@malloy-publisher/skills 0.1.23 → 0.1.24

package/package.json

@@ -1,7 +1,7 @@
 {
    "name": "@malloy-publisher/skills",
    "description": "Agent skills for Malloy and the Malloy Publisher",
-   "version": "0.1.23",
+   "version": "0.1.24",
    "license": "MIT",
    "type": "module",
    "main": "dist/index.js",

package/skills/eval-answer/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: eval-answer
 description: 'Score one analytical answer against a verified golden, and score which of the entities the golden depends on retrieval delivered to the answerer. Run the contamination checklist, re-execute the submitted query yourself, then spawn a judge subagent per skill:eval-judge. Append attempt, tool_call, score, and retrieval_score events to the file ledger (reference/ledger-schema.md). Never explain the failure (eval-diagnose) or edit the model (eval-improve). Use when asked whether an answer was correct, to score a run, or to baseline a model.'
-version: 0.1.23
+version: 0.1.24
 ---
 
 # Evaluate One Answer

package/skills/eval-answer/reference/ledger-schema.md

@@ -124,6 +124,7 @@ on that axis.
 | `diagnoserModel` / `improverModel` | Written by `diagnose.py` / `improve.py` when those stages run, so the run names every LLM that touched it. Absent on a run that was only answered and judged. |
 | `modelGitSha` | Commit of the model repo, from `--model-repo`; `-dirty` suffix when that path had uncommitted changes -- fine for a band measurement, not for an A/B pin. **Null unless `--model-repo` names the repo.** It cannot be inferred: Publisher serves a COPY under `publisher_data/`, so the tree around the served file is the server's storage, not the model's history, and the field named that until 2026-09-03. `modelSha` above is the pin that always works; this is the pointer to where those bytes are versioned, and absent beats wrong. |
 | `modelRepo` | The path `--model-repo` named, so a reader can tell an absent pin from an unrecorded one. |
+| `modelDir` | The package directory `--model-dir` named, when it was: the path the `-dirty` marker on `modelGitSha` was decided over. Absent means the whole repo, where any unrelated untracked file marks the model dirty. |
 | `environment` / `package` / `modelPath` | What was served, and from where. On a platform target `environment` is the organization and `package` is the workspace the MCP URL is scoped to. |
 | `scope` | Platform target only: the `environment/package[@version]` the answerer was told to pass as an explicit `scopes` entry on every `get_context` / `execute_query` call. A workspace can serve many packages (a personal workspace serves every package the user can read), so without this the run also measures whether retrieval picks the right package -- a different measurement. Absent means unscoped. |
 | `targetVersion` *(pin)* | Platform target only: the published version the answers came from. Both hosted tools default an omitted version to the PINNED one, meaning whatever the workspace serves at the moment of the call, so this only describes the run when `--scope` carries it to every call. `--target-version` supplies it when the scope omits it; a scope naming a different version is refused rather than treated as an override, because a run cannot say which build answered if two pins disagree. |

package/skills/eval-answer/scripts/init_truth_package.py

@@ -23,6 +23,13 @@ WHAT IT PRODUCES
                      the header comment says to; the script will not guess
                      semantics, because guessed semantics are exactly what a
                      truth package exists to exclude.
+                     A key that composes two tables (the top N by one
+                     measure, then another measure over those rows) is written
+                     as a raw per-key rollup declared in truth.malloy --
+                     `source: t_x_by_key is t_x -> { group_by: key; aggregate:
+                     ... }` -- joined from an `extend` in the canonical query.
+                     A raw aggregate by key is not semantics, and the
+                     Publisher refuses a join declared inline in a query.
   publisher.json     the truth package, named, with the standard description.
   publisher.config.json  (--publisher-config) a Publisher server config
                      serving ONLY the truth package, for the second server the
@@ -133,6 +140,9 @@ def main() -> int:
         "//     own doc for where each comes from",
         "//   - raw-column dimensions for anything nested (a VARIANT column, a JSON",
         "//     path) that a golden query will need to group by",
+        "//   - a raw per-key rollup (`source: t_x_by_key is t_x -> { group_by: key;",
+        "//     aggregate: ... }`) wherever a key composes two tables, joined from an",
+        "//     `extend` in the canonical query: the server refuses an inline join",
         "// Keep column names in the warehouse's own case so a golden query reads as",
         "// a warehouse query, not as a model query.",
         "",

package/skills/eval-answer/scripts/ledger.py

@@ -169,7 +169,7 @@ RUN_REQUIRED = {"runId", "target", "answererModel", "phase", "started"}
 RUN_RECOMMENDED = {"judgeModel", "judgeVersion", "datasetVersion", "modelSha",
                    "skillsVersion", "answererManifest"}
 RUN_OPTIONAL = {"label", "effort", "environment", "package", "modelPath",
-                "modelGitSha", "mcpUrl", "publisher", "predictionsReExecuted",
+                "modelGitSha", "modelDir", "mcpUrl", "publisher", "predictionsReExecuted",
                 "serverVersion", "diagnoserModel", "improverModel",
                 "rubricSha",
                 # The prompt the judge was SHOWN, hashed. `rubricSha` covers

package/skills/eval-answer/scripts/verify_goldens.py

@@ -218,6 +218,16 @@ def check_value(case: dict[str, Any], a: argparse.Namespace
         # canonicalQuery" and count as an error, so a set with one criteria
         # golden failed its own audit with exit 1.
         return "skipped", "criteria: the clauses are the key, nothing to re-derive", None
+    if g.get("status") in ("ambiguous", "invalid"):
+        # A held golden is settled by a person through the golden side door
+        # and never re-derived (`promotion_blocker` says the same). Running the
+        # value check on it printed HTTP 404 on every audit for a key whose
+        # canonicalQuery read the model under test, `verify()` counted that
+        # error as drift, and `run_baseline` refused to start the arm -- with
+        # `--refresh` as the suggested remedy, which cannot fix an error.
+        return ("skipped",
+                f"{g['status']}: settled by a person through the golden side "
+                f"door, not re-derived", None)
     if not q:
         # A PROVISIONAL golden with no query is young, not wrong, and it is
         # exactly what `eval-import` produces from a set that arrived as
@@ -243,6 +253,21 @@ def check_value(case: dict[str, Any], a: argparse.Namespace
     rows, err = try_query(a.publisher, a.environment, a.truth_package,
                           a.truth_model, q)
     if err:
+        if "not queryable" in err:
+            # The single most likely state of a set authored before its truth
+            # package existed: every key replays a packaged view (`run:
+            # orders -> ...`), and the truth server answers 404 "Query
+            # target is not queryable" 23 times with no hint that the query's
+            # root source is not a raw table. The message sent a reader to the
+            # server; the defect is in the golden.
+            m = re.match(r"\s*run:\s*([A-Za-z_]\w*)", q)
+            root = f"`{m.group(1)}`" if m else "its root source"
+            return ("error",
+                    f"canonicalQuery reads {root}, which the truth package does "
+                    f"not serve as queryable: either the truth model does not "
+                    f"declare it (a key derived through the model under test, "
+                    f"not the raw tables) or the query did not compile. "
+                    f"Re-derive the key through the truth package", None)
         return "error", err[:160], None
 
