chore(release): 0.9.1

.agents/skills/testing-pilot-corpora-gate/SKILL.md

@@ -183,8 +183,8 @@ gate's own helpers are package-private but reusable (`pilotCorporaGate.files(t)`
 
 `actionlint`, `shellcheck`, `python3 scripts/check-doc-links.py`, `gofmt`, `go vet`,
 `go run -C tools ./cmd/pilot-diff` (validators pre-downloaded; ~4min, prints e.g.
-the headline the committed baseline holds — `379 file(s), 347 fully agreeing; 38 agreed
-diagnostic(s), 38 only ours, 1582 only the pilot's` at the `2026-08` pin, so read it from
+the headline the committed baseline holds — `380 file(s), 345 fully agreeing; 38 agreed
+diagnostic(s), 41 only ours, 1614 only the pilot's` at the `2026-08` pin, so read it from
 `docs/project/pilot-differential-baseline.json` rather than from this line)
 and `make lint` (staticcheck+gosec, ~2min) all work. There is **no** `yamllint` and **no**
 `circleci` CLI, so `.circleci/config.yml` can only be parsed as YAML, not schema-validated — say so

.agents/skills/testing-pilot-differential/SKILL.md

@@ -21,13 +21,16 @@ GNU-format diagnostics **relative to `--root`**. Consequences for testing:
 - The pin `tools/referee/diff` reports comes from `build/pilot-sysml-validator/pilot-pin.txt`
   (written by the new script), not from the DeciSym `pom.xml`.
 - `-validator /nonexistent` now says `run ./scripts/download-pilot-sysml-validator.sh`.
-- Measured at the `2026-08` pin, with a fresh library cache: `379 file(s), 347 fully agreeing; 38 agreed,
-  38 only ours, 1582 only the pilot's`, JSON totals `openSysMLDiagnostics 79 / pilotDiagnostics
-  1623 / severityMismatch 3`; ~2 min wall, byte-identical across runs *and* after a from-scratch
-  rebuild of `build/pilot-validator`. The six `kerml-examples` pilot-only rows the `2026-07` run
-  carried (`The opposite features 'owningType' … do not refer to each other`) are gone: the pilot
-  fixed its `ownedDisjoining` delegate, and nothing on our side moved. `kerml-examples` carries no `syntax` diagnostic on either
-  side. Refresh this paragraph with every rebaseline, and treat a stale one as a finding.
+- Measured at the `2026-08` pin after bare parameters took their effective range `[0..*]`, removing
+  the adjudicated `Behaviors.kerml:14` multiplicity warning (the `[1]` `RocketEquation` inputs keep
+  its warning at `delta-v-budget.sysml:93`): `380 file(s), 345 fully agreeing; 38 agreed, 41 only
+  ours, 1614 only the pilot's`, JSON totals `openSysMLDiagnostics 82 / pilotDiagnostics 1655 /
+  severityMismatch 3`; ~2 min wall, byte-identical across runs *and* after a from-scratch rebuild of
+  `build/pilot-validator`. The six `kerml-examples` pilot-only rows the `2026-07` run carried (`The
+  opposite features 'owningType' … do not refer to each other`) are gone: the pilot fixed its
+  `ownedDisjoining` delegate, which did not move our side at that time. `kerml-examples` carries no
+  `syntax` diagnostic on either side. Refresh this paragraph with every rebaseline, and treat a
+  stale one as a finding.
 - **`tools/referee/diff` has no `-jobs` flag.** Its full flag set is
   `-repo -validator -kerml-validator -syside -out -timeout`; passing `-jobs` exits **2** with
   `flag provided but not defined: -jobs`. Only `tools/referee/xpect` is job-parallel. So a PR that
@@ -136,14 +139,19 @@ The harness compares OpenSysML diagnostics against the OMG SysML v2 Pilot Implem
 (via two pinned plain-Java bridges over the pilot's own validators) over four corpus roots and writes
 `build/pilot-diff/pilot-diff.{txt,json}`. `docs/project/pilot-differential-baseline.json` is the
 committed result of the *last refreshed* run, so **the harness is testable by reproduction** —
-but only while the baseline is current. Check that first. As of the rebaseline that came when the Legend of the Red Dragon example left for its own repository it **is**
-current: a live run gives `379 file(s), 347 fully agreeing; 38 agreed, 38 only ours, 1582 only the
-pilot's`, byte-identical to the committed baseline, and `docs/project/pilot-differential.md`'s
-"Results" table matches. The rebaseline before it, at the architecture self-model's landing, covered two rounds, because the succession-shorthand
-removal before it landed without refreshing the baseline; a control run of its merge commit gives
-`32 agreed, 54 only ours, 79 only the pilot's`. When it is stale (it was at `ac4ac4fb`, and again while the F60–F69 fix
-PRs were in flight), a non-empty `jq -S` baseline diff is *not* by itself evidence of a
-regression — see "Isolating one change's effect" below.
+but only while the baseline is current. Check that first. The latest rebaseline, after bare
+parameters took their effective range `[0..*]` and removed the adjudicated `Behaviors.kerml:14`
+warning (the `[1]` `RocketEquation` inputs still produce the warning at
+`delta-v-budget.sysml:93`), is current: a live run gives `380 file(s), 345 fully agreeing; 38
+agreed, 41 only ours, 1614 only the pilot's`, byte-identical to the committed baseline, and
+`docs/project/pilot-differential.md`'s "Results" table matches. The prior rebaseline, when the
+Legend of the Red Dragon example left for its own repository, gave
+<!-- doc-count:historical -->`380 file(s), 344 fully agreeing; 38 agreed, 42 only ours, 1614 only the pilot's`.
+The rebaseline before that, at the architecture self-model's landing, covered two rounds, because
+the succession-shorthand removal before it landed without refreshing the baseline; a control run
+of its merge commit gives `32 agreed, 54 only ours, 79 only the pilot's`. When it is stale (it was
+at `ac4ac4fb`, and again while the F60–F69 fix PRs were in flight), a non-empty `jq -S` baseline
+diff is *not* by itself evidence of a regression — see "Isolating one change's effect" below.
 
