@cratis/pi 7.62.0 → 7.64.0

package/package/corpus/skills/cratis-screenplay-slice-design/references/slicing.md

@@ -97,14 +97,15 @@ module Moorings
 Record, per slice, the events it consumes and which slice produces each. This is for
 orientation, not a build order: view specifications use synthetic `given` events, so slices
 are built and checked independently. A command or reaction may consult another slice's view
-(`reads`; unprotected in `.play`, see `rule-layers.md`). A slice never calls another slice's
+(`reads`; eligible command reads can opt into v25 protection, trigger reads cannot;
+see `rule-layers.md` for target gaps). A slice never calls another slice's
 command except through `invokes`. Dependencies run in one direction; a cycle through events
 means the story is a feedback loop that belongs in an `Automation` slice.
 
 The contract between slices is events: slice B depends on slice A because B's command, rule
 or view needs an event A produces. Two other edges are supported and recorded explicitly, never
-implied: `reads <View>` from another slice (unprotected, so a stored-state rule over it stays
-NOT enforced, `rule-layers.md`) and `invokes <Command>` from a reaction. No shared state or
+implied: `reads <View>` from another slice (declare protected-command opt-in and
+admission, or mark the legacy/refused shape and target gap, `rule-layers.md`) and `invokes <Command>` from a reaction. No shared state or
 other direct call. Name each
 slice after its element (the command, the view, the automation, the translation (capture or translator reaction)), not a broader feature name
 that spans several. Per slice, record:

package/package/corpus/skills/cratis-screenplay-slice-design/references/worked-example.md

@@ -1,13 +1,13 @@
 # Worked example: parcel lockers (design mode)
 
-One complete model for `cratis-screenplay-slice-design`. It is in **design mode**: V1 clean
-(compiles with warnings as errors); V3 is blocked on purpose by the `ListLockers` list query
-(`PLAY0268` at binding); `given clock` also failed binding on a cratis before 3.28.2 bundle (3.28.2 binds it)
-(`cratis-screenplay-toolchain` `SKILL.md`). Personas and screens are informational.
-The stored-state rules in `AssignLocker` (`reads` + `require`) are intent, not enforced today,
-and they also fail binding on their own: `PLAY0271` on each `reads`, and `PLAY0268` because the
-`require` operands (`locker.assigned`, `request.state`) must be command properties. So this
-document is design mode as a whole: V3 is blocked twice over and no specification runs here.
+One complete legacy design-mode control for `cratis-screenplay-slice-design`, without
+`command reads protected`. Its reads and read paths retain PLAY0271/PLAY0268, so no
+specification runs here. List queries and clock fixtures bind on an admitting compiler;
+they are not the remaining blocker. Personas and screens are informational.
+Eligible command reads can opt into v25; inspect every projection/key/removal before
+migration and retain Stage's separate refusal (STAGE-ESM-044; the v25 pair itself is admitted). Read
+[protected reads](../../cratis-screenplay-command-surface/references/protected-reads.md).
+The unenforced descriptions below refer to this legacy control, not all command reads.
 The specifications still seed every read-model source (`LockerInstalled`, `LockerRequested`,
 complete givens) so they are the right form once binding is possible.
 Lineage matrix: `field-lineage.md`. State-transition table and rule coverage: `slicing.md`.

package/package/corpus/skills/cratis-screenplay-specifications/SKILL.md

@@ -40,41 +40,61 @@ Screenplay's reference runner executes specifications against an immutable
 in-memory world: no Arc, no Chronicle, no database, no network. Every downstream
 target has one normalized behavior to match.
 
