dsh-ptc-plus 0.5.3 → 0.5.4

package/src/client-capabilities-view.js

@@ -1,36 +1,62 @@
-import { capabilityPolicyForConfig, capabilityRule, changeCapabilityRule, effectiveCapabilitySettings, CAPABILITY_DISCLOSURES, CAPABILITY_INVENTORY_CATEGORIES } from '../internal/capability-policy.js'
+import { capabilityPolicyForConfig, capabilityPolicyFromRecord, changeCapabilityRule, effectiveCapabilitySettings, CAPABILITY_DISCLOSURES, CAPABILITY_INVENTORY_CATEGORIES } from '../internal/capability-policy.js'
 import { CONFIG_DEFAULTS, CONFIG_FIELDS } from '../internal/config-spec.js'
 import { CAPABILITY_CONFIGURATION_KEYS, capabilityProfileConfiguration, validateCapabilityProfiles } from '../internal/runtime-config.js'
 import { readCapabilityCommandReceipt } from '../internal/capability-command-receipt.js'
+import { capabilitySortDirection, cycleCapabilitySort, sortCapabilityEntries } from './client-capability-sort.js'
 import { createFallbackModal } from './client-primitives.js'
-import { CAPABILITY_SORT_COLUMNS, capabilitySortDirection, cycleCapabilitySort, sortCapabilityEntries } from './client-capability-sort.js'
 import {
   PROMPT_ASSETS, PROMPT_TEXT_MAX_SLOT_BYTES, PROMPT_TEXT_SCHEMA,
   accountPromptText, parsePromptTextDocument, resolvePromptText,
 } from '../internal/prompt-text.js'
 
 /**
- * One capability, three separate facts, in the reader's language. Saved,
- * delivered and usable are different questions, so a reader must be able to see
- * which one failed instead of reading one blanket "applied".
+ * The command's own outcome, in the reader's language.
+ *
+ * A receipt may report that it found no active PTC session to update. That is a
+ * lookup result and a statement about what the command did not do, so the notice
+ * says so; it is not a usability verdict about the session and no state is named
+ * after one. Releases up to 0.5.4 recorded that lookup as the wire state
+ * `unavailable`, so the mapping below keeps those recorded notices readable; the
+ * chat notice is the only reader that can still meet one.
  */
-export function capabilityProofCopy(t, proof) {
-  const delivery = ['delivered', 'pending', 'absent'].includes(proof?.delivery) ? proof.delivery : undefined
-  const usability = ['proven', 'unproven'].includes(proof?.usability) ? proof.usability : undefined
-  if (delivery === undefined || usability === undefined) return t('capabilities.quick.unknown')
-  return t('capabilities.proof.line', {
-    saved: t(proof.saved === true ? 'capabilities.proof.saved.yes' : 'capabilities.proof.saved.no'),
-    delivery: t(`capabilities.proof.delivery.${delivery}`),
-    usability: t(`capabilities.proof.usability.${usability}`),
-  })
+const RECEIPT_STATE = Object.freeze({
+  recorded: 'recorded', pending: 'pending', 'saved-only': 'saved-only',
+  paused: 'paused', off: 'off', usage: 'usage', unavailable: 'no-session',
+})
+const receiptCopyKey = (surface, state) => `capabilities.${surface}.${RECEIPT_STATE[state] ?? 'usage'}`
+
+/** The record one write named, in the §4 vocabulary the panel's columns use. */
+function capabilityRecordText(t, record) {
+  if (record === null || typeof record !== 'object' || typeof record.id !== 'string') return undefined
+  return `${record.id} · ${record.dimension === undefined ? '' : `${t(`capabilities.dimension.${record.dimension}`)} `}`
+    + t(`capabilities.word.${record.selection}`)
+}
+
+/**
+ * One receipt, one sentence, in the reader's language.
+ *
+ * A receipt states the write this command performed: which entry, which choice,
+ * and which session or global configuration now records it. Whether a cell later
+ * reached that entry is a catalogue row's `evidence` field — a marker means an
+ * accepted execution obtained it, and this page states no such column — so no
+ * receipt states it. The chat card and the composer
+ * toast read this one function; the `surface` argument picks which outcome
+ * sentence describes the command, and a write that named a record reads the same
+ * on both.
+ */
+export function capabilityReceiptNotice(t, receipt, surface = 'receipt') {
+  const record = capabilityRecordText(t, receipt?.record)
+  if (record !== undefined && receipt.state === 'recorded') {
+    return t(`capabilities.receipt.record${receipt.record.scope === 'global' ? '.global' : ''}`,
+      { session: receipt.sessionId, record })
+  }
+  return t(receiptCopyKey(surface, receipt?.state), { session: receipt?.sessionId, error: receipt?.error ?? '' })
 }
 
 export function capabilityCommandText(t, text) {
   if (text?.key) return t(text.key, text.params)
   const receipt = readCapabilityCommandReceipt(text)
-  if (!receipt) return text
-  const line = t(`capabilities.receipt.${receipt.state}`, { session: receipt.sessionId, error: receipt.error ?? '' })
-  return receipt.proof === undefined ? line : `${line} ${capabilityProofCopy(t, receipt.proof)}`
+  return receipt === undefined ? text : capabilityReceiptNotice(t, receipt, 'receipt')
 }
 
 // Host-owned context the model sees in PTC mode. The plugin never receives the host's
@@ -50,13 +76,13 @@ const PROMPT_TABLE_COLUMNS = PROMPT_TABLE_COLUMN_KEYS.length
 function capabilityChoiceLabel(t, value) {
   return t(value === 'inherit' ? 'capabilities.quick.noOverride'
     : ['enabled', 'pending', 'unknown'].includes(value) ? `capabilities.quick.${value}`
-      : [...selections, ...CAPABILITY_DISCLOSURES].includes(value) ? `capabilities.${value}` : 'capabilities.quick.unknown')
+      : [...selections, ...CAPABILITY_DISCLOSURES].includes(value) ? `capabilities.word.${value}` : 'capabilities.quick.unknown')
 }
 
-function capabilityRuleLabel(t, rule, empty = 'capabilities.policy.inheritRule') {
+function capabilityRuleLabel(t, rule, empty = 'capabilities.policy.layerAbove') {
   const dimensions = ['availability', 'disclosure'].filter(dimension => rule?.[dimension] !== undefined)
   return dimensions.length ? dimensions.map(dimension => `${t(`capabilities.policy.${dimension}`)}: ${rule[dimension] === 'automatic'
-    ? t('capabilities.policy.inheritRule') : capabilityChoiceLabel(t, rule[dimension])}`).join(' · ') : t(empty)
+    ? t('capabilities.policy.layerAbove') : capabilityChoiceLabel(t, rule[dimension])}`).join(' · ') : t(empty)
 }
 
 function validCatalogRule(rule, temporary = false) {
@@ -66,6 +92,100 @@ function validCatalogRule(rule, temporary = false) {
         ? ['enabled', 'closed'].includes(choice) : CAPABILITY_DISCLOSURES.includes(choice))))
 }
 
+const CATALOG_DIMENSIONS = ['availability', 'disclosure']
+// The panel's own word table, column by column: a dimension keeps the word naming
+// where its value comes from, so the saved column can say `automatic` and the
+// session column can also say `inherit`, and neither stands in for a decision.
+const CATALOG_STATEMENT_WORDS = Object.freeze({
+  saved: Object.freeze({ availability: ['enabled', 'closed', 'automatic'],
+    disclosure: [...CAPABILITY_DISCLOSURES, 'automatic'] }),
+  temporary: Object.freeze({ availability: ['enabled', 'closed', 'automatic', 'inherit'],
+    disclosure: [...CAPABILITY_DISCLOSURES, 'automatic', 'inherit'] }),
+})
+
+/**
+ * One column statement as the listing publishes it: the panel's value for the
+ * dimensions that row decides.
+ *
+ * A capability row decides both dimensions and an MCP server row only
+ * availability, so a statement is a dimension object with one or two entries.
+ * Releases up to 0.5.4 stated one whole-selection word per column; a string stays
+ * readable as that word, and the earlier independent-rule form stays readable as
+ * the rule it was.
+ */
+function validCatalogStatement(column, value) {
+  if (typeof value === 'string') return true
+  if (value === null || typeof value !== 'object' || Array.isArray(value)) return false
+  const dimensions = Object.entries(value)
+  // A dimension name resolves to this column's own word list or to nothing at all: an own
+  // key such as `constructor` would otherwise reach an inherited function and throw while
+  // the card is rendering, where every other out-of-table shape falls back to the source.
+  return dimensions.length > 0 && dimensions.every(([dimension, choice]) =>
+    Object.hasOwn(CATALOG_STATEMENT_WORDS[column], dimension)
+      && CATALOG_STATEMENT_WORDS[column][dimension].includes(choice))
+}
+
+/** The panel's words for one statement, in the panel's column order. */
+function catalogStatementLabel(t, statement) {
+  return CATALOG_DIMENSIONS.filter(dimension => statement[dimension] !== undefined)
+    .map(dimension => t(`capabilities.word.${statement[dimension]}`)).join(' · ')
+}
+
+// A Skill's declaring bucket is one of the public provider sources. A bucket this
+// build does not name is stated beside the generic Skill source rather than denied.
+const SKILL_SOURCE_BUCKETS = Object.freeze(['project-dsh', 'project-agents', 'user-dsh', 'user-agents',
+  'runtime', 'bundled', 'custom'])
+
+/** The declared MCP servers whose `mcp__<server>__` namespace begins one tool name. */
+const mcpServersOf = source => Array.isArray(source?.servers)
+  ? source.servers.filter(server => typeof server === 'string')
+  : typeof source?.server === 'string' ? [source.server] : []
+
+/**
+ * The source a row states when its payload names none.
+ *
+ * A settings row can name an identity that only the saved configuration or a frozen
+ * plan mentions. The identity still names its namespace — `tools.*` is the Host tool
+ * registry's, `skills.*` is a Skill's, `mcp.*`/`mcpServers.*` is MCP's — and stating
+ * the namespace is the same fact `inventory` states when no declared server names a
+ * tool.
+ */
+const namespaceSource = entry => {
+  const namespace = typeof entry.id === 'string' ? entry.id.slice(0, entry.id.indexOf('.')) : ''
+  return { kind: namespace === 'skills' ? 'skill'
+    : namespace === 'mcp' || namespace === 'mcpServers' ? 'mcp' : 'host' }
+}
+
+/**
+ * The source column's statement for one declared row.
+ *
+ * `servers` is every declared MCP server whose namespace names the row. One name can
+ * begin with two (`mcp__docs__deep__search` is named by `docs` and by `docs__deep`),
+ * and then the column states both of them: a source column that cannot name its
+ * source has nothing left to say but a denial, which §4 forbids. Payloads written
+ * before that list travelled said `kind: 'unknown'`; they still state that several
+ * servers match. Every other row states the source its payload names, or the
+ * namespace its identity belongs to.
+ */
+function capabilitySourceText(t, entry) {
+  // A server row is the declared server layer itself, so its source is MCP: naming
+  // the server there would state the row's own name as its source.
+  if (entry.kind === 'server') return t('capabilities.source.mcp')
+  const source = entry.source ?? namespaceSource(entry)
+  const servers = mcpServersOf(source)
+  if (servers.length > 0) return servers.join(t('capabilities.source.separator'))
+  if (source.kind === 'skill') {
+    return SKILL_SOURCE_BUCKETS.includes(source.bucket) ? t(`capabilities.source.${source.bucket}`)
+      : source.bucket ? `${t('capabilities.source.other-skill')} · ${source.bucket}` : t('capabilities.source.skill')
+  }
+  if (source.kind === 'unknown') return t('capabilities.source.multiple-servers')
+  // A source kind this build does not name falls back to the namespace the identity
+  // states, so each row keeps naming its own layer instead of another one's.
+  const namespace = namespaceSource(entry).kind
+  if (source.kind === 'mcp' || namespace === 'mcp') return t('capabilities.source.mcp')
+  return t(`capabilities.source.${namespace === 'skill' ? 'skill' : 'host'}`)
+}
+
 /** A Chat snapshot without a node store cannot order a receipt against the conversation. */
 const noSnapshot = () => undefined
 
@@ -89,17 +209,67 @@ export function firstHumanMessageSeq(nodes) {
 
 /**
  * A capability receipt belongs to chat only after the conversation has opened.
- * A blank Session has nothing to announce, and a receipt recorded before the
- * first human message describes a previous attempt's publication. A truncated
- * Chat window cannot prove where the conversation opened, so its earliest
- * loaded message must not hide a receipt the session may still own.
+ * A blank Session has nothing to announce, and a publication receipt recorded
+ * before the first human message describes a previous attempt's publication. A
+ * truncated Chat window cannot prove where the conversation opened, so its
+ * earliest loaded message must not hide a receipt the session may still own.
+ *
+ * A receipt that carries the record of a write is different: the user asked for
+ * that change through this session's own panel or command, so it stays visible
+ * wherever the conversation currently starts. Hiding it once is what made the
+ * row appear while the session was blank and vanish the moment a first message
+ * gave the window a starting point.
  */
-export function capabilityReceiptVisible(node, { blank = false, firstUserSeq = null, windowComplete = true } = {}) {
+export function capabilityReceiptVisible(node, { blank = false, firstUserSeq = null, windowComplete = true,
+  written = false } = {}) {
   if (blank === true) return false
+  if (written === true) return true
   if (windowComplete !== true) return true
   return !(Number.isSafeInteger(node?.seq) && Number.isSafeInteger(firstUserSeq) && node.seq < firstUserSeq)
 }
 
