diff --git a/docs/document-axes/README.md b/docs/document-axes/README.md
index f6465b643d..3c1b45473b 100644
--- a/docs/document-axes/README.md
+++ b/docs/document-axes/README.md
@@ -8,13 +8,13 @@ place, with `type`/`kind` dereferenced only inside a kind registry, a creation f
 
 - **Concepts — what the axes are, read out of current CLUE behavior:** [axes.md](./axes.md)
 - **Target — how the axes live in code (layers and boundaries):** [target-architecture.md](./target-architecture.md)
+- **Current state — what a consumer can read off a document today:** [reading-axes-in-code.md](./reading-axes-in-code.md)
 - **Research background (current-state evidence):** the findings doc, on the `document-type-decomposition`
   branch (~49KB; left there rather than imported).
 
 ### Related existing docs this roadmap evolves toward
 
 - [../document-types.md](../document-types.md) — the current `type` catalog these axes decompose.
-- [../document-scope.md](../document-scope.md) — the current scoping model the `scope` axis formalizes.
 - [../group-docs/README.md](../group-docs/README.md) — the group-document feature; its concurrency behavior is
   the first thing rebased onto the `concurrent` axis.
 
@@ -26,15 +26,16 @@ flips the rows it delivers **in the same PR**, and names the stage/ticket under
 
 | Axis / component | Mechanism (target) | Status | Delivered by |
 |---|---|---|---|
-| `canonical` (single pointed-to doc for a scope slot) | scoped pointer slots, rule-enforced | done | CLUE-524; class+unit pointer scope added CLUE-550 Stage 2 |
+| `canonical` (single pointed-to doc for a slot) | pointer slots addressed as container + owner + label, rule-enforced | done | CLUE-524; class+unit slots added CLUE-550 Stage 2; CLUE-610 gave every slot an explicit owner segment, taken from the document's `uid` |
 | `concurrent` (multi-writer vs single-writer) | stored per-doc; rule-readable; `DocumentModel` prop sourced from Firestore at open | done | CLUE-550 Stage 1 |
-| `kind` (preset/cohort tag: defaults, presentation, templates) | stored per-doc tag; dereferenced only in the kind registry | in progress | CLUE-550 Stage 1 (stored + registry seeded; presentation wiring lands Stage 3); class-wide slot kinds registered and their titles resolved by kind (`getDocumentTitle`) CLUE-550 Stage 2 |
-| `owner` (authoring identity / provenance) | creation: kind-declared `ownerType` → owner `uid` (in the kind registry); read: getter over stored `uid` | in progress | CLUE-550 Stage 2 (creation-side owner derivation registry-declared for all kinds via `getDocumentOwner`; read-side getter still to come) |
-| `scope` (org + curriculum association refs) | creation: `getDocumentScopeFields(kind, ctx)` stamps a kind's association fields, keyed on a registered `scopeType`; read: consumers read the individual scope fields, narrowing with field/axis **guards** (e.g. `hasOfferingScope`) rather than branching on `type` — whether to also add a single unified `scope` getter is an open question | in progress | CLUE-550 Stage 2 (creation-side scope fields registry-derived for every kind — the `createFirestoreMetadataDocument` type switch is gone) |
-| `permissions` (composed grant set) | permission-policy grants (referenced policy) + stored per-doc grants | not started | — |
+| `kind` (preset/cohort tag: defaults, presentation, templates) | stored per-doc tag; dereferenced only in the kind registry | done | CLUE-550 Stage 1 (stored + registry seeded); titles resolved by kind Stage 2; presentation wired by CLUE-610 (workspace title bar reads the registry; no consumer branches on kind); CLUE-610 also scopes a unit-declared kind's definition to its unit — see "Static and dynamic kinds" in [axes.md](./axes.md) |
+| `owner` (who the document belongs to) | creation: kind-declared `ownerType` → owner `uid` (`getDocumentOwner`) plus a group owner's stored `groupId` (`getDocumentOwnerFields`); read: `hasGroupOwner(doc)` and `hasClassOwner(doc)`, each over the uid prefix its minter used | in progress | CLUE-550 Stage 2 (creation-side owner derivation registry-declared for all kinds); CLUE-610 (both guards; `groupId` moved onto this axis, off the container, and then off the owner *question* — the `uid` is the sole authority). Still to come: the user level, and a getter that returns which owner a document has rather than testing for one |
+| `container` (where the document is kept: class → classUnit → offering) | creation: kind-declared `containerType`, stamped by `getDocumentLocationFields(kind, ctx)`; read: `isInClassUnitContainer(doc)`, over an `offeringId` now surfaced on both metadata types | in progress | CLUE-550 Stage 2 (creation side, every kind); CLUE-610 (`containerType` replaces `scopeType`, with no group level — a group document is kept in the offering and owned by the group; the edit gate switched from a curriculum test to this one). Still to come: a guard for the class level, and a getter returning the container |
+| `curriculum` (what the document is about: none → unit → investigation → problem) | creation: fixed by the kind's `containerType`, since every container above the class is identified by a curriculum coordinate; read: `getCurriculumLabel(doc)` | in progress | CLUE-550 Stage 2 (creation side, every kind); CLUE-610 (the label, and the unit level states its absent fields explicitly so it is queryable). No consumer asks a yes/no curriculum question, so no guard exists |
+| `permissions` (composed grant set) | permission-policy grants (referenced policy) + stored per-doc grants | not started | Consumers are spread widely and each composes the answer by hand; the edit gate `canUserEditDocument` is called out as a worked example, including its `type` branch for published documents. See "Not covered yet" in [reading-axes-in-code.md](./reading-axes-in-code.md) for what a named policy would replace |
 | kind registry (by-kind view) | `register`/`get` map keyed on `kind`; `fn(doc)` API | done | CLUE-550 Stage 1 |
-| behavior modules (by-behavior view) | `fn(doc)` reading axis getters / registry; never branch on `kind` | in progress | CLUE-550 Stage 1 (history + write-sync on concurrent; read-access + rules-delete on group type, interim until the permissions axis) |
-| creation factory (the one `kind → axis` bridge) | reads registry defaults, stamps axis values on a new doc | in progress | CLUE-550 Stage 2 (per-slot class-wide canonical creation; owner `uid` and scope fields stamped from the kind's `ownerType`/`scopeType`) |
+| behavior modules (by-behavior view) | `fn(doc)` reading axis getters / registry; never branch on `kind` | in progress | CLUE-550 Stage 1 (history + write-sync on concurrent; read-access + rules-delete on group type, interim until the permissions axis); CLUE-550 Stage 3a (collaborative thumbnail treatment reads `concurrent`); CLUE-610 (edit gate `canUserEditDocument` and the collaborative title bar read `concurrent`) |
+| creation factory (the one `kind → axis` bridge) | reads registry defaults, stamps axis values on a new doc | in progress | CLUE-550 Stage 2 (per-slot class-wide canonical creation; owner and location fields stamped from the kind's `ownerType`/`containerType`) |
 
 Status values: `not started` / `in progress` / `done`.
 
@@ -44,15 +45,28 @@ CLUE-550 ("class-wide collaborative documents") is the first concrete slice of t
 `concurrent` and `kind` stored axes plus a kind registry, then rebased group-document behavior (concurrent
 history, non-owner write-sync, class-wide read access, the rules delete clause) from `type === "group"` onto
 the stored `concurrent`. Stage 2 auto-creates class-wide documents (e.g. the driving-question board) via the
-canonical-pointer engine: a class+unit pointer scope alongside the existing offering+group scope, with
+canonical-pointer engine: a class+unit slot alongside the existing offering+group one, with
 get-or-create convergence guaranteeing exactly one document per slot per class. Stage 2 also begins the
-`owner` and `scope` axes on the creation side, now for **every** kind: a document's owner `uid` is derived from
-the kind's registered `ownerType` (`user` / `group` / `class`) — class-wide documents owned by a class-scoped
-synthetic uid (`class_<classHash>`) — and its scope association fields from the kind's registered `scopeType`
-via `getDocumentScopeFields(kind, ctx)`, both resolved in the kind registry rather than a `type` switch. Because
-all kinds are registered, `createFirestoreMetadataDocument` derives owner and scope through these registry calls
+`owner`, `container`, and `curriculum` axes on the creation side, now for **every** kind: a document's owner
+`uid` is derived from the kind's registered `ownerType` (`user` / `group` / `class`) — class-wide documents
+owned by a synthetic class uid (`class_<classHash>`) — and the fields saying where it is kept and what it is
+about from the kind's registered container, both resolved in the kind registry rather than a `type` switch.
+Because all kinds are registered, `createFirestoreMetadataDocument` derives all of these through registry calls
 for all document types. The kind axis fields (`kind`/`concurrent`) are stamped only on
 `type:"group"` documents — avoiding a stamp we would have to migrate if the publication kinds are later folded
 into the kinds they publish. That gate widens as each type is converted; see
 [Which documents get stamped](./target-architecture.md#which-documents-get-stamped--a-gate-that-narrows-as-types-are-converted)
 for how it is retired.
+
+CLUE-610 surfaces those documents: Sort Work sections them under "Whole Class" by owner and curriculum
+rather than by type, a whole-unit listener keeps them visible under the investigation and problem
+filters, presentation reads `concurrent` and the kind registry, and one predicate
+(`canUserEditDocument`) gates every Edit button. It also settles how these axes are modeled in code:
+consumers read narrow named guards over the stored fields, with no level enum and no unified struct;
+a kind declares `ownerType` and `containerType`; and `groupId` sits on the owner axis, so there is no
+group container level (see [reading-axes-in-code.md](./reading-axes-in-code.md)). Canonical slots follow:
+each is addressed as its container plus its owner plus a label, with the owner segment read straight from
+the document's `uid` so the pointer path no longer depends on `groupId` at all. Both owner guards read the
+`uid` the same way, which leaves it the single authority on who a document belongs to; the stored
+`groupId` is left carrying only Sort Work's group label and the queries that retire with the
+canonical-pointer migration.
diff --git a/docs/document-axes/axes.md b/docs/document-axes/axes.md
index af9e9f9077..40c3e81586 100644
--- a/docs/document-axes/axes.md
+++ b/docs/document-axes/axes.md
@@ -7,9 +7,9 @@ readable by their teacher, shareable to their group*. Every one of those clauses
 decision, and different types make them differently.
 
 This document names those decisions as **axes**. Instead of asking "what type is this document?", we
-describe a document by **where it sits on each axis** — who owns it, where it is scoped, whether it is
-the canonical doc for its slot, whether it is multi-writer, who may do what to it. The type becomes
-just one of those axes (`kind`), not the thing everything hangs off.
+describe a document by **where it sits on each axis** — who owns it, where it is kept, what content it
+is about, whether it is the canonical doc for its slot, whether it is multi-writer, who may do what to
+it. The type becomes just one of those axes (`kind`), not the thing everything hangs off.
 
 **These axes are "virtual" today.** The current code does not store most of them as fields. But its
 *behavior* already fixes a value for every axis on every document — the four-up share toggle, the
@@ -22,7 +22,7 @@ refactoring tracked in this folder then makes the axes explicit; see
 > evidence (per code site) that backs it lives in the findings doc on the `document-type-decomposition`
 > branch.
 
-## The six axes
+## The seven axes
 
 ### `owner` — authoring identity and provenance
 
@@ -39,43 +39,216 @@ Two tells that `owner` is its own thing:
   frozen copy the publisher can no longer edit, yet it still "belongs to" them for attribution and
   unpublish authority. Owner persists past write access.
 
-### `scope` — where the document is attached
+#### What the owner axis has to support
+
+Stated independently of how the owner is stored, so a change of representation can be checked against
+this list. Most entries are behavior CLUE has to support however it is built. A few instead record a
+constraint the current implementation imposes; those are marked *Note*, and each says what it would
+take to lift it — they bound today's choices without being requirements in their own right.
+
+**Assigning**
+
+1. **Resolve an owner at creation from the kind.** A kind declares whether its documents are owned by
+   the creating user, their group, or the class; creation turns that declaration into a concrete owner.
+
+**Authorizing**
+
+2. **Decide whether the authenticated user is the owner.** The Firestore rules compare a user-owned
+   document's owner against the JWT's `platform_user_id`.
+3. **Distinguish "owned by no user" from "owned by a different user".** A group or class owned
+   document must never satisfy (2) for anybody. In other words the `platform_user_id` check can't match a
+   group or class owned document. Put another way, this is one of the reasons the combination of owner type and owner id
+   needs to be unique within the authentication domain. *A side note*: Because we can't tell directly if a user
+   can edit a group or class owned document, in the Firestore rules concurrent documents need their own
+   check to see if a user can add a history entry.
+4. **Decide whether the current user belongs to the group that owns a document** — the gate on editing
+   a group document. Group ids repeat across offerings, so the same number names a different set of
+   students in each; this check has to be specific to one offering, which means the owner must carry
+   enough to identify the offering. Documents from other offerings do reach this check, because Sort
+   Work's "All" filter lists everything the class has produced.
+
+**Addressing**
+
+5. **Locate a document's content by its owner.** RTDB stores content at
+   `classes/<class>/users/<owner>/documents/<key>`, so an owner must serialize to a single key-safe
+   path segment — RTDB keys exclude `.` `$` `#` `[` `]` `/`. *Note*: this is an implementation detail,
+   so we could decide to change it, but that would require a large migration.
+6. **Address a document's canonical-pointer slot by its owner.** A pointer path carries the owner as a
+   single segment — the document's `uid` verbatim, synthetic owners included:
+   `canonical/v1/classes/<class> / [offerings/<id> | units/<unit>] / owners/<uid> / slots/<label>`. The
+   offering in that path is the document's container, not something read back out of a group owner's
+   id, and no segment names the group. The client and the Firestore rules build the path independently
+   and have to agree on it, and the rules have only the document's stored fields to work from — so an
+   owner has to serialize to one Firestore path segment they can use. *Note*: this is also an
+   implementation detail. It is a new feature (2026-07), so could be revised.
+
+**Attributing and organizing**
+
+7. **Read a document's owner type directly off the document.** This is the requirement that most
+   constrains the representation, so it is worth stating concretely.
+
+   The Sort Work tab can section documents by group or by name. Each view walks the whole list of
+   documents the class has produced and must place *every* one of them. Both branch three ways on the
+   owner type, and each branch resolves something different:
+
+   | owner type | sectioned by group | sectioned by name |
+   |---|---|---|
+   | group | `Group <N>` — the document's group | one entry under **each member** of that group |
+   | class | `Whole Class` — a fixed section | `No Name` — the class is not a person |
+   | user | `Group <N>` — whichever group its owner belongs to *now* — or `No Group` | the owner's `Last, First` |
+
+   Three things follow. The owner type selects *which lookup to perform* — a group registry lookup, a
+   name lookup in the class, or no lookup at all — so it has to be known before any id is resolved. A
+   user-owned document is placed indirectly, by its owner's current group rather than by anything the
+   document itself records, so the owner type also decides whether the document or its owner's present
+   state supplies the answer. And when sectioning by name, a group-owned document is emitted **once per
+   member** while the other two are emitted once — so the owner type changes the shape of the output,
+   not just the label.
+
+   The view iterates documents it did not choose and cannot anticipate, including documents from other
+   units and offerings. It needs the owner type as a value it can read from each document, the same way
+   it reads a title.
+8. **Resolve a group owner to its group's members** — for listing a group document under each student
+   who worked on it. The members come from a group registry maintained for the **current offering**.
+   The "Group N" label is not part of this: sectioning by group takes the number from the document's
+   stored group id, so it resolves nothing and works for a document from any offering.
+9. **Resolve a user owner to their name in the class** — for the "Last, First" section label.
+
+**Locating**
+
+10. **Find a group's document from before canonical pointers existed**, by class, offering, and group.
+    This is the only query anywhere that filters on an owner, and it is transitional — it retires with
+    the canonical-pointer migration.
+
+#### Not required today
+
+**No query filters documents by owner.** Sort Work fetches by class and by curriculum position (unit,
+investigation, problem), then sections what it receives. Neither the owner type nor the owner id is
+ever a query term, apart from the transitional case above.
+
+Worth stating explicitly, because it means the owner representation does **not** have to be queryable
+by type today. If that changes, it becomes the strongest argument for a stored owner type.
+
+#### Limitations
+
+- **A group owner outside the current offering does not resolve.** Requirement 8 resolves only against
+  the current offering, so a group-owned document from an earlier one — visible under Sort Work's "All"
+  filter — does not know its members. Sectioning by name cannot list it under anybody, so it is filed by
+  where the work came from ("Groups from `<problem>`") rather than under this offering's group of the
+  same number, whose students did not write it. Lifting this needs a group registry that spans
+  offerings, not a change to how the owner is stored: the owner already identifies its offering.
+
+  **Sectioning by group is deliberately unaffected.** It needs only the group's number, which it takes
+  from the stored group id without resolving anything, so a document from another offering sections
+  under the same `Group <N>` section that a document from the current offering does. The two sorts
+  differ here because they are claiming different things: a group number is a label that reads the
+  same in every offering, while a student's name asserts *who did this work* — so the sort that cannot
+  answer that truthfully declines to answer it at all. Requirements 8 and 9 carry that asymmetry: only
+  the by-name sections resolve an owner to people. This approach of mixing different groups under the
+  same `Group <N>` section might change in the future.
+
+#### Possible future requirements
+
+- **Query by owner type** — a view that fetches only class-owned documents, or trims payload by owner.
+  This would be needed if the current client-side approach isn't sufficient.
+- **More owner types** — a school, a network, a teacher cohort.
+- **Group-level authorization in the rules.** A group document's history is currently authorized
+  class-wide because the auth token carries no group id. If tokens ever carried one, the rules would
+  have to recover the group from the owner.
+- **Owner transfer.** Because permissions are computed *from* the owner, reassigning it changes who
+  may act; it would need a privileged path rather than an ordinary update.
+
+### `container` — where the document is kept
+
+**What it is.** The place a document belongs to, in a strict nesting: **class → classUnit →
+offering**. A classUnit is one class working through one unit. An offering is one assignment of one
+problem to that class, and every offering falls inside exactly one classUnit. Each document sits at
+exactly one of these, and never moves.
+
+**In today's behavior.** The container is visible in *how long a document stays with you*:
+- A **personal** document or **learning log** is kept by the class. It is available no matter which
+  unit or assignment you are working on, which is why it is used to carry notes between problems.
+- A **class-wide collaborative** document (the driving question board) is kept by the class *and* the
+  unit — one per class per unit. Move to another unit and you get a different one.
+- A **problem** or **planning** document is kept by the assignment. You get a fresh one per
+  assignment, and it does not follow you to a different problem.
+- A **group** document is kept by the assignment too — its group-ness is *whose* it is, not where it
+  is kept.
+
+**Neither the user nor the group is a level here.** It is tempting to continue the nesting downward,
+since students are in groups and groups are in assignments. But a container has to be stable for as
+long as the things in it: group membership changes during an assignment and differs between
+assignments, and a single student's documents are kept at several different levels rather than under
+one place of their own. *Whose* a document is belongs to `owner`.
+
+**The container defines `canonical` slots.** A canonical slot is a container plus an owner plus a
+label — "the group document for this group in this assignment", "the driving question board for this
+class in this unit" (see `canonical`).
+
+**The container names permission principals.** "Readable by the class" means readable by whoever
+shares the document's class. So when a publication opens to the class, the audience is being named by
+where the document is kept. (Group-based audiences work the same way, but the group comes from
+`owner` rather than from the container.)
+
+### `curriculum` — what content the document is about
+
+**What it is.** Where the document sits in the curriculum: **none → unit → investigation →
+problem**. This is what the document is *about*, not where it is kept.
+
+**In today's behavior.** The curriculum position is visible in *when a document is offered to you*:
+- A **personal** document or **learning log** has no curriculum position at all — it is not about any
+  particular content.
+- A **class-wide collaborative** document is about a whole unit.
+- A **problem**, **planning**, or **group** document is about one problem.
+- An **exemplar** is about one problem — it is authored into the curriculum alongside that problem.
+
+It is also what the Sort Work filters match on: choosing an investigation or a problem narrows the
+list to documents about that part of the curriculum.
+
+**Why this is separate from `container`.** For most documents the two line up — kept by the class and
+about none of it, kept by a classUnit and about that unit, kept by an assignment and about that problem.
+Exemplars are the case that comes apart: an exemplar is about a specific problem, but it is not part
+of any assignment. It exists whether or not the class has ever been assigned that problem, so there is
+no assignment to keep it in. A document can be about a problem without being kept in that problem's
+assignment.
+
+A **publication** shows the same independence from the other direction: publishing broadens who can
+see a document without changing what it is about, while its `owner` stays the publisher — `owner`,
+`container`, and `curriculum` moving separately is the signature of publishing.
 
-**What it is.** The document's position in the org hierarchy (network / class / offering / group / user)
-and the curriculum hierarchy (unit / problem / section). A document attaches to whichever of these
-apply; the familiar labels ("this user's doc in this offering") are just names for which associations
-are set.
+### `canonical` — the single doc for a slot
 
-**In today's behavior.** Scope is visible in *where CLUE looks for a document* and *when it applies*:
-- A **problem** or **planning** document is scoped to *one user in one offering* — you get a fresh one
-  per assignment, and it does not follow you to a different problem.
-- A **personal** document or **learning log** is scoped to *the user in the class*, with no offering —
-  which is why it is available across problems and used to carry notes between them.
-- A **group** document is scoped to *the group in the offering* (no single user).
-- A **publication** broadens scope to the whole offering or class while its `owner` stays the
-  publisher — `owner` and `scope` diverging is the signature of publishing.
+**What it is.** *Which* **container** slot this document is the one document for — or none, when the
+document is one of a growing collection instead.
 
-**Scope also defines `canonical` slots.** A canonical slot *is* a scope that at most one document is
-expected to fill — "the problem doc for this user in this offering", "the group doc for this group"
-(see `canonical`).
+**Which slot, not whether.** A container can have several single-document roles at the same time, so the
+axis has to name the one this document fills.
 
-**Scope also feeds `permissions`.** Scope is not purely positional. Its **class** and **group** associations
-double as *permission principals*: "readable by the class" means readable by whoever shares the document's
-class scope, and "readable by the group" means the members of its group scope. So when a publication
-opens to the class, or a group document is read and written by its members, the audience is being named
-*by scope*.
+This is already true of the oldest documents CLUE has. A teacher in one offering has both a problem
+document and a planning document — each the single one of its role, and sharing `owner`, `container`, and
+`curriculum` exactly. The slot is what tells them apart. Nothing enforces either singleton today, so
+nothing has had to name the two roles; the moment something does, a document marked "canonical" is
+ambiguous unless it says which of the two it is.
 
-### `canonical` — the single doc for a slot
+The class-wide documents make the same point with enforcement behind it: within one class and one unit
+there are several canonical documents at once — the driving question board, the word wall — and a yes/no
+value could not say which of them a given document is.
 
-**What it is.** Whether this is *the* one document expected to fill a given **scope** slot, as opposed
-to one of a growing collection.
+**A slot is not a `kind`.** A kind is the recipe a document was made from; a slot is a position in a
+container. They line up today only because each class-wide kind happens to define one slot. Nothing says
+they must: a class could want two documents of the same kind — an opening board and a closing one — which
+is two slots filled from one recipe. The group document already leaves room for this. Its slot is named
+"the default one" rather than "the group kind's", so a second group slot could be added without inventing
+a kind to name it.
 
 **In today's behavior.** Some documents are singletons, some are collections:
 - A user is meant to have **exactly one** problem document per offering (and a teacher one planning
   document) — the primary workspace. It is canonical *by convention*; the database does not enforce it,
   and bugs have produced duplicates, which is precisely the fragility making `canonical` worth naming
   explicitly.
-- A group has **one** group document per offering — canonical, and here backed by a real pointer.
+- A group has **one** group document per offering — canonical, and here enforced rather than assumed.
+- A class has **one** class-wide document per declared kind per unit — several slots in one container,
+  each enforced the same way.
 - **Personal** documents and **learning logs** are the opposite: a user may create as many as they
   like. There is no single canonical one — the slot is a collection.
 - **Publications** are non-canonical and versioned: publishing the same document repeatedly stacks up
@@ -108,12 +281,14 @@ type and to reason about its axes instead — so it is fair to ask why a type-sh
 all. It survives because a few things are genuinely *per-preset* and cannot be read off how a document
 behaves:
 - **Creation** — when a new document is made, something has to choose its starting axis values. "A new
-  problem is owned by its creator, scoped to this offering, canonical, single-writer, teacher-readable"
+  problem is owned by its creator, kept by this assignment, about that problem, canonical,
+  single-writer, teacher-readable"
   is a recipe belonging to a preset; the axes describe the result but cannot supply it.
 - **Presentation** — the label a document is shown under, its title bar, its icons and styling are
   chosen per preset, not consequences of its axis values.
 - **Copy and publish** — what a copy or a publication of a document should look like (which axes change,
-  which carry over) is a per-preset recipe.
+  which carry over, and what kind the result takes) is a per-preset recipe. Worked examples are in
+  [Copies and publications, read as deltas](#copies-and-publications-read-as-deltas).
 - **Permission defaults** — the baseline of who may do what (e.g. "the owner may read and write, the teacher
   may read") is shared by every document of a kind. Rather than copy those rules onto each document, a kind
   points the document at a named **permission policy** (see `permissions`), and several kinds can share one
@@ -137,6 +312,60 @@ needed a separate preset concept — `type` does both jobs at once. The part tha
 defaults, the permission baseline, and copy/publish templates have no separate existence today; `type` and
 the code around it supply them implicitly.
 
+#### Static and dynamic kinds
+
+A preset does not have to be written in code. Kinds come from two sources:
+
+- **Static kinds** are registered by the application itself. They exist for the whole session, everywhere,
+  and are the same for every user.
+- **Dynamic kinds** are declared in configuration that is loaded at runtime — today, a unit's
+  `classWideDocuments`, which registers a kind when that unit loads. This is what lets "add another
+  class-wide document" be an authoring change rather than a code change, and it is the direction the
+  roadmap wants: a preset is data.
+
+Dynamic kinds carry a constraint that static kinds do not, and it is a property of *where the definition
+is loaded from*, not of the kind itself: **a dynamic kind's definition is only present when its
+configuration is loaded.** Only the current unit's config is loaded, so for a unit-declared kind the
+definition is absent for every document from any other unit — while those documents remain visible, because
+Sort Work's unfiltered view spans every unit a class has worked through.
+
+Two rules follow, and both are really the same rule — *a document must remain interpretable without its
+kind's definition*:
+
+1. **Anything a dynamic kind supplies must be stamped at creation or degrade gracefully.** Values the
+   definition contributes to a document's axes are written onto the document, so they survive the
+   definition's absence. Anything not stamped — presentation, above all — must have a fallback derived from
+   stored fields alone. This is the same reason consumers read a document's container and curriculum
+   from its stored associations rather than through the registry.
+2. **A dynamic kind's documents must carry the association that identifies the configuration that defined
+   them.** For unit-declared kinds that association is `unit`. Kind names are not globally unique across
+   configurations — two units may declare the same kind with different wording — so without it there is no
+   way to tell whether a definition found under that name is the one the document was made from, and the
+   wrong definition would be applied confidently.
+
+   `getKindDefinitionFor(doc)` is where this rule lives in code: it is the one way to read a kind definition
+   off an existing document, and it compares the two associations before returning anything. Creation looks
+   kinds up by name instead (`getDocumentKindInfo`), which is sound because a document being created takes
+   its kind from the configuration in hand. Keeping every read behind one function is what makes rule 1's
+   fallback obligation checkable — a consumer either handles the undefined case or does not compile.
+
+**This bounds which documents a dynamic kind can create.** A unit-declared kind can only produce
+documents about that unit or narrower, because rule 2 requires the `unit` association and the
+curriculum axis is a nesting rooted at the unit — every position at or below it carries one. It cannot
+produce documents with no curriculum position at all, like personal documents and learning logs.
+Making *those* presets authorable is a reasonable future goal, but it is not just a matter of adding
+entries to a unit config: it needs a configuration source loaded independently of the current unit
+(class- or site-level), so that a definition is present wherever its documents are, along with an
+association on the document naming that source. Until such a source exists, personal-like presets stay
+static.
+
+**How a kind sets that today.** A kind declares only `containerType`, and `getDocumentLocationFields`
+derives both the container and curriculum axes' fields from it, so a document's curriculum position
+currently follows from its container: `class` yields no unit, `classUnit` the unit, `offering` the
+problem. The bound is stated on `curriculum` because that is what rule 2 constrains, and it survives
+the coupling being broken — a kind declaring a class container *and* a unit curriculum would stamp
+`unit` and satisfy rule 2, which a container-based bound would wrongly forbid.
+
 ### `permissions` — who may do what
 
 **What it is.** The permission set: who may `read`, `write`, `publish`, `copy`, and whether the content
@@ -154,9 +383,9 @@ features:
 - A **multi-class support** grants read to a structured target audience across classes.
 - An **exemplar** grants read per student.
 
-Several of those audiences are named *by `scope`*: "the class can read" and "group members can
-read/write" resolve through the document's class and group associations. `permissions` supplies the *verbs*
-(read / write / publish / copy) and the per-document toggles; `scope` supplies *which* class or group
+Several of those audiences are named elsewhere: "the class can read" resolves through the document's
+`container`, and "group members can read/write" through its `owner`. `permissions` supplies the *verbs*
+(read / write / publish / copy) and the per-document toggles; the other axes supply *which* class or group
 those grants point at.
 
 Because `permissions` blends kind-defaults with a few stored per-document grants, it is the axis that
@@ -177,25 +406,62 @@ policy. (This is a structure *within* `permissions`, not a separate axis.)
 This table is a **snapshot of how each current type sits on the axes** — useful for seeing that the
 axes are already present, but *not* the definition. The point of this doc is the axes; the types are
 just where today's behavior happens to have placed things. `permissions` is collapsed to a short label
-because its real value (a composed grant set) does not fit a cell.
-
-| kind (`type`) | owner | scope | canonical | concurrent | permissions (shorthand) |
-|---|---|---|---|---|---|
-| `problem` | student/teacher | user-in-offering | yes (by convention) | no | owner + teacher read; group-read when shared |
-| `planning` | teacher | user-in-offering | yes (by convention) | no | owner + teacher read |
-| `personal` | student/teacher | user-in-class | no (collection) | no | owner + teacher read; class-read when public |
-| `learningLog` | student/teacher | user-in-class | no (collection) | no | owner + teacher read; class-read when public |
-| `group` | none (group user) | group-in-offering | yes (pointer) | **yes** | all group members read/write |
-| `problem` publication | publisher (retained) | offering | no, versioned | no | class read; frozen |
-| `personal`/`learningLog` publication | publisher (retained) | class | no, versioned | no | class read; frozen |
-| `support` (multi-class) | teacher (retained) | multi-class / offering | no | no | target audience read; frozen |
-| `exemplar` | synthetic author | class-less, curriculum-rooted | no | no | per-student read |
+because its real value (a composed grant set) does not fit a cell. The `canonical` column names *which*
+slot a document fills rather than answering yes/no, since a container can have more than one.
+
+| kind (`type`) | owner | container | curriculum | canonical (which slot) | concurrent | permissions (shorthand) |
+|---|---|---|---|---|---|---|
+| `problem` | student/teacher | offering | problem | the user's one problem doc (by convention) | no | owner + teacher read; group-read when shared |
+| `planning` | teacher | offering | problem | the user's one planning doc (by convention) | no | owner + teacher read |
+| `personal` | student/teacher | class | none | none — a collection | no | owner + teacher read; class-read when public |
+| `learningLog` | student/teacher | class | none | none — a collection | no | owner + teacher read; class-read when public |
+| `group` | the group | offering | problem | the group's one doc (enforced) | **yes** | all group members read/write |
+| class-wide collaborative | the class | classUnit | unit | the class's one doc per declared kind (enforced) | **yes** | all class members read/write |
+| `problem` publication | publisher (retained) | offering | problem | none — versioned | no | class read; frozen |
+| `personal`/`learningLog` publication | publisher (retained) | class | none | none — versioned | no | class read; frozen |
+| copy of a `problem` doc → `personal` | **the copier** | class | none | none — a collection | no | owner + teacher read; class-read when public |
+| copy of a `personal`/`learningLog` doc → same kind | **the copier** | class | none | none — a collection | no | owner + teacher read; class-read when public |
+| `support` (multi-class) | teacher (retained) | multi-class / offering | problem | none | no | target audience read; frozen |
+| `exemplar` | synthetic author | none until commented on | problem | none | no | per-student read |
 
 Reading the table the new way: a "group document" is not a special *kind of thing* — it is simply the
-document that happens to be *ownerless, group-scoped, canonical, concurrent, and group-read/write*. Any
-other document that took those same axis values would behave the same way. That is the shift this
+document that happens to be *group-owned, kept by an assignment, about that problem, canonical,
+concurrent, and group-read/write*. Any other document that took those same axis values would behave
+the same way. The class-wide collaborative document is the demonstration: it differs from a group
+document on `owner`, `container`, and `curriculum` alone, and behaves accordingly. That is the shift this
 folder is built around.
 
