feat(view): render GridView relationship matrices

.agents/skills/testing-pilot-corpora-gate/SKILL.md

@@ -183,8 +183,8 @@ gate's own helpers are package-private but reusable (`pilotCorporaGate.files(t)`
 
 `actionlint`, `shellcheck`, `python3 scripts/check-doc-links.py`, `gofmt`, `go vet`,
 `go run -C tools ./cmd/pilot-diff` (validators pre-downloaded; ~4min, prints e.g.
-the headline the committed baseline holds — `384 file(s), 345 fully agreeing; 49 agreed
-diagnostic(s), 43 only ours, 1640 only the pilot's` at the `2026-08` pin, so read it from
+the headline the committed baseline holds — `385 file(s), 345 fully agreeing; 49 agreed
+diagnostic(s), 43 only ours, 1653 only the pilot's` at the `2026-08` pin, so read it from
 `docs/project/pilot-differential-baseline.json` rather than from this line)
 and `make lint` (staticcheck+gosec, ~2min) all work. There is **no** `yamllint` and **no**
 `circleci` CLI, so `.circleci/config.yml` can only be parsed as YAML, not schema-validated — say so

.agents/skills/testing-pilot-differential/SKILL.md

@@ -23,8 +23,8 @@ GNU-format diagnostics **relative to `--root`**. Consequences for testing:
 - `-validator /nonexistent` now says `run ./scripts/download-pilot-sysml-validator.sh`.
 - Measured at the `2026-08` pin after bare parameters took their effective range `[0..*]`, removing
   the adjudicated `Behaviors.kerml:14` multiplicity warning (the `[1]` `RocketEquation` inputs keep
-  its warning at `delta-v-budget.sysml:93`): `384 file(s), 345 fully agreeing; 49 agreed, 43 only
-  ours, 1640 only the pilot's`, JSON totals `openSysMLDiagnostics 94 / pilotDiagnostics 1691 /
+  its warning at `delta-v-budget.sysml:93`): `385 file(s), 345 fully agreeing; 49 agreed, 43 only
+  ours, 1653 only the pilot's`, JSON totals `openSysMLDiagnostics 94 / pilotDiagnostics 1704 /
   severityMismatch 2`; the two new only-ours rows are the expected `action-step-multiplicity-not-fixed`
   warnings on `training/18. Action Performance/Action Performance Example.sysml:10` and
   `pilot-examples/Camera Example/Camera.sysml:4`. ~2 min wall, byte-identical across runs *and* after a from-scratch rebuild of
@@ -146,8 +146,8 @@ parameters took their effective range `[0..*]` and removed the adjudicated `Beha
 warning (the `[1]` `RocketEquation` inputs still produce the warning at
 `delta-v-budget.sysml:93`), is current: the action-step multiplicity rule adds the two expected
 `action-step-multiplicity-not-fixed` warnings on `takePhoto[*]` in the training corpus and
-`takePicture[*]` in `Camera Example/Camera.sysml`; a live run gives `384 file(s), 345 fully
-agreeing; 49 agreed, 43 only ours, 1640 only the pilot's`, byte-identical to the committed baseline, and
+`takePicture[*]` in `Camera Example/Camera.sysml`; a live run gives `385 file(s), 345 fully
+agreeing; 49 agreed, 43 only ours, 1653 only the pilot's`, byte-identical to the committed baseline, and
 `docs/project/pilot-differential.md`'s "Results" table matches. The prior rebaseline, when the
 Legend of the Red Dragon example left for its own repository, gave
 <!-- doc-count:historical -->`380 file(s), 344 fully agreeing; 38 agreed, 42 only ours, 1614 only the pilot's`.

.agents/skills/testing-pilot-execution-referee/SKILL.md

@@ -148,8 +148,8 @@ pilot answers the representation's own. See
   `pilot-exec-diff: <file>:<line>: model no/such/model.sysml: stat <abs>: no
   such file or directory`.
 - **Additivity.** `go run -C tools ./cmd/pilot-diff` must still print the headline the
-  committed baseline holds (`384 file(s), 345 fully agreeing; 49 agreed
-  diagnostic(s), 43 only ours, 1640 only the pilot's` at the `2026-08` pin — read it from the baseline JSON, not from this line, since each
+  committed baseline holds (`385 file(s), 345 fully agreeing; 49 agreed
+  diagnostic(s), 43 only ours, 1653 only the pilot's` at the `2026-08` pin — read it from the baseline JSON, not from this line, since each
   fix round moves it) and `jq -S` diff clean against
   `docs/project/pilot-differential-baseline.json`; `git status --porcelain`
   empty at the end.

