@cratis/pi 7.62.0 → 7.64.0

package/package/corpus/skills/cratis-screenplay-legacy-extraction/references/generated-recovery.md

@@ -24,6 +24,20 @@ Each recovery below has its own gate; use the adapter that has the one you rely
 
 - Requires Arc.Screenplay 22.78.0 or later for `[GeneratedValue]` Handle parameters whose `New()` is a UUID v4 form, for the `generated identifier` and response they produce, and for scenario pins (`for` / `generated`). Before it none of this is recovered. From 22.78.0 until 22.86.0 any other strategy keeps its source form and reports SP0073.
 - Requires Arc.Screenplay 22.86.0 or later to recover UUIDv7, ULID, TypeID, NanoID, `Bytes` and hex strategies as concept `generate` lines (ESM v15) and a passed-through `GenerationContext`.
+- Requires Arc.Screenplay 22.101.0 for generated-concept validator recovery (ESM
+  v20); check `dotnet list package --include-transitive`. Older adapters withhold
+  generation on rule-bearing concepts. Recovery covers only a fully recovered,
+  non-opaque default validator: Proven rules emit, Unproven rules remain with
+  SP0078, Refuted rules withhold generation with SP0073 and a counterexample.
+  Generation is also withheld with SP0073 (rules kept) when the validator is
+  unreadable, conditional or names a predicate (`rule <Name>`), when a UUID
+  concept has any validator, when the concept carries `pii` or `secret`, and
+  below a v20 cap.
+- Requires Arc.Screenplay 22.107.0 for pattern/random, checksum validation and
+  self-contained String generation-rule recovery (ESM v21); older adapters leave
+  those factories in code with SP0073. A v20-or-lower cap withholds generation
+  and dependent values/mappings/responses/destinations/scenarios, preserving
+  checksum validation as a source attachment rather than dropping it.
 
 Tagged evidence:
 
@@ -38,24 +52,30 @@ Tagged evidence:
 Use the [same shop vocabulary](../../cratis-screenplay-command-surface/references/shop-generation.md):
 CustomerId (`cus_` + ULID), OrderId (TypeID), InviteCode (NanoID), ApiKey (secret
 Bytes(32) with .NET `[NotAudited]`). Do not claim exact recovery of every factory:
-the custom `cus_` interpolation is not a recognized single factory call;
-TypeID can recover a passed-through context's strategy, not equivalent receipt-time/
-tenant behavior. Context-member bodies and generated secrets remain unreleased
-Screenplay scope. Preserve ApiKey's protection and source code, not an unprotected
+a custom `cus_` interpolation may recover as a self-contained String rule, not as
+an inferred built-in prefix strategy. TypeID recovers a passed-through context's
+strategy, not proof of equivalent receipt-time/tenant behavior. Context-member
+String bodies can recover under the v21 gate; generated secrets stay in code.
+Recovered rule fixtures supply a String result without reference execution of the body. Preserve ApiKey's protection and source code, not an unprotected
 replacement String. The intentional candidate can author the released customer
 prefix strategy with an explicit target decision, separate from as-is proof.
 
 Recover the strategy the source proves; do not choose a replacement because a
 factory is named `New()`. Use the existing [strategy reference](../../cratis-screenplay-command-surface/references/generated-values-and-responses.md)
-for meaning and shapes, then the forms below for parameter factories, literal pins
+for meaning and shapes (including readable InvoiceNumber patterns and random Int
+TicketNumber values), then the forms below for parameter factories, literal pins
 and retained source pointers.
 
 ## When not to
 
 Do not infer generation for client-supplied IDs, deduplication keys or gapless
 invoice numbers, or turn an observed secret into a random String. Preserve
-protection and unrecovered code; rule/context-member bodies are not executable
-strategies. Report missing pins, withheld productions/scenarios and version caps
+protection and unrecovered code. A pattern is not a gapless/sequential allocator
+or secret; check digits detect typos, not forgery. Low-entropy payload codes need
+uniqueness separate from source freshness. Arc recovery does not imply rendering:
+Requires Stage 4.118.0 for checksum validation and 4.119.0 for pattern/random;
+older renderers refuse them. `generate rule` still refuses STAGE-ESM-028.
+Report missing pins, withheld productions/scenarios and version caps
 as losses, not successful recovery. Sources: Arc
 `Documentation/backend/csharp/generating-a-screenplay.md`;
 Screenplay `Documentation/screenplay/generated-values/choosing.md`.
@@ -65,8 +85,8 @@ Screenplay `Documentation/screenplay/generated-values/choosing.md`.
 The UUID v4 forms, pins and the identifier/response rules in this section need Arc.Screenplay 22.78.0 or later; the other strategies in the list below need 22.86.0 or later.
 
 A `[GeneratedValue]` Handle parameter becomes a generated command property only
-for a required scalar Uuid/String concept with a proven strategy and no validator,
-validation rules or compliance markers. Its explicit attribute name, otherwise
+for a required scalar Uuid/String or signed Int32/Int64 random concept with a proven strategy and no compliance
+markers. Validator rules recover under the v20 gate above, not by deleting them. Its explicit attribute name, otherwise
 parameter name, becomes the property name. A directly returned event-source
 identity (alone or beside an event) adds `generated identifier` and a response;
 a direct `EventForEventSourceId(parameter, event)` target adds the identifier
@@ -85,10 +105,26 @@ Constructors/conversions must forward the primitive unchanged. Recoverable calls
 - `RandomNumberGenerator.GetHexString(...)` → hex bytes only with an even literal
   character count; preserve its requested casing.
 