+### Copies and publications, read as deltas
+
+The two publication rows and the two copy rows are not new shapes; they are what the publish and copy
+templates (see `kind`) produce when applied to a row above them. Reading them against their source is what
+a template *is*:
+
+- **Publishing a `problem` document** moves `canonical` (a publication fills no slot, and versions stack up)
+  and `permissions` (owner + teacher read → class read, frozen) and holds `owner`, `container`, and
+  `curriculum` still. Holding those three is the substance of publishing: it changes who may see the
+  document, not whose it is or what it is about. Publishing a `personal` document or a learning log is the
+  same delta applied to a different row.
+- **Copying a `problem` document** moves exactly the three axes publishing holds still: `owner` becomes the
+  copier, `container` drops from the offering to the class, `curriculum` drops from the problem to none. It
+  is also not the assignment's primary workspace, so it gives up the one slot its source held — held by
+  convention rather than by enforcement, but held. The result
+  lands on the `personal` row exactly, and `kind` follows: the copy *is* a personal document, presented and
+  listed as one, so the template names that kind rather than carrying the source's over.
+- **Copying a `personal` document or a learning log** moves `owner` alone, and only when the source was
+  someone else's — which is why its row and its source row are otherwise identical.
+
+So a template sets `kind` along with the axes; it is neither carried over automatically nor derivable from
+the axes the template produced. What `kind` a *publication* takes is not settled — see "Open questions" in
+[target-architecture.md](./target-architecture.md).
+
+Two more things follow. The copy template is not one recipe per kind so much as one destination — "a
+document of the copier's own, about nothing in particular" — which is why copying a problem document and
+copying a personal document converge. And the copy of a problem document is the case that argues for
+templates being per-kind at all: no rule over the axes alone says a copy should stop being about the problem
+it came from. That is a decision about what copying is *for*, which is exactly the sort of thing a preset
+holds.
+
 ## Relationship to the other docs here
 
 - [target-architecture.md](./target-architecture.md) — how the axes will live in code: getters on
diff --git a/docs/document-axes/reading-axes-in-code.md b/docs/document-axes/reading-axes-in-code.md
new file mode 100644
index 0000000000..83d03d82ea
--- /dev/null
+++ b/docs/document-axes/reading-axes-in-code.md
@@ -0,0 +1,150 @@
+# Reading the axes in code, today
+
+> **Purpose:** what a consumer can actually read off a document right now, and how. [axes.md](./axes.md)
+> defines the axes in terms of behavior and deliberately avoids naming code;
+> [target-architecture.md](./target-architecture.md) describes where the code is heading. This doc is the
+> current state in between — the helpers that exist, the stored fields behind them, and what is not
+> covered yet.
+
+## The guards
+
+Consumers that need a document's position on an axis read its stored fields through the guards in
+`src/models/document/document-axes.ts`, rather than branching on the document `type`:
+
+- `hasGroupOwner(doc)` — an **owner** question: the document belongs to a single group.
+- `hasClassOwner(doc)` — an **owner** question: the document belongs to the class as a whole, with no
+  personal author.
+- `isInClassUnitContainer(doc)` — a **container** question: the document is kept in the class's copy of
+  one unit, rather than in a single offering of one problem.
+
+Each guard answers about one axis and reads only that axis's fields. A consumer needing a position on
+more than one asks each. That is what keeps each guard's meaning independent of what the other axes
+hold: `hasGroupOwner` does not care which problem a document is about, and `isInClassUnitContainer`
+does not care who owns it.
+
+Asking the *right* axis matters as much as reading the right fields. Sort Work sections a class-wide
+document under the class because of who owns it, so it asks `hasClassOwner`. The Edit button lets a
+classmate into a class-wide document because of where it is kept, so it asks
+`isInClassUnitContainer`.
+
+A guard reads *stored fields only*. It must not consult the kind registry: Sort Work lists documents
+from other units, whose kinds are not registered in the current session.
+
+The module also provides `getCurriculumLabel(doc)`, which names a document's curriculum position —
+`"sas-1.2"` for a problem, `"sas"` for a unit. Titles use it as a stand-in when a document's real
+title cannot be resolved. Nothing currently asks a yes/no question about the curriculum axis, so no
+guard for it exists.
+
+## How a kind declares its axes
+
+Those fields are stamped at creation from what the kind registered in
+`src/models/document/document-kinds.ts`. A kind declares two things:
+
+- `ownerType` — `"user"`, `"group"`, or `"class"`. It picks the owner `uid` (`getDocumentOwner`) and,
+  for a group owner, the `groupId` stored beside it (`getDocumentOwnerFields`).
+- `containerType` — `"class"`, `"classUnit"`, or `"offering"`. It picks the fields that say where the
+  document is kept and what it is about (`getDocumentLocationFields`).
+
+One knob covers both container and curriculum because every container above the class is *identified
+by* a curriculum coordinate — a classUnit by its unit, an offering by its problem — so a kind has no
+curriculum position left to choose separately. `getDocumentLocationFields` is named for the pair rather
+than for the container alone, because the fields it returns span both axes.
+
+There is no container level for a group. A group document is kept in the offering, alongside the
+problem documents its members write; what makes it the group's is its owner. Its `groupId` therefore
+follows `ownerType: "group"`, and is a denormalization of an owner uid that already encodes it
+(`group_<offeringId>_<groupId>`).
+
+Both owner guards read the `uid`, testing the prefix its minter used — `kGroupOwnerPrefix`,
+`kClassOwnerPrefix`, each shared by the function that mints the uid and the guard that reads it back.
+Testing a prefix is not the same as taking a uid apart: nothing recovers an `offeringId` or a `groupId`
+out of one, which is lossy and is why `getGroupByOwnerId` builds the whole owner id and compares instead.
+
+That leaves the `uid` as the single authority on who a document belongs to — it is also what the
+canonical slot is addressed by and what the Firestore rules read — so what remains of the stored
+`groupId` is worth knowing, because it has been shrinking. It no longer answers *whether* a document is
+group-owned, and it no longer resolves a group document to its members. What remains is Sort Work's group
+labels, the transitional group-document title, and the two queries that retire with the canonical-pointer
+migration — a Firestore query needs a stored field, which a uid grammar cannot provide.
+
+## What each stored shape looks like
+
+| document | `uid` | `unit` | `investigation` | `offeringId` | `groupId` | `canonical` | container | curriculum | owner |
+|---|---|---|---|---|---|---|---|---|---|
+| personal, learning log | the user | `null` | — | — | — | — | class | none | user |
+| problem, planning, publications | the user | set | set | set | — | — | offering | problem | user |
+| group | `group_<offeringId>_<groupId>` | set | set | set | set | `"default"` | offering | problem | **group** |
+| exemplar (from curriculum) | authoring persona | set | set | — | — | — | classUnit | problem | synthetic user |
+| class-wide slot | `class_<classHash>` | set | `null` | — | — | **the kind** | classUnit | **unit** | class |
+
+The owner column is read off the `uid` alone. `groupId` is set on exactly the row whose `uid` already
+encodes it, which is what makes it a denormalization rather than a second source.
+
+`canonical` holds a **slot label**, not a flag: the final segment of the pointer path the document won
+(`…/owners/<uid>/slots/<label>`). The two rows that carry one show why it cannot be a boolean — a class-wide
+document is labeled with its kind precisely so that several of them can be canonical at once inside the same
+classUnit container, under the same class owner, one per declared kind. A problem document is canonical *by
+convention* only: no pointer is claimed for it, so the field stays unset.
+
+Nothing in the client reads it. The path is always built from what the caller already knows — the container,
+the owner, and the label it is asking for — and the *pointer* is what names the document, so the code only
+ever travels slot → document. The label is stored for the direction nothing travels yet, and for the
+Firestore rules: they rebuild the pointer path from the incoming label to verify a claim (which is why no
+label is hardcoded in the rules), and they read the stored label back to refuse deleting a document that
+holds a slot.
+
+The `null`s are load-bearing. A class-wide document writes `investigation: null` and `problem: null`
+explicitly rather than omitting them, because Firestore cannot match a field that is missing — that is
+what makes "about a unit but not a problem" a queryable condition.
+
+## Not covered yet
+
+- **No guard reads the user level of owner.** A user-owned document is simply one whose `uid` is
+  neither synthetic prefix, and no guard says so; consumers compare `uid` to a user id directly.
+  There is also no getter that returns *which* owner a document has — only the two "is it this one"
+  guards.
+- **`hasClassOwner` reads the uid's grammar.** The class owner has no field of its own, so the guard
+  matches the `class_` prefix that `DB.userIdForClassWideDocuments` mints. The two share
+  `kClassOwnerPrefix`, which is what keeps them from drifting, but the grammar is still a convention
+  rather than something stored. The same is true of the group owner uid.
+- **Only one container level has a guard.** `isInClassUnitContainer` distinguishes classUnit from
+  offering; nothing names the class level, and no getter returns a document's container. Canonical
+  pointer paths are assembled from the individual fields on both sides (`getCanonicalPointerPath` and
+  the rules' `canonicalPointerPath`) rather than from a container value.
+- **The `permissions` axis has no representation, so its consumers compose it by hand.** Permission
+  decisions are spread widely through the code — [axes.md](./axes.md) lists the four-up share toggle,
+  publications, group documents, multi-class supports, and exemplars — and each site works out its own
+  answer from whatever fields are nearest. The edit gate `canUserEditDocument` in
+  `src/models/document/document-utils.ts` is worth calling out as a **worked example**, not because it
+  came first but because it composes the whole question in a few readable lines: a `type` test for
+  published documents, an owner comparison, `concurrent`, then a reach test over the owner and the
+  container. In the target design a document instead references a named **permission policy** and a gate
+  like this collapses into resolving that policy. Two things follow, worth stating where the example is:
+  - **Its `type` test is the last type branch left inside that gate.** "A published document is frozen"
+    is a permission statement, and a policy is what should carry it. Its neighbor
+    `isDocumentAccessibleToUser` still branches on `type` for the same reason — read access is also a
+    permissions question — which is the clearest sign that these branches are waiting on the axis rather
+    than on any one consumer being cleaned up.
+  - **Its `concurrent` test likely goes the same way.** A policy that grants write to a class or a group
+    states the multi-writer case directly, so "is this document concurrent" stops being a separate
+    question a gate has to ask first. The container and owner tests that follow are then not permission
+    logic at all, but the resolution of *which* class or group the policy's grant points at — which the
+    guards above already answer.
+
+## Titling a document from another unit
+
+Under Sort Work's "All" filter a class sees every document it owns, including documents from units it
+has already worked through — the class hash spans units. Two title-resolution problems follow, and both
+are handled by treating a unit-declared title as belonging to its unit:
+
+- A kind declared by a unit that is not loaded has no registered title, and a class-wide document
+  stores no title of its own. `getDocumentDisplayTitle` names it from `getDocumentKindLabel(kind)` plus
+  the curriculum label — `"Driving Question Board (other)"`.
+- Two units may declare the *same* kind with different wording. `IDocumentKindInfo.unit` records which
+  unit's config declared a title, and `getDocumentTitle` returns it only for that unit's documents, so
+  a foreign document falls through to the label above rather than borrowing wording that may not be its
+  own.
+
+The kind label recovers the kind's identity, not the author's wording: a slot titled "Our Big Questions"
+in its own unit reads as "Driving Question Board" from elsewhere. Nothing loads another unit's config,
+so its authored title is not available.
diff --git a/docs/document-axes/target-architecture.md b/docs/document-axes/target-architecture.md
index bbab6c61a1..6639e36e2f 100644
--- a/docs/document-axes/target-architecture.md
+++ b/docs/document-axes/target-architecture.md
@@ -55,7 +55,7 @@ view, and it is legitimate to put here because these are *data the document has*
 | `owner` | existing `uid` (identity/provenance; may differ from scope for publications) |
 | `scope` | the individual association fields `context` / `offeringId` / `groupId` / `problem` / `unit` (the org + curriculum associations). Consumed via field/axis **guards** (see "Typed document shapes"), not by branching on `type`; whether to also expose a single unified `scope` getter is an open question — the fields may be read directly |
 | `kind` | existing `type` (a stored tag — see Layer 2 for its uses) |
-| `canonical` | new stored field (pointer-slot occupancy) |
+| `canonical` | new stored field holding the label of the pointer slot this document fills — not a flag; several documents can be canonical in one container, one per label |
 | `permissions` | **composed getter** — merges *permission-policy grants* (from the document's referenced policy) with *stored per-doc grants* (the `visibility` share toggle, support audience, exemplar visibility). See "Permissions composition" below |
 | `concurrent` | new stored field (multi-writer; marks special stored state, rule-readable) |
 
@@ -327,6 +327,14 @@ deferred under Non-goals (the `scope`/`permissions`/`canonical` schemas). This s
 - Whether `DocumentModel` should be split further into a generic wrapper + a CLUE metadata mixin, or left as
   one model with the getters (leaning: leave as one; the getters-vs-behaviors boundary already delivers the
   clarity, and a further split risks churn for little gain).
+- What `kind` a publish template targets: its source's kind, or a publication kind of its own. Copying settles
+  the same question by naming a kind outright (axes.md, "Copies and publications, read as deltas"), but
+  publishing holds `owner`, `container`, and `curriculum` still and moves only `canonical` and `permissions`
+  — all stated on the axes — so a second kind buys nothing unless some per-kind fact about a publication is
+  not determined by its axes. Today's four publication types are not evidence either way; that is `type`
+  doing every job at once. (Leaning: keep the source's kind. The cost is that a nav-tab section selects
+  documents by a list of type names, so the authored `navTabs` configs — in this repo and in
+  `clue-curriculum` — would have to select on axes instead.)
 
 ## References
 
diff --git a/docs/document-metadata/metadata-fields.md b/docs/document-metadata/metadata-fields.md
index 838cd76202..546b2a6ab6 100644
--- a/docs/document-metadata/metadata-fields.md
+++ b/docs/document-metadata/metadata-fields.md
@@ -188,8 +188,11 @@ questions and are written by different code.
 - **Reactive:** No
 
 Claims a canonical label for a group document so concurrent creators converge on one document. The rules
-forbid setting it on create and permit a single one-time set on update. Not present in
-`IDocumentMetadata` or `DocumentMetadataModel` — it has no type coverage at all.
+forbid setting it on create and permit a single one-time set on update, and only when the pointer for
+this document's own slot already names it. That slot is a container plus an owner plus a label, and the
+rules locate it by building the path from the document's own fields — including its `uid` as the owner —
+so a document cannot claim a slot belonging to a different owner. Not present in `IDocumentMetadata` or
+`DocumentMetadataModel` — it has no type coverage at all.
 
 ### `offeringId`
 
@@ -197,13 +200,14 @@ forbid setting it on create and permit a single one-time set on update. Not pres
 - **Location:** Firestore `documents/{key}.offeringId`; RTDB
   `/{classPath}/users/{uid}/documentMetadata/{key}/offeringId`
 - **Applies to:** the problem family — problem, planning, publication, supportPublication, group
-- **Runtime:** not surfaced on any document model
+- **Runtime:** `DocumentModel.offeringId`, `DocumentMetadataModel.offeringId`
 - **Updated by:** nothing — creation only
-- **Reactive:** No
+- **Reactive:** No — immutable
 
-Listed here rather than under dual-stored because it is not in `IDocumentMetadata` and has no runtime
-representation; it exists to scope documents to an offering. It reaches Firestore only because
-`createFirestoreMetadataDocument` spreads the RTDB metadata object.
+Names the offering a document is kept in, and is the only positive marker of that container: an
+exemplar carries the same unit/investigation/problem as a problem document and is distinguished from
+it by nothing else. `canUserEditDocument` therefore depends on it — without it a group document reads
+as class-wide, and the class check would let any classmate edit another group's work.
 
 ---
 
@@ -316,18 +320,21 @@ declare it. Anything reading properties from the Firestore metadata should treat
   `undefined`)
 - **Applies to:** group documents — the group that **owns** the document
 - **Runtime:** `DocumentModel.groupId`, `DocumentMetadataModel.groupId`
-- **Updated by:** nothing — creation only, stamped from the kind's registered `scopeType` by
-  `getDocumentScopeFields` ([document-kinds.ts](../../src/models/document/document-kinds.ts))
+- **Updated by:** nothing — creation only, stamped from the kind's `ownerType` by
+  `getDocumentOwnerFields`
 - **Reactive:** No — immutable
 
 The group that **owns** the document, and nothing else — not the group its owning user happens to be in,
 which is `groupIdOfUserOwner` below. It is a denormalization of the owner: the owner `uid` already encodes it
 (`group_<offeringId>_<groupId>`), so this field spares consumers from taking that apart when they need the
-group's number.
+group's number. It is not what makes a document group-owned — `hasGroupOwner`
+(`src/models/document/document-axes.ts`) reads the uid's prefix, so the uid stays the single authority on
+the owner and this field cannot contradict it.
 
 **A group id is unique only within an offering.** Group 3 of one assignment and group 3 of the next are
-different sets of students, so a bare group id is not a safe key to look a group up by. The owner `uid`
-carries the offering, which makes it the exact one.
+different sets of students, so a bare group id must not be used to look a group up — `getGroupByOwnerId`
+matches on the whole owner id instead, and answers with nothing for a group outside the offering it
+holds.
 
