@cratis/pi 7.62.0 → 7.64.0

package/package/corpus/skills/cratis-screenplay-command-surface/references/protected-reads.md

@@ -0,0 +1,113 @@
+<!-- Copyright (c) Cratis. All rights reserved. -->
+<!-- Licensed under the MIT license. See LICENSE file in the project root for full license information. -->
+
+# Protected command reads
+
+## Contents
+
+- Admission and paths
+- Absence and races
+- Repair and target boundary
+
+Requires Screenplay 4.193.0 or later (`screenplay --version`); older compilers refuse command reads with PLAY0271 and read paths with PLAY0268.
+
+Declare `command reads protected` once in the application-root document. Imported
+commands inherit it. This selects ESM v25, including when text rules are used, and
+records `commandReadMode: "protected"`. Without it, legacy reads retain PLAY0271,
+read paths retain PLAY0268, and bytes/version stay unchanged. A higher ESM version
+alone never opts an application in.
+
+Complete model:
+
+```screenplay
+domain Inventory
+command reads protected
+module Stock
+  feature Allocation
+    slice StateView CurrentStock
+      event StockCounted
+        quantity Int
+      event StockRemoved
+      readmodel Current
+        id String key
+        quantity Int
+      projection CurrentProjection => Current
+        from StockCounted
+        remove with StockRemoved
+    slice StateChange Allocate
+      command Allocate
+        id String identifier
+        stockId String
+        reads Current by stockId
+        validate
+          require Current.quantity > 0
+            message "Stock must be available"
+        produces Allocated
+          for id
+          quantity = Current.quantity
+      event Allocated
+        quantity Int
+```
+
+## Admission and paths
+
+`reads <View> [as <alias>] [by <input>]` looks up required state. Omitted `by` uses
+the declared command identifier; no identifier is PLAY0782. Repeated reads of a
+view each need a distinct alias; paths use the alias rather than the view name.
+Aliases start with a lowercase letter or underscore.
+
+Every read must satisfy both boundaries:
+
+- A finite non-empty set of event-log event types builds the view, including removal
+  handling; the key is event-source identity only.
+- The lookup key is a required scalar non-generated command input: String, a String
+  concept or canonical GUID.
+
+PLAY0781 refuses reducers, joins (including removal joins), children/nested scopes,
+`every`/`all`, payload/composite keys, missing removals, empty handled-event sets,
+named sources/streams, singleton views and unsupported/generated/optional/collection
+keys. Its closed reasons are Reducer, Join, Children, OpenSubscription, PayloadKey,
+ByParts, NoRemoval, EmptyHandledSet, NamedSourceOrStream, Singleton, KeyType,
+GeneratedKey, OptionalKey and CollectionKey. `optional`, `advisory` and `via query`
+remain refused; `via query` uses parser code PLAY0175. There is no unguarded fallback.
+
+Single-level `read.property` paths bind in `require` operands and produced-event
+mapping sources only. Deeper paths and read paths in `produces when`, response
+fields, `for`, routes and derive/provide remain PLAY0268. Unknown read/property
+paths report PLAY0784; ambiguous view paths report PLAY0785. A command with both
+`reads` and `concurrency` reports PLAY0783: do not guess which boundary wins.
+
+## Absence and races
+
+Execution orders authorization → property rules → required reads → derive/provide
+→ requirements → productions/responses. Missing state rejects with Validation and
+message `<ReadModel> '<key>' does not exist.` before evaluating requirements or
+mappings. Property-rule rejection therefore wins over absence.
+
+Decide records the unfiltered fact-log boundary, read key and handled event types.
+A matching fact after that boundary makes commit return Conflict /
+DecisionStateChanged with no command facts, including publications. Irrelevant
+facts do not conflict and remain in the committed world. Even a no-fact command is
+checked. Race cases are evaluator vectors, not a new `.play` specification construct.
+
+Specify present/absent state, rule refusal and denial. Assert no new facts and
+unchanged views on failure; use target concurrency tests to prove actual storage
+protection. Ordinary injected read models are not protected decisions; uniqueness
+still belongs in a `unique` append constraint.
