feat(runtrace): render a run's trace as a state timeline and a message sequence

.agents/skills/testing-pilot-corpora-gate/SKILL.md

@@ -183,7 +183,7 @@ gate's own helpers are package-private but reusable (`pilotCorporaGate.files(t)`
 
 `actionlint`, `shellcheck`, `python3 scripts/check-doc-links.py`, `gofmt`, `go vet`,
 `go run -C tools ./cmd/pilot-diff` (validators pre-downloaded; ~4min, prints e.g.
-the headline the committed baseline holds — `388 file(s), 359 fully agreeing; 45 agreed
+the headline the committed baseline holds — `389 file(s), 360 fully agreeing; 45 agreed
 diagnostic(s), 44 only ours, 85 only the pilot's` at the `2026-08` pin, so read it from
 `docs/project/pilot-differential-baseline.json` rather than from this line)
 and `make lint` (staticcheck+gosec, ~2min) all work. There is **no** `yamllint` and **no**

.agents/skills/testing-pilot-differential/SKILL.md

@@ -24,7 +24,7 @@ GNU-format diagnostics **relative to `--root`**. Consequences for testing:
 - Measured at the `2026-08` pin after the view concern framing round retired the six view-body
   `frame` `syntax` rows (bare parameters already at their effective range `[0..*]`, so the
   adjudicated `Behaviors.kerml:14` multiplicity warning is gone while the `[1]` `RocketEquation`
-  inputs keep its warning at `delta-v-budget.sysml:93`): `388 file(s), 359 fully agreeing; 45 agreed,
+  inputs keep its warning at `delta-v-budget.sysml:93`): `389 file(s), 360 fully agreeing; 45 agreed,
   44 only ours, 85 only the pilot's`, JSON totals `openSysMLDiagnostics 90 / pilotDiagnostics 131 /
   severityMismatch 1`; the two only-ours rows the multiplicity rule added are the expected `action-step-multiplicity-not-fixed`
   warnings on `training/18. Action Performance/Action Performance Example.sysml:10` and
@@ -148,7 +148,7 @@ warning (the `[1]` `RocketEquation` inputs still produce the warning at
 `delta-v-budget.sysml:93`), is current: the action-step multiplicity rule adds the two expected
 `action-step-multiplicity-not-fixed` warnings on `takePhoto[*]` in the training corpus and
 `takePicture[*]` in `Camera Example/Camera.sysml`, and the view concern framing round retired the
-six view-body `frame` `syntax` rows on `examples`; a live run gives `388 file(s), 359 fully
+six view-body `frame` `syntax` rows on `examples`; a live run gives `389 file(s), 360 fully
 agreeing; 45 agreed, 44 only ours, 85 only the pilot's`, byte-identical to the committed baseline, and
 `docs/project/pilot-differential.md`'s "Results" table matches. The prior rebaseline, when the
 Legend of the Red Dragon example left for its own repository, gave

.agents/skills/testing-pilot-execution-referee/SKILL.md

@@ -148,7 +148,7 @@ pilot answers the representation's own. See
   `pilot-exec-diff: <file>:<line>: model no/such/model.sysml: stat <abs>: no
   such file or directory`.
 - **Additivity.** `go run -C tools ./cmd/pilot-diff` must still print the headline the
-  committed baseline holds (`388 file(s), 359 fully agreeing; 45 agreed
+  committed baseline holds (`389 file(s), 360 fully agreeing; 45 agreed
   diagnostic(s), 44 only ours, 85 only the pilot's` at the `2026-08` pin — read it from the baseline JSON, not from this line, since each
   fix round moves it) and `jq -S` diff clean against
   `docs/project/pilot-differential-baseline.json`; `git status --porcelain`

.agents/skills/testing-pilot-xpect/SKILL.md

@@ -423,7 +423,7 @@ census in `w5c_census_test.go` is live two ways: perturb one pinned triple (e.g.
 ## Regression neighbour
 