-A passed-through `GenerationContext` parameter is readable for UUIDv7/ULID/TypeID;
-reading `context.Now` or `context.Tenant` is not. Helper calls, multi-statement
-bodies, computed/invalid arguments and rule/pattern/random execution stay in code
-with SP0073. Never invent a rule body or implementation-file reference.
+Under the v21 recovery gate, literal `GenerateValue.Pattern(pattern[, checksum])`
+and its passed-through context overload recover `generate pattern`; dated patterns
+require that context overload. `GenerateValue.Integer(min, max)` recovers inclusive
+signed Int64 `random`; an Int32 concept needs exactly one `(int)` cast with both
+bounds inside Int32. Invalid/computed arguments, unsigned backing and extra casts
+stay in code with SP0073. Screenplay checks pattern support, proofs and entropy.
+
+An unconditional default validator's `Must(v => GenerateValue.HasValidChecksum(v,
+Checksum.Luhn))` recovers `validate checksum luhn` (also Mod11/Mod97). None,
+conditional predicates and arbitrary helper predicates are not checksum rules.
+
+A self-contained String factory can instead recover `generate rule <Concept>New`
+with an inline `csharp` body, stripping only proven forwarding constructions.
+Literal/primitive locals, `context.Now`, `context.Tenant`, string, Math, Convert,
+Guid, RandomNumberGenerator and GenerateValue are allowlisted; multi-statement
+bodies can qualify. Compound time-based calls must pass the captured context.
+Private helpers, fields, DI, aliases/static imports, ambient time, raw Default
+comparisons and external dependencies remain SP0073; no file fallback is invented.
+This is the Cratis C# binding to Fundamentals' GenerationContext, not a universal
+runtime type. Opaque entropy is unknown, so a rule cannot supply an identifier.
 The concept owns `generate`; each command property only marks generation.
 Use the shared [strategy reference](../../cratis-screenplay-command-surface/references/generated-values-and-responses.md)
 for exact encodings, ranges, entropy and admission, rather than duplicating them.
@@ -119,7 +155,8 @@ resolved adapter version, diagnostic, retained/withheld form and open question:
 
 | Diagnostic | Loss to reconcile |
 | --- | --- |
-| SP0073 | Unproven strategy/body/arguments, or non-default strategy above the ESM cap; no replacement strategy inferred. |
+| SP0073 | Unproven strategy/body/arguments, refuted generated-concept rule with witness, or generation above the ESM cap; no replacement strategy inferred. |
+| SP0078 | Generated-concept rule proof is Unproven; preserve the rule and reason, not a claim of Proven generation. |
 | SP0052 | Unadmitted generated value, dependent response or pre-generation protection stays in code; local-generation fallback is not parameter recovery. |
 | SP0012 | A required payload mapping or condition needs an unavailable value/read: withhold the whole production, never prune it into an incomplete fact. An optional blocked mapping can be omitted alone. |
 | SP0039 | Missing/unreadable pins, unrecoverable source identities or outcomes withhold the whole scenario. Name what was lost. |

package/package/corpus/skills/cratis-screenplay-legacy-extraction/references/intent-example.md

@@ -1,5 +1,10 @@
 # Intentional candidate example
 
+Legacy control: this candidate deliberately omits `command reads protected`, so its
+unenforced markers are about this source. Eligible command reads can instead opt
+into v25; inspect all reads before migration and keep target realization separate.
+Read [protected reads](../../cratis-screenplay-command-surface/references/protected-reads.md).
+
 A complete, compiling example of what extraction produces: one legacy write that touched two
 tables (`Checkins`, `Hooks`) is re-sliced into a single decision event plus a projection. The
 numbers in the slice descriptions (`E1`, `E6`, `Q3`) are evidence ids and open questions from

package/package/corpus/skills/cratis-screenplay-legacy-extraction/references/loss-report-template.md

@@ -35,7 +35,8 @@ and the question raised.
 ## Rules not enforced or not expressible today
 One line per rule, named individually (never one generic platform caveat): the rule, its
 evidence row, the invariant and consistency risk, and the target enforcement. State-dependent
-checks are written as `reads` + `require` and marked NOT enforced in the slice description;
+checks use `reads` + `require`: eligible reads opt into v25 protection, while legacy/refused
+shapes are marked unenforced and Stage realization remains a separate gap;
 date rules and opaque policies that no declaration can state stay in the slice `documentation` and here.
 
 ## Unknowns and undecided target decisions

package/package/corpus/skills/cratis-screenplay-legacy-extraction/references/rule-modeling.md

@@ -12,9 +12,12 @@
 
 ## State-dependent rules
 A rule that depends on stored state (current status, existing records, balances) is written
-as `reads <View>` + `require <expr> message "…"` and the slice description says it is **NOT
-enforced in the model today** (PLAY0268/0271 at binding are expected in design mode).
-Name the invariant, the race it leaves open, and the target:
+as `reads <View>` plus `require` with an indented message. Opt eligible views into
+application-root `command reads protected` (v25); test present/absent state and rule
+refusal, and matching decide/commit conflicts. Read
+[protected reads](../../cratis-screenplay-command-surface/references/protected-reads.md)
+for admission and Stage's refusal. For legacy/refused shapes, mark the rule unenforced.
+Name the invariant, the race it leaves open and the target realization:
 `[ProtectedDecision]` + `DecisionRead<T>` (Arc 22.39.0 and later; available to gap-fill
 in Stage's rendered package set, not automatically emitted), or a Chronicle
 `concurrency` scope on the event source or stream, or a constraint where one fits. Forbidden: caller-supplied copies of state

package/package/corpus/skills/cratis-screenplay-legacy-extraction/references/signal-to-intent.md

@@ -71,7 +71,7 @@ files on it. Each hop has a typical yield:
 
 | Path | Hops | What to take from it |
 |---|---|---|
-| Write | entry point (route, handler, form action), input model and validation, service, entity, repository, schema or migration, response and error mapping | the command name and inputs; `validate` rules with their exact messages; state-dependent checks (`reads` plus `require`, NOT enforced); unique indexes; the error mapping gives the `then error` text and the legacy HTTP code for the slice `documentation` |
+| Write | entry point (route, handler, form action), input model and validation, service, entity, repository, schema or migration, response and error mapping | the command name and inputs; `validate` rules with their exact messages; state-dependent checks (`reads` plus `require`, eligible protected opt-in or recorded legacy/refused shape and target gap); unique indexes; the error mapping gives the `then error` text and the legacy HTTP code for the slice `documentation` |
 | Read | entry point, query or repository, response model, paging and filter conventions | the read-model shape and query arguments (`by`, `filter`); which caller may narrow what |
 | Background | listeners, after-commit hooks, message consumers, schedulers, outbox relays | reaction or translation candidates; say "none found" when there is none |
 

package/package/corpus/skills/cratis-screenplay-model-authoring/SKILL.md

@@ -40,25 +40,18 @@ editing concept generation or `generated identifier`.
 
 ## When not to
 
-The same reference separates inputs, credentials and context/secret generation that is not available.
+For generation proofs/PLAY0688 repairs, read [generation details](references/mcp-tools.md#concept-generation):
+use `rules[]`, not parsed diagnostics (Requires Screenplay 4.173.0,
+`screenplay --version`; older servers omit proofs).
 
 ## Locate and connect
 
 Use the declared `screenplay` MCP server (for example `open-workspace`).
 
