@cratis/pi 7.62.0 → 7.64.0

package/package/corpus/skills/cratis-screenplay-modeling-lifecycle/references/principles.md

@@ -11,7 +11,7 @@ instruction for the work, not background reading. Skills that restate one cite i
 6. **Keep semantic identity independent of names, paths, layout and generated symbols.** Commit the identity catalog with the model.
 7. **Keep unsupported intent visible.** Return a precise gap and its owning issue; never weaken the model so rendering passes.
 8. **Write specifications with intent, including rejection and denial.** Never report an unexecuted or unsupported scenario as passed.
-9. **Treat state reads as a correctness boundary.** Do not claim protection until the opted-in contract and the target support exist.
+9. **Treat state reads as a correctness boundary.** Eligible command reads opt into `command reads protected` (v25); legacy/trigger reads remain unprotected. Stage refuses protected reads (STAGE-ESM-044), not the v25 pair: reference absence/conflict guarantees and verified target realization are different claims.
 10. **Separate event-source identity from event payload and choose destinations explicitly.**
 11. **Persisted event shape changes are evolution, never cleanup.** Keep historical generations.
 12. **Model external work as business intent.** Provider interfaces and transport mechanics stay out of the language.

package/package/corpus/skills/cratis-screenplay-modeling-lifecycle/references/vocabulary-map.md

@@ -21,7 +21,7 @@ speaks in them; never model board mechanics (lanes, node ids, positions).
 | Storyline (ordered beats) | a **family** of specifications sharing example data, each one transition (no storyline syntax) | several spec classes | specifications |
 | Field validation | concept `validate` (every use) / command `validate`, `require` | `ConceptValidator<T>` / `CommandValidator<T>` | command validation |
 | Role permission ("Cannot") | `policy` + `authorize` + `then denied` spec; ownership via `claim ... matches subject` | `[Authorize(Policy)]`, generated policies | authorization |
-| Precondition on stream state | `reads` + `require` as stated intent, not enforced (target: Arc `[ProtectedDecision]` + `DecisionRead<T>`, or Chronicle DCB; APIs available to gap-fill in the Arc and Chronicle the Stage scaffold pins, not emitted protection) | decision over a guarded read | command validation |
+| Precondition on stream state | `command reads protected` + eligible `reads`/`require` (v25 reference protection); legacy/refused reads remain stated intent. Stage refuses protected reads (STAGE-ESM-044); target Arc `[ProtectedDecision]` + `DecisionRead<T>` or Chronicle DCB needs separate verification | decision over a guarded read | command validation |
 | Generated id (`derived:uuid4()`) | `generated` (authorable, not executable) | id supplied before `Handle()` | commands |
 | External system / outbound call | `Translate` slice (inbound); `system`/`operation` (authorable, not executable) or Automation (outbound) | `ICommandOperation` / reactor | operations, reactors |
 | HTML mockup | `screen` Level 1 + board (`visualize-model`) | default Scene composition | ui composition |

package/package/corpus/skills/cratis-screenplay-read-surface/SKILL.md

@@ -263,9 +263,8 @@ choosing a whole action list rather than one labeled command, use block-form
 **Inside out:** the slice, then the enclosing feature, then the module, then the
 document. The innermost match wins.
 
-That rule exists because a generated document cannot make every name unique — one
-real application declares 76 queries under 37 distinct names, with `All` appearing
-21 times. Two sibling slices can each declare `All`, and each screen gets its own.
+Sibling slices may each declare `All`; each screen resolves its own query.
+Read `references/named-keys.md` when query scope affects identity inference.
 
 Reach across slices by qualifying with **any trailing part** of the scope.
 Excerpt: `Queue` and `Deviations` are sibling slices that each declare `All`.

package/package/corpus/skills/cratis-screenplay-read-surface/references/named-keys.md

@@ -100,7 +100,9 @@ Composite read-model keys, query `by` blocks and fixtures
 over those views remain authoring-only: binding reports PLAY0268 citing
 Screenplay#599 (still open). They do not reference-execute or render. This is not
 ESM v10 admission; v10 covers reaction identity, production routes and observer
-filters. Command reads independently remain unprotected/unadmitted (PLAY0271).
+filters. Eligible command reads separately opt into v25 with `command reads protected`;
+legacy reads remain PLAY0271, and composite keys are still refused (PLAY0781 ByParts).
+See command-surface [protected reads](../../cratis-screenplay-command-surface/references/protected-reads.md).
 A single explicit key does bind; Stage admission still depends on the complete
 model and projection/query shape, not just the key modifier.
 

package/package/corpus/skills/cratis-screenplay-render-and-gap-fill/SKILL.md

@@ -32,6 +32,12 @@ Tool versions are covered in `cratis-screenplay-toolchain` `SKILL.md`; read it b
   (the user); Stage internals and the sandbox (`cratis-stage-rendering-and-sandbox`); judging
   hand-written code against its slice (`cratis-application-slice-conformance`).
 
+## Language modes that block target delivery
+
+Read [language admission](../cratis-screenplay-toolchain/references/language-admission.md)
+for v22–v25: Stage refuses atomic batches, described bodies (even Stub mode) and
+protected reads. Preserve contracts; reference success is not target realization.
+
 ## Interview phase
 **Skip if** the request names the model root, the application name, the destination and the
 decision on non-renderable scope. Otherwise ask only what is missing:
@@ -143,9 +149,8 @@ Adapters and non-renderable scope follow the contract rules of `cratis-applicati
   the Arc/Chronicle set in `cratis-stage-rendering-and-sandbox` `references/rendered-application.md`; API availability alone is not verified enforcement.
 - Adapters that call outside systems follow `cratis-engineering-effect-boundaries`; slice
   specifications follow `cratis-application-slice-specifications`.
-- Realization notes are the explicit realization requirements stated in a slice `description` or `documentation`
-  (definition: `cratis-application-slice-conformance`, `references/contract-and-precedence.md`).
-  Executable parts (specifications, mappings, constraints) win over prose, and a contradicting description is a model defect to report.
+- Read conformance's `references/contract-and-precedence.md` for realization-note
+  authority. Executable contract wins over prose; report contradictions.
 