     want = g.get("value")

package/skills/eval-answer/scripts/verify_goldens_test.py

@@ -1021,3 +1021,67 @@ class NumericRendering(unittest.TestCase):
 
 if __name__ == "__main__":
     unittest.main()
+
+
+class HeldGoldensAreNotReDerived(unittest.TestCase):
+    """An `ambiguous` or `invalid` golden is a person's judgement. Running the
+    value check on one reported an error on every audit, `verify()` counted the
+    error as drift, and the arm refused to start."""
+
+    def setUp(self):
+        self.a = argparse.Namespace(rewrite=False, publisher="http://x",
+                                    environment="e", truth_package="t",
+                                    truth_model="truth.malloy")
+
+    def case(self, status):
+        return {"qid": "s-1", "golden": {"kind": "scalar", "status": status,
+                                          "canonicalQuery": "run: model -> { aggregate: n }",
+                                          "value": {"n": 1}}}
+
+    def test_a_held_golden_is_skipped_with_the_reason(self):
+        for status in ("ambiguous", "invalid"):
+            with self.subTest(status=status):
+                with unittest.mock.patch.object(verify_goldens, "try_query") as tq:
+                    got, detail, rows = check_value(self.case(status), self.a)
+                tq.assert_not_called()
+                self.assertEqual(got, "skipped")
+                self.assertIn(status, detail)
+                self.assertIn("side door", detail)
+
+    def test_a_provisional_golden_with_a_query_still_runs(self):
+        with unittest.mock.patch.object(verify_goldens, "try_query",
+                                        return_value=([{"n": 1}], None)) as tq:
+            got, _, _ = check_value(self.case("provisional"), self.a)
+        tq.assert_called_once()
+        self.assertEqual(got, "ok")
+
+
+class ANotQueryableKeyNamesItsRootSource(unittest.TestCase):
+    """A set authored before its truth package existed replays packaged views;
+    the truth server answers 404 for each, and the bare message sent a reader
+    to the server instead of the golden."""
+
+    def test_the_root_source_and_the_remedy_are_in_the_detail(self):
+        a = argparse.Namespace(rewrite=False, publisher="http://x", environment="e",
+                               truth_package="t", truth_model="truth.malloy")
+        case = {"qid": "s-2", "golden": {"kind": "scalar", "status": "provisional",
+                                          "canonicalQuery": "run: orders -> { aggregate: n }",
+                                          "value": {"n": 1}}}
+        err = 'HTTP 404: {"code":404,"message":"Query target is not queryable."}'
+        with unittest.mock.patch.object(verify_goldens, "try_query",
+                                        return_value=(None, err)):
+            got, detail, _ = check_value(case, a)
+        self.assertEqual(got, "error")
+        self.assertIn("`orders`", detail)
+        self.assertIn("truth package", detail)
+
+    def test_any_other_error_is_reported_as_it_came(self):
+        a = argparse.Namespace(rewrite=False, publisher="http://x", environment="e",
+                               truth_package="t", truth_model="truth.malloy")
+        case = {"qid": "s-3", "golden": {"kind": "scalar", "status": "provisional",
+                                          "canonicalQuery": "run: t_a -> { aggregate: n }",
+                                          "value": {"n": 1}}}
+        with unittest.mock.patch.object(verify_goldens, "try_query",
+                                        return_value=(None, "HTTP 500: boom")):
+            got, detail, _ = check_value(case, a)
+        self.assertEqual((got, detail), ("error", "HTTP 500: boom"))

package/skills/eval-diagnose/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: eval-diagnose
 description: 'Diagnose why a scored answer failed and who owns the fix, then cluster the failures by shared root cause. Walk dataset, agent-call, get_context/model, get_context/retrieval, construction, then model-definition. Append issue events to the file ledger, linked by traceId, one per cluster. Use after eval-answer, when triaging a run, or before changing a model. Does not edit the model (eval-improve).'
-version: 0.1.23
+version: 0.1.24
 ---
 
 # Diagnose One Answer

package/skills/eval-import/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: eval-import
 description: 'Turn a list of questions into an eval set, whatever shape it arrived in: a JSONL a customer sent, a CSV, a spreadsheet export, a markdown doc, an email thread, or a pull from production logs. Classify each item by what came WITH the question (a query, a number, prose criteria, or nothing), write cases.jsonl and set.json per reference/case-format.md, keep the file as it arrived, and seal each question so a later edit is detectable. Never marks a value-bearing golden verified and never invents a question. Use when questions arrive from outside and need to become a set, or before the first run against a set nobody here authored.'
-version: 0.1.23
+version: 0.1.24
 ---
 
 # Import questions into an eval set

package/skills/eval-import/reference/case-format.md

@@ -13,7 +13,7 @@ On the case:
 | field | from the source | when it is missing |
 |---|---|---|
 | `qid` | their id, if they gave one, prefixed with the set name | derive from the question: a slug of its first words plus a counter. Stable, because scores are keyed on it |
-| `question` | the question text, byte for byte | it is not a case. Do not reconstruct a question from a criterion |
+| `question` | the question text, byte for byte. One exception: a source hard-wrapped at a column width cannot be one line byte for byte, so a line break inside a question becomes one space, the seal is on the unwrapped text, and `sourceNote` says so | it is not a case. Do not reconstruct a question from a criterion |
 | `questionSha` | never from the source | stamped at conversion by `import_cases.py --stamp` |
 | `split` | rarely present | you choose, and freeze it at import |
 | `source` | how it arrived: the filename, or the log query | say `unknown` rather than guessing a provenance |

package/skills/eval-improve/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: eval-improve
 description: 'Make the smallest safe Malloy model edit that closes a diagnosed model-owned gap, with a probe receipt for every factual claim. Use after eval-diagnose, or when asked to fix a model so an agent can discover the right answer. Never accepts its own edit; the acceptance check belongs to eval-loop. Does not decide whether an answer was wrong (eval-answer) or why (eval-diagnose).'
-version: 0.1.23
+version: 0.1.24
 ---
 
 # Improve the Model

package/skills/eval-judge/SKILL.md

@@ -1,12 +1,12 @@
 ---
 name: eval-judge
 description: 'Decide whether ONE answer matches its golden, and say whether you believe the golden. Read this before emitting any verdict. Covers containment, column pairing, near_match, refusals, and the gold_status judgement. Use when scoring an attempt in an evaluation run; never to conduct a run (eval-loop), diagnose a failure (eval-diagnose) or edit a model (eval-improve).'
-version: 0.1.23
+version: 0.1.24
 ---
 
 # The judge
 
-JUDGE_VERSION: 5
+JUDGE_VERSION: 6
 
 This skill IS the judge. One fresh judge subagent is spawned per attempt, with
 this skill installed in its workspace and the case materials in its prompt. It
@@ -186,6 +186,29 @@ Output, exactly this shape:
    total; the question had never asked for one. A rubric that means "campaign
    total only" must say so as `REQUIRED`, and the question should say so too.
 