+
+## Repair and target boundary
+
+PLAY0780 rejects duplicate, conflicting or non-root preambles. Informational
+PLAY0786 identifies an eligible legacy model at its first command read. Discover
+`read-workspace view=repairs`, then `propose-repair` with current workspace/catalog
+revisions and canonical formatting consent; review with `read-proposal` before
+explicit `apply`. The repair inserts into the domain document or sole document,
+refuses ambiguous roots and requires individual review, never fix-all. It changes
+absence/conflict behavior, not merely formatting.
+
+Stage admits ESM v25 but refuses protected reads with STAGE-ESM-044 in rendering,
+Host serving and specification execution; a reference pass is not Stage or Arc
+realization. Preserve the model's protection and deliver authorized hand-written
+consistency enforcement through the render-and-gap-fill workflow. Never remove
+the preamble to get a render. `screenplay <root> --warnaserror` must exit zero;
+`screenplay test <root>` separately establishes reference behavior, not target support.

package/package/corpus/skills/cratis-screenplay-command-surface/references/shop-generation.md

@@ -1,22 +1,30 @@
 <!-- Copyright (c) Cratis. All rights reserved. -->
 <!-- Licensed under the MIT license. See LICENSE file in the project root for full license information. -->
 
-# The shop in Screenplay: keep the release boundary
+# The shop in Screenplay: generated values
+
+## Contents
+
+- Choosing a strategy
+- When not to generate
+- Sources
 
 ## Choosing a strategy
 
 Use the same vocabulary as the [Fundamentals/Arc shop](../../cratis-fundamentals-concept/references/shop-generation.md),
 but only the released language realization: CustomerId is `cus_` + uppercase
-ULID, OrderId is `typeid "order"`, and InviteCode is NanoID. Their strategies
+ULID, OrderId is `typeid "order"`, and InviteCode is NanoID. InvoiceNumber uses
+a readable date/checksum pattern; TicketNumber is an Int pickup-ticket value. Their strategies
 belong to concepts; command properties only say `generated`/`generated identifier`.
 The existing [strategy reference](generated-values-and-responses.md) owns exact
 encodings, entropy, MCP edits, fixtures and freshness.
 
-**Context-dependent generation is not released in Screenplay.** The OrderId below
-is time-ordered TypeID, not Arc's received-time/tenant factory contract; Stage
-emits a wall-clock `New()`. Passed-through GenerationContext in Arc source
-recovery describes that strategy shape, not equivalent clock/tenant semantics.
-Context-member/rule recovery stays in code.
+Requires Screenplay 4.172.0 or later (`screenplay --version`) for pattern/random/rule
+and checksum validation (ESM v21); older compilers refuse them with PLAY0268.
+`generate rule Name` can attach code with Now/Tenant context, but the reference
+runner never executes it: pin the whole String result. TypeID itself has no
+tenant slot. Context-member factory recovery still stays in code. Stage's
+time-ordered factories use the command receipt, not an invented wall-clock value.
 
 The shop's ApiKey remains a **secret**. In .NET its factory is `Bytes(32)` and its
 concept is `[NotAudited]`. It is never an identifier (event-source IDs are plaintext
@@ -35,6 +43,11 @@ concept OrderId : String
 concept InviteCode : String
   generate nanoid
 concept ApiKey : String secret
+concept InvoiceNumber : String
+  generate pattern "INV-{yyyy}{MM}-#{7}" checksum luhn
+  validate checksum luhn
+concept TicketNumber : Int
+  generate random 100000..999999
 module Shop
   feature Customers
     slice StateChange Register
@@ -58,22 +71,39 @@ module Shop
           inviteCode = "abcdefghijklmnopqrstu"
   feature Orders
     slice StateChange Place
+      constraint UniqueInvoiceNumber
+        unique invoiceNumber on OrderPlaced
+      constraint UniquePickupTicket
+        unique pickupTicket on OrderPlaced
       command PlaceOrder
         orderId OrderId generated identifier
+        invoiceNumber InvoiceNumber generated
+        pickupTicket TicketNumber generated
         produces event OrderPlaced
+          invoiceNumber InvoiceNumber = invoiceNumber
+          pickupTicket TicketNumber = pickupTicket
         returns orderId
       specification PlacesWithPinnedValue
+        given clock "2026-10-02T09:00:00Z"
         when PlaceOrder
           for "order_0000000000e008000000000000"
+          generated invoiceNumber = "INV-202610-00000004"
+          generated pickupTicket = 123456
         then OrderPlaced
           for "order_0000000000e008000000000000"
+          invoiceNumber = "INV-202610-00000004"
+          pickupTicket = 123456
         then returns "order_0000000000e008000000000000"
 ```
 
 Each property is server-owned, not a client-minted input. The ApiKey declaration
 is not permission to replace its secret contract with an ordinary random String.