 ## Rules
 

package/package/corpus/skills/cratis-screenplay-render-and-gap-fill/references/gap-fill-handoff.md

@@ -105,6 +105,14 @@ stable array or list. The Stage scaffold pins an older Arc, so raise the version
 `Customizations/Dependencies.props` only after a restore and build proves it. Never split the
 reaction or drop an effect to dodge rendering.
 
+Preserve declared `reaction batches atomic` boundaries: each trigger occurrence's
+direct productions and each selected refusal branch are separate batches, with
+invoked commands independent. Stage refuses v22 (STAGE-ESM-016) and atomic mode
+in admitted v23–v25 (STAGE-ESM-043); the declaration is not external-effect deduplication.
+For described handlers, hand off only payload computation under the v23 result
+contract; Stage STAGE-IMPL-002 means no stubs, even Stub mode. Protected v25 reads
+refuse STAGE-ESM-044 despite version admission and need target admission/enrollment tests; ordinary injection never supplies protection.
+
 ## Re-delivery
 The work list is the full in-scope contract delta since the fallback record's last verified source
 identity (specifications, rules, mappings, realization notes), then the whole contract is

package/package/corpus/skills/cratis-screenplay-render-and-gap-fill/references/renderability-gate.md

@@ -14,8 +14,10 @@ probe reports and choosing what to do. Do not copy the code table here.
 2. Execution planning builds the plan and can emit `PLAN-*` diagnostics before Stage runs.
 3. Stage plans the target and admits or rejects each member: `STAGE-ESM-0xx`; profile and path
    problems `STAGE-CRATIS-0xx`. An evolved event is reported with Stage's own `STAGE-ESM-026`
-   (still refused); the CLI adds nothing. Stage admits exact ESM v1–v17 and v19 pairs, not v18/v20; CLI admission remains bounded by its bundled renderer and
-   refuses each construct it does not render with its own code (see Stage's current code table, including `-024`, `-027`, `-028`, `-030` to `-041`).
+   (still refused); the CLI adds nothing. Read the owning Stage admission table and
+   toolchain `references/renderable-subset.md` for exact pairs and version minimums;
+   CLI admission remains bounded by its bundled renderer. Each unsupported construct
+   has its own code; version admission is not construct support.
 4. Any error in the selected scope publishes nothing: the run ends with exit 5 and the diagnostics.
    Without `--scope` the scope is the whole application. With `--scope`, `PLAN-*` problems in
    unselected slices are warnings and `STAGE-ESM-*` refusals in unselected slices do not block;
@@ -28,8 +30,8 @@ ESM). Only the probe answers renderability. `PLAY0270` entries are information,
 
 | Class | Meaning | Typical examples (each verified in `admission.md`) | Action |
 | --- | --- | --- | --- |
-| **Model fix (in mode)** | the model is in, or the user chose, renderable mode and breaks its own subset in a way that has a renderable equivalent with the same meaning | a `produces` whose `for` is not the command identifier; one `StateChange` slice with two commands (`STAGE-ESM-004`); two projections for one read model (`-007`); a policy Stage cannot express portably (`-015`; role-only and opaque pure policies render) | edit request to the modeler session with address, change and rationale |
-| **Capability gap** | the intended meaning needs a construct Stage does not render yet | a snapshot list query (`-010`; observable lists and keyed or unkeyed lists bind and observable lists render), DateTime equality filters and required parameters after optional filters (`-010`); context/single-result filters, opaque `scoped to`/`performer` and composite `by` remain PLAY0268; Translate, clocks, captures, non-event triggers and opaque reaction bodies (`-024`); claim-reading/opaque `runs as` gates (`-034`), legacy `from` (`-035`), mixed effects in one handler (`-037`, retries can duplicate events; keep it whole), unsupported reaction mappings (`-039`); unsupported generated types/result combinations (`-028`/`-038`); `then no readmodel` (`-027`); evolved events (`STAGE-ESM-026`); conditional `produces when` (`-006`); `reads` (`PLAY0271`); code validation (`-005`); protected identities/enums (`-040`), non-text secrets (`-041`) or unadmitted explicit subject lineage (`PLAY0268`); a command `handler` (`PLAY0268`) | keep the model; fallback record entry; options a to c in `SKILL.md`; link the Stage issue |
+| **Model fix (in mode)** | the model is in, or the user chose, renderable mode and breaks its own subset in a way that has a renderable equivalent with the same meaning | a `produces` whose `for` is not the command identifier; two projections for one read model (`-007`); a policy Stage cannot express portably (`-015`; role-only and opaque pure policies render) | edit request to the modeler session with address, change and rationale |
+| **Capability gap** | the intended meaning needs a construct Stage does not render yet | DateTime equality filters and required parameters after optional filters (`-010`); context/single-result filters, opaque `scoped to`/`performer` and composite `by` remain PLAY0268; Translate, clocks, captures, non-event triggers and opaque reaction bodies (`-024`); claim-reading/opaque `runs as` gates (`-034`), legacy `from` (`-035`), mixed effects in one handler (`-037`, retries can duplicate events; keep it whole), unsupported reaction mappings (`-039`); unsupported generated types/result combinations (`-028`/`-038`); `then no readmodel` (`-027`); evolved events (`STAGE-ESM-026`); unsupported expression/enum production conditions (`-006`; supported conditional productions render); legacy reads (`PLAY0271`), protected reads (STAGE-ESM-044 despite v25 admission); code validation (`-005`); protected identities/enums (`-040`) or unadmitted explicit subject lineage (`PLAY0268`); attached command handlers (PLAY0268), described handlers (v23, STAGE-IMPL-002 even Stub mode), atomic mode (STAGE-ESM-016 for v22, STAGE-ESM-043 in admitted v23–v25) | keep the model; fallback record entry; options a to c in `SKILL.md`; link the Stage issue |
 | **Tool skew** | the bundled compiler disagrees with documented semantics | the false `PLAY0285` on reaction cascades from an older bundle; codes the standalone compiler does not raise | record in the session state and the fallback record; never "fix" a correct model |
 | **Environment** | not the model | restore failures, missing SDK, a destination that is not writable | fix the environment or report blocked |
 