+### Rubric markers
+
+A case rubric marks its alternate readings and disclosures with the words
+below, and each word fixes the verdict. Apply them as written; do not re-weigh
+a reading the rubric has already classified. (`reference/writing-rubrics.md`
+is where authors are told to use them; this table is the judge's half.)
+
+| Marker | Verdict | Meaning |
+|---|---|---|
+| `PREFERRED` | `match` | The reading the golden encodes. |
+| `ACCEPT` | `match` | Equally right: a different but faithful route to the same claim. Check the figure against the golden the way the clause says to. |
+| `DIVERGENT` | `near_match` | Defensible and not what was asked for. Never `no_match`, however clearly the answer committed to it. |
+| `WRONG` | `no_match` | Plausible and incorrect; the clause usually names the trap. |
+| `REQUIRED` | omitted: `no_match` | A disclosure without which the number misleads. |
+| `CREDITED` | omitted: `match` | Context a good analyst adds; its absence costs nothing. |
+
+Measured on an unchanged answer, rubric and golden: an answer whose
+recommended figure the rubric marked `DIVERGENT` scored `near_match` under
+one judge and `no_match` under the next, because the judge had never been
+told what the word meant and weighed the commitment instead. An unmarked
+clause is `CREDITED` (the author's bug, not yours to repair by inventing a
+requirement).
+
 ### Anchors
 
 - **match**: question "total sales by category"; golden 8 rows

package/skills/eval-judge/reference/writing-rubrics.md

@@ -40,6 +40,14 @@ Rules that follow from this:
   must say "for the campaign as a whole". If it does not, the rubric must accept
   a correct figure at any stated grain (judge rule 11). A rubric that quietly
   assumes the golden's grain fails correct answers.
+- **Fix the cardinality in the question, or accept any prefix in the rubric.**
+  "The most", "the top ones", "most often" name no N; the truth query needs
+  one, so the golden fixes 10 or 20 or 25 and an answer that shows five
+  correct rows reads as missing fifteen. Measured over one 24-case set, that
+  class alone produced a `no_match`, a flip and two `near_match` verdicts on
+  answers whose rows were a correct prefix of the golden's. Either write the N
+  into the question, or mark the rubric `ACCEPT the first N of the golden's
+  order for any N of at least five`, and say which order the golden is in.
 - **A right value plus a missing `CREDITED` disclosure is a `match`.** Not a
   near match. Do not deduct for it.
 - **`DIVERGENT` is about definitions, not arithmetic.** A clause permitting a

package/skills/eval-loop/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: eval-loop
 description: 'Conduct a local Publisher evaluation loop in five steps: scrape/run, eval, diagnose, improve, checkpoint. You are the conductor: import cases into the file ledger, spawn a blind answerer, then run eval-answer, eval-diagnose, and eval-improve. Persistence is plain files under the model package''s evals/ directory; checkpoints are git commits of the model repo. Use to score a model, diagnose failures, improve behind an acceptance check, or roll back a bad direction.'
-version: 0.1.23
+version: 0.1.24
 ---
 
 # The Evaluation Loop

package/skills/eval-loop/reference/running-a-run.md

@@ -15,6 +15,10 @@ check, a judge, and a conformant `events.jsonl`.
 #    if it does not reach `ready`: the sync is lazy, so without it the first
 #    cases are answered LEXICALLY and the run reports that as the model's
 #    number.
+#    Semantic retrieval needs EMBEDDING_API_KEY in the server's environment
+#    (the Publisher does not read OPENAI_API_KEY); without it every ranking is
+#    lexical, the warm-up reports `cooldown`, and the provider's own error is
+#    only in publisher.log (grep Embedding).
 python3 skills/eval-loop/scripts/serve.py --publisher-dir <publisher>/packages/server \
   --server-root <root> --port 4811 --mcp-port 4040 --trace-retrieval \
   --warm-retrieval --environment <env> --package <pkg> \

package/skills/eval-loop/scripts/agent_harness.py

@@ -90,6 +90,11 @@ ALWAYS_BLOCKED = (
     # launched detached, and they alone flagged every attempt in a 37-case run.
     # `Task` was blocked; the newer task-management tools were not.
     "TaskCreate", "TaskGet", "TaskList", "TaskUpdate",
+    # Granted to every headless session by the current CLI. Measured
+    # 2026-09-22 on the first smoke against a real model: it alone flagged the attempt
+    # contaminated on an answer that made two MCP calls and nothing else, and
+    # a judged arm would have voided all 24 verdicts.
+    "Artifact",
 )
 
 # The role-dependent half, and the reason it cannot join ALWAYS_BLOCKED:

package/skills/eval-loop/scripts/agent_harness_test.py

@@ -94,9 +94,11 @@ class TheFence(unittest.TestCase):
         # Each of these was measured as GRANTED to the clustering agent on
         # 2026-09-08. `Task` spawns a sub-agent confined by nothing;
         # `ReportFindings` cost the coverage judge its only turn.
+        # `Artifact` was measured as granted to a headless answerer on
+        # 2026-09-22; it alone flagged the attempt contaminated.
         for tool in ("Task", "ReportFindings", "SendMessage", "Workflow",
                      "ScheduleWakeup", "RemoteTrigger", "ShareOnboardingGuide",
-                     "WebFetch", "WebSearch", "ReadMcpResourceTool"):
+                     "WebFetch", "WebSearch", "ReadMcpResourceTool", "Artifact"):
             with self.subTest(tool=tool):
                 self.assertIn(tool, ah.ALWAYS_BLOCKED)
                 self.assertIn(tool, spawn_cmd(mcp_url=None))

package/skills/eval-loop/scripts/run_baseline.py

@@ -594,7 +594,43 @@ def path_breaches(events: list[dict[str, Any]],
     return list(r["reasons"])
 