+/**
+ * One run of capability writes, as the card states it.
+ *
+ * The chat store is read once per node and the answer is a string, because a
+ * selector must return the same value for the same store: a fresh array would
+ * make every notification re-render. `node` names the member whose card this is;
+ * a store that does not contain it (a single-node render, or a window that does
+ * not reach it) still answers with that node's own row.
+ */
+export function capabilityWriteRun(nodes, node, t) {
+  const own = writeReceiptOf(node)
+  if (own === undefined) return ''
+  const ownRow = capabilityReceiptNotice(t, own, 'card')
+  const list = orderedChatNodes(nodes)
+  const index = list.findIndex(item => item === node
+    || (node?.commandId !== undefined && item?.commandId === node.commandId))
+  if (index < 0) return JSON.stringify({ last: true, rows: [ownRow] })
+  let start = index
+  let end = index
+  while (start > 0 && writeReceiptOf(list[start - 1]) !== undefined) start -= 1
+  while (end + 1 < list.length && writeReceiptOf(list[end + 1]) !== undefined) end += 1
+  const rows = list.slice(start, end + 1).map(item => capabilityReceiptNotice(t, writeReceiptOf(item), 'card'))
+  return JSON.stringify({ last: end === index, rows })
+}
+
+function parseWriteRun(signature, fallback) {
+  if (typeof signature !== 'string' || signature === '') return fallback === '' ? { last: true, rows: [] } : JSON.parse(fallback)
+  try { return JSON.parse(signature) } catch { return { last: true, rows: [] } }
+}
+
+function orderedChatNodes(nodes) {
+  if (nodes === null || nodes === undefined) return []
+  if (typeof nodes.values === 'function') return [...nodes.values()]
+  return Array.isArray(nodes) ? nodes : []
+}
+
+function writeReceiptOf(node) {
+  if (typeof node?.args !== 'string' || !String(node.args).trim().startsWith('set ')) return undefined
+  const receipt = readCapabilityCommandReceipt(node?.outcome?.text)
+  return receipt?.state === 'recorded' && receipt.record !== undefined ? receipt : undefined
+}
+
 export function createCapabilityCommandCard(React) {
   const h = React.createElement
   return function CapabilityCommandCard({ node, t, useChat, useSession }) {
@@ -118,38 +288,56 @@ export function createCapabilityCommandCard(React) {
     // not chat, so a node without that submitted input is not a user command and
     // renders no notice: a fresh session has no change to announce.
     if (typeof node.args !== 'string') return null
-    if (!capabilityReceiptVisible(node, { blank, firstUserSeq, windowComplete })) return null
-    const command = `/${node.name ?? 'capabilities'}${node.args ? ` ${String(node.args).trim()}` : ''}`
     const text = node.outcome?.text
     const receipt = readCapabilityCommandReceipt(text)
+    // A write is this session's own record, so it is visible wherever the window
+    // starts; a publication receipt keeps the conversation-start rule.
+    const written = receipt?.state === 'recorded' && receipt.record !== undefined
+    if (!capabilityReceiptVisible(node, { blank, firstUserSeq, windowComplete, written })) return null
+    const command = `/${node.name ?? 'capabilities'}${node.args ? ` ${String(node.args).trim()}` : ''}`
     // Pending is the plan's publication state, not an outcome: it becomes true
     // only at the next accepted model step, so a durable notice would state a
     // future that a historical row can no longer verify.
     if (receipt?.state === 'pending') return null
     const legacyRefresh = text === 'Session capability environment refreshed; the model-visible notification is recorded.'
+    if (written) {
+      // Writes that arrive together are one event for the reader: the runs are
+      // counted once and stated as one card, and the last row of a run draws it so
+      // the card does not repeat per command. The signature is a string because a
+      // selector has to answer the same value for the same store.
+      const signature = readChat(snapshot => capabilityWriteRun(snapshot?.nodes, node, t))
+      const run = parseWriteRun(signature, capabilityWriteRun(undefined, node, t))
+      if (run.last !== true) return null
+      return h('section', { className: 'ptcPlusCapabilityCommandNotice', 'data-kind': 'writes',
+        role: node.outcome?.kind === 'error' ? 'alert' : 'status' },
+      h('p', { className: 'ptcPlusCapabilityCommandNoticeHead' },
+        t('capabilities.card.writes', { count: run.rows.length })),
+      h('ul', { className: 'ptcPlusCapabilityCommandNoticeList' },
+        run.rows.map((row, index) => h('li', { key: `${index}`, className: 'ptcPlusCapabilityCommandNoticeRow' }, row))))
+    }
     if (receipt || String(node.args ?? '').trim() === 'refresh' || legacyRefresh) {
-      const outcome = receipt ? t(`capabilities.card.${receipt.state}`, { error: receipt.error ?? '' })
+      // The notice a command leaves in chat is the same receipt the composer toast
+      // and the panel's footer state, so no surface keeps its own account of a write.
+      const outcome = receipt ? capabilityReceiptNotice(t, receipt, 'card')
         : legacyRefresh ? t('capabilities.card.recorded')
           : node.outcome ? (typeof text === 'string' && !text.trim() ? undefined : capabilityCommandText(t, text))
             ?? t(node.outcome.kind === 'error' ? 'capabilities.commandFailed' : 'capabilities.refreshAcknowledged')
             : t('capabilities.refreshing')
-      // A command that names one capability carries that capability's three
-      // facts; the notice states them beside its session outcome so "saved"
-      // cannot be read as "delivered" or "usable".
-      const notice = receipt?.proof === undefined || outcome === undefined
-        ? outcome : `${outcome} ${capabilityProofCopy(t, receipt.proof)}`
       return h('p', { className: 'ptcPlusCapabilityCommandNotice',
         role: node.outcome?.kind === 'error' ? 'alert' : 'status',
-        'data-state': node.outcome?.kind ?? 'pending' }, notice)
+        'data-state': node.outcome?.kind ?? 'pending' }, outcome)
     }
     let json
     if (typeof text === 'string') {
       try { json = JSON.parse(text) } catch { /* Plain command outcomes remain readable text. */ }
     }
+    // The listing states the saved column and this session's record; the composition
+    // a runtime would build is not one of its entries, so the card states these two
+    // columns and no third answer it could only guess.
     const entries = json?.schema === 'ptc-capability-catalog/v1' && Array.isArray(json.entries)
       && json.entries.every(entry => entry && typeof entry.id === 'string'
-        && ['name', 'description', 'effective', 'saved', 'temporary']
-          .every(key => entry[key] === undefined || typeof entry[key] === 'string')
+        && ['name', 'description'].every(key => entry[key] === undefined || typeof entry[key] === 'string')
+        && ['saved', 'temporary'].every(key => entry[key] === undefined || validCatalogStatement(key, entry[key]))
         && ['savedRule', 'temporaryRule'].every(key => entry[key] === undefined || validCatalogRule(entry[key], key === 'temporaryRule'))) ? json.entries : null
     const outcome = entries ? t('capabilities.card.catalogCount', { count: entries.length })
       : json ? t('capabilities.card.details')
@@ -157,13 +345,10 @@ export function createCapabilityCommandCard(React) {
           ?? t(node.outcome.kind === 'error' ? 'capabilities.commandFailed' : 'capabilities.refreshAcknowledged')
           : t('capabilities.refreshing')
     const label = (entry, key) => {
-      const ruleKey = key === 'saved' ? 'savedRule' : key === 'temporary' ? 'temporaryRule' : 'effectiveDimensions'
-      const rule = entry[ruleKey]
-      if (rule !== undefined && (key !== 'effective' || validCatalogRule({ availability: rule?.availability, disclosure: rule?.disclosure }))) {
-        const dimensions = capabilityRuleLabel(t, rule, key === 'temporary' ? 'capabilities.quick.noOverride' : 'capabilities.policy.inheritRule')
-        return key === 'effective' ? `${capabilityChoiceLabel(t, entry.effective)} (${dimensions})` : dimensions
-      }
-      return capabilityChoiceLabel(t, entry[key])
+      if (typeof entry[key] === 'object') return catalogStatementLabel(t, entry[key])
+      const rule = entry[key === 'saved' ? 'savedRule' : 'temporaryRule']
+      return rule === undefined ? capabilityChoiceLabel(t, entry[key])
+        : capabilityRuleLabel(t, rule, key === 'temporary' ? 'capabilities.quick.noOverride' : 'capabilities.policy.layerAbove')
     }
     return h('section', { className: 'ptcPlusCapabilityReceipt', 'aria-label': t('capabilities.receipt.title') },
       h('div', { className: 'ptcPlusCapabilityReceiptHead' },
@@ -175,12 +360,12 @@ export function createCapabilityCommandCard(React) {
       entries?.length ? h('details', { className: 'ptcPlusCapabilityReceiptCatalog' },
         h('summary', null, t('capabilities.card.browse')),
         h('div', { className: 'ptcPlusCapabilityReceiptTable' }, h('table', null,
-          h('thead', null, h('tr', null, ...['member', 'quick.effective', 'quick.globalSaved', 'quick.temporary']
+          h('thead', null, h('tr', null, ...['member', 'quick.globalSaved', 'quick.temporary']
             .map(key => h('th', { key, scope: 'col' }, t(`capabilities.${key}`))))),
           h('tbody', null, ...entries.map((entry, index) => h('tr', { key: `${entry.id}-${index}` },
             h('td', null, h('strong', null, entry.name ?? entry.id),
               entry.description ? h('small', null, entry.description) : null),
-            ...['effective', 'saved', 'temporary'].map(key => h('td', { key }, label(entry, key))))))))) : null,
+            ...['saved', 'temporary'].map(key => h('td', { key }, label(entry, key))))))))) : null,
       text ? h('details', { className: 'ptcPlusCapabilityReceiptSource',
         onToggle: event => setShowSource(event.currentTarget.open) },
         h('summary', null, t('capabilities.card.source')),
@@ -189,28 +374,8 @@ export function createCapabilityCommandCard(React) {
 }
 
 const selections = ['automatic', 'full', 'on-demand', 'closed']
-const kinds = ['all', 'tool', 'skill', 'resource', 'other']
 const compare = (a, b) => a < b ? -1 : a > b ? 1 : 0
 const configurationId = () => Array.from(globalThis.crypto.getRandomValues(new Uint8Array(16)), byte => byte.toString(16).padStart(2, '0')).join('')
-
-/** Catalog facts and saved preferences stay separate from frozen session results. */
-export function capabilitySettingsEntries(value, catalog, plans, uncertain = false) {
-  const baseline = JSON.parse(value.capabilityBaseline ?? CONFIG_DEFAULTS.capabilityBaseline)
-  const entries = new Map((catalog ?? []).map(entry => [entry.id, { ...entry, available: true }]))
-  for (const plan of plans ?? []) for (const entry of plan.effective.entries) {
-    if (!entries.has(entry.id)) entries.set(entry.id, { id: entry.id, category: entry.category })
-  }
-  const policy = capabilityPolicyForConfig(value)
-  for (const id of [...baseline, ...Object.keys(policy.items)].filter(id => !id.startsWith('mcpServers.'))) if (!entries.has(id)) entries.set(id, { id })
-  return [...entries.values()].map(entry => ({ ...entry,
-    name: entry.name ?? entry.id,
-    kind: ['tool', 'skill'].includes(entry.category) ? entry.category
-      : ['resource', 'resource-template'].includes(entry.category) ? 'resource' : 'other',
-    availability: catalog === null || uncertain ? 'unknown' : entry.available ? 'available' : 'unavailable',
-    common: baseline.includes(entry.id), rule: policy.items[entry.id] ?? {}, resolvedRule: capabilityRule(policy, entry),
-  }))
-}
-
 export function capabilityPlanReason(t, entry) {
   const known = ['manual-override', 'baseline-not-selected', 'baseline', 'coverage-below-threshold', 'statistical-coverage',
     'mcp-server-disabled', 'contract-budget', 'management-disabled', 'statistics-disabled', 'statistics-settings-invalid', 'statistics-data-invalid',
@@ -219,7 +384,7 @@ export function capabilityPlanReason(t, entry) {
     .map(reason => known.includes(reason) ? t(`capabilities.reason.${reason}`) : reason).join(' · ')
 }
 
-export function createCapabilitySettingsViews(React, { SearchIcon, Select, Modal = createFallbackModal(React) }) {
+export function createCapabilitySettingsViews(React, { Select, Modal = createFallbackModal(React) }) {
   const h = React.createElement
   const field = key => CONFIG_FIELDS.find(item => item.key === key)
   // Each group owns one settings tab; the prompt text switch lives in the same
@@ -308,8 +473,13 @@ export function createCapabilitySettingsViews(React, { SearchIcon, Select, Modal
     )
   }
 
-  function PolicyRules({ value, catalog, disabled, onChange, t }) {
-    const policy = capabilityPolicyForConfig(value)
+  function PolicyRules({ value, disabled, onChange, t }) {
+    // This window edits the record's own document. A configuration that saved no policy has only
+    // a synthesized document, whose bottom layer the capability-management switch shaped, so the
+    // editor starts from the record's written layers instead of freezing that layer into the
+    // record on the first edit (capability-surface §8.1c).
+    const policy = value.capabilityPolicySaved === true
+      ? capabilityPolicyForConfig(value) : capabilityPolicyFromRecord(value)
     const write = next => onChange(field('capabilityPolicy'), JSON.stringify(next))
     const ruleControls = (rule, update, label, defaults = false) => h('div', { className: 'ptcPlusPolicyRule', key: label },
       h('strong', null, label), ...['availability', 'disclosure'].map(dimension => h('div', { className: 'ptcPlusCapabilityFilter', key: dimension },
@@ -318,7 +488,7 @@ export function createCapabilitySettingsViews(React, { SearchIcon, Select, Modal
           value: rule[dimension] ?? 'automatic', onChange: choice => {
             const next = { ...rule }; if (choice === 'automatic') delete next[dimension]; else next[dimension] = choice; update(next)
           }, options: [...(defaults ? [] : ['automatic']), ...(dimension === 'availability' ? ['enabled', 'closed'] : CAPABILITY_DISCLOSURES)]
-            .map(choice => ({ value: choice, label: t(choice === 'automatic' ? 'capabilities.policy.inheritRule' : `capabilities.${choice === 'enabled' ? 'quick.enabled' : choice}`) })) }))))
+            .map(choice => ({ value: choice, label: t(choice === 'automatic' ? 'capabilities.policy.layerAbove' : `capabilities.word.${choice}`) })) }))))
     return h('section', { className: 'ptcPlusPolicyRules', 'aria-label': t('capabilities.policy.rules') },
       h('h4', null, t('capabilities.inheritedRules')), h('p', { className: 'ptcPlusDetail' }, t('capabilities.inheritedRulesHelp')),
       h('p', { className: 'ptcPlusDetail' }, t('capabilities.policy.precedence')),
@@ -327,7 +497,7 @@ export function createCapabilitySettingsViews(React, { SearchIcon, Select, Modal
         ...Object.values(CAPABILITY_INVENTORY_CATEGORIES).map(category => ruleControls(policy.categories[category] ?? {}, rule =>
           write({ ...policy, categories: { ...policy.categories, [category]: rule } }), t(`capabilities.policy.category.${category}`)))),
       h('details', null, h('summary', { tabIndex: 0 }, t('capabilities.sourceRules')),
-        ...[...new Set([...Object.keys(policy.mcpServers), ...(catalog ?? []).map(item => item.mcpServer).filter(Boolean)])].sort(compare)
+        ...[...new Set(Object.keys(policy.mcpServers))].sort(compare)
           .map(server => ruleControls(policy.mcpServers[server] ?? {}, rule =>
             write(changeCapabilityRule(changeCapabilityRule(policy, `mcpServers.${server}`, 'availability', rule.availability ?? 'automatic'),
               `mcpServers.${server}`, 'disclosure', rule.disclosure ?? 'automatic')), server))))
@@ -345,340 +515,23 @@ export function createCapabilitySettingsViews(React, { SearchIcon, Select, Modal
       footer ? h('div', { className: 'ptcPlusCapabilityDialogFooter' }, footer) : null)
   }
 
