@agent-native/core 0.130.2 → 0.131.2

package/corpus/templates/content/docs/product/capabilities/content.view.dynamic-create.md

@@ -0,0 +1,137 @@
+---
+record_type: "capability"
+spec_version: 2
+id: "content.view.dynamic-create"
+name: "View-derived creation defaults"
+user_promise: "Creating through a View starts new records with safe contextual values without turning that View's filters into hidden validation."
+primary_user_job: "Capture a new record where I am working and have it start in the right context without losing the ability to make a valid exception."
+kind: "surface"
+state: "approved_shape"
+publicness: "public"
+availability: "universal"
+dependencies: ["content.view.query", "content.property.constraints"]
+related_features: ["content.feature.data-that-keeps-itself-right"]
+roadmap_boundary: "feature"
+acceptance_summary: "Creation through an effective View seeds only deterministic positive equality, membership, contextual, and renderer-placement values; Database validation remains the sole hard gate, and valid edits may move records into or out of results with truthful feedback."
+proof_requirements:
+  [
+    "Typed effective-View analysis for positive seeds and refusal of ambiguous inference",
+    "Shared UI and Action creation with Database permissions, validation, defaults, Events, revisions, and Undo",
+    "Real-interface workflows for conflicting seeds, post-create exclusion, and valid edits that leave or re-enter results",
+  ]
+evidence: []
+superseded_by: null
+last_reviewed: "2026-07-29"
+---
+
+# View-derived creation defaults
+
+## Why this exists
+
+People often create work from a focused list, Board lane, or Calendar date.
+That surface should provide a useful starting context, but a filter only says
+which records are included in a result. Treating it as a hidden mutation rule
+would make a View unexpectedly own data validity and block legitimate work.
+
+## Example workflow
+
+An editor opens an `Active` Board filtered to `Active = true` and chooses a
+lane for `Status = Planned`. New work begins with both values. The editor then
+turns `Active` off because that is the correct valid state. Content commits the
+change through the Database, removes the record from the active View, and shows
+**Moved out of this View · Undo**; it does not reject the change or delete the
+record.
+
+## Product contract
+
+### Seed only what is deterministic
+
+- Creation uses the effective View: its saved definition, applicable personal
+  arrangement, and renderer placement. Human and agent creation receive the
+  same analysis and shared Action behavior.
+- Exact positive equality, positive membership, contextual equality, and an
+  explicit renderer placement may seed stored values when they have an
+  unambiguous writable route. Examples include `Active = true`, `Tags contains
+Urgent`, `Assignee = current actor`, a Board lane, or a Calendar date.
+- `OR`, negation, ranges, full-text search, aggregate conditions, arbitrary
+  formulas, and other non-deterministic expressions never manufacture a stored
+  value merely because a record might satisfy them.
+- Seeds are starting values, not locked fields. Explicit user intent may change
+  them before or after creation whenever the owning Database permits the
+  resulting mutation.
+
+### Inclusion is not validation
+
+- Query and View filters control result inclusion. The owning Database owns
+  membership, Properties, defaults, constraints, permissions, Rules, and the
+  canonical create/write path; only those rules decide whether a value is
+  valid.
+- A View over a Query cannot seed or validate outside the Query's declared
+  creation routes. A composed Query with no applicable route is truthfully
+  read-only, and a View cannot invent a target.
+- If valid creation or a later valid edit no longer matches the effective
+  result, Content preserves the record, refreshes the result, and gives light
+  feedback such as **Created, but not shown in this View** or **Moved out of
+  this View**, with an appropriate Open or Undo route.
+- Conflicting automatic seeds never cause a guess. Quick capture expands to the
+  normal creation editor, explains the conflict, and lets Database validation
+  and explicit intent resolve it.
+
+## Boundaries and non-goals
+
+- Database and Query Views own presentation, downstream filters, and the
+  effective View; Database constraints and Rules own validity.
+- Reusable Queries own intrinsic filters and creation routes. This Capability
+  applies those routes in a View; it does not define cross-source write routing.
+- This is not a bulk-update, schema-default, task-template, permission, or
+  second Action system.
+
+## Acceptance stories
+
+### Seed a Board capture without locking it
+
+Given an authorized Board View filtered to `Active = true` with a `Planned`
+lane, when a person creates a record in that lane, then the record starts with
+`Active = true` and `Status = Planned`. When they validly set `Active = false`,
+then the Database commits it and the record leaves the View with Undo feedback.
+
+### Refuse to infer an ambiguous filter
+
+Given a View filtered by `Priority = High OR Priority = Urgent` and a date
+range, when a person starts quick capture, then Content does not choose a
+priority or fabricate a date from those expressions; it opens the normal editor
+with only independently deterministic defaults.
+
+### Resolve conflicting seeds visibly
+
+Given a View's positive filter and renderer placement propose incompatible
+writable values, when an authorized person creates a record, then no arbitrary
+value is committed and the normal editor identifies the mismatch. If the person
+chooses a valid value outside the View, the record is created and truthfully
+reported as not shown.
+
+## Current evidence
+
+Existing filters, saved Views, Board/Calendar rendering, and creation paths are
+useful donor substrate. They do not yet prove typed seed analysis, identical
+human/agent behavior, conflict expansion, result-transition feedback, or the
+complete Database-validation boundary. This Capability remains `approved_shape`.
+
+## Proof plan
+
+1. Test equality, membership, contextual, Board, and Calendar seeds through UI
+   and Actions, including permissions, defaults, constraints, Rules, Events,
+   revisions, reload, and Undo.
+2. Assert that OR, negation, ranges, search, aggregates, formulas, unavailable
+   fields, ambiguous routes, and inaccessible values produce no invented seed.
+3. Exercise post-create exclusion, editing records out of and back into Database
+   and Query Views, conflicting seeds, and composed Query zero/one/many routes.
+4. Verify accessible feedback and keyboard capture without turning View
+   inclusion into a hidden mutation failure.
+
+## Open questions
+
+- The exact precedence and presentation for multiple compatible defaults,
+  Database defaults, and renderer placement need implementation design.
+- The compact creation editor for conflicting seeds and the exact Undo scope
+  need interaction design, while preserving the settled ownership boundary.