 ### `groupIdOfUserOwner` (runtime only)
 
diff --git a/docs/superpowers/specs/2026-07-27-clue-610-sort-work-ui-design.md b/docs/superpowers/specs/2026-07-27-clue-610-sort-work-ui-design.md
new file mode 100644
index 0000000000..68dc8a435c
--- /dev/null
+++ b/docs/superpowers/specs/2026-07-27-clue-610-sort-work-ui-design.md
@@ -0,0 +1,564 @@
+# CLUE-610 — Sort Work + workspace UI for class-wide documents — Design
+
+> **How this shipped.** This work grew past 47 changed files and went out as two stacked PRs, so this one
+> spec covers both. It remains a design record written before implementation, not a summary of either PR.
+>
+> It also ended up spanning **two stories**. It was designed and begun as Stage 3 of CLUE-550, and the
+> presentation half shipped under that story; the remaining half was split out into **CLUE-610** so the
+> release it lands in has its own story. CLUE-550 now covers the groundwork that reached production first.
+> References to CLUE-550 and to Stages 1–2 below are to that foundation and remain correct.
+>
+> - **#2940 — the presentation half** (merged first, under CLUE-550): the workspace title bar and the
+>   thumbnail treatment (Summary item 5, the consumer-table rows for `document.tsx` and
+>   `thumbnail-document-item.tsx`, and the implementation notes for both). It also carries two changes this
+>   spec does *not* describe, because they were found during implementation: surfacing `offeringId` on
+>   `IDocumentMetadataBase` and `DocumentMetadataModel`, and splitting `DocumentModel.groupId` into the
+>   owning group and a new `authorGroupId`.
+> - **#2949 — everything else** (this story, CLUE-610): the axis guards, the Sort Work listener and
+>   sectioning, the edit predicate, and the Firestore rules changes. Replaces #2942, which was opened from
+>   the branch's earlier name; its review discussion stays readable there.
+>
+> Two statements below were overtaken by #2940 and are left as written rather than edited, since this is a
+> record of the design as it stood: the claim that `offeringId` "never reaches a read-side consumer" and that
+> the `!doc.offeringId` term is "inert" is what #2940 changes. Names also drifted during implementation —
+> "scope" was split into the `owner`, `container`, and `curriculum` axes, and the guards were renamed to
+> match. [../../document-axes/](../../document-axes/) is the current-state record; this file is not.
+>
+> **Status:** Design spec for this PR. Self-contained: it describes exactly what this PR delivers and cites only
+> docs already in the repo.
+>
+> **Where this fits.** CLUE-550's Stage 1 landed the two stored axes (`concurrent`, `kind`) and rebased
+> group-document *behavior* onto them
+> ([2026-07-23-clue-550-stage-1-document-axes-design.md](2026-07-23-clue-550-stage-1-document-axes-design.md)).
+> Its Stage 2 made the app auto-create a class-wide collaborative document — the Driving Question Board (DQB) is
+> the default slot — exactly once per class per unit, with **no UI**
+> ([2026-07-23-clue-550-stage-2-class-wide-slots-design.md](2026-07-23-clue-550-stage-2-class-wide-slots-design.md)).
+> Both shipped in 7.4.0 and are on production. **This work makes those documents visible, sectioned, titled,
+> and editable**, and goes out in 7.5.0. The roadmap lives at
+> [../../document-axes/README.md](../../document-axes/README.md).
+>
+> **Builds on** (all CLUE-550, already shipped):
+> - the stored `concurrent`/`kind` axes and the kind registry;
+> - class-wide slot declaration (`classWideDocuments`), registry-derived owner/scope at creation, and title
+>   resolution by kind (`getDocumentTitle`).
+
+## Summary — what this PR delivers
+
+1. **Scope guards** — named predicates over the stored association fields, one per scope dimension
+   (`hasGroupOwnerScope`, `hasUnitCurriculumScope`), in a new leaf module. This resolves the scope-modeling
+   checkpoint the project deferred to its richest consumer: **scope is two independent dimensions — curriculum
+   (unit/investigation/problem) and owner (class/group/user) — read through per-dimension guards, with no
+   `scopeLevel` enum and no unified `scope` struct.**
+2. **Explicit-null scope fields for the `classUnit` scope**, so "scoped to a unit but not to a problem" is
+   directly queryable, following the convention that a scope field written as `null` means *absent scope* —
+   with a backfill pass added to Stage 1's one-shot script for documents created before the change.
+3. **A unit-scoped Sort Work listener** so class-wide documents survive the Investigation and Problem filters —
+   a scope-driven query naming neither `type` nor `kind`.
+4. **Sectioning by scope** — `byGroup` puts class-scoped collaborative documents in a "Whole Class" section
+   ahead of the numbered groups; `byName` puts them in a "No Name" section. `byGroup` ordering now comes from a
+   structured sort key rather than parsing the section label (a slice of review issue #7).
+5. **Presentation off the axes** — the workspace title bar and the thumbnail treatment stop branching on
+   `type === "group"` and read `concurrent`, with the title resolved from the `kind` registry.
+6. **One shared edit predicate** (`canUserEditDocument`) used by both Sort Work and the resources pane,
+   replacing the two inline gates (resolves review issue #4).
+7. **History-write authorization for synthetic document owners**, established by an emulator test first.
+
+The stored `type` value stays `"group"` (the transitional convention throughout this work). Retiring it is
+unscheduled follow-on work — see "Boundaries and non-goals".
+
+## The scope-modeling checkpoint, resolved
+
+The project deliberately deferred the question "does scope need a helper at all, and if so what shape?" to the
+stage with the most scope consumers. Stage 3 is that stage. Working through its five consumers shows that only
+one of them needs to know anything about scope:
+
+| Consumer | Branched on today | What it actually asks |
+|---|---|---|
+| Workspace title bar (`document.tsx`) | `document.isGroup` | `kind` → registry presentation |
+| Thumbnail treatment (`thumbnail-document-item.tsx`) | `type === GroupDocument` | `concurrent` → collaborative styling |
+| Edit gate (`sort-work-document-area.tsx`) | `uid === user.id` | `concurrent` + is the user inside the document's scope |
+| Sort Work listener (`sorted-documents.ts`) | — | scope *breadth*: a unit-scoped document must survive a problem filter |
+| `byGroup` / `byName` sectioning (`document-group.ts`) | `type === GroupDocument` | which cohort the document belongs to |
+
+Four of the five are answered by an axis a consumer already has (`kind`, `concurrent`) or by the query it
+already writes. No consumer needs a "this is a class-wide document" flag, and none is introduced — a
+consumer that asked that question would be branching on identity again, which is exactly what this project
+exists to remove.
+
+**Decision: per-dimension guards, no general scope model.** A new leaf module
+`src/models/document/document-scope.ts` — structural parameter types only, no model imports, the same shape as
+`document-kinds.ts`.
+
+Scope turns out to be **two dimensions** — curriculum (unit → investigation → problem) and owner (class →
+group → user) — with the offering crossing both rather than sitting on either. That is why no `scopeLevel`
+enum is introduced: a single ordered level cannot express a position on two axes at once. The model and the
+field-by-shape table live in `docs/document-scope.md`, added by this PR; what matters here is the shape of the
+API it produces:
+
+```ts
+hasGroupOwnerScope(doc)     = !!doc.groupId
+hasUnitCurriculumScope(doc) = !!doc.unit && !doc.investigation && !doc.offeringId
+```
+
+Each guard answers about **one** dimension and reads only that dimension's fields, so its meaning does not
+depend on what the other dimension holds. A consumer needing a position on both asks both — a class-wide
+collaborative document is `hasUnitCurriculumScope` *and* not `hasGroupOwnerScope`. That is what drops the
+cross-dimension `!doc.groupId` term the curriculum guard would otherwise carry (a group document is already
+excluded by its `investigation`) and what makes `!doc.offeringId` belong: an offering assigns one problem, so
+it narrows this same dimension.
+
+These read only stored association fields — no `type`, no `kind`, no `concurrent`. That matters for a real
+case: under the "All" filter Sort Work lists documents from *other* units of the same class, and a class-wide
+document from another unit has a `kind` that was never registered in this session (kinds are registered when
+the current unit loads). A registry lookup would silently misfile it; a field read cannot.
+
+**Two gaps, recorded rather than closed.** No guard reads the class or user levels of owner scope, because
+those live in `uid` (the class owner is a synthetic `class_<classHash>`). `byName` needs "owned by the class"
+and approximates it with `hasUnitCurriculumScope`, which is correct only while the one class-owned kind is
+also the one unit-scoped kind; the call site is commented to that effect. Separately, `offeringId` is written
+to Firestore at creation but is declared on neither `IDocumentMetadata` nor `DocumentMetadataModel`, so it
+never reaches a read-side consumer — the `!doc.offeringId` term is inert at today's call sites, and every
+document carrying an offering is excluded by its `investigation` instead. Both belong with the `owner` and
+`scope` axes' read sides, which are not in this stage.
+
+`docs/document-scope.md` gains the section recording all of the above.
+
+## Making the scope queryable: explicit-null fields
+
+The bottom row of that table is only true once the `classUnit` scope writes its absent curriculum fields
+explicitly. `getDocumentScopeFields`'s `classUnit` case currently returns `{ unit, context_id }`, leaving
+`investigation` and `problem` off the Firestore document entirely:
+
+```ts
+case "classUnit": return {
+  unit: ctx.unit,
+  context_id: ctx.context_id,
+  investigation: null,   // added: absent scope, stated explicitly
+  problem: null          // added
+};
+```
+
+This follows the convention the rules already encode — `hasScopeField` in `firestore.rules` treats a
+field written as `null` as *absent scope*, precisely because class-scoped documents (personal, learning log)
+already store `unit: null`. Stamping the same way for `classUnit` makes the client read (`!doc.investigation`)
+and the Firestore query (`where("investigation", "==", null)`) agree, and makes a class-wide document's stored
+scope self-describing rather than defined by which fields happen to be missing.
+
+### Backfilling existing documents
+
+A class-wide document created before this change has neither field, so `hasUnitCurriculumScope` still accepts it
+client-side (a missing field is falsy just as `null` is) but the new Firestore query does not match it — it
+would silently disappear from Sort Work under the Investigation and Problem filters. Class-wide documents are
+unreleased, so only dev/QA partitions hold any, but the fix is cheap and the tooling already exists: Stage 1's
+one-shot backfill script, `scripts/backfill-group-concurrent.ts` — renamed here to
+`scripts/backfill-group-document-axes.ts` (see below).
+
+Its collection-group query — `where("type", "==", "group")` — already returns exactly the right superset, since
+group and class-wide documents share the transitional type. The script gains a second, independent pass over
+the same snapshot:
+
+| pass | selects | stamps |
+|---|---|---|
+| existing | `concurrent !== true` **and has a `groupId`** | `{ concurrent: true, kind: "group" }` |
+| new | no `groupId`, and `investigation`/`problem` absent | `{ investigation: null, problem: null }` |
+
+Both remain additive, idempotent, and batched, and `BackfillResult` grows a counter per pass so a dry run
+reports each separately.
+
+Two details worth stating:
+
+- **The existing pass is narrowed to documents that have a `groupId`.** Today it stamps `kind: "group"` on any
+  `type == "group"` document missing `concurrent`. A class-wide document is created with `concurrent: true`, so
+  in practice it is already filtered out — but if one ever lacked the field it would be mis-stamped with the
+  *group* kind, silently breaking its title and its canonical-pointer slot. Selecting on `groupId` makes the
+  two passes select disjoint sets by scope rather than relying on a value that a partial write could leave
+  missing. This is the same owner-scope question `hasGroupOwnerScope` asks, expressed in the script.
+- **The script is renamed to match what it now does.** `backfill-group-concurrent.ts` →
+  `backfill-group-document-axes.ts`, with `backfillGroupConcurrent` → `backfillGroupDocumentAxes` and the test
+  file renamed alongside it. It is no longer a one-field backfill: it normalizes the stored axes of every
+  group-typed document, and a name naming only `concurrent` would misdirect the next person who needs to add a
+  pass. Its header comment — which carries the dry-run/`APPLY=1` usage, since `scripts/README.md` documents
+  only the shared setup and does not list individual scripts — is updated to describe both passes.
+
+## The Sort Work query
+
+Class-wide documents carry no `investigation` or `problem`, so the two filters that add those equality clauses
+drop them:
+
+| `docFilter` | existing filtered query | class-wide docs included? |
+|---|---|---|
+| All | `context_id ==` | yes |
+| Unit | `+ unit in <variants>` | yes |
+| Investigation | `+ investigation ==` | **no** |
+| Problem | `+ investigation == , problem ==` | **no** |
+
+`sorted-documents.ts` gains a third listener — a sibling of the existing `metadataDocsWithoutUnit` listener,
+which exists for the same reason one level up (it picks up class-scoped personal documents when a unit filter is
+applied):
+
+```ts
+// active only when the filter is "Investigation" or "Problem"
+const queryForUnitScoped = baseQuery
+  .where("unit", "in", this.curriculumConfig.getUnitCodeVariants(unit))
+  .where("investigation", "==", null);
+```
+
+Its snapshot lands in a `metadataDocsUnitScoped` map, merged into `firestoreMetadataDocs` and deduped by key
+alongside the other two maps, and its disposer joins the returned composite disposer.
+
+The query names no `type` and no `kind` — it asks for documents scoped to this unit but not to a problem, which
+is a question about scope breadth, not about what the document *is*. This is the concrete replacement for PR
+#2890's `queryForDqb` (`where("type", "==", "drivingQuestionBoard")` plus client-side unit filtering). It is
+equality-only, so Firestore serves it from single-field indexes with no composite index to add.
+
+## Sectioning
+
+### `byGroup`
+
+```ts
+if (hasGroupOwnerScope(doc))     return `${groupTerm} ${doc.groupId}`;
+if (hasUnitCurriculumScope(doc)) return kWholeClassSectionLabel;   // "Whole Class"
+const group = this.stores.groups.groupForUser(doc.uid);
+return group ? `${groupTerm} ${group.id}` : `No ${groupTerm}`;
+```
+
+Group scope is tested first: a group document has both a `groupId` and a `unit`, and the group question is the
+more specific one. The final branch is unchanged — a document owned by a class user is filed under that user's
+current group.
+
+### `byName`
+
+Class-scoped collaborative documents go to a "No Name" section, matching PR #2890. The class-wide document has
+no personal author, and listing it under every class member (the way a group document is listed under each of
+its group's members) would repeat one document across the entire list. "No Name" is a distinct label from the
+existing "Unknown" bucket, which is used for a document whose owner is not in the class store. No change is made
+to `sortNameSectionLabels`, so "No Name" sorts alphabetically among the student names, as in #2890.
+
+### Sort keys instead of label parsing (part of review issue #7)
+
+`sortGroupSectionLabels` currently recovers a group number by stripping non-digits from the display label
+(`parseInt(a.replace(/^\D+/g, ''), 10)`). Adding a non-numeric "Whole Class" section makes that worse — #2890
+had to special-case the label *string* inside the comparator, and any label whose text does not contain a number
+sorts as `NaN`.
+
+`byGroup` instead builds a side sort-key map alongside its document map and passes it to the comparator, exactly
+as `byDate` already passes `docMapWithDates` to `sortDateSectionLabels` and `byProblem` already carries a side
+`labelMap`:
+
+```ts
+type GroupSectionSortKey =
+  | { scope: "class" }                        // Whole Class  — first
+  | { scope: "group"; groupId: string }       // Group N      — numeric ascending
+  | { scope: "none" };                        // No Group     — last
+
+sortGroupSections(labels, sortKeyMap)   // class < group(asc) < none
+```
+
+**`label` remains both the display text and the section identity.** The sort key is used only for ordering.
+That keeps three existing label-as-identity uses untouched and needs no migration of persisted state:
+
+| Use | Where | Persisted? |
+|---|---|---|
+| which sections are expanded | `ui.expandedSortWorkSections` (array of labels) | no — session `ui` store |
+| which section holds the open document | `persistentUI` tab state `currentDocumentGroupId` = JSON of `{primaryLabel, primaryType, …}` | **yes** |
+| re-finding that section on render | `sortedDocumentGroups.findIndex(g => g.label === primaryLabel)` | reads the persisted value |
+
+The rest of review issue #7 — that the open-document state round-trips section structure through a
+JSON-stringified display label — is **not** addressed here and stays open. Replacing it means retyping
+`IOpenDocumentsGroupMetadata` and touching `sorted-section`, `document-scroller`, `sort-work-view`, and
+`persistent-ui`, which is larger than this feature and unrelated to class-wide documents.
+
+## Presentation
+
+Title resolution by `kind` already landed in Stage 2 (`getDocumentTitle` → `getDocumentDisplayTitle`). Stage 3
+wires the two remaining presentation sites, and both of them turn out to be `concurrent` questions rather than
+`kind` questions — a class-wide document and a group document *look* alike because they are the same kind of
+thing; only their titles differ.
+
+- **Workspace title bar** (`document.tsx`): `renderTitleBar`'s `document.isGroup` branch becomes
+  `document.concurrent`, and `renderGroupDocumentTitleBar` becomes a collaborative title bar that takes its
+  title from `getDocumentDisplayTitle(unit, document, appConfig)` — the registry lookup — instead of the
+  hardcoded `` `Group ${document.groupId} Document` ``. The scss hook passed as `docType` becomes
+  `document.kind ?? document.type`, so a group document still renders `.titlebar.group` with no style change,
+  while a class-wide document gets a class named for its kind.
+- **Thumbnail treatment** (`thumbnail-document-item.tsx`): `document.type === GroupDocument` becomes
+  `!!document.concurrent` for the purple border and corner badge.
+
+**Deliberate deviation from PR #2890:** its absolutely-positioned, full-width centered title for the DQB
+title bar is not ported. It is cosmetic, and it would put `drivingQuestionBoard` in a stylesheet — a
+kind-specific rule cuts against the project's requirement that adding another class-wide document be a
+*configuration* change. This is the one intentional difference from #2890's UX and should be confirmed in the
+parity check.
+
+### Titling a document from another unit
+
+The Sort Work base query constrains only `context_id`, and under the **All** filter no unit clause is added.
+The class hash comes from the portal class, not the offering, so a class that has worked through more than
+one unit sees documents from all of them — the pre-existing `Problem doc from sas-1.2` fallback exists for
+exactly this reason. Class-wide documents reach that view too, and they raise two problems that titling by
+kind alone cannot answer, because only the *current* unit's config is loaded:
+
+1. The document's kind was declared by a unit that is not loaded, so the registry holds no title — and a
+   class-wide document stores no title of its own. It would render blank.
+2. Two units declare the *same* kind with different authored wording. The registry answers, but with the
+   current unit's title, stating a title for a document that unit does not govern.
+
+Both are handled by treating a unit-declared title as belonging to its unit. `IDocumentKindInfo` gains a
+`unit` field, recorded at registration from the same unit code the document is stamped with, and
+`getDocumentTitle` returns a registered title only for that unit's documents. Built-in kinds set no `unit`
+and no `title`, so they are unaffected; the group-document label does not depend on unit config and keeps
+working across units.
+
+A document that resolves no title and stores none is named by `getDocumentKindLabel(kind)` — a registry-free
+reading of the camelCase kind — plus `getCurriculumScopeLabel(doc)`, giving `Driving Question Board (other)`.
+The scope label is read from the stored fields rather than assumed to be a unit, because an unresolvable
+kind says nothing about how the document is scoped; it produces `sas-1.2` for a problem-scoped document and
+`sas` for a class-wide one, and `getDocumentTitleFromProblem` now shares it so the format lives in one place.
+Provenance appears only in this fallback, matching the existing convention: a resolvable title is shown
+plain, and coordinates stand in when there is none.
+
+Two limits are accepted. The label recovers the kind's identity, not the author's wording — a slot titled
+"Our Big Questions" reads as "Driving Question Board" from another unit, and nothing loads that unit's
+config to do better. And a document carrying a *renamed* unit code compares unequal to the declaring unit,
+so it drops to the fallback; `getUnitCodeVariants` lives on `curriculumConfig`, which the registry (a leaf
+module) does not import.
+
+**No icon is authored.** Stage 2 removed the unused `icon` field from the `classWideDocuments` declaration and
+left the question to this stage; nothing here needs one, so no icon field is added to the unit config or to the
+kind registry. Adding one later is additive.
+
+## The edit gate (review issue #4)
+
+Two inline gates decide whether the Edit button appears:
+
+```ts
+// sort-work-document-area.tsx: only the user's own documents
+const showEdit = openDocument?.uid === user.id;
+// document-view.tsx: a tab check that stands in for "these tabs only show your own documents"
+const showEdit = !openDocument.isRemote && ((tab === "my-work") || (tab === "learningLog"));
+```
+
+Both are replaced by one predicate in `document-utils.ts`, beside its sibling question
+`isDocumentAccessibleToUser`, and taking the same `{ document, documentMetadata, user }` parameters:
+
+```ts
+canUserEditDocument({ document, documentMetadata, user })
+  // own document                                    -> true
+  // not concurrent                                  -> false
+  // class-unit scope: context_id === user.classHash -> true   (any class member)
+  // otherwise (group scope): groupId === user.currentGroupId
+```
+
+Fields are read preferring the reactive Firestore metadata and falling back to the lazily-fetched full document,
+per field — the full document's `groupId` can still be undefined while a groupmate's document is loading, which
+would otherwise hide the button until a reload.
+
+`document-view.tsx` adopts it as `!openDocument.isRemote && canUserEditDocument(...)`. That is a real behavior
+change beyond class-wide documents — a group document surfaced in the class-work tab becomes editable, and a
+classmate's shared document remains non-editable — so it gets its own test coverage and its own line in the
+manual check.
+
+**Relationship to CLUE-525 / PR #2930.** That in-flight PR introduces the same rule for group documents as
+`canEditSortWorkDocument` in `src/components/document/sort-work-edit-permission.ts`, with five loose primitive
+parameters and the metadata merge spelled out at the call site. If it lands in the reshaped form (moved to
+`document-utils.ts`, object parameters, the type test isolated behind a named `isCollaborativeDoc` local), this
+stage's entire delta is inside the function body: swap that local for `!!concurrent` and add the class-scoped
+arm. If it lands as originally written, this stage performs the move and reshape as part of resolving issue #4.
+Either way the end state is the same file, name, and signature.
+
+`DocumentModel`'s `metadata` getter does not currently include `context_id` (the model stores it as `contextId`,
+from CLUE-576), so it is added there to let the document-fallback path answer the class-scoped arm.
+
+## History-write authorization for synthetic owners
+
+Concurrent documents write history entries to `documents/<key>/history/<entryId>`. That rule gates create and
+read on `userOwnsDocument()`, which resolves through the **parent** document — `getDocumentPath()` builds
+`.../documents/$(docId)` from the enclosing `match /documents/{docId}`, and `getDocumentOwner()` returns that
+document's `uid`. `request.resource.data` — the entry being written — is never consulted, and the rules' helper
+for that (`userIsRequestUser()`, used by the comments rules) is not applied here.
+
+A class-wide document's owner is the synthetic `class_<classHash>`, which never equals a student's
+`platform_user_id`. The same is already true of a group document's `group_<offeringId>_<groupId>`, so if this
+denies history writes it denies them for group documents too — a pre-existing gap that has gone unnoticed
+because group documents are unreleased and are exercised in permissive dev/QA partitions.
+
+**This was established by an emulator test before anything was changed.** Five characterization tests were added
+to the `history entries` block in `firebase-test/src/documents-rules.test.ts` and run against the Firestore
+emulator (`firebase emulators:exec --only firestore "npm test"`). A class member's attempt to create a history
+entry under a metadata document owned by a synthetic group (`group_myOffering_3`) or class-wide (`class_<hash>`)
+owner **was denied** — `PERMISSION_DENIED` at the `create` rule for the group case, the class-wide case, and the
+corresponding read. The two negative-control tests **passed** (a user outside the class, and a class member on a
+classmate's single-writer document): their writes were correctly denied both before and after the fix, confirming
+the axis under test — not just authentication — was what gated the positive cases.
+
+Because the writes were denied, the rule was rebased onto the `concurrent` axis: create and read are now allowed
+when the parent document carries `concurrent: true` and the requester's `class_hash` matches its `context_id`, in
+addition to `userOwnsDocument()`. This continues Stage 1's pattern of rebasing rules onto `concurrent`, and covers
+group and class-wide documents with one clause (`isConcurrentClassDocument()` in `firestore.rules`). It
+deliberately does **not** narrow group-document history to the owning group: the auth token carries no group id,
+so the rules cannot express that, and the RTDB rules already grant write on the whole `classes/<classHash>`
+subtree, so this matches the existing write surface rather than widening it.
+
+**Follow-up fix: `concurrent` is itself an authorization input, so its write path needed gating too.**
+Code review on this change found that `concurrent` was not in `preservesReadOnlyDocumentFields()`'s read-only
+set, and `isValidDocumentUpdateRequest()` lets any class member update any document in their class
+(`resourceInUserClass()`). That combination let a class member forge the grant `isConcurrentClassDocument()`
+checks: update a classmate's ordinary `problemDocument` with `{ concurrent: true }` — no read-only field is
+touched, so the update was allowed — which then made that student, and every classmate, able to read and append
+history on the classmate's private document. `type` is itself read-only, so it cannot be flipped first to route
+around a `type == "group"` check placed elsewhere. A characterization test run against the pre-fix rules
+confirmed the forgery: `expectUpdateToFail(db, kDocumentDocPath, { concurrent: true })` from a classmate's session
+against another student's `problemDocument` failed with "Expected request to fail, but it succeeded."
+
+The fix closes the escalation at the write path rather than narrowing the read path: a new `concurrentChangeOk()`
+function (beside `preservesReadOnlyDocumentFields()` in `firestore.rules`) allows a change to `concurrent` only
+when the stored document's `type` is `"group"`, and is wired into `isValidDocumentUpdateRequest()`. This is
+transitional by design and is commented as such in the rules: two paths still merge-update `concurrent` onto
+pre-existing group documents that predate the field — the on-open backfill in `src/lib/db.ts` and the one-shot
+`scripts/backfill-group-document-axes.ts` — so it cannot yet be made unconditionally read-only. Once both backfill
+paths have run against every environment, `concurrentChangeOk()` should be deleted and `concurrent` added to
+`preservesReadOnlyDocumentFields()`'s read-only set, making it settable only at document creation — a change that
+also requires constraining `isValidDocumentCreateRequest()` (firestore.rules:172-180), which today constrains
+neither `concurrent` nor `uid`: a truthy `concurrent` at create should imply `type == "group"`, and/or the create
+should require `userIsRequestUser()`, or a class member can create a new document stamped with a classmate's
+`uid` and `concurrent: true`. That does not reopen the escalation closed above — a create cannot target an
+existing document — but it leaves that vector open once the update-path allowance above is removed.
+
+The same backfill unblocks a smaller cleanup. `getDocumentTitle` selects the group-document title on
+`type == "group"` **plus a `groupId`**, rather than on `kind`, because a group document may carry no stored
+`kind` — the kind is backfilled on open, but the lists that show these titles render before the documents are
+opened. The `groupId` term is what keeps a class-wide document (same `type`, no `groupId`) from being labelled
+"Group undefined Document" when its own kind is unregistered. Once the backfill has stamped `kind` on every
+group document, this becomes `kind == "group"` and the `groupId` term goes away with it: a class-wide document
+has its own kind and can no longer reach the branch at all. Breadcrumbs are in `document-kinds.ts` and the
+backfill script.
+
+Re-running the full `documents-rules.test.ts` suite (120 tests, including every pre-existing history-entry and
+document-update case) and the full `firebase-test` suite (366 tests across all 8 rule files) both passed after
+the fix. The seven tests added across both fix rounds remain as the regression guard.
+
+## Carried forward from Stage 2
+
+Stage 2's whole-branch review flagged two items to verify before a slot is turned on. `src/public/demo/units/qa`
+declares a `drivingQuestionBoard` slot, so they are live now.
+
+- **Type-based enumeration leak** — a `type: "group"` document with no `offeringId`/`groupId` must not be picked
+  up as an ordinary group document. Audited:
+  - `documents.byType` / `byTypeForUser` are never called with `GroupDocument`; every call site names an
+    exemplar, publication, personal, planning, or problem type.
+  - The 4-up view resolves documents through group *users* (`getUserDocument`), not a type scan.
+  - `document-group.ts`'s `byGroup`/`byName` were the real leak — a class-wide document landed in
+    `Group undefined`. That is what this stage's sectioning fixes.
+  - `tile-activity-badges.tsx` gates on `type === GroupDocument`, so a class-wide document passes it. The
+    activity listener is group-scoped, so only same-group members' presence appears on a class-wide document —
+    incomplete rather than incorrect, and exactly what CLUE-611's unified class-scoped channel completes. No
+    change here.
+  - `document-workspace.tsx`'s `guaranteeInitialDocuments` re-opens a `type: "group"` primary document after a
+    reload (group documents are not loaded automatically); a class-wide document restored as the primary
+    document is covered by that same branch, which is the behavior we want.
+- **Eager-open cost — measured.** `createDeclaredClassWideDocuments` runs on every unit load, including the fast
+  path, and opens each declared slot's document into `stores.documents` (subscribing its history manager).
+  Measured against `demo/units/qa` (one declared slot, `drivingQuestionBoard`) on a second load — the pointer
+  and metadata documents already exist, so the fast path (`pointerRef.get()` then
+  `openCanonicalDocumentByKey()`) runs — by timing `stores.unitLoadedPromise` resolving against the class-wide
+  document appearing in `stores.documents.all`, in a real Chrome session against a live Firestore project
+  (`collaborative-learning-ec215`). Two independent reloads: **670ms** and **730ms** (~700ms average) between
+  the unit-loaded event and the document appearing. That crosses the "material" threshold this bullet set (more
+  than a few hundred milliseconds), and confirms the reasoning below directly: the fast path is still two
+  sequential round trips, not one.
+  Read count could not be measured the way originally planned: the Firestore v8 SDK multiplexes every
+  listener and one-time read for the whole page (persistent UI, curriculum, class/group listeners, this
+  slot's pointer and metadata reads) over one shared long-polling WebChannel connection, so individual reads
+  are not visible as separate Network-panel entries — only channel-level HTTP requests shared across
+  everything else the page is doing at that moment. By code inspection (not empirical capture),
+  `getOrCreateCanonicalDocument`'s fast path is `pointerRef.get()` (one read) followed by
+  `openCanonicalDocumentByKey()` → `findFirestoreMetadata()` (a second read), i.e. two sequential reads per
+  declared slot before the document opens — consistent with "a handful," but this half of the measurement is
+  reasoned, not captured.
+  **This is material and not fixed here, per the brief for this bullet: defer the open, not the
+  get-or-create.** The get-or-create must still run at unit-load to converge the class on one document per
+  slot; what should move is subscribing `stores.documents` and the history manager, which is what makes the
+  700ms visible on the critical path today. Filed as a follow-up rather than folded into this stage.
+
+## Roadmap update
+
+[../../document-axes/README.md](../../document-axes/README.md), in this PR:
+
+- `kind` → **done** — presentation now reads the registry (title in Stage 2, title bar here) and no consumer
+  branches on kind.
+- `scope` → stays **in progress**, with the read side recorded: per-dimension guards (`hasGroupOwnerScope`,
+  `hasUnitCurriculumScope`) over stored association fields, and the checkpoint outcome that no `scopeLevel` enum or
+  unified `scope` struct is introduced.
+- behavior modules → the edit-gate predicate and the `concurrent`-driven presentation added to the list of
+  behaviors reading axes rather than `type`; the history-write rule outcome recorded once known.
+
+## Boundaries and non-goals
+
+- **Presence is deferred to CLUE-611.** The parallel group/class activity listener and broadcaster, the
+  session/offering dimension (review issue #5), and unified activity badges are not touched. On a class-wide
+  document the indicators therefore show only the viewer's own group — accepted for this release.
+- **The legacy type stays.** Documents still store `type: "group"`; flipping it to `"generic"` and removing
+  `GroupDocument`/`isGroup` is unscheduled follow-on work. It is entangled with read access (below) and with
+  the transitional rules that CLUE-604 and CLUE-612 retire, so it cannot simply be done next.
+- **Read access still keys on `type`.** `isDocumentAccessibleToUser` continues to grant class-wide read via
+  `metadata.type === GroupDocument`, which covers class-wide documents for free. Rebasing read access is
+  deferred to the `permissions` axis, per Stage 1.
+- **Review issue #7 is only partly addressed** — section *ordering* stops parsing labels; the persisted
+  label round-trip does not change.
+- **No general scope model.** Two guards, no enum, no struct.
+- **No icon authoring surface.**
+
+## Testing
+
+- **Unit (Jest):** the two scope guards across every document shape in the table above; `getDocumentScopeFields`
+  stamping `investigation: null`/`problem: null` for `classUnit` and nothing else changing for other scope types;
+  `byGroup` sectioning (group scope → `Group N`; class-unit scope → `Whole Class`; owner's group; `No Group`) and
+  its sort-key ordering (class first, groups numeric ascending, `No Group` last, non-numeric labels
+  deterministic); `byName` filing a class-scoped document under `No Name`; the unit-scoped listener firing only
+  under the Investigation/Problem filters, and its documents merging and deduping into `firestoreMetadataDocs`;
+  `canUserEditDocument` across own / own-group / other-group / other-student / class-wide-as-class-member /
+  class-wide-as-outsider / non-concurrent cases, including the per-field metadata-preferring merge with a
+  still-loading document.
+- **Backfill script (Jest, mock Firestore)** — the existing `backfill-group-concurrent.test.ts` cases carried
+  over to the renamed `scripts/backfill-group-document-axes.test.ts`, plus: the new
+  pass stamps `{ investigation: null, problem: null }` only on group-typed documents with no `groupId` that
+  lack those fields; the existing pass stamps `{ concurrent: true, kind: "group" }` only on documents that
+  *have* a `groupId`, so a class-wide document is never stamped with the group kind; the two passes select
+  disjoint sets; both are idempotent (a fully-migrated set writes nothing) and a dry run writes nothing while
+  reporting each pass's count.
+- **Component:** the title bar rendering the registry title for a class-wide document and the unchanged
+  `Group N Document` for a group document; the thumbnail collaborative treatment driven by `concurrent`.
+- **Rules (emulator):** the synthetic-owner history-write test described above, plus whichever outcome it
+  establishes.
+- **Manual end-to-end — pending human verification.** This requires two browser profiles signed in as
+  different students in one class, which is outside what an automated session can perform; it was not run as
+  part of this task. On `demo/units/qa` (declares a `drivingQuestionBoard` slot), with two browser profiles
+  signed in as different students in one class, verify:
+  1. Sort Work shows a "Whole Class" section containing the class-wide document, under each of the All, Unit,
+     Investigation, and Problem filters.
+  2. Sorting by Name shows it under "No Name" and under no student.
+  3. Its title is the one authored in `classWideDocuments`.
+  4. Its thumbnail has the collaborative (purple/badge) treatment.
+  5. The Edit button appears for both students; editing from one appears in the other.
+  6. Opening it in the workspace shows the authored title in the title bar, not `Group undefined Document`.
+  7. A group document's title, thumbnail, section, and Edit button are unchanged.
+  8. In the resources pane: My Work and Learning Log still show Edit for the user's own documents; a
+     bookmarked document owned by another student does not show Edit.
+  Record any deviation here rather than silently fixing it.
+- Full `npm test`, `npm run check:types`, `npm run lint:build`, and the `firebase-test` rules suite green.
+
+## References
+
+- Stage 1 design:
+  [2026-07-23-clue-550-stage-1-document-axes-design.md](2026-07-23-clue-550-stage-1-document-axes-design.md).
+- Stage 2 design:
+  [2026-07-23-clue-550-stage-2-class-wide-slots-design.md](2026-07-23-clue-550-stage-2-class-wide-slots-design.md).
+- Document-axes roadmap: [../../document-axes/README.md](../../document-axes/README.md).
+- Scoping model this stage extends: [../../document-scope.md](../../document-scope.md).
+- Key code sites: `src/models/document/document-scope.ts` (new), `src/models/document/document-kinds.ts`,
+  `src/models/document/document-utils.ts`, `src/models/document/document.ts`,
+  `src/models/stores/document-group.ts`, `src/models/stores/sorted-documents.ts`,
+  `src/utilities/sort-document-utils.ts`, `src/components/document/document.tsx`,
+  `src/components/document/sort-work-document-area.tsx`, `src/components/navigation/document-view.tsx`,
+  `src/components/thumbnail/thumbnail-document-item.tsx`, `firestore.rules`,
+  `scripts/backfill-group-document-axes.ts` (Stage 1's one-shot backfill, extended and renamed here).
diff --git a/firebase-test/src/canonical-pointers-rules.test.ts b/firebase-test/src/canonical-pointers-rules.test.ts
index 9faaf07914..9cf24090ac 100644
--- a/firebase-test/src/canonical-pointers-rules.test.ts
+++ b/firebase-test/src/canonical-pointers-rules.test.ts
@@ -7,10 +7,13 @@ import { assertFails, assertSucceeds } from "@firebase/rules-unit-testing";
 const kOffering = "offering-1";
 const kGroup = "3";
 const kLabel = "default";
+// The owner segment of a slot path is the document's own `uid` — for a group document, the synthetic
+// group owner. It must match the uid on the document that claims the slot.
+const kGroupOwner = `group_${kOffering}_${kGroup}`;
 const kPointerPath =
-  `authed/test-portal/canonical/v1/classes/${thisClass}/offerings/${kOffering}/groups/${kGroup}/slots/${kLabel}`;
+  `authed/test-portal/canonical/v1/classes/${thisClass}/offerings/${kOffering}/owners/${kGroupOwner}/slots/${kLabel}`;
 const kOtherClassPointerPath =
-  `authed/test-portal/canonical/v1/classes/other-class/offerings/${kOffering}/groups/${kGroup}/slots/${kLabel}`;
+  `authed/test-portal/canonical/v1/classes/other-class/offerings/${kOffering}/owners/${kGroupOwner}/slots/${kLabel}`;
 // createdBy is the real user who created/claimed the pointer, not the document's synthetic owner.
 const validPointer = () => ({ documentKey: "doc-abc", createdAt: firebase.firestore.Timestamp.now(), createdBy: studentId });
 
@@ -52,7 +55,7 @@ describe("canonical pointers", () => {
 
 const kDocPath = `authed/test-portal/documents/group-doc-1`;
 const groupDoc = (extra: any = {}) => ({
-  uid: `group_${kOffering}_${kGroup}`, type: "group", key: "group-doc-1",
+  uid: kGroupOwner, type: "group", key: "group-doc-1",
   createdAt: firebase.firestore.Timestamp.now(), context_id: thisClass, network: null,
   offeringId: kOffering, groupId: kGroup, ...extra
 });
@@ -117,12 +120,41 @@ describe("canonical flag integrity", () => {
     await assertFails(db.doc(kDocPath).update({ canonical: "default" }));
   });
 
-  it("a document whose scope has no canonical shape (no group association) cannot claim canonical", async () => {
-    // Scope is read from the association fields. Without a group association the document has no
-    // canonical-pointer path (canonicalPointerPath() is null), so the claim is denied before any
-    // pointer is consulted — the update touches only `canonical`, so nothing else can reject it.
-    const { groupId, ...noGroupScope } = groupDoc();
-    await adminWriteDoc(kDocPath, { ...noGroupScope, createdAt: Date.now() });
+  it("a document whose container has no canonical shape cannot claim canonical", async () => {
+    // The container is read from the association fields. With neither an offering nor a unit the
+    // document has no canonical-pointer path (canonicalPointerPath() is null), so the claim is denied
+    // before any pointer is consulted — the update touches only `canonical`, so nothing else can
+    // reject it.
+    const { offeringId, ...noContainer } = groupDoc();
+    await adminWriteDoc(kDocPath, { ...noContainer, createdAt: Date.now() });
+    db = initFirestore(studentAuth);
+    await assertFails(db.doc(kDocPath).update({ canonical: "default" }));
+  });
+
+  it("a group document may set canonical when the slot for its own owner confirms it", async () => {
+    // The positive half of the pair below: the pointer sits at the slot for this document's own uid.
+    const admin = initFirestore(teacherAuth);
+    await admin.doc(kDocPath).set(groupDoc());
+    await admin.doc(kPointerPath).set({
+      documentKey: "group-doc-1", createdAt: firebase.firestore.Timestamp.now(), createdBy: studentId
+    });
+    db = initFirestore(studentAuth);
+    await assertSucceeds(db.doc(kDocPath).update({ canonical: "default" }));
+  });
+
+  it("a document may not claim a slot belonging to another owner in the same container", async () => {
+    // The pointer exists and names this document, but at group 7's slot while the document's uid is
+    // group 3's. The path the rules build comes from the document's own `uid`, so it looks at group 3's
+    // slot, finds nothing, and denies the claim. This is what the owner segment buys: two groups in one
+    // offering cannot fill each other's slot.
+    const otherOwnersSlot =
+      `authed/test-portal/canonical/v1/classes/${thisClass}/offerings/${kOffering}` +
+      `/owners/group_${kOffering}_7/slots/${kLabel}`;
+    const admin = initFirestore(teacherAuth);
+    await admin.doc(kDocPath).set(groupDoc());
+    await admin.doc(otherOwnersSlot).set({
+      documentKey: "group-doc-1", createdAt: firebase.firestore.Timestamp.now(), createdBy: studentId
+    });
     db = initFirestore(studentAuth);
     await assertFails(db.doc(kDocPath).update({ canonical: "default" }));
   });
@@ -144,10 +176,11 @@ describe("canonical flag integrity", () => {
 
 const kUnit = "msu";
 const kClassWideLabel = "drivingQuestionBoard";
+const kClassOwner = `class_${thisClass}`;
 const kClassWidePointerPath =
-  `authed/test-portal/canonical/v1/classes/${thisClass}/units/${kUnit}/slots/${kClassWideLabel}`;
+  `authed/test-portal/canonical/v1/classes/${thisClass}/units/${kUnit}/owners/${kClassOwner}/slots/${kClassWideLabel}`;
 const kOtherClassWidePointerPath =
-  `authed/test-portal/canonical/v1/classes/other-class/units/${kUnit}/slots/${kClassWideLabel}`;
+  `authed/test-portal/canonical/v1/classes/other-class/units/${kUnit}/owners/${kClassOwner}/slots/${kClassWideLabel}`;
 
 describe("class+unit canonical pointers", () => {
   it("a student in the class may create a class+unit pointer with the required keys", async () => {
@@ -184,7 +217,7 @@ describe("class+unit canonical pointers", () => {
 const kClassWideDocPath = `authed/test-portal/documents/dqb-doc-1`;
 const classWideDoc = (extra: any = {}) => ({
   // Owner is the class (class_<classHash>), shared across units; the unit lives in the canonical slot, not the uid.
-  uid: `class_${thisClass}`, type: "group", key: "dqb-doc-1",
+  uid: kClassOwner, type: "group", key: "dqb-doc-1",
   createdAt: firebase.firestore.Timestamp.now(), context_id: thisClass, network: null,
   unit: kUnit, kind: kClassWideLabel, concurrent: true, ...extra
 });
diff --git a/firebase-test/src/documents-rules.test.ts b/firebase-test/src/documents-rules.test.ts
index 92adb25d74..37f42ab922 100644
--- a/firebase-test/src/documents-rules.test.ts
+++ b/firebase-test/src/documents-rules.test.ts
@@ -30,7 +30,7 @@ describe("Firestore security rules", () => {
   const kDocumentDocPath = "authed/myPortal/documents/myDocument";
 
   interface ISpecDocumentDoc {
-    add?: Record<string, string | string[] | object>;
+    add?: Record<string, string | string[] | object | boolean>;
     remove?: string[];
   }
   function specDocumentDoc(options?: ISpecDocumentDoc) {
@@ -360,6 +360,34 @@ describe("Firestore security rules", () => {
       await expectUpdateToFail(db, kDocumentDocPath, { title: "new-title" });
     });
 
+    it("a class member cannot set concurrent:true on a classmate's non-group document", async () => {
+      // `concurrent` is an authorization input for the history rule (isConcurrentClassDocument), so
+      // granting it here would let a class member hand themselves and every classmate history access
+      // to someone else's document.
+      db = initFirestore(studentAuth);
+      await adminWriteDoc(kDocumentDocPath, specDocumentDoc({ add: { uid: student2Id }}));
+      await expectUpdateToFail(db, kDocumentDocPath, { concurrent: true });
+    });
+
+    it("a class member can set concurrent:true on a classmate's group-typed document", async () => {
+      // The backfill paths (src/lib/db.ts on-open backfill, scripts/backfill-group-document-axes.ts)
+      // merge-update `concurrent` onto pre-existing group documents, so this must keep working.
+      db = initFirestore(studentAuth);
+      await adminWriteDoc(kDocumentDocPath, specDocumentDoc({ add: { uid: student2Id, type: "group" }}));
+      await expectUpdateToSucceed(db, kDocumentDocPath, { concurrent: true });
+    });
+
+    it("a class member cannot clear concurrent on a group document", async () => {
+      // Only the backfills write this field and both write `true`, so clearing it is nobody's
+      // legitimate operation. Allowing it would let any class member strip a group document's shared
+      // history access and its members' Edit button.
+      db = initFirestore(studentAuth);
+      await adminWriteDoc(kDocumentDocPath, specDocumentDoc({
+        add: { uid: student2Id, type: "group", concurrent: true }
+      }));
+      await expectUpdateToFail(db, kDocumentDocPath, { concurrent: false });
+    });
+
     it("authenticated students can't delete documents in their class", async () => {
       db = initFirestore(studentAuth);
       await adminWriteDoc(kDocumentDocPath, specDocumentDoc());
@@ -377,7 +405,7 @@ describe("Firestore security rules", () => {
   describe("history entries", () => {
     const kDocumentHistoryDocPath = `${kDocumentDocPath}/history/myHistoryEntry`;
     interface ISpecHisoryDoc {
-      add?: Record<string, string | string[] | object>;
+      add?: Record<string, string | string[] | object | boolean>;
       remove?: string[];
     }
     function specHistoryEntryDoc(options?: ISpecHisoryDoc) {
@@ -552,6 +580,59 @@ describe("Firestore security rules", () => {
       await expectWriteToSucceed(db, kDocumentHistoryDocPath, specHistoryEntryDoc());
     });
 
+    it("class member can create a history entry on a concurrent document owned by a group", async () => {
+      // A concurrent document's owner is synthetic (`group_<offeringId>_<groupId>` for a group
+      // document, `class_<classHash>` for a class-wide one), so it never equals a real user id.
+      // Every member of the class must still be able to append history to it.
+      db = initFirestore(studentAuth);
+      await adminWriteDoc(kDocumentDocPath, specHistoryEntryParentDoc({
+        add: { uid: "group_myOffering_3", type: "group", concurrent: true, groupId: "3" },
+        remove: ["teachers"]
+      }));
+      await expectWriteToSucceed(db, kDocumentHistoryDocPath, specHistoryEntryDoc());
+    });
+
+    it("class member can create a history entry on a class-wide concurrent document", async () => {
+      db = initFirestore(studentAuth);
+      await adminWriteDoc(kDocumentDocPath, specHistoryEntryParentDoc({
+        add: { uid: `class_${thisClass}`, type: "group", concurrent: true, unit: "sas" },
+        remove: ["teachers"]
+      }));
+      await expectWriteToSucceed(db, kDocumentHistoryDocPath, specHistoryEntryDoc());
+    });
+
+    it("class member can read history on a concurrent document they do not own", async () => {
+      db = initFirestore(studentAuth);
+      await adminWriteDoc(kDocumentDocPath, specHistoryEntryParentDoc({
+        add: { uid: `class_${thisClass}`, type: "group", concurrent: true, unit: "sas" },
+        remove: ["teachers"]
+      }));
+      await adminWriteDoc(kDocumentHistoryDocPath, specHistoryEntryDoc());
+      await expectReadToSucceed(db, kDocumentHistoryDocPath);
+    });
+
+    it("a user outside the class cannot create a history entry on a concurrent document", async () => {
+      db = initFirestore(studentAuth);
+      await adminWriteDoc(kDocumentDocPath, specHistoryEntryParentDoc({
+        add: {
+          uid: "class_someOtherClass", type: "group", concurrent: true, unit: "sas",
+          context_id: otherClass
+        },
+        remove: ["teachers"]
+      }));
+      await expectWriteToFail(db, kDocumentHistoryDocPath, specHistoryEntryDoc());
+    });
+
+    it("a class member still cannot create a history entry on a classmate's single-writer document",
+      async () => {
+        // The concurrent axis is what grants the write, not class membership on its own.
+        db = initFirestore(studentAuth);
+        await adminWriteDoc(kDocumentDocPath, specHistoryEntryParentDoc({
+          add: { uid: student2Id, type: "problemDocument" }, remove: ["teachers"]
+        }));
+        await expectWriteToFail(db, kDocumentHistoryDocPath, specHistoryEntryDoc());
+      });
+
     it ("all updates fail", async () => {
       db = initFirestore();
       await expectUpdateToFail(db, kDocumentHistoryDocPath, {});
diff --git a/firestore.rules b/firestore.rules
index 51f5b5433d..a9a58496df 100644
--- a/firestore.rules
+++ b/firestore.rules
@@ -97,6 +97,28 @@ service cloud.firestore {
       return !affectedFieldsSet.hasAny(readOnlyFieldsSet);
     }
 
+    // TRANSITIONAL: `concurrent` is an authorization input for the history rule below
+    // (isConcurrentClassDocument), so letting any class member set it on any document would let them
+    // grant themselves history access to a classmate's document. It stays writable on `type ==
+    // "group"` documents only, and then only to `true`, because two backfill paths merge-update it onto
+    // pre-existing group documents that predate the field: the on-open backfill in src/lib/db.ts and the
+    // one-shot scripts/backfill-group-document-axes.ts. Both write only `true`, so clearing the field is
+    // nobody's legitimate operation, and permitting it would let a class member strip a group document's
+    // shared history and edit access. `type` itself is read-only (preservesReadOnlyDocumentFields),
+    // so it cannot be flipped first to unlock this. Once both backfill paths have run against every
+    // environment, this function should be deleted and `concurrent` added to
+    // preservesReadOnlyDocumentFields's readOnlyFieldsSet, making it settable only at document creation —
+    // which also requires constraining isValidDocumentCreateRequest below: today it constrains neither
+    // `concurrent` nor `uid`, so a class member can create a new document stamped with a classmate's `uid`
+    // and `concurrent: true`. A truthy `concurrent` at create should imply `type == "group"`, and/or the
+    // create should require userIsRequestUser().
+    function concurrentChangeOk() {
+      let affectedFieldsSet = request.resource.data.diff(resource.data).affectedKeys();
+      return !affectedFieldsSet.hasAny(["concurrent"].toSet())
+        || (resource.data.get("type", "") == "group"
+            && request.resource.data.get("concurrent", false) == true);
+    }
+
     function isValidSupportCreateRequest() {
       return userIsRequestUser() &&
               classInRequestClasses() &&
@@ -165,7 +187,7 @@ service cloud.firestore {
       }
 
       function isValidDocumentUpdateRequest() {
-        return preservesReadOnlyDocumentFields() &&
+        return preservesReadOnlyDocumentFields() && concurrentChangeOk() &&
                ( resourceInUserClass() || userInResourceTeachers() );
       }
 
@@ -359,32 +381,39 @@ service cloud.firestore {
       }
 
       match /documents/{docId} {
-        // A scope field counts only when it holds a non-empty string. A field written as null counts as
-        // absent scope.
-        function hasScopeField(data, key) {
+        // An association field counts as present only when it holds a non-empty string. A field written as
+        // null counts as absent, not as a value: class-contained docs (personal, learning-log) store
+        // `unit: null`, and a bare `!= ""` test would read that null as present (`null != ""` in rules).
+        function hasPresentField(data, key) {
           return data.get(key, "") is string && data.get(key, "") != "";
         }
 