package/package/corpus/skills/cratis-screenplay-scenario-coverage/SKILL.md

@@ -7,11 +7,10 @@ license: MIT
 # Screenplay scenario coverage
 
 ## Purpose
-Turn designed slices into specifications that pin behaviour a business person would argue
-about. Decide **which** situations need a specification before writing any (coverage matrix),
-then write them with consistent example data in the form the chosen mode admits. Situations the
-language cannot express today are recorded, not faked. Grammar and outcome comparison live in
-`cratis-screenplay-specifications`; this skill owns coverage and method.
+Decide **which** situations need specifications in a coverage matrix, then use
+consistent example data and mode-admitted forms. Record inexpressible cases; never
+fake them. This skill owns coverage; `cratis-screenplay-specifications` owns grammar
+and outcome comparison.
 
 ## When / when not
 - Use: the scenario phase of `cratis-screenplay-modeling-lifecycle`; adding or changing a
@@ -33,11 +32,9 @@ Use it to seed, never replace, the matrix. Multi-step storylines remain unavaila
 lifecycle families emulate them.
 
 ## Interview phase
-**Skip if** the brief already states the coverage depth (rules, denials, state violations,
-retries, races), the critical rules with an allowed and a refused example each, how the specs
-will be used (reference only, executable, rendered and tested) and who validates them.
-Critical questions, one at a time, with follow-ups:
-Ask only what is missing: depth, known rules and edge cases (one allowed and the nearest refused request per rule), intended use (decides admitted forms), and who validates. Read [references/interview-batch.md](references/interview-batch.md) for the four questions and follow-ups.
+Ask only what is missing: coverage depth, allowed/refused rule examples, intended
+execution mode and who validates. Read [interview prompts](references/interview-batch.md)
+when these inputs are unsettled; skip answered questions.
 
 **Unattended:** assume visibly, never invent a rule, and record who actually answered; an agent asking itself four kinds of question is not four approvals.
 
@@ -64,23 +61,22 @@ Ask only what is missing: depth, known rules and edge cases (one allowed and the
    existing intentional fixtures (`references/scenario-catalogue.md` "Example data"). Shared
    fixtures may live as typed `example`s in another document beside the declarations they type
    (`cratis-screenplay-specifications` `references/examples-and-routes.md`).
-7. **Draft commands**: happy path, each rule, denial, duplicates and retries, competing claims,
-   state violations, alternative branches, compensation, external failure, evolution. In each
-   rejection vary only the value under test. Use typed `parameter`/named `case`
-   tables for a shared validation matrix, not for unrelated behaviors; rows are
-   cases, not typed fixture `example`s. `given caller as <Persona>` supplies one
-   authenticated policy witness for success/denial; use explicit callers for
-   anonymous/ownership or unsynthesizable personas. Syntax and complete model:
-   `cratis-screenplay-specifications` `references/persona-callers-and-cases.md`.
+7. **Draft commands** for each applicable scenario type below. Vary only the value
+   under test in a rejection. Read specifications'
+   [persona callers and cases](../cratis-screenplay-specifications/references/persona-callers-and-cases.md)
+   when sharing a validation matrix or choosing synthesized versus explicit callers;
+   cases are not fixture examples and do not group unrelated behaviors.
 8. **Separate view pass**: population, each update, accumulation, removal (with a surviving
    row), absence, ordering. Mark lifecycle branches. Views combining sources must
    tolerate any arrival order. Pin a child before its parent (Requires Screenplay 4.149.1 or later):
    given child, then parent, then read model; "parent never arrives" leaves the
    child absent. Evidence/example: `references/view-and-story-specs.md`.
-9. **State-dependent rules**: `reads <View>` + `require <expr> message "..."` as stated intent,
-   marked **NOT enforced in the model today** in the slice `description` (binding reports
-   PLAY0268/0271: expected in design mode; Screenplay#129), target named (Arc
-   `[ProtectedDecision]` + `DecisionRead<T>`, Chronicle DCB, or a constraint). Forbidden:
+9. **State-dependent rules**: use `reads` plus `require` over authoritative state;
+   eligible views opt into `command reads protected` (v25). Cover present/absent reads,
+   refusal and denial; matching decide/commit changes are conflicts, not refusals.
+   Read [protected reads](../cratis-screenplay-command-surface/references/protected-reads.md)
+   for admission and Stage refusal; legacy/refused shapes remain marked unenforced
+   with a named target mechanism. Forbidden:
    caller-supplied copies of state in `require`, boolean attestation inputs (`confirmsX ==
    true`) and rules hidden in `handler`/hint prose. Never drop an unresolved given or assertion
    to make a spec compile: record the blocked case and continue.
@@ -91,6 +87,16 @@ Ask only what is missing: depth, known rules and edge cases (one allowed and the
 ## Scenario types (decide each per command; detail in `references/scenario-catalogue.md`)
 Decide each of these per command: happy path; rule rejection (one spec per rule, exact pinned `then error`); denial (`given caller` without the policy, `then denied`, one per gated command and query); state violation; duplicate or retry; competing claim; alternative path; ordering; external failure; compensation; evolution; and the view pass. Read [references/scenario-catalogue.md](references/scenario-catalogue.md) ("Scenario types at a glance") for each type's question and usual shape.
 