-No `given clock` is used: pin the whole value. A seed/clock does not draw a
-portable ULID or TypeID fixture. A v15 duplicate-source specification should
+The invoice date segments use the pinned UTC clock; it does not draw a portable
+ULID or TypeID fixture. Checksum validation is authored separately from generation.
+Dates/check digits add no entropy. The short invoice and ticket values use
+single-property unique constraints; neither is a generated identifier. Whole-source
+freshness protects the OrderId destination, not every generated payload value.
+A duplicate-source specification should
 expect Concurrency with no new facts or response, not a regenerated ID.
 
 ## When not to generate
@@ -83,10 +113,13 @@ idempotency keys, authorization, gapless invoice numbers or proof of projection
 readiness. A reference InviteCode is not automatically a credential; if possession
 confers access, protect it as a secret and do not claim this generated String
 example realizes that credential behavior. Never drop ApiKey's secret marker to
-make its generation bind/render. Pattern/random/rule execution, context rules,
-sequence allocation and secret generation stay explicit upstream gaps.
+make its generation bind/render. A pattern is not gapless/sequential numbering;
+check digits catch typos, not forgery. ESM v21 binds and reference-executes with
+pins. Requires Stage 4.118.0 for checksum validation and 4.119.0 for pattern/random
+rendering; older renderers refuse those constructs. `generate rule` still refuses
+STAGE-ESM-028. Sequence allocation and secret generation stay explicit gaps.
 
-## Tagged evidence
+## Sources
 
 Screenplay `Documentation/screenplay/generated-values/choosing.md`,
 `Documentation/screenplay/generated-values.md`,

package/package/corpus/skills/cratis-screenplay-command-surface/references/text-and-match-rules.md

@@ -0,0 +1,119 @@
+<!-- Copyright (c) Cratis. All rights reserved. -->
+<!-- Licensed under the MIT license. See LICENSE file in the project root for full license information. -->
+
+# Literal text rules and portable matching
+
+## Contents
+
+- Literal text rules
+- Portable `matches`
+- Studio replacements and public check APIs
+
+## Literal text rules
+
+Requires Screenplay 4.184.0 or later (`screenplay --version`) for literal text rules and pattern admission checks; older compilers do not admit these rule forms.
+
+Prefer a literal rule over a regex when the requirement is plain text. Complete example:
+
+```screenplay
+concept InvoiceReference : String
+  validate
+    contains "-"
+    not contains " "
+    starts with "INV-"
+    ends with "-NOK"
+```
+
+These concept/command-property rules select ESM v24. They compare UTF-16 code units
+ordinally, without case folding or normalization. Use one non-enum text value and a
+quoted literal operand, not a property, collection or regex. An absent optional
+value passes; add `not empty` to require presence. An empty operand makes `contains`,
+`starts with` and `ends with` pass, and `not contains` fail for present text.
+Equality and inequality remain `== "x"` and `!= "x"`.
+
+This is not condition grammar: `contains`/`starts with` in `require`, `produces when`
+or reaction `where` remain PLAY0268. Those conditions admit scalar equality and
+numeric ordering, not the property text rules.
+
+Requires Stage 4.124.0 for v24 text-rule admission (`cratis --version` identifies the CLI bundle); older renderers refuse v24 with STAGE-ESM-016.
+
+Stage admits v24 and executes these four rules on its Host and specification
+executor, rendering ordinal UTF-16 comparisons without regex or a Screenplay
+runtime dependency. The legacy EventModel syntax engine drops these rules; use
+semantic admission, never infer support from that engine's output.
+
+## Portable `matches`
+
+Requires Screenplay 4.183.0 or later (`screenplay --version`); older compilers use platform matching and may accept nonportable constructs.