.agents/skills/testing-pilot-xpect/SKILL.md

@@ -423,8 +423,8 @@ census in `w5c_census_test.go` is live two ways: perturb one pinned triple (e.g.
 ## Regression neighbour
 
 `go run -C tools ./cmd/pilot-diff` (~1m12s) must still print the headline the *committed* baseline holds —
-at the `2026-08` pin that is `384 file(s), 345 fully agreeing; 49 agreed diagnostic(s), 43
-only ours, 1640 only the pilot's`. Read the number out of
+at the `2026-08` pin that is `385 file(s), 345 fully agreeing; 49 agreed diagnostic(s), 43
+only ours, 1653 only the pilot's`. Read the number out of
 `docs/project/pilot-differential-baseline.json` rather than trusting this line, since a landing fix
 round moves it. When the baseline is itself stale (it was at `19a3ce03`, holding 273 / 281 / 317), a
 failing `cmp` against it is *not* evidence of an Xpect regression — compare the summary line, and see

README.md

@@ -336,11 +336,11 @@ The project is under active development, with the core infrastructure operationa
 <!-- doc-counts:begin refereed-figures -->
 **Measured against the pinned reference** (`PILOT_TAG=2026-08`, artifact `0.62.0`). Every number below is generated by `make docs-counts` from the committed baselines and gated; none of them is typed in by hand.
 
-- **Corpus agreement:** 345 of 384 files agree diagnostic-by-diagnostic; 43 diagnostics are ours alone and 1640 the reference's alone, and the first number must be read by root: the aggregate includes candidate conformance differences, intentional execution-scope warnings on reference corpora and diagnostics from our own examples ([differential](docs/project/pilot-differential.md), `go run -C tools ./cmd/pilot-diff`).
+- **Corpus agreement:** 345 of 385 files agree diagnostic-by-diagnostic; 43 diagnostics are ours alone and 1653 the reference's alone, and the first number must be read by root: the aggregate includes candidate conformance differences, intentional execution-scope warnings on reference corpora and diagnostics from our own examples ([differential](docs/project/pilot-differential.md), `go run -C tools ./cmd/pilot-diff`).
 - **Declared-diagnostic silence:** of the 512 declared `errors` rows in the reference's own Xpect suites, we report nothing for 0. 245 we report word-for-word; 248 wording-only and 7 location-only differences are agreement in substance and are not counted as gaps; 0 more we report as a warning and 2 elsewhere in the file ([Xpect oracle](docs/project/pilot-xpect.md), `go run -C tools ./cmd/pilot-xpect`).
 - **Scope agreement:** 230 of 230 declared scope assertions match exactly (same source).
 - **Permissiveness gaps:** of 312 invalid models we wrote ourselves, the reference rejects 3 that we accept by default, and 300 both reject; 3 further cases agree only when we are asked strictly. We authored every one of these cases ourselves, so the denominator measures the reach of our own corpus and not our conformance; agreement reached only under an opt-in strict mode is weaker evidence than agreement by default ([rejection oracle](docs/project/pilot-rejection.md), `go run -C tools ./cmd/pilot-reject`).
-- **Declared errata:** the registry declares 12 defect(s) in the published reference material — 4 with a specification-derived correction, 8 documented without one, since no intended reading can be inferred ([OMG issues](docs/project/omg-issues.md), `tools/oracle/errata`). Every figure above is as published and stays the conformance statement; running the same oracles over the corrected text instead reports 346 of 384 files agreeing, 42 diagnostics ours alone and 1640 the reference's alone, 0 declared rows we are silent on, and 0 of 312 authored cases the reference alone rejects. The corrected figures are diagnostic only: an erratum never reclassifies a divergence category, and the published corpus is never edited.
+- **Declared errata:** the registry declares 12 defect(s) in the published reference material — 4 with a specification-derived correction, 8 documented without one, since no intended reading can be inferred ([OMG issues](docs/project/omg-issues.md), `tools/oracle/errata`). Every figure above is as published and stays the conformance statement; running the same oracles over the corrected text instead reports 346 of 385 files agreeing, 42 diagnostics ours alone and 1653 the reference's alone, 0 declared rows we are silent on, and 0 of 312 authored cases the reference alone rejects. The corrected figures are diagnostic only: an erratum never reclassifies a divergence category, and the published corpus is never edited.
 - **Self-assessed surface:** the action, state-machine and classifier-behavior rows have no external referee at all — the four refereed figures above cannot see them, because the pinned artifact evaluates expressions but executes neither actions nor state machines. [Spec compliance](docs/project/spec-compliance.md) counts them.
 
