@cratis/pi 6.1.0 → 6.3.0

package/package/corpus/skills/cratis-screenplay-captures-and-reactions/SKILL.md

@@ -25,22 +25,25 @@ source is the single flow model.
 
 | Package | Version | Purpose |
 | --- | --- | --- |
-| `Cratis.Screenplay` | `4.12.1` | CDL parser, reaction and trigger parsers, diagnostics |
+| `Cratis.Screenplay` | `4.31.0` | CDL parser, reaction and trigger parsers, diagnostics, semantic binder |
 
-Read from the Screenplay repository at tag `v4.12.1` (commit `122eee8`), against
-`Documentation/screenplay/{captures,captures/grammar,reactions,triggers}.md` and
-`Source/DotNET/Screenplay/Parsing/`. Reverify before claiming another version
-behaves the same.
+Checked against the Screenplay repository at tag `v4.31.0` (commit `355dffb`):
+`Documentation/screenplay/{captures,captures/grammar,reactions,triggers,interactions,file-references,grammar,diagnostics}.md`
+and decisions 0003, 0006 and 0009. Every example below compiles with that
+version's compiler. Reverify before claiming another version behaves the same.
 
-⚠️ **Neither slice type reaches the reference runtime.** `SemanticSliceKind` admits
-only `StateChange` and `StateView`, so an `Automation` or `Translate` slice is
-rejected by ESM v1 outright. Model them when the `.play` file is the deliverable;
-do not promise they execute.
+⚠️ **Neither slice type reaches the reference runtime.** The executable model
+admits only `StateChange` and `StateView` slices, so an `Automation` or
+`Translate` slice fails binding with `PLAY0268` (*Slice '<name>' of type '<type>'
+is not admitted by ESM v1*), and so do reactions and declared triggers. A
+specification's `when append` never runs reactions either. Model them when the
+`.play` file is the deliverable; do not promise they execute.
 
 ## `capture` — the Change Data Capture Language
 
 Captures live in `Translate` slices and are the anti-corruption layer: external
-shapes in, domain events out.
+shapes in, domain events out. Excerpt: the module and feature around the slice,
+and the events it appends, are declared elsewhere.
 
 ```screenplay
 slice Translate LegacyInvoiceSync
@@ -79,6 +82,10 @@ convention, not enforcement.
 
 **`key <property>`** names the source property identifying an instance.
 
+Declaring an event's external origin on the `event` itself is accepted as
+Screenplay decision 0009 but **not in the language**; a `capture` in a
+`Translate` slice is how outside data enters a model today.
+
 **`map`** reshapes before events are appended: direct rename
 (`productName = name`), a backtick template, `translate` with indented
 `"source" => target` entries, and `split <source> by "<sep>"` with indented target
@@ -107,6 +114,9 @@ an optional `map` and any number of `append` blocks.
 
 ## `reaction`
 
+Excerpt: `BuildFinished` is a declared trigger and `SendFailureNotice` a command
+elsewhere in the model.
+
 ```screenplay
 slice Automation NotifyOnBuildFailure
   reaction NotifyOnFailure
@@ -158,6 +168,8 @@ reaction is an error; combine with `and`/`or` instead.
 