+
+A quoted pattern is a flagless JavaScript expression restricted to a portable linear
+dialect, not arbitrary ECMAScript or .NET regex. It searches any substring unless
+anchored. Screenplay uses its own Thompson automaton, without timeout or host-engine
+settings. Syntax remains `matches "^INV-[0-9]{6}$"` or `matches email`.
+
+| Admitted | Meaning |
+| --- | --- |
+| Literals, `.`, `^`, `$`, alternation | `$` is strict end of input, not before a final newline |
+| `(…)`, `(?:…)`, `(?<name>…)` | ASCII names `[A-Za-z_][A-Za-z0-9_]*`; duplicate names only in disjoint alternatives; names that can match together report PLAY0367 |
+| Classes, negation, single-character ranges | Unions/complements use set semantics |
+| `\d \D \w \W \s \S` | `\d` is ASCII digits, `\w` ASCII letters/digits/underscore |
+| `\t \n \r \f \v`, `\0` not before a digit, `\xHH`, `\uHHHH` | UTF-16 code-unit escapes |
+| Escaped syntax characters and `\/` | `\-` also inside a class |
+| `* + ? {n} {n,} {n,m}` and lazy forms | No stacked quantifiers |
+
+`\s` includes U+00A0, U+FEFF and Unicode line/paragraph separators; it excludes
+U+0085. Dot excludes LF, CR, U+2028 and U+2029. `\w` excludes U+0130.
+`matches email` is conservative, not RFC 5322: one `@`, nonempty local part without
+whitespace/`@`, and at least two nonempty domain parts without whitespace/`@`.
+A no-break space therefore fails email validation. Other bare names report PLAY0366.
+
+PLAY0367 means invalid syntax, including stacked quantifiers. PLAY0699 means a
+construct outside the dialect: lookarounds, backreferences, word boundaries,
+Unicode properties, code-point escapes, control/octal/identity escapes, .NET-only
+anchors/options/class subtraction, empty classes, stray brackets, class escapes as
+range endpoints, or non-ASCII group names. Use explicit classes, UTF-16/hex escapes,
+`^`/`$`, or a literal text rule where equivalent. A length-only lookahead can become
+an anchored counted repeat; there is no general lookaround replacement.
+
+Limits are 1,000 decoded UTF-16 code units and 3,000 expanded nodes. Literals,
+classes, anchors and each optional/loop/alternative choice point count one. Counted
+repeats multiply their body by the upper bound (unbounded: lower bound plus one),
+adding optional/loop choices. `x{1500}` counts 1,500; `a{0,1500}` and `(a*){1500}`
+count 3,000. Exceeding either limit reports PLAY0699 before automaton construction.
+
+Older serialized ESM retains authored pattern bytes and loads, but invalid/refused
+patterns plan as UnsupportedValidation and generation checks report Unproven;
+re-authoring reports PLAY0367/PLAY0699.
+Browser matching remains advisory: JavaScript may backtrack even on admitted
+`(a+)+$`. The server-side linear check is authoritative.
+
+## Studio replacements and public check APIs
+
+Only exact escaped-literal Studio shapes desugar with warning PLAY0787, not PLAY0699:
+
+| Decoded pattern (`L` is an escaped literal) | Replacement |
+| --- | --- |
+| `^(?![\s\S]*L)` | `not contains "literal"` |
+| `L(?![\s\S])` | `ends with "literal"` |
+| `^L(?![\s\S])` | `== "literal"` |
+| `^(?!L$)` or `^(?!L(?![\s\S]))` | `!= "literal"` |
+
+Recognition requires a lossless escape/decode round trip: Studio v1 uses
+.NET Regex.Escape; v2 escapes `\ ^ $ . | ? * + ( ) [ ] { } /`. Other lookarounds
+remain refused. Plain `L`, `^L`, `^L$` and `L$` are unchanged. Syntax retains the
+original text, while binding stores the ordinal rule. Old ESM evaluates these exact
+patterns as replacements without changing bytes. The editor quick fix and MCP
+`propose-repair` migrate to literal rules preserving message/severity; preview the
+revision-bound canonical-formatting proposal before explicit apply.
+
+C#: `Cratis.Screenplay.Semantics.PortableMatchPattern.Check(pattern)`.
