @@ Do not present a tenant-prefixed custom string as standard TypeID.
 
 Use the context form only for time/tenant-dependent generation. If both interfaces
 are implemented, callers choose context; the interfaces themselves do not dispatch.
-Built-in context overloads reject default Now (`MissingGenerationTime`) and time
-before the Unix epoch. A fixed context fixes the timestamp, not random suffixes.
+Time-ordered built-in context overloads reject default Now (`MissingGenerationTime`)
+and time before the Unix epoch. A fixed context fixes the timestamp, not random suffixes.
+
+Requires Cratis.Fundamentals 7.25.0 for `Pattern`, `Integer`, `Checksum` and
+`HasValidChecksum` (`dotnet list package --include-transitive`); older packages
+lack these helpers. Upgrade deliberately or retain the existing factory.
+
+`GenerateValue.Pattern(string pattern, Checksum checksum = Checksum.None)` is the
+date-free overload; `Pattern(string pattern, GenerationContext context,
+Checksum checksum = Checksum.None)` uses `context.Now` in UTC for date segments.
+A date pattern without context throws `PatternRequiresGenerationContext`;
+default Now on the context overload throws `MissingGenerationTime`.
+Use `#` for digits, `?` for uppercase letters, `*` for letters/digits, positive
+ASCII classes and repeats up to 64. UTC segments are `{yyyy}`, `{yy}`, `{MM}`, `{dd}`.
+The appended checksum uses every preceding ASCII digit, including date digits:
+`Checksum.Luhn` and `Mod11` append one digit, `Mod97` two; Mod11 excludes payloads
+that would need digit 10. Output including suffix is limited to 256 characters.
+
+Generation does not add a validator. Use
+`GenerateValue.HasValidChecksum(value, Checksum.Luhn)` in the concept's validator
+when supplied/stored values must obey the arithmetic too; combine it with shape
+validation. `Integer(long minimum, long maximum)` returns `long`, includes both
+endpoints and supports the full Int64 range with unbiased secure randomness.
+Enforce unique short payload codes at append: randomness alone does not reserve
+one, and event-source freshness does not protect a different payload value.
 
 ## When not to generate
 
 - Client-minted customer/order IDs stay inputs. Do not replace them on retry.
-- Random values supply neither idempotency nor gapless invoice allocation.
+- Random values and readable patterns supply neither idempotency nor gapless/sequential
+  invoice allocation. A legally gapless invoice number needs an allocator.
+- Check digits detect transcription mistakes, not forgery or authorization; patterns
+  are not secrets. Low-entropy codes need explicit collision/uniqueness handling.
 - An ID is not an authentication token or authorization policy.
 - ApiKey is a **secret**, not an event-source ID: event-source IDs are plaintext metadata
   and cannot be encrypted. Use a separate `ApiKeyId` as the identity and keep ApiKey a
@@ -102,7 +141,11 @@ before the Unix epoch. A fixed context fixes the timestamp, not random suffixes.
 
 Fundamentals `Source/DotNET/Fundamentals/Concepts/GenerationContext.cs`,
 `IGeneratableInContext.cs`, `GenerateValue.TimeOrderedStrings.cs`,
-`GenerateValue.RandomStrings.cs`; `Documentation/csharp/generating-values.md`.
+`GenerateValue.RandomStrings.cs`, `GenerateValue.Patterns.cs`,
+`GenerateValue.Numbers.cs`, `Checksum.cs`; at Fundamentals v7.25.0,
+`Documentation/csharp/generating-values/patterns.md`,
+`Documentation/csharp/generating-values/reference.md` and
+`Documentation/csharp/generating-values/context.md`.
 Arc `Source/DotNET/Chronicle/Commands/NotAuditedAttribute.cs`,
 `CommandCausationValues.cs` (command/type/property exclusion only, never
 payload encryption or log protection);

package/package/corpus/skills/cratis-screenplay-automations-and-translations/SKILL.md

@@ -12,37 +12,41 @@ guarantees. Then write it as `Automation` and `Translate` slices that say truthf
 protected, what is only recorded, and who acts. Grammar depth is in
 `cratis-screenplay-captures-and-reactions`; this skill owns the decisions.
 