 ## Prerequisites
 

.agents/skills/testing-pilot-execution-referee/SKILL.md

@@ -148,8 +148,8 @@ pilot answers the representation's own. See
   `pilot-exec-diff: <file>:<line>: model no/such/model.sysml: stat <abs>: no
   such file or directory`.
 - **Additivity.** `go run -C tools ./cmd/pilot-diff` must still print the headline the
-  committed baseline holds (`379 file(s), 347 fully agreeing; 38 agreed
-  diagnostic(s), 38 only ours, 1582 only the pilot's` at the `2026-08` pin — read it from the baseline JSON, not from this line, since each
+  committed baseline holds (`380 file(s), 345 fully agreeing; 38 agreed
+  diagnostic(s), 41 only ours, 1614 only the pilot's` at the `2026-08` pin — read it from the baseline JSON, not from this line, since each
   fix round moves it) and `jq -S` diff clean against
   `docs/project/pilot-differential-baseline.json`; `git status --porcelain`
   empty at the end.

.agents/skills/testing-pilot-rejection/SKILL.md

@@ -9,7 +9,7 @@ Sibling of `testing-pilot-differential` and `testing-pilot-xpect` (same pin
 `scripts/pilot-pin.sh`, same committed-baseline shape), but pointed the other way: the
 differential measures what the reference accepts and we reject; this oracle measures what the
 reference **rejects and we accept** — permissiveness gaps. Its corpus is committed under
-`tools/referee/reject/testdata/negative/` (306 hand-written invalid models, one violated rule + citation
+`tools/referee/reject/testdata/negative/` (310 hand-written invalid models, one violated rule + citation
 in each file's mandatory `// Invalid: ...` first line), so no corpus download exists. Method and
 findings: `docs/project/pilot-rejection.md`.
 
