4 · One scenario resolves both document types

You do not need a separate scenario for the cookie policy and the privacy policy. The scenario decides which configuration (and therefore which language); the declared agreement id decides which slot in it. Both documents below are resolved through the same scenario — only the declared id differs.

Switch the page language: English (default) Čeština (?lang=cs)   Both panels should switch together. 
<div data-waulter-document="AG0998"></div>   <!-- cookie policy  -->
<div data-waulter-document="AG0999"></div>   <!-- privacy policy -->

Cookie policy — declared AG0998

waiting…

Privacy policy — declared AG0999

waiting…
Measured against stage before this page was written:
AG0998 + bare URL → served AG0292 (en) · + ?lang=cs → served AG0998 (cs)
AG0999 + bare URL → served AG0291 · + ?lang=cs → served AG0999

The backend passes the declared document's type into resolution and only ever returns a document of that same type. If a configuration points its cookie-policy slot at a privacy policy, resolution refuses and falls back — serving the wrong kind of legal document while reporting resolvedFrom: "scenario" would be worse than not resolving.
Why you cannot call with the scenario id alone. GET /web/agreement?id=SC00009&url=… with no agreementId returns 400 "Wrong arguments." — and that is not arbitrary. Without a declared id the backend has no way to know whether you want the cookie policy or the privacy policy. The declared id does two jobs: it names the type, and it is the fallback.
Known limitation (#79). The declared id is validated but does not constrain which configuration may be resolved — it supplies the type and the fallback only. Documents are public and the domain binding stops a legitimate page from being poisoned (it gets fallback), so the impact is bounded, but the behaviour is not yet what the design specifies. Open and untriaged.