+For command Date/DateTime ordering, cover increasing and inverted intervals,
+equality across offsets, a one-tick boundary and **each participating DateTime
+input without an offset or Z**. That last case rejects with Validation before rules,
+even if a condition short-circuits or a production is skipped. `then` stays ordinal;
+never replace payload text with an equivalent instant. Read the complete
+[retention-window specifications](../cratis-screenplay-command-surface/references/date-comparisons.md)
+for the compiler prerequisite, admitted positions, refused `today` and Stage's v26
+refusal. Missing-offset runtime coverage needs an evaluator-request or target input
+test: a typed `.play` fixture rejects that value at binding with PLAY0273, before runtime.
+
 For recovery, `when redelivered <Event> to <Reaction>` must select one definitely
 matching effective given and no undecided candidate. It delivers only to the named
 reaction without re-appending the input; `then no events` explicitly checks no
@@ -101,11 +107,10 @@ when specifying malformed keys/filters versus valid absence (ESM v18).
 Requires Screenplay 4.157.0 (`screenplay --version`) for v17, 4.161.0 for query
 validation/error assertions; older tools do not execute these contracts.
 
-**Once, idempotent, exactly once are different claims.** A `unique event` constraint proves the
-*fact* occurs once per event source; it does not make *command handling* idempotent (a retry is
-rejected, not answered with success), and nothing in the model proves an *external effect* (an
-email, a payment) happens exactly once. Say which of the three a spec proves; record the rest as
-target requirements.
+**Once, idempotent, exactly once are different claims.** `unique event` proves a once-only fact,
+not successful retry handling or an exactly-once external effect. Name the claim
+proved and keep other guarantees as target requirements; recovery cases are in
+`references/scenario-catalogue.md`.
 
 ## Rules
 ### Compiler contracts
@@ -116,7 +121,8 @@ target requirements.
   or query spec needs `given caller` or `given caller as <Persona>` (module and feature gates count); an authorized scenario
   gets no inferred fixture (PLAY0389). Unauthorized is never `then error`.
 - Duplicate and competing specs use `when <Command>`; `when append` is for projection and
-  automation triggers, and for a constraint the command's own validation would reject first.
+  automation triggers, consumed public events driving captures, and for a
+  constraint the command's own validation would reject first.
 - `null` only for optional read-model properties; constraint messages are copied verbatim.
 - Executable-only binding checks (PLAY0350/0352/0388/0389/0273) do not show in V1: run V3.
 
@@ -126,9 +132,12 @@ target requirements.
   (denial), `<View>LifecycleN<State>` for families.
 - `for` on every given, appended and expected event (plain `produces <Name>` too; inline `produces event` omits it), and on the `when` command where the
   destination matters. A competing-claim given needs a *different* `for`.
+  Foreign event fixtures feeding a capture may omit `for`; supplied `for` is
+  opaque source text, not the capture's content key.
 - Format rules belong on a `concept`: give each concept rule representative acceptance,
   rejection and boundary specs once (through one command that carries it), not on every use;
-  never `n/a` automatically. Include a whitespace-only rejection for text `not empty`:
+  never `n/a` automatically. Date/DateTime comparisons are command-only, not concept rules.
+  Include a whitespace-only rejection for text `not empty`:
   this changes outcomes in every ESM version (Requires Screenplay 4.151.0 or later). Unicode/identity boundaries
   and evidence: command-surface `references/validate-rules.md`.
   A business rule gets one rejection spec if an expert could recognize it from its message;
@@ -149,7 +158,16 @@ Read [references/review-questions.md](references/review-questions.md) for the ra
 
 ## Public-event coverage (ESM v9)
 
-Outbound publication needs `when append <private>` and `then <PublicEvent>`. Read [references/public-event-coverage.md](references/public-event-coverage.md) when specifying public events or routed producers and observers.
+Outbound publication needs `when append <private>` and `then <PublicEvent>`.
+Captures over public events use `given <FromEvent>` / `when append <FromEvent>`,
+not capture records (PLAY0701). Read [references/public-event-coverage.md](references/public-event-coverage.md)
+when specifying public events or routed producers and observers.
+
+Record captures distinguish first sight from updates: first root/child/nested
+records are added only, so field guards need `given capture` for the same key.
+Use a separate `when added` append when initial observations should produce a fact.
+Read captures-and-reactions `references/record-capture-specifications.md` for the
+prerequisite and runnable cases. Include first, changed and unchanged rows in the matrix.
 
 ## Version skew: reaction cascades and false PLAY0285
 Under ESM v6 a command spec's `then` lists the events reactions cascade from it; an older `cratis` bundle reports a **false PLAY0285** for it. Never delete the reaction. Read [references/version-skew.md](references/version-skew.md) when a spec with cascade events reports PLAY0285 or the bundled compiler is older than the standalone tool.

package/package/corpus/skills/cratis-screenplay-scenario-coverage/references/berth-reservations.md