 ### Effects — `produces` vs `invokes`
 
+Excerpt, inside an `Automation` slice:
+
 ```screenplay
 reaction Provisioner
   when InvitationAccepted
@@ -174,7 +186,57 @@ refuse it. `invokes` asks for a command, which may still validate and reject.
 Using `produces` for both would say those are the same kind of consequence.
 
 Both are declarations of *what happens*, not of how — a trigger can state its
-consequences **and** carry a `file` or inline block that implements them.
+consequences **and** carry a `file` or an inline block in a tagged fence
+(` ```csharp `) that implements them. That code is an implementation attachment:
+the model lists it (role, owner, content hash) but never runs it.
+
+### What it decides from — trigger `reads`
+
+An automation decides from state. A trigger names the views it consults with
+`reads <View> [as <alias>] [by <trigger value>]` — the same word and meaning as
+a command's `reads`: the state the behavior decides from. Excerpt, inside a
+`feature`: the events, the command and the two read models (each built by a
+projection) are declared elsewhere.
+
+```screenplay
+slice Automation ChaseOverdueInvoices
+  reaction RemindOnDueDate
+    description "Reminds the customer when an invoice falls due unpaid"
+    when InvoiceFellDue
+      invoiceId
+      reads InvoiceBalance as balance by invoiceId
+      invokes SendPaymentReminder
+        invoiceId = invoiceId
+      file Reactions/RemindOnDueDate.cs
+  reaction SweepOverdueInvoices
+    description "Re-checks every overdue invoice each morning"
+    at 08:00
+      reads OverdueInvoice
+      file Reactions/SweepOverdueInvoices.cs
+```
+
+- `reads` sits **under a trigger**, beside the values it takes and its effects.
+  Each trigger declares its own.
+- **`by` names a value that trigger takes** (`invoiceId` above). Naming anything
+  else is warning `PLAY0442`.
+- **Clock triggers read whole views.** `every` and `at` take no values, so
+  `reads <View>` works under them but `by` is error `PLAY0443`.
+- **Aliases follow the command rules.** A view read more than once needs an
+  alias on every read (`PLAY0410`), aliases are unique per trigger (`PLAY0411`),
+  and an alias must not match a trigger value (`PLAY0412`). A view no projection
+  in the document produces is warning `PLAY0177`.
+- **`reads` is a directive in a trigger body.** A trigger value named `reads` is
+  written `@reads`. A bare `reads` line is error `PLAY0175`, and
+  `reads <PrimitiveType>` is warning `PLAY0444`; both messages name the escape.
+- `for each <View>` is reserved for a future view-driven trigger. It is not a
+  trigger today (`PLAY0137`).
+
+⚠️ **Declared, not enforced.** Reactions still do not bind in the executable
+model (`PLAY0268`), so trigger `reads` gives no runtime protection, and command
+`reads` give none yet either (`PLAY0271`, decision 0003). A reaction that
+`invokes` a command leaves the decision, and any protection, to that command's
+own reads. Decision 0006 leaves `where` over read paths out of scope: keep the
+logic that uses the state in the implementation, as both reactions above do.
 
 ## `trigger`
 
@@ -193,14 +255,23 @@ open. The type on a value is optional; a bare name is already a useful statement
 **Name resolution, in order:** events the document declares or imports → triggers
 the document declares → triggers registered with the compiler, plus the built-in
 host signals. A registration wins over a built-in of the same name. Only when all
-three miss is the name reported unknown — as a **warning**, like every other
-unresolved reference.
+three miss is the name reported unknown — a **warning** (`PLAY0248`), because the
+name may be known outside the document. A malformed reaction body is an error.
 
 **Built-in triggers:** `Startup` and `Shutdown`. The clock is built in too, but
 with its own syntax rather than a name.
 