-Never ask the user which folder to use before trying. Call `open-workspace` with no
-arguments first: a server started without a fixed root binds the folder the host or
-launch directory offers (the client's single workspace root, else the working
-directory when it holds `.play` files). Only when it answers that no root was given,
-or that several roots are offered, pass `path`: the folder holding the project's `.play` files, otherwise the
-folder the user names. Without a project, the server works in `Documents/Screenplay`
-in the user's home folder, so do not invent a location. A root fixed at launch
-can switch only to the same model folder in a registered Git worktree of the
-same repository; rules and refusals are in [MCP loop](references/mcp-loop.md).
-
-Prefer a fixed root (dynamic-roots history: [MCP loop](references/mcp-loop.md)). Send `initialize` and
-`notifications/initialized` before any tool call, then discover `tools/list`
-schemas rather than relying on a remembered count.
+Never ask the user which folder to use before trying `open-workspace` without
+arguments; do not invent a root. Read [MCP loop](references/mcp-loop.md) when connecting or switching roots;
+it owns fallback discovery, fixed-root limits and the initialization protocol.
+Discover `tools/list` schemas rather than relying on a remembered count.
 
 
 Look first for the project's existing `.play` files: their folder is the model.
@@ -71,20 +64,12 @@ explanatory Markdown belongs in repository documentation.
 `mcp-servers.json` declares the Screenplay server; supported client registration
 is owned by the Cratis CLI, which preserves other servers and user configuration.
 
-The CLI entry point is:
-
-```shell
-cratis screenplay mcp <model-folder>
-```
+The CLI-bundled MCP can be older than the standalone tool: discover schemas.
+Read [MCP loop](references/mcp-loop.md) for launch options. Use the supported
+channel, not another global tool, Docker or copied managed configuration.
 
-The CLI-bundled MCP can be older than the standalone tool and lack newer capabilities, such as the generation summary and entropy repairs.
-Discover installed capabilities. Do not ask for a second global .NET tool, Docker
-or hand-copied managed MCP configuration. Installation/status must confirm adapter
-support and no conflicts.
-
-If the MCP is unavailable, report that gap. Do not claim compiler-validated AST
-editing while falling back to regex. Existing standalone `screenplay mcp` users
-can keep that entry point; use the project's supported installation channel.
+If MCP is unavailable, report it; regex edits are not compiler-validated AST
+editing. Existing standalone `screenplay mcp` users may retain that entry point.
 
 ## Understand before editing
 
@@ -96,7 +81,9 @@ can keep that entry point; use the project's supported installation channel.
    `kind: "Property"`, `Owner.member` / `Owner.generationN.member`, direct mappings.
    `complete: false` is incomplete evidence, never a successful empty list.
    Edit through MCP proposals, not hand-edited text; [generation](references/mcp-tools.md#concept-generation).
-3. Read diagnostics and coverage limitations. Use `dependency-graph` for container
+3. Read diagnostics and coverage limitations. Identify subjects by code and typed
+   `arguments`, never by parsing message text. Read [diagnostic arguments](../cratis-screenplay-toolchain/references/diagnostic-arguments.md)
+   for kinds, PLAY0524 step paths/indices, unknown fields and older responses. Use `dependency-graph` for container
    edges, declared-dependency coverage, cycles and advisory order; the board's
    dependency-map toggle exposes this evidence visually. Unknown or ambiguous
    bindings are not an empty, successful dependency graph.
@@ -114,6 +101,13 @@ Keep reads scoped to the relevant module, feature, slice or document. Do not
 request a whole merged AST when a bounded declaration/property query answers the
 question. Size-limit refusals require narrower reads, not truncation.
 
+## Application modes and described handler intent
+
+Start new models with `reaction batches atomic`; preserve it through proposals.
+Read [language admission](../cratis-screenplay-toolchain/references/language-admission.md)
+for atomic/protected modes and Stage refusals. Read [intent inventories](references/mcp-tools.md#dependencies-and-intent-inventories)
+for handler views: `executableReady` means binding, not an implemented body.
+
 ## Compare models
 
 For a `main` comparison, pass a worktree `path` to `semantic-diff`, not two

package/package/corpus/skills/cratis-screenplay-model-authoring/references/choosing-generation.md

@@ -7,14 +7,21 @@
 
 Follow the [threaded shop model](../../cratis-screenplay-command-surface/references/shop-generation.md):
 CustomerId (`cus_` + ULID), OrderId (TypeID) and InviteCode (NanoID) are released
-strategies. ApiKey stays secret without executable generation. Neither the
-OrderId's Arc received-time/tenant context nor ApiKey's .NET Bytes(32) secret
-factory can be promised as Screenplay generation today.
+strategies. InvoiceNumber uses a readable pattern/checksum and TicketNumber an
+Int pickup-ticket range. ApiKey stays secret without executable generation.
+An attached generation rule can use Now/Tenant, but the reference runner consumes
+pinned Strings rather than executing its implementation.
 
 For a server-owned new value, choose implicit UUID for an ordinary identity,
 UUIDv7 for time-ordered UUIDs, ULID for compact time-ordered text, TypeID for
 recognizable typed text, NanoID for opaque text, or bytes for an exact random-bit
-budget. Inspect entropy separately from executable admission; prefixes add no
+budget. Choose `pattern` for readable references (dates/check digits add no
+entropy), `random` for bounded Int values, `rule` only when an opaque implementation
+is needed.
+
+Requires Screenplay 4.172.0 (`screenplay --version`) for these v21 constructs; older compilers refuse PLAY0268.
+
+Inspect entropy separately from executable admission; prefixes add no
 random bits and identifiers need at least 64. Time-ordered is not strict
 millisecond ordering. Use the existing [strategy and MCP reference](../../cratis-screenplay-command-surface/references/generated-values-and-responses.md),
 not a per-property strategy: the concept owns `generate`, the command property
@@ -23,7 +30,13 @@ says `generated identifier` or `generated`.
 ## When not to
 
 Do not replace client-minted inputs, authorization, idempotency keys or a gapless
-invoice allocator with generation. Secret generation, pattern/random/rule execution
-and generated-concept rule consistency are not released capabilities. Preserve
-refused rules instead of deleting them or inventing a repair.
+invoice allocator with generation. Patterns are not sequential/gapless allocators
+or secrets; check digits detect typos, not forgery. Use a unique constraint for
+short payload codes, and retain whole-source freshness for generated destinations.
+Secret generation and sequence allocation remain refused. Inspect authored-order
+MCP `rules[]` and `derivedPattern` for rule proofs and reviewed PLAY0688 repair;
+never delete a business invariant to silence PLAY0689. Read
+[Stage admission](../../cratis-stage-rendering-and-sandbox/references/admission.md)
+for checksum validation and pattern/random rendering prerequisites.
+`generate rule` remains STAGE-ESM-028, so model admission does not promise rendering.
 Sources: `Documentation/screenplay/generated-values/choosing.md` and `Documentation/screenplay/generated-values.md` in `Cratis/Screenplay`.