-**Translation crosses an application boundary:** inbound turns outside data or foreign
-public events into private local facts; outbound publishes private facts as one local public
-event type. Declare `direction inbound|outbound` when public metadata is used; omission
-preserves inbound for translations without a declared direction. Private-to-private follow-up is an
-Automation (`produces` or `invokes`), even when a Chronicle reactor realizes it.
-Read [public events and direction](references/public-events-and-direction.md) for released
-ESM v9 forms, event-target folds, publication specifications and the Unsupported capture limit.
+**Translation crosses an application boundary:** private-to-private follow-up is
+Automation, even if a reactor realizes it. Keep captures in Translate and reactions
+to their local facts in separate Automation slices. Read
+[public events and direction](references/public-events-and-direction.md) when
+choosing direction, folding events or specifying publication: it owns the ESM v9
+forms, PLAY0616 and directionless Translate's PLAY0694 split boundary.
+Requires Screenplay 4.176.0 or later (`screenplay --version`) for PLAY0694; older compilers leave that directionless shape unchecked.
 One `source events` capture reads one origin (event store); split several origins.
 Requires Screenplay 4.155.0 (`screenplay --version`) for PLAY0687; older tools leave it unchecked.
 
-Work in the model first. Code appears only where it is truly needed: the external call, the
-source adapter, the trusted actor, and everything Stage cannot render (below). Session and
-verdict discipline: `cratis-screenplay-modeling-lifecycle`; tools, versions and verdicts V1 to V5:
-`cratis-screenplay-toolchain`. When you add or change a reaction or capture, resolve its input,
-identity, effect and pending-work contract at that point; do not postpone it to the final review.
+Model behavior first; code implements external calls, adapters, actors and refused
+target scope. Follow `cratis-screenplay-modeling-lifecycle` for session discipline
+and `cratis-screenplay-toolchain` for verdicts. Settle input, identity, effect and
+pending-work contracts when changing each reaction/capture, not at final review.
 
 ## Tool and realization facts (read before promising anything)
-- Reactions, clocks, triggers, captures and Automation/Translate slices compile (V1) and bind (V3)
-  as ESM v6: the standalone tool and a CLI whose bundled compiler admits v6. A compiler that
-  stops before v6 reports PLAY0268 at binding: report "V3 blocked: PLAY0268 (ESM v6)" and
-  name the tool, never remove them.
-- The pinned standalone tool runs admitted scenarios through `screenplay test` or MCP
-  `run-specifications`; source validation and render publication do not run V4.
-- A renderer can refuse Automation/Translate members (STAGE-ESM-024) it does not realize.
-  Deliver that scope as authorized gap-fill
-  (`references/realization-and-gap-fill.md`).
-- Reaction `runs as system role "<Role>"` declares an invocation actor (ESM v10).
-  Without it the invoke has no caller. A compiler or renderer that stops before v10
-  rejects the syntax (PLAY0137) or refuses it at render admission (CLI-RENDER-004). The CLI/Stage pair (toolchain
-  `references/renderable-subset.md`) renders role/authenticated reaction identity; claim-reading/opaque gates retain STAGE-ESM-034. Checked model/diagnostics: captures-and-reactions
-  `references/invocation-identity.md`.
+- V1, V3, V4 and target rendering are separate; name the compiler and never remove
+  a refused construct. Run `screenplay test` or MCP `run-specifications` for V4.
+- Read [realization and gap-fill](references/realization-and-gap-fill.md) before
+  promising Automation/Translate delivery (STAGE-ESM-024).
+- Invokes have no caller without `runs as`. Read captures-and-reactions
+  [invocation identity](../cratis-screenplay-captures-and-reactions/references/invocation-identity.md)
+  for the ESM v10 actor and role/authenticated versus claim/opaque admission.
+
+## Atomic production boundaries and source identity
+
+Start new models with application-root `reaction batches atomic` (ESM v22 or later).
+Each trigger occurrence's direct productions and each selected refusal branch are
+separate all-or-none batches; invoked commands remain independent. Absence retains
+legacy per-fact behavior even at later versions. Assert no failed-batch facts and
+unchanged views, not only `then error`. Stage refuses v22 (STAGE-ESM-016) and
+atomic mode in admitted v23/v24 models (STAGE-ESM-043); keep the semantics as gap-fill.
+Read [atomic batches and source mappings](../cratis-screenplay-captures-and-reactions/references/atomic-batches-and-source-mappings.md)
+when choosing these boundaries or mapping an invoked identifier from `$eventSourceId`
+(or `$eventContext.eventSourceId`) instead of copying it into event payload.
 