-⚠️ A trigger body reserves `file`, so a trigger value named `file` is written
-`@file`.
+⚠️ **An application trigger is not a UI event.** What a button click, a form
+submit or entering a screen does is an *interaction*: an `on click` / `on submit`
+/ `on enter` clause or a named `behavior`, never a declared `trigger` (see
+`cratis-screenplay-ui-composition`). The two meet in two places: an interaction
+can observe a declared trigger with `on <Trigger>` and fire one with
+`raise <Trigger>`. A trigger named after a built-in interaction kind (`click`,
+`submit`, `enter`, …) is an error (`PLAY0326`).
+
+⚠️ Under a reaction trigger, `description`, `file`, `produces`, `invokes` and
+`reads` are directives, so a value with one of those names is written with `@`
+(`@file`, `@reads`).
 
 **Registration** (for a name only an integration knows) happens through the
 compiler's language registry, either name-only or with a shape. ⚠️ Stating **no**
@@ -232,6 +303,10 @@ something is reported. `Startup` and `Shutdown` are registered the second way.
 - [ ] No `when` clause mixes `or` and `and`.
 - [ ] Cross-cutting infrastructure is **not** modeled as a `Translate` slice.
 - [ ] Every name a reaction takes is carried by the event or trigger.
+- [ ] Each trigger `reads` the views its automation decides from; `by` names a
+      value the trigger takes, and clock triggers read without `by`.
+- [ ] Nobody reports trigger or command `reads` as protected; UI clicks are
+      interactions, not triggers.
 
 ## Route near misses
 

package/package/corpus/skills/cratis-screenplay-captures-and-reactions/verification.json

@@ -7,6 +7,10 @@
     { "kind": "skill-contains", "value": "`cratis ai install` manages `.cratis/ai/`, not `.cratis/screenplay/`" },
     { "kind": "skill-contains", "value": "cannot be mixed in one clause" },
     { "kind": "skill-contains", "value": "`where` belongs to the reaction, not to one trigger" },
-    { "kind": "skill-contains", "value": "Startup` and `Shutdown" }
+    { "kind": "skill-contains", "value": "Startup` and `Shutdown" },
+    { "kind": "skill-contains", "value": "`reads <View> [as <alias>] [by <trigger value>]`" },
+    { "kind": "skill-contains", "value": "Clock triggers read whole views." },
+    { "kind": "skill-contains", "value": "Declared, not enforced." },
+    { "kind": "skill-contains", "value": "An application trigger is not a UI event" }
   ]
 }

package/package/corpus/skills/cratis-screenplay-command-surface/SKILL.md

@@ -25,14 +25,22 @@ source is the single flow model.
 
 | Package | Version | Purpose |
 | --- | --- | --- |
-| `Cratis.Screenplay` | `4.12.1` | Parser, validator, diagnostics |
+| `Cratis.Screenplay` | `4.31.0` | Parser, validator, diagnostics, semantic binder |
 
-Read from the Screenplay repository at tag `v4.12.1` (commit `122eee8`), against
-both the documentation and `Source/DotNET/Screenplay/Parsing/`. Reverify before
-claiming another version behaves the same.
+Checked against the Screenplay repository at tag `v4.31.0` (commit `355dffb`):
+`Documentation/screenplay/{commands,constraints,policies,context,concepts,diagnostics}.md`
+and decisions 0001 and 0003. Every example below compiles with that version's
+compiler. Reverify before claiming another version behaves the same.
+
+"Parses" and "runs" are different claims. The executable profile, and what
+each construct binds to, is in the `cratis-screenplay-model-authoring` language
+reference.
 
 ## The command block
 
+Excerpt: the concepts, the `InvoiceLine` type, the policy and the event are
+declared elsewhere in the model.
+
 ```screenplay
 command RegisterInvoice
   description "Registers a new invoice with its lines and payment terms"
@@ -40,33 +48,33 @@ command RegisterInvoice
   invoiceNumber  InvoiceNumber
   lines          InvoiceLine[]
   note           String?
-  reads InvoiceList by invoiceNumber