package/package/corpus/skills/cratis-screenplay-model-authoring/references/language-reference.md

@@ -260,16 +260,22 @@ See read-surface `references/named-keys.md` for the collection-key exclusion alg
 | Information only, never blocks | `persona` (report-only: `PLAY0270`, the policies it lists must exist), `authentication`, `domain`, `seed`, descriptions and `file` provenance. A persona does not block binding and does not change behavior, so state persona scope in a description or a policy the model uses |
 | Binds as ESM v7 (`PLAY0268` on a compiler that stops before v7) | `generated` properties and `returns` responses, generated fixtures and `then returns`: bound and executed by the reference runner; a policy, rule or requirement that references a generated value is `PLAY0273`, and generated-concept rules select v20 with PLAY0688/0689 proof diagnostics. Stage renders supported UUID/String strategies, scalar/named responses and fixtures; unsupported types/result combinations remain `-028`/`-038` |
 | Authorable, not executable (PLAY0268) | Systems/operations, the `numbers exact` source mode (PLAY0268; exact lowering of qualifying Double literals is the admitted v11) remain unadmitted |
-| Concept generation strategies (ESM v15) | Required scalar generatable Uuid/String concepts; concept-owned uuid/uuidv7/ulid/typeid/nanoid/bytes strategies and admitted modifiers. Strict fixture encoding; Guarded whole-source freshness rejects Concurrency with no append/retry. Generated secrets, pattern/random/rule and sequence remain refused; generated-concept rules select v20. Stage renders supported strategies: command-surface `references/generated-values-and-responses.md` |
+| Concept generation strategies (ESM v15) | Required scalar generatable Uuid/String concepts; concept-owned uuid/uuidv7/ulid/typeid/nanoid/bytes strategies and admitted modifiers. Strict fixture encoding; Guarded whole-source freshness rejects Concurrency with no append/retry. Generated secrets and sequence remain refused; generated-concept rules select v20, pattern/random/rule and checksum validation select v21. Stage renders supported strategies: command-surface `references/generated-values-and-responses.md` |
 | Response-name UI continuations (no ESM change) | Form submit and execute-success scopes, own failure PLAY0685, nested shadowing and outer success in inner failure; field/parameter precedence. An older bundled compiler lacks resolution; Scene runtime binding remains downstream. UI composition `references/response-continuations.md` |
 | Collection equality filters (ESM v14) | Caller-supplied `filter name Type [optional]`, no `from`, matching a same-named scalar primitive/concept/enum read-model property with the same nominal type. AND with `by`; optional omission does not narrow, supplied null is refused. PLAY0468 covers unknown/repeated/missing required spec arguments; result rows compare by read-model/key regardless of order. Read read-surface `references/equality-filters.md` for the compiled example and renderer ceilings |
 | Recovery and no-event assertions (ESM v17) | `when redelivered` delivers one given occurrence to one reaction without append; `then no events` checks no new facts, excluding append input. Requires Screenplay 4.157.0 or later (`screenplay --version`); older compilers report PLAY0268. |
 | Query Validation rejection (ESM v18) | Exactly one queried call plus one `then error`, no other action/result/denial. Concept key/supplied filters validate after authorization in every version. Requires Screenplay 4.161.0 or later (`screenplay --version`); older runners may answer absence. |
 | Invocation refusal branches (ESM v19) | Ordered first-match `on refused` productions or acknowledgement, `$refusal` values; bare refusal excludes authorization. Requires Screenplay 4.160.0 or later (`screenplay --version`); older compilers report PLAY0268. |
-| Generated-concept rules (ESM v20) | Proven rules bind, Refuted PLAY0688 errors, Unproven PLAY0689 warnings; fixtures obey shape and rules. Requires Screenplay 4.164.0 or later (`screenplay --version`); older compilers report PLAY0268. |
+| Generated-concept rules (ESM v20) | Proven rules bind silently, Refuted PLAY0688 errors include a witness, Unproven PLAY0689 warnings include a reason; deterministic regex containment only, not passing samples. Fixtures obey shape and rules. Requires Screenplay 4.164.0 or later (`screenplay --version`); older compilers report PLAY0268. |
+| Finite generation and attachments (ESM v21) | String pattern with optional Luhn/Mod11/Mod97 checksum, inclusive Int random range, attached String generation rule with language-neutral Now/Tenant context and String result, String checksum validation. Requires Screenplay 4.172.0 (`screenplay --version`); older compilers report PLAY0268. PLAY0691 is support-budget exhaustion, PLAY0692 empty support on a scanned date. Pin date fixtures with given clock. Requires Stage 4.118.0 for checksum validation and 4.119.0 for pattern/random rendering; older renderers refuse them. `generate rule` remains STAGE-ESM-028; see command-surface `references/generated-values-and-responses.md`. |
+| Atomic reaction batches (ESM v22) | Root `reaction batches atomic`; direct productions per occurrence and selected refusal branches are separate batches, commands independent; Stage refuses v22 and atomic mode |
+| Described handlers (ESM v23) | Pending implementation beside unconditional produces; payload-only contract, reached body Unsupported ImplementationBody; Stage STAGE-IMPL-002 even Stub mode |
+| Ordinal text rules (ESM v24) | contains/not contains/starts with/ends with on scalar non-enum text properties; quoted literals, not conditions; Stage semantic engines execute/render |
+| Protected command reads (ESM v25) | Root `command reads protected`; eligible read paths in requirements and production mappings, absence Validation, concurrent matching facts Conflict; Stage admits v25 but refuses protected reads STAGE-ESM-044 |
+| Chronological command dates (ESM v26) | Same-primitive Date/DateTime `==`, `!=`, `>`, `>=`, `<`, `<=` in require/produces-when (property or literal RHS) and command/property rules (literal RHS only). DateTime uses UTC ticks, participating offset-less inputs reject Validation before rules; then matching stays ordinal. Requires Screenplay 4.199.0 (`screenplay --version`); older binders refuse PLAY0268. Stage refuses v26 STAGE-ESM-016. Read command-surface `references/date-comparisons.md`. |
 | Current routing and actor admission | Sources/streams and command/specification routes bind and reference-execute as v8; reaction `runs as system role` supplies the invocation actor as v10. Whole-workspace binding determines executable availability; CLI/Stage realization remains separate |
-| Blocks binding (`PLAY0268`) | enum/identity compliance and events combining personal or explicitly subject-scoped secret values with explicit subject marks; a compiler that stops before v13 refuses all `pii`/`secret` concepts ("compliance attributes require portable data-subject semantics"), while v13 binds them and Stage renders protection; command `handler` (never binds; a command cannot declare both `produces` and `handler`, `PLAY0035`), bare `rule <Name>`, `require` or conditions over read-model paths, dates and `today` in comparisons, `$context.tenant`/claims/roles/causation in `produces`, `$env` conditions, `file` constraints, unquoted `import` of an external contract, a read model with neither explicit `key` nor unambiguous query-based identity as described above (composite keys remain unadmitted), queries with context `from` sources (typed query context is unadmitted), single-result filters (collections only), `scoped to` (opaque scope), `performer` (opaque implementation) or composite `by` blocks; optional keyed and collection queries, including caller-supplied equality filters and observable delivery, bind, `$causedBy` and templates in projections |
-| Blocks binding (`PLAY0271`, legacy meaning) | Command `reads` and `concurrency` |
+| Blocks binding (`PLAY0268`) | enum/identity compliance and events combining personal or explicitly subject-scoped secret values with explicit subject marks; a compiler that stops before v13 refuses all `pii`/`secret` concepts ("compliance attributes require portable data-subject semantics"), while v13 binds them and Stage renders protection; attached command `handler` (PLAY0035 beside productions; pending described intent instead binds v23), bare `rule <Name>`, read paths without protected opt-in or in unsupported positions such as `produces when`, date comparisons with mixed primitives, optional condition operands, `$context`, protected read paths or `today`, date rules on concepts or reaction `where`, `$context.tenant`/claims/roles/causation in `produces`, `$env` conditions, `file` constraints, unquoted `import` of an external contract, a read model with neither explicit `key` nor unambiguous query-based identity as described above (composite keys remain unadmitted), queries with context `from` sources (typed query context is unadmitted), single-result filters (collections only), `scoped to` (opaque scope), `performer` (opaque implementation) or composite `by` blocks; optional keyed and collection queries, including caller-supplied equality filters and observable delivery, bind, `$causedBy` and templates in projections |
+| Blocks binding (`PLAY0271`, legacy meaning) | Command reads without protected opt-in and `concurrency`; combined protected reads/concurrency is PLAY0783 |
 | Deferred (`PLAY0269`, information) | Screens, layouts, templates, forms, contributions, UI profiles, themes, behaviors and `on`/`uses` |
 | Metadata only (`PLAY0270`, information) | `domain`, `seed`, `persona`, trigger and other descriptions, and `file` provenance on declarations |
 