package/corpus/templates/content/docs/product/capabilities/content.view.fast-capture.md

@@ -0,0 +1,82 @@
+---
+record_type: "capability"
+spec_version: 2
+id: "content.view.fast-capture"
+name: "Fast keyboard capture"
+user_promise: "Keyboard-fluent List and Table capture"
+primary_user_job: "Capture and revise a record at keyboard speed without leaving the current authorized View."
+kind: "surface"
+state: "approved_shape"
+publicness: "public"
+availability: "universal"
+dependencies: ["content.view.query", "content.agent.action-parity"]
+related_features:
+  [
+    "content.feature.see-your-information-your-way",
+    "content.feature.run-projects-your-way",
+  ]
+roadmap_boundary: "feature"
+acceptance_summary: "List and Table capture create and edit canonical records through the shared Action surface, preserve keyboard focus, and roll back an unsuccessful optimistic update visibly."
+proof_requirements:
+  [
+    "Keyboard-only create, edit, Enter, Tab, escape, navigation, and focus-return coverage",
+    "Shared Action authorization, validation, history, error, and optimistic rollback coverage",
+    "Real-interface assistive-technology and concurrent-refresh workflow",
+  ]
+evidence: []
+superseded_by: null
+last_reviewed: "2026-07-29"
+---
+
+# Fast keyboard capture
+
+## Why this exists
+
+Quick capture keeps a small thought from becoming a ceremony while retaining the
+Database's rules and the record's canonical identity.
+
+## Example workflow
+
+An editor tabs to the last row of a filtered List, presses Enter, types a title,
+and moves through editable cells with Tab. A rejected change returns focus and
+an explanation; it does not leave a convincing but unsaved row behind.
+
+## Product contract
+
+- List and Table are keyboard editors of canonical Database records, not local drafts.
+- Enter, Tab, arrow navigation, escape, selection, and focus restoration are predictable and accessible.
+- Creation and edits use the same authorized Action, validation, Events, history, and failure behavior as an agent.
+- Optimistic UI is reversible; denied, invalid, stale, or unavailable work is visibly distinct from success.
+
+## Boundaries and non-goals
+
+View-derived creation defaults own contextual seeds. This Capability does not define
+bulk editing, a new inline data store, or a permission bypass.
+
+## Acceptance stories
+
+### Capture a record without a mouse
+
+Given an editable List, when a person enters a title and tabs through a writable field,
+then one valid canonical record is created and focus advances predictably.
+
+### Recover from a rejected edit
+
+Given an optimistic inline edit that fails validation, when the Action rejects it, then
+the rendered value rolls back, focus remains useful, and the failure is announced.
+
+## Current evidence
+
+Existing Database editing and View machinery are donor substrate. No complete proof yet
+covers keyboard semantics, Action parity, rollback, accessibility, and recovery; this
+Capability remains `approved_shape`.
+
+## Proof plan
+
+1. Test keyboard creation and editing across List and Table with validation and permissions.
+2. Verify Action/UI parity, Events, history, stale writes, rollback, and reload.
+3. Exercise screen-reader announcements, focus order, and concurrent result refreshes.
+
+## Open questions
+
+The compact editor's exact escape and multi-cell paste semantics need interaction design.