   authorize CanManageInvoice
   validate
     invoiceNumber not empty                 message "Invoice number is required"
-    invoiceNumber matches "^INV-[0-9]{6}$"  message "Must look like INV-000000"
+    invoiceNumber matches "^INV-[0-9]{6}$"  severity warning message "Must look like INV-000000"
   produces InvoiceRegistered
     invoiceId    = invoiceId
     registeredAt = $context.occurred
-  concurrency
-    eventSource
-    events InvoiceRegistered, InvoiceCancelled
 ```
 
 Type modifiers: `<Type>[]` for a collection, `<Type>?` for optional.
 
-⚠️ **The parser enforces no clause order.** The order above is the house
-convention and the order a reader expects; the compiler accepts any. Keep to it.
+⚠️ **The parser enforces no clause order.** The house order is description,
+properties, `reads`, `authorize`, `validate`, `produces`/`handler`, `concurrency`.
+Keep to it.
 
 ⚠️ **`produces` and `handler` are mutually exclusive** — declaring both is an
 error. Everything else may repeat except `description` (one) and `concurrency`
-(one).
+(one). A `handler` parses but does not bind to the executable model yet
+(`PLAY0268`); prefer `produces` when the model must run.
 
 ## `identifier` — the stream boundary decision
 
-Exactly one command property may carry `identifier`. It names the value the
-runtime resolves the event source id from, so **choosing it is choosing the stream
-boundary** — the highest-consequence decision in the slice.
+At most one command property may carry `identifier`. It names the value the
+runtime uses as the event source id, so **choosing it is choosing the stream
+boundary** — the highest-consequence decision in the slice. Leave it out only
+when the runtime should allocate a fresh `Uuid` (a command that creates
+something whose identity the caller does not supply).
 
 - A second `identifier` on the same command is an error: *only one property can be
   the identifier*.
@@ -75,44 +83,82 @@ boundary** — the highest-consequence decision in the slice.
 
 ## `reads` — state the command decides against
 
+Excerpt: the `Account` read model, its projection and its keyed query are
+declared elsewhere.
+
 ```screenplay
-reads InvoiceList by invoiceNumber
+command TransferFunds
+  sourceId      AccountId
+  destinationId AccountId
+  amount        Decimal
+  reads Account as source by sourceId
+  reads Account as destination by destinationId
+  validate
+    require source.balance >= amount
+      message "The source account does not cover the transfer"
 ```
 
-`by <property>` names the command property the read model is looked up by; it is
-optional. A command may read several read models, but **each one only once** —
-a duplicate is an error.
+`by <property>` names the command property the read model is looked up by.
+`as <alias>` names one read: a command that reads a view more than once needs an
+alias on **every** read (`PLAY0410`), aliases are unique (`PLAY0411`) and must not
+match a command property (`PLAY0412`). A `require` path uses the alias, or the
+view name when that view is read once.
 
-This is a deliberate Cratis divergence from generic Event Modeling, which forbids
-read-model-to-command edges. Use it for a genuine consistency boundary, and pair
-it with `concurrency` so the decision is enforced at append time rather than
-merely consulted. Do not use it to fetch data the caller could supply.
+⚠️ **`reads` is not a protected read.** It documents the read-model-to-command
+arrow of the event model; nothing checks at append time that the state is still
+current. The executable model rejects every `reads` and `concurrency` with
+`PLAY0271`, and `require` over a read-model path with `PLAY0268`, until
+decision-consistent reads exist (Screenplay #129, decision 0003). Adding a
+`concurrency` block does not fix this: its scope is not the read's watermark, and