 `go run -C tools ./cmd/pilot-diff` (~1m12s) must still print the headline the *committed* baseline holds —
-at the `2026-08` pin that is `388 file(s), 359 fully agreeing; 45 agreed diagnostic(s), 44
+at the `2026-08` pin that is `389 file(s), 360 fully agreeing; 45 agreed diagnostic(s), 44
 only ours, 85 only the pilot's`. Read the number out of
 `docs/project/pilot-differential-baseline.json` rather than trusting this line, since a landing fix
 round moves it. When the baseline is itself stale (it was at `19a3ce03`, holding 273 / 281 / 317), a

README.md

@@ -338,11 +338,11 @@ The project is under active development, with the core infrastructure operationa
 <!-- doc-counts:begin refereed-figures -->
 **Measured against the pinned reference** (`PILOT_TAG=2026-08`, artifact `0.62.0`). Every number below is generated by `make docs-counts` from the committed baselines and gated; none of them is typed in by hand.
 
-- **Corpus agreement:** 359 of 388 files agree diagnostic-by-diagnostic; 44 diagnostics are ours alone and 85 the reference's alone, and the first number must be read by root: the aggregate includes candidate conformance differences, intentional execution-scope warnings on reference corpora and diagnostics from our own examples ([differential](docs/project/pilot-differential.md), `go run -C tools ./cmd/pilot-diff`).
+- **Corpus agreement:** 360 of 389 files agree diagnostic-by-diagnostic; 44 diagnostics are ours alone and 85 the reference's alone, and the first number must be read by root: the aggregate includes candidate conformance differences, intentional execution-scope warnings on reference corpora and diagnostics from our own examples ([differential](docs/project/pilot-differential.md), `go run -C tools ./cmd/pilot-diff`).
 - **Declared-diagnostic silence:** of the 512 declared `errors` rows in the reference's own Xpect suites, we report nothing for 0. 245 we report word-for-word; 248 wording-only and 7 location-only differences are agreement in substance and are not counted as gaps; 0 more we report as a warning and 2 elsewhere in the file ([Xpect oracle](docs/project/pilot-xpect.md), `go run -C tools ./cmd/pilot-xpect`).
 - **Scope agreement:** 230 of 230 declared scope assertions match exactly (same source).
 - **Permissiveness gaps:** of 312 invalid models we wrote ourselves, the reference rejects 3 that we accept by default, and 300 both reject; 3 further cases agree only when we are asked strictly. We authored every one of these cases ourselves, so the denominator measures the reach of our own corpus and not our conformance; agreement reached only under an opt-in strict mode is weaker evidence than agreement by default ([rejection oracle](docs/project/pilot-rejection.md), `go run -C tools ./cmd/pilot-reject`).
-- **Declared errata:** the registry declares 12 defect(s) in the published reference material — 4 with a specification-derived correction, 8 documented without one, since no intended reading can be inferred ([OMG issues](docs/project/omg-issues.md), `tools/oracle/errata`). Every figure above is as published and stays the conformance statement; running the same oracles over the corrected text instead reports 360 of 388 files agreeing, 43 diagnostics ours alone and 85 the reference's alone, 0 declared rows we are silent on, and 0 of 312 authored cases the reference alone rejects. The corrected figures are diagnostic only: an erratum never reclassifies a divergence category, and the published corpus is never edited.
+- **Declared errata:** the registry declares 12 defect(s) in the published reference material — 4 with a specification-derived correction, 8 documented without one, since no intended reading can be inferred ([OMG issues](docs/project/omg-issues.md), `tools/oracle/errata`). Every figure above is as published and stays the conformance statement; running the same oracles over the corrected text instead reports 361 of 389 files agreeing, 43 diagnostics ours alone and 85 the reference's alone, 0 declared rows we are silent on, and 0 of 312 authored cases the reference alone rejects. The corrected figures are diagnostic only: an erratum never reclassifies a divergence category, and the published corpus is never edited.
 - **Self-assessed surface:** the action, state-machine and classifier-behavior rows have no external referee at all — the four refereed figures above cannot see them, because the pinned artifact evaluates expressions but executes neither actions nor state machines. [Spec compliance](docs/project/spec-compliance.md) counts them.
 