-  function CapabilityBatchDialog({ operation, value, entries, disabled, onChange, onClose, t }) {
-    const [choices, setChoices] = React.useState({ availability: 'keep', disclosure: 'keep' })
-    const [pending, setPending] = React.useState(false)
-    const [failed, setFailed] = React.useState(false)
-    const saving = React.useRef(false)
-    const mounted = React.useRef(true)
-    React.useEffect(() => { mounted.current = true; return () => { mounted.current = false } }, [])
-    const targetIds = new Set(entries.filter(entry => entry.availability === 'available').map(entry => entry.id))
-    const missing = operation.targets.filter(entry => !targetIds.has(entry.id)).length
-    const blocked = disabled('capabilityPolicy') || pending
-    const changed = Object.values(choices).some(choice => choice !== 'keep')
-    const close = () => { if (!saving.current) onClose() }
-    const confirm = async () => {
-      if (saving.current || blocked || missing || !changed || !operation.targets.length) return
-      let next = capabilityPolicyForConfig(value)
-      for (const target of operation.targets) for (const dimension of ['availability', 'disclosure']) {
-        if (choices[dimension] !== 'keep') next = changeCapabilityRule(next, target.id, dimension, choices[dimension])
-      }
-      saving.current = true; setPending(true); setFailed(false)
-      try {
-        const saved = await onChange(field('capabilityPolicy'), JSON.stringify(next))
-        if (!mounted.current) return
-        if (saved === true) onClose()
-        else setFailed(true)
-      } catch {
-        if (mounted.current) setFailed(true)
-      } finally {
-        saving.current = false
-        if (mounted.current) setPending(false)
-      }
-    }
-    return h(Modal, { open: true, onClose: close, title: t('capabilities.batchSettings'),
-      closeLabel: t('capabilities.batch.cancel'), headless: true, className: 'ptcPlusCapabilityBatchModal' },
-      h('div', { className: 'ptcPlusCapabilityBatchHead' }, h('h2', null, t('capabilities.batchSettings')),
-        h('button', { type: 'button', className: 'ptcPlusDialogClose', disabled: pending,
-          'aria-label': t('capabilities.batch.cancel'), onClick: close }, '×')),
-      h('div', { className: 'ptcPlusCapabilityBatchBody' },
-        h('p', { className: 'ptcPlusDetail', role: 'status' }, t('capabilities.batch.targets', { count: operation.targets.length })),
-        operation.excluded ? h('p', { className: 'ptcPlusDetail' }, t('capabilities.batch.excluded', { count: operation.excluded })) : null,
-        operation.targets.length ? h('ul', { className: 'ptcPlusCapabilityBatchTargets', 'aria-label': t('capabilities.batch.targetList') },
-          ...operation.targets.map(target => h('li', { key: target.id }, h('span', null, target.name), h('code', null, target.id))))
-          : h('p', { className: 'ptcPlusDetail' }, t('capabilities.batch.empty')),
-        h('div', { className: 'ptcPlusCapabilityBatchFields' }, ...['availability', 'disclosure'].map(dimension =>
-          h('div', { key: dimension, className: 'ptcPlusCapabilityFilter' }, h('span', null, t(`capabilities.policy.${dimension}`)),
-            h(Select, { value: choices[dimension], disabled: blocked || !operation.targets.length,
-              label: t(`capabilities.batch.${dimension}`), onChange: choice => setChoices(current => ({ ...current, [dimension]: choice })),
-              options: ['keep', 'automatic', ...(dimension === 'availability' ? ['enabled', 'closed'] : CAPABILITY_DISCLOSURES)]
-                .map(choice => ({ value: choice, label: t(choice === 'keep' ? 'capabilities.batch.keep'
-                  : choice === 'automatic' ? 'capabilities.policy.inheritRule'
-                    : choice === 'enabled' ? 'capabilities.action.enable'
-                      : choice === 'closed' ? 'capabilities.action.close' : `capabilities.${choice}`) })) })))),
-        h('p', { className: 'ptcPlusDetail' }, t('capabilities.batch.effect')),
-        h('p', { className: 'ptcPlusDetail' }, t('capabilities.batch.sourceClosure')),
-        missing ? h('p', { className: 'ptcPlusMessage', role: 'alert' }, t('capabilities.batch.changedTargets', { count: missing })) : null,
-        failed ? h('p', { className: 'ptcPlusMessage', role: 'alert' }, t('capabilities.batch.failed')) : null),
-      h('div', { className: 'ptcPlusCapabilityBatchFooter' },
-        h('button', { type: 'button', className: 'ptcPlusButton', disabled: pending, onClick: close }, t('capabilities.batch.cancel')),
-        h('button', { type: 'button', className: 'ptcPlusButton', 'data-kind': 'primary',
-          disabled: blocked || Boolean(missing) || !changed || !operation.targets.length, onClick: confirm },
-        t(pending ? 'state.syncing' : 'capabilities.batch.confirm', { count: operation.targets.length }))))
-  }
-
-  function CapabilityChoices({ value, catalog, catalogError, plans, plansError, disabled, onChange, onReload, t, selectedSessionId, onSessionSelect }) {
-    const root = React.useRef(null)
-    const [query, setQuery] = React.useState('')
-    const [kind, setKind] = React.useState('all')
-    const [source, setSource] = React.useState('all')
-    const [strategy, setStrategy] = React.useState('all')
-    const [availabilityRule, setAvailabilityRule] = React.useState('all')
-    const [onlyCommon, setOnlyCommon] = React.useState(false)
-    const [availability, setAvailability] = React.useState('all')
-    const [sort, setSort] = React.useState(null)
-    const [selected, setSelected] = React.useState(null)
-    const [picked, setPicked] = React.useState([])
-    const [filtersOpen, setFiltersOpen] = React.useState(false)
-    const [batchOperation, setBatchOperation] = React.useState(null)
-    const [inheritedRulesOpen, setInheritedRulesOpen] = React.useState(false)
-    const [localSessionId, setLocalSessionId] = React.useState('')
-    const sessionId = onSessionSelect ? selectedSessionId : localSessionId
-    const setSessionId = next => { setLocalSessionId(next); onSessionSelect?.(next) }
-    const baseline = JSON.parse(value.capabilityBaseline ?? CONFIG_DEFAULTS.capabilityBaseline)
-    const policy = capabilityPolicyForConfig(value)
-    const entries = capabilitySettingsEntries(value, catalog, plans, Boolean(catalogError))
-    const sourceKey = entry => JSON.stringify([entry.source?.kind ?? 'unknown', entry.source?.server ?? null,
-      entry.source?.bucket ?? null, entry.source?.provider ?? null])
-    const sourceLabel = entry => {
-      if (entry.source?.kind === 'skill') {
-        const bucket = entry.source.bucket
-        const known = ['project-dsh', 'project-agents', 'user-dsh', 'user-agents', 'runtime', 'bundled', 'custom']
-        const label = known.includes(bucket) ? t(`capabilities.source.${bucket}`)
-          : bucket ? `${t('capabilities.source.other-skill')} · ${bucket}` : t('capabilities.source.unknown')
-        return `${label}${entry.source.provider ? ` · ${entry.source.provider}` : ''}`
-      }
-      if (entry.source?.kind === 'mcp') return `MCP${entry.source.server ? ` · ${entry.source.server}` : ''}`
-      return t(`capabilities.source.${entry.source?.kind === 'host' ? 'host' : 'unknown'}`)
-    }
-    const matchesKind = (entry, type) => type === 'all' || (type === 'resource' ? entry.source?.kind === 'mcp'
-      : type === 'tool' ? entry.kind === 'tool' && entry.source?.kind !== 'mcp' : type === entry.kind)
-    const sources = new Map(entries.filter(entry => matchesKind(entry, kind)).map(entry => [sourceKey(entry), sourceLabel(entry)]))
-    const setType = next => { setKind(next); if (!entries.some(entry => matchesKind(entry, next) && sourceKey(entry) === source)) setSource('all') }
-    const setCompatibleSource = next => {
-      setSource(next)
-      if (next !== 'all' && !entries.some(entry => matchesKind(entry, kind) && sourceKey(entry) === next)) setKind('all')
-    }
-    const normalizedQuery = query.trim().toLowerCase()
-    const filtered = entries.filter(entry => matchesKind(entry, kind)
-      && (source === 'all' || sourceKey(entry) === source)
-      && (strategy === 'all' || (entry.rule.disclosure ?? 'automatic') === strategy)
-      && (availabilityRule === 'all' || (entry.rule?.availability ?? 'automatic') === availabilityRule)
-      && (!onlyCommon || entry.common)
-      && (availability === 'all' || entry.availability === availability)
-      && `${entry.name} ${entry.id} ${entry.description ?? ''} ${sourceLabel(entry)}`.toLowerCase().includes(normalizedQuery))
-    const defaultOrder = (a, b) => compare(a.name.toLowerCase(), b.name.toLowerCase()) || compare(a.id, b.id)
-    const state = item => item.availability === 'unknown' ? 'unknown' : item.availability === 'unavailable' ? 'unavailable'
-      : value.capabilityContextEnabled === false || value.capabilityManagementEnabled !== true ? 'unapplied'
-        : item.resolvedRule.availabilitySource.startsWith('mcp:') && item.resolvedRule.availability === 'closed' ? 'source-closed' : item.resolvedRule.availability
-    const type = item => item.source?.kind === 'mcp' ? 'resource' : item.kind
-    const displayedSource = item => item.source?.kind === 'mcp' ? item.source.server ?? sourceLabel(item) : sourceLabel(item)
-    const groups = new Map()
-    for (const entry of filtered) {
-      const group = entry.source?.kind === 'mcp' && entry.source.server ? `mcp:${entry.source.server}`
-        : entry.availability === 'unavailable' ? 'unavailable' : entry.kind
-      if (!groups.has(group)) groups.set(group, [])
-      groups.get(group).push(entry)
-    }
-    const groupOrder = ['tool', ...[...groups.keys()].filter(key => key.startsWith('mcp:')).sort(compare), 'skill', 'resource', 'other', 'unavailable']
-    const defaultEntries = groupOrder.flatMap(group => (groups.get(group) ?? []).sort(defaultOrder))
-    const visible = sortCapabilityEntries(defaultEntries, sort, (item, column) => column === 'name' ? item.name
-      : column === 'type' ? t(`capabilities.type.${type(item)}`)
-        : column === 'source' ? displayedSource(item)
-          : column === 'availability' ? t(`capabilities.rowState.${state(item)}`)
-            : t(`capabilities.${item.resolvedRule.disclosure}`))
-    const pickedIds = picked.filter(id => entries.some(item => item.id === id))
-    const pickedEntries = pickedIds.map(id => entries.find(item => item.id === id)).filter(Boolean)
-    const pickedTargets = pickedEntries.filter(item => item.availability === 'available')
-    const allVisiblePicked = visible.length > 0 && visible.every(item => pickedIds.includes(item.id))
-    const someVisiblePicked = visible.some(item => pickedIds.includes(item.id))
-    const togglePick = id => setPicked(current => current.includes(id) ? current.filter(item => item !== id) : [...current, id])
-    const toggleAllVisible = () => setPicked(current => allVisiblePicked
-      ? current.filter(id => !visible.some(item => item.id === id))
-      : [...new Set([...current, ...visible.map(item => item.id)])])
-    const entry = visible.find(item => item.id === selected)
-    const plan = sessionId ? plans?.find(item => item.sessionId === sessionId) : undefined
-    const effective = plan?.effective.entries.find(item => item.id === entry?.id)
-    const change = (key, next) => onChange(field(key), JSON.stringify(next))
-    const setManual = (id, selection) => change('capabilityPolicy', changeCapabilityRule(policy, id, 'disclosure', selection))
-    const clear = () => { setQuery(''); setKind('all'); setSource('all'); setStrategy('all'); setAvailabilityRule('all'); setOnlyCommon(false); setAvailability('all') }
-    const activeFilters = Number(kind !== 'all') + Number(source !== 'all') + Number(strategy !== 'all') + Number(availabilityRule !== 'all') + Number(onlyCommon) + Number(availability !== 'all')
-    const select = (label, current, update, options, blocked = false) => h('div', { className: 'ptcPlusCapabilityFilter' },
-      h('span', null, label), h(Select, { label, value: current, disabled: blocked, onChange: update,
-        options: options.map(([key, text]) => ({ value: key, label: text })) }))
-    const editorField = (label, control) => h('div', { className: 'ptcPlusCapabilityField' }, h('span', null, label), control)
-    const manualSelect = item => h('div', { className: 'ptcPlusCapabilityEditorFields' },
-      editorField(t('capabilities.enabledColumn'), h(Select, { value: item.rule.availability ?? 'automatic', disabled: disabled('capabilityPolicy'),
-        label: t('capabilities.policy.availabilityFor', { name: item.id }),
-        onChange: next => change('capabilityPolicy', changeCapabilityRule(policy, item.id, 'availability', next)),
-        options: ['automatic', 'enabled', 'closed'].map(choice => ({ value: choice, label: t(choice === 'automatic' ? 'capabilities.policy.inheritRule' : choice === 'enabled' ? 'capabilities.quick.enabled' : `capabilities.${choice}`) })) })),
-      editorField(t('capabilities.contextColumn'), h(Select, { value: item.rule.disclosure ?? 'automatic', disabled: disabled('capabilityPolicy'),
-        label: t('capabilities.disclosureFor', { name: item.id }),
-        onChange: next => setManual(item.id, next), options: ['automatic', ...CAPABILITY_DISCLOSURES]
-          .map(choice => ({ value: choice, label: t(choice === 'automatic' ? 'capabilities.policy.inheritRule' : `capabilities.${choice}`) })) })))
-    const commonSwitch = item => h('div', { className: 'ptcPlusCapabilitySwitchRow' },
-      h('div', { className: 'ptcPlusCapabilitySwitchText' },
-        h('span', { className: 'ptcPlusCapabilitySwitchLabel' }, t('capabilities.commonBaseline')),
-        h('span', { className: 'ptcPlusCapabilitySwitchHint' }, t(item.common ? 'capabilities.inBaseline' : 'capabilities.notInBaseline'))),
-      h('input', { type: 'checkbox', role: 'switch', className: 'ptcPlusCheck', checked: item.common,
-        disabled: disabled('capabilityBaseline'), 'aria-label': t('capabilities.baselineFor', { name: item.id }),
-        onChange: event => change('capabilityBaseline', event.target.checked
-          ? [...baseline.filter(id => id !== item.id), item.id] : baseline.filter(id => id !== item.id)) }))
-    const filterLabels = [kind !== 'all' ? t(`capabilities.type.${kind}`) : null,
-      source !== 'all' ? sources.get(source) ?? t('capabilities.previousSource') : null,
-      strategy !== 'all' ? t(strategy === 'automatic' ? 'capabilities.policy.inheritRule' : `capabilities.${strategy}`) : null,
-      availabilityRule !== 'all' ? t(availabilityRule === 'automatic' ? 'capabilities.policy.inheritRule'
-        : availabilityRule === 'enabled' ? 'capabilities.quick.enabled' : 'capabilities.closed') : null,
-      onlyCommon ? t('capabilities.onlyCommon') : null,
-      availability !== 'all' ? t(`capabilities.availability.${availability}`) : null].filter(Boolean)
-    const closeEditor = () => {
-      const button = [...(root.current?.querySelectorAll('[data-capability-edit-id]') ?? [])].find(item => item.dataset.capabilityEditId === selected)
-      setSelected(null); button?.focus({ preventScroll: true })
-    }
-    return h('div', { className: 'ptcPlusCapabilityChoices', ref: root },
-      h('div', { className: 'ptcPlusCapabilityToolbar' },
-        h('label', { className: 'ptcPlusSearch' }, h(SearchIcon),
-          h('input', { type: 'search', value: query, 'aria-label': t('capabilities.search'), placeholder: t('capabilities.search'),
-            onChange: event => setQuery(event.target.value) })),
-        h('div', { className: 'ptcPlusCapabilityTypes', role: 'group', 'aria-label': t('capabilities.types') },
-          ...kinds.filter(key => key !== 'other' || entries.some(item => item.kind === 'other')).map(key => h('button', {
-            key, type: 'button', 'aria-pressed': kind === key, onClick: () => setType(key),
-          }, t(`capabilities.type.${key}`)))),
-        h('button', { type: 'button', className: 'ptcPlusButton', 'aria-haspopup': 'dialog',
-          onClick: () => setFiltersOpen(true) }, t('capabilities.filterAction')),
-        h('button', { type: 'button', className: 'ptcPlusButton', 'aria-haspopup': 'dialog',
-          'aria-label': t('capabilities.batchSettings'),
-          disabled: disabled('capabilityPolicy') || pickedTargets.length === 0,
-          onClick: () => setBatchOperation({
-            targets: pickedTargets.map(item => ({ id: item.id, name: item.name })),
-            excluded: pickedIds.length - pickedTargets.length,
-          }) }, t('capabilities.batchSettings'),
-          pickedIds.length ? h('span', { className: 'ptcPlusCapabilityBatchCount', 'aria-hidden': true,
-            title: t('capabilities.selectionCount', { count: pickedIds.length }) },
-            String(pickedIds.length)) : null),
-        h('button', { type: 'button', className: 'ptcPlusButton', 'aria-haspopup': 'dialog',
-          onClick: () => setInheritedRulesOpen(true) }, t('capabilities.inheritedRules'))),
-      filtersOpen ? h(CapabilityDialog, { title: t('capabilities.filterAction'), onClose: () => setFiltersOpen(false), t,
-        className: 'ptcPlusCapabilityFilterDialog', footer: h('button', { type: 'button', className: 'ptcPlusButton',
-          'data-kind': 'primary', onClick: () => setFiltersOpen(false) }, t('capabilities.dialogDone')) },
-        h('div', { className: 'ptcPlusCapabilityFilterFields' },
-          select(t('capabilities.sourceFilter'), source, setCompatibleSource, [['all', t('capabilities.allSources')], ...sources,
-            ...(source !== 'all' && !sources.has(source) ? [[source, t('capabilities.previousSource')]] : [])]),
-          select(t('capabilities.policy.disclosureFilter'), strategy, setStrategy, [['all', t('capabilities.allStrategies')],
-            ...['automatic', ...CAPABILITY_DISCLOSURES].map(key => [key, t(key === 'automatic' ? 'capabilities.policy.inheritRule' : `capabilities.${key}`)])]),
-          select(t('capabilities.policy.availabilityFilter'), availabilityRule, setAvailabilityRule, [['all', t('capabilities.allStrategies')],
-            ...['automatic', 'enabled', 'closed'].map(key => [key, t(key === 'automatic' ? 'capabilities.policy.inheritRule' : key === 'enabled' ? 'capabilities.quick.enabled' : 'capabilities.closed')])]),
-          h('label', { className: 'ptcPlusCapabilityOnlyCommon' }, h('input', { type: 'checkbox', checked: onlyCommon,
-            onChange: event => setOnlyCommon(event.target.checked) }), t('capabilities.onlyCommon')),
-          select(t('capabilities.availabilityFilter'), availability, setAvailability,
-            ['all', 'available', 'unavailable', 'unknown'].map(key => [key, t(`capabilities.availability.${key}`)])))) : null,
-      inheritedRulesOpen ? h(CapabilityDialog, { title: t('capabilities.inheritedRules'), onClose: () => setInheritedRulesOpen(false), t,
-        footer: h('button', { type: 'button', className: 'ptcPlusButton', 'data-kind': 'primary',
-          onClick: () => setInheritedRulesOpen(false) }, t('capabilities.dialogDone')) },
-        h(PolicyRules, { value, catalog, disabled, onChange, t })) : null,
-      batchOperation ? h(CapabilityBatchDialog, { operation: batchOperation, value, entries, disabled, onChange,
-        onClose: () => setBatchOperation(null), t }) : null,
-      activeFilters ? h('div', { className: 'ptcPlusActiveFilters' }, h('span', null, filterLabels.join(' · ')),
-        h('button', { type: 'button', className: 'ptcPlusCapabilityLink', onClick: clear }, t('capabilities.clear'))) : null,
-      h('div', { className: 'ptcPlusCapabilityResultLine' }, h('span', { role: 'status' }, t('capabilities.results', { count: visible.length, total: entries.length })),
-        h('button', { type: 'button', className: 'ptcPlusCapabilityLink', onClick: onReload }, t('capabilities.reloadCatalog'))),
-      catalogError ? h('p', { role: 'status', className: 'ptcPlusMessage' }, t('capabilities.catalogUnavailable', { error: catalogError })) : null,
-      entries.length === 0 ? h('p', { className: 'ptcPlusDetail' }, t('capabilities.catalogEmpty'))
-        : visible.length === 0 ? h('div', { className: 'ptcPlusCapabilityEmpty' }, h('p', null, t('capabilities.noMatches')),
-          h('button', { type: 'button', className: 'ptcPlusCapabilityLink', onClick: clear }, t('capabilities.clear'))) :
-          h('div', { className: 'ptcPlusCapabilityTable', role: 'table', 'aria-label': t('capabilities.management') },
-            h('div', { className: 'ptcPlusCapabilityColumns', role: 'row' },
-              ...CAPABILITY_SORT_COLUMNS.map(column => h('span', { key: column.key, role: 'columnheader',
-                'aria-sort': capabilitySortDirection(sort, column.key),
-                ...(column.key === 'name' ? { 'aria-label': t('capabilities.member'), className: 'ptcPlusCapabilityPickHead' } : {}) },
-                ...(column.key === 'name' ? [h('input', { type: 'checkbox', className: 'ptcPlusPick', checked: allVisiblePicked,
-                  ref: node => { if (node) node.indeterminate = someVisiblePicked && !allVisiblePicked },
-                  disabled: visible.length === 0, 'aria-label': t('capabilities.selectAllVisible'),
-                  onChange: toggleAllVisible })] : []),
-                h('button', { type: 'button', className: 'ptcPlusCapabilitySort', title: t('capabilities.sortCycle'),
-                  onClick: () => setSort(current => cycleCapabilitySort(current, column.key)) },
-                t(`capabilities.${column.label}`), h('span', { 'aria-hidden': true },
-                  capabilitySortDirection(sort, column.key) === 'ascending' ? '↑' : capabilitySortDirection(sort, column.key) === 'descending' ? '↓' : '↕'))))),
-            h('div', { className: 'ptcPlusCapabilityList', role: 'rowgroup' }, ...visible.map(item => h('div', { key: item.id, className: 'ptcPlusCapabilityItem', role: 'row',
-              'data-selected': entry?.id === item.id, 'data-availability': item.availability,
-              onClick: () => setSelected(item.id) },
-              h('div', { className: 'ptcPlusCapabilityIdentity', role: 'cell' },
-                h('input', { type: 'checkbox', className: 'ptcPlusPick', checked: pickedIds.includes(item.id),
-                  'aria-label': t('capabilities.selectForBatch', { name: item.name ?? item.id }),
-                  onClick: event => event.stopPropagation(), onChange: () => togglePick(item.id) }),
-                h('div', { className: 'ptcPlusCapabilityIdentityText' },
-                  h('span', { className: 'ptcPlusCapabilityName' }, item.name), h('code', null, item.id))),
-              h('span', { className: 'ptcPlusCapabilityBadge', role: 'cell', 'data-kind': type(item) }, t(`capabilities.type.${type(item)}`)),
-              h('span', { className: 'ptcPlusCapabilitySource', role: 'cell' }, displayedSource(item)),
-              // The cell stays a plain cell so its empty area selects the row; only the switch and
-              // its own label swallow the click, keeping a toggle from also opening the row editor.
-              h('div', { className: 'ptcPlusCapabilityAvailability', role: 'cell', 'data-state': state(item) },
-                h('input', { type: 'checkbox', role: 'switch', className: 'ptcPlusCheck', id: `ptcPlusCapabilityAvailability-${item.id}`,
-                  checked: item.resolvedRule.availability === 'enabled',
-                  disabled: disabled('capabilityPolicy') || state(item) === 'source-closed',
-                  'aria-label': t('capabilities.policy.availabilityFor', { name: item.id }),
-                  onClick: event => event.stopPropagation(),
-                  onChange: event => change('capabilityPolicy', changeCapabilityRule(policy, item.id, 'availability', event.target.checked ? 'enabled' : 'closed')) }),
-                h('label', { htmlFor: `ptcPlusCapabilityAvailability-${item.id}`,
-                  onClick: event => event.stopPropagation() }, t(`capabilities.rowState.${state(item)}`))),
-              h('div', { role: 'cell', className: 'ptcPlusCapabilityContextCell' }, h('button', { type: 'button', className: 'ptcPlusCapabilityContext', 'data-capability-edit-id': item.id,
-                'aria-label': t('capabilities.editContextFor', { name: item.id }), 'aria-haspopup': 'dialog',
-                onClick: event => { event.stopPropagation(); setSelected(item.id) } },
-                h('span', null, t(`capabilities.${item.resolvedRule.disclosure}`)),
-                h('svg', { width: 16, height: 16, viewBox: '0 0 24 24', fill: 'none', stroke: 'currentColor', strokeWidth: 1.5, 'aria-hidden': true },
-                  h('path', { d: 'm15 5 4 4M4 20l4-1L20 7l-4-4L4 15Z' })))))))),
-      entry ? h(CapabilityDialog, { title: entry.name, onClose: closeEditor, t, className: 'ptcPlusCapabilityEditorDialog',
-        footer: h('button', { type: 'button', className: 'ptcPlusButton', onClick: closeEditor }, t('capabilities.closeDetails')) },
-        h('code', null, entry.id), h('p', { className: 'ptcPlusDetail' }, t('capabilities.contextHelp')),
-        manualSelect(entry), commonSwitch(entry),
-        h('p', { className: 'ptcPlusDetail' }, t(value.capabilityContextEnabled === false ? 'capabilities.effect.paused'
-          : value.capabilityManagementEnabled !== true ? 'capabilities.effect.rulesOff'
-            : entry.resolvedRule.availabilitySource.startsWith('mcp:') && entry.resolvedRule.availability === 'closed' ? 'capabilities.effect.sourceClosed'
-              : entry.resolvedRule.availability === 'closed' ? 'capabilities.effect.closed'
-                : `capabilities.effect.disclosure.${entry.resolvedRule.disclosure}`)),
-        h('p', { className: 'ptcPlusDetail' }, t('capabilities.policy.resolved', {
-          availability: t(entry.resolvedRule.availability === 'enabled' ? 'capabilities.quick.enabled' : 'capabilities.closed'),
-          disclosure: t(`capabilities.${entry.resolvedRule.disclosure}`),
-          source: `${entry.resolvedRule.availabilitySource} · ${entry.resolvedRule.disclosureSource}` })),
-        entry.rule.disclosure !== undefined ? h('button', { type: 'button', className: 'ptcPlusCapabilityLink', disabled: disabled('capabilityPolicy'),
-          onClick: () => setManual(entry.id, 'automatic') }, t('capabilities.restoreAutomatic')) : null,
-        entry.source?.kind === 'mcp' && entry.mcpServer ? h('section', { className: 'ptcPlusCapabilityEditorSection' },
-          h('h5', null, t('capabilities.sourceRules')),
-          h('p', { className: 'ptcPlusDetail' }, t('capabilities.serverHint')),
-          h('div', { className: 'ptcPlusCapabilityEditorFields' },
-            ...['availability', 'disclosure'].map(dimension => editorField(t(`capabilities.policy.${dimension}`),
-              h(Select, { value: policy.mcpServers[entry.mcpServer]?.[dimension] ?? 'automatic', disabled: disabled('capabilityPolicy'),
-                label: `${entry.mcpServer} · ${t(`capabilities.policy.${dimension}`)}`,
-                onChange: next => change('capabilityPolicy', changeCapabilityRule(policy, `mcpServers.${entry.mcpServer}`, dimension, next)),
-                options: ['automatic', ...(dimension === 'availability' ? ['enabled', 'closed'] : CAPABILITY_DISCLOSURES)].map(key => ({ value: key,
-                  label: t(key === 'automatic' ? 'capabilities.policy.inheritRule' : key === 'enabled' ? 'capabilities.quick.enabled' : `capabilities.${key}`) })) }))))) : null,
-        entry.kind === 'skill' ? h('p', { className: 'ptcPlusDetail' }, t('capabilities.skillDisclosure')) : null,
-        entry.kind === 'skill' && entry.invocationConflict ? h('p', { className: 'ptcPlusDetail' }, t('capabilities.invocation.varies')) : null,
-        entry.kind === 'skill' && entry.invocation ? h('p', { className: 'ptcPlusDetail' },
-          t(entry.invocation.modelInvocable ? entry.invocation.userInvocable ? 'capabilities.invocation.both'
-            : 'capabilities.invocation.model' : 'capabilities.invocation.user', { name: entry.name })) : null,
-        entry.description ? h('section', { className: 'ptcPlusCapabilityEditorSection' },
-          h('h5', null, t('capabilities.catalogDescription')), h('p', { className: 'ptcPlusCapabilityProse' }, entry.description)) : null,
-        entry.availability === 'unavailable' ? h('button', { type: 'button', className: 'ptcPlusCapabilityLink',
-          disabled: disabled('capabilityBaseline') || disabled('capabilityPolicy'), onClick: () => {
-            const next = { ...policy, items: { ...policy.items } }; delete next.items[entry.id]; change('capabilityPolicy', next)
-            if (baseline.includes(entry.id)) change('capabilityBaseline', baseline.filter(id => id !== entry.id))
-          } }, t('capabilities.removeSaved')) : null,
-        value.capabilityContextEnabled !== false && value.capabilityManagementEnabled === true ? h('section', { className: 'ptcPlusCapabilityEditorSection' },
-          h('h5', null, t('capabilities.currentSession')),
-          editorField(t('capabilities.sessionSelector'), h(Select, { value: sessionId ?? '', label: t('capabilities.sessionSelector'), onChange: setSessionId,
-            options: [{ value: '', label: t('capabilities.chooseSession') }, ...(plans ?? []).map(item => ({ value: item.sessionId, label: item.sessionId }))] })),
-          plansError ? h('p', { role: 'status', className: 'ptcPlusDetail' }, t('capabilities.unavailable', { error: plansError }))
-            : !plan ? h('p', { className: 'ptcPlusDetail' }, t('capabilities.selectObservation')) : h(React.Fragment, null,
-              h('p', null, effective ? t(`capabilities.${effective.selection}`) : t('capabilities.notInSession')),
-              effective ? h('p', { className: 'ptcPlusDetail' }, capabilityPlanReason(t, effective)) : null,
-              effective?.evidence ? h('p', { className: 'ptcPlusDetail' }, `${effective.evidence.used}/${effective.evidence.eligible} (${effective.evidence.scope})`) : null,
-              plan.pendingRefresh ? h('p', { className: 'ptcPlusDetail' }, t('capabilities.pending')) : null)) : null) : null)
-
-  }
-
   function AllocationEvidence({ allocation, allocationError, allocationPending, selectedSessionId, statistics = false, onReload, t }) {
     const [statisticsScope, setStatisticsScope] = React.useState('workspace')
     if (allocationPending) return h('p', { role: 'status' }, t('state.syncing'))
     if (allocationError) return h('p', { role: 'status', className: 'ptcPlusMessage' }, t('capabilities.unavailable', { error: allocationError }))
-    if (!allocation) return selectedSessionId ? h('p', { className: 'ptcPlusCapabilityNotice' }, t('capabilities.observationUnavailable')) : null
+    if (!allocation) return selectedSessionId ? h('p', { className: 'ptcPlusCapabilityNotice' }, t('capabilities.observationNotRead')) : null
     const { plan, coverage, configuration } = allocation
     const count = selection => plan.entries.filter(entry => entry.selection === selection).length
     const evidenceFor = item => coverage?.[item.id]?.[statisticsScope]
     const usable = evidence => evidence?.status === 'usable' && Number.isFinite(evidence.used) && Number.isFinite(evidence.eligible)
+    // Only the sample states the evidence itself reports have a name here. Any other
+    // value describes the samples the read did not deliver, never a capability state.
+    const SAMPLE_STATES = ['no-samples', 'pending-settlement', 'incomplete-window', 'capacity-exceeded']
+    const sampleText = evidence => SAMPLE_STATES.includes(evidence?.status)
+      ? t(`capabilities.statStatus.${evidence.status}`) : t('capabilities.statStatus.not-reported')
     const coverageText = evidence => usable(evidence) && Number.isFinite(evidence.coverage) ? `${Math.round(evidence.coverage * 100)}%`
       : usable(evidence) ? t('capabilities.statStatus.no-samples')
-      : t(`capabilities.statStatus.${evidence?.status ?? 'unavailable'}`)
+        : sampleText(evidence)
     return h('section', { className: 'ptcPlusAllocationEvidence', 'aria-label': t(statistics ? 'capabilities.observedUsage' : 'capabilities.budgetPreview') },
       h('div', { className: 'ptcPlusCapabilityResultLine' }, h('h4', null, t(statistics ? 'capabilities.observedUsage' : 'capabilities.budgetPreview')),
         h('button', { type: 'button', className: 'ptcPlusCapabilityLink', onClick: onReload }, t('capabilities.reloadObservation'))),
@@ -689,14 +542,14 @@ export function createCapabilitySettingsViews(React, { SearchIcon, Select, Modal
       !statistics ? h('p', { className: 'ptcPlusCapabilityNotice' }, t('capabilities.coldStartHint')) : null,
       !statistics ? h(React.Fragment, null,
         h('div', { className: 'ptcPlusAllocationMetrics' },
-          ...['full', 'on-demand', 'closed'].map(selection => h('div', { key: selection }, h('strong', null, count(selection)), h('span', null, t(`capabilities.${selection}`)))),
+          ...['full', 'on-demand', 'closed'].map(selection => h('div', { key: selection }, h('strong', null, count(selection)), h('span', null, t(`capabilities.word.${selection}`)))),
           h('div', null, h('strong', null, `${plan.budgets.contractBytes} / ${configuration.capabilityBudgetBytes}`), h('span', null, 'UTF-8 bytes'))),
         h('progress', { max: configuration.capabilityBudgetBytes, value: Math.min(configuration.capabilityBudgetBytes, plan.budgets.contractBytes),
           'aria-label': t('capabilities.budgetPreview') }),
         h('p', { className: 'ptcPlusDetail' }, t('capabilities.budget', { bytes: plan.budgets.contractBytes, overage: plan.budgets.overageBytes })),
         h('p', { className: 'ptcPlusDetail' }, t('capabilities.directoryUsage', { bytes: plan.budgets.directoryBytes, budget: configuration.capabilityDirectoryBytes })),
         !plan.enabled ? h('p', { className: 'ptcPlusCapabilityNotice' }, t('capabilities.managementOff')) : null)
-        : coverage === null ? h('p', { role: 'status' }, t('capabilities.statStatus.unavailable')) : null,
+        : coverage === null ? h('p', { role: 'status' }, t('capabilities.statStatus.not-reported')) : null,
       h('div', { className: 'ptcPlusCapabilityEvidenceTable' }, h('table', null,
         h('thead', null, h('tr', null, ...[t('capabilities.member'), ...(statistics
           ? [t('capabilities.usedFamilies'), t('capabilities.eligibleFamilies'), t('capabilities.coverageColumn')]
@@ -708,7 +561,7 @@ export function createCapabilitySettingsViews(React, { SearchIcon, Select, Modal
               h('td', { key: 'eligible' }, usable(evidenceFor(item)) ? evidenceFor(item).eligible : '—'),
               h('td', { key: 'coverage' }, coverageText(evidenceFor(item)), usable(evidenceFor(item)) && Number.isFinite(evidenceFor(item).coverage)
                 ? h('progress', { max: 1, value: evidenceFor(item).coverage, 'aria-label': t('capabilities.coverageFor', { name: item.id }) }) : null)]
-            : [h('td', { key: 'selection' }, t(`capabilities.${entry?.selection ?? 'host'}`)), h('td', { key: 'reason' }, entry ? capabilityPlanReason(t, entry) : '—'), h('td', { key: 'size' }, `${item.contractBytes} B`)]))
+            : [h('td', { key: 'selection' }, t(`capabilities.word.${entry?.selection ?? 'host'}`)), h('td', { key: 'reason' }, entry ? capabilityPlanReason(t, entry) : '—'), h('td', { key: 'size' }, `${item.contractBytes} B`)]))
         })))))
   }
 