@@ -35,8 +35,8 @@ As of the `semantic/` source (named pilot constraints, KerML and SysML, the cont
 succession rules, the feature-value overriding rule, the enumeration-variation rules, the send-action cases,
 the metadata typing, annotated-element and body rules, the trigger-argument typing rules, the owning-body member rules, the cross-subsetting rules, the variant port rule, the association arity, binary-link end
 count and multiplicity-bound typing rules, the result-expression ownership rules, and the annotation-ownership, binding-arity, feature-chain conformance,
-conjugated typing and end-feature rules, the end-multiplicity, return-owner and single-conjugator rules, the keyword-first relationship end kinds, the prefix and body-context cases, and the redefinition name-resolution cases), with a fresh library cache:
-`306 case(s): 297 both reject, 0 only the pilot rejects, 9 only we reject, 0 both accept`,
+conjugated typing and end-feature rules, the end-multiplicity, return-owner and single-conjugator rules, the keyword-first relationship end kinds, the prefix and body-context cases, the redefinition name-resolution cases, and the transition accept usage-typing rule), with a fresh library cache:
+`310 case(s): 301 both reject, 0 only the pilot rejects, 9 only we reject, 0 both accept`,
 byte-identical to the committed baseline. Any `both accept` case is a bug in the corpus (the case
 is not actually invalid under the loaded standard library) — fix the case, never ignore it. A
 candidate the pilot accepts because it does not enforce the named constraint is not a case either:

.agents/skills/testing-pilot-xpect/SKILL.md

@@ -416,8 +416,8 @@ census in `w5c_census_test.go` is live two ways: perturb one pinned triple (e.g.
 ## Regression neighbour
 
 `go run -C tools ./cmd/pilot-diff` (~1m12s) must still print the headline the *committed* baseline holds —
-at the `2026-08` pin that is `379 file(s), 347 fully agreeing; 38 agreed diagnostic(s), 38
-only ours, 1582 only the pilot's`. Read the number out of
+at the `2026-08` pin that is `380 file(s), 345 fully agreeing; 38 agreed diagnostic(s), 41
+only ours, 1614 only the pilot's`. Read the number out of
 `docs/project/pilot-differential-baseline.json` rather than trusting this line, since a landing fix
 round moves it. When the baseline is itself stale (it was at `19a3ce03`, holding 273 / 281 / 317), a
 failing `cmp` against it is *not* evidence of an Xpect regression — compare the summary line, and see

.agents/skills/testing-sysml-repl/SKILL.md

@@ -661,6 +661,32 @@ Also note the parser rejects `require constraint <name> { … }` (a *named* nest
 `require`/`assume`): `expected '{' after 'require constraint'`. Only the anonymous form and the
 `require R { … }` reference form parse, so an export test cannot cover the named variant.
 
+## Python multi-document parsing (`Connection.parse_sources`)
+
+- Drive the public `opensysml.Connection.parse_sources` against a real service
+  with a library document and a second document that imports it. Assert more
+  than the absence of diagnostics: the dependent symbol's `specializations`
+  entry with `kind == "typing"` must have `target_id` naming the library's
+  definition (`Symbol` has no `.type` property), and `model.documents` must
+  keep document order, `model.roots` one root per document.
+- Use `opensysml.loads` on the dependent document alone as the negative
+  control: its import must fail. A diagnostic's `.file` is the document's
+  name as given, including inline names that look like relative paths.
+- To prove validation happens before any RPC, attach a delegating
+  `grpc.UnaryUnaryClientInterceptor` to the connection's channel and stub,
+  count both GetServerInfo and ParseSources, and follow the invalid input with
+  a valid call so the instrumentation cannot yield a vacuous pass.
+- A conformance fixture containing `choice c;` also needs an outgoing
+  transition, or it fails on an unrelated semantic error. For an isolated
+  extension warning use
+  `package P { state def S { choice c; state a; transition first c then a; } }`;
+  check the diagnostic goes from warning to error with
+  `strict_conformance=True`, then that `strict=True` raises `ModelError`.
+- The module-level `opensysml.parse_sources` opens the default connection,
+  which starts a private service unless a port is named; close it afterwards
+  (`opensysml._default_connection.close()`), or a later test that asserts no
+  private service is running fails.
+
 ## Argument order and the `--` marker
 