-        // A document's scope is read from the association fields it carries, not from its `type`.
-        // True when `data`'s scope can hold a canonical pointer: it is anchored to an offering or a unit.
-        // (class+owner-only scopes — personal, learning-log — have no canonical pointer.)
-        function hasCanonicalScope(data) {
-          return hasScopeField(data, "offeringId") || hasScopeField(data, "unit");
-        }
-
-        // The path of the canonical-pointer slot for `data`'s scope, or null if `data`'s scope has no canonical
-        // shape. Pointers live in a dedicated, versioned collection (canonical/v1/…); below the version the path
-        // is built segment-by-segment from the scope fields the document carries, so all scopes share one layout.
-        // Keep in lockstep with getCanonicalPointerPath in scoped-document-pointers.ts:
-        //   canonical/v1/classes/<context_id> / (offerings/<offeringId> | units/<unit>) / [groups/<groupId>] / slots/<label>
-        // The units segment is used only when there is no offering (an offering already pins a unit). A future
-        // problem/planning pointer will add a /users/<owner> segment after the offering.
+        // A document's container is read from the association fields it carries, not from its `type`.
+        // True when `data` is kept somewhere that can hold a canonical pointer: an offering or a unit.
+        // A document kept by the class alone (personal, learning-log) has no canonical pointer — a
+        // class-level slot would be a valid shape, but no create block grants one, so none can exist.
+        function hasCanonicalContainer(data) {
+          return hasPresentField(data, "offeringId") || hasPresentField(data, "unit");
+        }
+
+        // The path of `data`'s canonical-pointer slot, or null when `data` is kept somewhere that has no
+        // canonical shape. A slot is a container plus an owner plus a label. Pointers live in a dedicated,
+        // versioned collection (canonical/v1/…); below the version the path is built segment-by-segment
+        // from the fields the document carries. Keep in lockstep with getCanonicalPointerPath in
+        // scoped-document-pointers.ts:
+        //   canonical/v1/classes/<context_id> / [offerings/<offeringId> | units/<unit>] / owners/<uid> / slots/<label>
+        // Each container names only itself: an offering contributes its own id, not the classUnit it falls
+        // inside, so a new container level can be added later without moving the pointers that exist
+        // (pointers are immutable — no block below grants update or delete).
+        // The owner segment is the document's `uid`, synthetic owners included (`group_<offeringId>_<groupId>`,
+        // `class_<classHash>`). Reading the owner straight from `uid` is what keeps a group's identity out of
+        // this path construction: no groupId, and no owner type to infer.
         function canonicalPointerPath(portal, data, label) {
-          return hasCanonicalScope(data)
+          return hasCanonicalContainer(data)
             ? path("/databases/" + database + "/documents/authed/" + portal
                 + "/canonical/v1/classes/" + data.context_id
-                + (hasScopeField(data, "offeringId") ? "/offerings/" + data.offeringId : "/units/" + data.unit)
-                + (hasScopeField(data, "groupId") ? "/groups/" + data.groupId : "")
+                + (hasPresentField(data, "offeringId") ? "/offerings/" + data.offeringId : "/units/" + data.unit)
+                + "/owners/" + data.uid
                 + "/slots/" + label)
             : null;
         }
@@ -513,6 +542,16 @@ service cloud.firestore {
           return getDocumentOwner() == string(request.auth.token.platform_user_id);
         }
 
+        // A concurrent (multi-writer) document has a synthetic owner — `group_<offeringId>_<groupId>`
+        // or `class_<classHash>` — that never equals a real user id, so ownership cannot authorize
+        // its history. Every member of the document's class may append to it instead. This does not
+        // narrow a group document's history to its own group: the auth token carries no group id.
+        function isConcurrentClassDocument() {
+          let docData = getDocumentData();
+          return docData.get("concurrent", false) == true
+            && request.auth.token.class_hash == docData.context_id;
+        }
+
         function hasDocumentAccess() {
           return teacherCanAccessDocument() || researcherCanAccessDocument() || userCanAccessDocument();
         }
@@ -527,8 +566,9 @@ service cloud.firestore {
 
         // For writing individual history entries
         match /history/{entryId} {
-          allow create: if isAuthed() && userOwnsDocument();
-          allow read: if (isAuthed() && userOwnsDocument()) || teacherCanAccessDocument() || researcherCanAccessDocument();
+          allow create: if isAuthed() && (userOwnsDocument() || isConcurrentClassDocument());
+          allow read: if (isAuthed() && (userOwnsDocument() || isConcurrentClassDocument()))
+            || teacherCanAccessDocument() || researcherCanAccessDocument();
           allow delete: if false;
           allow update: if false;
         }
@@ -633,13 +673,16 @@ service cloud.firestore {
       }
 
       // Canonical-document pointers live in a dedicated, versioned collection (canonical/v1/…), not interleaved
-      // in the class/offering/group tree. Read and immutability are uniform across every scope, so they are
-      // stated once on the recursive wildcard below; create stays per-scope so each scope can authorize who may
-      // claim its slot (a single wildcard create could not be tightened per-scope — Firestore ORs allow rules).
+      // in the class/offering document tree. Read and immutability are uniform across every container, so they
+      // are stated once on the recursive wildcard below; create stays per-container so each container can
+      // authorize who may claim its slots (a single wildcard create could not be tightened per-container —
+      // Firestore ORs allow rules).
+      // The class leads the path because this read rule compares that segment to the caller's class claim; a
+      // synthetic group owner id could not supply the class.
       // Keep these paths in lockstep with getCanonicalPointerPath in scoped-document-pointers.ts.
       match /canonical/v1/classes/{classId} {
-        // Uniform for every scope: any class member may read their class's pointers; pointers are immutable.
-        match /{scopePath=**} {
+        // Uniform for every container: any class member may read their class's pointers; pointers are immutable.
+        match /{slotPath=**} {
           allow read:           if isAuthed() && request.auth.token.class_hash == classId;
           allow update, delete: if false;   // no block grants these — pointers are immutable
         }
@@ -650,12 +693,15 @@ service cloud.firestore {
             && request.resource.data.keys().hasAll(["documentKey", "createdAt", "createdBy"]);
         }
 
-        // Create is granted only per-scope, so each scope authorizes its own slot claim; a create at any path not
-        // matched by one of these blocks is denied by default (a new scope must add its own create block).
-        match /offerings/{offeringId}/groups/{groupId}/slots/{label} {
+        // Create is granted only per-container, so each container authorizes its own slot claims; a create at any
+        // path not matched by one of these blocks is denied by default. One block per container level, covering
+        // every owner: which owner may claim a slot is settled on the document side, where canonicalFieldOk
+        // requires the pointer at the path built from that document's own `uid` to already name it.
+        // A class-level slot (classes/<classId>/owners/<uid>/slots/<label>) has no block, so none can be created.
+        match /offerings/{offeringId}/owners/{ownerId}/slots/{label} {
           allow create: if canonicalPointerCreatable();
         }
-        match /units/{unit}/slots/{label} {
+        match /units/{unit}/owners/{ownerId}/slots/{label} {
           allow create: if canonicalPointerCreatable();
         }
       }
diff --git a/scripts/backfill-group-concurrent.test.ts b/scripts/backfill-group-concurrent.test.ts
deleted file mode 100644
index 0b38b22d85..0000000000
--- a/scripts/backfill-group-concurrent.test.ts
+++ /dev/null
@@ -1,46 +0,0 @@
-import type { Firestore } from "firebase-admin/firestore";
-import { backfillGroupConcurrent } from "./backfill-group-concurrent";
-
-// Minimal Firestore-admin stand-in: a collection-group query returning canned docs, and a batch recorder.
-function makeDb(docs: any[]) {
-  const writes: any[] = [];
-  const batch = {
-    set: (ref: any, data: any, opts: any) => { writes.push({ ref, data, opts }); },
-    commit: () => Promise.resolve(),
-  };
-  return {
-    writes,
-    collectionGroup: () => ({
-      where: () => ({ get: () => Promise.resolve({ size: docs.length, docs }) }),
-    }),
-    batch: () => batch,
-  };
-}
-const mkDoc = (key: string, concurrent?: boolean) => ({
-  ref: { path: `authed/p/documents/${key}` },
-  get: (field: string) => (field === "concurrent" ? concurrent : undefined),
-});
-
-describe("backfillGroupConcurrent", () => {
-  it("dry run reports counts and writes nothing", async () => {
-    const db = makeDb([mkDoc("a"), mkDoc("b", true)]);
-    const res = await backfillGroupConcurrent(db as unknown as Firestore, { dryRun: true, log: () => undefined });
-    expect(res).toEqual({ total: 2, updated: 0 });
-    expect(db.writes.length).toBe(0);
-  });
-
-  it("APPLY writes concurrent+kind only to group docs missing concurrent", async () => {
-    const db = makeDb([mkDoc("a"), mkDoc("b", true), mkDoc("c")]);
-    const res = await backfillGroupConcurrent(db as unknown as Firestore, { dryRun: false, log: () => undefined });
-    expect(res).toEqual({ total: 3, updated: 2 });
-    expect(db.writes.map((w: any) => w.ref.path)).toEqual(["authed/p/documents/a", "authed/p/documents/c"]);
-    expect(db.writes[0]).toMatchObject({ data: { concurrent: true, kind: "group" }, opts: { merge: true } });
-  });
-
-  it("is idempotent — a fully-migrated set writes nothing", async () => {
-    const db = makeDb([mkDoc("a", true), mkDoc("b", true)]);
-    const res = await backfillGroupConcurrent(db as unknown as Firestore, { dryRun: false, log: () => undefined });
-    expect(res).toEqual({ total: 2, updated: 0 });
-    expect(db.writes.length).toBe(0);
-  });
-});
diff --git a/scripts/backfill-group-concurrent.ts b/scripts/backfill-group-concurrent.ts
deleted file mode 100644
index 85e20ad346..0000000000
--- a/scripts/backfill-group-concurrent.ts
+++ /dev/null
@@ -1,77 +0,0 @@
-// Backfill the `concurrent` axis onto pre-existing group documents.
-//
-// Group documents created before the `concurrent` field existed have no stored `concurrent`, so their
-// history manager would run in single-writer mode. This stamps `{ concurrent: true, kind: "group" }` onto
-// every `type == "group"` document that lacks `concurrent`. Additive, idempotent, batched.
-//
-// Requires a Firebase service account key at scripts/serviceAccountKey.json (see scripts/README.md). The
-// `documents` collection-group query needs a single-field COLLECTION_GROUP index on `type`
-// (firestore.indexes.json; deploy with `firebase deploy --only firestore:indexes`, or use the one-click link
-// Firestore prints on first run).
-//
-// Dry run (reports counts, writes nothing):   cd scripts && npx tsx backfill-group-concurrent.ts
-// Apply (performs the writes):                cd scripts && APPLY=1 npx tsx backfill-group-concurrent.ts
-
-import type { Firestore } from "firebase-admin/firestore";
-
-export interface BackfillResult {
-  total: number;
-  updated: number;
-}
-
-/**
- * Stamp `{ concurrent: true, kind: "group" }` onto every `type == "group"` document missing `concurrent`.
- * Pure (no admin initialization) so it can be unit-tested with a mock Firestore.
- */
-export async function backfillGroupConcurrent(
-  db: Firestore,
-  { dryRun = true, log = console.log }: { dryRun?: boolean; log?: (message: string) => void } = {}
-): Promise<BackfillResult> {
-  const snap = await db.collectionGroup("documents").where("type", "==", "group").get();
-  const needing = snap.docs.filter((d) => d.get("concurrent") !== true);
-  log(`group docs: ${snap.size} total, ${needing.length} missing concurrent`);
-  if (dryRun) {
-    log("DRY RUN — set APPLY=1 to write");
-    return { total: snap.size, updated: 0 };
-  }
-
-  let batch = db.batch();
-  let n = 0;
-  let updated = 0;
-  for (const doc of needing) {
-    batch.set(doc.ref, { concurrent: true, kind: "group" }, { merge: true });
-    if (++n === 400) {
-      await batch.commit();
-      updated += n;
-      batch = db.batch();
-      n = 0;
-    }
-  }
-  if (n > 0) {
-    await batch.commit();
-    updated += n;
-  }
-  log(`updated ${updated} documents`);
-  return { total: snap.size, updated };
-}
-
-async function main() {
-  // Imported lazily so the Jest test can import backfillGroupConcurrent without loading firebase-admin
-  // or the import.meta-using script-utils module.
-  const admin = (await import("firebase-admin")).default;
-  const { getScriptRootFilePath } = await import("./lib/script-utils.js");
-  admin.initializeApp({
-    credential: admin.credential.cert(getScriptRootFilePath("serviceAccountKey.json")),
-  });
-  const result = await backfillGroupConcurrent(admin.firestore(), { dryRun: process.env.APPLY !== "1" });
-  console.log("done", result);
-  process.exit(0);
-}
-
-// Run only when invoked directly (via tsx), never when imported by the Jest test.
-if (!process.env.JEST_WORKER_ID) {
-  main().catch((err) => {
-    console.error(err);
-    process.exit(1);
-  });
-}
diff --git a/scripts/backfill-group-document-axes.test.ts b/scripts/backfill-group-document-axes.test.ts
new file mode 100644
index 0000000000..0c8cac251a
--- /dev/null
+++ b/scripts/backfill-group-document-axes.test.ts
@@ -0,0 +1,81 @@
+import type { Firestore } from "firebase-admin/firestore";
+import { backfillGroupDocumentAxes } from "./backfill-group-document-axes";
+
+// Minimal Firestore-admin stand-in: a collection-group query returning canned docs, and a batch recorder.
+function makeDb(docs: any[]) {
+  const writes: any[] = [];
+  const batch = {
+    set: (ref: any, data: any, opts: any) => { writes.push({ ref, data, opts }); },
+    commit: () => Promise.resolve(),
+  };
+  return {
+    writes,
+    collectionGroup: () => ({
+      where: () => ({ get: () => Promise.resolve({ size: docs.length, docs }) }),
+    }),
+    batch: () => batch,
+  };
+}
+
+// A group-scoped document: carries a groupId.
+const mkGroupDoc = (key: string, concurrent?: boolean) => ({
+  ref: { path: `authed/p/documents/${key}` },
+  get: (field: string) => ({ concurrent, groupId: "3" } as Record<string, any>)[field],
+});
+// A class-wide document: no groupId. `fields` supplies whatever scope fields it already has.
+const mkClassWideDoc = (key: string, fields: Record<string, any> = {}) => ({
+  ref: { path: `authed/p/documents/${key}` },
+  get: (field: string) => ({ concurrent: true, ...fields } as Record<string, any>)[field],
+});
+
+const quiet = { log: () => undefined };
+
+describe("backfillGroupDocumentAxes", () => {
+  it("dry run reports both passes and writes nothing", async () => {
+    const db = makeDb([mkGroupDoc("a"), mkGroupDoc("b", true), mkClassWideDoc("c")]);
+    const res = await backfillGroupDocumentAxes(db as unknown as Firestore, { dryRun: true, ...quiet });
+    expect(res).toEqual({ total: 3, concurrentUpdated: 0, scopeUpdated: 0 });
+    expect(db.writes.length).toBe(0);
+  });
+
+  it("stamps concurrent+kind only on group-scoped docs missing concurrent", async () => {
+    const db = makeDb([mkGroupDoc("a"), mkGroupDoc("b", true), mkGroupDoc("c")]);
+    const res = await backfillGroupDocumentAxes(db as unknown as Firestore, { dryRun: false, ...quiet });
+    expect(res).toEqual({ total: 3, concurrentUpdated: 2, scopeUpdated: 0 });
+    expect(db.writes.map((w: any) => w.ref.path)).toEqual(["authed/p/documents/a", "authed/p/documents/c"]);
+    expect(db.writes[0]).toMatchObject({ data: { concurrent: true, kind: "group" }, opts: { merge: true } });
+  });
+
+  it("stamps null curriculum scope only on class-wide docs that lack it", async () => {
+    const db = makeDb([
+      mkClassWideDoc("old"),                                       // needs both fields
+      mkClassWideDoc("new", { investigation: null, problem: null }) // already migrated
+    ]);
+    const res = await backfillGroupDocumentAxes(db as unknown as Firestore, { dryRun: false, ...quiet });
+    expect(res).toEqual({ total: 2, concurrentUpdated: 0, scopeUpdated: 1 });
+    expect(db.writes).toEqual([{
+      ref: { path: "authed/p/documents/old" },
+      data: { investigation: null, problem: null },
+      opts: { merge: true }
+    }]);
+  });
+
+  it("never stamps the group kind onto a class-wide document", async () => {
+    // A class-wide document that somehow lacks `concurrent` must not be swept into the group pass:
+    // kind:"group" would break both its title resolution and its canonical-pointer slot.
+    const db = makeDb([mkClassWideDoc("cw", { concurrent: undefined })]);
+    const res = await backfillGroupDocumentAxes(db as unknown as Firestore, { dryRun: false, ...quiet });
+    expect(res.concurrentUpdated).toBe(0);
+    expect(db.writes.every((w: any) => w.data.kind === undefined)).toBe(true);
+  });
+
+  it("is idempotent — a fully-migrated set writes nothing", async () => {
+    const db = makeDb([
+      mkGroupDoc("a", true),
+      mkClassWideDoc("c", { investigation: null, problem: null })
+    ]);
+    const res = await backfillGroupDocumentAxes(db as unknown as Firestore, { dryRun: false, ...quiet });
+    expect(res).toEqual({ total: 2, concurrentUpdated: 0, scopeUpdated: 0 });
+    expect(db.writes.length).toBe(0);
+  });
+});
diff --git a/scripts/backfill-group-document-axes.ts b/scripts/backfill-group-document-axes.ts
new file mode 100644
index 0000000000..deab4c6232
--- /dev/null
+++ b/scripts/backfill-group-document-axes.ts
@@ -0,0 +1,115 @@
+// Normalize the stored axes of `type == "group"` documents — both regular group documents and
+// class-wide collaborative documents, which share that transitional type.
+//
+// Two independent passes over one collection-group query, selected by scope so they cover disjoint
+// sets. A group-scoped document carries a groupId; a class-wide document does not.
+//
+//   group-scoped, missing `concurrent`      -> { concurrent: true, kind: "group" }
+//   class-wide, missing curriculum scope    -> { investigation: null, problem: null }
+//
+// The first pass restores the concurrent history manager for group documents that carry no stored
+// `concurrent` value. The second states a class-wide document's absent curriculum scope
+// explicitly, which is what makes it findable by Sort Work's unit-scoped query. Both are additive,
+// idempotent, and batched.
+//
+// Requires a Firebase service account key at scripts/serviceAccountKey.json (see scripts/README.md).
+// The `documents` collection-group query needs a single-field COLLECTION_GROUP index on `type`
+// (firestore.indexes.json; deploy with `firebase deploy --only firestore:indexes`, or use the
+// one-click link Firestore prints on first run).
+//
+// Dry run (reports counts, writes nothing):   cd scripts && npx tsx backfill-group-document-axes.ts
+// Apply (performs the writes):                cd scripts && APPLY=1 npx tsx backfill-group-document-axes.ts
+//
+// This script authenticates as a service account, so it writes past Firestore rules regardless of
+// what they allow. The client-side backfill in src/lib/db.ts does not: it merge-updates `concurrent`
+// as an ordinary authenticated user, which is why the Firestore rule (concurrentChangeOk in
+// firestore.rules) transitionally allows any class member to set `concurrent` on a `type == "group"`
+// document. Once this script has been run against every environment, tighten that rule so
+// `concurrent` is settable only at document creation, and delete concurrentChangeOk — and constrain
+// isValidDocumentCreateRequest in firestore.rules alongside it, since it constrains neither
+// `concurrent` nor `uid` today: a truthy `concurrent` at create should imply `type == "group"`,
+// and/or the create should require userIsRequestUser(), or a class member can create a new document
+// stamped with a classmate's `uid` and `concurrent: true`.
+//
+// The first pass also unblocks a second cleanup: getDocumentTitle (src/models/document/document-kinds.ts)
+// selects the group-document title on `type == "group"` plus a groupId, because a group document may carry
+// no `kind`. Once every group document has one, that check becomes `kind == "group"`.
+
+import type { Firestore } from "firebase-admin/firestore";
+
+export interface BackfillResult {
+  total: number;
+  concurrentUpdated: number;
+  scopeUpdated: number;
+}
+
+/**
+ * Run both backfill passes. Pure (no admin initialization) so it can be unit-tested with a mock
+ * Firestore.
+ */
+export async function backfillGroupDocumentAxes(
+  db: Firestore,
+  { dryRun = true, log = console.log }: { dryRun?: boolean; log?: (message: string) => void } = {}
+): Promise<BackfillResult> {
+  const snap = await db.collectionGroup("documents").where("type", "==", "group").get();
+
+  // Select each pass by scope, not by the value it is about to write: a partial write could leave a
+  // class-wide document without `concurrent`, and stamping it kind:"group" would break both its
+  // title resolution and its canonical-pointer slot (the slot label is the kind).
+  const needingConcurrent = snap.docs.filter((d) => !!d.get("groupId") && d.get("concurrent") !== true);
+  const needingScope = snap.docs.filter((d) =>
+    !d.get("groupId") && (d.get("investigation") === undefined || d.get("problem") === undefined));
+
+  log(`group-typed docs: ${snap.size} total, ` +
+      `${needingConcurrent.length} missing concurrent, ${needingScope.length} missing curriculum scope`);
+  if (dryRun) {
+    log("DRY RUN — set APPLY=1 to write");
+    return { total: snap.size, concurrentUpdated: 0, scopeUpdated: 0 };
+  }
+
+  const writes = [
+    ...needingConcurrent.map((d) => ({ ref: d.ref, data: { concurrent: true, kind: "group" } })),
+    ...needingScope.map((d) => ({ ref: d.ref, data: { investigation: null, problem: null } })),
+  ];
+
+  let batch = db.batch();
+  let n = 0;
+  for (const write of writes) {
+    batch.set(write.ref, write.data, { merge: true });
+    if (++n % 400 === 0) {
+      await batch.commit();
+      batch = db.batch();
+    }
+  }
+  if (n % 400 !== 0) {
+    await batch.commit();
+  }
+
+  log(`updated ${needingConcurrent.length} concurrent, ${needingScope.length} curriculum scope`);
+  return {
+    total: snap.size,
+    concurrentUpdated: needingConcurrent.length,
+    scopeUpdated: needingScope.length,
+  };
+}
+
+async function main() {
+  // Imported lazily so the Jest test can import backfillGroupDocumentAxes without loading
+  // firebase-admin or the import.meta-using script-utils module.
+  const admin = (await import("firebase-admin")).default;
+  const { getScriptRootFilePath } = await import("./lib/script-utils.js");
+  admin.initializeApp({
+    credential: admin.credential.cert(getScriptRootFilePath("serviceAccountKey.json")),
+  });
+  const result = await backfillGroupDocumentAxes(admin.firestore(), { dryRun: process.env.APPLY !== "1" });
+  console.log("done", result);
+  process.exit(0);
+}
+
+// Run only when invoked directly (via tsx), never when imported by the Jest test.
+if (!process.env.JEST_WORKER_ID) {
+  main().catch((err) => {
+    console.error(err);
+    process.exit(1);
+  });
+}
diff --git a/shared/shared.ts b/shared/shared.ts
index 8c12f3237a..b695529ca2 100644
--- a/shared/shared.ts
+++ b/shared/shared.ts
@@ -141,11 +141,12 @@ export interface IDocumentMetadataBase {
   unit?: string|null;
   offeringId?: string|null;
   groupId?: string|null;
+  context_id?: string|null;
+  concurrent?: boolean|null;
 }
 
 export interface IDocumentMetadata extends IDocumentMetadataBase {
   createdAt?: number;
-  context_id?: string|null;
   network?: string|null;
   originDoc?: string|null;
   properties?: Record<string, string>;
@@ -155,7 +156,6 @@ export interface IDocumentMetadata extends IDocumentMetadataBase {
     id: string;
     index: number;
   }|null;
-  concurrent?: boolean|null;
   kind?: string|null;
 }
 export function isDocumentMetadata(o: any): o is IDocumentMetadata {
diff --git a/src/components/navigation/document-view.tsx b/src/components/navigation/document-view.tsx
index 6decf6af16..5c74a764c7 100644
--- a/src/components/navigation/document-view.tsx
+++ b/src/components/navigation/document-view.tsx
@@ -5,7 +5,7 @@ import classNames from "classnames";
 import { useAppConfig, useLocalDocuments, useStores,
   usePersistentUIStore } from "../../hooks/use-stores";
 import { useUserContext } from "../../hooks/use-user-context";
-import { isDocumentAccessibleToUser } from "../../models/document/document-utils";
+import { canUserEditDocument, isDocumentAccessibleToUser } from "../../models/document/document-utils";
 import { ISubTabModel, NavTabModelType, kBookmarksTabTitle } from "../../models/view/nav-tabs";
 import { DocumentType } from "../../models/document/document-types";
 import { logDocumentViewEvent } from "../../models/document/log-document-event";
@@ -228,7 +228,7 @@ const DocumentArea = ({openDocument, subTab, tab, sectionClass, isVisible, isSec
   const {appConfig, persistentUI, ui, user} = useStores();
   const showPlayback = user.type && !openDocument?.isPublished
                           ? appConfig.enableHistoryRoles.includes(user.type) : false;
-  const showEdit = !openDocument.isRemote && ((tab === "my-work") || (tab === "learningLog"));
+  const showEdit = !openDocument.isRemote && canUserEditDocument({ document: openDocument, user });
 
   function handleCloseButtonClick() {
     persistentUI.closeDocumentGroupPrimaryDocument();
diff --git a/src/components/thumbnail/simple-document-item.test.tsx b/src/components/thumbnail/simple-document-item.test.tsx
index d638a477e1..f481abc80f 100644
--- a/src/components/thumbnail/simple-document-item.test.tsx
+++ b/src/components/thumbnail/simple-document-item.test.tsx
@@ -5,20 +5,31 @@ import React from "react";
 import { SimpleDocumentItem } from "./simple-document-item";
 import { DocumentMetadataModel, IDocumentMetadataModel } from "../../models/document/document-metadata-model";
 import { ProblemDocument } from "../../models/document/document-types";
+import { ClassModel } from "../../models/stores/class";
 import { specStores } from "../../models/stores/spec-stores";
 import { UserModel } from "../../models/stores/user";
 
 interface IRenderOptions {
   isPrivate?: boolean;
   selected?: boolean;
+  /** Overrides the document's owner, for owners who are not members of the class. */
+  uid?: string;
   onSelectDocument?: (document: IDocumentMetadataModel) => void;
 }
 
 function renderItem(options: IRenderOptions = {}) {
   const { isPrivate = false, selected = false, onSelectDocument = jest.fn() } = options;
-  const ownerId = isPrivate ? "other-user" : "test-student";
+  const ownerId = options.uid ?? (isPrivate ? "other-user" : "test-student");
   const user = UserModel.create({ id: "test-student", type: "student", name: "Test Student" });
-  const stores = specStores({ user });
+  const clazz = ClassModel.create({
+    name: "Test Class",
+    classHash: "test-class-hash",
+    users: {
+      "test-student": { type: "student", id: "test-student", firstName: "Test", lastName: "Student",
+                        fullName: "Test Student", initials: "TS" }
+    }
+  });
+  const stores = specStores({ user, class: clazz });
   const document = DocumentMetadataModel.create({
     type: ProblemDocument,
     title: "Test Document",
@@ -50,6 +61,18 @@ describe("SimpleDocumentItem", () => {
     expect(item.getAttribute("aria-label")).toBe(item.getAttribute("title"));
   });
 
+  it("names a document by its owner and title, and one whose owner is not in the class by title alone", () => {
+    // Group and class-wide documents are owned by a synthetic uid (`group_<offeringId>_<groupId>`,
+    // `class_<classHash>`) that belongs to no class member, and their titles already say whose they are.
+    const memberLabel = renderItem().item.getAttribute("aria-label");
+    const syntheticOwnerItem = renderItem({ uid: "class_test-class-hash" }).item;
+    const syntheticLabel = syntheticOwnerItem.getAttribute("aria-label");
+
+    expect(memberLabel).toBe(`Test Student: ${syntheticLabel}`);
+    expect(syntheticLabel).not.toContain("undefined");
+    expect(syntheticOwnerItem.getAttribute("title")).toBe(syntheticLabel);
+  });
+
   it("identifies which document it stands for, the same way a thumbnail does", () => {
     const { item, document } = renderItem();
     expect(item).toHaveAttribute("data-document-key", document.key);
diff --git a/src/components/thumbnail/simple-document-item.tsx b/src/components/thumbnail/simple-document-item.tsx
index 2f088e0b6f..1ca4d80be1 100644
--- a/src/components/thumbnail/simple-document-item.tsx
+++ b/src/components/thumbnail/simple-document-item.tsx
@@ -19,7 +19,11 @@ export const SimpleDocumentItem = observer(function SimpleDocumentItem(
   const { uid } = document;
   const userName = classStore.getUserById(uid)?.displayName;
   const title = getDocumentDisplayTitle(unit, document, appConfig);
-  const titleWithUser = `${userName}: ${title}`;
+  // A document several people edit together is owned by a synthetic uid — `group_<offeringId>_<groupId>` or
+  // `class_<classHash>` — which is no member of the class, so there is no name to put in front of it. Its
+  // title already says whose it is ("Group 1 Document"). A title can also be absent, so join whichever parts
+  // resolve rather than interpolating both.
+  const titleWithUser = [userName, title].filter(Boolean).join(": ");
   const isPrivate = !isDocumentAccessibleToUser({ documentMetadata: document, user, documents });
   const selected = ui.highlightedSortWorkDocument === document.key;
 
diff --git a/src/lib/db-listeners/db-groups-listener.ts b/src/lib/db-listeners/db-groups-listener.ts
index 827d969e52..b7c7a181b4 100644
--- a/src/lib/db-listeners/db-groups-listener.ts
+++ b/src/lib/db-listeners/db-groups-listener.ts
@@ -93,8 +93,8 @@ export class DBGroupsListener extends BaseListener {
   };
 
   private async updateGroupsFromDb(dbGroups: DBOfferingGroupMap) {
-    const {groups, class: clazz, portal} = this.db.stores;
-    groups.updateFromDB(dbGroups);
+    const {groups, class: clazz, portal, user} = this.db.stores;
+    groups.updateFromDB(dbGroups, user.offeringId);
     if (!groups.needToRefreshClass) return;
 
     // FIXME: if a user has launched CLUE and then the teacher removes them from the class, they can
diff --git a/src/lib/db.test.ts b/src/lib/db.test.ts
index 86aa0609e0..41fab19578 100644
--- a/src/lib/db.test.ts
+++ b/src/lib/db.test.ts
@@ -416,10 +416,10 @@ describe("db", () => {
   describe("class-wide document creation", () => {
     it("createFirestoreMetadataDocument stamps class+unit scope, kind, and concurrent (but not title)", async () => {
       // The kind must be registered as class-scoped so getDocumentKindMetadataFields returns its axis fields and
-      // getDocumentScopeFields returns the class `unit` (read from the stores' current unit). The authored title
+      // getDocumentLocationFields returns the class `unit` (read from the stores' current unit). The authored title
       // is registered too, to prove it is resolved by kind and NOT persisted into the Firestore metadata.
       registerDocumentKind("drivingQuestionBoard", {
-        metadataFields: { concurrent: true }, ownerType: "class", scopeType: "classUnit",
+        metadataFields: { concurrent: true }, ownerType: "class", containerType: "classUnit",
         title: "Driving Question Board"
       });
       // Rebuild stores with the classHash (→ context_id) and the current unit code the class-wide scope uses.
@@ -456,6 +456,12 @@ describe("db", () => {
         kind: "drivingQuestionBoard", concurrent: true, uid: "class_class-1"
       });
       expect(setPayloads[0].title).toBeUndefined();
+      // The class+unit scope states its absent curriculum fields explicitly so the scope is
+      // queryable; it must still carry no offering or group.
+      expect(setPayloads.some((d: any) =>
+        d.investigation === null && d.problem === null &&
+        d.offeringId === undefined && d.groupId === undefined
+      )).toBe(true);
     });
   });
 
@@ -472,6 +478,12 @@ describe("db", () => {
       });
       (db as any).openDocumentFromFirestoreMetadata = openStub;
       (db as any).findFirestoreMetadata = jest.fn(async (k: string) => ({ key: k }));
+      // createDeclaredClassWideDocuments registers a declared kind before asking for its document, and
+      // getDocumentOwner throws for an unregistered kind rather than defaulting the owner to the caller.
+      registerDocumentKind("drivingQuestionBoard", {
+        metadataFields: { concurrent: true }, ownerType: "class", containerType: "classUnit",
+        title: "DQB", unit: "msu"
+      });
     });
 
     it("fast path: opens the pointer's documentKey when the class+unit pointer exists", async () => {
diff --git a/src/lib/db.ts b/src/lib/db.ts
index 7c3539ee89..2d512151cf 100644
--- a/src/lib/db.ts
+++ b/src/lib/db.ts
@@ -33,9 +33,10 @@ import { LogEventName } from "./logger-types";
 import { getSimpleDocumentPath, IDocumentMetadata, IGetImageDataParams,
          IPublishSupportParams } from "../../shared/shared";
 import {
-  getDocumentKindMetadataFields, getDocumentOwner, getDocumentOwnerType, getDocumentScopeFields,
-  registerClassWideDocumentKind
+  getDocumentKindMetadataFields, getDocumentLocationFields, getDocumentOwner, getDocumentOwnerFields,
+  getDocumentOwnerType, IDocumentOwnerContext, registerClassWideDocumentKind
 } from "../models/document/document-kinds";
+import { getClassOwnerId } from "../models/document/document-axes";
 import { getFirebaseFunction } from "../hooks/use-firebase-function";
 import { IStores } from "../models/stores/stores";
 import { TeacherSupportModelType, SectionTarget, AudienceModelType } from "../models/stores/supports";
@@ -110,10 +111,12 @@ export interface OpenDocumentOptions {
 }
 
 interface IGetOrCreateCanonicalDocumentOpts {
-  // Firestore path of the pointer slot for this scope.
-  pointerPath: string;
-  // The pointer slot's label. It must match the final segment of pointerPath and is written to the
-  // winning document's `canonical` field.
+  // The container holding the slot: the class, plus that container's own id when the document is kept
+  // below the class. The slot's owner is not passed — it is derived from `kind`, the same way the
+  // document's own `uid` is, so the pointer path and the document can never name different owners.
+  container: { classHash: string; offeringId?: string; unit?: string };
+  // The pointer slot's label. It is the path's final segment and is written to the winning document's
+  // `canonical` field.
   canonicalLabel: string;
   // The document's stored `type` (transitional) and its `kind` axis. They coincide today for group documents;
   // a class-wide document keeps type === GroupDocument while its kind is the declared kind. The kind also drives
@@ -598,17 +601,19 @@ export class DB {
       return docSnapshot.data() as IDocumentMetadata;
     }
 