 
+# Two spellings, from two CLI paths: the persisted-output stub, and the MCP
+# token-cap error ("result ... exceeds maximum allowed tokens. Output has been
+# saved to <path>"). Both leave the whole payload on disk.
+PERSISTED_STUB = re.compile(
+    r"(?:<persisted-output>.*?Full output saved to|Output has been saved to):? "
+    r"(/\S+?\.(?:json|txt))\.?(?=\s|$)", re.S)
+
+
 def result_text(block: dict[str, Any]) -> str:
+    """The text of one tool_result block, with a persisted stub resolved.
+
+    Above a size the CLI decides, a tool result reaches the answerer as a
+    `<persisted-output>` stub: a file path and a 2 KB preview. Measured on the
+    first arm against a real model, 14 of 74 get_context results (53 to 70 KB each) arrived that
+    way, and the answerer followed the path with Read every time. Reading the
+    stub as the payload scored those calls as zero entities delivered, which
+    is the opposite of what happened: the whole ranking was on disk. So when
+    the stub names a file that still exists, its content is the result.
+    """
+    text = _raw_result_text(block)
+    m = PERSISTED_STUB.search(text)
+    if m:
+        path = pathlib.Path(m.group(1))
+        if path.exists():
+            try:
+                blocks = json.loads(path.read_text())
+            except (OSError, json.JSONDecodeError):
+                return path.read_text()
+            if isinstance(blocks, list):
+                return "\n".join(b.get("text", "") for b in blocks
+                                 if isinstance(b, dict) and b.get("type") == "text")
+            if isinstance(blocks, dict) and blocks.get("type") == "text":
+                return blocks.get("text", "")
+    return text
+
+
+def _raw_result_text(block: dict[str, Any]) -> str:
     c = block.get("content")
     if isinstance(c, str):
         return c
@@ -1183,7 +1219,14 @@ _FENCE = re.compile(r"```(?:malloy)?\s*\n(.*?)```", re.S | re.I)
 
 
 def _norm(q: str) -> str:
-    return " ".join((q or "").split())
+    """One spelling for one query. Malloy takes a newline OR a semicolon
+    between clauses; the executed query (one line in the tool call) carries
+    semicolons and the block the answer prints carries newlines, so the two
+    never compared equal and `declared` never fired -- the harness fell through
+    to `last_ok` and re-executed a probe. On one acceptance arm that read a
+    model edit as a regression: the answer led with the filtered figure and
+    the harness graded the unfiltered probe it ran afterwards."""
+    return " ".join((q or "").replace(";", " ").split())
 
 
 def _model_path_of(query: str, runs: list[dict[str, Any]]) -> str | None:
@@ -1242,6 +1285,26 @@ def pick_final_query(queries: list[str], calls: list[dict[str, Any]],
     return queries[-1], "last", _model_path_of(queries[-1], runs)
 
 
+def store_events(path: pathlib.Path, events: list[dict[str, Any]],
+                 replaced_qids: set[str] | None = None) -> None:
+    """Write the arm's ledger, or splice a narrowed rebuild into it.
+
+    `--rebuild --only <qid>` re-derives the named cases and nothing else, and
+    it used to write `events.jsonl` from scratch: a 29-case arm became a
+    one-case arm after re-judging one case, its other 28 attempts and scores
+    gone (the artifacts stayed, which is how it was recovered). Downstream
+    nothing said so -- `flip_table --calibration` printed "0 flips over 1
+    cases" and `diagnose.py` found "no diagnosable failures". A narrowed
+    rebuild now replaces the named cases' lines and keeps the rest; a full
+    write (`replaced_qids` None) is unchanged.
+    """
+    if replaced_qids is None:
+        ledger.write_events(path, events)
+        return
+    ledger.replace_events(path, keep=lambda e: e.get("qid") not in replaced_qids,
+                          new=events)
+
+
 def retrieval_summary(attempts: Iterable[dict[str, Any]]
                       ) -> tuple[str, dict[str, int]]:
     """Which retriever answered this run's get_context calls, and the tally.
@@ -2686,6 +2749,13 @@ def main(argv: list[str] | None = None) -> int:
                          "Publisher serves a copy under publisher_data/, so "
                          "there is no way to infer it; without this the run "
                          "carries modelSha, the content pin, and no git pin")
+    ap.add_argument("--model-dir", default=None, type=pathlib.Path,
+                    help="the package directory inside --model-repo the answerer "
+                         "was served from. The -dirty marker on modelGitSha is "
+                         "decided over this path, so an unrelated untracked file "
+                         "elsewhere in the repo (a scratch notebook, a run "
+                         "directory) does not stamp a clean model dirty. "
+                         "Recorded as modelDir; defaults to the whole repo")
     ap.add_argument("--skills-root", default=None,
                     help="a checkout holding skills/ and manifests/ to load the "
                          "answerer's and judge's doctrine from -- a Publisher "
@@ -3198,7 +3268,8 @@ def main(argv: list[str] | None = None) -> int:
         # those bytes are versioned, and it is absent rather than wrong when
         # nobody said where that is.
         modelRepo=str(a.model_repo) if a.model_repo else None,
-        modelGitSha=(git_sha(a.model_repo, scope=a.model_repo)
+        modelDir=str(a.model_dir) if a.model_dir else None,
+        modelGitSha=(git_sha(a.model_repo, scope=a.model_dir or a.model_repo)
                      if a.model_repo else None),
         skillsVersion=ledger.skills_git_sha(a.roots[0]),
         skillsRoot=str(a.roots[0]),
@@ -3389,7 +3460,8 @@ def main(argv: list[str] | None = None) -> int:
                           must_not_use_hits=mnu["hits"] or None,
                           artifactPath=f"artifacts/{qid}/judge.md"))
 
-    ledger.write_events(a.out / "events.jsonl", events)
+    store_events(a.out / "events.jsonl", events,
+                 {c["qid"] for c in cases} if (a.rebuild and a.only) else None)
 
     # near_match is neither a pass nor a fail: see flip_table.py. Reported on
     # its own line, because a set whose near_match count is climbing has rubrics

package/skills/eval-loop/scripts/run_baseline_test.py

@@ -77,6 +77,23 @@ class FinalQuery(unittest.TestCase):
             rb.pick_final_query(["run: a -> answer"] * 2, calls, text)[2],
             "answer.malloy")
 