-- It runs the capabilities the execution plan admits: declarative validation
-  and `require` over command properties, conditional production, literal tags,
-  declarative policies, `unique` constraints, and projections as Chronicle
-  lowers them. The `cratis-screenplay-model-authoring` language reference lists
-  what binds and what the plan admits.
-- Binding is not admission. These projection constructs bind, but the plan
-  refuses them: a projection-level `remove via join`; `all` beside removals,
-  `children` or `nested`; a `join`, `children` or `remove via join` inside
-  `nested`; and any `$eventContext.<path>` other than `eventSourceId`, such as
-  `$eventContext.occurred`. The limits apply at every ESM version.
-- A specification that needs **opaque code** — a bodied reducer, a rule with a
-  body, a fenced `validate` block, a code policy, or (ESM v6) a reached reaction
-  body — returns **unsupported** and
-  never passes. Authorization is evaluated first, so a `then denied` case still
-  runs when a portable policy decides it. Other specifications in the model run
-  normally.
-- Unsupported reachable declarative constructs block the whole execution plan
-  rather than running partially: no specification in the model runs, including
-  the ones that never touch the refused construct.
-- Reactions: before ESM v6 they never run, not even after `when append`. From ESM
-  v6 they run after every action, as in "Reactions and
-  cascades" ([references/reactions-and-cascades.md](references/reactions-and-cascades.md)). A compiler that stops before ESM v6 fails `when clock`, `when trigger`
-  and `when capture` binding with `PLAY0268`, and so reactions and captures.
-- Children defer until their parent exists; an ambiguous parent still fails closed.
-  [Child ordering](references/child-ordering.md): specs and routing caveat.
-
-  Requires Screenplay 4.149.1 or later (`screenplay --version`) for child deferral.
-- A rejected individual command or append leaves the world unchanged; an accepted
-  one commits once, then the read models and queries are compared. There is no
-  scenario-wide transaction in v6: when a later effect of a cascade or capture
-  rejects, the earlier accepted facts and their projections remain.
-
-Unsupported is not passed. Report it as "needs a target", not as green. "Specified"
-and "bound" are never "passing": run the reference CLI/MCP route or the owning
-target tests, and name the engine, version and expected/discovered selection.
+Binding is not plan admission. Read model-authoring's
+[language reference](../cratis-screenplay-model-authoring/references/language-reference.md)
+when distinguishing executable declarations, refused projection shapes and opaque
+code. Reached opaque code is **unsupported**, never passed; portable denial may
+still execute before it. Unsupported declarative constructs block the whole plan,
+not just the specifications that touch them.
+
+Read [reactions and cascades](references/reactions-and-cascades.md) when testing
+ESM v6 actions; older compilers fail reaction/capture binding with PLAY0268.
+Read [child ordering](references/child-ordering.md) for deferral;
+an ambiguous parent still fails closed.
+Requires Screenplay 4.149.1 or later (`screenplay --version`) for child deferral; older runners do not defer.
+
+A rejected command/append leaves the world unchanged; an accepted one commits
+before comparing views. V6 has no scenario-wide transaction: later cascade
+failure does not roll back earlier accepted facts. Atomic mode boundaries are below.
+
+Unsupported is not passed. Name a target. Run CLI/MCP reference execution
+or target tests; name engine, version and expected/discovered selection.
+
+## Batches, described bodies, protected reads and text rules
+
+- With `reaction batches atomic`, assert no facts from a failed direct-production or
+  selected refusal-branch batch and unchanged views through evaluator world assertions,
+  not only `then error`. `then no events` is acceptance and cannot accompany an error. Earlier
+  accepted batches/invoked commands remain; legacy absence retains per-fact appends.
+  Read [atomic boundaries](../cratis-screenplay-captures-and-reactions/references/atomic-batches-and-source-mappings.md).
+- A described handler binds v23, but reaching its body returns Unsupported
+  ImplementationBody, naming command/RequirementId and emitting no events. Denial and
+  validation cases still run; an all-Unsupported run is never green. Read
+  [described handlers](../cratis-screenplay-command-surface/references/described-handlers.md).
+- Protected command reads opt into v25. Test present/absent state and rule refusal;
+  matching decide/commit changes are Conflict / DecisionStateChanged, not validation
+  refusal. Race vectors are not new specification syntax. Read
+  [protected reads](../cratis-screenplay-command-surface/references/protected-reads.md).
+- Literal text rules use ordinal UTF-16 comparison (v24); matches uses a portable
+  linear matcher, not platform regex. Old invalid/refused patterns plan as
+  UnsupportedValidation, not a successful check. Read
+  [text and match rules](../cratis-screenplay-command-surface/references/text-and-match-rules.md)
+  for boundary values and PLAY0699/0787. Reference success is not Stage admission.
+
+## Chronological command date comparisons
+
+Requires Screenplay 4.199.0 (ESM v26; `screenplay --version`); older binders refuse
+these comparisons with PLAY0268. DateTime conditions compare UTC instants at tick
+precision: cover equal instants with different offsets, increasing endpoints,
+an inverted interval and a one-tick boundary. Every participating DateTime input
+without an offset or `Z` rejects with Validation before rules, even when its
+comparison is skipped; add a missing-offset rejection, not a clock fixture workaround.
+`then` matching stays ordinal: expected event values keep the exact produced text,
+not an equivalent offset. Read the complete [retention-window specifications](../cratis-screenplay-command-surface/references/date-comparisons.md)
+for `require to >= from`, PLAY0268/0273 and Stage's v26 refusal. The missing-offset
+runtime case needs an evaluator-request or target input test: putting the invalid
+value in a typed `.play` fixture instead fails binding with PLAY0273; `then error`
+does not exercise runtime validation.
 
