@@ -384,6 +384,34 @@ of the *run* and not of the code: CI sets it, a developer running the suite loca
 adopter changes a line to publish one. Unset means no report, which is not an error. Several suites
 in one pytest session each write their own pair, so flagd's two resolvers would not collide.
 
+### A partial run is not a conformance run
+
+The canonical scenario set is fixed by the specification, and a run that executed less of it cannot
+support a conformance claim. `-k`, `-m`, `--deselect`, or a test module that stopped calling
+`scenarios()` on the canonical path each run fewer scenarios, and none of them is an error to
+pytest. Go measured the consequence: `-run` on a single scenario passed green and emitted a
+well-formed report covering 1 of 29 canonical scenarios, with nothing in the document saying so.
+
+So every run is checked against the scenarios this distribution ships, and a suite that did not
+execute all of them writes no report:
+
+```console
+$ PROVIDER_TCK_REPORT_DIR=./reports pytest -k "unknown_flag_key"
+provider-tck [in-memory]: 28 of 29 canonical scenarios did not run, so this run cannot support a
+conformance claim and no report is written for it. …
+  - features/errors.feature: A float flag is not silently narrowed to an integer
+  - features/errors.feature: Requesting the wrong type returns the code default [key=float-flag requested=Boolean default=false]
+  … and 18 more
+```
+
+A scenario the capability gate skipped **has** run: it was asked, and the report accounts for it
+with its reason, so declining a capability never trips this. Your own scenarios are yours — they are
+not counted towards the canonical set and cannot close a gap in it.
+
+Set `PROVIDER_TCK_PARTIAL=1` to work on a single scenario without the guard failing the run. It buys
+a green run and nothing else: no report is written for an incomplete suite either way. Java's TCK
+spells the same escape hatch the same way.
+
 ### Why the results are not our format
 
 Per-scenario outcomes, tags, Scenario Outline row identity and the executed feature source are all
@@ -464,14 +492,16 @@ the field.
 | `test_extensions` | an adopter's own scenarios | an extension runs inside the canonical suite, changes nothing for an adopter who has none, and cannot take a canonical scenario's identity |
 | `test_report` | the conformance report | checks the two properties a consumer is entitled to assume, against the emitted Messages stream |
 | `test_extension_reporting` | an extension in a report | it is reported under its own prefix, it changes no other field, and the two uris the derivation cannot rule out produce no report at all |
+| `test_canonical_set` | the canonical-set guard | a run that executed less than the canonical set fails and publishes nothing |
 
 ```
-135 passed, 21 skipped, 2 xfailed
+155 passed, 21 skipped, 2 xfailed
 ```
 
-No Docker and no network. The conformance suites take under a second; `test_report` and
-`test_extensions` take most of the rest, because the properties they check are properties of a whole
-pytest session and they run generated adoptions in subprocesses to check them.
+No Docker and no network. The conformance suites take under a second; `test_report`,
+`test_extension_reporting` and `test_canonical_set` take most of the time, because the properties
+they check are properties of a whole pytest session and they run generated adoptions in subprocesses
+to check them.
 
 Neither in-memory suite declares `@lifecycle`, so the six lifecycle scenarios — three about
 initialisation, three about shutdown — are skipped in both. That is the point: with no backend to
 
@@ -52,6 +52,7 @@ def tck_config():
 
 import importlib.resources
 
+from .canonical import PARTIAL_ENV
 from .capability import DECLARABLE_CAPABILITIES, RESERVED_CAPABILITIES, Capability
 from .config import KnownDeviation, TckConfig
 from .control import (
@@ -79,6 +80,7 @@ def tck_config():
     "DECLARABLE_CAPABILITIES",
     "EXTENSIONS_DIRECTORY",
     "MESSAGES_FORMAT",
+    "PARTIAL_ENV",
     "REPORT_DIR_ENV",
     "RESERVED_CAPABILITIES",
     "SCHEMA_VERSION",
 