package/corpus/templates/content/docs/product/capabilities/content.view.graph.md

@@ -0,0 +1,95 @@
+---
+record_type: "capability"
+spec_version: 2
+id: "content.view.graph"
+name: "Graph View"
+user_promise: "Graph lays out query-selected canonical objects and typed Relationships for access-safe exploration and editing."
+primary_user_job: "Explore a meaningful neighborhood of connected records, understand why they relate, and make an authorized semantic change without treating a visual line as the source of truth."
+kind: "surface"
+state: "approved_shape"
+publicness: "public"
+availability: "universal"
+dependencies:
+  [
+    "content.knowledge.graph",
+    "content.relationship.edge",
+    "content.view.renderer-conformance",
+  ]
+related_features: ["content.feature.sketch-connections-keep-whats-true"]
+roadmap_boundary: "feature"
+acceptance_summary: "Graph renders an access-scoped saved relationship query as canonical nodes and typed edges, supports authorized typed-edge editing, and keeps every layout operation separate from semantic truth."
+proof_requirements:
+  [
+    "Access-scoped graph-query results, traversal, expansion, filtering, and empty or unavailable states",
+    "Typed-edge creation, editing, removal, permission denial, and history through the shared Relationship Action",
+    "Manual and physics-assisted layouts, pinning, saved arrangements, reset, and proof that layout never mutates semantic relationships",
+    "Keyboard, assistive-technology, dense-neighborhood, and drill-in workflows in the real interface",
+  ]
+evidence: []
+superseded_by: null
+last_reviewed: "2026-07-29"
+---
+
+# Graph View
+
+## Why this exists
+
+A list can show that records are related without making the surrounding structure legible. Graph View lets people explore an access-scoped semantic neighborhood: canonical records are nodes, and each visible line is a real typed Relationship rather than decoration.
+
+It is for questions such as “what supports this claim?” or “which work is blocked by this decision?” It is not a drawing board, a statistical chart, or an authored diagram.
+
+## Example workflow
+
+A project lead opens a saved graph query centered on a decision Page and expands one relationship type at a time. They pin the Pages relevant to a review, use a force-assisted layout to separate a crowded neighborhood, and save that arrangement for later. With the `blocks` type selected in the edge tool, they draw from one authorized Page to another; Content creates the corresponding canonical Relationship and shows it in Connections and other authorized projections. Resetting the layout changes only positions, never the relationship.
+
+## Product contract
+
+- Graph renders a saved, typed, access-scoped relationship query. Nodes retain their canonical Page, Block, Source, or query-result identity; Graph owns only its View configuration and arrangement.
+- Each semantic edge displays a Relationship type and is a projection of the canonical edge. Editing, removing, or creating an edge uses the shared typed Relationship Action and records normal history.
+- The edge tool requires a Relationship type before it can create an edge. A line never becomes a semantic assertion merely because it was drawn.
+- People may filter, group, and style by relationship type; expand authorized neighbors; open canonical records; pin or unpin nodes; save a useful arrangement; and reset it.
+- Manual, hierarchical, radial, and physics-assisted layouts may change positions only. Layout algorithms never infer, create, rewrite, or delete Relationships.
+- Graph applies access before query evaluation, traversal, counts, labels, previews, export, or agent use. An inaccessible endpoint is not exposed through a visible placeholder, degree, or hidden-edge count.
+- An empty query is an honest empty Graph. A failed, stale, or unavailable query reports that state distinctly and does not masquerade as no relationships.
+
+## Boundaries and non-goals
+
+- `content.relationship.edge` owns canonical edge identity, cardinality, authority, mutation, and history; Graph is an authorized editor and projection.
+- `content.knowledge.graph` owns relationship-query semantics and traversal; Graph owns visual exploration and layout.
+- `content.view.canvas` owns intentional spatial composition and view-local freeform connectors. Canvas lines require explicit promotion before they become Relationships.
+- `content.view.chart` owns analytical visualizations over measures and grouped data. Authored Mermaid diagrams belong to code-authoring and Mermaid rendering, not Graph.
+- Graph does not create a parallel graph datastore, access model, permission bypass, task dependency engine, or diagram language.
+
+## Acceptance stories
+
+### Explore only what the viewer may know
+
+Given a saved graph query that includes both accessible and inaccessible relationships, when a viewer opens and expands Graph, then the graph, counts, labels, previews, and exports contain only authorized nodes and edges, while a direct unauthorized request receives an honest denial.
+
+### Create a semantic edge deliberately
+
+Given an editor authorized to change two Pages and use the `supports` Relationship type, when they select `supports` and draw an edge, then one canonical typed Relationship is created and appears in Connections and other authorized projections. When no type is selected, drawing cannot commit an edge.
+
+### Separate arrangement from meaning
+
+Given a dense saved Graph, when a viewer pins nodes, runs a force-assisted layout, saves the arrangement, and later resets it, then node positions change as requested but the relationship query and canonical edge history remain unchanged.
+
+### Report unavailable work truthfully
+
+Given a graph query that cannot complete because its source is unavailable, when Graph opens, then it reports the unavailable state and retry path rather than rendering a plausible empty neighborhood.
+
+## Current evidence
+
+The repository defines the shared object, query, Relationship, and renderer boundaries that Graph will need. Existing code may offer useful visualization or relation substrate, but no current evidence proves the complete Graph query, edge-editing, access-closure, layout, or recovery contract. This Capability remains `approved_shape`.
+
+## Proof plan
+
+1. Exercise saved graph queries with filtering, expansion, grouping, pagination or bounds, empty results, stale inputs, and unavailable sources.
+2. Create, edit, and remove typed edges through Graph alongside Connections and another projection; verify one identity, permission decision, and committed history.
+3. Verify manual, hierarchical, radial, and physics-assisted layouts across pin, save, reload, reset, and concurrent semantic edits; assert that no layout path changes an edge.
+4. Run keyboard and assistive-technology workflows for navigation, node inspection, edge-type selection, editing, errors, and dense-graph recovery.
+5. Re-run traversal, labels, counts, previews, export, and agent reads with changing endpoint access to prove access precedes every computation.
+
+## Open questions
+
+The contract leaves rendering-engine choice, layout implementation, graph-size limits, and exact controls open. Those choices must preserve bounded loading, explicit failure states, and the semantic/layout separation above.