 ## Descriptions, persona callers and case tables
 
@@ -102,8 +122,7 @@ Rules the binder enforces:
 - **`then result` and `then no result` need `when query`**, and `when query`
   needs one of them, `then denied` or a sole validation `then error` (`PLAY0465`). Each argument is a `by` or
   `filter` parameter of the query (`PLAY0468`).
-- **A clock instant is ISO 8601 with an offset or `Z`**, such as
-  `"2026-10-05T08:00:00Z"` (`PLAY0461`); `given clock` appears at most once.
+- **A clock instant is ISO 8601 with an offset or `Z`** (PLAY0461); one `given clock` maximum.
 - **`then` contains either events or an error — never both.** A rejection
   specification has exactly one rejection and no success outcome.
 - **`then denied` stands alone**: not with events, errors or state assertions
@@ -114,10 +133,8 @@ Rules the binder enforces:
 - **`null` only in optional read-model values.** A `null` in a command or event
   value is `PLAY0350`: an optional fact is a separate event.
 
-`PLAY0358` is a syntax error (`PLAY0388` also at parse time for extra text after `then denied`). `PLAY0350`, `PLAY0352`, `PLAY0388` (mixed with another outcome), `PLAY0389` and
-the one-rejection rule (`PLAY0273`) are reported only when the model binds, so
-`screenplay --warnaserror` does not show them. Check executable diagnostics
-(the MCP authoring tools) as well.
+V1 does not report binding-only outcome errors; read `references/vocabulary.md`
+for parse-versus-bind diagnostics and check executable diagnostics too.
 
 ## How outcomes are compared
 
@@ -154,12 +171,12 @@ Read [references/reactions-and-cascades.md](references/reactions-and-cascades.md
 
 ## Published-event specifications (released ESM v9)
 
-Use `when append <PrivateEvent>` then `then <PublicEvent>` for outbound publication,
-not `then readmodel`. The follow-up event list is exhaustive and ordered. Read
-[publication example and fold cases](../cratis-screenplay-automations-and-translations/references/public-events-and-direction.md).
-Events-source captures and reached opaque event-target reducers return typed
-Unsupported, not a pass. Composite view fixtures need every key part but remain
-unadmitted (PLAY0268); see read-surface `references/named-keys.md`.
+Use `when append <PrivateEvent>` then `then <PublicEvent>`, not `then readmodel`;
+follow-up events are exhaustive and ordered. Read
+[publication and fold cases](../cratis-screenplay-automations-and-translations/references/public-events-and-direction.md)
+when specifying outbound facts or event-source captures: it owns the minimum
+compiler, PLAY0700/0701, key folding and Unsupported boundaries. Composite view
+fixtures remain unadmitted; see read-surface `references/named-keys.md`.
 
 ## Reusable fixtures, routes and recovery intent
 
@@ -194,6 +211,9 @@ Whitespace-acceptance specs fail. This applies to every ESM version.
 
 Requires Screenplay 4.151.0 or later (`screenplay --version`) for the Unicode `not empty` correction.
 
+Date/DateTime comparisons are the command-only exception: do not move them onto
+concept rules to follow the general format-rule convention.
+
 ## Application-boundary coverage
 
 Every slice should carry at least one specification whose action is what a real
@@ -221,6 +241,8 @@ For command specifications:
 - [ ] Error cases test business rules; each concept rule has one rejection
       specification through one command, not one per use.
 - [ ] A localized rejection is pinned by its quoted `$strings` key.
+- [ ] DateTime comparisons cover offset-less input rejection before rules, equal
+      instants across offsets and tick boundaries; `then` keeps ordinal payload values.
 