@@ -868,7 +721,7 @@ export function createCapabilitySettingsViews(React, { SearchIcon, Select, Modal
           setting('group.capabilities', enabled('capabilityContextEnabled')),
           setting('capabilities.management', enabled('capabilityManagementEnabled')),
           setting('capabilities.statisticsEnabled', t(JSON.parse(configuration.capabilityStatistics).enabled ? 'capabilities.serverOn' : 'capabilities.serverOff')),
-          setting('capabilities.defaultDisclosure', t(`capabilities.${policy.defaults.disclosure}`)),
+          setting('capabilities.defaultDisclosure', t(`capabilities.word.${policy.defaults.disclosure}`)),
           setting('capabilities.allocationTitle', ['baseline', 'statistics', 'budget'].filter(key => policy.allocation[key]).map(key => t(`capabilities.allocation.${key}`)).join(' · ') || '—'),
           setting('capabilities.recoveryEnabled', enabled('capabilityRecoveryEnabled')),
           setting('capabilities.previewEnabled', `${enabled('modelPreviewEnabled')}${configuration.modelPreviewEnabled ? ` · ${t('capabilities.estimatedTokens', { count: configuration.modelPreviewTokens })}` : ''}`),
@@ -901,14 +754,18 @@ export function createCapabilitySettingsViews(React, { SearchIcon, Select, Modal
     const saved = choicesFor(configurationReady ? value : undefined)
     const retained = flagsFor(saved)
     const applied = flagsFor(effectiveCapabilitySettings(saved))
-    const policy = capabilityPolicyForConfig(value)
+    // This pane states and writes the record's own rules: a configuration that saved no policy
+    // starts from the declared defaults plus the override record, so the synthesized bottom layer
+    // is neither shown as a saved default nor frozen into the record (§8.1c).
+    const policy = value.capabilityPolicySaved === true
+      ? capabilityPolicyForConfig(value) : capabilityPolicyFromRecord(value)
     const write = next => onChange(field('capabilityPolicy'), JSON.stringify(next))
     const adaptive = [policy.defaults, ...Object.values(policy.categories), ...Object.values(policy.mcpServers), ...Object.values(policy.items)]
       .some(rule => rule.disclosure === 'adaptive')
     const summary = key => {
       if (choiceState(retained, applied, key) === 'unknown') return t('capabilities.combination.unknownSettings')
       if (key === 'description') {
-        const description = t('capabilities.context.summary.description', { disclosure: t(`capabilities.${policy.defaults.disclosure}`) })
+        const description = t('capabilities.context.summary.description', { disclosure: t(`capabilities.word.${policy.defaults.disclosure}`) })
         if (policy.defaults.disclosure !== 'adaptive') return description
         const criteria = ['baseline', 'statistics', 'budget'].filter(key => policy.allocation[key])
           .map(key => t(`capabilities.allocation.${key}`)).join(t('capabilities.combination.separator'))
@@ -955,7 +812,7 @@ export function createCapabilitySettingsViews(React, { SearchIcon, Select, Modal
           h('p', { className: 'ptcPlusDetail' }, t('capabilities.descriptionDependency')),
           h('div', { className: 'ptcPlusCapabilityFilter' }, h('span', null, t('capabilities.defaultDisclosure')),
             h(Select, { value: policy.defaults.disclosure, disabled: disabled('capabilityPolicy'), label: t('capabilities.defaultDisclosure'),
-              options: CAPABILITY_DISCLOSURES.map(choice => ({ value: choice, label: t(`capabilities.${choice}`) })),
+              options: CAPABILITY_DISCLOSURES.map(choice => ({ value: choice, label: t(`capabilities.word.${choice}`) })),
               onChange: disclosure => write({ ...policy, defaults: { ...policy.defaults, disclosure } }) })),
           h('p', { className: 'ptcPlusDetail' }, effect(value.capabilityManagementEnabled !== true ? 'capabilities.effect.rulesOff' : `capabilities.effect.disclosure.${policy.defaults.disclosure}`)),
           criteria,
@@ -1344,10 +1201,11 @@ export function createCapabilitySettingsViews(React, { SearchIcon, Select, Modal
       h('p', { className: 'ptcPlusPromptIntro' }, t('capabilities.prompt.intro')))
   }
 
-  function CapabilityWorkbench({ value, configurationReady, catalog, catalogError, plans, plansError, plansPending, plansStale, disabled, onChange, onReload, t, renderField, renderPlans, renderRefresh, id, selectedSessionId, onSessionSelect,
-    allocation, allocationError, allocationPending, onApplyConfiguration, configurationWritable, saving, saveStatus }) {
+  function CapabilityWorkbench({ value, configurationReady, plans, plansError, plansPending, plansStale, disabled, onChange, onReload, t, renderField, renderPlans, renderRefresh, id, selectedSessionId, onSessionSelect,
+    allocation, allocationError, allocationPending, onApplyConfiguration, configurationWritable, saving, saveStatus, surface }) {
     const [tab, setTab] = React.useState('manual')
     const [contextSection, setContextSection] = React.useState('description')
+    const [rulesOpen, setRulesOpen] = React.useState(false)
     const tabs = ['manual', 'budgets', 'statistics', 'prompt', 'plans']
     const feedback = saving ? t('state.syncing') : saveStatus && saveStatus.key !== 'status.applied' ? t(saveStatus.key, saveStatus.params)
       : t(configurationWritable ? 'capabilities.savedForNew' : 'footer.readOnly')
@@ -1371,7 +1229,18 @@ export function createCapabilitySettingsViews(React, { SearchIcon, Select, Modal
               onChange: event => onChange(field('capabilityManagementEnabled'), event.target.checked) })) : null),
         key === 'manual' ? h(React.Fragment, null, h('p', { className: 'ptcPlusDetail' }, t(value.capabilityContextEnabled === false ? 'capabilities.effect.paused'
           : value.capabilityManagementEnabled === true ? 'capabilities.managementHelp' : 'capabilities.effect.rulesOff')),
-          h(CapabilityChoices, { value, catalog, catalogError, plans, plansError, disabled, onChange, onReload, t, selectedSessionId, onSessionSelect }))
+          // The capability page is one renderer mounted here with the address this
+          // entrance fixes. This entrance brings no columns, words, controls or
+          // receipts of its own; the rule chain that answers for objects the saved
+          // address has not decided one by one stays a rule editor beside it.
+          h('div', { className: 'ptcPlusCapabilityRulesEntry' },
+            h('button', { type: 'button', className: 'ptcPlusButton', 'aria-haspopup': 'dialog',
+              onClick: () => setRulesOpen(true) }, t('capabilities.inheritedRules'))),
+          rulesOpen ? h(CapabilityDialog, { title: t('capabilities.inheritedRules'), onClose: () => setRulesOpen(false), t,
+            footer: h('button', { type: 'button', className: 'ptcPlusButton', 'data-kind': 'primary',
+              onClick: () => setRulesOpen(false) }, t('capabilities.dialogDone')) },
+            h(PolicyRules, { value, disabled, onChange, t })) : null,
+          surface ?? null)
           : key === 'statistics' ? h(React.Fragment, null, renderField('capabilityStatistics'),
             h('p', { className: 'ptcPlusDetail' }, t(value.capabilityContextEnabled === false ? 'capabilities.effect.paused'
               : choicesFor(value).statistics?.enabled === true ? 'capabilities.effect.collectionOn'
@@ -1390,21 +1259,28 @@ export function createCapabilitySettingsViews(React, { SearchIcon, Select, Modal
   return { CapabilityWorkbench }
 }
 