+decision 0003 plans to make the combination an error once protected reads ship.
+When a rule depends on state:
 
-## `validate` — the complete rule vocabulary
+- if it is uniqueness, declare a `unique` constraint (below);
+- otherwise state the rule, and say in review that the target implementation
+  must enforce it consistently. Do not claim the model guarantees it.
 
-Fourteen rule kinds (`ValidationRuleKind`), each taking an optional
-`message "<text>"`:
+Do not use `reads` to fetch data the caller could supply.
+
+## `validate`
+
+Each rule takes an optional `severity information|warning|error` and then an
+optional `message "<text>"` (or `$strings.<key>`). The default severity is `error`.
 
 | Rule | Example |
 | --- | --- |
 | `not empty` | `name not empty` |
-| `max <n>` / `min <n>` | `reason max 500`, `quantity min 1` |
+| `max <n>` / `min <n>` | `reason max 500` (length on text), `quantity min 1` (value on numbers) |
 | `> <v>` / `>= <v>` / `< <v>` / `<= <v>` | `quantity > 0`, `discountPct <= 100` |
-| `== <v>` / `!= <v>` | `currency == "NOK"`, `status != "draft"` |
+| `== <v>` / `!= <v>` | `currency == "NOK"`, `status != draft` |
 | `length == <n>` | `currency length == 3` |
-| `matches <regex>` | `invoiceNumber matches "^INV-[0-9]{6}$"` |
+| `matches email` | the only named pattern; any other name is `PLAY0366` |
+| `matches "<regex>"` | ECMAScript; matches **any substring** unless anchored with `^…$`; an invalid pattern is `PLAY0367` |
 | `all > <v>` / `all >= <v>` | `lines.quantity all > 0` |
 | `rule <Name>` | `orgNumber rule BeAValidOrganizationNumber` |
 
-`matches` accepts either a named pattern (`email matches email`) or a quoted
-regex, which is why the reference lists it on two rows while the parser has one
-kind for it.
+⚠️ **Validation severity is not compiler severity.** Every failed rule and
+`require` rejects the command, at `information` and `warning` too; severity only
+tells the UI how to present the failure.
 
-A `rule <Name>` may carry an indented `file <path>` or an inline code block as its
-body. A rule with no body is a complete statement that the rule exists.
+**Whole-command rules** use `require <condition>` with an indented `message` and
+optional `severity`, sharing the condition grammar with `produces … when`:
+`and` binds tighter than `or`, parentheses group. A conditional rule is an
+implication: `require isExtension == false or newEndDate > endDate`.
 
-**Whole-command rules** use `require <condition>` with an optional indented
-`message`, sharing the condition grammar with `produces … when` and `where`.
+**Rules whose logic is code.** A bare `rule <Name>` records that a rule exists but
+has no portable meaning (`PLAY0268`). Give it a body when the logic can live in the
+model — a `file` or a tagged ` ```csharp ` fence indented under the rule, or a
+fenced `validate` block for cross-field rules. Excerpt, inside a command:
+
+```screenplay
+validate
+  orgNumber rule BeAValidOrganizationNumber message "Must be a valid organization number"
+    file Validations/BeAValidOrganizationNumber.cs
+```
+
+A bodied rule or fenced block binds as opaque code (ESM v3): the reference runner
+reports it unsupported, and a target must supply the implementation. Prefer a
+declarative rule when one can say it.
 
 **Put format rules on the `concept`, not the command.** A concept carries its own
 `validate` block and every use inherits it — that is Screenplay's type system, and
@@ -120,6 +166,8 @@ a rule that travels is worth more than one that is repeated.
 
 ## `authorize`
 
+Excerpt: the policies are declared at the top of the model.
+
 ```screenplay
 authorize IsAccountant
           or IsCustomerSelf
@@ -133,21 +181,34 @@ A continuation line extends the clause.
 ⚠️ **Two adjacent policies synthesize an implicit `and`.** `authorize A B` means
 `A and B`. Write the operator explicitly so the reader does not have to know this.
 