 For view specifications:
 

package/package/corpus/skills/cratis-screenplay-specifications/references/actions-beyond-commands.md

@@ -7,7 +7,17 @@ A slice is not always set off by a command. Name what does:
 | A view no event builds - its query has a `performer` | `given readmodel` …, `when query <Query>`, `then result` / `then no result` |
 | An automation driven by the clock | `given clock "<instant>"`, `when clock "<later instant>"` |
 | An automation driven by an application trigger | `when trigger <Trigger>` with the values it carries |
-| A translation driven by a capture | `given capture <Capture>` (the record as it was), `when capture <Capture>` (as it is now) |
+| A translation driven by a record capture | `given capture <Capture>` (the record as it was), `when capture <Capture>` (as it is now) |
+| A capture with `source events` | `given <FromEvent>`, `when append <FromEvent>`; capture-record fixtures are PLAY0701 |
+
+A first record is `added` only, including child and nested records; field-change,
+`and`/`or` and transition guards need earlier state for the same key. For first sight
+add a separate `when added` append; for an update seed `given capture`. Requires
+Screenplay 4.175.0 or later (`screenplay --version`); older record evaluators treat
+first-record fields as changed. Complete cases: captures-and-reactions
+[record capture specifications](../../cratis-screenplay-captures-and-reactions/references/record-capture-specifications.md).
+Event captures use the typed event fixtures and overlay rules in
+[public event captures](../../cratis-screenplay-automations-and-translations/references/public-events-and-direction.md).
 
 Use `given clock`, never `given time`, to state the scenario occurrence time and
 assert a value mapped from `$context.occurred`. In a command's `produces`, that

package/package/corpus/skills/cratis-screenplay-specifications/references/generated-fixtures.md

@@ -1,31 +1,42 @@
-## Generated fixtures and return expectations (ESM v7 and v15)
+# Generated fixtures and return expectations
 
-### Choosing a strategy
+## Contents
+
+- Choosing a strategy
+- When not to
+- Fixtures and outcomes
+
+## Choosing a strategy
 
 Use the [shop example](../../cratis-screenplay-command-surface/references/shop-generation.md):
 pin CustomerId (`cus_` + ULID), OrderId (TypeID) and InviteCode (NanoID) as
 whole values. ApiKey stays secret with no executable generation; do not write a
 passing issuance spec that invents its .NET Bytes(32) factory in Screenplay.
-OrderId pins do not realize Arc's received-time/tenant context either.
+Pin InvoiceNumber's whole date/checksum reference and TicketNumber's integral
+pickup-ticket value too; do not use numeric text for Int fixtures.
 
 Choose the concept's strategy for the job, then pin a whole value matching it:
 `for` for its generated identifier, named `generated` fixtures for other values.
 Use the shared [strategy reference](../../cratis-screenplay-command-surface/references/generated-values-and-responses.md)
-for UUID, time-ordered, typed/opaque text and byte-budget choices and exact shapes.
-`given clock` supplies `$context.occurred`, not a generated time-ordered ID;
+for UUID, time-ordered, typed/opaque text, byte budgets, finite patterns and Int
+range choices and exact shapes.
+`given clock` supplies `$context.occurred` and pattern UTC date segments, not a generated time-ordered ID;
 a seed is not a portable fixture.
 
-### When not to
+## When not to
 
 Pins do not prove randomness, authorization, idempotency, storage freshness or
 secret safety. Client-minted IDs stay inputs; gapless invoice numbering needs an
-allocator, not a random fixture. Pattern/random/rule and secret generation remain
-unadmitted. Source: Screenplay
+allocator, not a random fixture or pattern. Check digits catch typos, not forgery;
+short payload codes need uniqueness enforcement separate from source freshness.
+Pattern/random/rule and checksum validation bind as v21. Stage renders
+pattern/random/checksum under the version gates below; `generate rule` remains
+STAGE-ESM-028. Generated secrets remain refused. Source: Screenplay
 `Documentation/screenplay/generated-values/choosing.md`.
 