package/corpus/templates/content/docs/product/capabilities/content.view.grouping-aggregation.md

@@ -0,0 +1,83 @@
+---
+record_type: "capability"
+spec_version: 2
+id: "content.view.grouping-aggregation"
+name: "Grouping and aggregation"
+user_promise: "Views group across several dimensions and compute access-safe totals, subtotals, rollups, and measures."
+primary_user_job: "Understand meaningful totals and their contributing records without learning information I cannot access."
+kind: "primitive"
+state: "approved_shape"
+publicness: "public"
+availability: "universal"
+dependencies: ["content.view.query", "content.access.safe-aggregate"]
+related_features:
+  [
+    "content.feature.see-your-information-your-way",
+    "content.feature.plan-work-across-time",
+    "content.feature.understand-what-your-data-says",
+  ]
+roadmap_boundary: "feature"
+acceptance_summary: "Authorized View results can be grouped by typed dimensions and measured with access-safe totals, subtotals, rollups, and drill-in."
+proof_requirements:
+  [
+    "Typed multi-dimension grouping, ordering, empty groups, and measure semantics",
+    "Access-before-grouping, totals, rollups, drill-in, export, and agent-context tests",
+    "Real-interface refresh, unavailable-source, dense-result, and accessible-table workflows",
+  ]
+evidence: []
+superseded_by: null
+last_reviewed: "2026-07-29"
+---
+
+# Grouping and aggregation
+
+## Why this exists
+
+People need a useful shape for many records, but a subtotal must never reveal a row,
+field, or inference that its viewer may not know.
+
+## Example workflow
+
+A lead groups authorized work by project and status, reads each subtotal, and opens a
+group to inspect its canonical records. A private task contributes nowhere: not to a
+count, a sum, an empty-group hint, or an export.
+
+## Product contract
+
+- Views group their canonical Query result by typed dimensions and compute declared measures.
+- Access applies before grouping, aggregation, rollup, count, labels, drill-in, export, or agent context.
+- Groups retain stable query semantics; sorting, collapse, and presentation do not mutate records.
+- Empty, stale, unavailable, and partially loaded inputs are explicitly represented.
+
+## Boundaries and non-goals
+
+Queries own result semantics and safe aggregates own disclosure rules. This is not a
+spreadsheet engine, a new analytics datastore, or permission-derived guessing.
+
+## Acceptance stories
+
+### Read an authorized subtotal
+
+Given a grouped View with private rows, when a viewer opens it, then every group and
+total is computed only from authorized rows and fields.
+
+### Drill into a measure
+
+Given a visible aggregate cell, when a viewer drills in, then Content opens the exact
+authorized contributing records rather than an inferred or copied collection.
+
+## Current evidence
+
+Existing filters and renderer utilities are donor substrate. The repository does not
+yet prove multi-dimensional measure semantics or disclosure closure, so this remains
+`approved_shape`.
+
+## Proof plan
+
+1. Test typed grouping, measures, ordering, nulls, empty groups, and rollups.
+2. Test access changes through results, counts, drill-in, exports, and agent context.
+3. Exercise reload, source failure, pagination, dense views, keyboard, and assistive technology.
+
+## Open questions
+
+The initial measure catalog and treatment of mixed-source precision need implementation design.