@@ -0,0 +1,116 @@
+"""The canonical scenario set, and whether a run actually executed it.
+
+A conformance suite that goes green on scenarios it did not run is worse than no
+suite. The capability gate already rules out the loud version of that -- an
+undeclared capability is reported as skipped, with its reason, never as passed --
+but it says nothing about the quiet version, where the scenarios were never asked
+for in the first place. A ``-k`` expression, a ``-m`` filter, a ``--deselect``, a
+test module that stopped calling ``scenarios()`` on the canonical path: each of
+those runs less of the suite and none of them is an error. The Go implementation
+measured it. ``-run`` on a single scenario passed green and emitted a well-formed
+report covering one of twenty-nine canonical scenarios, and nothing in the
+document said so.
+
+So the run is checked against what this distribution *ships* rather than against
+what it was asked to run. The expectation is compiled from the packaged feature
+files with the same Gherkin compiler that produces the results payload, which
+means it is one entry per Scenario Outline row -- the granularity the runner
+generates and therefore the only one a comparison can be made at.
+
+Two properties this has to have, and both are about what may close a gap.
+
+**A skip counts; an absence does not.** A scenario the capability gate skipped
+did run: it was asked, and the report accounts for it with a reason. A scenario
+that was never collected is missing, and no declaration makes it otherwise.
+
+**An extension cannot close a gap.** An adopter's own scenarios are matched by
+neither uri nor path against the packaged set, and the executed side of the
+comparison is filtered to files that are genuinely inside this distribution --
+not merely to files reported under the canonical prefix, so that the check does
+not rest on the same derivation it is meant to corroborate.
+"""
+
+from __future__ import annotations
+
+import functools
+import os
+import typing
+
+from .extensions import canonical_root, is_canonical, uri_for
+from .messages import FeatureCatalog, ScenarioKey, ScenarioRun
+
+__all__ = [
+    "PARTIAL_ENV",
+    "canonical_scenarios",
+    "describe",
+    "missing_canonical",
+    "partial_run_allowed",
+]
+
+PARTIAL_ENV = "PROVIDER_TCK_PARTIAL"
+"""Set to acknowledge that a run is deliberately not a conformance run.
+
+For working on one scenario with ``-k`` without the guard failing the run. It
+never makes a partial run publishable: no report is written for a suite that did
+not execute the canonical set, with or without it. The Java TCK spells the same
+escape hatch the same way, so the two are one thing to know rather than two.
+"""
+
+_TRUTHY = {"1", "true", "yes", "on"}
+
+
+def partial_run_allowed(environment: typing.Mapping[str, str] | None = None) -> bool:
+    """Whether the run has declared itself partial."""
+    source = os.environ if environment is None else environment
+    return source.get(PARTIAL_ENV, "").strip().lower() in _TRUTHY
+
+
+@functools.cache
+def canonical_scenarios() -> frozenset[ScenarioKey]:
+    """Every scenario the packaged feature files define, row by row.
+
+    Empty when the assets are not reachable as files -- an installation from a
+    zipimport, say. Everything built on this then degrades to "cannot tell",
+    which is the honest answer and never a false accusation.
+
+    Cached because it is the same answer for the whole process and parsing it is
+    the same work the results payload already does.
+    """
+    root = canonical_root()
+    if root is None or not root.is_dir():
+        return frozenset()
+
+    catalog = FeatureCatalog()
+    for path in sorted(root.rglob("*.feature")):
+        uri = uri_for(path)
+        if uri is not None:
+            catalog.load_file(uri, path)
+    return catalog.scenario_keys
+
+
+def missing_canonical(runs: typing.Iterable[ScenarioRun]) -> tuple[ScenarioKey, ...]:
+    """The canonical scenarios this suite did not execute, in reporting order.
+
+    ``runs`` is everything the suite accounted for, extensions included; only
+    the ones whose feature file is genuinely one of the packaged assets are
+    counted, so an adopter's scenario can neither fill a gap nor be blamed for
+    one.
+    """
+    expected = canonical_scenarios()
+    if not expected:
+        return ()
+    executed = {
+        (run.identity.uri, run.identity.name, run.identity.example)
+        for run in runs
+        if is_canonical(run.identity.path)
+    }
+    return tuple(sorted(expected - executed))
+
+
+def describe(key: ScenarioKey) -> str:
+    """One missing scenario, named the way a failure message should name it."""
+    uri, name, row = key
+    if not row:
+        return f"{uri}: {name}"
+    cells = " ".join(f"{header}={cell}" for header, cell in row)
+    return f"{uri}: {name} [{cells}]"
@@ -33,6 +33,13 @@
 
 import pytest
 
+from .canonical import (
+    PARTIAL_ENV,
+    canonical_scenarios,
+    describe,
+    missing_canonical,
+    partial_run_allowed,
+)
 from .config import TckConfig
 from .extensions import (
     collision_problem,
@@ -97,6 +104,14 @@
 _SKIPPED = pytest.skip.Exception
 """What ``pytest.skip`` raises, named so a step hook can recognise it."""
 
+_MAX_MISSING = 10
+"""How many missing canonical scenarios a failure names before summarising.
+
+Enough to act on and not so many that the reason is lost above them. A run with
+one scenario selected is missing twenty-eight, and listing all of them says
+nothing the count did not.
+"""
+
 
 def scenario_identity(node: pytest.Item) -> ScenarioIdentity | None:
     """Describe a pytest node as a Gherkin scenario, or return ``None``.
@@ -222,11 +237,19 @@ def __init__(self, config: pytest.Config) -> None:
         self._step_started: dict[str, int] = {}
         config.stash[COLLECTOR_KEY] = self.collector
 
+    @pytest.hookimpl(trylast=True)
     def pytest_collection_modifyitems(self, items: list[pytest.Item]) -> None:
-        """Enumerate every TCK scenario the session collected.
+        """Enumerate every TCK scenario the session will run.
 