-### Fixtures and outcomes
+## Fixtures and outcomes
 
-A compiler that admits ESM v7 binds and runs these; Stage renders supported UUID/String generation strategies,
+A compiler that admits ESM v7 binds and runs these; Stage renders supported UUID/String and Int random generation strategies,
 scalar/named responses, fixtures and `then returns`. Unsupported types/result combinations
 remain `STAGE-ESM-028`/`-038`; preserve refused specifications as gap-fill contracts. The model and rules are in `cratis-screenplay-command-surface`; the
 complete threaded model is the linked shop example. The excerpt below belongs
@@ -62,17 +73,37 @@ specification RegistersWithPinnedValues
   own destinations. For commands without a generated identifier `when ... for` keeps the destination assertion.
   UUID fixtures require canonical lowercase hyphenated form. From v15, pins must also match
   exact strategy size, case, UUID version/variant and zero trailing encoding bits; invalid pins are
-  Contract rejections. Earlier models check canonical UUID type, not its version.
+  Contract rejections. A generated concept with rules selects v20 and checks pins
+  against both shape and rules, including implicit UUID. Rule failures are
+  `Rejected(Contract)` with `Generated fixture '<property>' fails concept '<Concept>' rules`,
+  never client validation failures or redraws. Earlier rule-free implicit-UUID
+  models check canonical UUID type, not its version.
 - A serialized concept generation strategy selects v15 and Guarded whole-source freshness for all
   generated destinations, including implicit UUIDs. Reusing a generated source with existing facts
-  rejects the entire command with Concurrency, without append, response or silent retry. Below v15
-  fixtures retain legacy reuse. See the complete [strategy example](../../cratis-screenplay-toolchain/references/generation-strategies-example.md)
+  rejects the entire command with Concurrency, without append, response or silent retry.
+  Models without a serialized strategy retain legacy reuse even when rules select v20. See the complete [strategy example](../../cratis-screenplay-toolchain/references/generation-strategies-example.md)
   and command-surface `references/generated-values-and-responses.md` for tagged sources.
-- `given clock` supplies `$context.occurred`; it does not synthesize UUIDv7, ULID or
-  TypeID from that instant. Pin the whole identifier, never a seed. Stage's
-  time-ordered factories use wall clock, not command-receipt time, and its clock
-  specifications remain unsupported. Sources: Screenplay
+- `given clock` supplies `$context.occurred` and requires all pattern date segments
+  to match the same UTC instant, including offset rollover and leap days. Without
+  a clock the reference runner checks digit widths, never today's wall clock.
+  Checksum pins check arithmetic only with an authored `validate checksum` rule;
+  a generation modifier alone checks suffix shape. It does not synthesize UUIDv7,
+  ULID or TypeID: pin the whole identifier, never a seed. Stage time-ordered
+  factories use receipt time; admitted command clock specs render. Sources: Screenplay
   `Documentation/screenplay/generated-values/choosing.md`; Stage
   `Documentation/reference/generated-values-rendering.md`.
+- Attached generation bodies are not run: pin the resulting String;
+  an opaque validator still yields Unsupported. Stage allows unpinned rendered
+  generation only when every concept rule is Proven and the expectations support
+  relational captures. Unproven/Refuted rules need pins (-038); invalid pins fail
+  STAGE-ESM-011. Opaque/unsupported rules refuse -005 before pin evaluation.
+  Screenplay's reference runner and Stage's independent executor always need pins.
 - A reaction-invoked command that reaches generation is `Unsupported(IdentityAllocation)` (no fixture channel); a
   response-only command runs and its response is discarded.
+
+Requires Screenplay 4.164.0 (`screenplay --version`) for v20 rule-bearing generated pins, 4.172.0 for v21 finite/rule strategies; older compilers refuse PLAY0268.
+Requires Stage 4.95.0 for command clock specs and 4.109.0 for v20 rule-bearing pins; older renderers refuse those shapes.
+Requires Stage 4.115.0 for v21 admission/all-Proven unpinned rendering, 4.117.0
+for warning/info generated-concept rules, 4.118.0 for checksum validation and
+4.119.0 for pattern/random. Older renderers require rule-bearing pins or refuse
+the respective rules/strategies with -038/-042/-028. `generate rule` remains -028.

package/package/corpus/skills/cratis-screenplay-specifications/references/outcome-comparison.md

@@ -20,6 +20,12 @@ This reference holds the comparison rules for events, read models, query rows an
   and requires the rejection to carry the string-key marker; it never loads
   translated text; resolving the key is the realization's job.
 
+Date/DateTime `then` matching stays ordinal: different offsets naming one instant
+do not match merely because a v26 command comparison considers them equal. Keep
+the exact produced payload text in the expectation. Keys, constraints and freshness
+also retain ordinal equality. For UTC-tick comparisons and pre-rule missing-offset
+Validation rejections, read the [retention-window specifications](../../cratis-screenplay-command-surface/references/date-comparisons.md).
+
 ## Rejections and denials say different things
 
 `then error "<message>"` says **rejected, for this reason** — pin it when the

package/package/corpus/skills/cratis-screenplay-specifications/references/vocabulary.md

@@ -1,3 +1,6 @@
+<!-- Copyright (c) Cratis. All rights reserved. -->
+<!-- Licensed under the MIT license. See LICENSE file in the project root for full license information. -->
+
 # The specification vocabulary
 