@@ -1,5 +1,11 @@
 # Berth reservations: worked example
 
+This is a legacy control without `command reads protected`; the unprotected-read
+markers below describe that control, not all command reads. Eligible views can opt
+into v25; the date-rule blocker still remains. Read
+[protected reads](../../cratis-screenplay-command-surface/references/protected-reads.md)
+for admission and Stage's protected-read refusal (STAGE-ESM-044).
+
 Complete, compiled design-mode model (marina guest berths) showing a coverage matrix turned into specifications: happy path, one rejection per rule, authorization denial, duplicate and retry, competing claim, state violation, alternative branches, compensation and a view lifecycle family. The matrix for it is in `coverage-matrix.md`; the catalogue (`scenario-catalogue.md`) names its specifications.
 
 ```screenplay test=unbound
@@ -12,8 +18,8 @@ Complete, compiled design-mode model (marina guest berths) showing a coverage ma
 // + `require ... message` and marked NOT enforced in the slice descriptions, with their target
 // named. Binding reports PLAY0271/PLAY0268 for them (expected; Screenplay#129): such a model
 // is design-complete but not binding-ready, and that is reported, never "fixed" by deleting the
-// rules. The past-date rule (`night >= today`) is declarative too: ESM v1 has no runtime date,
-// so binding reports PLAY0268 on it (recorded as blocked, not moved into prose); the rule and its rejection
+// rules. The past-date rule (`night >= today`) is declarative too: `today` has no runtime date
+// value, so binding reports PLAY0268 on it (recorded as blocked, not moved into prose); the rule and its rejection
 // specification stay so the intent executes once a date value exists.
 // Verified: V1 (warnings as errors). V3 binding is blocked by the stored-state and date rules.
 
@@ -30,7 +36,7 @@ module Berths
     authorize IsHarbourOffice
 
     slice StateChange ReserveBerth
-      description "One guest boat per berth per night. OneBoatPerBerthNight declares that two event sources cannot hold the same berth-night; the competing-claim specification pins the loser's rejection after an earlier holder. It neither runs two commands at once nor proves the runtime's index-and-append behaviour under failure: that needs target-level verification. A retried ReserveBerth with the same reservation id is refused by ReserveOnce: the fact occurs once, but the retry is NOT answered with success, so a client that lost the first acknowledgement must treat this rejection as 'already reserved' (idempotent handling is a target decision, recorded as an open question). The night must not be in the past: declared in `validate` (`night >= today`) with its rejection specification. Binding reports PLAY0268 for date comparisons today (ESM v1 has no runtime date value), so this rule is design-complete but blocks V3 until Screenplay supports it."
+      description "One guest boat per berth per night. OneBoatPerBerthNight declares that two event sources cannot hold the same berth-night; the competing-claim specification pins the loser's rejection after an earlier holder. It neither runs two commands at once nor proves the runtime's index-and-append behaviour under failure: that needs target-level verification. A retried ReserveBerth with the same reservation id is refused by ReserveOnce: the fact occurs once, but the retry is NOT answered with success, so a client that lost the first acknowledgement must treat this rejection as 'already reserved' (idempotent handling is a target decision, recorded as an open question). The night must not be in the past: declared in `validate` (`night >= today`) with its rejection specification. Binding reports PLAY0268 for the `today` operand, which has no runtime date value (comparisons between Date or DateTime command properties, or against literals, bind), so this rule is design-complete but blocks V3 until Screenplay supports `today`."
       command ReserveBerth
         reservationId ReservationId identifier
         berth         BerthCode
@@ -93,7 +99,7 @@ module Berths
           boatLength    = 31
         then error "Guest berths take boats up to 24 metres"
 
-      // Declarative past-date rule; binding is blocked for date comparisons (see header).
+      // Declarative past-date rule; binding is blocked for the `today` operand (see header).
       specification RejectingANightInThePast
         given caller
           authenticated

package/package/corpus/skills/cratis-screenplay-scenario-coverage/references/invoicing-dues-design.md

@@ -1,6 +1,13 @@
 # Invoicing and dues: design-mode document for the stored-state rules
 
-**Design mode, not binding-ready by design.** This document states the stored-state rules of the
+**Legacy control without `command reads protected`, not binding-ready by design.**
+Read [protected reads](../../cratis-screenplay-command-surface/references/protected-reads.md)
+for the opt-in alternative. Do not insert the preamble blindly: every read must meet
+finite event-source-keyed admission with removals. A v25 reference pass still does not
+render protected reads: Stage admits v25 but refuses them with STAGE-ESM-044. The comments and unenforced markers below describe
+this legacy control, not a general limit on command reads.
+
+**Design mode.** This document states the stored-state rules of the
 invoicing example as the skill requires (`reads <View>` + `require ... message`, marked NOT
 enforced in the slice `description`, target named). It compiles (V1, warnings as errors) but
 does not bind, and the only blockers are `reads` (PLAY0271) and `require` over
@@ -17,7 +24,7 @@ The excerpt's Stage API-availability comment describes the historical Stage 4.24
 scaffold. Stage 4.73.1's scaffold pins an Arc/Chronicle set (see the Stage skill's `references/rendered-application.md`): protected-read APIs are
 available to gap-fill (the "not in a Stage-rendered application" comment in the source is
 superseded), not emitted protection or `.play` rule admission. The
-original compiled source is retained unchanged.
+capture uses separate first-sight/update appends, with its local-event follow-up in Automation.
 
 ```screenplay expect PLAY0516 test=unbound
 // Scenario coverage design-mode example: stored-state rules of invoicing club dues (complete document).
@@ -89,6 +96,10 @@ module Invoicing
           outcome = outcome translate
             "C" => captured
             "D" => declined
+        append PaymentGatewayResultReceived
+          when added
+            outcome = $.outcome
+            reason  = $.reason
         append PaymentGatewayResultReceived
           when outcome
             outcome = $.outcome
@@ -96,15 +107,15 @@ module Invoicing
       event PaymentGatewayResultReceived
         outcome GatewayOutcome
         reason  String
-      event PaymentReceived
 
-    slice Automation TranslatePaymentGatewayResults
+    slice Automation RecordPaymentOutcome
       description "Gives PaymentReceived its producer: the translator reacts to the provider's external fact"
       reaction ReceivedTranslator
         when PaymentGatewayResultReceived
           outcome
           produces PaymentReceived
         where outcome == "captured"
+      event PaymentReceived
 
     slice StateChange SettleOrVoidInvoice
       description "An invoice ends either settled or voided, never both (SettleOrVoid, enforced at append). NOT enforced in the model today: that the invoice exists and is still open (settling) and that only an open, unpaid invoice may be voided. Stated as `reads OpenInvoice` + `require` (PLAY0271/PLAY0268 at binding; Screenplay#129). Target: Arc [ProtectedDecision] with DecisionRead, or a Chronicle DCB. Requirements to test in the target: settling an unknown invoice is rejected; voiding a paid invoice is rejected; voiding an open invoice succeeds."