-    // Resolve every scope field (context_id, unit/investigation/problem, offering/group association) from the
-    // kind's registered scope. The runtime values come from the stores; they are valid here because
-    // createDocument validated them via validateDocumentKindCreation before writing (a group kind requires the
-    // user to be in a group, so currentGroupId is present).
-    const scopeFields = getDocumentScopeFields(kind, {
+    // Resolve where the document is kept and what it is about (context_id, unit/investigation/problem,
+    // offeringId) from the kind's registered container.
+    const locationFields = getDocumentLocationFields(kind, {
       ...this.currentProblemInfo,
       context_id: user.classHash,
       offeringId: user.offeringId,
-      groupId: user.currentGroupId,
     });
 
+    // The owner's stored fields beyond `uid`: a group owner's `groupId`. The runtime value comes from the
+    // stores; it is valid here because createDocument validated it via validateDocumentKindCreation before
+    // writing (a group kind requires the user to be in a group, so currentGroupId is present).
+    const ownerFields = getDocumentOwnerFields(kind, user.currentGroupId);
+
     // `title` is stamped only when present so Firestore never sees `title: undefined`.
     const titleInfo: { title?: string } = {};
     if (title != null) {
@@ -616,7 +621,7 @@ export class DB {
     }
 
     // Stamp the kind's axis fields (kind + concurrent), but only on type:"group" documents (group + class-wide).
-    // Every kind is registered now for scope/owner resolution, yet we deliberately do NOT persist `kind` on
+    // Every kind is registered now for location/owner resolution, yet we deliberately do NOT persist `kind` on
     // other docs' Firestore metadata yet. We might change the list of kinds when we add full support for the
     // other document types, so we don't want to stamp a kind we'd then have to migrate. Add a type here as it
     // is converted — see "Which documents get stamped" in docs/document-axes/target-architecture.md.
@@ -632,7 +637,8 @@ export class DB {
       properties: {},
       uid: owner,
       ...titleInfo,
-      ...scopeFields,
+      ...ownerFields,
+      ...locationFields,
       ...kindFields
     };
     await documentRef.set(firestoreMetadata);
@@ -659,9 +665,9 @@ export class DB {
     return { groupId: currentGroupId, offeringId };
   }
 
-  // Verify the stores hold the runtime context a document of this kind needs to construct its owner and scope
-  // fields. Throws when the context is missing. Currently only group-owned kinds have a requirement. The check
-  // lives here instead of the kind registry because it is easier for now.
+  // Verify the stores hold the runtime context a document of this kind needs to construct its owner and
+  // location fields. Throws when the context is missing. Currently only group-owned kinds have a requirement.
+  // The check lives here instead of the kind registry because it is easier for now.
   private validateDocumentKindCreation(kind: string) {
     if (getDocumentOwnerType(kind) === "group") {
       this.requireGroupContext();
@@ -685,11 +691,7 @@ export class DB {
       // The owner (authoring identity, stored as `uid`) is chosen by the kind's registered owner type:
       // the creating user, the synthetic group owner, or the synthetic class owner. It is also the document's
       // storage-path owner — a document the user owns resolves to their own path (getUserPath: owner || user.id).
-      const owner = getDocumentOwner(kind, {
-        userId: user.id,
-        groupOwnerId: user.userIdForGroupDocuments,
-        classOwnerId: this.userIdForClassWideDocuments
-      });
+      const owner = getDocumentOwner(kind, this.documentOwnerContext);
 
       const documentPath = this.firebase.getUserDocumentPath(user, undefined, owner);
       const documentRef = this.firebase.ref(documentPath).push();
@@ -773,14 +775,12 @@ export class DB {
   public async getOrCreateGroupDocument() {
     const { user } = this.stores;
     const { groupId, offeringId } = this.requireGroupContext();
-    // The pointer slot is labeled "default" (the group's default canonical document), not by the
-    // document's type — see kDefaultCanonicalDocumentLabel. The document itself is a GroupDocument.
-    const pointerPath = getCanonicalPointerPath(
-      { classHash: user.classHash, offeringId, groupId }, kDefaultCanonicalDocumentLabel
-    );
-    // Regular group documents: the transitional `type` and `kind` coincide (both GroupDocument).
+    // A group document is kept in the offering; its group-ness is its owner, which the kind supplies.
+    // The slot is labeled "default" (the group's default canonical document) rather than by the
+    // document's type — see kDefaultCanonicalDocumentLabel. For a regular group document the
+    // transitional `type` and the `kind` coincide, both GroupDocument.
     return this.getOrCreateCanonicalDocument({
-      pointerPath,
+      container: { classHash: user.classHash, offeringId },
       canonicalLabel: kDefaultCanonicalDocumentLabel,
       type: GroupDocument,
       kind: GroupDocument,
@@ -788,20 +788,19 @@ export class DB {
     });
   }
 
-  // Class-scoped synthetic owner for this class's class-wide documents
+  // Synthetic owner uid for this class's class-wide documents, minted by the same function hasClassOwner
+  // reads back, so the two cannot drift.
   private get userIdForClassWideDocuments() {
-    return `class_${this.stores.user.classHash}`;
+    return getClassOwnerId(this.stores.user.classHash);
   }
 
   public async getOrCreateClassWideDocument(classWideDoc: { kind: string; title: string }) {
     const { user, unit } = this.stores;
     // For a class-wide document the canonical-pointer label equals the document's kind.
-    const label = classWideDoc.kind;
-    const pointerPath = getCanonicalPointerPath({ classHash: user.classHash, unit: unit.code }, label);
     // The document's transitional `type` stays GroupDocument while its `kind` is the declared kind.
     return this.getOrCreateCanonicalDocument({
-      pointerPath,
-      canonicalLabel: label,
+      container: { classHash: user.classHash, unit: unit.code },
+      canonicalLabel: classWideDoc.kind,
       type: GroupDocument,
       kind: classWideDoc.kind
     });
@@ -815,10 +814,12 @@ export class DB {
     if (!classWideDocs?.length) return;
     for (const classWideDoc of classWideDocs) {
       // Register each declared document's kind so createFirestoreMetadataDocument stamps its axis fields via the
-      // registry and createDocument derives its owner and scope. Registration validates the kind and rejects a
-      // duplicate (both throw); skip a bad entry rather than crash startup.
+      // registry and createDocument derives its owner and location — registerClassWideDocumentKind supplies the
+      // shape every class-wide document shares. The unit passed is the same code stamped as the document's
+      // `unit` (see currentProblemInfo). Registration validates the kind and rejects a duplicate (both throw);
+      // skip a bad entry rather than crash startup.
       try {
-        registerClassWideDocumentKind(classWideDoc.kind, classWideDoc.title);
+        registerClassWideDocumentKind(classWideDoc.kind, classWideDoc.title, this.stores.unit.code);
       } catch (err) {
         console.error("Ignoring class-wide document:", classWideDoc.kind, err);
         continue;
@@ -829,8 +830,27 @@ export class DB {
     }
   }
 
+  // The candidate owner uids for a document created in this session. getDocumentOwner picks among them by
+  // the kind's registered owner type; both the document's stored `uid` and its canonical slot use this.
+  private get documentOwnerContext(): IDocumentOwnerContext {
+    const { user } = this.stores;
+    return {
+      userId: user.id,
+      groupOwnerId: user.userIdForGroupDocuments,
+      classOwnerId: this.userIdForClassWideDocuments
+    };
+  }
+
   private async getOrCreateCanonicalDocument(opts: IGetOrCreateCanonicalDocumentOpts) {
-    const { pointerPath, type, kind, canonicalLabel, findLegacy } = opts;
+    const { container, type, kind, canonicalLabel, findLegacy } = opts;
+    // The slot's owner is the same uid createDocument stamps on the document, from the same registry
+    // call. firestore.rules builds the pointer path from the document's stored `uid`, so a claim whose
+    // path named a different owner would be rejected rather than silently mis-slotted.
+    const pointerPath = getCanonicalPointerPath({
+      ...container,
+      owner: getDocumentOwner(kind, this.documentOwnerContext),
+      label: canonicalLabel
+    });
     const pointerRef = this.firestore.doc(pointerPath);
 
     // 1. Fast path: pointer already exists.
diff --git a/src/lib/scoped-document-pointers.test.ts b/src/lib/scoped-document-pointers.test.ts
index 9495cfb461..af956e4657 100644
--- a/src/lib/scoped-document-pointers.test.ts
+++ b/src/lib/scoped-document-pointers.test.ts
@@ -1,16 +1,33 @@
 import { getCanonicalPointerPath } from "./scoped-document-pointers";
 
 describe("getCanonicalPointerPath", () => {
-  it("group scope (class + offering + group) — offering wins, unit omitted even when present", () => {
-    // Real group metadata carries both offeringId and unit; the offering pins the unit, so no units segment.
-    expect(getCanonicalPointerPath(
-      { classHash: "class-1", offeringId: "off-1", groupId: "3", unit: "msu" }, "default"
-    )).toBe("canonical/v1/classes/class-1/offerings/off-1/groups/3/slots/default");
+  it("names the offering container, the group owner, and the label", () => {
+    // Real group metadata carries both offeringId and unit. Each container names only itself, so the
+    // offering's own id is the level and no units segment appears.
+    expect(getCanonicalPointerPath({
+      classHash: "class-1", offeringId: "off-1", unit: "msu",
+      owner: "group_off-1_3", label: "default"
+    })).toBe("canonical/v1/classes/class-1/offerings/off-1/owners/group_off-1_3/slots/default");
   });
 
-  it("class+unit scope (no offering) — uses the units segment; label === kind", () => {
-    expect(getCanonicalPointerPath(
-      { classHash: "class-1", unit: "msu" }, "drivingQuestionBoard"
-    )).toBe("canonical/v1/classes/class-1/units/msu/slots/drivingQuestionBoard");
+  it("names the classUnit container, the class owner, and the kind as the label", () => {
+    expect(getCanonicalPointerPath({
+      classHash: "class-1", unit: "msu",
+      owner: "class_class-1", label: "drivingQuestionBoard"
+    })).toBe("canonical/v1/classes/class-1/units/msu/owners/class_class-1/slots/drivingQuestionBoard");
+  });
+
+  it("distinguishes two owners in the same container", () => {
+    // What keeps one group from filling another's slot: the containers match, the owners do not.
+    const slot = { classHash: "class-1", offeringId: "off-1", label: "default" };
+    expect(getCanonicalPointerPath({ ...slot, owner: "group_off-1_3" }))
+      .not.toBe(getCanonicalPointerPath({ ...slot, owner: "group_off-1_7" }));
+  });
+
+  it("omits the container level for a document kept by the class alone", () => {
+    // Nothing creates this shape yet — firestore.rules grants no create for it — but the path is the
+    // one a class-level slot would use: the class prefix already identifies the container.
+    expect(getCanonicalPointerPath({ classHash: "class-1", owner: "u-1", label: "default" }))
+      .toBe("canonical/v1/classes/class-1/owners/u-1/slots/default");
   });
 });
diff --git a/src/lib/scoped-document-pointers.ts b/src/lib/scoped-document-pointers.ts
index df2c84a974..9082351e73 100644
--- a/src/lib/scoped-document-pointers.ts
+++ b/src/lib/scoped-document-pointers.ts
@@ -7,51 +7,61 @@ export interface ICanonicalPointer {
 }
 
 /**
- * Label for the pointer "slot" holding a scope's default canonical document. It is used two ways:
+ * Label for the pointer "slot" holding a container's default canonical document. It is used two ways:
  * as the final segment of the pointer path (`.../slots/<label>`) and as the value written to
  * the winning document's `canonical` field. It is a slot label, NOT the document's `type`: multiple
- * canonical documents of the same type can coexist in one scope, differentiated by their label.
+ * canonical documents of the same type can coexist in one container, differentiated by their label.
  * firestore.rules reads the label from the document's `canonical` field, so it is not hardcoded there.
  */
 export const kDefaultCanonicalDocumentLabel = "default";
 
-export interface ICanonicalPointerScope {
+/**
+ * A canonical slot: a container, an owner, and a label (see docs/document-axes/axes.md). Exactly one
+ * document fills a slot, and `getCanonicalPointerPath` turns the slot into the path of the pointer
+ * that names it.
+ *
+ * The container is given as the class plus, when the document is kept below the class, that
+ * container's own id — an `offeringId` or a `unit`. The owner is the document's `uid`, including the
+ * synthetic owners (`group_<offeringId>_<groupId>`, `class_<classHash>`).
+ */
+export interface ICanonicalSlot {
   classHash: string;
   offeringId?: string;
-  groupId?: string;
   unit?: string;
-  // owner?: string;  // future: problem/planning pointers are scoped to an offering + a user (users/<owner>).
+  owner: string;
+  label: string;
 }
 
 /**
  * Path (relative to the Firestore root) of a canonical-document pointer. Pointers live in a dedicated,
- * versioned collection — `canonical/v1/…` — rather than interleaved in the class/offering/group document
- * tree. That keeps their access rules stated per concern (uniform read + immutability across scopes, create
- * per-scope) and leaves room to introduce a different layout under a later version prefix. Below the version,
- * the path is built segment-by-segment from the scope fields the document carries, so every scope shares one
- * layout:
+ * versioned collection — `canonical/v1/…` — rather than interleaved in the class/offering document tree.
+ * That keeps their access rules stated per concern (uniform read + immutability across containers, create
+ * per container shape) and leaves room to introduce a different layout under a later version prefix.
+ * Below the version:
  *
- *   canonical/v1/classes/<classHash> / (offerings/<offeringId> | units/<unit>) / [groups/<groupId>] / slots/<label>
+ *   canonical/v1/classes/<classHash> / [offerings/<offeringId> | units/<unit>] / owners/<uid> / slots/<label>
  *
- * The `units/` segment is used only when there is no offering — an offering already pins a unit, so
- * offering-scoped pointers (group docs; future problem/planning docs) omit it, while class+unit pointers
- * (class-wide docs like the DQB) use it. For class-wide slots the label equals the document's `kind`; a
- * group document slot just uses "default".
+ * The class leads because the rules authorize reads by comparing that segment to the caller's class
+ * claim, which a synthetic group owner id cannot supply. Below it the container contributes its **own**
+ * level and id rather than a chain of ancestors: an offering names only itself, even though every
+ * offering falls inside a classUnit. Pointers are immutable (firestore.rules grants no update or
+ * delete), so a pointer cannot be moved — addressing each one by its own container is what lets a new
+ * container level be introduced later without stranding the pointers that already exist. A document
+ * kept by the class alone would omit the level entirely; nothing creates one yet, and the rules grant
+ * no create for that shape (see firestore.rules).
  *
- * firestore.rules `canonicalPointerPath` builds the same path the same way (string concat + path(), verified
- * against the emulator) — keep the two in lockstep.
+ * firestore.rules `canonicalPointerPath` builds the same path the same way (string concat + path(),
+ * verified against the emulator) — keep the two in lockstep.
  */
-export function getCanonicalPointerPath(scope: ICanonicalPointerScope, label: string): string {
-  const { classHash, offeringId, groupId, unit } = scope;
+export function getCanonicalPointerPath(slot: ICanonicalSlot): string {
+  const { classHash, offeringId, unit, owner, label } = slot;
   const segments = [`canonical/v1/classes/${classHash}`];
   if (offeringId) {
     segments.push(`offerings/${offeringId}`);
   } else if (unit) {
     segments.push(`units/${unit}`);
   }
-  if (groupId) {
-    segments.push(`groups/${groupId}`);
-  }
+  segments.push(`owners/${owner}`);
   segments.push(`slots/${label}`);
   return segments.join("/");
 }
diff --git a/src/models/document/document-axes.test.ts b/src/models/document/document-axes.test.ts
new file mode 100644
index 0000000000..5bda7e2be0
--- /dev/null
+++ b/src/models/document/document-axes.test.ts
@@ -0,0 +1,130 @@
+import {
+  getClassOwnerId, getCurriculumLabel, getGroupOwnerId, hasClassOwner, hasGroupOwner, isInClassUnitContainer
+} from "./document-axes";
+
+describe("document axis guards", () => {
+  // One case per document shape CLUE stores, so the guards are pinned against every shape they
+  // must distinguish rather than only the two this feature introduces. Each carries the uid its
+  // owner would mint: a real user id, or one of the synthetic ones.
+  const personal = { uid: "u-1", unit: null, investigation: null };
+  const problem = { uid: "u-1", unit: "sas", investigation: "1", problem: "2", offeringId: "off-1" };
+  const group = {
+    uid: getGroupOwnerId("off-1", "3"), unit: "sas", investigation: "1", problem: "2", offeringId: "off-1"
+  };
+  // Curriculum-authored, so it belongs to no offering and is owned by an authoring persona.
+  const exemplar = { uid: "ivan_idea_1", unit: "qa", investigation: "1", problem: "1" };
+  const classWide = { uid: getClassOwnerId("h1"), unit: "sas", investigation: null };
+  // Created before investigation/problem were stamped.
+  const legacyClassWide = { uid: getClassOwnerId("h1"), unit: "sas" };
+
+  describe("hasGroupOwner", () => {
+    it("is true only for a document owned by the synthetic group uid", () => {
+      expect(hasGroupOwner(group)).toBe(true);
+    });
+
+    it("is false for every other owner", () => {
+      expect(hasGroupOwner(personal)).toBe(false);   // a real user
+      expect(hasGroupOwner(problem)).toBe(false);    // a real user
+      expect(hasGroupOwner(classWide)).toBe(false);  // the synthetic class uid
+      expect(hasGroupOwner(exemplar)).toBe(false);   // a synthetic authoring persona
+    });
+
+    it("reads only the owner, whatever the document is about or where it is kept", () => {
+      expect(hasGroupOwner({ uid: getGroupOwnerId("off-1", "3") })).toBe(true);
+      expect(hasGroupOwner({ uid: getGroupOwnerId("off-1", "3"), unit: "sas", offeringId: "off-1" }))
+        .toBe(true);
+    });
+
+    it("is false when the document has no uid at all", () => {
+      expect(hasGroupOwner({ unit: "sas" })).toBe(false);
+    });
+  });
+
+  describe("hasClassOwner", () => {
+    it("is true only for a document owned by the synthetic class uid", () => {
+      expect(hasClassOwner(classWide)).toBe(true);
+      expect(hasClassOwner(legacyClassWide)).toBe(true);
+    });
+
+    it("is false for every other owner", () => {
+      expect(hasClassOwner(personal)).toBe(false);   // a real user
+      expect(hasClassOwner(problem)).toBe(false);    // a real user
+      expect(hasClassOwner(group)).toBe(false);      // the synthetic group uid
+      expect(hasClassOwner(exemplar)).toBe(false);   // a synthetic authoring persona
+    });
+
+    it("reads only the owner, whatever the document is about or where it is kept", () => {
+      expect(hasClassOwner({ uid: getClassOwnerId("h1") })).toBe(true);
+      expect(hasClassOwner({ uid: getClassOwnerId("h1"), unit: "sas", investigation: "1",
+        offeringId: "off-1" })).toBe(true);
+    });
+
+    it("is false when the document has no uid at all", () => {
+      expect(hasClassOwner({ unit: "sas" })).toBe(false);
+    });
+  });
+
+  describe("getClassOwnerId", () => {
+    it("mints the uid hasClassOwner recognizes", () => {
+      // The minting and reading sides are pinned together: a change to the uid's grammar that broke one
+      // without the other would file class-wide documents in a slot nothing could find them by.
+      expect(getClassOwnerId("h1")).toBe("class_h1");
+      expect(hasClassOwner({ uid: getClassOwnerId("h1") })).toBe(true);
+    });
+
+    it("is distinct from a group owner built on the same id", () => {
+      expect(getClassOwnerId("3")).not.toBe(getGroupOwnerId("off-1", "3"));
+      expect(hasGroupOwner({ uid: getClassOwnerId("3") })).toBe(false);
+    });
+  });
+
+  describe("isInClassUnitContainer", () => {
+    it("is true for a document kept in the class's copy of a unit", () => {
+      expect(isInClassUnitContainer(classWide)).toBe(true);
+      expect(isInClassUnitContainer(legacyClassWide)).toBe(true);
+      // An exemplar is about a problem but belongs to no offering, so it is kept here too.
+      expect(isInClassUnitContainer(exemplar)).toBe(true);
+    });
+
+    it("is false for a document kept in an offering", () => {
+      expect(isInClassUnitContainer(problem)).toBe(false);
+      expect(isInClassUnitContainer(group)).toBe(false);
+    });
+
+    it("is false for a document kept at the class, with no unit", () => {
+      expect(isInClassUnitContainer(personal)).toBe(false);
+    });
+
+    it("reads only the container, whatever the owner holds", () => {
+      // The owner cannot decide this guard: it says who the document belongs to, not where it is kept.
+      expect(isInClassUnitContainer({ uid: getGroupOwnerId("off-1", "3"), unit: "sas" })).toBe(true);
+    });
+
+    it("treats an empty-string unit as no unit", () => {
+      expect(isInClassUnitContainer({ unit: "", offeringId: null })).toBe(false);
+    });
+  });
+
+  describe("getCurriculumLabel", () => {
+    it("names the problem a document belongs to", () => {
+      expect(getCurriculumLabel(problem)).toBe("sas-1.2");
+      expect(getCurriculumLabel(group)).toBe("sas-1.2");
+      expect(getCurriculumLabel(exemplar)).toBe("qa-1.1");
+    });
+
+    it("names the unit alone when the document is scoped no narrower", () => {
+      expect(getCurriculumLabel(classWide)).toBe("sas");
+      expect(getCurriculumLabel(legacyClassWide)).toBe("sas");
+    });
+
+    it("returns undefined when the document has no unit", () => {
+      expect(getCurriculumLabel(personal)).toBeUndefined();
+      expect(getCurriculumLabel({ unit: "" })).toBeUndefined();
+    });
+
+    it("keeps the investigation when a document has one but no problem", () => {
+      // No registered scope type produces this shape; the label degrades rather than dropping it.
+      expect(getCurriculumLabel({ unit: "sas", investigation: "1" })).toBe("sas-1.x");
+    });
+  });
+});
diff --git a/src/models/document/document-axes.ts b/src/models/document/document-axes.ts
new file mode 100644
index 0000000000..a7b08232a7
--- /dev/null
+++ b/src/models/document/document-axes.ts
@@ -0,0 +1,111 @@
+/**
+ * Guards over a document's stored axis fields (`uid`, `unit`, `investigation`, `problem`,
+ * `offeringId`), stamped at creation from the kind's registered `ownerType` and `containerType`
+ * (see document-kinds.ts).
+ *
+ * Each guard answers about one axis, reading only that axis's fields; a consumer needing a position on
+ * more than one asks each. See docs/document-axes/reading-axes-in-code.md for the field-by-shape table
+ * and what is not covered yet, and docs/document-axes/axes.md for what the axes mean.
+ *
+ * A guard reads stored fields only, never the kind registry: Sort Work lists documents from other
+ * units, whose kinds are not registered in the current session.
+ */
+
+/**
+ * The prefix of the synthetic uid that owns a group's documents, `group_<offeringId>_<groupId>`. Shared
+ * by getGroupOwnerId, which mints the uid, and hasGroupOwner, which reads it back.
+ */
+export const kGroupOwnerPrefix = "group_";
+
+/**
+ * The prefix of the synthetic uid that owns a class's documents, `class_<classHash>`. Shared by
+ * getClassOwnerId, which mints the uid, and hasClassOwner, which reads it back.
+ */
+export const kClassOwnerPrefix = "class_";
+
+/**
+ * The synthetic uid that owns a group's documents. Every member of the group resolves to the same
+ * value, which is what makes the document the group's rather than its creator's.
+ *
+ * It is qualified by the offering because a group id is unique only within one: group 3 of this
+ * assignment and group 3 of the next are different sets of students. Callers that need to recognize a
+ * particular group's documents should build the id with this and compare, rather than parsing a stored
+ * uid apart.
+ */
+export function getGroupOwnerId(offeringId: string, groupId: string): string {
+  return `${kGroupOwnerPrefix}${offeringId}_${groupId}`;
+}
+
+/**
+ * The synthetic uid that owns a class's documents. Every member of the class resolves to the same
+ * value, which is what makes the document the class's rather than its creator's.
+ *
+ * The class hash needs no further qualification the way a group id does: it already identifies one class
+ * across the whole portal. Callers that need to recognize a particular class's documents should build the
+ * id with this and compare, rather than parsing a stored uid apart.
+ */
+export function getClassOwnerId(classHash: string): string {
+  return `${kClassOwnerPrefix}${classHash}`;
+}
+
+/** The fields the guards read. Structural, so this stays a leaf module. */
+export interface IDocumentAxisFields {
+  uid?: string | null;
+  unit?: string | null;
+  investigation?: string | null;
+  problem?: string | null;
+  offeringId?: string | null;
+}
+
+/**
+ * Owner axis: the document belongs to a single group, whoever created it.
+ *
+ * Like a class owner, a group owner has no field of its own — it is a synthetic uid, so this reads the
+ * uid's grammar. It tests the prefix rather than taking the uid apart; a caller that needs the group's
+ * number reads the `groupId` stored beside the uid (see getDocumentOwnerFields), and one that needs the
+ * group itself builds the whole owner id and compares (`Groups.getGroupByOwnerId`).
+ */
+export function hasGroupOwner(doc: IDocumentAxisFields): boolean {
+  return !!doc.uid?.startsWith(kGroupOwnerPrefix);
+}
+
+/**
+ * Owner axis: the document belongs to the class as a whole, with no personal author.
+ *
+ * A class owner has no field of its own — it is a synthetic uid, so this reads the uid's grammar.
+ * Callers ask the question and leave that to the guard, which is what lets the representation change
+ * without touching them.
+ */
+export function hasClassOwner(doc: IDocumentAxisFields): boolean {
+  return !!doc.uid?.startsWith(kClassOwnerPrefix);
+}
+
+/**
+ * Container axis: the document is kept in the class's copy of one unit, rather than in a single
+ * offering of one problem. It says nothing about who owns it — a class-wide slot and an exemplar are
+ * both kept here.
+ *
+ * `offeringId` is the only positive marker of the offering container, so a caller that cannot see it
+ * must not use this guard: an exemplar carries the same unit/investigation/problem as a problem
+ * document and is told apart from it by nothing else.
+ */
+export function isInClassUnitContainer(doc: IDocumentAxisFields): boolean {
+  return !!doc.unit && !doc.offeringId;
+}
+
+/**
+ * A short label for a document's curriculum position: "sas-1.2" when it is about a problem, "sas" when
+ * it is about a unit and nothing narrower, undefined when it has no unit at all.
+ *
+ * Callers use it as a stand-in when a document's real title cannot be resolved, so the coordinates
+ * name the document instead. It reads the stored fields alone, so it describes a document from any
+ * unit, including one whose config is not loaded.
+ *
+ * An investigation with no problem ("sas-1.x") is not a shape any registered container type produces; it
+ * is handled so a partial position still reads as one rather than losing the investigation.
+ */
+export function getCurriculumLabel(doc: IDocumentAxisFields): string | undefined {
+  if (!doc.unit) return undefined;
+  if (!doc.investigation) return doc.unit;
+  return `${doc.unit}-${doc.investigation}.${doc.problem ?? "x"}`;
+}
diff --git a/src/models/document/document-kinds.test.ts b/src/models/document/document-kinds.test.ts
index 9a43e71ce7..5750c8373c 100644
--- a/src/models/document/document-kinds.test.ts
+++ b/src/models/document/document-kinds.test.ts
@@ -1,7 +1,8 @@
 import { GroupDocument, PersonalDocument, ProblemDocument } from "./document-types";
 import {
-  getDocumentKindInfo, getDocumentKindMetadataFields, getDocumentOwner, getDocumentOwnerType,
-  getDocumentScopeFields, getDocumentTitle, isValidDocumentKind, registerDocumentKind
+  getDocumentKindInfo, getDocumentKindLabel, getDocumentKindMetadataFields, getDocumentOwner,
+  getDocumentOwnerFields, getDocumentOwnerType, getDocumentLocationFields, getDocumentTitle, getKindDefinitionFor,
+  isValidDocumentKind, registerDocumentKind, resetDocumentKindRegistryForTests
 } from "./document-kinds";
 
 describe("isValidDocumentKind", () => {
@@ -29,23 +30,23 @@ describe("document kinds registry", () => {
 
   it("registerDocumentKind adds new kinds", () => {
     registerDocumentKind("testAddedKind",
-      { metadataFields: { concurrent: true }, ownerType: "user", scopeType: "class" });
+      { metadataFields: { concurrent: true }, ownerType: "user", containerType: "class" });
     expect(getDocumentKindInfo("testAddedKind")?.metadataFields.concurrent).toBe(true);
   });
 
   it("registerDocumentKind throws when a kind is registered more than once", () => {
     registerDocumentKind("testDuplicateKind",
-      { metadataFields: {}, ownerType: "user", scopeType: "class" });
+      { metadataFields: {}, ownerType: "user", containerType: "class" });
     expect(() => registerDocumentKind("testDuplicateKind",
-      { metadataFields: {}, ownerType: "user", scopeType: "class" })).toThrow(/already registered/);
+      { metadataFields: {}, ownerType: "user", containerType: "class" })).toThrow(/already registered/);
     // built-in kinds are registered at module load, so re-registering one throws too
     expect(() => registerDocumentKind(GroupDocument,
-      { metadataFields: { concurrent: true }, ownerType: "group", scopeType: "group" })).toThrow();
+      { metadataFields: { concurrent: true }, ownerType: "group", containerType: "offering" })).toThrow();
   });
 
   it("registerDocumentKind throws for a kind that is not a valid camelCase identifier", () => {
     expect(() => registerDocumentKind("not-camel-case",
-      { metadataFields: {}, ownerType: "user", scopeType: "class" })).toThrow(/not a valid identifier/);
+      { metadataFields: {}, ownerType: "user", containerType: "class" })).toThrow(/not a valid identifier/);
   });
 
   describe("getDocumentKindMetadataFields", () => {
@@ -62,15 +63,24 @@ describe("document kinds registry", () => {
     });
   });
 
-  describe("owner scope", () => {
+  describe("owner", () => {
     const ctx = { userId: "u-1", groupOwnerId: "group_off_3", classOwnerId: "class_c1" };
 
-    it("resolves user-scoped and unregistered kinds to the user as owner", () => {
-      expect(getDocumentOwnerType(PersonalDocument)).toBe("user");   // registered user-scoped kind
-      expect(getDocumentOwnerType(undefined)).toBe("user");          // unregistered defaults to user
+    it("resolves a user-owned kind to the user as owner", () => {
+      expect(getDocumentOwnerType(PersonalDocument)).toBe("user");   // registered user-owned kind
+      expect(getDocumentOwnerType(undefined)).toBe("user");          // the type query defaults to user
       expect(getDocumentOwner(PersonalDocument, ctx)).toBe("u-1");
     });
 
+    it("throws rather than defaulting the owner of an unregistered kind", () => {
+      // Unlike getDocumentOwnerType, this must not fall back to the creating user: that would hand a
+      // group's or a class's document to whoever created it, and file it in that user's canonical slot.
+      // A unit-declared kind is registered only while its unit is loaded, so this is also what confines
+      // document creation to the kinds the current unit defines.
+      expect(() => getDocumentOwner("noSuchKind", ctx)).toThrow(/unregistered document kind/);
+      expect(() => getDocumentOwner(undefined, ctx)).toThrow(/unregistered document kind/);
+    });
+
     it("resolves the built-in group kind to the group owner", () => {
       expect(getDocumentOwnerType(GroupDocument)).toBe("group");
       expect(getDocumentOwner(GroupDocument, ctx)).toBe("group_off_3");
@@ -78,49 +88,113 @@ describe("document kinds registry", () => {
 
     it("resolves a class kind to the class owner", () => {
       registerDocumentKind("testDqb",
-        { metadataFields: { concurrent: true }, ownerType: "class", scopeType: "classUnit" });
+        { metadataFields: { concurrent: true }, ownerType: "class", containerType: "classUnit" });
       expect(getDocumentOwnerType("testDqb")).toBe("class");
       expect(getDocumentOwner("testDqb", ctx)).toBe("class_c1");
     });
 
-    it("falls back to the user when the scope's synthetic owner was not supplied", () => {
-      expect(getDocumentOwner(GroupDocument, { userId: "u-1" })).toBe("u-1");
+    it("throws rather than falling back to the user when the synthetic owner is unavailable", () => {
+      // A student who is not in a group has no group owner id. Handing them the document instead would
+      // make it theirs rather than the group's, and file its canonical slot under them.
+      expect(() => getDocumentOwner(GroupDocument, { userId: "u-1" }))
+        .toThrow(/Cannot create a group-owned document/);
+      registerDocumentKind("testClassKindNoOwner",
+        { metadataFields: {}, ownerType: "class", containerType: "classUnit" });
+      expect(() => getDocumentOwner("testClassKindNoOwner", { userId: "u-1" }))
+        .toThrow(/Cannot create a class-owned document/);
+    });
+  });
+
+  describe("owner fields", () => {
+    it("stamps a groupId for a group-owned kind", () => {
+      expect(getDocumentOwnerFields(GroupDocument, "3")).toEqual({ groupId: "3" });
+    });
+
+    it("stamps nothing for a kind owned by a user or a class", () => {
+      expect(getDocumentOwnerFields(ProblemDocument, "3")).toEqual({});
+      expect(getDocumentOwnerFields(PersonalDocument, "3")).toEqual({});
+      expect(getDocumentOwnerFields(undefined, "3")).toEqual({});
+    });
+
+    it("stamps nothing when the group-owned kind has no group to record", () => {
+      expect(getDocumentOwnerFields(GroupDocument, undefined)).toEqual({});
     });
   });
 