 This reference holds the given/when/then construct table and the enumeration and DateTime literal rules.
@@ -17,7 +20,7 @@ This reference holds the given/when/then construct table and the enumeration and
 | `given clock "<instant>"` | the ISO 8601 instant the scenario happens at |
 | `when clock "<instant>"` | the clock reaches an instant; scheduled reactions that are due run |
 | `when trigger <Trigger>` | an application trigger fires with the values beneath it |
-| `given capture` / `when capture <Capture>` | an earlier and the current record of a capture's source |
+| `given capture` / `when capture <Capture>` | earlier/current records for non-event sources; for `source events` use typed `given <Event>` / `when append <Event>` (PLAY0701) |
 | `generated <name> = <value>` | beneath `when <Command>`: the fixture for a generated property other than the identifier (ESM v7); `for` beneath the `when` supplies the generated identifier |
 | `then returns [<value>]` | the command's response (ESM v7): `then returns "<uuid>"` for a scalar, `then returns` with named `field = value` lines for a subset of a record |
 | `then <EventType>` | an expected new event |
@@ -32,6 +35,16 @@ This reference holds the given/when/then construct table and the enumeration and
 | `for <value>` | the event source of a `given`/`then` event, or of the `when` command or appended event |
 | `<property> = <value>` | a literal, `null`, or a one-line JSON-shaped object or list: `lines = [{"sku":"A-1","quantity":2}]` |
 
+## Parse and binding diagnostics
+
+PLAY0358 is a syntax error; PLAY0388 also occurs at parse time for extra text
+after `then denied`. PLAY0350, PLAY0352, PLAY0388 for mixed outcomes, PLAY0389 and
+the one-rejection rule PLAY0273 occur only at binding. Source validation alone
+will not report them: check executable diagnostics as well. Clock instants need
+an ISO 8601 offset or `Z`, for example `"2026-10-05T08:00:00Z"` (PLAY0461).
+
+## Literal spellings
+
 An enumeration value binds whether it is written bare
 (`status = sent`), qualified (`status = InvoiceStatus.sent`) or quoted, and a
 `DateTime` value binds as a plain ISO 8601 instant (`"2026-10-05T08:00:00Z"`).

package/package/corpus/skills/cratis-screenplay-streams-and-consistency/SKILL.md

@@ -26,17 +26,15 @@ Read [references/product-sources.md](references/product-sources.md) when checkin
 - Not for: projection and query syntax, reactions and captures, writing the specifications
   themselves (`cratis-screenplay-scenario-coverage`), Chronicle C# mechanics
   (`cratis-chronicle-event-modeling`). See Route near misses.
-- Model-first applies: when an accepted model covers the scope, change the model and its
-  specifications, not code. Do not weaken authorization, `pii` or rules to make a model compile.
+- Apply model-first per `cratis-screenplay-modeling-lifecycle`; never weaken
+  authorization, `pii` or rules to compile.
 
 ## Interview phase
-**Skip if** the user or the model already states the stream identities, who owns each module, how
-much autonomy each side has, the external systems, and rough growth. Otherwise ask only what is
-missing, one question at a time, with options. **Unattended:** assume the most conservative
-option, mark it `ASSUMED` in the slice or module `documentation` and in the session `STATE.md`
-(`.ai-work/screenplay/<model-slug>/STATE.md`), and continue.
-
-Ask only what is missing: (1) instance - what real-world thing the stream is about; (2) competition - what must never happen when two people act at once; (3) retry - what a repeated request should see; (4) ownership; (5) growth; (6) change - whether the event was ever stored in a running system. Read [references/interview-batch.md](references/interview-batch.md) for each question's follow-up; ownership options are in `references/boundaries.md`.
+Read [interview prompts](references/interview-batch.md) when identity, competition,
+retry, ownership, growth or stored-event history is unsettled. Ask only missing
+questions, one at a time; ownership options are in `references/boundaries.md`.
+Unattended work takes the conservative option and marks it `ASSUMED` in model
+`documentation` and `.ai-work/screenplay/<model-slug>/STATE.md`.
 