package/package/corpus/skills/cratis-screenplay-scenario-coverage/references/invoicing-dues-example.md

@@ -13,8 +13,10 @@ destination-type information; a reaction can also consume events from a capture
 
 **Scope.** This document is the runnable demonstration only. It deliberately holds no rule that
 depends on stored state (the invoice must exist, only an open invoice may be voided, a reversal
-needs a received payment, `reads` + `require`): those rules cannot bind or run at Screenplay
-4.66.0 (PLAY0271, PLAY0268) and are stated in the design-mode document `invoicing-dues-design.md`,
+needs a received payment, `reads` + `require`): the legacy design control lacks
+`command reads protected` and retains PLAY0271/PLAY0268. Eligible reads can opt into
+v25; see command-surface protected-read admission and Stage refusal. The rules stay
+in the design-mode document `invoicing-dues-design.md`,
 never in prose here. It shows the category shapes; for a coverage example see `berth-reservations.md`.
 
 ```screenplay
@@ -208,27 +210,13 @@ module Invoicing
           when added
             outcome = $.outcome
             reason  = $.reason
+        append PaymentGatewayResultReceived
+          when outcome
+            outcome = $.outcome
+            reason  = $.reason
       event PaymentGatewayResultReceived
         outcome GatewayOutcome
         reason  String
-      event PaymentReceived
-      event PaymentDeclined
-        reason String
-
-    slice Automation TranslatePaymentGatewayResults
-      description "Our facts from the provider's: the translators react to the external fact the Translate slice records"
-      reaction ReceivedTranslator
-        when PaymentGatewayResultReceived
-          outcome
-          produces PaymentReceived
-        where outcome == "captured"
-      reaction DeclinedTranslator
-        when PaymentGatewayResultReceived
-          outcome
-          reason
-          produces PaymentDeclined
-            reason = reason
-        where outcome == "declined"
 
       specification TranslatingADeclinedCardResult
         when capture PaymentGatewayResults
@@ -243,6 +231,23 @@ module Invoicing
           for "9c1f0a52-6a4e-4b1c-9f55-0d2c7b8e1a01"
           reason = "Card declined"
 
+    slice Automation RecordPaymentOutcome
+      reaction ReceivedTranslator
+        when PaymentGatewayResultReceived
+          outcome
+          produces PaymentReceived
+        where outcome == "captured"
+      reaction DeclinedTranslator
+        when PaymentGatewayResultReceived
+          outcome
+          reason
+          produces PaymentDeclined
+            reason = reason
+        where outcome == "declined"
+      event PaymentReceived
+      event PaymentDeclined
+        reason String
+
     slice StateView OpenInvoices
       description "Todo list: membership means 'still to collect'; there is no status flag."
       readmodel OpenInvoice

package/package/corpus/skills/cratis-screenplay-scenario-coverage/references/public-event-coverage.md

@@ -4,9 +4,20 @@ Coverage for public events and routed producers.
 
 Outbound publication needs `when append <private>` and `then <PublicEvent>`:
 complete state, incomplete state, unchanged repeat, changed instance, separate
-source ids and the exported field boundary. Reference publication is executable;
-source-event captures and reached opaque event-target reducers are typed
-Unsupported. Read automations-and-translations `references/public-events-and-direction.md`.
+source ids and the exported field boundary. Reference publication and admitted
+source-event captures execute; reached opaque event-target reducers remain typed
+Unsupported. Read automations-and-translations `references/public-events-and-direction.md`
+for the prerequisite and complete typed capture specifications.
+
+For `source events`, use `given <FromEvent>` / `when append <FromEvent>`, not
+`given capture` / `when capture` (PLAY0701). Cover first added, unchanged overlays,
+updates after ordered givens, properties retained across different event types,
+and independent keys. The key must be required on every source event, not a
+context key (PLAY0700); optional foreign fixture `for` is not that key.
+Assertions list all follow-up facts, never the input append itself. Mixed capture
+and reaction expectations may need `then events in any order`; this is not proof
+of observer order or redelivery deduplication. Children/nested over events and
+context members other than `occurred` are not admitted execution.
 For routed producers/observers, cover override versus inherited route, skipped
 production route failure, matching/wrong source/stream and unrouted facts;
 see toolchain `references/production-routes-and-filters.md`.

package/package/corpus/skills/cratis-screenplay-scenario-coverage/references/scenario-examples.md

@@ -15,8 +15,10 @@ easily. Every excerpt below is copied verbatim from the complete document in
 `invoicing-dues-example.md`, which compiles with warnings as errors and whose 23 specifications
 pass in the reference evaluator; it also holds the declarations the excerpts depend on. The two
 compensation excerpts in section 4 come from `invoicing-dues-design.md` instead: that document
-holds the stored-state rules (`reads` + `require`), compiles but does not bind (PLAY0271,
-PLAY0268), so its specifications are design mode and do not run. A second
+holds stored-state rules as a legacy control without `command reads protected`, so
+it compiles but does not bind (PLAY0271/PLAY0268) and its design specs do not run.
+Eligible reads can instead opt into v25; inspect admission and keep Stage refusal
+separate (command-surface [protected reads](../../cratis-screenplay-command-surface/references/protected-reads.md)). A second
 complete example, with competing claims and denial fixtures, is `berth-reservations.md`. The category structure and the good/bad contrast follow the worked
 examples in `eventmodeling-elaborating-scenarios` by TrogonStack and by Martin Dilger and Nebulit GmbH (`provenance.md`), translated to
 Screenplay specifications.
@@ -104,7 +106,11 @@ in `invoicing-dues-design.md`; it is never prose and never a spec that pretends
 ## 3. External failure: the capture, then the retry
 Two separate obligations. First, the **capture specification**: concrete external input in, our
 facts out. The provider's refusal is a fact (never a `then error`), kept in the provider's
-vocabulary and then translated.
+vocabulary; a separate Automation records the local outcome. The capture uses
+`when added` for first sight and a separate `when outcome` for updates. An update
+spec needs `given capture` with the same key's earlier record; the first record's
+fields are not modifications (root, child or nested). See captures-and-reactions
+`references/record-capture-specifications.md` for runnable first/update/repeat cases.
 ```screenplay excerpt parent=references/invoicing-dues-example.md#1
 specification TranslatingADeclinedCardResult
   when capture PaymentGatewayResults