+    def test_a_declared_query_matches_however_it_was_laid_out(self):
+        # The executed query is one line with semicolons; the answer prints the
+        # same query on several lines. Before, they never compared equal and
+        # the harness graded the probe that ran last.
+        ran = "run: a -> { where: x = 1; aggregate: n is count() }"
+        calls = [
+            {"tool": "execute_query", "query": ran,
+             "modelPath": "m.malloy", "error": None},
+            {"tool": "execute_query", "query": "run: a -> probe",
+             "modelPath": "p.malloy", "error": None},
+        ]
+        text = ("The filtered total.\n\n```malloy\nrun: a -> {\n  where: x = 1\n"
+                "  aggregate: n is count()\n}\n```")
+        self.assertEqual(
+            rb.pick_final_query([ran, "run: a -> probe"], calls, text),
+            (ran, "declared", "m.malloy"))
+
     def test_a_call_that_named_no_file_reports_none(self):
         # The server resolved the file from its own default, so the run's
         # default is the closer guess than a file another call named.
@@ -1503,6 +1520,16 @@ class GitSha(unittest.TestCase):
             rb.git_sha(pathlib.Path("sub"), scope=pathlib.Path("sub"))
             .endswith("-dirty"))
 
+    def test_dirt_outside_the_scope_is_not_the_models(self):
+        # A scratch file at the repo root: the tree is dirty, the model is not.
+        # Scoped to the package directory the marker says so; unscoped it
+        # stamps a clean model -dirty, which is what every run pin used to read.
+        (self.repo / "scratch.txt").write_text("notes\n")
+        self.assertFalse(
+            rb.git_sha(pathlib.Path("."), scope=pathlib.Path("sub"))
+            .endswith("-dirty"))
+        self.assertTrue(rb.git_sha(pathlib.Path(".")).endswith("-dirty"))
+
     def test_a_relative_path_still_marks_dirt(self):
         self.dirty()
         self.assertTrue(
@@ -1644,3 +1671,68 @@ class OffloadedToolResult(unittest.TestCase):
 
 if __name__ == "__main__":
     unittest.main()
+
+class NarrowedRebuildKeepsTheLedger(unittest.TestCase):
+    """`--rebuild --only <qid>` re-derives one case. It used to write the whole
+    ledger from that one case, and a 29-case arm read as a 1-case arm."""
+
+    def setUp(self):
+        self.tmp = pathlib.Path(tempfile.mkdtemp())
+        self.path = self.tmp / "events.jsonl"
+        self.old = [{"kind": "attempt", "qid": "a", "sample": 1},
+                    {"kind": "score", "qid": "a", "verdict": "match"},
+                    {"kind": "attempt", "qid": "b", "sample": 1},
+                    {"kind": "score", "qid": "b", "verdict": "no_match"}]
+        self.path.write_text("".join(json.dumps(e) + "\n" for e in self.old))
+
+    def tearDown(self):
+        shutil.rmtree(self.tmp, ignore_errors=True)
+
+    def test_only_the_named_cases_lines_are_replaced(self):
+        new = [{"kind": "attempt", "qid": "b", "sample": 1},
+               {"kind": "score", "qid": "b", "verdict": "match"}]
+        rb.store_events(self.path, new, replaced_qids={"b"})
+        got = [json.loads(l) for l in self.path.read_text().splitlines()]
+        self.assertEqual(got, self.old[:2] + new)
+
+    def test_a_full_write_still_replaces_everything(self):
+        new = [{"kind": "attempt", "qid": "c", "sample": 1}]
+        rb.store_events(self.path, new, None)
+        got = [json.loads(l) for l in self.path.read_text().splitlines()]
+        self.assertEqual(got, new)
+
+
+class PersistedStubIsTheResult(unittest.TestCase):
+    """Above a size the CLI decides, a tool result reaches the answerer as a
+    stub naming a file. Reading the stub as the payload scored 14 of 74
+    get_context calls on one arm as zero entities delivered."""
+
+    def setUp(self):
+        self.tmp = pathlib.Path(tempfile.mkdtemp())
+
+    def tearDown(self):
+        shutil.rmtree(self.tmp, ignore_errors=True)
+
+    def block(self, text):
+        return {"content": [{"type": "text", "text": text}]}
+
+    def test_the_persisted_output_stub_resolves_to_the_saved_blocks(self):
+        saved = self.tmp / "r.json"
+        saved.write_text(json.dumps([{"type": "text", "text": "ranked: a, b, c"}]))
+        stub = (f"<persisted-output>\nFull output saved to: {saved}\n\n"
+                f"Preview (first 2KB):\nranked: a")
+        self.assertEqual(rb.result_text(self.block(stub)), "ranked: a, b, c")
+
+    def test_the_token_cap_spelling_resolves_to_the_saved_text(self):
+        saved = self.tmp / "r.txt"
+        saved.write_text("ranked: a, b, c")
+        stub = ("Error: result (68,820 characters across 1 line) exceeds maximum "
+                f"allowed tokens. Output has been saved to {saved}.")
+        self.assertEqual(rb.result_text(self.block(stub)), "ranked: a, b, c")
+
+    def test_a_stub_whose_file_is_gone_is_left_as_it_was(self):
+        stub = f"<persisted-output>\nFull output saved to: {self.tmp / 'gone.json'}\n"
+        self.assertEqual(rb.result_text(self.block(stub)), stub)
+
+    def test_an_ordinary_result_is_unchanged(self):
+        self.assertEqual(rb.result_text(self.block("{\"sources\": []}")), "{\"sources\": []}")

package/skills/eval-report/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: eval-report
 description: 'Write the summary a person reads after an evaluation run: what ran, what it scored, which failures were the MODEL and which were the EVAL itself (out of turns, contaminated, unestablished golden, unreadable judge), what was learned, and what to do next. Every claim links to the artifact behind it. Use at the end of any run, before quoting a number to anyone. Never scores an answer (eval-answer) or decides who owns a failure (eval-diagnose).'
-version: 0.1.23
+version: 0.1.24
 ---
 
 # Report a Run

package/skills/malloy/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: malloy
 description: Index of all Malloy skills. Use when user asks "malloy help", "what malloy skills are available", "how do I use malloy", or needs guidance on which Malloy skill to use.
-version: 0.1.23
+version: 0.1.24
 ---
 <!-- Copyright (c) Credible Data Inc. SPDX-License-Identifier: MIT -->
 

package/skills/malloy-analysis/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: malloy-analysis
 description: "Read before your first get_context call on any business or data question. The required workflow, not background: which source, which rows, how to verify. Skipping it causes confident wrong answers."
-version: 0.1.23
+version: 0.1.24
 ---
 
 <!-- Copyright (c) Credible Data Inc. SPDX-License-Identifier: MIT -->

package/skills/malloy-analysis-pitfalls/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: malloy-analysis-pitfalls
 description: Checks to run on a query and its numbers before a result is presented - wrong grain, fan-out, invented field names, mismatched filters, count vs distinct. The common data-analysis pitfalls.
-version: 0.1.23
+version: 0.1.24
 ---
 <!-- Copyright (c) Credible Data Inc. SPDX-License-Identifier: MIT -->
 

package/skills/malloy-analysis-report/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: malloy-analysis-report
 description: Combine validated Malloy queries into a notebook report or dashboard. Use when the user asks to "create a report", "build a dashboard", "combine these into a report", or wants a persistent multi-query artifact.
-version: 0.1.23
+version: 0.1.24
 ---
 <!--
 Copyright (c) Credible Data Inc.