-## `produces`
+- Several `authorize` lines on one command or query combine with AND, in authored
+  order. (Before v4.29.0 all but the last were silently dropped.)
+- `authorize` on an enclosing `module` or `feature` is ANDed with the command's
+  own gate; an `or` inside one gate never bypasses another gate.
+- Evaluation short-circuits left to right, module → feature → command. If it
+  reaches a policy implemented in code, the reference runner reports the outcome
+  unsupported; it never guesses allow or deny.
 
-Every mapping source form: a command property (`= invoiceNumber`), a context value
-(`= $context.occurred`, `= $context.identity.id`, `= $context.identity.claims.x`,
-`= $context.causedBy.subject`, `= $context.causation.type`, `= $context.tenant`),
-an environment variable (`= $env.REGION`), a literal (`= "draft"`, `= 0`), or a
-template (`` = `${firstName} ${lastName}` ``).
+## `produces`
 
-- **`for <expression>`** says which event source the event lands on. **At most one
-  per `produces`** — *an event is appended to one event source*.
-- **`tag`** lines apply tags to this append. Tags also exist on the `event`
-  declaration, where they apply to every append of that type.
+- **Mapping sources** that bind to the executable model: a command property
+  (`= invoiceNumber`), a literal (`= "draft"`, `= 0`), `$context.occurred`, and
+  the caller's audit identity (`$context.identity.id`/`.name`/`.userName`, the
+  same values as `$context.causedBy.*`). The last two select ESM v2.
+  `$context.tenant`, claims, roles, causation, `$env.` values, templates and
+  computed expressions parse but block binding (`PLAY0268`).
+- **`for <identifier>`** on an indented line names the event source the event is
+  appended to. At most one per `produces`. To bind, it must name the command's
+  `identifier` property (`PLAY0273` otherwise); fanning out to another event
+  source parses but does not run today.
+- **`tag`** lines apply literal tags to this append. Tags also exist on the
+  `event` declaration, where they apply to every append of that type.
 - **Several unconditional `produces` blocks** are allowed — that is co-production,
   and it is what an automation is *not*.
-- **`produces when <condition>`** takes the event name on the next indented line:
+- **`produces when <condition>`** takes the event name on the next indented line.
+  Conditions over command properties and constants bind; each is evaluated
+  independently, and when all are false the command is accepted with no events.
+  Excerpt:
 
 ```screenplay
 produces when isProForma == true
@@ -158,7 +219,9 @@ produces when isProForma == true
 ## `concurrency`
 
 Five dimensions, each at most once, and at most one `concurrency` block per
-command:
+command. It mirrors Chronicle's `ConcurrencyScope` for a target implementation;
+the executable model does not bind it (`PLAY0271`), and it does not protect a
+`reads` decision.
 
 | Dimension | Scopes the check to |
 | --- | --- |
@@ -168,25 +231,43 @@ command:
 | `streamId <Name>` | an event stream id |
 | `events <A>, <B>` | the listed event types |
 
-An unknown dimension is an error naming all five.
+An empty block or an unknown dimension is an error.
 
-## `constraint` — append-time invariants
+## `constraint` — uniqueness at append time
 
-Exactly one of three forms per constraint:
+Chronicle's constraints enforce **uniqueness only**. Excerpt: the events are
+declared in the same model.
 
 ```screenplay
 constraint UniqueInvoiceNumber
   unique invoiceNumber on InvoiceRegistered
+  released by InvoiceCancelled
+  ignore casing
+  message "That invoice number is already in use"
 