-/** Execute a human command through DSH; a receipt never stands in for model publication. */
+/**
+ * Execute a human command through DSH; a receipt never stands in for model publication.
+ *
+ * The button asks the command channel to run the same `refresh` line a human types.
+ * The channel publishes nothing until a session observes it, so the button keeps its
+ * own observation open; that observation decides no branch here. Whether the session
+ * lists the command is the command's own answer: a refusal arrives as its concrete
+ * error in the receipt, which is more accurate than a pre-emptive verdict.
+ */
 export function createCapabilityRefreshView(React, commands) {
   const h = React.createElement
-  const absent = Object.freeze({ getSnapshot: () => false, subscribe: () => () => {} })
   return function CapabilityRefreshButton({ sessionId, enabled, t, onApplied, onInvalidated }) {
-    const source = React.useMemo(() => sessionId ? commands.source(sessionId) : absent, [sessionId])
-    const available = React.useSyncExternalStore(source.subscribe, source.getSnapshot)
     const [pending, setPending] = React.useState(false)
     const [status, setStatus] = React.useState(null)
     const request = React.useRef(null)
+    const source = React.useMemo(() => sessionId ? commands.source(sessionId) : null, [sessionId])
+    React.useEffect(() => source === null ? undefined : source.subscribe(() => {}), [source])
     React.useEffect(() => {
       setStatus(null)
       setPending(false)
       return () => { request.current?.abort(); request.current = null }
-    }, [sessionId, enabled, available])
+    }, [sessionId, enabled])
     const cancel = event => {
       event.stopPropagation()
       request.current?.abort(); request.current = null; setPending(false)
@@ -1413,7 +1289,7 @@ export function createCapabilityRefreshView(React, commands) {
     }
     const execute = async event => {
       event.stopPropagation()
-      if (!enabled || !available || request.current) return
+      if (!enabled || request.current) return
       const controller = new AbortController()
       request.current = controller
       setPending(true)
@@ -1437,596 +1313,643 @@ export function createCapabilityRefreshView(React, commands) {
       }
     }
     return h('div', { className: 'ptcPlusCapabilityRefresh' },
-      h('button', { type: 'button', className: 'ptcPlusButton', disabled: !enabled || !available || pending,
-        title: !available ? t(sessionId ? 'capabilities.refreshUnavailable' : 'capabilities.chooseSession') : undefined,
+      h('button', { type: 'button', className: 'ptcPlusButton', disabled: !enabled || pending,
+        title: sessionId ? undefined : t('capabilities.chooseSession'),
         onClick: execute }, t(pending ? 'capabilities.refreshing' : 'capabilities.applySession')),
       pending ? h('button', { type: 'button', className: 'ptcPlusButton', onClick: cancel }, t('capabilities.cancelRefresh')) : null,
       status ? h('p', { className: 'ptcPlusDetail', role: 'status' }, capabilityCommandText(t, status))
-        : !available ? h('p', { className: 'ptcPlusDetail' }, t(sessionId ? 'capabilities.refreshUnavailable' : 'capabilities.chooseSession')) : null)
+        : sessionId ? null : h('p', { className: 'ptcPlusDetail' }, t('capabilities.chooseSession')))
   }
 }
 