package/package/corpus/skills/cratis-screenplay-scenario-coverage/references/spec-forms-by-mode.md

@@ -21,7 +21,8 @@ Typed example/override forms: `cratis-screenplay-specifications`
 | Context `from`, single-result filters, `scoped to`, `performer` or composite `by` | yes | PLAY0268: query context, collection-only filtering, opaque scope/implementation or multipart lookup are unadmitted | no |
 | `then no readmodel <RM> for "<key>"` | yes | yes | no |
 | `when query` -> `then result` / `then no result` | yes | yes | same as `then query`: only the query-only cases below |
-| `given clock` / `when clock`, `when trigger`, `given`/`when capture` | yes | yes (standalone and any cratis whose compiler admits v6; an older bundle does not, see toolchain `references/executable-subset.md`) | no |
+| `given clock` / `when clock`, `when trigger`, record-source `given`/`when capture` | yes | yes (standalone and any cratis whose compiler admits v6; an older bundle does not, see toolchain `references/executable-subset.md`) | no |
+| Event-source capture fixtures | `given <FromEvent>` / `when append <FromEvent>`, not capture records (PLAY0701) | admitted root capture behavior executes; see `public-event-coverage.md` for prerequisites and limits | separate target admission |
 | Command spec listing reaction cascade events | yes (v6 semantics) | false PLAY0285 on an older cratis bundle only; see SKILL.md "Version skew" | no: STAGE-ESM-011; generated CommandScenario does not settle reactions |
 | `generated <name> = <value>` under `when`, `then returns` (ESM v7) | yes | yes on a compiler that admits v7 (PLAY0268 on an older bundle) | yes on Stage for supported UUID/String strategies and v15 freshness and scalar/named responses; unsupported types/combinations remain -028/-038 |
 | v15 generation strategy fixtures and used-source rejection | yes | strict encoding/size/case/version/variant; Contract for invalid pins, Concurrency for reused source | supported strategies/freshness render; invalid pins refuse -011, unpinned unordered/projected assertions -038; source: command-surface `references/generated-values-and-responses.md` |
@@ -33,9 +34,13 @@ Typed example/override forms: `cratis-screenplay-specifications`
 | Refusal branches, `$refusal` | yes | ESM v19; first matching branch wins | Stage supported subset; -039 for unfaithful refusal details/trigger groups, -011 for specification limits |
 | Query `then error` | yes | ESM v18; one query/one error, no result/denial | requires target v18 admission; a v19-capable renderer does not necessarily admit v18 |
 | Composite (JSON) values in specs | yes | yes | no |
-| Rules over dates or `today`, nested paths | spec them in design | rule does not bind: `recorded` | `recorded` |
+| Same-primitive `Date`/`DateTime` comparisons in `require`, `produces when` and command or property validation rules (v26; Requires Screenplay 4.199.0; see [date comparisons](../../cratis-screenplay-command-surface/references/date-comparisons.md)) | spec them | binds and executes; a `DateTime` input without an offset is a Validation rejection | v26 STAGE-ESM-016: gap-fill |
+| Date rules using `today`, `$context`, mixed `Date`/`DateTime`, concept or reaction-`where` positions; nested paths | spec them in design | rule does not bind: `recorded` | `recorded` |
 | Bodied rules, code policies | spec them | spec reported **unsupported**, never passed | no |
-| Command handlers, `file` constraints, query `performer`s | spec them in design | blocked: PLAY0268 at binding, no spec runs (V3 blocked) | no |
+| Pending described command handlers (v23) | specify intent | binds; denial/validation execute, body-reaching specs Unsupported ImplementationBody; all-Unsupported is not green | STAGE-IMPL-002 even Stub mode |
+| Attached command handlers, `file` constraints, query `performer`s | spec them in design | blocked: PLAY0268 at binding, no spec runs (V3 blocked) | no |
+| Atomic reaction mode (v22) | declare for new models | failed batch adds no facts or view changes; earlier batches/commands remain; `then error` alone is insufficient | v22 STAGE-ESM-016; mode in admitted v23–v25 STAGE-ESM-043 |
+| Protected command reads (v25) | declare opt-in for eligible reads | absence Validation; matching intervening facts Conflict; race vectors are not a new spec construct | protected reads STAGE-ESM-044; v25 pair admitted |
 
 Requires Screenplay 4.105.0 or later (`screenplay --version`) for list-query specifications, and 4.143.0 or later for collection equality filters (ESM v14).
 
@@ -49,7 +54,7 @@ older cratis bundle is available). Mark each such spec in the coverage matrix as
 `gap: <reason>` for the narrower modes so the verification and render phases know what will not execute.
 