         At collection rather than as each runs, so that the stream accounts for
         scenarios that never got as far as running a fixture.
+
+        ``trylast`` so that pytest's own deselection -- ``-k``, ``-m``,
+        ``--deselect`` -- has already removed what it is going to remove.
+        Enumerating before it does would make a filtered run report every
+        deselected scenario as collected but never run, which is a true
+        statement about a list nobody asked for and drowns the one message that
+        matters: which canonical scenarios are missing.
         """
         for item in items:
             identity = scenario_identity(item)
@@ -294,24 +317,48 @@ def _finish_step(
         )
 
     def pytest_sessionfinish(self, session: pytest.Session) -> None:
+        if session.config.getoption("collectonly", False):
+            # Nothing ran, and nothing was meant to. Every check below asks what
+            # a run executed, and the answer "nothing" is not a finding here.
+            return
+
+        problems = self.collector.resolve(scenario_run)
+
+        # Whether a suite may be published is a property of the run rather than
+        # of the report, so it is established whether or not one was asked for.
+        # Both checks are made on every suite rather than short-circuited, so a
+        # suite with two faults hears about both.
+        unpublishable: set[int] = set()
+        for suite in self.collector.suites:
+            sound = self._identities_are_sound(session, suite)
+            complete = self._canonical_set_ran(session, suite)
+            if not sound or not complete:
+                unpublishable.add(id(suite))
+
         directory = os.environ.get(REPORT_DIR_ENV, "").strip()
         if not directory:
             return
-        self.write(session, Path(directory))
+        for problem in problems:
+            self._fail(session, f"provider-tck: {problem}")
+        self.write(session, Path(directory), unpublishable)
 
-    def write(self, session: pytest.Session, directory: Path) -> None:
+    def write(
+        self,
+        session: pytest.Session,
+        directory: Path,
+        unpublishable: typing.AbstractSet[int] = frozenset(),
+    ) -> None:
         """Write every suite's pair of files, failing the session if one cannot be.
 
         A run that asked for a report and silently did not get one is how a
         publishing pipeline ends up serving a stale result forever, so both a
         write failure and an incomplete document are loud and change the exit
         status rather than being logged and forgotten.
         """
-        for problem in self.collector.resolve(scenario_run):
-            self._fail(session, f"provider-tck: {problem}")
-
         written: dict[str, str] = {}
         for suite in self.collector.suites:
+            if id(suite) in unpublishable:
+                continue
             name = suite.config.name
             file_name = envelope_file_name(name)
             if written.get(file_name, name) != name:
@@ -324,19 +371,56 @@ def write(self, session: pytest.Session, directory: Path) -> None:
             written[file_name] = name
             self._write_suite(session, directory, suite)
 
+    def _canonical_set_ran(self, session: pytest.Session, suite: SuiteReport) -> bool:
+        """Whether this suite executed every scenario the TCK ships.
+
+        The check a conformance claim rests on that no amount of reading the
+        report can supply: the results payload says what happened to the
+        scenarios that ran, and says nothing at all about the ones that did not.
+
+        A capability-gated skip counts -- it was asked, and the report accounts
+        for it with a reason. An extension scenario does not count and cannot
+        close a gap. :data:`~.canonical.PARTIAL_ENV` downgrades the failure to a
+        note for someone working on a single scenario; it does not make the run
+        publishable, because the report is withheld either way.
+        """
+        missing = missing_canonical(suite.runs.values())
+        if not missing:
+            return True
+
+        name = suite.config.name
+        total = len(canonical_scenarios())
+        headline = (
+            f"provider-tck [{name}]: {len(missing)} of {total} canonical scenarios "
+            f"did not run, so this run cannot support a conformance claim and no "
+            f"report is written for it. The canonical set is fixed by the "
+            f"specification; running less of it is not a configuration. Decline "
+            f"capabilities your provider does not have through TckConfig instead, "
+            f"which reports the scenarios as skipped with their reason"
+        )
+        if partial_run_allowed():
+            self._say(
+                session,
+                f"{headline}. {PARTIAL_ENV} is set, so the run is not failed for it",
+            )
+        else:
+            self._fail(
+                session,
+                f"{headline}. To filter anyway while working on one scenario, set "
+                f"{PARTIAL_ENV}=1 and accept that the run is not a conformance run",
+            )
+        for key in missing[:_MAX_MISSING]:
+            self._say(session, f"  - {describe(key)}")
+        if len(missing) > _MAX_MISSING:
+            self._say(session, f"  ... and {len(missing) - _MAX_MISSING} more")
+        return False
+
     def _write_suite(
         self, session: pytest.Session, directory: Path, suite: SuiteReport
     ) -> None:
         name = suite.config.name
         runs = suite.sorted_runs
 
-        if not self._identities_are_sound(session, suite):
-            # Refusing to write is the point: a document that presents an
-            # adopter's feature file as the specification's -- or reports one
-            # file's scenarios against another's source -- is worse than no
-            # document, because it is the one thing a consumer cannot check.
-            return
-
         catalog = FeatureCatalog()
         try:
             for run in runs:
@@ -406,6 +490,11 @@ def _identities_are_sound(
         has no way to tell that the specification did not write it. And two
         files must not share a uri, or the stream carries one source for both
         and the second file's scenarios are reported against the first's.
+
+        A suite that fails either writes no report. Refusing is the point: a
+        document that presents an adopter's feature file as the specification's
+        is worse than no document, because it is the one thing a consumer cannot
+        check.
         """
         name = suite.config.name
         runs = suite.sorted_runs