Three layers, each on the previous, per the plan artifact. Labels are a new `labelGoal` overlay carrying a goal's WHOLE set, latest-wins by (createdAt, uri) and matched by goal URI — the `closeGoal` pool shape, and any active member's for the same stated reason. `GoalView.labels` is the typed field anything mechanical reads. Filters are UI-only derivation over the fold, mirrored into query params so a narrowed list is a link; that serialization is what a saved view names. Saved views are a personal `savedView` record, latest-wins per (author DID, name), so re-saving a name is the edit and `deleted: true` is the delete. Notes on what the plan did not anticipate: - The validator already enforced array `maxLength` and per-item schemas, so the plan's top risk needed no fix — only the test that pins it. - Normalization lives in `@radial/core` rather than the UI, because the sidecar needs the identical rule; the fold deliberately does NOT apply it, and only drops exact repeats. - `records` in the digest is assembled from surfaced views, not from every trusted record, so neither collection reaches it — the same treatment `closeGoal` and `setAutoReview` already get. Left as-is and documented in docs/operators.md rather than widened here. - Added `/goals`, a space-wide goal list: a view cut by label alone spans projects, and no existing list is "the goals matching this". - The OAuth scope list needed both collections, so a session predating this change must re-authorize before labelling; `write.ts` already names that. Co-Authored-By: claudebot.disnetdev.com (did:plc:n6ku5xddiuguwze3f356evla) <claudebot.disnetdev.com@noreply.radial>