@@ -301,8 +307,9 @@ and routes bind and reference-execute as v8; reaction identity as v10.
 Use standalone `screenplay test` or MCP `run-specifications` for a reference
 verdict, and independently check CLI/Stage admission. Never drop a contract to bind.
 Generated values and `returns` are not in this group: they bind as ESM v7.
-Protected reads and `derive`/`provide` (not admitted by any supported ESM version) have no documented
-syntax: do not teach or invent one. Affected-instance declarations and query paging/sorting/change-set delivery
+Protected command reads have documented v25 opt-in; see command-surface
+`references/protected-reads.md`. `derive`/`provide` remain undocumented and
+unadmitted: do not invent syntax. Affected-instance declarations and query paging/sorting/change-set delivery
 remain unavailable here. Event `subject` is report-only authoring metadata;
 public events/origin are admitted as ESM v9 (not provider realization).
 Purpose declarations, references and processing records are authoring metadata,

package/package/corpus/skills/cratis-screenplay-model-authoring/references/mcp-loop.md

@@ -24,6 +24,14 @@ defined by `cratis-screenplay-modeling-lifecycle`. Discover the installed tool s
 
 ## Connect
 
+Never ask which folder to use before trying `open-workspace` with no arguments.
+Without a fixed root, it binds the client's single workspace root, else a launch
+directory holding `.play` files. Only after a no-root or multiple-roots response,
+pass `path`: the folder holding the project's models, otherwise the folder the
+user names. Without a project the server uses `Documents/Screenplay` in the user's
+home; do not invent a location. A fixed root can switch only to the same model
+folder in a registered Git worktree of the same repository.
+
 1. Launch with a **fixed root**: `screenplay mcp <model-folder>`, or
    `cratis screenplay mcp <model-folder>`, or `cratis screenplay mcp` inside a
    project, where the CLI locates the model (the project's `.play` files, else `Source/`
@@ -210,7 +218,7 @@ connection. Passing `open-workspace.path` does **not** avoid it, because the err
 | --- | --- | --- |
 | Address-preserving | descriptions; bodies of rules and expressions; mappings between members that already exist; any edit that adds, removes or renames no addressed element. Also every edit in a model with no `.screenplay/identities.json` except persisted names | bounded text edit of the `.play` file, then compile the folder; or `propose-ast` |
 | Catalog-changing (identity file present) | add, remove or rename a declaration (slice, command, event, read model, projection, ...), a property of a command, event, read model, composite type or trigger, a query, a query argument or a specification; create, delete, rename or move a mapped `.play` document (McpState refuses reopening with `IdentityMappingConflict`; use document operations in `propose-ast`); rename, remove or move an event, command, read model, constraint, module, feature or slice; move declarations between files (slices and features across logical parents: `propose-move`); contract evolution of a persisted event (new generation, property added, removed or retyped) | `propose-rename` or a reviewed `propose-ast`; never a blind text rename. Renaming a constraint resets its uniqueness index: ask first unless the request names it, then report the reset. A persisted event rename needs `id "OldName"` (added by default) |
-| Concept `generate` | set/change/remove strategy and modifiers | `propose-ast` replaces `ConceptSyntax.generation` (`GenerationSyntax`; omit/null to remove), or reviewed `propose-source`; never hand-edit `generate` text. Preserve other concept members and inspect executable diagnostics: sequence PLAY0682, preview strategies PLAY0268, generated-rule proofs PLAY0688/0689. |
+| Concept `generate` | set/change/remove strategy and modifiers | `propose-ast` replaces `ConceptSyntax.generation` (`GenerationSyntax`; omit/null to remove), or reviewed `propose-source`; never hand-edit `generate` text. Preserve other concept members and inspect executable diagnostics: sequence PLAY0682, generated secrets PLAY0268, generated-rule proofs PLAY0688/0689, finite-support failures PLAY0691/0692. Pattern/random/rule and checksum validation bind as ESM v21 (Requires Screenplay 4.172.0, `screenplay --version`; older compilers refuse PLAY0268). Read `mcp-tools.md#concept-generation` for `arguments`, exact support and `rules[]`, not parsed diagnostic prose. |
 | Repair | `PLAY0166`, `0478`, `0469`, `0471`, `0479`, `0516`, `0563`, `0564`, `0565`, `0614`, `0653`, `0683`, `0684` (and recipe-only `0397`) | `propose-repair` with `formatting`; PLAY0166/0478 may pin attachment evidence (`pinRepairEvidence` and `expectedRepairEvidenceRevision`), never fix-all PLAY0478 |
 | Inline event extraction | `produces event ...` to a declared event | `propose-extract-inline-event` |
 | Parser-invalid document | no editable handles | `propose-source` `replace-document` with corrected source, or typed `propose-ast` document replacement |