package/corpus/templates/content/docs/product/capabilities/content.view.map.md

@@ -0,0 +1,77 @@
+---
+record_type: "capability"
+spec_version: 2
+id: "content.view.map"
+name: "Map View"
+user_promise: "Map renders typed locations with points, clustering, filtering, and record previews before adding richer geographic layers."
+primary_user_job: "See authorized records in their meaningful places and open the underlying record without making map coordinates a second source of truth."
+kind: "surface"
+state: "approved_shape"
+publicness: "public"
+availability: "universal"
+dependencies: ["content.property.location", "content.view.renderer-conformance"]
+related_features: []
+roadmap_boundary: "supporting"
+acceptance_summary: "Map projects access-scoped canonical results with typed locations, filters, clustering, previews, and shared record actions."
+proof_requirements:
+  [
+    "Typed location selection, invalid or absent location, viewport, filter, and cluster behavior",
+    "Access-safe markers, counts, previews, search, export, and shared Action editing",
+    "Real-interface keyboard, assistive alternative, provider-unavailable, and reload workflows",
+  ]
+evidence: []
+superseded_by: null
+last_reviewed: "2026-07-29"
+---
+
+# Map View
+
+## Why this exists
+
+Place can be the clearest way to find work, provided a pin remains a projection of a
+typed location on a canonical record.
+
+## Example workflow
+
+A coordinator filters locations to an authorized region, selects a cluster, previews a
+record, and opens it. Changing the record's location uses the ordinary shared Action;
+the pin updates after the canonical change.
+
+## Product contract
+
+- Map consumes a canonical Database or Query result and a declared typed location field.
+- Markers, clusters, viewport filters, previews, and counts are access-scoped.
+- Selecting a pin opens or edits the canonical record through shared View Actions.
+- Missing, invalid, stale, and provider-unavailable locations report honestly.
+
+## Boundaries and non-goals
+
+`content.property.location` owns location meaning. Map is not geocoding custody, route
+planning, a geographic layer editor, or a second record store.
+
+## Acceptance stories
+
+### Explore only authorized places
+
+Given a result containing private locations, when a viewer opens Map, then no marker,
+cluster count, preview, or viewport query exposes those records.
+
+### Edit a location through its record
+
+Given an authorized marker, when an editor changes its typed location, then the shared
+Action updates one canonical record and the Map refreshes without duplicate state.
+
+## Current evidence
+
+No current implementation evidence proves Map's location, access, interaction, and
+recovery contract. This Capability remains `approved_shape`.
+
+## Proof plan
+
+1. Test typed locations, invalid values, filters, clusters, and canonical preview/open.
+2. Verify access closure through markers, counts, viewport changes, exports, and agents.
+3. Exercise keyboard alternatives, source/provider failure, reload, and dense geographic results.
+
+## Open questions
+
+The first provider boundary and offline geographic behavior remain implementation questions.