 What these numbers cannot show: the OMG corpora are demonstrations rather than an official conformance suite; the differential is one-directional, comparing the diagnostics the two implementations report on the same files; the Xpect suites are the pilot authors' test intent rather than a certification oracle; and none of these is a percentage of the specification — no global compliance figure is claimed anywhere.
@@ -352,7 +352,7 @@ What these numbers cannot show: the OMG corpora are demonstrations rather than a
 **Test coverage:** top-level `Test` functions (counted from the `_test.go` files, as `go test ./...` runs them) covering parsers, semantics, runtime (actions, states, instances, operators, validation), behind golden ASTs, negatives, execution conformance cases, golden traces, runtime robustness cases and gRPC conformance and robustness cases. The figures are counted from the tree when the documentation site is built into the test inventory of [spec compliance](docs/project/spec-compliance.md), never committed, so a branch adding a test does not rewrite this page. A test skips only for want of something the run did not provide, and says what: the held-image round trip declines a conformance case that creates no instance, a few gate on a PDF or Mermaid toolchain, a pinned pilot artifact, the PSSM suite, a locale, a case-insensitive filesystem or a live Flexo stack, and the OMG corpus gates skip until the corpora are downloaded unless asked to fail.
 **Parser coverage:** 105/105 bundled library files parse cleanly — the 94 official SysML v2 standard library files and the non-normative `OpenSysML Libraries/OpenSysMLMathFunctions.kerml`, `OpenSysML Libraries/DocumentQueries.sysml`, `OpenSysML Libraries/IdentityMetadata.sysml`, `OpenSysML Libraries/DiagramLayout.sysml`, `OpenSysML Libraries/OOSEM.sysml`, `OpenSysML Libraries/MOSA.sysml`, `OpenSysML Libraries/StateSpaceIntegration.sysml`, `OpenSysML Libraries/Stochastic.sysml`, `OpenSysML Libraries/RandomFunctions.kerml`, `OpenSysML Libraries/Simulation.sysml` and `OpenSysML Libraries/MigrationMetadata.sysml` extensions. Conformance verified by [stdlib_conformance_test.go](internal/workspace/libs/stdlib_conformance_test.go). Grammar reference: [OMG Xtext grammar](https://github.com/Systems-Modeling/SysML-v2-Pilot-Implementation/tree/master/org.omg.kerml.xtext/src/org/omg/kerml/xtext).
 **Behavioral execution:** Calc/constraint/requirement/satisfy functional. Action/state executors handle nested invocation, control flow keywords, loop and conditional statements and the send statement (<!-- doc-counts:begin conformance-passing -->every conformance case passing<!-- doc-counts:end conformance-passing -->). Coverage is self-assessed against the specification text and the normative library: the pinned OMG pilot implementation evaluates expressions but does not execute actions or state machines headlessly, so no external implementation currently adjudicates these rows. See [spec compliance](docs/project/spec-compliance.md).
-**Reference differential:** 384 files compared diagnostic-by-diagnostic against the pinned OMG pilot implementation (`2026-08`), 345 in full agreement; every divergence is enumerated and adjudicated in [the differential](docs/project/pilot-differential.md), reproducible with `go run -C tools ./cmd/pilot-diff`.
+**Reference differential:** 385 files compared diagnostic-by-diagnostic against the pinned OMG pilot implementation (`2026-08`), 345 in full agreement; every divergence is enumerated and adjudicated in [the differential](docs/project/pilot-differential.md), reproducible with `go run -C tools ./cmd/pilot-diff`.
 **Rejection oracle:** the reverse direction — do we reject what the reference rejects? 312 hand-written invalid models validated by both implementations, 303 rejected by both, 0 the pinned pilot rejects and we accept; the remainder only we reject — the control-node succession rules the pinned pilot leaves unimplemented and a non-Boolean succession guard it accepts once the standard library types it — and every permissiveness gap is enumerated with a reproducer and likely root cause in [the rejection oracle](docs/project/pilot-rejection.md), reproducible with `go run -C tools ./cmd/pilot-reject`. We wrote every case, so the count measures our coverage of the rejection surface, not our conformance — a sample, not a proof.
 **Training examples:** 100/100 files report no semantic errors, gated by `tests/corpus/testdata/training_examples_expected.txt`; the gate does not count execution-scope warnings. Download with `./scripts/download-training-examples.sh` (from the [OMG training directory](https://github.com/Systems-Modeling/SysML-v2-Pilot-Implementation/tree/master/sysml/src/training)). See [training examples](docs/project/training-examples.md) for analysis.
 **Semantic layer:** a complete implementation of runtime operators, feature chains and validation rules. See [examples/semantic-layer/](examples/semantic-layer/) for a full demonstration.