package/package/corpus/skills/cratis-screenplay-model-authoring/references/mcp-tools.md

@@ -166,8 +166,12 @@ exists only for authored `generate`; an implicit UUID default has no block.
 | --- | --- |
 | `strategy` | Authored strategy name |
 | `modifiers` | Only set `prefix`, `case`, `size`, `alphabet`, `count`, `encoding`; omitted defaults are not filled in |
-| `previewArguments` | Present only for authored `pattern`, `checksum`, `range`, `rule`; each is `{value, executable: false}` |
-| `entropyBits` | Exact random bits, or null for unknown strategy/invalid entropy inputs |
+| `arguments` | Authored `pattern`, `checksum`, `rule` strings and `range: {text, minimum, maximum}` with exact Int64 endpoints; malformed range retains text only. Replaces `previewArguments`. |
+| `supportCount` | Exact JSON integer for assessed pattern/random distinct support; preserve large numbers without floating-point rounding. Dates use minimum conditioned support over the compiler's 100-year UTC horizon. |
+| `entropyBits` | Built-in random bits; pattern/random use log2(supportCount). Null for opaque rule implementations or invalid/unsupported inputs. |
+| `derivedPattern` | Anchored strategy-derived regex, or null; pattern expressions are deterministic and bounded, but date/checksum digit runs describe shape, not arithmetic containment. |
+| `derivedPatternUnknownReason` | Reason when derivedPattern is null; never invent a regex from it. |
+| `rules` | Authored-order entries: rule kind, line/column, status proven/refuted/unproven; witness for refuted, reason for unproven. diagnosticCode only for reported PLAY0688/0689; repair PLAY0688 only for a reported refuted declarative rule. |
 | `entropyUnknownReason` | Present only when entropy is unknown |
 | `valuesAtOnePercentCollision` | JSON number estimating the 1% birthday collision count, or null; scientific notation can exceed client floating-point range |
 | `executable` | `status`, `diagnosticCodes`, and `reason` only for `notAssessed` |
@@ -178,7 +182,10 @@ and no such error exists; otherwise `notAssessed`, with a reason that whole-mode
 binding failed. `diagnosticCodes` contains only errors at these declaration locations.
 An empty list is not admission; low-entropy property diagnostics require workspace
 inspection. Invalid alphabets/non-positive sizes or counts yield null estimates
-with `entropyUnknownReason`, preserving compiler diagnostics. Time, prefixes,
+with `entropyUnknownReason`, preserving compiler diagnostics. Pattern support
+budget exhaustion (PLAY0691) or empty support on a scanned date (PLAY0692) also
+leaves estimates null with the compiler's reason; an opaque `rule` has unknown,
+not zero, entropy. Time, prefixes,
 case and encoding add no randomness; the compiler, details and repairs share
 `GenerationEntropy`, not an agent's parallel estimate.
 
@@ -191,8 +198,9 @@ source document under the same revision/review contract. Canonical printing
 retains `generate`. Review `read-proposal` changes and `view: "executable-diagnostics"`,
 run candidate specifications where executable, then explicitly `apply`.
 Authoring acceptance does not imply executable readiness: `sequence` reports
-PLAY0682; `pattern`/`random`/`rule` and generated-concept validation rules report
-PLAY0268. Do not retype a refused proposal to bypass those diagnostics.
+PLAY0682; generated secrets still report PLAY0268, rule proofs PLAY0688/0689,
+and finite-support failures PLAY0691/0692. Pattern/random/rule and checksum
+validation bind as ESM v21. Do not retype a refused proposal to bypass diagnostics.
 
 `screenplay_repair_capabilities` advertises PLAY0683/PLAY0684. Discover concrete
 verified actions with `read-workspace view: "repairs"` at the diagnostic revision:
@@ -211,10 +219,40 @@ concept; uniqueness changes append-time behavior. Review every changed document
 before applying; discovery/proposal write nothing. The saved-file VS Code repair
 picker does not expose these entropy actions.
 
-PLAY0688 repair replaces a refuted generated-concept rule with the strategy-derived
-`matches` pattern. Review it as a validation change for input/stored values too.
-PLAY0689 is an unproven warning, not proof; checksum repairs remain unadmitted.
-MCP does not generate values.
+Read `generation.rules[]` instead of parsing diagnostic prose: `refuted` names
+the violating `witness`; `unproven` explains its `reason`; `proven` needs no diagnostic.
+A refuted result without `diagnosticCode` means the compiler did not check that
+rule (for example, a UUID concept unused by generated command properties), so
+there is no reported repair. Proof status is not executable admission, and
+passing samples do not prove containment.
+
+To add a rule the strategy satisfies, put `derivedPattern` into a typed `matches`
+proposal preserving other concept members. If null, read
+`derivedPatternUnknownReason` and keep the intended invariant; do not fabricate
+an expression. PLAY0688 repair replaces a refuted generated-concept rule with
+the strategy-derived matches pattern. Discover its subject through
+`read-workspace view: "repairs"`, then `propose-repair` with both revisions and
+canonical formatting. Review input/stored-value effects, not just generation.
+For a checksum pattern the same proposal explicitly adds the declared checksum
+validation if absent. Ambiguous/unbounded derived regexes have no repair.
+PLAY0689 is an Unproven warning, not proof; MCP never generates values.
+For an opaque generation rule, inspect `read-workspace view:
+"implementation-requirements"` for its ValueGeneration requirement; the reference
+runner consumes a pinned String and never executes its attached body.
+Requires Screenplay 4.181.1 (`screenplay --version`) for the language-neutral
+version-1 ValueGeneration context contract (Now instant, Tenant portable ID,
+String result); older Cratis C# bindings cannot compile all context-aware bodies.
+The provider selects the binding, not the fence tag: Cratis C# uses Fundamentals'
+`Cratis.Concepts.GenerationContext`; BCL-only C# hosts can use Screenplay's record.
+Portable bodies use Now, tenant interpolation/string assignment and BCL types.
+Passing context to `GenerateValue.*`, constructing/naming the context type or
+reading `Tenant.Value` is target-bound, not a shared language contract. See
+[context reference](https://github.com/Cratis/Screenplay/blob/main/Documentation/screenplay/context.md).
+
+Requires Screenplay 4.173.0 or later (`screenplay --version`) for `arguments`,
+exact support, derived patterns and `rules[]`; older servers can expose
+`previewArguments` and omit proofs. Discover schemas and diagnostics instead of
+assuming these fields. Reference: [generation details](https://github.com/Cratis/Screenplay/blob/main/Documentation/screenplay/mcp/reference.md#generated-values-and-responses).
 