 constraint OneRegistrationPerInvoice
   unique event InvoiceRegistered
-
-constraint InvoiceStatusTransition
-  file Constraints/InvoiceStatusTransition.cs
 ```
 
-A constraint with no body is an error naming the three forms. Use a constraint
-when two concurrent appends must not both win — a `validate` rule cannot do that.
+- `unique <p>[, <p>…] on <Event>` — a value (or composite value, in order) held by
+  one event source is unavailable to every other. Repeat the line for other
+  events sharing the claim. The same event source may re-claim its own value; a
+  null value claims nothing. The property must be declared directly on the event
+  (`PLAY0391`).
+- `unique event <Event>` — the event occurs at most once per event source.
+- `released by <Event>` (repeatable) frees the claim; `ignore casing` applies to
+  property rules only (`PLAY0393`); `message` replaces the default violation text —
+  never put the colliding value in it.
+- **The name is the identity.** It is unique across the application (`PLAY0392`),
+  and renaming a constraint starts a new, empty index.
+- Chronicle updates the uniqueness index after the append commits; do not describe
+  it as an atomic index-and-append guarantee.
+
+⚠️ **Do not use `constraint … file <Path>` for other rules.** It can only name a
+hand-written Chronicle `IConstraint`, which can only declare uniqueness; it warns
+(`PLAY0396`) and the executable model rejects it. A state transition rule
+belongs in `validate`/`require`. Use a constraint when two concurrent appends must
+not both win — a `validate` rule cannot do that.
 
 ## `concept` and `type`
 
@@ -209,7 +290,9 @@ The seven primitives are `Uuid`, `String`, `Int`, `Decimal`, `Bool`, `Date` and
 is why the compiler says *expected … or Enum* rather than listing it among them.
 Attributes `@pii` and `@sensitive`, each with at most one `reason`; a
 reason for an attribute the concept does not declare is an error. **Compliance is
-inherited** — a property typed with a `@pii` concept is PII everywhere.
+inherited** — a property typed with a `@pii` concept is PII everywhere. The
+executable model does not bind compliance attributes yet (`PLAY0268`); keep them,
+because the classification is the point.
 
 ⚠️ **Enum trap.** A value literally named `validate` is read as an empty validate
 block. Write `@validate` for the value; the compiler warns when it sees the
@@ -223,11 +306,15 @@ commands reference; use `concept` for a single wrapped primitive.
 ```screenplay
 policy IsAuthenticated
   require authenticated
+policy IsAccountant
+  require role "Accountant"
 policy CanManageInvoice
   require role "InvoiceManager"
     or role "Accountant"
 policy OwnsInvoice
   require claim "sub" matches subject
+policy IsAdultCustomer
+  file Policies/IsAdultCustomer.cs
 