+TypeScript: import `checkPortableMatchPattern` from `@cratis/screenplay-compiler`.
+Both return PortableMatchCheck: status, code, construct, UTF-16 offset in the decoded
+pattern, suggestion, description and optional replacement `{ kind, value }`.
+Statuses are Admitted, Deprecated, Refused, Invalid (lowercase strings in TypeScript).
+Admitted has no code; Deprecated is PLAY0787, Refused PLAY0699, Invalid PLAY0367.
+Replacement kinds are Equal, NotEqual, Contains, NotContains, StartsWith, EndsWith.
+Checking never executes a pattern or constructs a platform regex.
+
+Validate with `screenplay <root> --warnaserror`, then execute acceptance/refusal
+examples through `screenplay test <root>`; source validation alone is not a rule test.

package/package/corpus/skills/cratis-screenplay-command-surface/references/validate-rules.md

@@ -10,9 +10,28 @@
 | `== <v>` / `!= <v>` | `currency == "NOK"`, `status != draft` |
 | `length == <n>` | `currency length == 3` |
 | `matches email` | the only named pattern; any other name is `PLAY0366` |
-| `matches "<regex>"` | ECMAScript; matches **any substring** unless anchored with `^…$`; an invalid pattern is `PLAY0367` |
+| `matches "<regex>"` | Portable linear dialect; any substring unless anchored `^…$`; invalid syntax PLAY0367, refused constructs PLAY0699 |
+| `contains "<text>"` / `not contains "<text>"` | Ordinal substring presence/absence on scalar non-enum text |
+| `starts with "<text>"` / `ends with "<text>"` | Ordinal prefix/suffix; quoted literal operands, not conditions |
 | `all > <v>` / `all >= <v>` | `lines.quantity all > 0` |
 | `rule <Name>` | `orgNumber rule BeAValidOrganizationNumber` |
+| `checksum luhn|mod11|mod97` | String concept `validate checksum luhn`; validates supplied/stored values too |
+
+Requires Screenplay 4.172.0 or later (`screenplay --version`) for checksum rules
+(ESM v21); older compilers refuse them with PLAY0268. A pattern's `checksum`
+modifier generates check digits but does not add validation. Check digits catch
+typos, not forgery. For generated-concept proof statuses, deterministic regex
+limits and PLAY0688 repairs, read [generated rules](generated-values-and-responses.md#generated-concept-rules-esm-v20).
+
+## Date and DateTime comparisons
+
+Requires Screenplay 4.199.0 (ESM v26; `screenplay --version`); older binders refuse
+with PLAY0268. Command/property rules admit `==`, `!=`, `>`, `>=`, `<`, `<=` against
+a same-primitive date literal only, for example `to >= "2026-01-01T00:00:00Z"` on
+DateTime. Property-to-property comparisons instead use `require to >= from`.
+Date rules on concepts remain refused; an absent optional value passes rules
+except `not empty`. Read [date comparisons](date-comparisons.md) for UTC ticks,
+input offsets, refused positions and the complete retention-window specifications.
 
 ## `not empty` means non-blank text
 
@@ -60,10 +79,11 @@ validate
 
 A bodied rule or fenced block on a validation, rule or policy binds as opaque code
 (ESM v3): the reference runner reports it unsupported, and a target must supply the
-implementation. Two exceptions never bind: the command `handler`, and a `file`
-constraint (the binder records the requirement, then rejects it with `PLAY0268`;
-only `unique` constraints bind).
+implementation. Attached command handlers and `file` constraints remain PLAY0268
+(only `unique` constraints bind). Pending command handlers beside unconditional
+`produces` instead bind as described commands; see [described handlers](described-handlers.md).
+Literal text rules, portable patterns and Studio desugaring: [text and match rules](text-and-match-rules.md).
 Stage renders pure reducer transitions and opaque policy bodies, but refuses command and
 concept code validations and rule predicates (STAGE-ESM-005): those are gap-fill code. Prefer a
-declarative rule when one can say it. What binds and what the executable model rejects (Date and
-DateTime comparisons, nested-path rules): `cratis-screenplay-toolchain` `references/executable-subset.md`.
+declarative rule when one can say it. What binds and what the executable model rejects
+(date comparisons outside command positions, nested-path rules): `cratis-screenplay-toolchain` `references/executable-subset.md`.