-/** Session capability choices use the real command transaction and a read-only catalog observation. */
-export function createSessionCapabilityControlsView(React, { commands, Modal, Select, inspectSessionCatalog }) {
+/**
+ * The one capability surface, mounted by every entrance.
+ *
+ * A page states, for one supplied object, which value each of its two dimensions has
+ * at each address. Three permanent facts decide what it may state: the Host's supply
+ * (which rows exist), the record at each address (the saved configuration and this
+ * session's own log), and the receipt a write leaves. No runtime, service or global
+ * switch produces any of them, so the read is not gated: a failed read is a defect
+ * reported beside the rows, never a state the rows are replaced with.
+ *
+ * An entrance fixes which address this page may write. §4: a control exists exactly
+ * when its cell's address is fixed by the entrance that opened the page — so the
+ * session entrance controls this session's record and the settings entrance controls
+ * the new-session default. The other address is still stated, because it is what the
+ * reader compares against, and the session entrance adds the receipt column, which
+ * names the record each decision leaves. The settings entrance has no session address
+ * at all: its two session columns are absent, not disabled and not read-only.
+ */
+export function createCapabilitySurfaceView(React, { commands, bindingCommands, Modal, Select, inspectSessionCatalog }) {
   const h = React.createElement
-  const emptyDrafts = () => ({})
-  // The panel reports the three capability facts only where it holds evidence:
-  // the receipts its own commands returned. A catalogue row says what the plan
-  // will do; it cannot say a cell reached the capability.
-  const emptyProofs = () => ({})
-  return function SessionCapabilityControls({ sessionId, open, enabled, t, onClose }) {
-    const source = React.useMemo(() => commands.source(sessionId), [sessionId])
-    const available = React.useSyncExternalStore(source.subscribe, source.getSnapshot)
-    const [catalog, setCatalog] = React.useState([])
-    const [management, setManagement] = React.useState('unknown')
-    const [savedSettings, setSavedSettings] = React.useState(null)
-    const [loading, setLoading] = React.useState(false)
-    const [error, setError] = React.useState(null)
-    const [drafts, setDrafts] = React.useState(emptyDrafts)
+  // §4's seven columns plus the receipt column, in that order. One column, one
+  // decision: a dimension's control owns a labelled cell instead of sharing an
+  // unlabelled one with another dimension's control.
+  const COLUMNS = Object.freeze({
+    session: Object.freeze(['object', 'type', 'source', 'savedEnabled', 'savedDisclosure',
+      'sessionEnabled', 'sessionDisclosure', 'receipt']),
+    settings: Object.freeze(['object', 'type', 'source', 'savedEnabled', 'savedDisclosure']),
+  })
+  // One word per column, declared by this page and by no other surface (§6).
+  const COLUMN_COPY = Object.freeze({
+    object: 'capabilities.column.object',
+    type: 'capabilities.typesColumn',
+    source: 'capabilities.sourceColumn',
+    savedEnabled: 'capabilities.column.savedEnabled',
+    savedDisclosure: 'capabilities.column.savedDisclosure',
+    sessionEnabled: 'capabilities.column.sessionEnabled',
+    sessionDisclosure: 'capabilities.column.sessionDisclosure',
+    receipt: 'capabilities.column.receipt',
+  })
+  // The page's one value table. `inherit` is the session columns' own word for an
+  // address that recorded nothing, so no cell is blank and none carries a denial;
+  // every other word answers "who reads it, from which moment", which is the question
+  // both disclosure columns ask.
+  // `automatic` is the saved address's own word for a dimension its configuration wrote
+  // no rule for; the bottom layer a chain would fall back to is synthesized from
+  // configuration this page does not own, so it states no value here.
+  const SAVED_AVAILABILITY = Object.freeze(['enabled', 'closed', 'automatic'])
+  const SAVED_DISCLOSURE = Object.freeze([...CAPABILITY_DISCLOSURES, 'automatic'])
+  // A session column states the record's own words, so the record's own `automatic` is one
+  // of them; `inherit` stays this column's word for an address that recorded nothing.
+  const SESSION_AVAILABILITY = Object.freeze(['enabled', 'closed', 'automatic', 'inherit'])
+  const SESSION_DISCLOSURE = Object.freeze([...CAPABILITY_DISCLOSURES, 'automatic', 'inherit'])
+  const DIMENSIONS = Object.freeze(['availability', 'disclosure'])
+  const ADOPTION_WORDS = Object.freeze({ use: 'capabilities.word.use', skip: 'capabilities.word.skip',
+    damaged: 'capabilities.word.damaged' })
+  const FAMILIES = Object.freeze(['tools', 'skills', 'mcp', 'mcp_tools'])
+
+  /** A receipt is the command's own text; a keyed receipt is translated, never rewritten. */
+  const receiptText = (t, result) => {
+    const text = result?.text
+    if (typeof text === 'string') return text
+    if (text !== null && typeof text === 'object' && typeof text.key === 'string') return t(text.key, text.params)
+    return text === undefined || text === null ? '' : String(text)
+  }
+
+  return function CapabilitySurface({ entrance = 'session', sessionId, open, inline, writable = true, revision, savedCommands, onReload, t, onClose }) {
+    const settingsEntrance = entrance === 'settings'
+    const active = inline === true ? true : open
+    const [rows, setRows] = React.useState([])
+    // `loaded` is the read's own answer: an empty table means the Host declared
+    // nothing only after a complete read said so.
+    const [loaded, setLoaded] = React.useState(false)
+    const [defect, setDefect] = React.useState(null)
+    // The receipt of the most recent write, verbatim, or the error a refused write
+    // returned. The panel owns no wording of its own here.
+    const [receipt, setReceipt] = React.useState(null)
+    const [writing, setWriting] = React.useState([])
     const [picked, setPicked] = React.useState([])
     const [batchOpen, setBatchOpen] = React.useState(false)
     const [batchChoices, setBatchChoices] = React.useState({ availability: 'keep', disclosure: 'keep' })
-    const [selectedId, setSelectedId] = React.useState(null)
-    const [pane, setPane] = React.useState('list')
     const [query, setQuery] = React.useState('')
-    const [kind, setKind] = React.useState('all')
-    const [sourceFilter, setSourceFilter] = React.useState('all')
-    const [stateFilter, setStateFilter] = React.useState('all')
+    const [family, setFamily] = React.useState('all')
+    const [source, setSource] = React.useState('all')
+    // The table's ordering, owned by this page: a display decision that writes nothing
+    // and is dropped with the session it was made in.
     const [sort, setSort] = React.useState(null)
-    const [focusDimension, setFocusDimension] = React.useState(null)
-    const [status, setStatus] = React.useState(null)
-    const [proofs, setProofs] = React.useState(emptyProofs)
-    const [pending, setPending] = React.useState(false)
     const request = React.useRef(null)
-    const applying = React.useRef(false)
+    // Every write owns its own signal: a submitted command is not cancelled because
+    // another row was used, and each row reports only its own progress.
+    const writes = React.useRef(new Set())
+    const epoch = React.useRef(0)
     const mounted = React.useRef(true)
-    const detail = React.useRef(null)
-    const list = React.useRef(null)
-    React.useEffect(() => {
-      if (!focusDimension) return
-      const field = focusDimension === 'list' ? list.current?.querySelector('[data-selected="true"] .ptcPlusSessionCapabilityName')
-        : detail.current?.querySelector(`[data-capability-dimension="${focusDimension}"] [role="combobox"]`)
-        ?? detail.current?.querySelector('[role="combobox"]')
-      field?.focus({ preventScroll: true })
-      setFocusDimension(null)
-    }, [focusDimension, selectedId, pane])
     React.useEffect(() => {
       mounted.current = true
-      return () => { mounted.current = false; request.current?.abort(); request.current = null }
+      return () => {
+        mounted.current = false
+        epoch.current += 1
+        request.current?.abort()
+        request.current = null
+        for (const controller of writes.current) controller.abort()
+        writes.current.clear()
+      }
     }, [])
     React.useEffect(() => {
+      // A session switch abandons the previous session's read and writes: neither may
+      // land on the new session's rows.
       request.current?.abort()
       request.current = null
-      applying.current = false
-      setCatalog([])
-      setManagement('unknown')
-      setSavedSettings(null)
-      setDrafts(emptyDrafts())
+      for (const controller of writes.current) controller.abort()
+      writes.current.clear()
+      epoch.current += 1
+      setRows([])
+      setLoaded(false)
+      setDefect(null)
+      setReceipt(null)
+      setWriting([])
       setPicked([])
       setBatchOpen(false)
-      setSelectedId(null)
-      setPane('list')
-      setFocusDimension(null)
-      setStatus(null)
-      setProofs(emptyProofs())
-      setPending(false)
-      setError(null)
+      setQuery('')
+      setFamily('all')
+      setSource('all')
+      setSort(null)
     }, [sessionId])
     const load = React.useCallback(async signal => {
-      setLoading(true)
+      const mine = ++epoch.current
       try {
         const payload = await inspectSessionCatalog(sessionId, signal)
-        if (signal.aborted || !mounted.current || request.current?.signal !== signal) return
-        if (payload?.schema !== 'ptc-capability-session-catalog/v1' || !Array.isArray(payload.entries)) {
-          throw new Error('Invalid capability catalog')
+        if (!mounted.current || signal.aborted || mine !== epoch.current) return
+        // The only accepted response shape. `config` states a global switch, so it is
+        // read to confirm the shape and never drawn: a switch cannot decide a cell.
+        if (payload?.schema !== 'ptc-capability-session-catalog/v2' || !Array.isArray(payload.rows)
+          || payload.config === null || typeof payload.config !== 'object') {
+          throw new Error('Invalid capability catalogue')
         }
-        setCatalog(payload.entries)
-        setPicked(current => current.filter(id => payload.entries.some(entry => entry.id === id)))
-        setManagement(['managed', 'paused', 'off', 'unknown'].includes(payload.management)
-          ? payload.management : 'unknown')
-        setSavedSettings(payload.savedSettings !== null && typeof payload.savedSettings === 'object'
-          && !Array.isArray(payload.savedSettings) ? payload.savedSettings : null)
-        setError(null)
-        return payload.entries
-      } catch (failure) {
-        if (!signal.aborted && mounted.current && request.current?.signal === signal) setError(String(failure?.message ?? failure))
-      } finally {
-        if (!signal.aborted && mounted.current && request.current?.signal === signal) setLoading(false)
+        setRows(payload.rows)
+        setLoaded(true)
+        setDefect(null)
+        setPicked(current => current.filter(id => payload.rows.some(row => row.id === id)))
+      } catch (cause) {
+        if (mounted.current && !signal.aborted && mine === epoch.current) setDefect(String(cause?.message ?? cause))
       }
     }, [sessionId])
     React.useEffect(() => {
-      if (!open || !enabled || !available) {
-        if (!applying.current) { request.current?.abort(); request.current = null }
-        setLoading(false)
+      if (!active) {
+        request.current?.abort()
+        request.current = null
         return
       }
-      // An in-flight apply owns the shared catalog request and reloads it on completion.
-      if (applying.current) return
       const controller = new AbortController()
       request.current = controller
       void load(controller.signal)
-      return () => { controller.abort(); if (request.current === controller) request.current = null }
-    }, [open, enabled, available, load])
-    const choices = drafts
-    const choiceFor = entry => choices[entry.id] ?? entry.temporary ?? 'inherit'
-    // Session writes also require the saved configuration to keep capability
-    // management and context on; a frozen managed session cannot be edited
-    // while the current settings have them off.
-    const savedBlocks = savedSettings !== null && (savedSettings.enabled === false || savedSettings.contextEnabled === false)
-    const writesBlocked = management === 'paused' || management === 'off' || savedBlocks
-    const sourceKey = entry => entry.source?.kind === 'mcp' ? 'mcp:' + (entry.source.server ?? '')
-      : entry.source?.kind === 'skill' ? 'skill:' + (entry.source.bucket ?? '')
-        : entry.source?.kind ?? 'unknown'
-    const sourceLabel = entry => entry.source?.kind === 'mcp' ? `MCP · ${entry.source.server ?? ''}`
-      : entry.source?.kind === 'skill' ? `Skill · ${entry.source.bucket
-        ? t(`capabilities.source.${entry.source.bucket}`) : t('capabilities.source.unknown')}`
-        : t(`capabilities.source.${entry.source?.kind === 'host' ? 'host' : 'unknown'}`)
-    const category = entry => entry.category === 'skill' ? 'skills'
-      : ['server', 'resource'].includes(entry.category) ? 'mcp'
-        : entry.source?.kind === 'mcp' ? 'mcp_tools' : 'tools'
-    const type = entry => entry.category === 'server' ? 'server'
-      : entry.source?.kind === 'mcp' ? 'resource'
-        : entry.category === 'skill' ? 'skill'
-          : entry.category === 'resource' ? 'resource'
-            : entry.category === 'tool' ? 'tool' : 'other'
-    const displayedSource = entry => entry.source?.kind === 'mcp' ? entry.source.server ?? sourceLabel(entry) : sourceLabel(entry)
-    const effectiveAvailability = entry => entry.effective === 'pending' ? 'pending'
-      : entry.enclosingClosure || entry.effective === 'closed' ? 'closed'
-        : entry.effectiveDimensions?.availability
-          ?? (['full', 'on-demand', 'host', 'enabled'].includes(entry.effective) ? 'enabled' : 'unknown')
-    const effectiveContext = entry => entry.effective === 'pending' ? 'pending'
-      : effectiveAvailability(entry) === 'closed' ? 'closed'
-        : entry.effectiveDimensions?.disclosure
-          ?? (['full', 'on-demand', 'host'].includes(entry.effective) ? entry.effective : 'unknown')
-    const sources = [...new Set(catalog.filter(entry => kind === 'all' || category(entry) === kind).map(sourceKey))].sort()
-    const setCompatibleKind = next => {
-      setKind(next)
-      if (sourceFilter !== 'all' && !catalog.some(entry => (next === 'all' || category(entry) === next)
-        && sourceKey(entry) === sourceFilter)) setSourceFilter('all')
-    }
-    const setCompatibleSource = next => {
-      setSourceFilter(next)
-      if (next !== 'all' && !catalog.some(entry => (kind === 'all' || category(entry) === kind)
-        && sourceKey(entry) === next)) setKind('all')
-    }
-    const filtered = catalog.filter(entry => {
-      const text = [entry.name, entry.id, entry.description, entry.source?.server, entry.source?.bucket].filter(Boolean).join(' ').toLocaleLowerCase()
-      return (kind === 'all' || category(entry) === kind)
-        && (sourceFilter === 'all' || sourceKey(entry) === sourceFilter)
-        && (stateFilter === 'all' || (stateFilter === 'changed' ? Object.hasOwn(choices, entry.id) : entry.effective === stateFilter))
-        && text.includes(query.trim().toLocaleLowerCase())
-    }).sort((a, b) => (a.name ?? a.id).localeCompare(b.name ?? b.id) || a.id.localeCompare(b.id))
-    const groups = ['tools', 'skills', 'mcp', 'mcp_tools']
-    const defaultOrder = groups.flatMap(group => filtered.filter(entry => category(entry) === group))
-    const matches = sortCapabilityEntries(defaultOrder, sort, (entry, column) => column === 'name' ? entry.name ?? entry.id
-      : column === 'type' ? t(`capabilities.type.${type(entry)}`)
-        : column === 'source' ? displayedSource(entry)
-          : column === 'availability' ? capabilityChoiceLabel(t, effectiveAvailability(entry))
-            : capabilityChoiceLabel(t, effectiveContext(entry)))
-    const selected = matches.find(entry => entry.id === selectedId)
-      ?? ['tools', 'skills', 'mcp', 'mcp_tools'].map(group => matches.find(entry => category(entry) === group)).find(Boolean)
-    const staged = Object.entries(choices).flatMap(([id, choice]) => typeof choice === 'object'
-      ? Object.entries(choice).map(([dimension, selection]) => [id, selection, dimension]) : [[id, choice]])
-    const pickedRows = picked.map(id => catalog.find(entry => entry.id === id)).filter(Boolean)
-    const allMatchesPicked = matches.length > 0 && matches.every(entry => picked.includes(entry.id))
-    const someMatchesPicked = matches.some(entry => picked.includes(entry.id))
-    const togglePick = id => setPicked(current => current.includes(id) ? current.filter(item => item !== id) : [...current, id])
-    const toggleAllMatches = () => setPicked(current => allMatchesPicked
-      ? current.filter(id => !matches.some(entry => entry.id === id))
-      : [...new Set([...current, ...matches.map(entry => entry.id)])])
-    // One staging rule for single and batch edits: an item keeps one temporary
-    // patch, "inherit" removes the dimension and reselecting the stored choice
-    // never dirties the draft.
-    const stageDimension = (current, entry, dimension, choice) => {
-      const next = { ...current }
-      const patch = typeof next[entry.id] === 'object' && next[entry.id] !== null ? { ...next[entry.id] } : {}
-      const original = storedDimension(entry, dimension) ?? 'inherit'
-      const selectedChoice = patch[dimension] ?? original
-      if (choice !== selectedChoice) {
-        if (choice === original) delete patch[dimension]
-        else patch[dimension] = choice
+      return () => {
+        controller.abort()
+        if (request.current === controller) request.current = null
       }
-      if (Object.keys(patch).length) next[entry.id] = patch; else delete next[entry.id]
-      return next
-    }
-    const chooseDimension = (id, dimension, choice) => {
-      const entry = catalog.find(item => item.id === id)
-      if (entry) setDrafts(current => stageDimension(current, entry, dimension, choice))
-    }
-    const choose = (id, next) => {
-      const entry = catalog.find(item => item.id === id)
-      if (!entry) return
-      const original = entry.temporary ?? 'inherit'
-      if (next === (choices[id] ?? original)) return
-      setDrafts(current => {
-        const nextChoices = { ...current }
-        if (next === original) delete nextChoices[id]
-        else nextChoices[id] = next
-        return nextChoices
-      })
-    }
-    const stageBatch = (ids, selections) => setDrafts(current => ids.reduce((draft, id) => {
-      const entry = catalog.find(item => item.id === id)
-      if (!entry) return draft
-      return ['availability', 'disclosure'].reduce((next, dimension) =>
-        selections[dimension] === undefined || selections[dimension] === 'keep'
-          ? next : stageDimension(next, entry, dimension, selections[dimension]), draft)
-    }, current))
-    const hasInheritanceReset = staged.some(([, selection]) => selection === 'inherit')
-    const apply = async targetScope => {
-      if (applying.current || !enabled || !available || writesBlocked || staged.length === 0) return
-      if (targetScope === 'global' && hasInheritanceReset) return
-      const submitted = structuredClone(choices)
-      applying.current = true
-      setPending(true)
-      setStatus(null)
+      // The saved address is read again when the configuration under this page changes,
+      // so a rule edit elsewhere cannot leave the previous value on screen.
+    }, [active, load, revision])
+    const reload = () => {
       const controller = new AbortController()
       request.current?.abort()
       request.current = controller
-      // One owner releases the shared request slot and the pending state on every exit path, so a
-      // closed, superseded or failed apply cannot strand the workbench in "applying".
-      const finish = () => {
-        if (request.current === controller) request.current = null
-        applying.current = false
-        if (mounted.current) setPending(false)
-      }
+      void load(controller.signal)
+      onReload?.()
+    }
+    /**
+     * One intention, one record. The write itself is the caller's: a cell runs the
+     * write its own address owns, the receipt that write returns is what the footer
+     * shows, and the rows are re-read from the record rather than patched from the
+     * answer. A command that is not listed for this session reports its own refusal;
+     * it is never pre-empted.
+     */
+    const perform = async (id, run) => {
+      const controller = new AbortController()
+      writes.current.add(controller)
+      setWriting(current => current.includes(id) ? current : [...current, id])
+      setReceipt(null)
       try {
-        let completed = 0
-        let pendingCount = 0
-        let failure = null
-        let savedOnly = null
-        const observed = {}
-        for (const [id, selection, dimension] of staged) {
-          if (controller.signal.aborted) break
-          const line = `set ${targetScope} ${encodeURIComponent(id)} ${dimension ? dimension + ' ' : ''}${selection}`
-          try {
-            const result = await commands.run(sessionId, line, controller.signal)
-            const receipt = readCapabilityCommandReceipt(result.text)
-            if (!receipt || receipt.sessionId !== sessionId || !['recorded', 'pending'].includes(receipt.state)) {
-              throw new Error(receipt ? capabilityCommandText(t, result.text) : t('capabilities.quick.unknownReceipt'))
-            }
-            if (receipt?.state === 'pending') pendingCount += 1
-            // A receipt that names the capability carries the only proof this
-            // panel can hold: what the save did and did not establish.
-            if (receipt.proof !== undefined) observed[receipt.proof.id] = { proof: receipt.proof, command: `/capabilities ${line}` }
-            completed += 1
-          } catch (cause) {
-            failure = String(cause?.message ?? cause)
-            savedOnly = readCapabilityCommandReceipt(failure)?.state === 'saved-only'
-              ? readCapabilityCommandReceipt(failure) : null
-            break
-          }
-        }
-        if (mounted.current && Object.keys(observed).length) setProofs(current => ({ ...current, ...observed }))
-        if (request.current !== controller || controller.signal.aborted || !mounted.current) return
-        const refreshed = await load(controller.signal)
-        if (request.current !== controller || controller.signal.aborted || !mounted.current) return
-        const confirmed = refreshed ? staged.slice(0, completed).filter(([id, selection, dimension]) => {
-          const entry = refreshed.find(item => item.id === id)
-          if (dimension) return entry && (targetScope === 'session'
-            ? (entry.temporaryRule?.[dimension] ?? 'inherit') === selection
-            : (entry.savedRule?.[dimension] ?? 'automatic') === selection && entry.temporaryRule?.[dimension] === undefined)
-          return entry && (targetScope === 'session' ? entry.temporary === selection
-            : entry.saved === selection && entry.temporary === 'inherit')
-        }) : []