 persona Accountant
   description "Handles invoicing and collections"
@@ -235,11 +322,18 @@ persona Accountant
 ```
 
 Three condition forms: `authenticated`, `role "<name>"`, and
-`claim "<name>" matches subject | <value>`. A policy must declare a `require`
-condition or an inline code block.
+`claim "<name>" matches subject | "<value>" | <path>`. A policy has **exactly one**
+`require` line — continue the condition on deeper-indented lines instead of adding
+a second (`PLAY0441`) — **or** one implementation (a tagged ` ```csharp ` block or
+`file`), never both (`PLAY0440`). Declarative policies run in the reference
+runner; a code policy binds as opaque ESM v3 and needs a target to evaluate it.
+A `persona` is documentation for people; it blocks executable binding
+(`PLAY0268`).
 
 ## `seed`
 
+Excerpt: `CustomerRegistered` is declared in a slice.
+
 ```screenplay
 seed
   for "3fa85f64-5717-4562-b3fc-2c963f66afa6"
@@ -248,7 +342,8 @@ seed
 ```
 
 Events append to that event source in declaration order, using the same mapping
-expression grammar as `produces`. Several `seed` blocks accumulate.
+expression grammar as `produces`. Several `seed` blocks accumulate. Seeding is
+operational metadata, not part of executable behavior (`PLAY0270`).
 
 ## `$context`
 
@@ -266,10 +361,13 @@ Four contexts, and **what each omits is load-bearing** — read
 ## Verify
 
 - [ ] `screenplay <model> --warnaserror` reports zero errors and zero warnings.
-- [ ] Exactly one command property carries `identifier`, and no event property does.
+- [ ] At most one command property carries `identifier`, and no event property does.
 - [ ] Format rules live on the `concept`; state-dependent rules are specifications.
 - [ ] Every `authorize` combining policies writes `and`/`or` explicitly.
-- [ ] Any `reads` that decides a rule is paired with a `concurrency` block.
+- [ ] No `reads` or `concurrency` is described as protecting a decision; the gap
+      is stated.
+- [ ] Constraints are `unique` forms; no `file` constraint stands in for another rule.
+- [ ] Each policy has one `require` or one implementation, not both.
 - [ ] Personal data is `@pii` on the concept, with a reason.
 - [ ] No event carries an optional property covering two situations.
 
@@ -277,5 +375,5 @@ Four contexts, and **what each omits is load-bearing** — read
 
 - Deciding *which* commands and events exist: `cratis-screenplay-event-modeling`.
 - Building read models from these events: `cratis-screenplay-projections`.
-- Pinning the rejections: `cratis-screenplay-specifications`.
-- The admitted-versus-parsed boundary: `cratis-screenplay-model-authoring`.
+- Pinning the rejections and denials: `cratis-screenplay-specifications`.
+- The parsed/bound/executed boundary: `cratis-screenplay-model-authoring`.

package/package/corpus/skills/cratis-screenplay-command-surface/references/context.md

@@ -32,8 +32,13 @@ public record PolicyContext(
 | **Policy** | a `policy` code block | **`CausedBy`, `Causation`** | a decision about the caller, not an audit record |
 
 `RuleContext` carries `Artifact` (the whole thing under validation), `Value` (the
-value the rule is declared on) and `Property` (where it sits — empty for a
-whole-command `require`).
+value the rule is declared on) and `Property` (where it sits — empty for a fenced
+`validate` block). A `require` condition is declarative and gets no code context.
+
+Beside every `dynamic` member there is a typed accessor so LINQ binds at compile
+time: `CommandAs<T>()`, `ArgumentsAs<T>()`, `ArtifactAs<T>()`, `ValueAs<T>()`, and
+`StateAs<T>()`/`EventAs<T>()` on the reducer context. A payload of another type
+throws `ContextPayloadTypeMismatch`.
 
 ## The values they carry
 
@@ -50,8 +55,12 @@ with an appended event.
 
 ## Reaching the context declaratively
 
-Usable wherever a mapping source is — `produces` mappings, `seed` values, capture
-`append` mappings, query `from` parameters:
+Parsed wherever a mapping source is — `produces` mappings, `seed` values, capture
+`append` mappings, query `from` parameters. **Only a narrow subset binds to the
+executable model in `produces`:** `$context.occurred` (the occurrence time, not a
+guaranteed append time) and the audit identity `$context.identity.id`/`.name`/
+`.userName` (equal to `$context.causedBy.subject`/`.name`/`.userName`). Tenant,
+roles, claims and causation report `PLAY0268`.
 
 | Path | Yields |
 | --- | --- |
@@ -76,13 +85,15 @@ An unknown `$context.` path is reported, so a typo does not silently become null
 | `$env.<VAR_NAME>` | mapping sources | an environment variable |
 | `$eventContext.<property>` | **projections only** | `occurred`, `sequenceNumber`, `correlationId`, `eventSourceId` |
 | `$eventSourceId` | **projections only** | shorthand for `$eventContext.eventSourceId` |
-| `$causedBy.<property>` | **projections only** | `subject`, `name`, `userName` — an unknown one is an error naming all three |
+| `$causedBy.<property>` | **projections only** | `subject`, `name`, `userName`; parses, but does not bind (`PLAY0268`) — write `$eventContext.causedBy.subject` instead |
 | `$.` | **captures only** | a value from the current source item |
 | `$strings.<dotted.key>` | labels, titles, messages | a localized string from a `.strings` file |
 
 ## Templates and literals
 
-A template is backticked with `${}` substitutions:
+A template is backticked with `${}` substitutions. It parses in mappings but does
+not bind to the executable model in `produces` or projections. Excerpt, one
+mapping line inside a `produces` block:
 
 ```screenplay
 fullName = `${firstName} ${lastName}`
@@ -90,11 +101,12 @@ fullName = `${firstName} ${lastName}`
 
 Literals are `true` / `false`, `"quoted text"`, numbers (`42`, `-3.14`), and
 `null`. In a projection, `literal <value>` forces a value to be read as a literal
-rather than a property path — that is how a constant key is written:
+rather than a property path — that is how a constant key is written. Excerpt,
+inside a `projection`:
 
 ```screenplay
 from UserLoggedIn key literal "site-stats"
-  count TotalLogins
+  count totalLogins
 ```
 
 ⚠️ A template expression is **not allowed in a composite key**, and a composite