 `cmd/sysml/args.go` permutes arguments before `flag.Parse`, so flags may be written **after** the
@@ -2530,9 +2556,66 @@ its output rather than in an exit code — so assert on the exact rendered text:
 
 ## Multi-file projects: `%load <path>...` and positional dirs/globs (PR #146)
 
+### Per-file document isolation probes
+
+- Give only one file a root-level `private import ScalarValues::*;`. A second
+  file's bare `Real` must stay unresolved, as must a later prompt declaration's
+  bare `Real`. A qualified expression such as `%eval A::x + 1.0` should still
+  work, proving isolation did not remove the loaded package from the index.
+- Two loaded files declaring the same root package are two root namespaces, not
+  a duplicate. References select the declaration in the document whose name
+  sorts first, independent of CLI argument order (see the CLI reference's
+  Multiple Files section). Put `A::X` in `first.sysml` and `A::Y` in
+  `second.sysml`, then reverse arguments: `A::X` must resolve and `A::Y` must
+  remain unresolved in both orders. Do not confuse reference precedence with
+  document rendering order.
+- For rendering order, `%view` takes a **view**, not an ordinary package.
+  `%render #table` renders the loaded documents without a declared view; reverse
+  two nonalphabetical package names and assert their member groups reverse.
+  A declared view with `render asElementTable;` needs `private import Views::*;`
+  in its scope.
+- `%save` passes notation through the formatter. Test source retention separately
+  from byte equality: tabs can become four spaces even while comments, members,
+  file order and typed declarations survive. Compare with a `develop` build
+  before attributing such formatting to a load-path regression.
+- Both debugger fixtures in `internal/frontend/repl/testdata/` are load-ready:
+  `action_debug.sysml` (`%action Debug::tally`, `%step`, type `part def Z;`,
+  `%continue`) ends at `total = 5`; `state_debug.sysml` (`%state Debug::Cycle`,
+  `%advance 1`, type `part def Z;`, `%advance 9`, `%advance 5`) reaches working
+  at t=10 and done at t=15. This tests symbol rebinding across prompt edits.
+
+#### Devin Secrets Needed
+
+None for local multi-file CLI/REPL tests.
+
+### Parallel file-load verification
+
+- The shared concurrency knob is `-jobs N` / `OPENSYSML_JOBS`, also observable
+  with `%jobs`. It bounds both plan execution and files parsed/validated in one
+  load. Compare stdout, stderr and exit status at 1, 2 and 8 jobs plus an
+  environment override; test invalid values against a nonexistent path to
+  distinguish startup rejection from a load failure. `-workers` is not a
+  supported replacement flag.
+- Generate a small multi-file model from the nested tools module:
+  `go run -C tools ./cmd/stress-model -planes 4 -satellites 10 -ground-stations 8 -split-planes <scratch-dir>`.
+  Verify SHA256/name manifest records, then shrink the model: unchanged surplus
+  output should disappear, while an edited surplus plane and user file survive.
+  Editing a still-current output should refuse the entire regeneration with
+  `nothing written`; compare all directory bytes before and after.
+- A load containing `part component : Needed::T;` gives a non-vacuous batch
+  diagnostic. In `%verbosity debug`, declare `package Needed { part def T; }`,
+  then `package Needed {}`, then restore `T`. Whole-buffer diagnostics must
+  change 1→0→1→0. An empty package removes its members; a nonempty declaration
+  merges with existing members and is not a suitable deletion probe.
+- For save/reload, retain comments and loaded-file declarations and assert
+  only the latest prompt redeclaration survives. Re-evaluate a compound
+  expression after `%clear` and reloading the saved file.
+
 `sysml <dir|glob|file>...` and `%load <path>...` expand to model files via
 `internal/workspace/project.Expand`, and every file is accepted before one analysis pass
-(`Session.SubmitAll`), so load order does not affect name resolution. Shapes to expect:
+(`Session.SubmitAll`), each file a workspace document of its own indexed with the
+others. Repeated root names resolve by document-name order, not load order.
+Shapes to expect:
 
 - More than one file prints a `loaded N files:` header listing each path (a single file prints no
   header — a good tell that the multi-file path was taken).