-  describe("scope fields", () => {
+  describe("location fields", () => {
     const ctx = {
-      groupId: "3", offeringId: "off-1", unit: "msu", investigation: "1", problem: "2", context_id: "class-h"
+      offeringId: "off-1", unit: "msu", investigation: "1", problem: "2", context_id: "class-h"
     };
 
-    it("returns group + offering scope plus the problem context for the group kind", () => {
-      expect(getDocumentScopeFields(GroupDocument, ctx)).toEqual({
-        groupId: "3", offeringId: "off-1", unit: "msu", investigation: "1", problem: "2", context_id: "class-h"
+    it("returns the offering and its problem for the group kind, with no owner fields among them", () => {
+      // A group document is kept in the offering like the problem documents beside it; its group is an
+      // owner field (getDocumentOwnerFields), not part of where it is kept.
+      expect(getDocumentLocationFields(GroupDocument, ctx)).toEqual({
+        offeringId: "off-1", unit: "msu", investigation: "1", problem: "2", context_id: "class-h"
       });
     });
 
-    it("returns the unit and context_id for a class-unit kind", () => {
+    it("returns the unit and context_id for a class-unit kind, stating the absent curriculum explicitly", () => {
       registerDocumentKind("testWordWall",
-        { metadataFields: { concurrent: true }, ownerType: "class", scopeType: "classUnit" });
-      expect(getDocumentScopeFields("testWordWall", ctx)).toEqual({ unit: "msu", context_id: "class-h" });
+        { metadataFields: { concurrent: true }, ownerType: "class", containerType: "classUnit" });
+      expect(getDocumentLocationFields("testWordWall", ctx)).toEqual({
+        unit: "msu", context_id: "class-h", investigation: null, problem: null
+      });
     });
 
-    it("returns offering scope plus the problem context for an offering kind", () => {
-      expect(getDocumentScopeFields(ProblemDocument, ctx)).toEqual({
+    it("returns the offering and its problem for an offering kind", () => {
+      expect(getDocumentLocationFields(ProblemDocument, ctx)).toEqual({
         offeringId: "off-1", unit: "msu", investigation: "1", problem: "2", context_id: "class-h"
       });
     });
 
     it("returns only a null unit and context_id for a class kind and unregistered kinds", () => {
-      expect(getDocumentScopeFields(PersonalDocument, ctx)).toEqual({ unit: null, context_id: "class-h" });
-      expect(getDocumentScopeFields(undefined, ctx)).toEqual({ unit: null, context_id: "class-h" });
+      expect(getDocumentLocationFields(PersonalDocument, ctx)).toEqual({ unit: null, context_id: "class-h" });
+      expect(getDocumentLocationFields(undefined, ctx)).toEqual({ unit: null, context_id: "class-h" });
+    });
+  });
+
+  describe("getKindDefinitionFor", () => {
+    it("resolves a built-in kind for a document from any unit, since no unit declared it", () => {
+      expect(getKindDefinitionFor({ kind: GroupDocument, unit: "sas" })?.ownerType).toBe("group");
+      expect(getKindDefinitionFor({ kind: GroupDocument })?.ownerType).toBe("group");
+    });
+
+    it("returns undefined when the kind is unregistered or absent", () => {
+      expect(getKindDefinitionFor({ kind: "unregisteredKind", unit: "sas" })).toBeUndefined();
+      expect(getKindDefinitionFor({ unit: "sas" })).toBeUndefined();
+    });
+
+    describe("a kind declared by a unit config", () => {
+      beforeEach(() => {
+        resetDocumentKindRegistryForTests();
+        registerDocumentKind("testScopedKind", {
+          metadataFields: { concurrent: true }, ownerType: "class", containerType: "classUnit",
+          title: "Driving Question Board", unit: "sas"
+        });
+      });
+
+      it("resolves for a document from the unit that declared it", () => {
+        expect(getKindDefinitionFor({ kind: "testScopedKind", unit: "sas" })?.title)
+          .toBe("Driving Question Board");
+      });
+
+      it("returns undefined for a document from another unit declaring the same kind", () => {
+        // The loaded definition is not the one this document was made from, and the other unit may mean
+        // something different by the name, so nothing here governs it.
+        expect(getKindDefinitionFor({ kind: "testScopedKind", unit: "msa" })).toBeUndefined();
+      });
+
+      it("returns undefined for a document with no unit at all", () => {
+        expect(getKindDefinitionFor({ kind: "testScopedKind" })).toBeUndefined();
+      });
     });
   });
 
   describe("title", () => {
     it("returns a class-wide kind's registered static title", () => {
       registerDocumentKind("testDqbTitle", {
-        metadataFields: { concurrent: true }, ownerType: "class", scopeType: "classUnit",
+        metadataFields: { concurrent: true }, ownerType: "class", containerType: "classUnit",
         title: "Driving Question Board"
       });
       expect(getDocumentTitle({ kind: "testDqbTitle", type: GroupDocument })).toBe("Driving Question Board");
@@ -138,5 +212,85 @@ describe("document kinds registry", () => {
       expect(getDocumentTitle({ kind: PersonalDocument, type: PersonalDocument })).toBeUndefined();
       expect(getDocumentTitle({ type: "unregistered" })).toBeUndefined();
     });
+
+    it("does not mislabel a class-wide document with an unregistered kind as a group document", () => {
+      // A class-wide document also stores type:"group" but carries no groupId. If its kind belongs to a
+      // unit that has not loaded this session, the registry lookup above misses and this must not fall
+      // through to the group-document label (which would read "Group undefined Document").
+      expect(getDocumentTitle({ kind: "unregisteredClassWideKind", type: GroupDocument })).toBeUndefined();
+    });
+
+    describe("a title declared by a unit config", () => {
+      beforeEach(() => {
+        resetDocumentKindRegistryForTests();
+        registerDocumentKind("testUnitDeclaredKind", {
+          metadataFields: { concurrent: true }, ownerType: "class", containerType: "classUnit",
+          title: "Driving Question Board", unit: "sas"
+        });
+      });
+
+      it("names a document from the unit that declared it", () => {
+        expect(getDocumentTitle({ kind: "testUnitDeclaredKind", type: GroupDocument, unit: "sas" }))
+          .toBe("Driving Question Board");
+      });
+
+      it("does not name a document from another unit that declares the same kind", () => {
+        // Only the current unit's config is loaded, and another unit may word the same kind
+        // differently, so its document falls through to the caller's fallback rather than borrowing
+        // this title.
+        expect(getDocumentTitle({ kind: "testUnitDeclaredKind", type: GroupDocument, unit: "msa" }))
+          .toBeUndefined();
+      });
+    });
+  });
+
+  describe("getDocumentKindLabel", () => {
+    it("reads a camelCase kind as words", () => {
+      expect(getDocumentKindLabel("drivingQuestionBoard")).toBe("Driving Question Board");
+      expect(getDocumentKindLabel("group")).toBe("Group");
+    });
+
+    it("returns undefined when there is no kind", () => {
+      expect(getDocumentKindLabel(undefined)).toBeUndefined();
+      expect(getDocumentKindLabel(null)).toBeUndefined();
+      expect(getDocumentKindLabel("")).toBeUndefined();
+    });
+  });
+
+  describe("getDocumentLocationFields for a classUnit kind", () => {
+    const ctx = {
+      unit: "sas", investigation: "1", problem: "2",
+      context_id: "class-hash", offeringId: "off-1"
+    };
+
+    beforeEach(() => {
+      resetDocumentKindRegistryForTests();
+      registerDocumentKind("testClassWideKind", {
+        metadataFields: { concurrent: true }, ownerType: "class", containerType: "classUnit"
+      });
+    });
+
+    it("stamps the unit and class, and states the absent curriculum explicitly", () => {
+      // `investigation`/`problem` are written as null rather than omitted: a null field means "not about
+      // an investigation or problem" (firestore.rules hasPresentField), which is what makes a class+unit
+      // document queryable — `where("investigation", "==", null)` cannot match a missing field.
+      expect(getDocumentLocationFields("testClassWideKind", ctx)).toEqual({
+        unit: "sas",
+        context_id: "class-hash",
+        investigation: null,
+        problem: null
+      });
+    });
+
+    it("does not stamp an offering", () => {
+      expect(getDocumentLocationFields("testClassWideKind", ctx).offeringId).toBeUndefined();
+    });
+
+    it("leaves the group kind's location unchanged", () => {
+      expect(getDocumentLocationFields(GroupDocument, ctx)).toEqual({
+        unit: "sas", investigation: "1", problem: "2",
+        context_id: "class-hash", offeringId: "off-1"
+      });
+    });
   });
 });
diff --git a/src/models/document/document-kinds.ts b/src/models/document/document-kinds.ts
index b95e6c1e4e..cb2c730713 100644
--- a/src/models/document/document-kinds.ts
+++ b/src/models/document/document-kinds.ts
@@ -1,3 +1,4 @@
+import { upperFirst } from "lodash";
 import { IDocumentMetadata } from "../../../shared/shared";
 import {
   GroupDocument, LearningLogDocument, LearningLogPublication,
@@ -19,9 +20,13 @@ export type IDocumentKindMetadataFields = Pick<IDocumentMetadata, "kind" | "conc
 export type DocumentOwnerType = "user" | "group" | "class";
 
 /**
- * How a kind's `scope` axes (class, unit, investigation, problem, offering, group) are derived at creation.
+ * Which container a kind's documents are kept in, and with it their curriculum reach: "class" → the class,
+ * about no unit; "classUnit" → the class's copy of one unit, about that unit; "offering" → one assignment of
+ * a problem to a class, about that problem.
+ *
+ * One knob sets the container and curriculum axes values because that is the most convenient.
  */
-export type DocumentScopeType = "class" | "classUnit" | "offering" | "group";
+export type DocumentContainerType = "class" | "classUnit" | "offering";
 
 export interface IDocumentKindInfo {
   /** The kind key. Matches the value stored in a document's `kind` field. */
@@ -30,12 +35,21 @@ export interface IDocumentKindInfo {
   metadataFields: Omit<IDocumentKindMetadataFields, "kind">;
   /** How this kind's owner uid is derived. */
   ownerType: DocumentOwnerType;
-  /** How this kind's scope axes are derived. */
-  scopeType: DocumentScopeType;
+  /** Which container this kind's documents live in, and their curriculum reach. */
+  containerType: DocumentContainerType;
   /**
    * Static document display title. Leave undefined for dynamic titles.
    */
   title?: string;
+  /**
+   * The unit code whose config declared this kind. Set for kinds declared by a unit config; undefined
+   * for the built-in kinds, which are unit-independent.
+   *
+   * Kind names are not unique across configurations — two units may declare the same kind with different
+   * wording — and only the current unit's config is loaded. getKindDefinitionFor compares this against a
+   * document's own `unit` so one unit's definition is never applied to another unit's document.
+   */
+  unit?: string;
 }
 
 /**
@@ -54,10 +68,13 @@ export interface IDocumentOwnerContext {
 
 const kDocumentKindPattern = /^[a-z][a-zA-Z0-9]*$/;
 /**
- * A document `kind` is used as a Firestore path segment (the canonical-pointer slot) as well as the registry
- * key, so a kind is restricted to a camelCase identifier: a lowercase letter followed by letters/digits, with
- * no separators or special characters. This matches the built-in document type strings (e.g.
- * "learningLogPublication") and keeps the value safe as a Firestore document id.
+ * A `kind` is the registry key, and a class-wide document's canonical-pointer slot is labeled with its kind,
+ * so a kind has to be usable as a Firestore path segment. It is restricted to a camelCase identifier: a
+ * lowercase letter followed by letters/digits, with no separators or special characters. This matches the
+ * built-in document type strings (e.g. "learningLogPublication") and keeps the value safe as a document id.
+ *
+ * The reverse does not hold: a slot label need not be a kind. The group document's slot is labeled "default"
+ * while its kind is "group" — see kDefaultCanonicalDocumentLabel for what a label is.
  */
 export function isValidDocumentKind(value: string): boolean {
   return kDocumentKindPattern.test(value);
@@ -76,10 +93,49 @@ export function registerDocumentKind(kind: string, info: Omit<IDocumentKindInfo,
   gDocumentKindInfoMap[kind] = { kind, ...info };
 }
 
+/**
+ * Look a kind up by name alone, without asking which configuration defined it. Creation is the only
+ * caller: a document being created takes its kind from the config in hand, so the definition found is
+ * necessarily the one it is made from. Anything reading an existing document must use
+ * getKindDefinitionFor instead.
+ */
 export function getDocumentKindInfo(kind?: string|null) {
   return kind ? gDocumentKindInfoMap[kind] : undefined;
 }
 
+/**
+ * The fields that identify which definition a document was made from: its kind, and the association
+ * naming the configuration that declared that kind. Structural, so this stays a leaf module.
+ */
+export interface IKindScopedDocumentFields {
+  kind?: string | null;
+  unit?: string | null;
+}
+
+/**
+ * This document's kind definition, or undefined when no definition applicable to it is loaded.
+ *
+ * The single entry point for reading a kind definition off an existing document. It takes the document
+ * rather than the kind because a kind name does not identify a definition on its own: a kind declared by a
+ * unit config exists only while that unit is loaded, and two units may declare the same kind meaning
+ * different things (see IDocumentKindInfo.unit). Matching the document's `unit` against the definition's is
+ * what tells a definition that governs this document from one that merely shares its name.
+ *
+ * Undefined therefore means "no definition to read here", not "no such kind" — the document may well have
+ * been created from a perfectly good definition belonging to a unit that is not loaded. Sort Work lists
+ * documents from every unit a class has worked through, so this is ordinary rather than exceptional, and a
+ * caller must answer from the document's stored fields instead. Anything a definition contributes that
+ * cannot be recovered that way has to be stamped onto the document at creation.
+ */
+export function getKindDefinitionFor(doc: IKindScopedDocumentFields): IDocumentKindInfo | undefined {
+  const info = getDocumentKindInfo(doc.kind);
+  if (!info) return undefined;
+  // A built-in kind declares no unit: it is registered by the application, so it governs its documents
+  // wherever they came from.
+  if (info.unit != null && info.unit !== doc.unit) return undefined;
+  return info;
+}
+
 /** A kind's full stamp set (its metadataFields plus the `kind` key), or `{}` if the kind is unregistered. */
 export function getDocumentKindMetadataFields(kind?: string|null): IDocumentKindMetadataFields {
   const info = getDocumentKindInfo(kind);
@@ -92,50 +148,89 @@ export function getDocumentOwnerType(kind?: string|null): DocumentOwnerType {
 }
 
 /**
- * The owner uid to stamp on a new document of the given kind
+ * The owner uid to stamp on a new document of the given kind.
+ *
+ * Throws for a kind that is not registered, rather than defaulting to the creating user the way
+ * getDocumentOwnerType does. Defaulting here would hand a group's or a class's document to whoever
+ * happened to create it, and because a canonical slot is addressed by its owner, would file it in that
+ * user's slot instead of the shared one — both silently.
+ *
+ * A unit-declared kind is registered only while the unit declaring it is loaded, so this also states the
+ * rule that a document may be created only for a kind the current unit defines. Reading documents from
+ * other units is unaffected: nothing on the read side resolves an owner (see document-axes.ts).
  */
 export function getDocumentOwner(kind: string|null|undefined, ctx: IDocumentOwnerContext): string {
-  switch (getDocumentOwnerType(kind)) {
-    case "group": return ctx.groupOwnerId ?? ctx.userId;
-    case "class": return ctx.classOwnerId ?? ctx.userId;
+  const info = getDocumentKindInfo(kind);
+  if (!info) {
+    throw new Error(`Cannot resolve the owner of unregistered document kind "${kind}"`);
+  }
+  switch (info.ownerType) {
+    case "group": return requireOwnerId(ctx.groupOwnerId, kind, "group");
+    case "class": return requireOwnerId(ctx.classOwnerId, kind, "class");
     case "user":  return ctx.userId;
     default:      return ctx.userId;
   }
 }
 
+function requireOwnerId(ownerId: string | undefined, kind: string|null|undefined, ownerType: string): string {
+  if (!ownerId) {
+    throw new Error(`Cannot create a ${ownerType}-owned document of kind "${kind}": ` +
+      `no ${ownerType} owner id is available`);
+  }
+  return ownerId;
+}
+
+/**
+ * The stored owner-axis fields besides `uid`. A group owner's `groupId` is stored alongside the owner uid
+ * that already encodes it (`group_<offeringId>_<groupId>`), so Firestore rules and group-member lookups can
+ * read the group without parsing the uid.
+ */
+export interface IDocumentOwnerFields {
+  groupId?: string;
+}
+
+/**
+ * The owner fields to stamp on a new document of the given kind, beyond the owner uid getDocumentOwner
+ * returns. Only a group owner has one, so `groupId` is the creating user's current group — ignored for
+ * every other kind, and absent when they are in no group.
+ */
+export function getDocumentOwnerFields(
+  kind: string|null|undefined, groupId?: string
+): IDocumentOwnerFields {
+  if (getDocumentOwnerType(kind) !== "group" || !groupId) return {};
+  return { groupId };
+}
+
 /**
- * The scope fields a document draws from its runtime context, supplied by the caller because they depend on
- * the user's class, current group, offering, unit, and problem. Doubles as the return shape of
- * getDocumentScopeFields (the subset a given kind actually stamps).
+ * The container and curriculum values a document draws from its runtime context, supplied by the caller
+ * because they depend on the user's class, offering, unit, and problem. Doubles as the return shape of
+ * getDocumentLocationFields (the subset a given kind actually stamps).
  */
-export interface IDocumentScopeContext {
+export interface IDocumentLocationContext {
   unit: string | null;
-  investigation?: string;
-  problem?: string;
+  investigation?: string | null;
+  problem?: string | null;
   context_id: string;
-  groupId?: string;
   offeringId?: string;
 }
 
 /**
- * The scope fields to stamp on a document of the given kind, selected by its registered `scopeType`.
+ * The container and curriculum fields to stamp on a document of the given kind, selected by its registered
+ * `containerType` — which fixes both, so one lookup answers for both axes.
  */
-export function getDocumentScopeFields(
-  kind: string|null|undefined, ctx: IDocumentScopeContext
-): IDocumentScopeContext {
-  const scopeType = getDocumentKindInfo(kind)?.scopeType;
-  switch (scopeType) {
-    case "group": return {
-      unit: ctx.unit,
-      investigation: ctx.investigation,
-      problem: ctx.problem,
-      context_id: ctx.context_id,
-      offeringId: ctx.offeringId,
-      groupId: ctx.groupId
-    };
+export function getDocumentLocationFields(
+  kind: string|null|undefined, ctx: IDocumentLocationContext
+): IDocumentLocationContext {
+  switch (getDocumentKindInfo(kind)?.containerType) {
     case "classUnit": return {
       unit: ctx.unit,
-      context_id: ctx.context_id
+      context_id: ctx.context_id,
+      // Stated explicitly rather than omitted. A curriculum field written as null means "not about an
+      // investigation or problem" (firestore.rules `hasPresentField`), the same convention class-contained
+      // documents use for `unit: null`. It is what lets Sort Work query for documents about a unit but not
+      // a problem — Firestore cannot match a field that is missing.
+      investigation: null,
+      problem: null
     };
     case "class": return {
       unit: null,
@@ -159,8 +254,7 @@ export function getDocumentScopeFields(
  * The minimal document fields getDocumentTitle reads. Structural so the registry stays a leaf module that
  * doesn't import the document models.
  */
-interface IDocumentTitleFields {
-  kind?: string | null;
+interface IDocumentTitleFields extends IKindScopedDocumentFields {
   type?: string;
   groupId?: string | null;
 }
@@ -169,42 +263,70 @@ interface IDocumentTitleFields {
  * The display title for a document based on its kind
  */
 export function getDocumentTitle(document: IDocumentTitleFields): string | undefined {
-  const registeredTitle = getDocumentKindInfo(document.kind)?.title;
-  if (registeredTitle != null) return registeredTitle;
-  // Keyed on `type`, not `kind`: pre-existing group documents predate the `kind` axis and may have no stored
-  // `kind` yet. We backfill the kind on open but we need the title for the lists of documents before they
-  // are opened. Class-wide docs are new and always carry a `kind`, so their title is resolved above by kind.
-  if (document.type === GroupDocument) return `Group ${document.groupId} Document`;
+  // A document whose definition is not loaded resolves no title here and falls through to a caller's
+  // fallback, which names it from its stored fields instead.
+  const info = getKindDefinitionFor(document);
+  if (info?.title != null) return info.title;
+  // Keyed on `type` plus `groupId`, not `kind`: a group document may have no stored `kind` yet (we backfill
+  // the kind on open but need the title for the lists of documents before they are opened), so it cannot rely
+  // on the lookup above. Requiring `groupId` (not just `type === GroupDocument`) matters because a class-wide
+  // document also stores `type: "group"` but carries no `groupId` — if its `kind` is unregistered in this
+  // session (e.g. it belongs to a unit that has not loaded), the lookup above misses and execution reaches
+  // here; without the `groupId` check it would render as "Group undefined Document" instead of falling
+  // through to `undefined`, which callers already handle.
+  //
+  // TRANSITIONAL: this reads `type` only because a group document may carry no `kind`. Once
+  // scripts/backfill-group-document-axes.ts has stamped `kind` on every group document in every
+  // environment, this becomes `document.kind === GroupDocument` and the `groupId` check goes away with it —
+  // a class-wide document has its own kind, so it can no longer reach this branch at all.
+  if (document.type === GroupDocument && document.groupId) return `Group ${document.groupId} Document`;
   return undefined;
 }
 
+/**
+ * A readable label derived from the kind string alone: "drivingQuestionBoard" → "Driving Question
+ * Board". Registry-free by design, so it can name a document whose kind was declared by a unit config
+ * that is not loaded — the case getDocumentTitle cannot answer.
+ *
+ * It recovers the kind's identity, not the author's wording: a slot titled "Our Big Questions" in its
+ * own unit reads as "Driving Question Board" from elsewhere.
+ */
+export function getDocumentKindLabel(kind?: string | null): string | undefined {
+  if (!kind) return undefined;
+  return upperFirst(kind.replace(/([A-Z])/g, " $1"));
+}
+
 /**
  * Register a kind declared by a unit's `classWideDocuments` configuration. Every class-wide collaborative
- * document has the same shape — concurrent, owned by the synthetic class owner, scoped to the class + unit —
- * so only the kind key and the authored title come from the configuration. The title is registered rather than
- * stored per document so it resolves live by kind (see getDocumentTitle). Throws like registerDocumentKind
- * when the kind is malformed or already registered.
+ * document has the same shape — concurrent, owned by the synthetic class owner, kept in the class's copy of
+ * the unit and about that unit and nothing narrower — so only the kind key, the authored title, and the
+ * declaring unit come from the configuration. The title is registered rather than stored per document so it
+ * resolves live by kind (see getDocumentTitle). Throws like registerDocumentKind when the kind is malformed
+ * or already registered.
  */
-export function registerClassWideDocumentKind(kind: string, title: string) {
+export function registerClassWideDocumentKind(kind: string, title: string, unit: string) {
   registerDocumentKind(kind, {
     metadataFields: { concurrent: true },
     ownerType: "class",
-    scopeType: "classUnit",
-    title
+    containerType: "classUnit",
+    title,
+    unit
   });
 }
 
 function registerBuiltInDocumentKinds() {
+  // A group document is kept in the offering, like the problem documents beside it; what makes it a group's
+  // is its owner, which is also where its stored `groupId` comes from (see getDocumentOwnerFields).
   registerDocumentKind(GroupDocument, {
     metadataFields: { concurrent: true },
     ownerType: "group",
-    scopeType: "group"
+    containerType: "offering"
   });
 
   const personalLikeKindInfo = {
     metadataFields: { },
     ownerType: "user",
-    scopeType: "class"
+    containerType: "class"
   } as const;
   registerDocumentKind(PersonalDocument, personalLikeKindInfo);
   registerDocumentKind(LearningLogDocument, personalLikeKindInfo);
@@ -214,7 +336,7 @@ function registerBuiltInDocumentKinds() {
   const problemLikeKindInfo = {
     metadataFields: { },
     ownerType: "user",
-    scopeType: "offering"
+    containerType: "offering"
   } as const;
   registerDocumentKind(PlanningDocument, problemLikeKindInfo);
   registerDocumentKind(ProblemDocument, problemLikeKindInfo);
diff --git a/src/models/document/document-utils.test.ts b/src/models/document/document-utils.test.ts
index 40f9779f4d..a094c029ca 100644
--- a/src/models/document/document-utils.test.ts
+++ b/src/models/document/document-utils.test.ts
@@ -1,10 +1,11 @@
-import { IDocumentMetadata } from "../../../shared/shared";
 import { UnitModel } from "../curriculum/unit";
 import { AppConfigModel } from "../stores/app-config-model";
 import { UserModel } from "../stores/user";
 import { DocumentMetadataModel } from "../document/document-metadata-model";
-import { DocumentModel } from "./document";
-import { GroupDocument, PersonalDocument, ProblemDocument, SupportPublication } from "./document-types";
+import { createDocumentModel } from "./document";
+import { getGroupOwnerId } from "./document-axes";
+import { ExemplarDocument, GroupDocument, PersonalDocument, ProblemDocument, ProblemPublication,
+  SupportPublication } from "./document-types";
 import { canUserEditDocument, getDocumentDisplayTitle, isDocumentAccessibleToUser } from "./document-utils";
 import { registerDocumentKind } from "./document-kinds";
 import { unitConfigDefaults } from "../../test-fixtures/sample-unit-configurations";
@@ -194,7 +195,7 @@ describe("document utils", () => {
 
       test("a class-wide document uses its kind's registered title (resolved by kind, not stored)", () => {
         registerDocumentKind("testClassWideTitle", {
-          metadataFields: { concurrent: true }, ownerType: "class", scopeType: "classUnit",
+          metadataFields: { concurrent: true }, ownerType: "class", containerType: "classUnit",
           title: "Driving Question Board"
         });
         const metadata = DocumentMetadataModel.create({
@@ -204,69 +205,257 @@ describe("document utils", () => {
         expect(getDocumentDisplayTitle(unit, metadata, appConfig)).toBe("Driving Question Board");
       });
     });
+
+    describe("class-wide documents from another unit", () => {
+      // Under the Sort Work "All" filter a class sees every document it owns, including class-wide
+      // documents from units it has already worked through. Those units' configs are not loaded, so
+      // their kinds' titles cannot be looked up and the documents store no title of their own.
+      const unit = UnitModel.create({ code: "test", title: "test" });
+      const appConfig = AppConfigModel.create({ config: unitConfigDefaults });
+
+      test("names the document by its kind and the unit it came from", () => {
+        const metadata = DocumentMetadataModel.create({
+          type: GroupDocument, kind: "drivingQuestionBoard", uid: "class_c1", key: "dqb-other",
+          unit: "other", investigation: null, problem: null
+        });
+        expect(getDocumentDisplayTitle(unit, metadata, appConfig)).toBe("Driving Question Board (other)");
+      });
+
+      test("does not borrow the current unit's title for another unit's document of the same kind", () => {
+        registerDocumentKind("testSharedKind", {
+          metadataFields: { concurrent: true }, ownerType: "class", containerType: "classUnit",
+          title: "Our Big Questions", unit: "test"
+        });
+        const ownUnitDoc = DocumentMetadataModel.create({
+          type: GroupDocument, kind: "testSharedKind", uid: "class_c1", key: "dqb-own", unit: "test"
+        });
+        const otherUnitDoc = DocumentMetadataModel.create({
+          type: GroupDocument, kind: "testSharedKind", uid: "class_c1", key: "dqb-other", unit: "other"
+        });
+        expect(getDocumentDisplayTitle(unit, ownUnitDoc, appConfig)).toBe("Our Big Questions");
+        expect(getDocumentDisplayTitle(unit, otherUnitDoc, appConfig)).toBe("Test Shared Kind (other)");
+      });
+
+      test("falls back to the kind alone when the document has no unit", () => {
+        const metadata = DocumentMetadataModel.create({
+          type: GroupDocument, kind: "drivingQuestionBoard", uid: "class_c1", key: "dqb-no-unit"
+        });
+        expect(getDocumentDisplayTitle(unit, metadata, appConfig)).toBe("Driving Question Board");
+      });
+    });
   });
 
   describe("canUserEditDocument", () => {
-    const me = "student-1";
-    const myGroup = "3";
+    const student = UserModel.create({ id: "me", type: "student", name: "Me", classHash: "class-1" });
+    const kOffering = "off-1";
+    // A group document's owner, the same synthetic id the app stamps at creation.
+    const groupOwner = (groupId: string, offeringId = kOffering) => getGroupOwnerId(offeringId, groupId);
+    const groupedStudent = UserModel.create({
+      id: "me", type: "student", name: "Me", classHash: "class-1",
+      currentGroupId: "3", offeringId: kOffering
+    });
+    const teacher = UserModel.create({ id: "t1", type: "teacher", name: "Teacher", classHash: "class-1" });
+    const researcher = UserModel.create({ id: "r1", type: "researcher", name: "Researcher", classHash: "class-1" });
 
-    const user = (currentGroupId?: string) => UserModel.create({ id: me, currentGroupId });
-    const metadata = (props: Partial<IDocumentMetadata>): IDocumentMetadata =>
-      ({ key: "doc-1", uid: me, type: ProblemDocument, ...props });
+    const metadata = (props: Record<string, any>) =>
+      DocumentMetadataModel.create({ uid: "someone-else", type: GroupDocument, key: "k", ...props });
 
-    it("allows editing the user's own document", () => {
+    /**
+     * A group document as the app actually stamps it: kept in an offering, so it carries an
+     * `offeringId` and the owning class. Both matter — without the `offeringId` the document reads as
+     * class-wide, and the class check would then let any classmate edit another group's work.
+     */
+    const groupDocMetadata = (groupId: string, offeringId = kOffering) => metadata({
+      uid: groupOwner(groupId, offeringId), concurrent: true, groupId,
+      unit: "sas", investigation: "1", problem: "2", offeringId, context_id: "class-1"
+    });
+
+    it("allows a user to edit their own document", () => {
       expect(canUserEditDocument({
-        documentMetadata: metadata({ uid: me }), user: user(myGroup)
+        documentMetadata: metadata({ uid: "me", type: ProblemDocument }), user: student
       })).toBe(true);
     });
 
-    it("allows editing the user's own group document, even when created by another group member", () => {
+    it("refuses another student's single-writer document", () => {
+      expect(canUserEditDocument({
+        documentMetadata: metadata({ type: ProblemDocument }), user: student
+      })).toBe(false);
+    });
+
+    it("allows a member of the owning group to edit a group document", () => {
       expect(canUserEditDocument({
-        documentMetadata: metadata({ uid: "student-2", type: GroupDocument, groupId: myGroup }), user: user(myGroup)
+        documentMetadata: groupDocMetadata("3"), user: groupedStudent
       })).toBe(true);
     });
 
-    it("does not allow editing another group's document", () => {
+    it("refuses another group's document, even to a classmate of its owners", () => {
+      // The document is in this student's own class, so only its offering keeps the class-wide branch
+      // from reaching it.
       expect(canUserEditDocument({
-        documentMetadata: metadata({ uid: "student-9", type: GroupDocument, groupId: "7" }), user: user(myGroup)
+        documentMetadata: groupDocMetadata("7"), user: groupedStudent
       })).toBe(false);
     });
 
-    it("does not allow editing another student's (non-group) document", () => {
+    it("refuses the same group number in a different offering — a different set of students", () => {
+      // Sort Work's "All" filter lists documents from every offering the class has worked through,
+      // so this document does reach the check. Group ids are unique only within an offering.
       expect(canUserEditDocument({
-        documentMetadata: metadata({ uid: "student-2" }), user: user(myGroup)
+        documentMetadata: groupDocMetadata("3", "other-offering"), user: groupedStudent
       })).toBe(false);
     });
 
-    it("does not allow editing a group document when the user isn't in a group", () => {
+    it("refuses a group document when the user is not in a group", () => {
       expect(canUserEditDocument({
-        documentMetadata: metadata({ uid: "student-2", type: GroupDocument, groupId: myGroup }), user: user()
+        documentMetadata: groupDocMetadata("3"), user: student
       })).toBe(false);
     });
 
-    it("does not treat a missing document uid as a match", () => {
-      expect(canUserEditDocument({ user: user(myGroup) })).toBe(false);
+    it("allows any member of the class to edit a class-wide document", () => {
+      expect(canUserEditDocument({
+        documentMetadata: metadata({
+          concurrent: true, unit: "sas", investigation: null, context_id: "class-1"
+        }),
+        user: student
+      })).toBe(true);
     });
 