changes/unreleased/gridview-relationship-matrix.added.md

@@ -0,0 +1 @@
+- **Render filtered `GridView`s as relationship matrices.** Matrix views show satisfy, verify, allocation, connection, derivation, refinement and dependency relationships in text, Markdown, CSV and TSV, including unnamed exposed members; Mermaid, DOT, PlantUML and D2 are refused as graph-only forms. Ordinary tables and other renderings keep their existing output.

cmd/sysml/render_test.go

@@ -93,6 +93,67 @@ func TestRenderOfATabularView(t *testing.T) {
 	}
 }
 
+const matrixModel = `package Example {
+    private import StandardViewDefinitions::*;
+    requirement def Requirement;
+    requirement r : Requirement;
+    part def Vehicle;
+    part vehicle : Vehicle {
+        satisfy r;
+    }
+    view def RelationshipMatrixView :> GridView {
+        filter @SysML::SatisfyRequirementUsage;
+    }
+    view relationshipMatrix : RelationshipMatrixView {
+        expose vehicle::**;
+    }
+}
+`
+
+func TestRenderOfAGridViewRelationshipMatrix(t *testing.T) {
+	binary := buildCLI(t)
+
+	for _, tc := range []struct {
+		form string
+		want string
+	}{
+		{"text", "Example::relationshipMatrix - matrix rendering"},
+		{"markdown", "| Source / Target | Example::r |"},
+		{"csv", "Source / Target,Example::r\nExample::vehicle,satisfy\n"},
+		{"tsv", "Source / Target\tExample::r\nExample::vehicle\tsatisfy\n"},
+	} {
+		t.Run(tc.form, func(t *testing.T) {
+			got := runStreams(t, binary, matrixModel, "-render", "Example::relationshipMatrix", "-render-form", tc.form)
+			if got.status != exitHolds {
+				t.Fatalf("exit status = %d, want %d\n%s", got.status, exitHolds, got.output())
+			}
+			if !strings.Contains(got.stdout, tc.want) {
+				t.Errorf("stdout is missing %q:\n%s", tc.want, got.stdout)
+			}
+		})
+	}
+
+	for _, form := range []string{"mermaid", "dot", "plantuml", "d2"} {
+		got := runStreams(t, binary, matrixModel, "-render", "Example::relationshipMatrix", "-render-form", form)
+		if got.status != exitUnevaluable || !strings.Contains(got.stderr, "matrix rendering is not written as "+form) {
+			t.Errorf("matrix as %s = %d\n%s", form, got.status, got.output())
+		}
+	}
+
+	dir := filepath.Join(t.TempDir(), "matrix")
+	all := runStreams(t, binary, matrixModel, "-render-all", dir)
+	if all.status != exitHolds {
+		t.Fatalf("-render-all exit status = %d, want %d\n%s", all.status, exitHolds, all.output())
+	}
+	written, err := os.ReadFile(filepath.Join(dir, "Example.relationshipMatrix.md")) // #nosec G304 -- the test wrote this path.
+	if err != nil {
+		t.Fatalf("read -render-all matrix: %v", err)
+	}
+	if !strings.Contains(string(written), "| Source / Target | Example::r |") {
+		t.Errorf("-render-all matrix is missing its table:\n%s", written)
+	}
+}
+
 // A table is written as CSV or TSV when asked, on stdout or into a file, and a
 // graph-shaped view is refused either form.
 func TestRenderOfATableAsDelimitedValues(t *testing.T) {
@@ -548,6 +609,8 @@ func TestDefaultRenderFormFollowsTheDestination(t *testing.T) {
 		{"a table at a terminal", view.KindTable, "", true, view.FormText},
 		{"a table into a pipe", view.KindTable, "", false, view.FormMarkdown},
 		{"a table into a file", view.KindTable, "table.md", true, view.FormMarkdown},
+		{"a matrix into a pipe", view.KindMatrix, "", false, view.FormMarkdown},
+		{"a matrix into a file", view.KindMatrix, "matrix.md", true, view.FormMarkdown},
 		{"a tree at a terminal", view.KindTree, "", true, view.FormText},
 		{"a tree into a pipe", view.KindTree, "", false, view.FormMermaid},
 	}