package/package/corpus/skills/cratis-screenplay-command-surface/verification.json

@@ -4,6 +4,14 @@
   "fixtures": [],
   "assertions": [
     { "kind": "play-compiles" },
+    { "kind": "skill-contains", "value": "require to >= from", "file": "references/date-comparisons.md" },
+    { "kind": "skill-contains", "value": "RejectingAMissingOffset", "file": "references/date-comparisons.md" },
+    { "kind": "skill-contains", "value": "STAGE-ESM-016", "file": "references/date-comparisons.md" },
+    { "kind": "skill-contains", "value": "Unsupported (`ImplementationBody`)", "file": "references/described-handlers.md" },
+    { "kind": "skill-contains", "value": "including Stub mode", "file": "references/described-handlers.md" },
+    { "kind": "skill-contains", "value": "DecisionStateChanged", "file": "references/protected-reads.md" },
+    { "kind": "skill-contains", "value": "checkPortableMatchPattern", "file": "references/text-and-match-rules.md" },
+    { "kind": "skill-contains", "value": "U+00A0", "file": "references/text-and-match-rules.md" },
     { "kind": "skill-contains", "value": "screenplay_declaration_details", "file": "references/generated-values-and-responses.md" },
     { "kind": "skill-contains", "value": "do not hand-edit the text", "file": "references/generated-values-and-responses.md" },
     { "kind": "skill-contains", "value": "A CLI-bundled MCP can lack this summary", "file": "references/generated-values-and-responses.md" },
@@ -42,7 +50,7 @@
     },
     {
       "kind": "skill-contains",
-      "value": "`produces` and `handler` are mutually exclusive"
+      "value": "A file/code `handler` cannot coexist with `produces`"
     },
     {
       "kind": "skill-contains",
@@ -54,11 +62,11 @@
     },
     {
       "kind": "skill-contains",
-      "value": "`reads` is not a protected read"
+      "value": "command reads protected"
     },
     {
       "kind": "skill-contains",
-      "value": "Adding a\n`concurrency` block does not fix this"
+      "value": "reads/concurrency cannot combine (PLAY0783)"
     },
     {
       "kind": "skill-contains",
@@ -93,6 +101,8 @@
       "value": "Generated identifiers need Uuid or String backing and at least 64 random bits.", "file": "references/generated-values-and-responses.md"
     },
     { "kind": "skill-contains", "value": "Generated values and responses (ESM v7 and v15)" },
+    { "kind": "skill-contains", "value": "names that can match together report PLAY0367", "file": "references/text-and-match-rules.md" },
+    { "kind": "skill-contains", "value": "or reaction `where` remain PLAY0268", "file": "references/text-and-match-rules.md" },
     { "kind": "skill-contains", "value": "Generated values are not request inputs", "file": "references/generated-values-and-responses.md" },
     { "kind": "skill-contains", "value": "Generated-concept validation rules select ESM v20", "file": "references/generated-values-and-responses.md" },
     { "kind": "skill-contains", "value": "PLAY0688 and a violating example", "file": "references/generated-values-and-responses.md" },

package/package/corpus/skills/cratis-screenplay-event-modeling/SKILL.md

@@ -108,7 +108,7 @@ The independent verdicts V1 to V5 that report them are in
 `cratis-screenplay-modeling-lifecycle`.
 
 What binds depends on **which tool** you ask, so name the tool and its version:
-Read [references/parsed-not-runnable.md](references/parsed-not-runnable.md) (section "What binds depends on which tool") when stating what a tool binds or renders (`reads`/`concurrency` fail with `PLAY0271`; `persona` declarations are report-only; an older bundle reports *Slice '<name>' of type '<type>' is not admitted by ESM v1.*).
+Read [references/parsed-not-runnable.md](references/parsed-not-runnable.md) (section "What binds depends on which tool") when stating what a tool binds or renders (legacy reads and `concurrency` fail with `PLAY0271`; protected command reads opt into v25; `persona` declarations are report-only; an older bundle reports *Slice '<name>' of type '<type>' is not admitted by ESM v1.*).
 
 The ESM versions, the full disposition table and the Step 7 clock example's binding
 result are in [references/parsed-not-runnable.md](references/parsed-not-runnable.md)
@@ -169,19 +169,19 @@ compile or will not be safe. Both are deliberate.