-    it("recognizes an own-group doc from the document when no metadata is available", () => {
-      const document = DocumentModel.create({
-        key: "doc-1", uid: "student-2", type: GroupDocument, groupId: myGroup
-      });
-      expect(canUserEditDocument({ document, user: user(myGroup) })).toBe(true);
+    it("refuses a class-wide document belonging to another class", () => {
+      expect(canUserEditDocument({
+        documentMetadata: metadata({
+          concurrent: true, unit: "sas", investigation: null, context_id: "class-2"
+        }),
+        user: student
+      })).toBe(false);
+    });
+
+    // An exemplar belongs to no offering, so it sits in the same container as a class-wide document
+    // and `isInClassUnitContainer` is true for it. What keeps it read-only is that it is single-writer.
+    it("refuses a curriculum exemplar", () => {
+      expect(canUserEditDocument({
+        document: createDocumentModel({
+          uid: "ivan_idea_1", type: ExemplarDocument, key: "ex-1",
+          unit: "sas", investigation: "1", problem: "2"
+        }),
+        user: student
+      })).toBe(false);
+    });
+
+    it("refuses the metadata record written when a teacher comments on an exemplar", () => {
+      // Unlike the curriculum document it mirrors, this record is stamped with the commenting class's
+      // `context_id` (create-firestore-metadata-document.ts), so the class check inside the container
+      // branch would pass. Being single-writer is the only thing standing between it and an Edit button.
+      expect(canUserEditDocument({
+        documentMetadata: metadata({
+          uid: "ivan_idea_1", type: ExemplarDocument,
+          unit: "sas", investigation: "1", problem: "2", context_id: "class-1"
+        }),
+        user: student
+      })).toBe(false);
     });
 
-    // The reactivity fix: the metadata is kept in sync by Firestore listeners while the lazily-fetched
-    // full document may still be missing the group id, so the metadata wins field by field.
-    it("prefers the metadata groupId over the document's", () => {
-      const document = DocumentModel.create({
-        key: "doc-1", uid: "student-2", type: GroupDocument
+    it("refuses a document that is not concurrent even inside the user's own scope", () => {
+      expect(canUserEditDocument({
+        documentMetadata: metadata({ unit: "sas", investigation: null, context_id: "class-1" }),
+        user: student
+      })).toBe(false);
+    });
+
+    it("returns false when neither a document nor metadata is supplied", () => {
+      expect(canUserEditDocument({ user: student })).toBe(false);
+    });
+
+    it("refuses a user's own published document — publishing copies it under the publisher's uid," +
+       " it is not a live editable document", () => {
+      expect(canUserEditDocument({
+        documentMetadata: metadata({ uid: "me", type: ProblemPublication }), user: student
+      })).toBe(false);
+    });
+
+    it("allows a researcher to edit their own document", () => {
+      expect(canUserEditDocument({
+        documentMetadata: metadata({ uid: "r1", type: ProblemDocument }), user: researcher
+      })).toBe(true);
+    });
+
+    it("refuses a researcher editing a class-wide document even though their classHash matches", () => {
+      expect(canUserEditDocument({
+        documentMetadata: metadata({
+          concurrent: true, unit: "sas", investigation: null, context_id: "class-1"
+        }),
+        user: researcher
+      })).toBe(false);
+    });
+
+    it("allows a teacher to edit a class-wide document belonging to their class", () => {
+      expect(canUserEditDocument({
+        documentMetadata: metadata({
+          concurrent: true, unit: "sas", investigation: null, context_id: "class-1"
+        }),
+        user: teacher
+      })).toBe(true);
+    });
+
+    it("refuses a class-wide document when context_id and the user's classHash are both empty", () => {
+      // Guards the `!!contextId &&` check: without it, an empty-string context_id would equal a
+      // user's default empty-string classHash and incorrectly grant access.
+      const noClassUser = UserModel.create({ id: "me", type: "student", name: "Me" });
+      expect(noClassUser.classHash).toBe("");
+      expect(canUserEditDocument({
+        documentMetadata: metadata({
+          concurrent: true, unit: "sas", investigation: null, context_id: ""
+        }),
+        user: noClassUser
+      })).toBe(false);
+    });
+
+    it("prefers the reactive metadata's owner over a still-loading document", () => {
+      // A groupmate's document syncs into the metadata before its content finishes loading; reading
+      // the metadata per field is what makes the Edit button appear without a reload.
+      const stillLoading = createDocumentModel({
+        uid: "", type: GroupDocument, key: "k", concurrent: true
       });
-      expect(document.groupId).toBeUndefined();
       expect(canUserEditDocument({
-        document, documentMetadata: metadata({ uid: "student-2", type: GroupDocument, groupId: myGroup }),
-        user: user(myGroup)
+        document: stillLoading,
+        documentMetadata: metadata({
+          uid: groupOwner("3"), concurrent: true, groupId: "3", unit: "sas", investigation: "1"
+        }),
+        user: groupedStudent
       })).toBe(true);
     });
+
+    it("does not treat a document model's groupId as evidence of group ownership", () => {
+      // A `groupId` on the model does not make a document group-owned — only the owner uid does, via
+      // hasGroupOwner reading its prefix. So a group number matching the user's own must not grant an
+      // edit by itself.
+      const authoredByAGroupmate = createDocumentModel({
+        uid: "someone-else", type: ProblemDocument, key: "k", concurrent: true,
+        groupId: "3", unit: "sas", investigation: "1"
+      });
+      expect(authoredByAGroupmate.groupId).toBe("3");
+      expect(canUserEditDocument({ document: authoredByAGroupmate, user: groupedStudent })).toBe(false);
+    });
+
+    it("allows a user to edit their own document via the document-only path (no metadata)", () => {
+      const ownDocument = createDocumentModel({ uid: "me", type: ProblemDocument, key: "k" });
+      expect(canUserEditDocument({ document: ownDocument, user: student })).toBe(true);
+    });
+
+    it("allows any member of the class to edit a class-wide document via the document-only path" +
+       " (no metadata)", () => {
+      const classWideDocument = createDocumentModel({
+        uid: "someone-else", type: GroupDocument, key: "k", concurrent: true,
+        unit: "sas", contextId: "class-1"
+      });
+      expect(canUserEditDocument({ document: classWideDocument, user: student })).toBe(true);
+    });
+
+    it("allows a group member to edit their group's document via the document-only path (no metadata)", () => {
+      const groupDocument = createDocumentModel({
+        uid: groupOwner("3"), type: GroupDocument, key: "k", concurrent: true,
+        unit: "sas", investigation: "1", offeringId: kOffering
+      });
+      expect(canUserEditDocument({ document: groupDocument, user: groupedStudent })).toBe(true);
+    });
   });
 });
 
diff --git a/src/models/document/document-utils.ts b/src/models/document/document-utils.ts
index 926d30c3b2..4a8556bf1d 100644
--- a/src/models/document/document-utils.ts
+++ b/src/models/document/document-utils.ts
@@ -1,6 +1,6 @@
 import { upperFirst } from "lodash";
 import { getParent } from "mobx-state-tree";
-import { IDocumentMetadata, IDocumentMetadataBase } from "../../../shared/shared";
+import { IDocumentMetadataBase } from "../../../shared/shared";
 import { getLocalTimeStamp } from "../../utilities/time";
 import { translate } from "../../utilities/translation/translate";
 import { SectionModelType } from "../curriculum/section";
@@ -10,7 +10,8 @@ import { AppConfigModelType } from "../stores/app-config-model";
 import { UserModelType } from "../stores/user";
 import { DocumentModelType, IExemplarVisibilityProvider } from "./document";
 import { DocumentContentModelType } from "./document-content";
-import { getDocumentTitle } from "./document-kinds";
+import { getCurriculumLabel, isInClassUnitContainer } from "./document-axes";
+import { getDocumentKindLabel, getDocumentTitle } from "./document-kinds";
 import { GroupDocument, isExemplarType, isPlanningType, isProblemType,
   isPublishedType, isSupportType } from "./document-types";
 
@@ -24,20 +25,33 @@ function getProblemFromDoc(unit: UnitModelType, document: DocumentModelType | ID
 }
 
 function getDocumentTitleFromProblem(currentUnit: UnitModelType, document: DocumentModelType | IDocumentMetadataModel) {
-  const {type, unit, investigation, problem} = document;
   const problemModel = getProblemFromDoc(currentUnit, document);
   if (problemModel) {
-    if (isPlanningType(type)) {
+    if (isPlanningType(document.type)) {
       return `${problemModel.title}: Planning`;
     }
     return problemModel.title;
   }
 
   const upperType = upperFirst(document.type);
-  if (!unit) {
+  const curriculumLabel = getCurriculumLabel(document);
+  if (!curriculumLabel) {
     return `${upperType} doc without ${translate("contentLevel.unit")}`;
   }
-  return `${upperType} doc from ${unit}-${investigation}.${problem}`;
+  return `${upperType} doc from ${curriculumLabel}`;
+}
+
+/**
+ * A stand-in title for a document that stores none and whose kind resolves no title (see
+ * getDocumentTitle). The kind names what the document is; the curriculum position says where it came
+ * from, read from the stored fields because an unresolvable kind gives no indication of where the
+ * document sits.
+ */
+function getUnresolvedDocumentTitle(document: DocumentModelType | IDocumentMetadataModel) {
+  const kindLabel = getDocumentKindLabel(document.kind);
+  if (!kindLabel) return undefined;
+  const curriculumLabel = getCurriculumLabel(document);
+  return curriculumLabel ? `${kindLabel} (${curriculumLabel})` : kindLabel;
 }
 
 export function getDocumentTitleWithTimestamp(
@@ -70,7 +84,9 @@ export function getDocumentDisplayTitle(
   } else if (isProblemType(type) || isPlanningType(type)) {
     return getDocumentTitleFromProblem(unit, document);
   } else {
-    return getDocumentTitleWithTimestamp(document, appConfig);
+    const storedTitle = getDocumentTitleWithTimestamp(document, appConfig);
+    if (storedTitle) return storedTitle;
+    return getUnresolvedDocumentTitle(document) ?? storedTitle;
   }
 }
 
@@ -123,27 +139,69 @@ export function isDocumentAccessibleToUser ({
 
 interface ICanUserEditDocumentParams {
   document?: DocumentModelType;
-  // `properties` is omitted so an IDocumentMetadataModel can be passed: the model stores properties in an
-  // observable map rather than a Record. See the compile-time checks in document-metadata-model.ts.
-  documentMetadata?: Omit<IDocumentMetadata, "properties">;
+  documentMetadata?: IDocumentMetadataBase;
   user: UserModelType;
 }
+
 /**
- * Whether the user can edit the document: true when it's their own document, or when it's a
- * collaborative document owned by their group (created by any member of the group).
+ * Whether this user may edit this document — the gate on every Edit button.
+ *
+ * A published document is a read-only snapshot, not editable by anyone, including its own
+ * publisher — publishing copies the document under the publisher's uid, so the ownership check
+ * alone can't tell a live document from its published copy. Beyond that exclusion, a user may
+ * always edit their own document; otherwise only a `concurrent` (multi-writer) document is
+ * editable by someone other than its owner, and then only by someone the document reaches: a class-wide
+ * document by any member of its class (teachers included — they belong to the class too), a group
+ * document by any member of its group.
+ *
+ * A researcher gets no edit affordance on anyone else's document, including the concurrent documents
+ * of a class or group they observe. The check sits *after* the ownership test on purpose: a researcher
+ * still has documents created for them under their own uid, and locking them out of those would serve
+ * nothing. Their uid is their own — the portal signs a researcher's JWT for the authenticated user and
+ * carries the student being viewed in a separate `target_user_id` claim — so the ownership test can
+ * never match a student's document for them.
+ *
+ * The Firestore metadata is preferred over the loaded document, because it is reactive and arrives
+ * first: a groupmate's document is listed before its content finishes loading, and the Edit button
+ * appears without a reload. The document is the fallback for the workspace, which opens documents
+ * without looking their metadata up. Every field read here is stamped once at creation, so the two
+ * sources never disagree — which is why one is chosen outright rather than field by field.
+ *
+ * This is an example of the `permissions` axis. See the
+ * `permissions` section of docs/document-axes/axes.md and "Not covered yet" in
+ * docs/document-axes/reading-axes-in-code.md.
  */
 export function canUserEditDocument({
   document, documentMetadata, user
 }: ICanUserEditDocumentParams): boolean {
-  // Prefer the reactive Firestore metadata field-by-field, falling back to the lazily-fetched full document,
-  // so the answer updates as soon as a groupmate's document syncs rather than on the next reload.
-  const uid = documentMetadata?.uid ?? document?.uid;
-  const type = documentMetadata?.type ?? document?.type;
-  const groupId = documentMetadata?.groupId ?? document?.groupId;
+  const metadata = documentMetadata ?? document?.metadata;
+  if (!metadata) return false;
+
+  const { uid, type, concurrent, context_id: contextId } = metadata;
 
+  if (type && isPublishedType(type)) return false;
   if (!!uid && uid === user.id) return true;
+  if (user.isResearcher) return false;
+  if (!concurrent) return false;
+  // Beyond this point the user must be inside the document's container, asked at the narrowest level the
+  // document is kept at. A group document is kept in an offering, so its group is asked first.
+  if (isUserInDocumentsGroup(uid, user)) return true;
+  if (isInClassUnitContainer(metadata)) {
+    return !!contextId && contextId === user.classHash;
+  }
+  return false;
+}
 
-  // A collaborative (multi-writer) document is editable by the members of the group that owns it.
-  const isCollaborativeDoc = type === GroupDocument;
-  return isCollaborativeDoc && !!user.currentGroupId && groupId === user.currentGroupId;
+/**
+ * Whether the user belongs to the group that owns this document.
+ *
+ * Compares owners rather than group ids. A group id is unique only within an offering — groups live
+ * at `offerings/<offeringId>/groups` — so the same group number in another offering is a different
+ * set of students. The owner (`group_<offeringId>_<groupId>`) carries the offering, which makes the
+ * comparison exact; Sort Work's "All" filter lists documents from every offering the class has
+ * worked through, so documents from another offering do reach this check.
+ */
+function isUserInDocumentsGroup(uid: string | null | undefined, user: UserModelType): boolean {
+  if (!uid || !user.currentGroupId || !user.offeringId) return false;
+  return uid === user.userIdForGroupDocuments;
 }
diff --git a/src/models/document/document.ts b/src/models/document/document.ts
index 881936a83f..addca2dccb 100644
--- a/src/models/document/document.ts
+++ b/src/models/document/document.ts
@@ -78,7 +78,8 @@ export const DocumentModel = Tree.named("Document")
      * live document, frozen at publish time for a publication. Set only where the owner is a user, since
      * a group- or class-owned document has no user to look up. It is a fact about that user's
      * membership, not about the document, so it says nothing about who owns this. The four-up view and
-     * the content listener want this one; anything asking "whose document is this" wants `groupId`.
+     * the content listener want this one; anything asking "whose document is this" wants `groupId` or
+     * the owner guards in document-axes.ts.
      */
     groupIdOfUserOwner: types.maybe(types.string),
     visibility: types.maybe(VisibilityTypeEnum),
@@ -149,13 +150,13 @@ export const DocumentModel = Tree.named("Document")
       return !!self.content;
     },
     get metadata(): IDocumentMetadata {
-      const { uid, groupId, type, key, createdAt, title, originDoc, properties, visibility, concurrent,
-              kind } = self;
+      const { uid, groupId, type, key, createdAt, title, originDoc, properties, visibility, concurrent, kind,
+              contextId } = self;
       // `groupId` is undefined for everything but a group document, matching the stored field it mirrors,
       // so this shape agrees with what Firestore holds. The owning user's group is deliberately absent: it is
       // not document metadata. Nothing writes this back to Firestore or Firebase today — it is used for
-      // finding Firestore documents.
-      return { uid, groupId, type, key, createdAt, title, concurrent, kind,
+      // finding Firestore documents and for reading a document's axes.
+      return { uid, groupId, type, key, createdAt, title, concurrent, kind, context_id: contextId,
         originDoc, properties: properties.toJSON(), investigation: self.investigation,
         problem: self.problem, unit: self.unit, offeringId: self.offeringId, visibility } as IDocumentMetadata;
     },
diff --git a/src/models/stores/document-group.test.ts b/src/models/stores/document-group.test.ts
index b904bdcba2..bc2c99f0c7 100644
--- a/src/models/stores/document-group.test.ts
+++ b/src/models/stores/document-group.test.ts
@@ -6,6 +6,7 @@ import { SnapshotIn } from "mobx-state-tree";
 import { clearTermOverrides, setTermOverrides } from "../../utilities/translation/translate";
 import { createDocumentModel, DocumentModelSnapshotType, DocumentModelType } from "../document/document";
 import { DocumentContentSnapshotType } from "../document/document-content";
+import { getGroupOwnerId } from "../document/document-axes";
 import { GroupDocument, ProblemDocument } from "../document/document-types";
 import { ClassModel, ClassModelType, ClassUserModel } from "./class";
 import { GroupModel, GroupsModel, GroupsModelType, GroupUserModel } from "./groups";
@@ -15,6 +16,10 @@ import { DocumentMetadataStore } from "./document-metadata-store";
 import { DB } from "../../lib/db";
 import { Bookmark, Bookmarks } from "./bookmarks";
 
+// The offering these mock groups belong to. A group id is unique only within one offering, so a group
+// document identifies its group through the synthetic owner uid the app stamps, not by a bare id.
+const kOffering = "offering-1";
+
 //****************************************** Documents Mock ***************************************
 
 const mockDocumentsData: DocumentModelSnapshotType[] = [
@@ -35,13 +40,17 @@ const mockDocumentsData: DocumentModelSnapshotType[] = [
     type: ProblemDocument, key:"Student 4 Problem Doc Group 3", groupIdOfUserOwner: "3", createdAt: 4,
     content: { tiles: [] } as DocumentContentSnapshotType
   },
-  { uid: "2", //Scott (group doc for group 3)
+  { uid: getGroupOwnerId(kOffering, "3"), // owned by the group, not by whoever created it
     type: GroupDocument, key:"Group 3 Group Doc", groupId: "3", createdAt: 5,
     content: { tiles: [] } as DocumentContentSnapshotType
   },
-  { uid: "1", //Joe (group doc for group 5)
+  { uid: getGroupOwnerId(kOffering, "5"),
     type: GroupDocument, key:"Group 5 Group Doc", groupId: "5", createdAt: 6,
     content: { tiles: [] } as DocumentContentSnapshotType
+  },
+  { uid: "class_mock", // the class-wide synthetic owner
+    type: GroupDocument, key:"Class Wide Doc", createdAt: 7, unit: "sas",
+    content: { tiles: [] } as DocumentContentSnapshotType
   }
 ];
 
@@ -79,20 +88,32 @@ const mockMetadataDocuments: SnapshotIn<typeof MetadataDocMapModel> = {
     problem: "2"
   },
   "Group 3 Group Doc": {
-    uid: "2",
+    uid: getGroupOwnerId(kOffering, "3"),   // the synthetic group owner, as the app stamps it
     type: GroupDocument, key:"Group 3 Group Doc", createdAt: 5,
     tools: [],
     groupId: "3",
+    offeringId: kOffering,
     investigation: "1",
     problem: "2"
   },
   "Group 5 Group Doc": {
-    uid: "1",
+    uid: getGroupOwnerId(kOffering, "5"),
     type: GroupDocument, key:"Group 5 Group Doc", createdAt: 6,
     tools: [],
     groupId: "5",
+    offeringId: kOffering,
     investigation: "1",
     problem: "1"
+  },
+  "Class Wide Doc": {
+    uid: "class_mock",
+    type: GroupDocument, key: "Class Wide Doc", createdAt: 7,
+    tools: [],
+    unit: "sas",
+    investigation: null,
+    problem: null,
+    kind: "drivingQuestionBoard",
+    concurrent: true
   }
 };
 
@@ -164,6 +185,7 @@ const createMockGroups = (mockClass?: ClassModelType) => {
 
   const env = mockClass ? { class: mockClass } : undefined;
   const mockGroups = GroupsModel.create({
+    offeringId: kOffering,
     groupsMap: {
       3: GroupModel.create({ id: "3", users: group3Users }),
       5: GroupModel.create({ id: "5", users: group5Users }),
@@ -239,8 +261,11 @@ describe('DocumentGroup Model', () => {
 
       const documentsByGroup = sortedDocuments.sortBy("Group");
 
+      // documentsByGroup[0] is "Whole Class" (the class-wide document, not bookmarked); group
+      // sections follow it in numeric order.
+
       // Group 3: Scott (bookmarked), Kirk (not), Group 3 group doc (not)
-      const documentCollection = documentsByGroup[0].byBookmarked;
+      const documentCollection = documentsByGroup[1].byBookmarked;
       expect(documentCollection.length).toBe(2);
       expect(documentCollection[0].label).toBe("Bookmarked");
       expect(documentCollection[0].documents.length).toBe(1);
@@ -248,7 +273,7 @@ describe('DocumentGroup Model', () => {
       expect(documentCollection[1].documents.length).toBe(2);
 
       // Group 5: Joe (bookmarked), Group 5 group doc (not)
-      const documentCollection2 = documentsByGroup[1].byBookmarked;
+      const documentCollection2 = documentsByGroup[2].byBookmarked;
       expect(documentCollection2.length).toBe(2);
       expect(documentCollection2[0].label).toBe("Bookmarked");
       expect(documentCollection2[0].documents.length).toBe(1);
@@ -256,7 +281,7 @@ describe('DocumentGroup Model', () => {
       expect(documentCollection2[1].documents.length).toBe(1);
 
       // Group 9: Dennis (not bookmarked)
-      const documentCollection3 = documentsByGroup[2].byBookmarked;
+      const documentCollection3 = documentsByGroup[3].byBookmarked;
       expect(documentCollection3.length).toBe(2);
       expect(documentCollection3[0].label).toBe("Bookmarked");
       expect(documentCollection3[0].documents.length).toBe(0);
@@ -328,13 +353,30 @@ describe('DocumentGroup Model', () => {
       expect(collection3[0].documents.length).toBe(2);
     });
 
+    it('puts a class-wide collaborative document in its own Whole Class section, ordered first', () => {
+      const byGroupDocs = sortedDocuments.sortBy("Group");
+      expect(byGroupDocs.map(d => d.label)).toEqual(["Whole Class", "Group 3", "Group 5", "Group 9"]);
+
+      const wholeClass = byGroupDocs[0];
+      expect(wholeClass.documents.map(d => d.key)).toEqual(["Class Wide Doc"]);
+    });
+
+    it('does not file a class-wide document under a numbered group', () => {
+      const byGroupDocs = sortedDocuments.sortBy("Group");
+      const groupSections = byGroupDocs.filter(d => d.label !== "Whole Class");
+      expect(groupSections.some(s => s.documents.some(d => d.key === "Class Wide Doc"))).toBe(false);
+    });
+
   });
 
   describe("byName Function", () => {
     it ('should return a document collection alphabetized by last name with the correct documents per user', () => {
       const byGroupDocs = sortedDocuments.sortBy("Group");
+      // byGroupDocs[0] is "Whole Class" (the class-wide document produces no name section); group
+      // sections follow it in numeric order.
+
       // Group 3: Scott, Kirk, and Group 3 group doc
-      const documentGroup = byGroupDocs[0];
+      const documentGroup = byGroupDocs[1];
       const documentCollection = documentGroup.byName;
       expect(documentCollection.length).toBe(2);
       expect(documentCollection[0].label).toBe("Cytacki, Scott");
@@ -345,7 +387,7 @@ describe('DocumentGroup Model', () => {
       expect(documentCollection[1].documents.length).toBe(2);
 
       // Group 5: Joe and Group 5 group doc
-      const documentGroup2 = byGroupDocs[1];
+      const documentGroup2 = byGroupDocs[2];
       const documentCollection2 = documentGroup2.byName;
       expect(documentCollection2.length).toBe(1);
       expect(documentCollection2[0].label).toBe("Bacal, Joe");
@@ -353,7 +395,7 @@ describe('DocumentGroup Model', () => {
       expect(documentCollection2[0].documents.length).toBe(2);
 
       // Group 9: Dennis (no group doc for group 9)
-      const documentGroup3 = byGroupDocs[2];
+      const documentGroup3 = byGroupDocs[3];
       const documentCollection3 = documentGroup3.byName;
       expect(documentCollection3.length).toBe(1);
       expect(documentCollection3[0].label).toBe("Cao, Dennis");
@@ -363,8 +405,8 @@ describe('DocumentGroup Model', () => {
     it('should include group documents under each member of the group', () => {
       // Sort directly by Name to test the top-level byName behavior
       const byNameDocs = sortedDocuments.sortBy("Name");
-      // Should have 4 name sections (alphabetical): Bacal, Cao, Cytacki, Swenson
-      expect(byNameDocs.length).toBe(4);
+      // Five sections: the four named students alphabetically, then the authorless section last.
+      expect(byNameDocs.length).toBe(5);
 
       // Bacal, Joe (Group 5) - own doc + Group 5 group doc
       expect(byNameDocs[0].label).toBe("Bacal, Joe");
@@ -395,7 +437,73 @@ describe('DocumentGroup Model', () => {
       // Group documents should not appear as their own name entry
       const labels = byNameDocs.map(d => d.label);
       expect(labels).not.toContain("Unknown");
-      expect(labels).toEqual(["Bacal, Joe", "Cao, Dennis", "Cytacki, Scott", "Swenson, Kirk"]);
+      // Named students sort among themselves; the authorless section is ordered after them rather than
+      // alphabetically among the surnames, matching the "by group" sort's trailing catch-all.
+      expect(labels).toEqual(["Bacal, Joe", "Cao, Dennis", "Cytacki, Scott", "Swenson, Kirk", "No Name"]);
+    });
+
+    it('files a class-wide collaborative document under No Name, not under any student', () => {
+      const byNameDocs = sortedDocuments.sortBy("Name");
+      const noName = byNameDocs.find(d => d.label === "No Name");
+      expect(noName).toBeDefined();
+      expect(noName?.documents.map(d => d.key)).toEqual(["Class Wide Doc"]);
+
+      // It has no author, so it must not be repeated under the students the way a group document is.
+      const studentSections = byNameDocs.filter(d => d.label !== "No Name");
+      expect(studentSections.some(s => s.documents.some(d => d.key === "Class Wide Doc"))).toBe(false);
+    });
+
+    describe("a group document from another offering", () => {
+      // Sort Work's "All" filter spans every offering the class has worked through. Group 3 of another
+      // assignment is a different set of students, and this store holds only the current offering's
+      // membership, so the document must not be filed under anybody's name.
+      const addForeignGroupDoc = () => {
+        sortedDocuments.metadataDocsFiltered = MetadataDocMapModel.create({
+          ...mockMetadataDocuments,
+          "Old Group 3 Doc": {
+            uid: getGroupOwnerId("other-offering", "3"),
+            type: GroupDocument, key: "Old Group 3 Doc", createdAt: 8,
+            tools: [], groupId: "3", offeringId: "other-offering",
+            unit: "sas", investigation: "2", problem: "4"
+          }
+        });
+      };
+
+      it("is sectioned by where the work came from, not under this offering's group 3", () => {
+        addForeignGroupDoc();
+        const byNameDocs = sortedDocuments.sortBy("Name");
+        const section = byNameDocs.find(d => d.documents.some(doc => doc.key === "Old Group 3 Doc"));
+        expect(section?.label).toBe("Groups from sas-2.4");
+
+        // Group 3 of the current offering is Cytacki and Swenson; neither wrote this.
+        const named = byNameDocs.filter(d => d.label === "Cytacki, Scott" || d.label === "Swenson, Kirk");
+        expect(named.some(s => s.documents.some(d => d.key === "Old Group 3 Doc"))).toBe(false);
+      });
+
+      it("stays visible even when this offering has no group of that number", () => {
+        // Group 7 does not exist here, so looking the group up by bare id found nothing and the
+        // document was dropped from this sort altogether rather than mis-filed.
+        sortedDocuments.metadataDocsFiltered = MetadataDocMapModel.create({
+          ...mockMetadataDocuments,
+          "Old Group 7 Doc": {
+            uid: getGroupOwnerId("other-offering", "7"),
+            type: GroupDocument, key: "Old Group 7 Doc", createdAt: 9,
+            tools: [], groupId: "7", offeringId: "other-offering",
+            unit: "sas", investigation: "2", problem: "4"
+          }
+        });
+        const byNameDocs = sortedDocuments.sortBy("Name");
+        const allKeys = byNameDocs.flatMap(d => d.documents.map(doc => doc.key));
+        expect(allKeys).toContain("Old Group 7 Doc");
+      });
+
+      it("is ordered after the named students, alongside the authorless section", () => {
+        addForeignGroupDoc();
+        const labels = sortedDocuments.sortBy("Name").map(d => d.label);
+        expect(labels).toEqual([
+          "Bacal, Joe", "Cao, Dennis", "Cytacki, Scott", "Swenson, Kirk", "Groups from sas-2.4", "No Name"
+        ]);
+      });
     });
   });
 
@@ -433,6 +541,16 @@ describe('DocumentGroup Model', () => {
       expect(documentCollection3[2].label).toBe("Not Tagged");
       expect(documentCollection3[2].documents.length).toBe(2);
 
+      // No Name: class-wide document with no strategies. It sorts after the named students.
+      const documentCollectionNoName = byNameGroups[4].byStrategy;
+      expect(documentCollectionNoName.length).toBe(3);
+      expect(documentCollectionNoName[0].label).toBe("foo");
+      expect(documentCollectionNoName[0].documents.length).toBe(0);
+      expect(documentCollectionNoName[1].label).toBe("bar");
+      expect(documentCollectionNoName[1].documents.length).toBe(0);
+      expect(documentCollectionNoName[2].label).toBe("Not Tagged");
+      expect(documentCollectionNoName[2].documents.length).toBe(1); // Class Wide Doc
+
       // Swenson, Kirk: problem doc has ["bar"] + Group 3 group doc with no strategies
       const documentCollection4 = byNameGroups[3].byStrategy;
       expect(documentCollection4.length).toBe(3);
@@ -448,9 +566,10 @@ describe('DocumentGroup Model', () => {
   describe("byTools Function", () => {
     it ('should return a document collection sorted by tool with the correct documents per tool', () => {
       const byGroupDocs = sortedDocuments.sortBy("Group");
+      // byGroupDocs[0] is "Whole Class"; group sections follow it in numeric order.
 
       // Group 3: Scott (Text), Kirk (no tools), Group 3 group doc (no tools)
-      const documentCollection = byGroupDocs[0].byTools;
+      const documentCollection = byGroupDocs[1].byTools;
       expect(documentCollection.length).toBe(2);
       expect(documentCollection[0].label).toBe("Text");
       expect(documentCollection[0].documents.length).toBe(1);
@@ -458,13 +577,13 @@ describe('DocumentGroup Model', () => {
       expect(documentCollection[1].documents.length).toBe(2);
 
       // Group 5: Joe (no tools), Group 5 group doc (no tools)
-      const documentCollection2 = byGroupDocs[1].byTools;
+      const documentCollection2 = byGroupDocs[2].byTools;
       expect(documentCollection2.length).toBe(1);
       expect(documentCollection2[0].label).toBe("No Tools");
       expect(documentCollection2[0].documents.length).toBe(2);
 
       // Group 9: Dennis (Drawing)
-      const documentCollection3 = byGroupDocs[2].byTools;
+      const documentCollection3 = byGroupDocs[3].byTools;
       expect(documentCollection3.length).toBe(1);
       expect(documentCollection3[0].label).toBe("Drawing");
       expect(documentCollection3[0].documents.length).toBe(1);
@@ -475,21 +594,22 @@ describe('DocumentGroup Model', () => {
     it('should return a document collection sorted by problem with correct documents per problem', () => {
       // Primary sort by Group, then secondary sort by Problem
       const byGroupDocs = sortedDocuments.sortBy("Group");
+      // byGroupDocs[0] is "Whole Class"; group sections follow it in numeric order.
 