package/corpus/templates/content/docs/product/capabilities/content.view.personal-state.md

@@ -0,0 +1,99 @@
+---
+record_type: "capability"
+spec_version: 2
+id: "content.view.personal-state"
+name: "Personal View state"
+user_promise: "A shared View remembers one private arrangement per person and supports named Only-me Views without copying records."
+primary_user_job: "Explore and remember a useful personal arrangement without changing the dependable View everyone else shares."
+kind: "surface"
+state: "approved_shape"
+publicness: "public"
+availability: "universal"
+dependencies: ["content.view.query", "content.share.views"]
+related_features: ["content.feature.make-the-workspace-yours"]
+roadmap_boundary: "feature"
+acceptance_summary: "Each shared View remembers one unnamed personal arrangement per user, supports any number of named Only-me Views, exposes effective state to agents, and never publishes personal exploration accidentally."
+proof_requirements:
+  [
+    "One automatically persisted personal arrangement per user and shared View",
+    "Reset, Save as new View, and permissioned Update shared View behavior",
+    "Focused View Instance containing shared, personal, effective, and delta state for UI and agents",
+    "Access isolation, link behavior, persistence, multi-device recovery, and no record copying",
+  ]
+evidence: []
+superseded_by: null
+last_reviewed: "2026-07-29"
+---
+
+# Personal View state
+
+## Why this exists
+
+Shared Views need dependable defaults, but people also need to sort, filter, group, resize, and collapse data while they work. Requiring a save decision after every exploration creates meta-work; publishing every experiment creates chaos.
+
+## Example workflow
+
+An editor opens the team's shared Content Calendar, filters to their own recent articles, resizes columns, and groups by status. Content quietly remembers that arrangement and shows **Viewing with personal changes**. The editor can reset, save it as a named **Only me** View, or deliberately update the shared View if they have permission.
+
+## Product contract
+
+- Every shared saved View may remember at most one unnamed personal arrangement for each user.
+- The arrangement automatically persists filters, sorting, grouping, column order/size, collapsed sections, and other supported presentation state without a recurring **Save for me** action.
+- When personal state differs, the interface quietly shows **Viewing with personal changes**.
+- **Reset to shared View** removes the remembered override.
+- **Save as new View** creates a stable named View over the same owner input with visibility **Only me** or an allowed shared destination. A person may create many named private Views.
+- **Update shared View** deliberately replaces the shared default only with the required Database/Query authority and records an ordinary reversible Revision.
+- The focused View Instance contains the shared definition, remembered personal override, effective state, and delta between them.
+- Agents receive that effective focused state so they understand what the person sees. They may run arbitrary ephemeral Queries behind the scenes without changing the visible arrangement.
+- An agent changes the personal arrangement only when asked to show a result, saves a named View only when asked, and updates the shared default only through the explicit permitted action.
+- Ordinary copied View links resolve to the saved View definition, never the sender's unnamed personal arrangement.
+- Personal state changes presentation and safe creation seeds only. It never copies records, changes source truth, grants access, or creates a private fork of the Database/Query.
+
+## Permissions and failure behavior
+
+- Personal arrangements and Only-me Views are visible only to their owner and system processes acting within that person's authority.
+- Saving a shared destination or updating a shared View requires the normal owner permissions; personal state cannot bypass them.
+- Effective results still intersect all View, input, row, field, Source, and viewer access.
+- If personal configuration temporarily references an unavailable field, Content preserves it in a degraded state when the absence may be temporary. Intentional field deletion follows the atomic cleanup contract.
+- Persistence failure leaves the shared View unchanged and reports that the personal arrangement was not remembered; it must not silently publish the state instead.
+
+## Boundaries and non-goals
+
+- This Capability owns personal presentation state, not Query semantics or Database values.
+- It does not make copied links carry hidden sender state.
+- It does not restrict a person to one named private View; the one-item limit applies only to the automatic unnamed arrangement per shared View.
+- Ephemeral agent exploration is not a saved View and does not mutate UI unless requested.
+
+## Acceptance stories
+
+### Remember without publishing
+
+Given two people open the same shared View, when one changes filters, grouping, and column sizing, then only that person's effective arrangement changes and persists across reload while the other person and shared definition remain unchanged.
+
+### Save several private alternatives
+
+Given one personal arrangement, when its owner chooses **Save as new View** twice with **Only me**, then two stable private Views exist over the same canonical records while the shared View still retains only one unnamed override for that person.
+
+### Keep links predictable
+
+Given a person copies the URL while viewing personal changes, when another authorized viewer opens it, then they receive the saved View definition plus their own personal state, never the sender's override.
+
+### Give agents the real focused surface
+
+Given a focused View with temporary personal filters, when an agent is asked about what is visible, then it receives shared, personal, effective, and delta state and may query further without publishing or changing the arrangement unless asked.
+
+## Current evidence
+
+Existing View controls and application-state patterns are useful substrate, but the complete unnamed persistence model, named Only-me Views, delta indication, scoped save/update actions, multi-device behavior, and agent-effective context are not proven. This Capability remains `approved_shape`.
+
+## Proof plan
+
+1. Persist and reset each supported personal filter, sort, group, layout, sizing, and collapsed-state override across reload and devices.
+2. Create several Only-me Views, attempt shared saves with and without authority, and verify one reversible shared Revision.
+3. Copy links under personal changes and verify predictable recipient behavior.
+4. Inspect application state and agent actions for shared/personal/effective/delta parity and non-mutating exploration.
+5. Exercise schema deletion, temporary unavailability, access revocation, persistence failure, Undo, accessibility, and recovery.
+
+## Open questions
+
+Exact cross-device conflict resolution for simultaneous personal arrangements and the retention policy for long-unused unnamed overrides remain open implementation/product details.