package/skills/malloy-analyze/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: malloy-analyze
 description: Open-ended exploration with no specific question to answer, and building views/dashboards/notebooks on an existing model. Use when the user asks "what's interesting?", "explore this data", "find insights", "look for patterns", "build a dashboard", or "create views". Not for a specific data question - answering one is `malloy-analysis`, and writing down what the answer assumed is `malloy-model-as-you-go`. For exploration start at Step 1; for views on an existing model jump to View Patterns.
-version: 0.1.23
+version: 0.1.24
 ---
 <!--
 Copyright (c) Credible Data Inc.

package/skills/malloy-charts/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: malloy-charts
 description: Chart selection for a Malloy view, plus the renderer reference for bar_chart, line_chart, scatter_chart, maps and layouts. For choosing a visualization or adding a chart annotation.
-version: 0.1.23
+version: 0.1.24
 ---
 <!--
 Copyright (c) Credible Data Inc.

package/skills/malloy-dashboards/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: malloy-dashboards
 description: "Build or modify a Malloy Publisher dashboard, a tagged .malloy file in a package's dashboards/ directory, with auto-rendered filter controls, a grid layout, and # drill click-through. Use when the user asks for a dashboard, a filterable operational view, or drill-through between views, and no code is wanted."
-version: 0.1.23
+version: 0.1.24
 ---
 
 <!--
@@ -69,8 +69,11 @@ Scanned at a glance is a dashboard; read top to bottom is a notebook.
    include wants `"scope": "package"`**, which recompiles every file as saved: `file` only checks the
    one you are editing, so renaming a source in `_shared.malloy` passes it while breaking every
    dashboard that imports it. A clean compile is not a working dashboard: some tag mistakes surface
-   at step 6, and some only when you look at the page in step 7. (The third scope, `append`, is the
-   default and is what a not-yet-saved file gets.)
+   at step 6, and some only when you look at the page in step 7. **A not-yet-saved dashboard wants
+   `"scope": "file"` too**, not the default: a dashboard file opens with an `import`, and the
+   default `append` scope refuses one, so the new-file case fails on the import and again on the
+   path that does not exist yet. `append` is for a fragment checked against a model that is
+   already on disk, which a dashboard file is not.
 6. **SAVE IT, RELOAD, AND READ THE MANIFEST AND THE WARNINGS.** `reload_package`, or
    `GET …/packages/<pkg>?reload=true`. Check the status the reload returns as well as the warnings:
    a 424 means the package did not load and your edit is not live. **The `warnings` key is absent

package/skills/malloy-debug/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: malloy-debug
 description: Fix Malloy compile errors and understand error messages. Use when encountering errors in .malloy files, user says "fix this error", "malloy error", "compile error", "syntax error", or sees 20+ cascading errors.
-version: 0.1.23
+version: 0.1.24
 ---
 <!--
 Copyright (c) Credible Data Inc.

package/skills/malloy-define/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: malloy-define
 description: Propose a source plan and field definitions for a Malloy semantic model. Covers picking which sources to model and at what grain, then proposing the specific renames, dimensions, and measures per source, every proposal backed by querying the data.
-version: 0.1.23
+version: 0.1.24
 ---
 <!--
 Copyright (c) Credible Data Inc.

package/skills/malloy-discover/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: malloy-discover
 description: Silent data discovery for Malloy modeling. Used at Step 1 of the modeling workflow. Scans tables, columns, distributions, and relationships without user interaction. The agent builds an internal picture before presenting anything.
-version: 0.1.23
+version: 0.1.24
 ---
 <!--
 Copyright (c) Credible Data Inc.

package/skills/malloy-document/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: malloy-document
 description: 'Add documentation with #(doc) tags to Malloy models so fields and sources are described in plain language. Use when user asks to "add documentation", "add doc tags", "document the model", or wants fields and sources described for natural-language search and discovery. For declaring parameterizable filters with #(filter), see the malloy-model skill. Filters are a runtime/modeling construct (governance, latency, correctness), not a documentation tag.'
-version: 0.1.23
+version: 0.1.24
 ---
 <!--
 Copyright (c) Credible Data Inc.

package/skills/malloy-getting-started/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: malloy-getting-started
 description: First steps for using a Malloy Publisher deployment through its MCP tools. Use when connecting to Publisher for the first time, when you do not yet know the available environments, packages, or models, or when a user asks what data they can explore. Covers verifying the server, discovering data with get_context, and running a first grounded query.
-version: 0.1.23
+version: 0.1.24
 ---
 <!--
 Copyright (c) Credible Data Inc.

package/skills/malloy-gotchas-modeling/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: malloy-gotchas-modeling
 description: Common Malloy modeling mistakes, for writing source definitions, dimensions, measures or joins - reserved words, NULL checks, date functions, type casts, field management (extend except/accept/rename vs include public/internal/private), query-based source gotchas.
-version: 0.1.23
+version: 0.1.24
 ---
 <!--
 Copyright (c) Credible Data Inc.

package/skills/malloy-gotchas-queries/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: malloy-gotchas-queries
 description: Common Malloy query and view mistakes, for writing views, queries or notebooks - chart constraints, aggregate filters, joined field aliasing, method syntax, time truncation vs extraction.
-version: 0.1.23
+version: 0.1.24
 ---
 <!--
 Copyright (c) Credible Data Inc.

package/skills/malloy-gotchas-rendering/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: malloy-gotchas-rendering
 description: Common Malloy renderer mistakes, for adding chart annotations and formatting tags or building dashboards - tag syntax, scale rules, sparkline setup, big_value patterns.
-version: 0.1.23
+version: 0.1.24
 ---
 <!--
 Copyright (c) Credible Data Inc.

package/skills/malloy-html-data-app-embedding/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: malloy-html-data-app-embedding
 description: Embed an in-package HTML data app into a host page or another application, including auto-sizing and auth. Read when embedding a Publisher page via Publisher.embed.
-version: 0.1.23
+version: 0.1.24
 ---
 <!--
 Copyright (c) Credible Data Inc.
@@ -12,6 +12,8 @@ SPDX-License-Identifier: MIT
 
 > `Publisher.embed(selector, { src })` drops a package page into a host page as a sandboxed, auto-resizing iframe. Same-origin embeds authenticate with the browser's cookies; cross-origin embeds need a signed token.
 