 ## Effect guarantees and recovery traps
 | Guarantee | What it promises | What can show it |
@@ -102,19 +106,9 @@ of each, and how each record finds our entity (the correlation strategy); and fo
 occurrence, the effect and who acts. Cite existing answers instead of asking again. Missing
 correlation is the most common cause of failed integrations: surface it first.
 
-**Critical questions** (ask one group at a time; follow up from the answer; accept "unsure" as an
-open question, not an invented answer):
-1. **Sources.** "Which systems send us facts? For each: name, record types, channel (webhook, poll,
-   topic, file), format, who authenticates it?" Follow-up per system: "Does the record carry our
-   entity id, or do we need to remember their id against ours?"
-2. **Mapping.** "For the hardest record: does it map directly to one fact of ours, need several
-   facts, or need data we already hold?" Follow-up if not direct: "What do we look up, and what
-   happens when the record arrives before that data exists?"
-3. **Automations.** "What happens on its own after <fact>? Can it fail, wait, or need a person? What
-   do people see meanwhile? Who is allowed to do it?" Follow-up: "What makes it stop? What if it ran
-   twice?"
-4. **Recovery.** "Which records or steps can we not accept, and who fixes them, how, and how does
-   processing resume?"
+Read [integration interview prompts](references/integration-interview.md) when
+sources, mapping, automation ownership or recovery are unsettled. Ask one group at
+a time; treat "unsure" as an open question.
 
 **Unattended:** assume visibly. Record each assumption as a labelled open decision in `STATE.md`
 (`.ai-work/screenplay/<model-slug>/STATE.md`), mark the dependent slice open, never write a mapping
@@ -155,7 +149,8 @@ or actor that nobody confirmed. Read `references/worked-integration.md` when you
 7. **Translate outside facts** (`references/translation-patterns.md`): enter only via `capture` or a
    translator reaction, in a `Translate` slice; correlate first; keep the external fact distinct from
    ours; trace source fields *and* every required target field; decide dedup, ordering and recovery
-   ownership. A worker after translation needs a distinct local decision, obligation or effect.
+   ownership. A reaction to a capture's local fact is a separate Automation, not a
+   second job inside Translate. A worker after translation needs a distinct local decision, obligation or effect.
 8. **Specify and audit.** Work through `references/cases-to-specify.md` per declaration and hand the
    named cases to `cratis-screenplay-scenario-coverage`. Produce the audit in `references/audit-format.md`.
 
@@ -167,9 +162,16 @@ or actor that nobody confirmed. Read `references/worked-integration.md` when you
 - Clock triggers take no values (PLAY0450) and no `by` on reads (PLAY0443). `for each <View>` is
   reserved, not available.
 - Capture `when` cannot mix `and` and `or` (PLAY0089). A capture without `key` does not bind.
+- For `source events`, `key` is a required property on every `from` event (PLAY0700);
+  specs supply `given <Event>` / `when append <Event>`, not capture records (PLAY0701).
+- First sight is `added` only. Use `when added` separately for initial facts; seed
+  record updates with `given capture` of the same key. Read captures-and-reactions
+  `references/record-capture-specifications.md` for the prerequisite and child/nested rules.
 - Current V1 warns on undeclared capture/removal events (PLAY0166); V3 remains a
   separate binder check.
-- A trigger with `reads` that `produces` directly fails binding: decide in a command. `reads` never protects.
+- A trigger with `reads` that `produces` directly fails binding: decide in a command.
+  Command reads can protect with `command reads protected` and admitted shapes (v25);
+  trigger reads cannot. Stage refuses protected reads (STAGE-ESM-044); target protection remains a separate check.
 - An authorized command exercised in a spec without `given caller` is PLAY0389 at binding.
 - A list query (`=> Item[]`) binds (a snapshot list is not rendered, `STAGE-ESM-010`);
   a clock sweep that iterates items needs a code body the reference does not run

package/package/corpus/skills/cratis-screenplay-automations-and-translations/references/cases-to-specify.md