 ## Executable mode
-- Every gated spec has `given caller`; every given/expected event has `for`, and so does every plain `produces <Name>` (inline `produces event` omits it and defaults to the identifier).
+- Every gated spec has `given caller`; local given/expected events have `for`, and so does every plain `produces <Name>` (inline `produces event` omits it and defaults to the identifier). Foreign event fixtures driving captures may omit `for`; a supplied value is opaque source text, not the capture key.
 - Each read model has one key shared by its keyed `=> RM optional` queries; the identifier equals
   the projection's effective key (`cratis-screenplay-slice-design` `references/read-model-design.md`
   decision table). View specs assert through a keyed query.

package/package/corpus/skills/cratis-screenplay-slice-design/SKILL.md

@@ -157,7 +157,9 @@ When `.screenplay/identities.json` exists, adding, removing or renaming an addre
 Slice design is done when these hold; otherwise report what is open.
 
 - [ ] Every command: origin reachable and authorized; every input traced; rules placed by
-      layer; stored-state rules recorded NOT enforced with a named target; no form-verb name.
+      layer; stored-state rules use admitted protected reads, or name the refused shape
+      and target gap; no form-verb name. Read [protected reads](../cratis-screenplay-command-surface/references/protected-reads.md)
+      for opt-in and Stage refusal; reference protection is not target realization.
 - [ ] Every command has a refusal inventory (success, each refusal with layer and message,
       denied persona); every gated command and query has a `then denied` row.
 - [ ] Every event is past tense, a specific change, and consumed or justified.

package/package/corpus/skills/cratis-screenplay-slice-design/references/command-inventory.md

@@ -171,13 +171,13 @@ Rules for filling it:
 | AssignLocker | caller is not an attendant | `authorize IsAttendant` | denied: Customer | RefusingACustomerAssigningALocker |
 | AssignLocker | locker already has a request | constraint `OneRequestPerLocker` | "The locker is already assigned" | AppendingASecondAssignmentOfALocker (`when append`: the command's own `require` would reject first) |
 | AssignLocker | request already has a locker | constraint `OneLockerPerRequest` | "The request already has a locker" | gap |
-| AssignLocker | locker is not free | `reads` + `require`, NOT enforced today | "The locker is not free"; target: `[ProtectedDecision]` (Arc 22.39.0+; available to Stage 4.73.1 gap-fill, not emitted protection) or DCB on the locker stream | RejectingASecondAssignmentOfALocker (pins the message; blocked until the target exists) |
-| AssignLocker | request is not waiting | `reads` + `require`, NOT enforced today | "The request is not waiting for a locker" | gap (same) |
+| AssignLocker | locker is not free | Legacy example lacks protected-read opt-in; inspect v25 admission and Stage gap | "The locker is not free"; target: `[ProtectedDecision]` (Arc 22.39.0+; available to Stage 4.73.1 gap-fill, not emitted protection) or DCB on the locker stream | RejectingASecondAssignmentOfALocker (pins the message; blocked until the target exists) |
+| AssignLocker | request is not waiting | Legacy example lacks protected-read opt-in; inspect v25 admission and Stage gap | "The request is not waiting for a locker" | gap (same) |
 | LockerById, ListLockers | caller is anonymous | module `authorize IsAuthenticated` | denied: no caller | RefusingAnAnonymousLockerLookup, RefusingAnAnonymousLockerList |
 | RequestById | caller is anonymous | module `authorize IsAuthenticated` | denied: no caller | RefusingAnAnonymousRequestLookup |
 
-The gaps are the hand-off: most are cheap rejection specs, and two are blocked on a target the
-model cannot express yet. A model whose inventory shows no gaps at design time has probably
+The gaps are the hand-off: most are cheap rejection specs, and two need protected-read admission plus separately verified target realization;
+the legacy example has not opted into v25. A model whose inventory shows no gaps at design time has probably
 not been asked the refusal questions.
 
 ## Common mistakes

package/package/corpus/skills/cratis-screenplay-slice-design/references/rule-layers.md

@@ -11,14 +11,16 @@ code only as XML doc comments (Stage#178): a rule that exists only in prose is u
 | who may ask | `authorize` with a policy (role, claim, authenticated) | enclosing gates combine with AND and run first. Gates every command and query in a feature shares go on the feature or module so a new path inherits them |
 | whose instance | policy `claim "x" matches subject` (the command identifier) or `matches <command property>` | executable; renders for text, Uuid, Date and DateTime subjects; an authorized command needs exactly one identifier (STAGE-ESM-015 otherwise) |
 | uniqueness, once-only facts | `constraint` (`unique ... on`, `unique event`) | append-time; the constraint name is its identity |
-| stored state (record exists, balance, current status) | `reads <View>` + `require <expr> message "..."` | stated intent, **NOT enforced in the model today** (PLAY0268/0271 at binding are expected in design mode). Name the target: Arc `[ProtectedDecision]` + `DecisionRead<T>` (Requires Arc 22.39.0 or later), Chronicle DCB (`concurrency` scope), or a constraint |
+| stored state (record exists, balance, current status) | `reads <View>` + `require` with an indented message | opt eligible reads into `command reads protected` (v25); absence Validation, matching intervening facts Conflict. Legacy/refused shapes stay stated intent with a named target mechanism |
 
 An unguarded materialized read is unsafe for a protected decision; a guarded read is the
 supported route. Availability: `[ProtectedDecision]` and `DecisionRead<T>` exist in
 the Arc/Chronicle package set Stage scaffolds (see the Stage skill's `references/rendered-application.md`), but Stage does not emit
 protected decisions. Gap-fill must use an admitted projection/key shape and active
 unit-of-work enrollment; do not edit managed dependencies. Keep the `.play` rule
-NOT enforced until its target enforcement is separately verified. Forbidden: caller-supplied copies of state in `require`, boolean attestation
+target enforcement separate from reference semantics until target tests verify it.
+Read [protected command reads](../../cratis-screenplay-command-surface/references/protected-reads.md)
+for admission and Stage's protected-read refusal (STAGE-ESM-044); never remove protection to obtain rendering. Forbidden: caller-supplied copies of state in `require`, boolean attestation
 inputs (`confirmsX == true`), rules in `handler` / implementation-hint prose.
 
 ## Authorization is executable