-        setDrafts(current => {
-          const nextChoices = { ...current }
-          for (const [id, selection, dimension] of confirmed) {
-            if (savedOnly && id === staged[completed]?.[0] && dimension === staged[completed]?.[2]) continue
-            if (dimension) {
-              if (nextChoices[id]?.[dimension] !== submitted[id]?.[dimension]) continue
-              const patch = { ...nextChoices[id] }; delete patch[dimension]
-              if (Object.keys(patch).length) nextChoices[id] = patch; else delete nextChoices[id]
-            } else if (nextChoices[id] === submitted[id]) delete nextChoices[id]
-          }
-          return nextChoices
-        })
-        if (savedOnly) setStatus({ key: 'capabilities.quick.savedOnly', params: { count: completed, error: savedOnly.error ?? '' } })
-        else if (failure || !refreshed || confirmed.length < completed) setStatus({ key: 'capabilities.quick.partial',
-          params: { count: confirmed.length, error: failure ?? t('capabilities.quick.confirmationUnavailable') } })
-        else setStatus({ key: pendingCount ? 'capabilities.quick.pendingApplied' : 'capabilities.quick.applied', params: { count: completed } })
+        const answer = await run(controller.signal)
+        if (!mounted.current || controller.signal.aborted) return
+        setReceipt({ text: receiptText(t, answer) })
+        await load(controller.signal)
+        // The caller distinguishes a write that ran from a row it skipped as already matching.
+        return { ok: true }
+      } catch (cause) {
+        const error = String(cause?.message ?? cause)
+        if (mounted.current && !controller.signal.aborted) setReceipt({ error })
+        // A batch runs one write at a time, so the next row's receipt would replace this
+        // refusal; the caller gets it back to state the batch's failure after the loop.
+        return { error }
       } finally {
-        finish()
+        writes.current.delete(controller)
+        if (mounted.current) setWriting(current => current.filter(item => item !== id))
       }
     }
-    const discard = () => { setDrafts(emptyDrafts()); setStatus(null) }
-    const close = () => {
-      // A confirmed apply keeps its own lifecycle: refusing the close keeps an accidental
-      // Escape or backdrop click from aborting host commands the user already submitted.
-      if (applying.current) return
-      request.current?.abort()
-      request.current = null
-      applying.current = false
-      setPending(false)
-      setDrafts(emptyDrafts())
-      setStatus(null)
-      onClose()
+    const record = (channel, line, id) => perform(id, signal => channel.run(sessionId, line, signal))
+    const word = value => t(`capabilities.word.${value}`)
+    // A batch writes one column of one entrance, so it names that column's dimension with
+    // the page's own word instead of the layer editor's rule name.
+    const dimensionWord = dimension => t(`capabilities.dimension.${dimension}`)
+    const choiceOptions = values => values.map(value => ({ value, label: word(value) }))
+    const familyOf = row => row.kind === 'binding' ? 'bindings'
+      : row.kind === 'server' ? 'mcp'
+        : row.category === 'skill' ? 'skills'
+          : row.category === 'resource' ? 'mcp'
+            : row.source?.kind === 'mcp' ? 'mcp_tools' : 'tools'
+    const badgeOf = row => row.kind === 'binding' ? 'binding'
+      : row.kind === 'server' ? 'server'
+        : row.category === 'skill' ? 'skill'
+          : row.category === 'resource' || row.source?.kind === 'mcp' ? 'resource' : 'tool'
+    // Two rows share one source filter entry exactly when they state the same source,
+    // and the entry is named by the row that states it.
+    const sourceKeyOf = row => row.kind === 'binding' ? 'bindings'
+      : JSON.stringify(row.source ?? namespaceSource(row))
+    const sourceText = row => row.kind === 'binding' ? t('capabilities.source.bindings')
+      : capabilitySourceText(t, row)
+    const sourceFilterLabel = row => {
+      const servers = mcpServersOf(row.source)
+      if (row.source?.kind === 'mcp' && servers.length > 0) return `MCP · ${servers.join(t('capabilities.source.separator'))}`
+      // The option names the whole source its key identifies. A skill's bucket does not:
+      // two providers can declare into one bucket, and two options reading one word would
+      // offer a distinction this filter cannot state.
+      return row.source?.kind === 'skill'
+        ? `Skill · ${sourceText(row)}${row.source.provider ? ` · ${row.source.provider}` : ''}`
+        : sourceText(row)
     }
-    const filter = (label, value, onChange, options, disabled = false) => h('div', { className: 'ptcPlusCapabilityFilter' },
-      h('span', null, label), h(Select, { label, value, onChange, disabled,
-        options: options.map(([key, text]) => ({ value: key, label: text })) }))
-    const ruleLabel = (rule, empty) => capabilityRuleLabel(t, rule, empty)
-    const statusLabel = value => value && typeof value === 'object' ? ruleLabel(value) : capabilityChoiceLabel(t, value)
-    // The stored temporary value for one dimension, including the legacy scalar
-    // form where a single selection covered both dimensions.
-    const storedDimension = (entry, dimension) => {
-      const rule = entry.temporaryRule !== null && typeof entry.temporaryRule === 'object' && !Array.isArray(entry.temporaryRule)
-        ? entry.temporaryRule : undefined
-      const override = rule?.[dimension]
-      if (override !== undefined) return override
-      if (entry.temporary === 'automatic') return 'automatic'
-      if (typeof entry.temporary === 'string' && !['inherit', 'automatic', 'unknown', 'pending'].includes(entry.temporary)) {
-        return dimension === 'availability' ? (entry.temporary === 'closed' ? 'closed' : 'enabled')
-          : (CAPABILITY_DISCLOSURES.includes(entry.temporary) ? entry.temporary : undefined)
+    // Both addresses, stated from the read: the saved column is the configuration's
+    // own value for this object and the session column is the record's answer, with
+    // `inherit` when this session recorded nothing. A server has no disclosure of its
+    // own, so both disclosure cells state where that decision lives instead of a
+    // denial or another row's answer.
+    // The saved cell states its own record's word: a dimension this record wrote nothing for reads
+    // `automatic`, never a resolved value another layer would answer (capability-surface §8.1c).
+    const savedOf = (row, dimension) => row.saved?.[dimension] ?? 'automatic'
+    const savedEnabled = row => word(savedOf(row, 'availability'))
+    const savedDisclosure = row => row.kind === 'server' ? t('capabilities.word.perMember')
+      : word(savedOf(row, 'disclosure'))
+    const recordedOf = (row, dimension) => row.session?.[dimension] ?? 'inherit'
+    const recordWord = (row, dimension) => row.record?.[dimension]
+    /** The layer whose record decided this dimension, or null when this object's own entry did. */
+    const recordLayer = (row, dimension) => row.record?.layers?.[dimension] ?? null
+    /** A recorded decision above this object: the row states the layer's word in its receipt. */
+    const adoptionOf = row => ['use', 'skip', 'damaged'].includes(row.session?.use) ? row.session.use : 'use'
+    /**
+     * The receipt column: which record this row's decision leaves, and what it states
+     * there — or that nothing has been written at that address yet. A missing record is
+     * that address's own "unwritten" receipt, not a blank: deleting this column would
+     * make "where does this decision get reconciled" unanswerable, which is why §4 asks
+     * for it and why the evidence column left the page.
+     */
+    const receiptOf = row => {
+      if (row.kind === 'binding') {
+        const record = t('capabilities.word.bindingRecord')
+        if (adoptionOf(row) === 'damaged') return `${record} · ${word('damaged')}`
+        return row.session?.recorded === true ? `${record} · ${t(ADOPTION_WORDS[adoptionOf(row)])}`
+          : `${record} · ${t('capabilities.word.unwritten')}`
       }
-      return undefined
+      const record = t('capabilities.word.sessionRecord')
+      // The receipt states the record's own text, not the resolution the value column
+      // shows, and names the layer when a record above this object decided it. That layer's row is
+      // part of this same read and states the word it wrote, so the receipt states that word:
+      // `inherit` is this row's word for its own entry having written nothing (§4), never a word a
+      // deciding record wrote.
+      // A server row states every word its own rule holds, including a disclosure word its rule
+      // can carry (§8.3): that word answers the members that wrote none at runtime, and a receipt
+      // that said `未写下` while the record held it would deny what this same read carries. Its
+      // disclosure cell still states the delegation, because the decision is made for the members.
+      const statedDimensions = DIMENSIONS
+      const layerWord = (layer, dimension) => rows
+        .find(candidate => candidate.id === layer)?.record?.[dimension]
+      const own = statedDimensions.filter(dimension => recordWord(row, dimension) !== undefined
+        && recordLayer(row, dimension) === null)
+      const byLayer = new Map()
+      for (const dimension of statedDimensions) {
+        const layer = recordLayer(row, dimension)
+        // A dimension this object did not write is still answered by that layer at runtime, so the
+        // receipt names it. A layer is named only for a dimension that layer's record wrote; a read
+        // that does not carry the layer's row states the layer alone instead of inventing a word.
+        if (layer === null) continue
+        const stated = layerWord(layer, dimension)
+        byLayer.set(layer, [...(byLayer.get(layer) ?? []), ...(stated === undefined ? [] : [`${dimension} ${stated}`])])
+      }
+      const parts = [
+        ...(own.length === 0 ? [] : [own.map(dimension => `${dimension} ${recordWord(row, dimension)}`).join(' · ')]),
+        ...[...byLayer].map(([layer, stated]) => stated.length === 0
+          ? t('capabilities.receipt.layer', { layer })
+          : `${t('capabilities.receipt.layer', { layer })} · ${stated.join(' · ')}`),
+      ]
+      return parts.length === 0 ? `${record} · ${t('capabilities.word.unwritten')}`
+        : `${record} · ${parts.join(' · ')}`
     }
-    // The value a dimension falls back to when this session keeps no temporary
-    // change; the frozen plan already resolved the saved layers.
-    const frozenDimension = (entry, dimension) => {
-      const source = entry.sourceDimensions?.[dimension]
-      if (typeof source === 'string') return source
-      const effective = entry.effectiveDimensions?.[dimension]
-      if (typeof effective === 'string' && storedDimension(entry, dimension) === undefined) return effective
-      if (dimension === 'availability') return entry.effective === 'closed' ? 'closed'
-        : ['full', 'on-demand', 'host', 'enabled'].includes(entry.effective) ? 'enabled' : undefined
-      return ['full', 'on-demand', 'host'].includes(entry.effective) ? entry.effective : undefined
+    // A control's own label names the address it writes, so a cell needs no neighbour
+    // to be read (§3.2). The address is the object's identity, not its display name:
+    // two rows can read alike, and only one of them is the record's key.
+    const controlLabel = (column, row) => t(`capabilities.control.${column}`, { name: row.id })
+    // The no-op test compares the record's own word, not the resolved value: a record
+    // that wrote `automatic` and one that wrote the value it resolves to are different
+    // records, and the second can only replace the first if the write is allowed.
+    const writeSession = (row, dimension, value) => {
+      if ((recordWord(row, dimension) ?? 'inherit') === value) return
+      // The promise is the write: a batch awaits it so each command composes from the record
+      // the previous one left, and nothing is fired in parallel.
+      return record(commands, `set session ${encodeURIComponent(row.id)} ${dimension} ${value}`, row.id)
     }
-    const stateText = value => value === undefined ? t('capabilities.quick.unknown') : statusLabel(value)
-    const dimensionCurrent = (entry, dimension) => choices[entry.id]?.[dimension] ?? storedDimension(entry, dimension) ?? 'inherit'
-    const dimensionImpact = (entry, dimension) => {
-      const draft = choices[entry.id]?.[dimension]
-      const choice = draft ?? storedDimension(entry, dimension) ?? 'inherit'
-      const stagedChange = draft !== undefined
-      if (choice === 'inherit') return { state: frozenDimension(entry, dimension), origin: 'capabilities.quick.originPlan', staged: stagedChange }
-      if (choice === 'automatic') return { upper: true, staged: stagedChange }
-      return { state: choice, origin: 'capabilities.quick.originSession', staged: stagedChange }
+    const writeSaved = (row, dimension, value) => {
+      if (savedOf(row, dimension) === value) return
+      if (typeof savedCommands?.run !== 'function') return
+      return perform(row.id, async signal => {
+        const written = await savedCommands.run({ id: row.id, dimension, selection: value }, signal)
+        return { text: capabilityReceiptNotice(t, { state: 'recorded', record: { ...written, scope: 'global' } }, 'receipt') }
+      })
     }
-    const impactLine = impact => impact.upper
-      ? t(impact.staged ? 'capabilities.quick.impactUpperPending' : 'capabilities.quick.impactUpper')
-      : t(impact.staged ? 'capabilities.quick.impactPending' : 'capabilities.quick.impact',
-        { state: stateText(impact.state), source: t(impact.origin) })
-    const dimensionOptions = (entry, dimension) => {
-      const restore = stateText(frozenDimension(entry, dimension))
-      const inherit = storedDimension(entry, dimension) === undefined
-        ? t('capabilities.quick.noChange', { state: restore })
-        : t('capabilities.quick.undoTemp', { state: restore })
-      // "Let the level above decide" only differs from "no change" while the
-      // session's frozen source still carries an explicit rule for the dimension.
-      const sourceDimension = entry.sourceRule?.[dimension]
-      const distinctRule = sourceDimension !== undefined && sourceDimension !== 'automatic'
-      return ['inherit', ...(distinctRule || dimensionCurrent(entry, dimension) === 'automatic' ? ['automatic'] : []),
-        ...(dimension === 'availability' ? ['enabled', 'closed'] : CAPABILITY_DISCLOSURES)]
-        .map(choice => ({ value: choice, label: choice === 'inherit' ? inherit
-          : choice === 'automatic' ? t('capabilities.quick.upperRule')
-            : t(choice === 'enabled' ? 'capabilities.action.enable' : choice === 'closed' ? 'capabilities.action.close' : `capabilities.${choice}`) }))
+    // A damaged record still gets a control: the click writes the record that replaces
+    // it, which is the only way the row can leave that state.
+    const writeAdoption = row => void record(bindingCommands,
+      `${adoptionOf(row) === 'use' ? 'skip' : 'use'} ${row.id}`, row.id)
+    // The session column's own word, as one stable token per state. The row and the cell
+    // both state it, so availability is read from a stripe and a mark before the word is
+    // read: `enabled` and `closed` are the two answers no reader should have to decode from
+    // identical text, and `inherit` must not read as a decision this session made. What those
+    // words resolve to at runtime stays off the page: a category or `mcpServers.<server>` rule
+    // answers a member whose own entry wrote nothing, a closed server answers over a member's
+    // own `enabled`, and a paused capability switch stops applying the saved document — none of
+    // those resolutions is a word these two columns hold (capability-surface §8.1b/§8.1c), so
+    // none of them becomes this row's colour or a second state token.
+    const sessionStateOf = row => row.kind === 'binding'
+      ? adoptionOf(row)
+      : (recordedOf(row, 'availability') ?? 'inherit')
+    const sessionAvailabilityCell = row => row.kind === 'binding'
+      ? h('div', { className: 'ptcPlusSessionCapabilityAvailability', 'data-state': sessionStateOf(row) },
+        h('span', { className: 'ptcPlusSessionStateMark', 'data-state': sessionStateOf(row), 'aria-hidden': true }),
+        h('button', { type: 'button', className: 'ptcPlusBindingToggle', 'data-kind': adoptionOf(row),
+          'aria-pressed': adoptionOf(row) === 'use' ? 'true' : 'false',
+          'aria-label': controlLabel('sessionEnabled', row),
+          'aria-busy': writing.includes(row.id) ? 'true' : undefined,
+          onClick: () => writeAdoption(row) }, t(ADOPTION_WORDS[adoptionOf(row)])))
+      : h('div', { className: 'ptcPlusSessionCapabilityAvailability', 'data-state': sessionStateOf(row) },
+        h('span', { className: 'ptcPlusSessionStateMark', 'data-state': sessionStateOf(row), 'aria-hidden': true }),
+        h(Select, { label: controlLabel('sessionEnabled', row), value: recordedOf(row, 'availability'),
+          options: choiceOptions(SESSION_AVAILABILITY),
+          onChange: value => writeSession(row, 'availability', value) }))
+    const sessionDisclosureCell = row => row.kind === 'binding'
+      // A binding's adoption record holds no disclosure decision at all, so the cell
+      // states that address's own word instead of borrowing the one a service row owns.
+      ? h('span', { className: 'ptcPlusSessionCapabilityDisclosure', 'data-state': 'inherit' },
+        t('capabilities.word.inherit'))
+      : row.kind === 'server'
+        // A server carries no disclosure of its own: its members do.
+        ? h('span', { className: 'ptcPlusSessionCapabilityDisclosure', 'data-state': 'per-member' },
+          t('capabilities.word.perMember'))
+      : h('div', { className: 'ptcPlusSessionCapabilityDisclosure',
+        'data-state': recordedOf(row, 'disclosure') ?? 'inherit' },
+        h(Select, { label: controlLabel('sessionDisclosure', row), value: recordedOf(row, 'disclosure'),
+          options: choiceOptions(SESSION_DISCLOSURE),
+          onChange: value => writeSession(row, 'disclosure', value) }))
+    // A control exists exactly when this entrance fixes the address the cell writes: the settings
+    // entrance writes the saved document, so every row it states gets the controls its own address
+    // holds — both dimensions for a capability, availability alone for a server, whose saved cell
+    // edits `mcpServers.<server>` in that same document. Read-only disables, never withdraws.
+    const savedControl = row => settingsEntrance
+    const savedDisabled = () => writable === false
+    // The saved column states the word its own record wrote, and that word is what this column
+    // makes readable: `enabled`/`closed` take the success and error colours and `automatic` the
+    // business colour, so the entrance that fixes the saved document shows at a glance which
+    // objects it switched off — the entrance that has no session column included. The colour
+    // states this column's own word only; it does not claim the answer a row gets here, because
+    // the saved entry is one layer of a resolution this page does not compute (§8.1b/§8.1c).
+    // The saved disclosure cell states one of five disclosure words and carries no state token:
+    // no rule colours it, and a token no selector or case observes states nothing.
+    const savedState = row => ({ 'data-state': savedOf(row, 'availability') })
+    const savedEnabledCell = row => savedControl(row)
+      ? h('div', { className: 'ptcPlusSessionCapabilitySaved', ...savedState(row) },
+        h(Select, { label: controlLabel('savedEnabled', row), value: savedOf(row, 'availability'),
+          disabled: savedDisabled(), options: choiceOptions(SAVED_AVAILABILITY),
+          onChange: value => writeSaved(row, 'availability', value) }))
+      : h('span', { className: 'ptcPlusSessionCapabilitySaved', ...savedState(row) }, savedEnabled(row))
+    const savedDisclosureCell = row => savedControl(row) && row.kind !== 'server'
+      // A server carries no disclosure of its own, so its saved disclosure cell is the statement
+      // that the members decide it; its availability cell is the rule edit below.
+      ? h('div', { className: 'ptcPlusSessionCapabilitySavedDisclosure' },
+        h(Select, { label: controlLabel('savedDisclosure', row), value: savedOf(row, 'disclosure'),
+          disabled: savedDisabled(), options: choiceOptions(SAVED_DISCLOSURE),
+          onChange: value => writeSaved(row, 'disclosure', value) }))
+      : h('span', { className: 'ptcPlusSessionCapabilitySavedDisclosure' }, savedDisclosure(row))
+    // Every cell states one clipped line and keeps its full text as the title, so no row grows
+    // with the length of its words. A display name that differs from the id is the one remaining
+    // difference between two rows: it adds the id line below the name.
+    const identityName = row => h('span', { className: 'ptcPlusSessionCapabilityName',
+      title: row.name ?? row.id }, row.name ?? row.id)
+    const identityId = row => row.name && row.name !== row.id
+      ? h('code', { title: row.id }, row.id) : null
+    const identityCell = row => row.kind === 'binding'
+      ? h('span', { className: 'ptcPlusCapabilityIdentity' },
+        h('span', { className: 'ptcPlusCapabilityIdentityText' }, identityName(row), identityId(row)))
+      : h('div', { className: 'ptcPlusCapabilityIdentity' },
+        // Only a capability row takes part in a batch: a server row's saved cell edits the scope's
+        // `mcpServers.<server>` rule on its own, and a binding row writes the bindings document.
+        row.kind !== 'capability' ? null : h('input', { type: 'checkbox', className: 'ptcPlusPick', checked: picked.includes(row.id),
+          'aria-label': t('capabilities.selectForBatch', { name: row.name ?? row.id }),
+          disabled: writable === false,
+          onChange: () => setPicked(current => current.includes(row.id)
+            ? current.filter(id => id !== row.id) : [...current, row.id]) }),
+        h('div', { className: 'ptcPlusCapabilityIdentityText' }, identityName(row), identityId(row)))
+    const cellsOf = row => {
+      const cells = {
+        object: identityCell(row),
+        type: h('span', { className: 'ptcPlusCapabilityBadge', 'data-kind': badgeOf(row) }, t(`capabilities.type.${badgeOf(row)}`)),
+        source: h('span', { className: 'ptcPlusCapabilitySource', title: sourceText(row) }, sourceText(row)),
+        savedEnabled: savedEnabledCell(row),
+        savedDisclosure: savedDisclosureCell(row),
+        sessionEnabled: sessionAvailabilityCell(row),
+        sessionDisclosure: sessionDisclosureCell(row),
+        receipt: h('span', { className: 'ptcPlusSessionCapabilityReceipt', title: receiptOf(row) }, receiptOf(row)),
+      }
+      return cells
+    }
+    const columns = COLUMNS[settingsEntrance ? 'settings' : 'session']
+    // What the reader compares in a column is the word that column shows: a translated
+    // badge, a source label, a record's own word. Sorting therefore reads this page's
+    // display values instead of the fields they were derived from.
+    const sortValue = (row, column) => column === 'object' ? (row.name ?? row.id)
+      : column === 'type' ? t(`capabilities.type.${badgeOf(row)}`)