 What these numbers cannot show: the OMG corpora are demonstrations rather than an official conformance suite; the differential is one-directional, comparing the diagnostics the two implementations report on the same files; the Xpect suites are the pilot authors' test intent rather than a certification oracle; and none of these is a percentage of the specification — no global compliance figure is claimed anywhere.
@@ -354,7 +354,7 @@ What these numbers cannot show: the OMG corpora are demonstrations rather than a
 **Test coverage:** top-level `Test` functions (counted from the `_test.go` files, as `go test ./...` runs them) covering parsers, semantics, runtime (actions, states, instances, operators, validation), behind golden ASTs, negatives, execution conformance cases, golden traces, runtime robustness cases and gRPC conformance and robustness cases. The figures are counted from the tree when the documentation site is built into the test inventory of [spec compliance](docs/project/spec-compliance.md), never committed, so a branch adding a test does not rewrite this page. A test skips only for want of something the run did not provide, and says what: the held-image round trip declines a conformance case that creates no instance, a few gate on a PDF or Mermaid toolchain, a pinned pilot artifact, the PSSM suite, a locale, a case-insensitive filesystem or a live Flexo stack, and the OMG corpus gates skip until the corpora are downloaded unless asked to fail.
 **Parser coverage:** 109/109 bundled library files parse cleanly — the 94 official SysML v2 standard library files and the 15 non-normative OpenSysML extensions: `OpenSysML Libraries/AnalysisRecords.sysml`, `DiagramLayout.sysml`, `DocumentQueries.sysml`, `IdentityMetadata.sysml`, `MOSA.sysml`, `MigrationMetadata.sysml`, `OOSEM.sysml`, `OpenSysMLMathFunctions.kerml`, `OpenSysMLRenderings.sysml`, `RandomFunctions.kerml`, `Simulation.sysml`, `StateMachines.sysml`, `StateSpaceIntegration.sysml`, `Stochastic.sysml` and `SysMLValidation.sysml`. Conformance verified by [stdlib_conformance_test.go](internal/workspace/libs/stdlib_conformance_test.go). Grammar reference: [OMG Xtext grammar](https://github.com/Systems-Modeling/SysML-v2-Pilot-Implementation/tree/master/org.omg.kerml.xtext/src/org/omg/kerml/xtext).
 **Behavioral execution:** Calc/constraint/requirement/satisfy functional. Action/state executors handle nested invocation, control flow keywords, loop and conditional statements and the send statement (<!-- doc-counts:begin conformance-passing -->every conformance case passing<!-- doc-counts:end conformance-passing -->). Coverage is self-assessed against the specification text and the normative library: the pinned OMG pilot implementation evaluates expressions but does not execute actions or state machines headlessly, so no external implementation currently adjudicates these rows. See [spec compliance](docs/project/spec-compliance.md).
-**Reference differential:** 388 files compared diagnostic-by-diagnostic against the pinned OMG pilot implementation (`2026-08`), 359 in full agreement; every divergence is enumerated and adjudicated in [the differential](docs/project/pilot-differential.md), reproducible with `go run -C tools ./cmd/pilot-diff`.
+**Reference differential:** 389 files compared diagnostic-by-diagnostic against the pinned OMG pilot implementation (`2026-08`), 360 in full agreement; every divergence is enumerated and adjudicated in [the differential](docs/project/pilot-differential.md), reproducible with `go run -C tools ./cmd/pilot-diff`.
 **Rejection oracle:** the reverse direction — do we reject what the reference rejects? 312 hand-written invalid models validated by both implementations, 303 rejected by both, 0 the pinned pilot rejects and we accept; the remainder only we reject — the control-node succession rules the pinned pilot leaves unimplemented and a non-Boolean succession guard it accepts once the standard library types it — and every permissiveness gap is enumerated with a reproducer and likely root cause in [the rejection oracle](docs/project/pilot-rejection.md), reproducible with `go run -C tools ./cmd/pilot-reject`. We wrote every case, so the count measures our coverage of the rejection surface, not our conformance — a sample, not a proof.
 **Training examples:** 100/100 files report no semantic errors, gated by `tests/corpus/testdata/training_examples_expected.txt`; the gate does not count execution-scope warnings. Download with `./scripts/download-training-examples.sh` (from the [OMG training directory](https://github.com/Systems-Modeling/SysML-v2-Pilot-Implementation/tree/master/sysml/src/training)). See [training examples](docs/project/training-examples.md) for analysis.
 **Semantic layer:** a complete implementation of runtime operators, feature chains and validation rules. See [examples/semantic-layer/](examples/semantic-layer/) for a full demonstration.