package/corpus/templates/content/docs/product/capabilities/content.view.pivot.md

@@ -0,0 +1,76 @@
+---
+record_type: "capability"
+spec_version: 2
+id: "content.view.pivot"
+name: "Pivot View"
+user_promise: "Pivot places dimensions on rows and columns, typed aggregations in cells, and drills back to canonical records."
+primary_user_job: "Compare an authorized measure across two meaningful dimensions and inspect the records behind any result."
+kind: "surface"
+state: "approved_shape"
+publicness: "public"
+availability: "universal"
+dependencies: ["content.view.grouping-aggregation"]
+related_features: ["content.feature.understand-what-your-data-says"]
+roadmap_boundary: "feature"
+acceptance_summary: "Pivot configures typed row and column dimensions with access-safe measures, totals, and drill-in to canonical contributing records."
+proof_requirements:
+  [
+    "Typed dimensions, measure selection, totals, nulls, ordering, and configuration persistence",
+    "Access-safe cells, totals, drill-in, export, agent context, and empty or unavailable input tests",
+    "Real-interface keyboard table navigation, responsive overflow, reload, and dense-data workflow",
+  ]
+evidence: []
+superseded_by: null
+last_reviewed: "2026-07-29"
+---
+
+# Pivot View
+
+## Why this exists
+
+One flat group can answer “how much?”; a pivot makes the crossing of two questions
+legible without detaching its cells from the records that made them.
+
+## Example workflow
+
+A lead puts project on rows, status on columns, and estimate sum in cells. Selecting a
+cell opens its authorized contributing records rather than a copied spreadsheet range.
+
+## Product contract
+
+- Pivot is a saved View configuration over canonical, access-scoped Query results.
+- Row and column dimensions and typed measures use grouping and aggregation semantics.
+- Cells, totals, labels, drill-in, export, and agent context reveal only authorized input.
+- Configuration persists independently of the canonical records and reports unavailable data honestly.
+
+## Boundaries and non-goals
+
+Grouping and aggregation own measure semantics. Pivot is not a formula grid, a writable
+cell store, or a replacement for Chart.
+
+## Acceptance stories
+
+### Compare two dimensions
+
+Given an authorized task result, when a viewer pivots project by status, then each cell
+and total reflects only eligible records and preserves the selected typed measure.
+
+### Inspect a cell
+
+Given a visible cell, when the viewer drills in, then the resulting collection contains
+only its authorized contributors and maintains canonical record identity.
+
+## Current evidence
+
+The grouping dependency establishes intended substrate; no repository evidence proves a
+complete Pivot renderer. This Capability remains `approved_shape`.
+
+## Proof plan
+
+1. Test dimensions, measures, totals, nulls, ordering, persistence, and drill-in.
+2. Verify disclosure closure across cells, totals, exports, and agents.
+3. Exercise responsive table navigation, dense data, reload, and unavailable sources.
+
+## Open questions
+
+The initial dimension-depth limit and display policy for sparse matrices need design.