+> **A cross-origin embed also needs the server to permit it.** Publisher sends `Content-Security-Policy: frame-ancestors 'self'` by default, so a page embedded from another origin is refused by the browser and renders blank -- with nothing logged server-side, which makes it look like a broken page rather than a policy. The deployment must set `PUBLISHER_FRAME_ANCESTORS` to the host page's origin (space-separated for several, or `*` to allow any). Check this first when an embed is blank: the browser console names `frame-ancestors`.
+
 ## The host-page pattern
 
 ```html

package/skills/malloy-html-data-app-runtime/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: malloy-html-data-app-runtime
 description: The JavaScript that drives an in-package HTML data app - calling Publisher.query, building queries from filter state, handling results and errors. For writing the page's data code.
-version: 0.1.23
+version: 0.1.24
 ---
 <!--
 Copyright (c) Credible Data Inc.

package/skills/malloy-html-data-apps/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: malloy-html-data-apps
 description: Build or modify an in-package HTML data app for a Malloy Publisher package (a public/ directory the package serves). Use when the user wants a hand-authored HTML dashboard or web page backed by a package's Malloy models, with no build step.
-version: 0.1.23
+version: 0.1.24
 ---
 <!--
 Copyright (c) Credible Data Inc.

package/skills/malloy-lookml-review/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: malloy-lookml-review
 description: Analyze LookML files as prior art for Malloy modeling. Used during Step 1 (DISCOVER) when .lkml files are present. Coordinates reference files that extract business logic, relationships, and curation decisions. Works with or without a database connection.
-version: 0.1.23
+version: 0.1.24
 ---
 <!--
 Copyright (c) Credible Data Inc.

package/skills/malloy-materialization/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: malloy-materialization
 description: Add and debug Malloy Persistence materializations in a package - persist an expensive source so queries read a pre-built table. Read this whenever the user wants to materialize a source, add a persist annotation, speed up a slow source, or asks why a persist source isn't building.
-version: 0.1.23
+version: 0.1.24
 ---
 <!--
 Copyright (c) Credible Data Inc.
@@ -100,12 +100,14 @@ Delete the smoke file and drop its table afterward.
 A gated source **can** be persisted, but only on one tier and only in one shape, and the thing to be
 careful about is not refused by anything - you have to decide it.
 
-- **`storage=` and `#@ preaggregate` always refuse a gated source**, with a 422 at build time naming the
-  source. (`#@ persist storage=<name>` is the tier that materializes into a separate registered storage
-  destination and serves from there, rather than building in the source's own connection; `#@ preaggregate`
-  stores a rollup Publisher derives from a measure you annotated with a grain, rather than a source you
-  wrote.) A rollup also groups *across* the gated column, so it could not be row-filtered afterwards even
-  in principle.
+- **`storage=` and `#@ preaggregate` always refuse a gated source**, naming it. The build skips a refused
+  source, records it on the run (`metadata.refusedSources`), and builds the rest of the package. A run fails
+  on a refusal only when every authored source it targeted was refused, or when `sourceNames` named this one;
+  a refused rollup never fails it. (`#@ persist storage=<name>` is the tier that materializes into a separate
+  registered storage destination and serves from there, rather than building in the source's own connection;
+  `#@ preaggregate` stores a rollup Publisher derives from a measure you annotated with a grain, rather than a
+  source you wrote.) A rollup also groups *across* the gated column, so it could not be row-filtered afterwards
+  even in principle.
 - **A colocated `#@ persist` (no `storage=`) is admitted** when the gate is provably the entry point's
   **own row filter**. It is refused when the gate is reached only through a join, inherited from a base
   the compiler cannot attribute cleanly, or does not classify as a row filter at all. The gate is found

package/skills/malloy-materialization-tuning/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: malloy-materialization-tuning
 description: Optimize a package's Malloy Persistence materializations for cost and performance using the malloy-pub CLI and the materialization history. Recommend what to persist, what to stop persisting, and how to schedule/scope it. Use when the user asks to make a package cheaper or faster, tune persistence, decide what to materialize, or review persist/schedule choices.
-version: 0.1.23
+version: 0.1.24
 ---
 
 <!--
@@ -51,6 +51,7 @@ The history is where cost lives. Each run records its trigger, timing, and how m
   In the JSON, read:
   - `metadata.durationMs`: how long the build took.
   - `metadata.sourcesBuilt` vs `metadata.sourcesReused`: how much work each run actually did. A run that is nearly all _reused_ is cheap; one that is nearly all _built_ every time is where cost accumulates.
+  - `metadata.sourcesRefused` and `metadata.refusedSources`: sources the eligibility gate skipped. Each one serves live on every query, so a refused source the user expected to be persisted is a finding in its own right; its entry's `message` says what to change.
   - `metadata.trigger`: `SCHEDULER` (a cron fired it) or `ON_DEMAND`.
   - `manifest.entries[*]`: the persisted sources: `sourceName`, `physicalTableName`, `realization`.
 
@@ -60,7 +61,7 @@ Look across several runs, not one: the pattern over the recent history (how ofte
 
 Weigh rebuild cost against query benefit. Common findings:
 
-- **Persist candidate:** an expensive, frequently-queried source that is _not_ persisted (recomputed on every query). Recommend adding `#@ persist name="…"`. Strongest when the source is a heavy aggregate/join reused by many queries and its inputs change slowly. If the source carries a `#(access_filter)` gate, check which case it is first. A gate reached only through a `join_*`, or inherited from a base it cannot be attributed to, makes the colocated persist **refuse with a 422** - so do not recommend persisting it at all. Where the gate is provably the source's own row filter the persist is admitted, and then only recommend it alongside a freshness window (`freshness.fallback="live"`): the gating column freezes at build time, so without one a revoked row can be served under its old access decision indefinitely (see `skill:malloy-materialization`, which also covers where that window does and does not bind).
+- **Persist candidate:** an expensive, frequently-queried source that is _not_ persisted (recomputed on every query). Recommend adding `#@ persist name="…"`. Strongest when the source is a heavy aggregate/join reused by many queries and its inputs change slowly. If the source carries a `#(access_filter)` gate, check which case it is first. A gate reached only through a `join_*`, or inherited from a base it cannot be attributed to, means the colocated persist is **refused** - the build skips it and it serves live - so do not recommend persisting it at all. Where the gate is provably the source's own row filter the persist is admitted, and then only recommend it alongside a freshness window (`freshness.fallback="live"`): the gating column freezes at build time, so without one a revoked row can be served under its old access decision indefinitely (see `skill:malloy-materialization`, which also covers where that window does and does not bind).
 - **Removal candidate:** a persisted source that is cheap to compute, rarely queried, or rebuilt far more often than it is read. Recommend dropping the `#@ persist` annotation (and its table): the storage + rebuild cost is not buying anything.