 
 - **A command may read state.** The generic method forbids `ReadModel -> Command`
   edges. Screenplay ships `reads <ReadModel> [as <alias>] [by <property>]` so the
-  model shows what a state-dependent decision consulted. **It is not a protected
-  (open limitation):** nothing checks at append time that the state is still current,
-  the executable model rejects `reads` and `concurrency` (`PLAY0271`), and adding
-  `concurrency` does not make the decision safe .
-  Write a state-dependent rule as `reads <View>` plus `require <expr> message "..."`
-  and mark it in the slice `description` as **not enforced in the model today**,
-  naming the target that must enforce it (Arc `[ProtectedDecision]` with
-  `DecisionRead<T>`, Chronicle's dynamic consistency boundary, or a constraint where
-  one fits). Model uniqueness as a `unique` constraint. Never copy state into a
+  model shows what a state-dependent decision consulted. Application-root
+  `command reads protected` admits eligible command reads as v25: absent state
+  rejects and matching decide/commit changes conflict. Read
+  [protected reads](../cratis-screenplay-command-surface/references/protected-reads.md)
+  for the strict shape and paths. Legacy reads remain PLAY0271; `concurrency` is
+  not protection and cannot combine with protected reads. Stage refuses protected reads
+  (STAGE-ESM-044), not v25 itself: name target enforcement separately rather than claiming a render.
+  Write state-dependent rules as `reads` plus `require` with an indented message;
+  mark refused shapes as unenforced and name the intended target mechanism. Model uniqueness as a `unique` constraint. Never copy state into a
   command input, add an attestation flag, or hide the rule in `handler` prose. Do not
   use `reads` to fetch data the command could carry as input. A reaction trigger
-  declares the views an automation decides from with the same `reads`, and the same
-  caveat applies.
+  declares consulted views with `reads`, but trigger reads remain unprotected;
+  decide in an invoked command instead.
 - **Some validation *does* belong in the model.** The generic method routes format
   rules to the type system. Screenplay's type system *is* the `concept`, and a
   concept carries its own `validate` block - so a format rule lives on the concept

package/package/corpus/skills/cratis-screenplay-event-modeling/references/parsed-not-runnable.md

@@ -34,7 +34,7 @@ Tool versions and consumer boundaries: toolchain `SKILL.md`.
 | Compliance concepts | Bare `pii`/`personal` and `secret`, qualifiers and scope bind as v13; enum/identity compliance and events combining personal or explicitly subject-scoped secret values with an explicit `subject` mark refuse PLAY0268 at binding only. A CLI bundle that admits v13 binds markers; Stage renders v13 protection, not protected identities/enums or subject lineage. Never remove protection |
 | Identity details / processing purposes / event subject | Report-only metadata; executable detail reads refuse PLAY0268, not source declaration errors |
 | Composite stream ids | v8 routing; complete named parts/canonical comparisons, PLAY0515 refuses protected keys/sources; not a legacy text split |
-| Command reads/concurrency | Legacy unprotected decisions, PLAY0271 |
+| Command reads/concurrency | Eligible reads opt into v25 with `command reads protected`; legacy reads/concurrency retain PLAY0271; Stage refuses protected reads (STAGE-ESM-044), not the v25 pair |
 | Invokes-only trigger reads | Report-only, not protected state; direct production with reads refuses |
 | Generated values/responses | v7 binding/reference execution; v15 strategies/strict fixtures/freshness. Stage renders supported UUID/String strategies, responses and fixtures; unsupported types/combinations remain -028/-038 |
 | Sources/streams and command/specification routes | v8 binding/reference execution; the CLI (toolchain `references/renderable-subset.md`) reaches Stage checks through its bundled ceiling (v16 without v17 support) |
@@ -70,8 +70,10 @@ accepted proposal or parsed node with a running application.
 - `Automation` and `Translate` slices, reactions, captures and triggers bind (ESM v6) on the
   standalone tool and a CLI bundle that admits v6. (An older bundle
   reports *Slice '<name>' of type '<type>' is not admitted by ESM v1.*) Stage renders supported event-triggered Automation, not Translate/captures or non-event triggers.