@@ -30,7 +30,9 @@ One spec in the slice does not cover the others.
 ## Translations
 | Case | Question | Typical shape |
 |---|---|---|
-| happy path | record arrives, our fact recorded | `when capture` -> `then <External>` + `then <Ours>` |
+| first sight | new record key arrives | record `when capture`, `when added` append -> `then <Fact>` and any separate Automation follow-up |
+| update | a field changes for a known key | `given capture` same key's previous record + `when capture`; field-change append holds |
+| consumed public event | capture has `source events` | `given <FromEvent>` / `when append <FromEvent>`, never capture-record fixtures (PLAY0701) |
 | arrives before our entity | the reference is unknown to us | decide: park, reject, or record an orphan fact for follow-up |
 | duplicate delivery | same record again | `given capture` (same record) + `when capture`: nothing new; or constraint rejection on our fact |
 | out of order | an older record after a newer one | `given capture` newer + `when capture` older; expected outcome stated |
@@ -66,4 +68,11 @@ One spec in the slice does not cover the others.
   tool's compiler stops before v6 does it report a false PLAY0285 on a cascade:
   then keep the cascade out of the command spec, specify it in the Automation slice
   (`when append <Trigger>`) and record the expectation. See `cratis-screenplay-scenario-coverage`.
-- `given capture` never persists between specs: state the baseline in each spec that needs it.
+- `given capture` never persists between specs: state the baseline in each record
+  update spec. First records (root, child, nested) are added only; field-change
+  `and`/`or` and transitions need previous state. Expressions/maps/unguarded record
+  appends are unchanged. See captures-and-reactions `references/record-capture-specifications.md`.
+- For `source events`, use prior typed events instead of `given capture`; cover
+  first added, per-key overlays, unchanged input, independent keys and optional
+  foreign `for` unrelated to the content key. Reference execution does not prove
+  capture redelivery deduplication or observer ordering.

package/package/corpus/skills/cratis-screenplay-automations-and-translations/references/integration-interview.md

@@ -0,0 +1,24 @@
+<!-- Copyright (c) Cratis. All rights reserved. -->
+<!-- Licensed under the MIT license. See LICENSE file in the project root for full license information. -->
+
+# Integration interview prompts
+
+Ask one group at a time, following up from the answer. Accept "unsure" as an open
+question, not an invented answer.
+
+1. **Sources.** "Which systems send us facts? For each: name, record types, channel
+   (webhook, poll, topic, file), format, who authenticates it?" Follow-up per system:
+   "Does the record carry our entity id, or do we need to remember their id against ours?"
+2. **Mapping.** "For the hardest record: does it map directly to one fact of ours, need
+   several facts, or need data we already hold?" Follow-up if not direct: "What do we
+   look up, and what happens when the record arrives before that data exists?"
+3. **Automations.** "What happens on its own after <fact>? Can it fail, wait, or need a
+   person? What do people see meanwhile? Who is allowed to do it?" Follow-up: "What
+   makes it stop? What if it ran twice?"
+4. **Recovery.** "Which records or steps can we not accept, and who fixes them, how,
+   and how does processing resume?"
+
+Skip questions already answered by the brief or model. Missing correlation is the
+most common cause of failed integrations: surface it first. Unattended work records
+assumptions as labeled open decisions in `.ai-work/screenplay/<model-slug>/STATE.md`
+and marks dependent slices open, never inventing mappings or actors.

package/package/corpus/skills/cratis-screenplay-automations-and-translations/references/public-events-and-direction.md

@@ -1,7 +1,7 @@
 <!-- Copyright (c) Cratis. All rights reserved. -->
 <!-- Licensed under the MIT license. See LICENSE file in the project root for full license information. -->
 
-# Public events and translation direction (released ESM v9)
+# Public events and translation direction
 