       // Group 3: Scott (1.2), Kirk (1.2), Group 3 group doc (1.2)
-      const documentCollection = byGroupDocs[0].byProblem;
+      const documentCollection = byGroupDocs[1].byProblem;
       expect(documentCollection.length).toBe(1);
       expect(documentCollection[0].label).toBe("Problem 1.2");
       expect(documentCollection[0].documents.length).toBe(3);
 
       // Group 5: Joe (1.1), Group 5 group doc (1.1)
-      const documentCollection2 = byGroupDocs[1].byProblem;
+      const documentCollection2 = byGroupDocs[2].byProblem;
       expect(documentCollection2.length).toBe(1);
       expect(documentCollection2[0].label).toBe("Problem 1.1");
       expect(documentCollection2[0].documents.length).toBe(2);
 
       // Group 9: Dennis (2.1)
-      const documentCollection3 = byGroupDocs[2].byProblem;
+      const documentCollection3 = byGroupDocs[3].byProblem;
       expect(documentCollection3.length).toBe(1);
       expect(documentCollection3[0].label).toBe("Problem 2.1");
       expect(documentCollection3[0].documents.length).toBe(1);
@@ -497,14 +617,17 @@ describe('DocumentGroup Model', () => {
 
     it('should sort problems in correct order (by investigation then problem)', () => {
       const byProblemDocs = sortedDocuments.sortBy("Problem");
-      expect(byProblemDocs.length).toBe(3);
-      // Should be sorted: 1.1, 1.2, 2.1
+      // The class-wide document has no investigation/problem, so it falls into "No Problem".
+      expect(byProblemDocs.length).toBe(4);
+      // Should be sorted: 1.1, 1.2, 2.1, No Problem
       expect(byProblemDocs[0].label).toBe("Problem 1.1");
       expect(byProblemDocs[0].documents.length).toBe(2); // Joe + Group 5 group doc
       expect(byProblemDocs[1].label).toBe("Problem 1.2");
       expect(byProblemDocs[1].documents.length).toBe(3); // Scott + Kirk + Group 3 group doc
       expect(byProblemDocs[2].label).toBe("Problem 2.1");
       expect(byProblemDocs[2].documents.length).toBe(1);
+      expect(byProblemDocs[3].label).toBe("No Problem");
+      expect(byProblemDocs[3].documents.length).toBe(1); // Class Wide Doc
     });
 
     it('labels groups with the problem title when the unit provides one (keeping ordinal order)', () => {
@@ -516,7 +639,9 @@ describe('DocumentGroup Model', () => {
         })
       };
       const byProblemDocs = sortedDocuments.sortBy("Problem");
-      expect(byProblemDocs.map(g => g.label)).toEqual(["Storm 1-1", "Storm 1-2", "Storm 2-1"]);
+      // The class-wide document has no investigation/problem, so it has no title to resolve and
+      // keeps the generic "No Problem" label.
+      expect(byProblemDocs.map(g => g.label)).toEqual(["Storm 1-1", "Storm 1-2", "Storm 2-1", "No Problem"]);
       // Grouping/ordering is unchanged — only the displayed label differs.
       expect(byProblemDocs[1].documents.length).toBe(3);
     });
@@ -542,7 +667,8 @@ describe('DocumentGroup Model', () => {
       expect(byProblemDocs[2].label).toBe("Problem 2.1");
       expect(byProblemDocs[2].documents.length).toBe(1);
       expect(byProblemDocs[3].label).toBe("No Problem");
-      expect(byProblemDocs[3].documents.length).toBe(1);
+      // Student 1 Problem Doc Group 5 (modified to have no problem info) + the class-wide document
+      expect(byProblemDocs[3].documents.length).toBe(2);
     });
   });
 
diff --git a/src/models/stores/document-group.ts b/src/models/stores/document-group.ts
index e320eaf82c..a3e83dc5a2 100644
--- a/src/models/stores/document-group.ts
+++ b/src/models/stores/document-group.ts
@@ -2,13 +2,14 @@ import { FC, SVGProps } from "react";
 import { makeAutoObservable } from "mobx";
 
 import {
-  createDocMapByBookmarks, createTileTypeToDocumentsMap, getTagsWithDocs,
-  sortDateSectionLabels, sortGroupSectionLabels, sortNameSectionLabels, sortProblemSectionLabels
+  createDocMapByBookmarks, createTileTypeToDocumentsMap, getTagsWithDocs, GroupSectionSortKey,
+  kNoNameSectionLabel, kWholeClassSectionLabel, NameSectionSortKey, sortDateSectionLabels, sortGroupSections,
+  sortNameSectionLabels, sortProblemSectionLabels
 } from "../../utilities/sort-document-utils";
 import { upperWords } from "../../utilities/string-utils";
 import { translate } from "../../utilities/translation/translate";
+import { getCurriculumLabel, hasClassOwner, hasGroupOwner } from "../document/document-axes";
 import { IDocumentMetadataModel } from "../document/document-metadata-model";
-import { GroupDocument } from "../document/document-types";
 import { getTileComponentInfo } from "../tiles/tile-component-info";
 import { getTileContentInfo } from "../tiles/tile-content-info";
 import { UnitModelType } from "../curriculum/unit";
@@ -58,6 +59,14 @@ interface IBuildDocumentCollectionProps {
   labelMap?: Map<string, string>;
 }
 
+/**
+ * Which section of the "by group" sort a document belongs in.
+ */
+interface IGroupSection {
+  sectionLabel: string;
+  sortKey: GroupSectionSortKey;
+}
+
 /*
  * DocumentGroup
  *
@@ -190,49 +199,92 @@ export class DocumentGroup {
   get byGroup(): DocumentGroup[] {
     const groupTerm = upperWords(translate("studentGroup"));
     const documentMap: Map<string, IDocumentMetadataModel[]> = new Map();
+    // Ordering information per section, so the comparator never parses the display label.
+    const sortKeys: Map<string, GroupSectionSortKey> = new Map();
+
+    const groupSection = (groupId: string): IGroupSection =>
+      ({ sectionLabel: `${groupTerm} ${groupId}`, sortKey: { section: "group", groupId } });
+
     this.documents.forEach((doc) => {
-      const sectionLabel = (() => {
-        if (doc.type === GroupDocument) {
-          return `${groupTerm} ${doc.groupId}`;
+      const { sectionLabel, sortKey } = ((): IGroupSection => {
+        // A document owned by a group belongs to that group, whoever created it. The section is labelled
+        // from the stored `groupId`, the one place the group's number is available without taking the
+        // owner uid apart; a group-owned document without one has no group to name and falls through.
+        if (hasGroupOwner(doc) && doc.groupId) return groupSection(doc.groupId);
+        // A class-owned document is not one student's work, so it sections under the class itself.
+        if (hasClassOwner(doc)) {
+          return { sectionLabel: kWholeClassSectionLabel, sortKey: { section: "class" } };
         }
-        const userId = doc.uid;
-        const group = this.stores.groups.groupForUser(userId);
-        return group ? `${groupTerm} ${group.id}` : `No ${groupTerm}`;
+        // Otherwise it belongs to its owner, and so to whichever group its owner is in now.
+        const group = this.stores.groups.groupForUser(doc.uid);
+        return group
+          ? groupSection(group.id)
+          : { sectionLabel: `No ${groupTerm}`, sortKey: { section: "none" } };
       })();
 
       if (!documentMap.has(sectionLabel)) {
         documentMap.set(sectionLabel, []);
       }
       documentMap.get(sectionLabel)?.push(doc);
+      sortKeys.set(sectionLabel, sortKey);
     });
-    const sortedSectionLabels = sortGroupSectionLabels(Array.from(documentMap.keys()));
+
+    const sortedSectionLabels = sortGroupSections(Array.from(documentMap.keys()), sortKeys);
     return this.buildDocumentCollection({sortedSectionLabels, sortType: "Group", docMap: documentMap});
   }
 
   get byName(): DocumentGroup[] {
     const documentMap: Map<string, IDocumentMetadataModel[]> = new Map();
-    const addDocForUser = (doc: IDocumentMetadataModel, user: ClassUserModelType | undefined) => {
-      const sectionLabel = user ? `${user.lastName}, ${user.firstName}` : "Unknown";
+    // Ordering information per section, so the comparator never parses the display label.
+    const sortKeys: Map<string, NameSectionSortKey> = new Map();
+    const addDocToSection = (
+      doc: IDocumentMetadataModel, sectionLabel: string, sortKey: NameSectionSortKey
+    ) => {
       if (!documentMap.has(sectionLabel)) {
         documentMap.set(sectionLabel, []);
       }
       documentMap.get(sectionLabel)?.push(doc);
+      sortKeys.set(sectionLabel, sortKey);
+    };
+    const addDocForUser = (doc: IDocumentMetadataModel, user: ClassUserModelType | undefined) => {
+      const sectionLabel = user ? `${user.lastName}, ${user.firstName}` : "Unknown";
+      addDocToSection(doc, sectionLabel, { section: "student" });
+    };
+    // One section per other assignment, not per group: a class works through many, and a section per
+    // group of each would swamp the sort. Every document in one offering shares a curriculum position,
+    // so that names the section.
+    const groupsTerm = upperWords(translate("studentGroups"));
+    const otherAssignmentSection = (doc: IDocumentMetadataModel) => {
+      const curriculumLabel = getCurriculumLabel(doc);
+      return curriculumLabel ? `${groupsTerm} from ${curriculumLabel}` : `Other ${groupsTerm}`;
     };
 
     this.documents.forEach((doc) => {
-      if (doc.type === GroupDocument) {
-        // Add group documents to each user in the group
-        const groupId = doc.groupId ?? "unknownGroup";
-        const group = this.stores.groups.getGroupById(groupId);
-        group?.users.forEach(user => {
-          addDocForUser(doc, user.classUser);
-        });
+      // The owner decides the section, so it is asked first, narrowest level outward.
+      if (hasGroupOwner(doc)) {
+        // A group document is listed under every member of the group that owns it. The group is looked
+        // up by owner, so one from another offering resolves to nothing rather than to this offering's
+        // same-numbered group — those are different students, and naming them would attribute the work
+        // to people who did not do it.
+        const group = this.stores.groups.getGroupByOwnerId(doc.uid);
+        if (group) {
+          group.users.forEach(user => {
+            addDocForUser(doc, user.classUser);
+          });
+        } else {
+          // Its members are not knowable from here, so file it by where the work came from. Keeping it
+          // out of the map entirely would drop it from this sort.
+          addDocToSection(doc, otherAssignmentSection(doc), { section: "otherAssignment" });
+        }
+      } else if (hasClassOwner(doc)) {
+        // A class-owned document has no personal author to file it under.
+        addDocToSection(doc, kNoNameSectionLabel, { section: "noName" });
       } else {
         addDocForUser(doc, this.stores.class.getUserById(doc.uid));
       }
     });
 
-    const sortedSectionLabels = sortNameSectionLabels(Array.from(documentMap.keys()));
+    const sortedSectionLabels = sortNameSectionLabels(Array.from(documentMap.keys()), sortKeys);
     return this.buildDocumentCollection({sortedSectionLabels, sortType: "Name", docMap: documentMap});
   }
 
diff --git a/src/models/stores/groups.test.ts b/src/models/stores/groups.test.ts
index 959101a21f..bba53ef025 100644
--- a/src/models/stores/groups.test.ts
+++ b/src/models/stores/groups.test.ts
@@ -1,6 +1,7 @@
 import { GroupsModel, GroupModel, GroupUserModel } from "./groups";
 import { ClassModel, ClassUserModel } from "./class";
 import { DBOfferingGroupMap } from "../../lib/db-types";
+import { getGroupOwnerId } from "../document/document-axes";
 
 describe("Groups model", () => {
 
@@ -54,6 +55,52 @@ describe("Groups model", () => {
     expect(groups.virtualDocumentForGroup("group-1")).toBeDefined();
   });
 
+  describe("getGroupByOwnerId", () => {
+    const groupsFor = (offeringId?: string) =>
+      GroupsModel.create({ offeringId, groupsMap: { 3: GroupModel.create({ id: "3", users: [] }) } });
+
+    it("resolves a group document's owner to its group", () => {
+      const groups = groupsFor("off-1");
+      expect(groups.getGroupByOwnerId(getGroupOwnerId("off-1", "3"))?.id).toBe("3");
+    });
+
+    it("does not resolve the same group number from another offering", () => {
+      // The whole point: group 3 of another assignment is a different set of students, so it must not
+      // answer with this offering's group 3.
+      const groups = groupsFor("off-1");
+      expect(groups.getGroupByOwnerId(getGroupOwnerId("off-2", "3"))).toBeUndefined();
+    });
+
+    it("does not resolve a bare group id, a user uid, or a class owner", () => {
+      const groups = groupsFor("off-1");
+      expect(groups.getGroupByOwnerId("3")).toBeUndefined();
+      expect(groups.getGroupByOwnerId("student-1")).toBeUndefined();
+      expect(groups.getGroupByOwnerId("class_hash")).toBeUndefined();
+    });
+
+    it("resolves nothing until the store knows which offering it holds", () => {
+      expect(groupsFor(undefined).getGroupByOwnerId(getGroupOwnerId("off-1", "3"))).toBeUndefined();
+      expect(groupsFor("off-1").getGroupByOwnerId(undefined)).toBeUndefined();
+    });
+
+    it("looks the group up in a map keyed by owner id, rather than scanning the groups", () => {
+      const groups = groupsFor("off-1");
+      expect(Object.keys(groups.groupsByOwnerId)).toEqual([getGroupOwnerId("off-1", "3")]);
+      expect(groups.groupsByOwnerId[getGroupOwnerId("off-1", "3")].id).toBe("3");
+    });
+
+    it("keys nothing until the offering is known, since an owner id cannot be built without it", () => {
+      expect(groupsFor(undefined).groupsByOwnerId).toEqual({});
+    });
+  });
+
+  it("records the offering its groups belong to when updating from db", () => {
+    const groups = GroupsModel.create({});
+    expect(groups.offeringId).toBeUndefined();
+    groups.updateFromDB({}, "off-7");
+    expect(groups.offeringId).toBe("off-7");
+  });
+
   it("updates from db", () => {
     const dbGroupsWithoutUsers: DBOfferingGroupMap = {
       1: {
@@ -133,11 +180,11 @@ describe("Groups model", () => {
 
     const groups = GroupsModel.create({}, {class: clazz});
 
-    groups.updateFromDB(dbGroupsWithoutUsers);
+    groups.updateFromDB(dbGroupsWithoutUsers, "off-1");
     expect(groups.allGroups.length).toEqual(1);
     expect(groups.allGroups[0].users.length).toEqual(0);
 
-    groups.updateFromDB(dbGroupsWithUsers);
+    groups.updateFromDB(dbGroupsWithUsers, "off-1");
     expect(groups.allGroups.length).toEqual(1);
     const group = groups.allGroups[0];
     expect(group.users.length).toEqual(3);
diff --git a/src/models/stores/groups.ts b/src/models/stores/groups.ts
index 8882ba880a..06f3b001fe 100644
--- a/src/models/stores/groups.ts
+++ b/src/models/stores/groups.ts
@@ -1,6 +1,7 @@
 import { types, getEnv, SnapshotIn, applySnapshot, hasEnv } from "mobx-state-tree";
 import { DBOfferingGroup, DBOfferingGroupMap } from "../../lib/db-types";
 import { ClassModelType } from "./class";
+import { getGroupOwnerId } from "../document/document-axes";
 import { GroupVirtualDocument } from "../document/group-virtual-document";
 import { UserModelType } from "./user";
 import { DocumentsModelType } from "./documents";
@@ -150,6 +151,12 @@ export function getGroupSnapshot(groupId: string, groupFromDB: DBOfferingGroup)
 export const GroupsModel = types
   .model("Groups", {
     groupsMap: types.map(GroupModel),
+    /**
+     * The offering whose groups these are, recorded because a group id is unique only within one
+     * offering. Without it a group id read off a document from another assignment would resolve to the
+     * same-numbered group here — a different set of students. Set by updateFromDB.
+     */
+    offeringId: types.maybe(types.string),
   })
   .views(self => ({
     get allGroups() {
@@ -168,6 +175,22 @@ export const GroupsModel = types
       });
       return groupsByUser;
     },
+    /**
+     * This offering's groups, keyed by the synthetic uid that owns their documents.
+     *
+     * Empty until the offering is known, because a group owner id cannot be built without it. That is also
+     * what keeps a document from another assignment from resolving here: its owner carries that
+     * assignment's offering, so it matches no key in this map.
+     */
+    get groupsByOwnerId() {
+      const groupsByOwnerId: Record<string, GroupModelType> = {};
+      const { offeringId } = self;
+      if (!offeringId) return groupsByOwnerId;
+      self.allGroups.forEach((group) => {
+        groupsByOwnerId[getGroupOwnerId(offeringId, group.id)] = group;
+      });
+      return groupsByOwnerId;
+    },
     get nonEmptyGroups() {
       return self.allGroups.filter(g => g.users.length > 0);
     }
@@ -187,6 +210,13 @@ export const GroupsModel = types
     getGroupById(id?: string) {
       return self.allGroups.find(group => group.id === id);
     },
+    /**
+     * The group that a group owned document's uid names, or undefined when that group owner is not one of the
+     * groups in this offering.
+     */
+    getGroupByOwnerId(ownerId?: string) {
+      return ownerId ? self.groupsByOwnerId[ownerId] : undefined;
+    },
   }))
   .views((self) => ({
     userInGroup(uid: string, groupId?: string) {
@@ -208,12 +238,17 @@ export const GroupsModel = types
     }
   }))
   .actions((self) => ({
-    updateFromDB(groups: DBOfferingGroupMap) {
+    // `offeringId` identifies the offering these groups belong to. Required rather than optional, and
+    // assigned unconditionally: these groups only mean anything paired with the offering they came
+    // from, so a caller that has none must say so and clear the stale one rather than leave the
+    // previous offering's id standing over a new set of groups.
+    updateFromDB(groups: DBOfferingGroupMap, offeringId: string | undefined) {
       const groupsMapSnapshot: SnapshotIn<typeof self.groupsMap> = {};
       Object.entries(groups).forEach(([groupId, group]) => {
         groupsMapSnapshot[groupId] = getGroupSnapshot(groupId, group);
       });
       applySnapshot(self.groupsMap, groupsMapSnapshot);
+      self.offeringId = offeringId;
     }
   }));
 
diff --git a/src/models/stores/sorted-documents.test.ts b/src/models/stores/sorted-documents.test.ts
index 3e8a607933..852502b577 100644
--- a/src/models/stores/sorted-documents.test.ts
+++ b/src/models/stores/sorted-documents.test.ts
@@ -245,3 +245,114 @@ describe('Sorted Documents Model', () => {
     });
   });
 });
+
+type WhereClause = [string, string, any];
+
+interface IMockQueryRecord {
+  clauses: WhereClause[];
+  emit: (docs: any[]) => void;
+  disposed: boolean;
+}
+
+// Records every query built off db.firestore and lets a test drive each listener's snapshot.
+function makeMockFirestore() {
+  const listeners: IMockQueryRecord[] = [];
+  const makeQuery = (clauses: WhereClause[]): any => ({
+    withConverter: () => makeQuery(clauses),
+    where: (field: string, op: string, value: any) => makeQuery([...clauses, [field, op, value]]),
+    onSnapshot: (cb: (snap: any) => void) => {
+      const record: IMockQueryRecord = {
+        clauses,
+        emit: (docs: any[]) => cb({ docs: docs.map(d => ({ data: () => d })) }),
+        disposed: false
+      };
+      listeners.push(record);
+      return () => { record.disposed = true; };
+    }
+  });
+  return { listeners, collection: () => makeQuery([]) };
+}
+
+describe("SortedDocuments.watchFirestoreMetaDataDocs", () => {
+  let firestore: ReturnType<typeof makeMockFirestore>;
+  let sortedDocuments: SortedDocuments;
+
+  const classWideMetadata = {
+    uid: "class_mock", type: "group", key: "Class Wide Doc", createdAt: 7,
+    unit: "sas", investigation: null, problem: null, kind: "drivingQuestionBoard", concurrent: true
+  };
+
+  beforeEach(() => {
+    firestore = makeMockFirestore();
+    const documentMetadata = new DocumentMetadataStore(
+      { db: {}, user: { classHash: "mock" }, documents: { exemplarDocuments: [] } } as any
+    );
+    const mockStores: DeepPartial<ISortedDocumentsStores> = {
+      documents: { all: [], exemplarDocuments: [] },
+      db: { firestore } as any,
+      user: { classHash: "mock" },
+      curriculumConfig: { getUnitCodeVariants: (unit: string) => [unit] },
+      documentMetadata,
+    };
+    sortedDocuments = new SortedDocuments(mockStores as ISortedDocumentsStores);
+  });
+
+  const unitScopedListener = () =>
+    firestore.listeners.find(l =>
+      l.clauses.some(([field, , value]) => field === "investigation" && value === null));
+
+  it("adds a whole-unit listener under the Problem filter", () => {
+    sortedDocuments.watchFirestoreMetaDataDocs("Problem", "sas", 1, 2);
+    const listener = unitScopedListener();
+    expect(listener).toBeDefined();
+    expect(listener?.clauses).toEqual([
+      ["context_id", "==", "mock"],
+      ["unit", "in", ["sas"]],
+      ["investigation", "==", null],
+    ]);
+  });
+
+  it("adds a whole-unit listener under the Investigation filter", () => {
+    sortedDocuments.watchFirestoreMetaDataDocs("Investigation", "sas", 1, 2);
+    expect(unitScopedListener()).toBeDefined();
+  });
+
+  it("adds no whole-unit listener under the All or Unit filters, which already include those docs", () => {
+    sortedDocuments.watchFirestoreMetaDataDocs("All", "sas", 1, 2);
+    expect(unitScopedListener()).toBeUndefined();
+
+    firestore.listeners.length = 0;
+    sortedDocuments.watchFirestoreMetaDataDocs("Unit", "sas", 1, 2);
+    expect(unitScopedListener()).toBeUndefined();
+  });
+
+  it("surfaces whole-unit documents in firestoreMetadataDocs", () => {
+    sortedDocuments.watchFirestoreMetaDataDocs("Problem", "sas", 1, 2);
+    unitScopedListener()?.emit([classWideMetadata]);
+    expect(sortedDocuments.firestoreMetadataDocs.map(d => d.key)).toEqual(["Class Wide Doc"]);
+  });
+
+  it("does not list a document twice when both listeners return it", () => {
+    sortedDocuments.watchFirestoreMetaDataDocs("Problem", "sas", 1, 2);
+    firestore.listeners[0].emit([classWideMetadata]);   // the filtered listener
+    unitScopedListener()?.emit([classWideMetadata]);
+    expect(sortedDocuments.firestoreMetadataDocs.map(d => d.key)).toEqual(["Class Wide Doc"]);
+  });
+
+  it("disposes the whole-unit listener with the others", () => {
+    const dispose = sortedDocuments.watchFirestoreMetaDataDocs("Problem", "sas", 1, 2);
+    const listener = unitScopedListener();
+    dispose();
+    expect(listener?.disposed).toBe(true);
+  });
+
+  it("clears previously fetched whole-unit documents when the filter no longer needs them", () => {
+    sortedDocuments.watchFirestoreMetaDataDocs("Problem", "sas", 1, 2);
+    unitScopedListener()?.emit([classWideMetadata]);
+    expect(sortedDocuments.firestoreMetadataDocs.length).toBe(1);
+
+    firestore.listeners.length = 0;
+    sortedDocuments.watchFirestoreMetaDataDocs("All", "sas", 1, 2);
+    expect(sortedDocuments.firestoreMetadataDocs.length).toBe(0);
+  });
+});
diff --git a/src/models/stores/sorted-documents.ts b/src/models/stores/sorted-documents.ts
index 4550c165b1..6c39a0279a 100644
--- a/src/models/stores/sorted-documents.ts
+++ b/src/models/stores/sorted-documents.ts
@@ -41,6 +41,10 @@ export class SortedDocuments {
   // `metadataDocsWithoutUnit` picks up unit-less docs (e.g. personal documents) when a unit
   // filter is applied.
   metadataDocsWithoutUnit = MetadataDocMapModel.create();
+  // `metadataDocsWholeUnit` picks up documents about a whole unit rather than any one investigation
+  // or problem within it (class-wide collaborative documents) when an investigation or problem filter
+  // is applied, which would otherwise exclude them.
+  metadataDocsWholeUnit = MetadataDocMapModel.create();
   docsReceived = false;
   // Maps from document ID to the history entry ID that the user requested to view.
   documentHistoryViewRequests: Record<string,string> = {};
@@ -54,6 +58,7 @@ export class SortedDocuments {
     // We only want MobX observability + MST serialization, not MST actions, on these maps.
     unprotect(this.metadataDocsFiltered);
     unprotect(this.metadataDocsWithoutUnit);
+    unprotect(this.metadataDocsWholeUnit);
     this.rootDocumentGroup = new DocumentGroup({
       stores,
       sortType: "All",
@@ -151,11 +156,30 @@ export class SortedDocuments {
       this.metadataDocsWithoutUnit.clear();
     }
 
-    // A disposing function that calls the two disposers from the
+    let disposeWholeUnitListener: (() => void) | undefined;
+    if (filter === "Investigation" || filter === "Problem") {
+      // We only want to filter out documents with a **different** investigation or problem.
+      // If the document is at the unit level (no investigation), we want to still show it.
+      // This is the curriculum axis of the document, not the container axis. Documents
+      // in the unit container that are about an investigation or problem are not included.
+      const queryForWholeUnit = baseQuery
+        .where("unit", "in", this.curriculumConfig.getUnitCodeVariants(unit))
+        .where("investigation", "==", null);
+      disposeWholeUnitListener = queryForWholeUnit.onSnapshot(snapshot => {
+        const mstSnapshot = this.stores.documentMetadata.getMSTSnapshotFromFBSnapshot(snapshot);
+        applySnapshot(this.metadataDocsWholeUnit, mstSnapshot);
+      });
+    } else {
+      // The All and Unit filters already include these documents.
+      this.metadataDocsWholeUnit.clear();
+    }
+
+    // A disposing function that calls the disposers from the
     // onSnapshot listeners.
     return () => {
       disposeFilteredListener();
       disposeDocsWithoutUnitListener?.();
+      disposeWholeUnitListener?.();
     };
   }
 
@@ -182,6 +206,12 @@ export class SortedDocuments {
       docsArray.push(doc);
       matchedDocKeys.add(doc.key);
     });
+    this.metadataDocsWholeUnit.forEach(doc => {
+      // Also present in the filtered map under the All and Unit filters; dedupe by key.
+      if (matchedDocKeys.has(doc.key)) return;
+      docsArray.push(doc);
+      matchedDocKeys.add(doc.key);
+    });
     this.exemplarMetadataDocs.forEach(doc => {
       // If there is a duplicate, it will have been merged with one of the previous
       // maps by the firestore snapshot listeners. So we ignore the duplicate here.
diff --git a/src/models/stores/user.ts b/src/models/stores/user.ts
index 01c37e0770..bc8760b955 100644
--- a/src/models/stores/user.ts
+++ b/src/models/stores/user.ts
@@ -3,6 +3,7 @@ import { Instance, types } from "mobx-state-tree";
 import { AuthenticatedUser, isAuthenticatedTeacher } from "../../lib/auth";
 import { PortalFirebaseStudentJWT, PortalJWT, PortalUserJWT } from "../../lib/portal-types";
 import { UserType, UserTypeEnum } from "./user-types";
+import { getGroupOwnerId } from "../document/document-axes";
 
 export const UserPortalOffering = types
   .model("UserPortalOffering", {
@@ -184,12 +185,14 @@ export const UserModel = types
 
     /**
      * Group documents have a special user id based on the offering and group id.
-     * In this way every member of the group will have the same userId for group documents
+     * In this way every member of the group will have the same userId for group documents.
      *
-     * @returns
+     * Undefined when this user is not in a group in an offering: there is no group whose documents these
+     * would be.
      */
-    get userIdForGroupDocuments() {
-      return `group_${self.offeringId}_${self.currentGroupId}`;
+    get userIdForGroupDocuments(): string | undefined {
+      if (!self.offeringId || !self.currentGroupId) return undefined;
+      return getGroupOwnerId(self.offeringId, self.currentGroupId);
     }
   }))
   .views((self) => ({
diff --git a/src/utilities/sort-document-utils.test.ts b/src/utilities/sort-document-utils.test.ts
index 710ee00333..fae482a5c8 100644
--- a/src/utilities/sort-document-utils.test.ts
+++ b/src/utilities/sort-document-utils.test.ts
@@ -7,6 +7,8 @@ import {
   createDocMapByBookmarks,
   createTileTypeToDocumentsMap,
   getTagsWithDocs,
+  GroupSectionSortKey,
+  sortGroupSections,
   sortProblemSectionLabels
 } from "./sort-document-utils";
 import { clearTermOverrides, setTermOverrides } from "./translation/translate";
@@ -203,4 +205,59 @@ describe("sort-document-utils", () => {
       expect(sorted).toEqual(["Problem 1.1"]);
     });
   });
+
+  describe("sortGroupSections", () => {
+    const keys = (entries: Array<[string, GroupSectionSortKey]>) => new Map(entries);
+
+    it("puts the whole-class section first, groups in numeric order, and no-group last", () => {
+      const labels = ["No Group", "Group 10", "Whole Class", "Group 2"];
+      const sorted = sortGroupSections(labels, keys([
+        ["No Group", { section: "none" }],
+        ["Group 10", { section: "group", groupId: "10" }],
+        ["Whole Class", { section: "class" }],
+        ["Group 2", { section: "group", groupId: "2" }],
+      ]));
+      expect(sorted).toEqual(["Whole Class", "Group 2", "Group 10", "No Group"]);
+    });
+
+    it("orders non-numeric group ids after numeric ones, alphabetically", () => {
+      const labels = ["Group b", "Group 3", "Group a"];
+      const sorted = sortGroupSections(labels, keys([
+        ["Group b", { section: "group", groupId: "b" }],
+        ["Group 3", { section: "group", groupId: "3" }],
+        ["Group a", { section: "group", groupId: "a" }],
+      ]));
+      expect(sorted).toEqual(["Group 3", "Group a", "Group b"]);
+    });
+
+    it("does not read the label text — a renamed group term still sorts numerically", () => {
+      // The comparator must not infer order from the display string; `studentGroup` is overridable
+      // per unit, so "Team 2" and "Group 2" must sort identically.
+      const labels = ["Team 10", "Team 2"];
+      const sorted = sortGroupSections(labels, keys([
+        ["Team 10", { section: "group", groupId: "10" }],
+        ["Team 2", { section: "group", groupId: "2" }],
+      ]));
+      expect(sorted).toEqual(["Team 2", "Team 10"]);
+    });
+
+    it("orders a digit-prefixed group id after the numeric ones, not alongside its leading digit", () => {
+      // Under `autoAssignStudentsToIndividualGroups` a group id is a user id, which in demo mode can be
+      // a nanoid — and a nanoid starts with a digit about one time in six. Reading only the leading
+      // digits would file "3xK9mQ" as group 3, tying it with the real group 3 and leaving the two in
+      // whatever order they arrived in.
+      const labels = ["Group 3xK9mQ", "Group 4", "Group 3"];
+      const sorted = sortGroupSections(labels, keys([
+        ["Group 3xK9mQ", { section: "group", groupId: "3xK9mQ" }],
+        ["Group 4", { section: "group", groupId: "4" }],
+        ["Group 3", { section: "group", groupId: "3" }],
+      ]));
+      expect(sorted).toEqual(["Group 3", "Group 4", "Group 3xK9mQ"]);
+    });
+
+    it("treats a label with no sort key as no-group", () => {
+      const sorted = sortGroupSections(["Mystery", "Whole Class"], keys([["Whole Class", { section: "class" }]]));
+      expect(sorted).toEqual(["Whole Class", "Mystery"]);
+    });
+  });
 });
diff --git a/src/utilities/sort-document-utils.ts b/src/utilities/sort-document-utils.ts
index 5de21e64ba..8c7312529e 100644
--- a/src/utilities/sort-document-utils.ts
+++ b/src/utilities/sort-document-utils.ts
@@ -41,18 +41,88 @@ export const sortDateSectionLabels = (
   });
 };
 
-export const sortGroupSectionLabels = (docMapKeys: string[]) => {
+/** Section label for documents that belong to the class as a whole rather than to a group. */
+export const kWholeClassSectionLabel = "Whole Class";
+
+/** Section label, in the "by name" sort, for documents that have no personal author. */
+export const kNoNameSectionLabel = "No Name";
+
+/**
+ * The ordering information for one "by group" section. Carried alongside the section label so the
+ * comparator never has to recover structure from the display text, which is translatable
+ * (`studentGroup` is overridable per unit) and has no number at all for some sections.
+ */
+export type GroupSectionSortKey =
+  | { section: "class" }
+  | { section: "group"; groupId: string }
+  | { section: "none" };
+
+const kGroupSectionOrder: Record<GroupSectionSortKey["section"], number> = {
+  class: 0,
+  group: 1,
+  none: 2,
+};
+
+const kNumericGroupId = /^\d+$/;
+
+/**
+ * Order "by group" sections: the whole class first, then groups by ascending numeric id, then the
+ * no-group section. A section with no sort key is ordered as if it had none.
+ */
+export const sortGroupSections = (docMapKeys: string[], sortKeys: Map<string, GroupSectionSortKey>) => {
+  const keyFor = (label: string): GroupSectionSortKey => sortKeys.get(label) ?? { section: "none" };
   return docMapKeys.sort((a, b) => {
-    const numA = parseInt(a.replace(/^\D+/g, ''), 10);
-    const numB = parseInt(b.replace(/^\D+/g, ''), 10);
-    return numA - numB;
+    const keyA = keyFor(a);
+    const keyB = keyFor(b);
+    if (keyA.section !== keyB.section) {
+      return kGroupSectionOrder[keyA.section] - kGroupSectionOrder[keyB.section];
+    }
+    if (keyA.section === "group" && keyB.section === "group") {
+      // A group id is usually a number, but not always: under
+      // `autoAssignStudentsToIndividualGroups` the group id is the user id, which in demo mode can be
+      // a nanoid. Only an all-digit id sorts numerically; the rest sort after those, by label.
+      const numA = kNumericGroupId.test(keyA.groupId) ? Number(keyA.groupId) : NaN;
+      const numB = kNumericGroupId.test(keyB.groupId) ? Number(keyB.groupId) : NaN;
+      if (!isNaN(numA) && !isNaN(numB)) return numA - numB;
+      if (!isNaN(numA)) return -1;
+      if (!isNaN(numB)) return 1;
+      return keyA.groupId.localeCompare(keyB.groupId);
+    }
+    return a.localeCompare(b);
   });
 };
 
-export const sortNameSectionLabels = (docMapKeys: string[]) => {
+/**
+ * The ordering information for one "by name" section, carried alongside the label for the same reason
+ * as GroupSectionSortKey above: only the student sections are names, and the rest must not be sorted as
+ * if they were. Named students come first, then group documents from other assignments, then the
+ * authorless section — the same shape as the "by group" sort, which ends with its own catch-all.
+ */
+export type NameSectionSortKey =
+  | { section: "student" }
+  | { section: "otherAssignment" }
+  | { section: "noName" };
+
+const kNameSectionOrder: Record<NameSectionSortKey["section"], number> = {
+  student: 0,
+  otherAssignment: 1,
+  noName: 2,
+};
+
+export const sortNameSectionLabels = (docMapKeys: string[], sortKeys?: Map<string, NameSectionSortKey>) => {
+  const keyFor = (label: string): NameSectionSortKey => sortKeys?.get(label) ?? { section: "student" };
   return docMapKeys.sort((a, b) => {
-    const parseName = (name: any) => {
-      const [lastName, firstName] = name.split(", ").map((part: any) => part.trim());
+    const sectionA = keyFor(a).section;
+    const sectionB = keyFor(b).section;
+    if (sectionA !== sectionB) {
+      return kNameSectionOrder[sectionA] - kNameSectionOrder[sectionB];
+    }
+    // Only the student sections hold names; the others are compared as plain labels.
+    if (sectionA !== "student") {
+      return a.localeCompare(b);
+    }
+    const parseName = (name: string) => {
+      const [lastName, firstName] = name.split(", ").map(part => part.trim());
       return { firstName, lastName };
     };
     const aParsed = parseName(a);
@@ -63,7 +133,8 @@ export const sortNameSectionLabels = (docMapKeys: string[]) => {
     if (lastNameCompare !== 0) {
       return lastNameCompare;
     }
-    return aParsed.firstName.localeCompare(bParsed.firstName);
+    // "Unknown" has no comma, so it has no first name to compare.
+    return (aParsed.firstName ?? "").localeCompare(bParsed.firstName ?? "");
   });
 };