-- `reads` and `concurrency` on a command do not bind (`PLAY0271`), so no decision is
-  protected against stale state. A reaction trigger's `reads` that only `invokes` is
+- Eligible command reads bind/reference-execute with `command reads protected`
+  (v25); legacy reads and `concurrency` remain PLAY0271. Read command-surface
+  [protected reads](../../cratis-screenplay-command-surface/references/protected-reads.md)
+  for admission, absence/conflicts and Stage refusal. A reaction trigger's `reads` that only `invokes` is
   report-only intent (`PLAY0270`); one that `produces` directly fails binding (`PLAY0268`).
 - `persona` declarations are report-only and never block; bare `pii` and `secret`
   concepts bind as ESM v13 (Requires Screenplay 4.141.0 or later); Stage renders admitted v13 protection.

package/package/corpus/skills/cratis-screenplay-event-modeling/verification.json

@@ -45,7 +45,11 @@
     },
     {
       "kind": "skill-contains",
-      "value": "It is not a protected"
+      "value": "command reads protected"
+    },
+    {
+      "kind": "skill-contains",
+      "value": "Legacy reads remain PLAY0271"
     },
     {
       "kind": "skill-contains",

package/package/corpus/skills/cratis-screenplay-legacy-extraction/SKILL.md

@@ -137,8 +137,8 @@ chain per slice before handoff (`references/evidence-table-template.md`, "Tracea
    - one StateChange per decision a person or system makes; events are facts experts recognise;
      consequences (counters, denormalised copies) become projections; an automation only when
      evidence shows a separate decision; no generic names (`Update/Edit/Save<Noun>`, `<Noun>Updated`): split by intent;
-   - refusals, state-dependent rules (`reads` + `require`, marked **NOT enforced in the model
-     today** with the target named), unique indexes and preserved `pii` / `secret` protection:
+   - refusals, state-dependent rules (`reads` + `require` with eligible protected-read
+     opt-in; legacy/refused shapes marked unenforced and target realization named), unique indexes and preserved `pii` / `secret` protection:
      `references/rule-modeling.md`. Every role gate has `authorize` plus a `then denied` spec,
      else a recorded gap; rules you cannot express truthfully are recorded one by one, never
      fabricated.

package/package/corpus/skills/cratis-screenplay-legacy-extraction/references/evidence-table-template.md

@@ -57,7 +57,7 @@ Example rows:
 | id | source | locator | observed fact | technical shape | strength | classification | gen. disposition | candidate | decision | decided by | verdict |
 |---|---|---|---|---|---|---|---|---|---|---|---|
 | E1 | dynamic | capture 0007, `POST /api/checkins` | taking in a coat writes two tables | insert `Checkins`; update `Hooks(occupied)`; 201 x41, 409 x3 | Observed | intent (take in) + consequence (hook) | n/a | `TakeInCoat` -> `CoatTakenIn`; occupancy via projection | change | proposed | not asked |
-| E2 | code | `CheckinService.cs` | 409 when the hook is already free, message "That coat is not on a hook" | throws `ConflictException` | Read | intent (rule) | n/a | `reads CoatStatus` + `require`, NOT enforced today (target: protected decision or Chronicle `concurrency` scope); no executable error spec, recorded in LOSS.md | keep | proposed | not asked |
+| E2 | code | `CheckinService.cs` | 409 when the hook is already free, message "That coat is not on a hook" | throws `ConflictException` | Read | intent (rule) | n/a | legacy control: `reads CoatStatus` + `require` without protected opt-in; inspect v25 admission, record refused shape/Stage target gap in LOSS.md | keep | proposed | not asked |
 | E3 | static | `static.play`, SP0016 at `CheckinValidator` | validation rule held to a condition is emitted unconditionally; the condition is lost | `When(x => x.IsVip)` | Exact (loss) | unknown | Lowered without its condition (semantic mismatch, reported by SP0016) | none yet | undecided | - | question Q4: when does the rule really apply? read `CheckinValidator` and ask an expert |
 | E4 | dynamic | uncorrelated txn, `Hooks` nightly 02:00 | hook flags reset without a command | update `Hooks(*)` daily | Observed | unexplained | n/a | none | undecided | - | question Q5 |