 ## Procedure
 1. **Establish identity and membership.** For every `concept XId` used as an `identifier`, write
@@ -87,14 +85,10 @@ Ask only what is missing: (1) instance - what real-world thing the stream is abo
    (PLAY0270), not runtime propagation or generated C# `[Subject]`. Without a
    supplied subject, the runtime defaults to the event source; see command-surface
    `references/compliance.md` for allowed types and the policy/encryption distinction.
-5. **Plan evolution** with `references/evolution.md`: classify each event change (additive,
-   meaning change, rename, removal, split or merge) and write its compatibility scenarios before
-   editing. Admit the **release baseline** in the release job; admitted
-   revisions need `newGeneration`. Modes/CLI/MCP: `references/evolution.md`.
-   Pin persisted/public enum member numbers before reordering or removing members (`references/evolution.md`, "Enum member numbers").
-
-   Renames and other identity-affecting edits are made by the identity owner (the
-   identity procedure in `cratis-screenplay-modeling-lifecycle`).
+5. **Plan evolution**: read `references/evolution.md` before editing stored contracts
+   for change classification, compatibility scenarios and enum-number safety.
+   After release-baseline admission, revisions need `newGeneration`. Identity-affecting edits belong to the
+   identity owner (`cratis-screenplay-modeling-lifecycle`).
 6. **Test ownership and interfaces** with `references/boundaries.md`: ownership interview,
    interface and processor inventory, one real interaction walked across each boundary, coupling
    check. Keep team, module, stream and deployment boundaries distinct; inbound facts via
@@ -108,15 +102,19 @@ Ask only what is missing: (1) instance - what real-world thing the stream is abo
 - `identifier` on an event property is PLAY0019; the source id is never payload by declaration.
   Copying it as a payload value is PLAY0469 (information, warning for inline events).
 - In the executable model a production's `for` must resolve to the command's scalar identifier:
-  one command writes one stream declaratively (a handler is never admitted).
+  one command writes one stream declaratively; described handlers bind v23 but
+  their payload-only contract does not grant arbitrary destinations.
 - Constraint names are application-wide identities (PLAY0392); properties must be declared
   directly on the event (PLAY0391); never mix event and property rules under one name (PLAY0135);
   `ignore casing` is not allowed on `unique event` (PLAY0393).
 - Generations are declared in full, numbered 1..N without gaps, in the same slice (PLAY0446-0448); `id` pins are shared by all generations and unique application-wide (PLAY0472); `storedName` needs ESM v16. See `references/evolution.md` ("Generations, pins and storedName diagnostics").
 
-- `reads` is PLAY0271 and `require` over read-model paths is PLAY0268 at binding. A `concurrency`
-  block compiles but is PLAY0271 at binding. Keep both when they state real intent; they are not
-  protection. `description` text never reaches rendered code: a rule that lives only in prose is
+- Application-root `command reads protected` admits eligible reads and single-level
+  requirement/mapping paths (v25). Absence rejects, matching decide/commit changes
+  conflict. Legacy reads remain PLAY0271/PLAY0268; `concurrency` remains unbound and
+  combining it with protected reads is PLAY0783. Read
+  [protected reads](../cratis-screenplay-command-surface/references/protected-reads.md)
+  for admission and Stage's STAGE-ESM-044 protected-read refusal (the v25 pair itself is admitted). `description` text never reaches rendered code: a rule that lives only in prose is
   unenforced there.
 - `pii` and `secret` bind as ESM v13;
   enum/identity compliance and protected events with explicit subject marks still
@@ -144,6 +142,12 @@ Requires Chronicle 19.59.6 or later (19.59.3 for the InMemory provider) for the
 - Give each invariant an authoritative atomic decision point and inspect every path that could
   violate it. A constraint violation rejects that command's whole append set; a reaction cascade
   is not one transaction. Declared semantics are not a passed concurrency test.
+- New models declare `reaction batches atomic`: direct productions per trigger
+  occurrence and each selected refusal branch are separate batches; invoked commands
+  stay independent. Legacy absence retains per-fact appends. Stage refuses v22
+  with STAGE-ESM-016 and atomic mode in admitted v23–v25 with STAGE-ESM-043. Read
+  [atomic boundaries](../cratis-screenplay-captures-and-reactions/references/atomic-batches-and-source-mappings.md)
+  when defining failure rollback; batching is not redelivery deduplication.
 - Match duplicate protection to scope. A property constraint lets a source re-claim its own
   value; use `unique event` for a fact that is genuinely once-only in its lifecycle, without
   blocking legitimate repeated operations just to make retries safe.

package/package/corpus/skills/cratis-screenplay-streams-and-consistency/references/boundaries.md

@@ -80,8 +80,8 @@ For each affected boundary, identify:
 
 Use declaration addresses, not copies of payloads. Per slice, also record the events it consumes
 and which slice produces them, for orientation, not as a build order. A command or reaction may
-consult another slice's view (`reads`; unprotected in `.play`, see `consistency-and-concurrency.md`
-section 3); a slice calls another slice's command only through `invokes`.
+consult another slice's view (`reads`; eligible commands opt into v25 protection,
+trigger reads cannot; see `consistency-and-concurrency.md` section 3 for target gaps); a slice calls another slice's command only through `invokes`.
 