 - **Cadence mismatch:** a `SCHEDULER` cadence out of step with how fast the data changes or how long a build takes. If most scheduled runs are all-reused (nothing changed), the cron is too frequent, so loosen it. If queries routinely read stale data, tighten it. If the build's `durationMs` approaches the interval, the cadence is too aggressive.
 - **Scope mismatch:** `scope: version` re-materializes per published version (right when versions must be isolated, e.g. a schedule); `scope: package` reuses one lineage across versions (cheaper when versions can share). A schedule _requires_ `version`. If a package carries a schedule it does not need, clearing the schedule frees it to use the cheaper package scope.

package/skills/malloy-model/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: malloy-model
 description: Build Malloy semantic models with base source and joined source files. Use when creating or modifying .malloy files, user asks to "create a malloy model", "add dimensions", "add measures", "create a source", or any Malloy model authoring task.
-version: 0.1.23
+version: 0.1.24
 ---
 <!--
 Copyright (c) Credible Data Inc.

package/skills/malloy-model-as-you-go/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: malloy-model-as-you-go
 description: 'After answering a data question, write down what the answer assumed so the next reader can trust the number. A field with a #(doc) in the model when you can edit it, an extend in the notebook when you can only author reports, or a stated assumption plus a Malloy snippet when you can only chat. Use after every answered question that rested on a judgment call, and whenever a question is asked against tables that have no model yet.'
-version: 0.1.23
+version: 0.1.24
 ---
 
 <!--

package/skills/malloy-modeling/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: malloy-modeling
 description: Build semantic models with Malloy for the Malloy Publisher. Read this skill whenever the user asks about modeling data or specifically mentions Malloy.
-version: 0.1.23
+version: 0.1.24
 ---
 <!--
 Copyright (c) Credible Data Inc.
@@ -150,7 +150,7 @@ Never guess field names. Ground yourself with `get_context` to see the sources a
 Publisher compiles each configured package at boot and serves that cached model, so a source or view you add afterwards is not queryable by name until you reload the package. The loop is:
 
 1. **Validate** the change with `compile_model`, picking the scope that matches what you are doing:
-   - Adding a new definition or query: the default (`scope: "append"`) compiles your text in the model's namespace. Note its diagnostic positions land in the model-plus-your-text concatenation.
+   - Adding a new definition or query: the default (`scope: "append"`) compiles your text in the model's namespace. Note its diagnostic positions land in the model-plus-your-text concatenation. Append checks your text against what the model already publishes, so it refuses text that declares its own data root -- `import`, `connection.table(...)` and `connection.sql(...)` are rejected. A `source:` line handed to you by `search_database_schema` is exactly that shape, so validate it at `file` or `package` scope instead.
    - **Editing an existing definition: `scope: "file"`**, with the whole edited file as `source`. It compiles your text AS the file (append would collide with "Cannot redefine"), and diagnostics land at the true line numbers of your text.
    - Before saving a change other files import: `scope: "package"` with the edited file as `source` runs reload's worker compiler over every `.malloy` and `.malloynb` file against your edit, so a rename that breaks an importer surfaces now instead of at reload. Each diagnostic carries `model`, the file it points at; files hidden from discovery can appear. If `modelPath` does not exactly match an existing file, a warning says the source was treated as new.
 2. **Save** it to the package's model file.

package/skills/malloy-notebook-chat/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: malloy-notebook-chat
 description: Steps to follow when the chat is bound to a notebook or saved report. The notebook's cells are the agent's primary context, answer from it, run its queries, and only reach for get_context when the user asks about something outside it.
-version: 0.1.23
+version: 0.1.24
 ---
 <!--
 Copyright (c) Credible Data Inc.

package/skills/malloy-notebooks/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: malloy-notebooks
 description: Create Malloy notebooks (.malloynb) for interactive dashboards and data stories. Use when user asks to "create a notebook", "make a dashboard notebook", "write a malloynb", "data story", or needs to build reports/visualizations.
-version: 0.1.23
+version: 0.1.24
 ---
 <!--
 Copyright (c) Credible Data Inc.

package/skills/malloy-patterns/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: malloy-patterns
 description: An index of what search_malloy_docs covers - language reference, common patterns (YoY, cohorts, percent of total), rendering - for picking a topic worth searching before querying the docs.
-version: 0.1.23
+version: 0.1.24
 ---
 <!--
 Copyright (c) Credible Data Inc.

package/skills/malloy-phrase-detection/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: malloy-phrase-detection
 description: How to phrase search_text on a get_context call so retrieval returns the fields you need instead of a truncated catalog. Covers target-type classification and decomposition patterns.
-version: 0.1.23
+version: 0.1.24
 ---
 <!-- Copyright (c) Credible Data Inc. SPDX-License-Identifier: MIT -->
 

package/skills/malloy-publish/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: malloy-publish
 description: Package Malloy models for serving by Malloy Publisher. Use when user asks to "publish", "package", "deploy", or wants to share models with others.
-version: 0.1.23
+version: 0.1.24
 ---
 <!--
 Copyright (c) Credible Data Inc.

package/skills/malloy-queries/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: malloy-queries
 description: Malloy query patterns and syntax, for writing or debugging a query - dates, aggregates vs dimensions, join paths, filters, string matching, chart annotations, and the errors a SQL habit produces.
-version: 0.1.23
+version: 0.1.24
 ---
 <!--
 Copyright (c) Credible Data Inc.

package/skills/malloy-review/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: malloy-review
 description: Malloy semantic-model code review. Invoke when the user asks to review, audit, or critique a `.malloy` file, a folder of Malloy models, or a GitHub PR that touches Malloy. Enforces project modeling standards and emits a navigable review file.
-version: 0.1.23
+version: 0.1.24
 ---
 <!--
 Copyright (c) Credible Data Inc.

package/skills/malloy-scope/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: malloy-scope
 description: Present discovery findings and propose an analytical scope before modeling. Use after inspecting a package's model and data, to classify tables and recommend an analytical focus the user can pick from.
-version: 0.1.23
+version: 0.1.24
 ---
 
 <!--

package/skills/malloy-source-unreachable/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: malloy-source-unreachable
 description: Work out why a source is missing from get_context, or why a query against it was refused with a 404 or a 403, and what to do next. Use when a source you expect is absent from discovery, when execute_query answers "No queryable source", when a query that used to work stops working, or when deciding whether a package's curation is hiding something you need.
-version: 0.1.23
+version: 0.1.24
 ---
 <!-- Copyright (c) Credible Data Inc. SPDX-License-Identifier: MIT -->