 Requires Screenplay 4.164.0 or later (`screenplay --version`) for generated-rule proofs and PLAY0688 repair; older servers lack this action. The CLI-bundled MCP can lack
 this generation summary and the entropy repairs. Existing typed concept proposals predate the
@@ -453,6 +491,11 @@ inspect authored links, not code execution or a transitive runtime graph.
 
 ## Dependencies and intent inventories
 
+Diagnostic subjects use code plus typed `arguments`, not parsed messages. This applies
+to `diagnostics`, executable diagnostics and proposal introducedExecutableErrors.
+Read [diagnostic arguments](../../cratis-screenplay-toolchain/references/diagnostic-arguments.md)
+for optional subjects, declaration paths and PLAY0524 step indices.
+
 `dependency-graph` edges point consumer → producer. Views: `edges`, `cycles`,
 `order`, `unresolved`, `declarations`; `from`/`to` select slice/feature/module
 aggregation (`to` also accepts context). `scope`, `direction`, `kinds` and
@@ -479,7 +522,12 @@ Workspace views `named-rule-intents`/`named-rule-intent-details` cover CommandNa
 only, including pending hints without a requirement ID. Details select either
 `subject` or attached `requirementId`, not both. `handler-intents` and
 `handler-intent-details` cover CommandHandler only; handler details select
-`requirementId`. All page ordered hints, not implementation correctness. Continue
+`requirementId`. A handler entry's `executableReady` means successful v23 binding
+with a matching Pending requirement, not a supplied body; `admission` is described,
+refused or authoring-only. `implementation-requirements` exposes ordered hints and
+provisional/ambiguous flags. Edit HandlerSyntax/ImplementationSyntax/ImplementationHintSyntax
+through `propose-ast` with Authoring validation, preview then apply; unwrapping
+pending metadata is refused. All page ordered hints, not implementation correctness. Continue
 with `expectedRevision` and `expectedCatalogRevision`; provisional owner IDs are
 not authoritative. Edit hints through reviewed `propose-ast`.
 

package/package/corpus/skills/cratis-screenplay-model-authoring/verification.json

@@ -137,7 +137,8 @@
     },
     {
       "kind": "skill-contains",
-      "value": "cratis screenplay mcp <model-folder>"
+      "value": "cratis screenplay mcp <model-folder>",
+      "file": "references/mcp-loop.md"
     },
     {
       "kind": "skill-contains",
@@ -174,7 +175,8 @@
     },
     {
       "kind": "skill-contains",
-      "value": "registered Git worktree"
+      "value": "registered Git worktree",
+      "file": "references/mcp-loop.md"
     },
     {
       "kind": "skill-contains",

package/package/corpus/skills/cratis-screenplay-model-review/SKILL.md

@@ -127,11 +127,8 @@ rejected state and its evidence.
 Optional, on request, all read-only and yielding edit requests: a subject's information journey (`references/model-inventory-report.md`), a resilience pass (`references/stressor-analysis.md`) and a slice-by-slice walkthrough (`references/walkthrough.md`).
 
 ## Quick self-check (modeler, P4; about ten minutes)
-Eleven yes/no checks the modeler runs on its own work before P5 (V1 clean, no dropped constructs,
-every event production has `for`, every field has an origin, every command a reachable authorized
-origin, NOT-enforced rules marked, coverage matrix filled, personas with their denials, rationale in
-`documentation`, open questions as anchored notes, every Automation with pending work). Any "no" is
-fixed or explained before P5. The list: [quick self-check](references/quick-self-check.md).
+Read [quick self-check](references/quick-self-check.md) before P5 for the eleven
+modeler checks. Fix or explain every "no"; this is not the independent review.
 
 ## Business-question pass (explain brief)
 Be a sharp business analyst seeing the domain fresh: walk each persona's journey and ask only what a domain person must decide, in plain language with no engineering words (could a non-technical product owner read it and immediately understand what is being asked?), anchored to a place in the model, at most 12 questions (zero is valid). Method, element prompts and the model-word translation table: `references/business-questions.md`. A behavior walk in the Stage sandbox (`cratis-stage-rendering-and-sandbox`) is a separate, optional check; its findings arrive here as review findings.

package/package/corpus/skills/cratis-screenplay-model-review/references/anti-patterns.md