api/proto/sysml.proto

@@ -2197,7 +2197,7 @@ message DocumentState {
 // DocumentEvent is one row an `Events` query answered: one record of the
 // session's trace, in the order the run made it.
 message DocumentEvent {
-  // "accept", "send", "transition", "entry", "exit", "do", "choice" or "guard".
+  // "accept", "send", "transition", "entry", "exit", "do", "choice", "guard" or "terminate".
   string kind = 1;
   // The clock's instant when the record was made: a quantity in the clock's
   // unit when the library reduces one, else a bare real of clock units.

changes/unreleased/run-trace-renderings.added.md

@@ -0,0 +1,2 @@
+- **Render recorded runs as timelines and message sequences.** The CLI and REPL can write a behavior's state occupancy and ordered messages as text, Mermaid or PlantUML without adding model-view vocabulary. Source links connect sequence participants to their type declarations and PlantUML timeline lanes and single-state spans to their declarations.
+- A terminated machine's `terminate` event also appears in state-run traces.

client/java/opensysml-client/src/main/java/org/openmbee/opensysml/DocumentValue.java

@@ -247,7 +247,7 @@ record DocumentState(
    * binding one is refused.
    *
    * @param kind {@code "accept"}, {@code "send"}, {@code "transition"}, {@code "entry"}, {@code
-   *     "exit"}, {@code "do"}, {@code "choice"} or {@code "guard"}
+   *     "exit"}, {@code "do"}, {@code "choice"}, {@code "guard"} or {@code "terminate"}
    * @param time the instant the record was written at, in the runtime clock's unit — a {@link
    *     QuantityValue} when the clock carries a unit, a plain number otherwise
    * @param text the record as the trace prints it

client/node/src/core/document.ts

@@ -162,7 +162,7 @@ export class DocumentState {
 
 /** A row an `Events` query answered: one record of a session's trace. Answered only. */
 export class DocumentEvent {
-  /** "accept", "send", "transition", "entry", "exit", "do", "choice" or "guard". */
+  /** "accept", "send", "transition", "entry", "exit", "do", "choice", "guard" or "terminate". */
   readonly kind: string;
   /** The instant the record was written at: a quantity, an int or a real. */
   readonly time: DocumentValue;

client/node/src/generated/sysml_pb.ts

@@ -6109,7 +6109,7 @@ export const DocumentStateSchema: GenMessage<DocumentState> = /*@__PURE__*/
  */
 export type DocumentEvent = Message<"sysml.DocumentEvent"> & {
   /**
-   * "accept", "send", "transition", "entry", "exit", "do", "choice" or "guard".
+   * "accept", "send", "transition", "entry", "exit", "do", "choice", "guard" or "terminate".
    *
    * @generated from field: string kind = 1;
    */

client/opensysml/documents.go

@@ -100,8 +100,8 @@ type DocumentState struct {
 // DocumentEvent is a row an `Events` query answered: one record of a session's
 // trace. It is answered, never bound.
 type DocumentEvent struct {
-	// Kind is "accept", "send", "transition", "entry", "exit", "do", "choice"
-	// or "guard".
+	// Kind is "accept", "send", "transition", "entry", "exit", "do", "choice",
+	// "guard" or "terminate".
 	Kind string
 	// Time is the run's clock when the record was made: a Quantity when the
 	// clock carries a unit, a Real otherwise.

client/python/opensysml/document.py

@@ -154,7 +154,7 @@ class DocumentEvent:
 
     Attributes:
         kind: ``"accept"``, ``"send"``, ``"transition"``, ``"entry"``,
-            ``"exit"``, ``"do"``, ``"choice"`` or ``"guard"``
+            ``"exit"``, ``"do"``, ``"choice"``, ``"guard"`` or ``"terminate"``
         time: The instant the record was written at, in the runtime clock's
             unit — a :class:`~opensysml.values.Quantity` when the clock carries
             one, a plain number otherwise