 ## Contents
 
@@ -100,26 +100,92 @@ module Integration
       direction inbound
       event ShipmentDispatched from "shipping"
         orderId OrderId
-      event OrderDispatched
+        carrier String
+      event ShipmentDelivered from "shipping"
         orderId OrderId
+        status String
+      event OrderDispatched
+        carrier String
+      event OrderDeliveryRecorded
+        carrier String
+        status String
       capture ShipmentTracking
         source events
           from ShipmentDispatched
+          from ShipmentDelivered
         key orderId
         append OrderDispatched
-          orderId = $.orderId
+          when added
+            carrier = $.carrier
+        append OrderDeliveryRecorded
+          when status
+            carrier = $.carrier
+            status = $.status
+      specification RecordingTheFirstDispatch
+        when append ShipmentDispatched
+          orderId = "3fa85f64-5717-4562-b3fc-2c963f66afa6"
+          carrier = "DHL"
+        then OrderDispatched
+          for "3fa85f64-5717-4562-b3fc-2c963f66afa6"
+          carrier = "DHL"
+      specification FoldingEarlierDispatchIntoDelivery
+        given ShipmentDispatched
+          orderId = "3fa85f64-5717-4562-b3fc-2c963f66afa6"
+          carrier = "DHL"
+        when append ShipmentDelivered
+          orderId = "3fa85f64-5717-4562-b3fc-2c963f66afa6"
+          status = "delivered"
+        then OrderDeliveryRecorded
+          for "3fa85f64-5717-4562-b3fc-2c963f66afa6"
+          carrier = "DHL"
+          status = "delivered"
+      specification IgnoringAnUnchangedDispatch
+        given ShipmentDispatched
+          orderId = "3fa85f64-5717-4562-b3fc-2c963f66afa6"
+          carrier = "DHL"
+        when append ShipmentDispatched
+          orderId = "3fa85f64-5717-4562-b3fc-2c963f66afa6"
+          carrier = "DHL"
+        then no events
 ```
 
-This compiles and binds as ESM v9. Evaluating the events-source capture returns
-typed Unsupported: the event-payload-to-working-record contract is not admitted.
-Do not equate binding with a passing capture specification or invent that mapping.
-Keep correlation and resulting private events in the model and report the runtime gap.
+Requires Screenplay 4.171.0 or later (`screenplay --version`) for event-capture
+reference execution and PLAY0700/0701; older runners do not deliver these inputs
+to captures. Run `screenplay <model> --warnaserror`, then `screenplay test <model>`:
+zero diagnostics and all three capture specifications passed are the pass signals.
+
+Present the consumed public event itself: `given <Event>` / `when append <Event>`.
+Fields are typed by its local declaration. `given capture` / `when capture` is
+PLAY0701, with a repair only for exactly one `from` event (several are ambiguous).
+`for` is optional on foreign fixtures: when supplied, it is opaque nonempty text
+identifying the foreign source, not the capture key. A content key such as `orderId`
+must be required on every `from` event (PLAY0700); `$eventSourceId` and other context
+keys are refused. An empty or whitespace-only text key fails execution, even in a
+given before the action; non-text/non-numeric keys are Unsupported.
+
+Givens fold in authored order without appending. Each event overlays its top-level
+properties onto state for that typed key: absent properties retain earlier values;
+objects/lists replace whole values. First sight is `added` only, unchanged overlays
+append nothing, and field/`and`/`or`/transition guards require a modification. An
+append without `when` holds on any change, not on every delivery. Maps apply to
+before and after states; `$.field` reads the mapped merged state. An expression
+guard evaluates the after state only on a change. Root `when removed` never holds.
+
+Captures run after reactions to the same input settle; each capture append settles
+its own cascade before the next. Mixed capture/reaction assertions may need
+`then events in any order`: reference order does not prove independent observer
+order. Only `$context.occurred` (from `given clock`) is admitted; other context
+members fail binding. `children`/`nested` over events remain Unsupported, as do
+composite/list values used as scalars or watched by guards. Reference state never
+persists between specifications and does not prove redelivery deduplication,
+source acknowledgement, retry safety or context propagation. A passing reference
+scenario is not renderer admission; Stage must refuse forms Chronicle cannot realize.
 
 ## Admission and evidence
 
-ESM v9 shipped and is selected only by use of public events,
-origins, direction, event-target builders or events-source captures. At 4.135.0,
-publication reference scenarios execute; imported shapes still refuse binding.
+ESM v9 is selected by use of public events, origins, direction, event-target
+builders or events-source captures. Publication and admitted event-capture
+reference scenarios execute; imported shapes still refuse binding.
 Stage 4.52.0 (previous CLI 3.46.1, history) audited only through v7. The CLI/Stage pair (toolchain `references/renderable-subset.md`)
 reaches construct admission through its bundled ceiling but still refuses publication (STAGE-ESM-032), foreign
 events/events-source captures (STAGE-ESM-033); source admission is not rendering.