@@ -64,8 +64,8 @@ the problem, the checks it violates, the fix, all pinned to one declaration.
 | Undeclared removal/append event | `remove with` or capture `append` names an undeclared event | V1 warns (PLAY0166, a failure under warnings as errors); binding fails PLAY0273 | C (executable) / D | declare or fix the name; run V3 |
 | Gated command invoked by a reaction without a declared actor | reaction `invokes` a command under a caller policy and has no `runs as system role "<Role>"` that satisfies the gate | the invocation carries no caller: rejected at run time | D (major) | declare `runs as system role "<Role>"` with the least-privilege role the gate admits (ESM v10, Screenplay 4.125.0; Stage 4.89.1 renders role/authenticated trusted actors, but claim-reading/opaque gates still refuse STAGE-ESM-034 and need gap-fill) or record another trusted-path decision - never just delete the gate. A matching `runs as system role` is the admitted trusted path, not a defect |
 | `reads` + `produces` reaction | reaction both reads a view and produces | fails binding | C (executable) | invoke a command, or produce without reads |
-| `reads` treated as protection | rule "checked" because the command or reaction `reads` a view | `reads` enforces nothing | D (major) | keep or introduce `reads <View>` + `require ... message` as stated intent, mark it NOT enforced in the slice `description`, name the target (`[ProtectedDecision]` + `DecisionRead<T>`, Chronicle DCB, or a constraint where it fits); checklist E3 |
-| Caller-supplied state rule | `require currentStatus == "open"` where the caller sends `currentStatus` | the caller decides its own permission | D (major) | read the stored state with `reads`; keep or introduce `reads <View>` + `require ... message` as stated intent, mark it NOT enforced in the slice `description`, name the target (`[ProtectedDecision]` + `DecisionRead<T>`, Chronicle DCB, or a constraint where it fits); checklist E3 |
+| Unadmitted read claimed protected | rule "checked" by legacy command or trigger reads | no protected contract or target realization | D (major) | opt eligible command reads into `command reads protected` (v25); inspect shape, absence and conflict cases. Stage refuses protected reads (STAGE-ESM-044); distinguish reference protection from target evidence; checklist E3 |
+| Caller-supplied state rule | `require currentStatus == "open"` where the caller sends `currentStatus` | the caller decides its own permission | D (major) | read authoritative stored state through admitted protected reads and `require`; mark legacy/refused shapes and target realization as gaps; checklist E3 |
 | `severity warning` as soft rule | rule meant to warn but still rejects | blocks valid requests | C semantics | remove or make it a real rule |
 | Relay events | `*Synced`, `*Forwarded` events that only move data | noise, not facts | D | translate once into a business fact |
 | External event driving a worker directly | captured external record invokes commands with no local fact | no audit of what was learned | D | append a local fact in `Translate`; automate from it |

package/package/corpus/skills/cratis-screenplay-model-review/references/checklist.md

@@ -123,7 +123,7 @@ the format in `worked-example.md`.
 |---|---|---|---|
 | E1 | Value formats on `concept`s; input rules on the command; uniqueness as `constraint`; access as `authorize` | declarations | D |
 | E2 | Every refusal has a message a person understands; constraint messages copied verbatim in specs | `message`, specs | D |
-| E3 | A state-dependent rule is `reads <View>` + `require <expr> message "..."` as stated intent, and the slice `description` marks it NOT enforced in the model today (PLAY0268/0271 at binding expected in design mode) with its target named (`[ProtectedDecision]` + `DecisionRead<T>`, Chronicle DCB / `concurrency` scope, or a constraint). Not: caller-supplied copies of state, attestation booleans (`confirmsX == true`), rules in `handler` / `implementation hint` prose, or `reads` treated as protection | slice `description`, `require`, `handler` | D (faking or hiding = major) |
+| E3 | A state-dependent rule uses `reads` + `require` over authoritative state: eligible reads opt into `command reads protected` (v25), with required absence and decide/commit conflict cases. Legacy/refused reads are marked unenforced with a named target. Stage refuses protected reads (STAGE-ESM-044); reference protection is not target realization. Not: caller-supplied copies of state, attestation booleans (`confirmsX == true`), rules in `handler` / `implementation hint` prose, or `reads` treated as protection | slice `description`, `require`, `handler` | D (faking or hiding = major) |
 | E4 | `severity warning` is not used as "soft" validation (it still rejects) | validate lines | C semantics |
 | E5 | Preconditions are explicit; nothing relies on "obviously you can't" | descriptions, specs | Q |
 | E6 | Each invariant has an atomic enforcement point (name the storage provider where constraint admission matters); the race loser's outcome is specified | constraints, specs | D |
@@ -147,7 +147,7 @@ PLAY0516 moves preserve executable bytes/identities. Source: Screenplay
 | F2 | No impossible sequence (a fact that requires one that can never precede it) | constraints, specs | D |
 | F3 | Cancellation, failure and correction paths exist where the business has them | slices | Q |
 | F4 | Automations: trigger, todo/work item if work can be pending, a closing fact, retry and once-only story | reactions, views | D (`cratis-screenplay-automations-and-translations`) |
-| F5 | External facts enter through `Translate`; in-app follow-ups through `Automation` | slice kinds | C semantics |
+| F5 | External facts enter through `Translate`; in-app follow-ups through separate `Automation` slices. Keep a capture in Translate, move reactions to its local appends out (PLAY0694 for directionless/unrouted co-location, including child/nested appends; PLAY0616 for explicit inbound). PLAY0694 is a warning that fails `--warnaserror`, with no automatic split | slice kinds, capture appends and reaction triggers | C semantics |
 | F6 | No cycle where fact A's reaction needs fact B and B's needs A, or two features each wait on the other | reactions, MCP `dependencies` | D (redesign the boundary) |
 | F7 | Each slice's consumed events and their producing slices are known; a slice calls another's command only through `invokes` | reactions, `reads` | Q |
 | F8 | Every Automation has a pending-work view (a todo list: membership is the pending work), or a written reason a direct effect needs none (immediate, internal, cannot fail). A "simple relay" is not exempt from the question | reactions, `reads`, views | D |

package/package/corpus/skills/cratis-screenplay-model-review/references/quick-self-check.md

@@ -8,7 +8,8 @@ About ten minutes, before the independent review.
 4. Every read-model field has an origin; every event has a consumer or terminal reason.
 5. Every command has a reachable, authorized origin (screen or form action, or a reaction to an event, clock or application trigger; a capture appends facts and a command after it is reached through a reaction).
 6. No gated command is invoked by a reaction without a recorded trusted-path decision.
-7. State-dependent rules are `reads` + `require ... message` marked NOT enforced; no
+7. State-dependent rules use admitted protected command reads plus `require`, or
+   record the legacy/refused shape and target gap; no
    caller-supplied state, attestation boolean (`confirmsX == true`) or handler/hint prose.
 8. Coverage matrix filled; every `n/a` has a domain reason.
 9. Persona text says what each role cannot do, each line backed by a gate and a `then denied`

package/package/corpus/skills/cratis-screenplay-model-review/references/review-questions.md

@@ -37,8 +37,9 @@ needs; a "no" is a finding only when it has a business consequence.
 
 ## For each slice and the model as a whole
 1. Does each slice depend on other slices only through event contracts, `invokes` and explicitly
-   recorded cross-slice `reads` of another slice's view (F7)? A `reads` is unprotected (a
-   stored-state rule over it stays not enforced) and couples the slice to that view's interface:
+   recorded cross-slice `reads` of another slice's view (F7)? Check protected-command
+   opt-in/admission and absence/conflict cases separately from target realization;
+   legacy and trigger reads remain unprotected. The view interface is a dependency:
    check that it is recorded, not implied.
 2. Could two people work on two slices at the same time without reading each other's
    declarations, given only the events' fields (A8)?