 ### Responsibility matrix and ownership timeline
 One compact matrix per feature shows who owns what; the timeline shows where a fact crosses.

package/package/corpus/skills/cratis-screenplay-streams-and-consistency/references/consistency-and-concurrency.md

@@ -57,8 +57,8 @@ observed legacy check from verified atomic protection.
 | several command properties / constants | `require` | runs after property rules, before production |
 | a value across all sources | `unique <prop> on <Event>` | value owned by one source; same source may re-claim |
 | a fact at most once per source; mutually exclusive facts | `unique event` (+ `released by`) | covers simple lifecycle transitions |
-| state-dependent rule not reducible to the supported uniqueness/release semantics (a balance, capacity, "only if approved") | no protected decision read in `.play` today | state it as `reads` + `require … message`, mark NOT enforced, name the target enforcement (below) |
-| a view (read model) | an unguarded materialized read is not protection | views lag; `reads` is PLAY0271, `require` over views PLAY0268 at binding (expected in design mode) |
+| state-dependent rule (balance, capacity, "only if approved") | eligible `reads` + `require` under `command reads protected` (v25) | required absence rejects; matching intervening facts conflict. Payload-key fan-in, joins, reducers and other refused shapes remain target gaps |
+| a view (read model) | unguarded materialized reads are not protection | legacy command and trigger reads remain unprotected; Stage refuses protected reads (STAGE-ESM-044), so reference protection is not target realization |
 
 ## 3. Record each state-dependent rule that the model cannot enforce
 Never accept the caller's copy of the state: `currentStatus Status` on the command with
@@ -67,7 +67,13 @@ input (`confirmsX == true`) standing in for the rule. Never move the rule into `
 `implementation hint` prose; a description renders only as an XML doc comment (Stage#178), so prose alone leaves
 the rule unenforced in rendered scope.
 
-Right: write the rule as stated intent and mark it unenforced.
+First inspect [protected reads](../../cratis-screenplay-command-surface/references/protected-reads.md):
+opt eligible command reads into v25, retain absence/conflict specifications and verify
+target consistency separately. Stage admits v25 but refuses protected reads (STAGE-ESM-044). A payload-keyed
+fan-in such as the course-capacity example remains refused; the preamble is not a
+blanket admission of arbitrary projections.
+
+For legacy models without opt-in or refused shapes, write stated intent and mark it unenforced.
 - `reads <View> as x by …` plus `require <expr over x> message "…"` on the command (the
   `StateChange` slice in `streams-example.md`). Binding reports PLAY0271 / PLAY0268; that is
   expected in design mode, so keep the lines. Do not remove them to pass a tool.

package/package/corpus/skills/cratis-screenplay-streams-and-consistency/references/multi-service-models.md

@@ -115,9 +115,10 @@ module Billing
   another reason each service has its own folder.
 - A capture keys on the incoming content, so the contract carries the identity
   the consumer keys on.
-- The producer's publication specification runs in the reference evaluator; the
-  consumer's capture over events binds but evaluates as typed Unsupported. Specify
-  the consumer's private behavior downstream of the capture.
+- Both sides run in the reference evaluator: the producer's publication
+  specification, and the consumer's capture over events, which a specification
+  drives by presenting the consumed public event (`when append <Event>`;
+  Requires Screenplay 4.171.0).
 - Syntax, publication semantics and the full rules: read
   `cratis-screenplay-automations-and-translations`
   `references/public-events-and-direction.md`.

package/package/corpus/skills/cratis-screenplay-streams-and-consistency/references/streams-example.md

@@ -1,5 +1,12 @@
 # Example: streams, constraints and a recorded rule
 
+Legacy control: no `command reads protected` preamble is declared. The course-capacity
+payload-key fan-in remains refused even with opt-in; eligible active-enrolment reads
+can protect under v25, but reads plus concurrency cannot combine (PLAY0783). Read
+[protected reads](../../cratis-screenplay-command-surface/references/protected-reads.md)
+for admission and Stage's protected-read refusal (STAGE-ESM-044). The legacy diagnostics below describe this
+control, not a blanket refusal of command reads.
+
 A complete design-mode model for course enrolment. It shows one business identity per stream,
 cross-stream references as payload, three kinds of uniqueness constraint, a state-dependent
 rule recorded as **NOT enforced in the model today**, a declared `concurrency` scope, and an