+        : column === 'source' ? sourceText(row)
+          : column === 'savedEnabled' ? savedEnabled(row)
+            : column === 'savedDisclosure' ? savedDisclosure(row)
+              : column === 'sessionEnabled' ? (row.kind === 'binding' ? t(ADOPTION_WORDS[adoptionOf(row)])
+                : word(recordedOf(row, 'availability')))
+                : column === 'sessionDisclosure' ? (row.kind === 'binding' ? t('capabilities.word.inherit')
+                  // A server states where the decision lives, not a disclosure of its own,
+                  // so that is the word this column shows and therefore the word it sorts by.
+                  : row.kind === 'server' ? t('capabilities.word.perMember')
+                    : word(recordedOf(row, 'disclosure')))
+                  : ''
+    // The receipt column states a whole sentence per row, so it offers no ordering: a
+    // reader sorting by the wording of a receipt would be sorting by prose.
+    const sortable = column => column !== 'receipt'
+    const renderRow = row => {
+      const cells = cellsOf(row)
+      return h('div', { key: row.id, role: 'row',
+        className: `ptcPlusSessionCapabilityRow ptcPlusCapabilityItem ptcPlusSessionCapabilityRow-${columns.length}`,
+        'data-capability-id': row.id, 'data-kind': row.kind,
+        'data-session-state': sessionStateOf(row),
+        ...(row.kind === 'binding' ? { 'data-binding-id': row.id, 'data-binding-state': adoptionOf(row) } : {}) },
+        ...columns.map(column => h(React.Fragment, { key: column }, React.cloneElement(cells[column], { role: 'cell' }))))
     }
-    const legacyFrozenState = entry => {
-      const stored = typeof entry.temporary === 'string' && !['inherit', 'automatic', 'unknown', 'pending'].includes(entry.temporary)
-      if (stored) return ['full', 'on-demand', 'closed'].includes(entry.sessionSourceSelection) ? entry.sessionSourceSelection : undefined
-      return ['full', 'on-demand', 'closed', 'host'].includes(entry.effective) ? entry.effective : undefined
+    const columnsRow = () => h('div', {
+      className: `ptcPlusSessionCapabilityColumns ptcPlusCapabilityColumns ptcPlusSessionCapabilityColumns-${columns.length}`,
+      role: 'row' }, ...columns.map(column => h('span', { key: column, role: 'columnheader',
+        'aria-sort': sortable(column) ? capabilitySortDirection(sort, column) : undefined },
+      sortable(column)
+        ? h('button', { type: 'button', className: 'ptcPlusCapabilitySort', title: t('capabilities.sortCycle'),
+          'aria-label': t('capabilities.sortColumn', { column: t(COLUMN_COPY[column]) }),
+          onClick: () => setSort(current => cycleCapabilitySort(current, column)) },
+        t(COLUMN_COPY[column]),
+        h('span', { className: 'ptcPlusCapabilitySortMark', 'aria-hidden': true },
+          capabilitySortDirection(sort, column) === 'ascending' ? '↑'
+            : capabilitySortDirection(sort, column) === 'descending' ? '↓' : '↕'))
+        : t(COLUMN_COPY[column]))))
+    const capabilities = rows.filter(row => row.kind !== 'binding')
+    const matches = row => {
+      const text = [row.name, row.id, sourceText(row)].filter(Boolean).join(' ').toLocaleLowerCase()
+      return text.includes(query.trim().toLocaleLowerCase())
     }
-    const choiceCurrent = entry => choices[entry.id] ?? entry.temporary ?? 'inherit'
-    const choiceImpact = entry => {
-      const draft = choices[entry.id]
-      const choice = draft ?? entry.temporary ?? 'inherit'
-      const stagedChange = draft !== undefined
-      if (choice === 'inherit') return { state: legacyFrozenState(entry), origin: 'capabilities.quick.originPlan', staged: stagedChange }
-      if (choice === 'automatic') return { upper: true, staged: stagedChange }
-      return { state: choice, origin: 'capabilities.quick.originSession', staged: stagedChange }
+    const listed = sortCapabilityEntries(capabilities.filter(row => (family === 'all' || familyOf(row) === family)
+      && (source === 'all' || sourceKeyOf(row) === source) && matches(row)), sort, sortValue)
+    const bindings = sortCapabilityEntries(rows.filter(row => row.kind === 'binding'), sort, sortValue)
+    const sources = new Map()
+    for (const row of capabilities) {
+      if (family !== 'all' && familyOf(row) !== family) continue
+      const key = sourceKeyOf(row)
+      if (!sources.has(key)) sources.set(key, sourceFilterLabel(row))
     }
-    const choiceOptions = selected ? [
-      'inherit', 'automatic',
-      ...(selected.category === 'server' ? [] : ['full', 'on-demand']), 'closed',
-    ].map(choice => ({ value: choice, label: choice === 'inherit'
-      ? t(selected.temporary !== undefined && selected.temporary !== 'inherit' ? 'capabilities.quick.undoChange' : 'capabilities.quick.keepUnchanged')
-      : choice === 'automatic' ? t('capabilities.quick.upperRule')
-        : t(`capabilities.${choice}`) })) : []
-    const dimensionFacts = dimensions => ['availability', 'disclosure'].map(dimension =>
-      `${t(`capabilities.policy.${dimension}`)}: ${statusLabel(dimensions[dimension])} (${dimensions[`${dimension}Source`] ?? t('capabilities.quick.unknown')})`).join(' · ')
-    // A dimension whose effective value comes from the session-only temporary
-    // choice is marked beside the frozen inheritance it replaces.
-    const temporaryDimension = (entry, dimension) => {
-      const rule = entry.temporaryRule !== null && typeof entry.temporaryRule === 'object' && !Array.isArray(entry.temporaryRule)
-        ? entry.temporaryRule : undefined
-      const override = rule?.[dimension]
-      if (override !== undefined && override !== 'automatic') return override
-      if (typeof entry.temporary === 'string' && !['inherit', 'automatic'].includes(entry.temporary)) {
-        return dimension === 'availability' ? (entry.temporary === 'closed' ? 'closed' : 'enabled') : entry.temporary
+    // A batch writes only a dimension this entrance shows a control for. The settings entrance
+    // fixes saved addresses and reads no session record, so what a session recorded decides
+    // nothing there; the session entrance writes the session address, and every capability row
+    // now carries both of its controls — a member's cell states its own record, so writing it
+    // always changes what the cell says.
+    const batchWritable = row => DIMENSIONS.filter(dimension => settingsEntrance
+      ? savedControl(row) && (dimension === 'availability' || row.kind === 'capability')
+      : dimension === 'availability' || row.kind === 'capability')
+    const pickedRows = capabilities.filter(row => picked.includes(row.id) && batchWritable(row).length > 0)
+    const batchLines = () => pickedRows.flatMap(row => batchWritable(row)
+      .filter(dimension => batchChoices[dimension] !== 'keep')
+      .map(dimension => ({ row, dimension, choice: batchChoices[dimension] })))
+    // A batch is the same decision applied to existing rows: it writes one record per
+    // selected row through the same channel and creates no rows of its own.
+    const applyBatch = async () => {
+      const lines = batchLines()
+      setBatchOpen(false)
+      // Every dimension kept its current setting, so this batch writes nothing. The
+      // click still owes the reader one sentence, and it is the footer's own receipt
+      // expression that states it: a zero-write batch names no record, so it states the
+      // batch's outcome instead of widening the command receipt vocabulary.
+      if (lines.length === 0) {
+        setReceipt({ text: { key: 'capabilities.batch.kept', params: {} } })
+        return
       }
-      return undefined
+      // One write at a time: each command composes the whole record from the log it reads, so
+      // overlapping commands would drop each other's decision. A refusal does not stop the
+      // remaining rows, and the batch states the first refusal after them instead of letting the
+      // next row's success sentence replace it.
+      let refusal, wrote = 0
+      for (const { row, dimension, choice } of lines) {
+        try {
+          const outcome = settingsEntrance
+            ? await writeSaved(row, dimension, choice)
+            : await writeSession(row, dimension, choice)
+          if (outcome?.error !== undefined) refusal ??= outcome.error
+          else if (outcome?.ok === true) wrote += 1
+        } catch (error) { refusal ??= String(error?.message ?? error) }
+      }
+      if (refusal !== undefined) setReceipt({ error: refusal })
+      // Every picked word already matched its record, so no command ran; the click still owes the
+      // reader one sentence rather than leaving the previous row's receipt standing.
+      else if (wrote === 0) setReceipt({ text: { key: 'capabilities.batch.kept', params: {} } })
     }
-    const dimensionCell = (entry, dimension, value) => temporaryDimension(entry, dimension) === value
-      ? t('capabilities.quick.temporaryState', { state: statusLabel(value) }) : statusLabel(value)
-    const openEditor = (entry, dimension = 'availability') => { setSelectedId(entry.id); setPane('detail'); setFocusDimension(dimension) }
-    const renderRow = entry => h('div', { key: entry.id, role: 'row',
-      className: 'ptcPlusSessionCapabilityRow ptcPlusCapabilityItem', 'data-capability-id': entry.id, 'data-selected': selected?.id === entry.id,
-      onClick: () => openEditor(entry) },
-      h('div', { role: 'cell', className: 'ptcPlusCapabilityIdentity' },
-        h('input', { type: 'checkbox', className: 'ptcPlusPick', checked: picked.includes(entry.id), disabled: writesBlocked,
-          'aria-label': t('capabilities.selectForBatch', { name: entry.name ?? entry.id }),
-          onClick: event => event.stopPropagation(), onChange: () => togglePick(entry.id) }),
-        h('div', { className: 'ptcPlusCapabilityIdentityText' },
-          h('button', { type: 'button', className: 'ptcPlusSessionCapabilityName ptcPlusCapabilityName',
-            'aria-current': selected?.id === entry.id ? 'true' : undefined,
-            onClick: event => { event.stopPropagation(); openEditor(entry) } }, entry.name ?? entry.id),
-          entry.name && entry.name !== entry.id ? h('code', null, entry.id) : null)),
-      h('span', { role: 'cell', className: 'ptcPlusCapabilityBadge', 'data-kind': type(entry) }, t(`capabilities.type.${type(entry)}`)),
-      h('span', { role: 'cell', className: 'ptcPlusCapabilitySource' }, displayedSource(entry)),
-      h('div', { role: 'cell', className: 'ptcPlusCapabilityAvailability', 'data-state': effectiveAvailability(entry) },
-        h('button', { type: 'button', className: 'ptcPlusCapabilityContext',
-          'aria-label': t('capabilities.policy.availabilityFor', { name: entry.id }),
-          title: t('capabilities.quick.effective'),
-          onClick: event => { event.stopPropagation(); openEditor(entry, 'availability') } }, dimensionCell(entry, 'availability', effectiveAvailability(entry)))),
-      h('div', { role: 'cell', className: 'ptcPlusCapabilityContextCell' },
-        h('button', { type: 'button', className: 'ptcPlusCapabilityContext',
-          'aria-label': t('capabilities.editContextFor', { name: entry.id }),
-          title: t('capabilities.quick.effective'),
-          onClick: event => { event.stopPropagation(); openEditor(entry, 'disclosure') } }, dimensionCell(entry, 'disclosure', effectiveContext(entry)))),
-      h('span', { role: 'cell', className: 'ptcPlusSessionCapabilityPending', 'data-changed': Object.hasOwn(choices, entry.id),
-        'data-label': t('capabilities.quick.changed') },
-        Object.hasOwn(choices, entry.id) ? statusLabel(choices[entry.id]) : '—'))
-    return h(Modal, { open, onClose: close, title: t('capabilities.quick.modalTitle'),
-      closeLabel: t('settings.close'), headless: true, className: 'ptcPlusSessionCapabilityModal' },
-    h('div', { className: 'ptcPlusSessionCapabilityHead' },
-      h('div', null, h('h2', null, t('capabilities.quick.modalTitle')),
-        h('p', null, t('capabilities.quick.sessionIdentity', { session: sessionId }))),
-      h('button', { type: 'button', className: 'ptcPlusDialogClose', 'aria-label': t('settings.close'), disabled: pending, onClick: close }, '×')),
-    h('div', { className: 'ptcPlusSessionCapabilityToolbar' },
-      h('label', { className: 'ptcPlusSearch' },
-        h('svg', { viewBox: '0 0 24 24', width: 16, height: 16, 'aria-hidden': true },
-          h('circle', { cx: 10, cy: 10, r: 6, fill: 'none', stroke: 'currentColor', strokeWidth: 2 }),
-          h('path', { d: 'm15 15 6 6', fill: 'none', stroke: 'currentColor', strokeWidth: 2 })),
-        h('input', { type: 'search', value: query, 'aria-label': t('capabilities.search'),
-          placeholder: t('capabilities.search'), onChange: event => setQuery(event.target.value) })),
-      filter(t('capabilities.quick.kind'), kind, setCompatibleKind,
-        ['all', 'tools', 'skills', 'mcp', 'mcp_tools'].map(key => [key, t(`capabilities.quick.${key}`)])),
-      filter(t('capabilities.sourceFilter'), sourceFilter, setCompatibleSource,
-        [['all', t('capabilities.allSources')], ...sources.map(key => [key,
-          sourceLabel(catalog.find(entry => sourceKey(entry) === key))])]),
-      filter(t('capabilities.quick.state'), stateFilter, setStateFilter,
-        [['all', t('capabilities.quick.allStates')], ['changed', t('capabilities.quick.changed')],
-          ...['full', 'on-demand', 'closed', 'pending'].map(key => [key, statusLabel(key)])])),
-    // A blocked workbench states why writes are off and how to restore them; the banner styling
-    // keeps that condition from reading as an incidental list message.
-    writesBlocked ? h('p', { className: 'ptcPlusCapabilityNotice ptcPlusCapabilityBlocked', role: 'status' },
-      h('svg', { className: 'ptcPlusCapabilityBlockedIcon', viewBox: '0 0 16 16', width: 14, height: 14,
-        'aria-hidden': true, fill: 'none' },
-        h('path', { d: 'M8 2.3 14.7 13.5H1.3L8 2.3Z', stroke: 'currentColor', strokeWidth: 1.3, strokeLinejoin: 'round' }),
-        h('path', { d: 'M8 6.4v3M8 11.2v.7', stroke: 'currentColor', strokeWidth: 1.3, strokeLinecap: 'round' })),
-      t(management === 'paused' ? 'capabilities.quick.sessionPaused'
-        : management === 'off' ? 'capabilities.quick.sessionManagementOff'
-          : savedSettings?.contextEnabled === false ? 'capabilities.quick.savedPaused'
-            : 'capabilities.quick.savedManagementOff')) : null,
-    h('div', { className: 'ptcPlusSessionCapabilityWorkspace', 'data-pane': pane },
-      h('div', { className: 'ptcPlusSessionCapabilityList', role: 'table', 'aria-label': t('capabilities.quick.members'), ref: list },
-        h('div', { className: 'ptcPlusSessionCapabilityColumns ptcPlusCapabilityColumns', role: 'row' },
-          ...CAPABILITY_SORT_COLUMNS.map(column => h('span', { key: column.key, role: 'columnheader',
-            'aria-sort': capabilitySortDirection(sort, column.key),
-            ...(column.key === 'name' ? { 'aria-label': t('capabilities.member'), className: 'ptcPlusCapabilityPickHead' } : {}) },
-            ...(column.key === 'name' ? [h('input', { type: 'checkbox', className: 'ptcPlusPick', checked: allMatchesPicked,
-              ref: node => { if (node) node.indeterminate = someMatchesPicked && !allMatchesPicked },
-              disabled: writesBlocked || matches.length === 0, 'aria-label': t('capabilities.selectAllVisible'),
-              onChange: toggleAllMatches })] : []),
-            h('button', { type: 'button', className: 'ptcPlusCapabilitySort', title: t('capabilities.sortCycle'),
-              onClick: () => setSort(current => cycleCapabilitySort(current, column.key)) },
-            t(`capabilities.${column.label}`), h('span', { 'aria-hidden': true },
-              capabilitySortDirection(sort, column.key) === 'ascending' ? '↑' : capabilitySortDirection(sort, column.key) === 'descending' ? '↓' : '↕')))),
-          h('span', { role: 'columnheader' }, t('capabilities.quick.changed'))),
-        loading ? h('p', { role: 'status' }, t('state.syncing')) : null,
-        error ? h('p', { role: 'alert' }, t('capabilities.quick.catalogError', { error })) : null,
-        !loading && !error && matches.length === 0 ? h('p', null, t('capabilities.noMatches')) : null,
-        ...(sort ? [h('div', { key: 'sorted', role: 'rowgroup' }, ...matches.map(renderRow))]
-          : groups.filter(group => matches.some(entry => category(entry) === group))
-          .map(group => h('section', { key: group, className: 'ptcPlusSessionCapabilityGroup' },
-            h('h3', null, t(`capabilities.quick.${group}`)),
-            h('div', { role: 'rowgroup' }, ...matches.filter(entry => category(entry) === group).map(renderRow)))))),
-      h('aside', { className: 'ptcPlusSessionCapabilityDetail', 'aria-label': t('capabilities.details'), ref: detail },
-        h('button', { type: 'button', className: 'ptcPlusSessionCapabilityBack', onClick: () => { setPane('list'); setFocusDimension('list') } },
-          t('capabilities.quick.backToList')),
-        selected ? h(React.Fragment, null,
-          h('h3', null, selected.name ?? selected.id), h('code', null, selected.id),
-          selected.description ? h('p', null, selected.description) : null,
-          h('dl', null,
-            h('dt', null, t('capabilities.sourceFilter')), h('dd', null, sourceLabel(selected)),
-            h('dt', null, t('capabilities.quick.globalSaved')), h('dd', null, selected.savedRule ? ruleLabel(selected.savedRule) : statusLabel(selected.saved)),
-            h('dt', null, t('capabilities.quick.sessionSource')), h('dd', null, selected.sourceRule ? ruleLabel(selected.sourceRule) : statusLabel(selected.sessionSourceSelection ?? 'unknown')),
-            h('dt', null, t('capabilities.quick.temporary')), h('dd', null, selected.temporaryRule ? ruleLabel(selected.temporaryRule, 'capabilities.quick.noOverride') : statusLabel(selected.temporary)),
-            h('dt', null, t('capabilities.quick.effective')), h('dd', null, statusLabel(selected.effective)),
-            selected.sourceDimensions ? h(React.Fragment, null, h('dt', null, t('capabilities.policy.frozenSource')), h('dd', null, dimensionFacts(selected.sourceDimensions))) : null,
-            selected.effectiveDimensions ? h(React.Fragment, null, h('dt', null, t('capabilities.policy.effectiveDimensions')), h('dd', null, dimensionFacts(selected.effectiveDimensions))) : null),
-          h('div', { className: 'ptcPlusCapabilityProof', 'data-capability-proof': selected.id },
-            h('h4', null, t('capabilities.proof.title')),
-            proofs[selected.id]
-              ? h(React.Fragment, null,
-                h('p', { className: 'ptcPlusDetail', role: 'status' }, capabilityProofCopy(t, proofs[selected.id].proof)),
-                h('small', null, t('capabilities.proof.observed', { command: proofs[selected.id].command })))
-              : h('p', { className: 'ptcPlusDetail' }, t('capabilities.proof.unobserved'))),
-          selected.source?.kind === 'mcp' && selected.category !== 'server'
-            ? (() => {
-              const server = catalog.find(entry => entry.category === 'server' && entry.source?.server === selected.source.server)
-              if (!server) return null
-              const proposed = choiceFor(server)
-              const availability = server.savedRule ? choices[server.id]?.availability ?? server.temporaryRule?.availability ?? 'inherit' : proposed
-              const sourceAvailability = server.sourceRule !== undefined ? server.sourceRule.availability : server.sessionSourceSelection
-              const pendingClose = server.managementEnabled !== false && (availability === 'inherit' ? sourceAvailability : availability) === 'closed'
-              const currentlyClosed = server.enclosingClosure ?? server.effective === 'closed'
-              const key = currentlyClosed ? 'capabilities.quick.disabledByServer'
-                : pendingClose ? 'capabilities.quick.pendingServerClose' : null
-              return key ? h('p', { className: 'ptcPlusCapabilityNotice' }, t(key, { server: selected.source.server })) : null
-            })() : null,
-          selected.category === 'server' ? h('div', { className: 'ptcPlusSessionCapabilityChildren' },
-            h('h4', null, t('capabilities.quick.serverTools')),
-            h('ul', null, ...catalog.filter(entry => entry.id !== selected.id
-              && entry.source?.kind === 'mcp' && entry.source.server === selected.source?.server)
-              .map(entry => h('li', { key: entry.id }, entry.name ?? entry.id)))) : null,
-          selected.savedRule ? h(React.Fragment, null, ...['availability', 'disclosure'].map(dimension => h(React.Fragment, { key: dimension },
-            h('div', { className: 'ptcPlusCapabilityFilter', 'data-capability-dimension': dimension },
-              h('span', null, t(`capabilities.policy.${dimension}`)),
-              h(Select, { label: t(`capabilities.policy.${dimension}`), disabled: !enabled || !available || pending || writesBlocked,
-                value: dimensionCurrent(selected, dimension),
-                onChange: next => chooseDimension(selected.id, dimension, next),
-                options: dimensionOptions(selected, dimension) })),
-            h('p', { className: 'ptcPlusDetail ptcPlusCapabilityImpact', 'data-impact-dimension': dimension },
-              impactLine(dimensionImpact(selected, dimension))))))
-            : h(React.Fragment, null,
-              h('div', { className: 'ptcPlusCapabilityFilter' },
-                h('span', null, t('capabilities.quick.choice')),
-                h(Select, { label: t('capabilities.quick.choice'), value: choiceCurrent(selected),
-                  disabled: !enabled || !available || pending || writesBlocked, options: choiceOptions,
-                  onChange: next => choose(selected.id, next) })),
-              h('p', { className: 'ptcPlusDetail ptcPlusCapabilityImpact', 'data-impact-dimension': 'selection' },
-                impactLine(choiceImpact(selected)))),
-          (typeof choices[selected.id] === 'string' ? choices[selected.id] === 'inherit'
-            : Object.values(choices[selected.id] ?? {}).includes('inherit')) ? h('p', { className: 'ptcPlusDetail' },
-            t('capabilities.quick.inheritSessionOnly')) : null) : h('p', null, t('capabilities.noMatches')))),
-    batchOpen ? h(Modal, { open: true, onClose: () => setBatchOpen(false), title: t('capabilities.batchSettings'),
-      closeLabel: t('capabilities.batch.cancel'), headless: true, className: 'ptcPlusCapabilityBatchModal' },
-      h('div', { className: 'ptcPlusCapabilityBatchHead' }, h('h2', null, t('capabilities.batchSettings')),
-        h('button', { type: 'button', className: 'ptcPlusDialogClose', 'aria-label': t('capabilities.batch.cancel'),
-          onClick: () => setBatchOpen(false) }, '\u00d7')),
-      h('div', { className: 'ptcPlusCapabilityBatchBody' },
-        h('p', { className: 'ptcPlusDetail', role: 'status' }, t('capabilities.batch.selected', { count: pickedRows.length })),
-        h('ul', { className: 'ptcPlusCapabilityBatchTargets', 'aria-label': t('capabilities.batch.targetList') },
-          ...pickedRows.map(entry => h('li', { key: entry.id }, h('span', null, entry.name ?? entry.id), h('code', null, entry.id)))),
-        h('div', { className: 'ptcPlusCapabilityBatchFields' }, ...['availability', 'disclosure'].map(dimension =>
-          h('div', { key: dimension, className: 'ptcPlusCapabilityFilter' }, h('span', null, t(`capabilities.policy.${dimension}`)),
-            h(Select, { value: batchChoices[dimension], label: t(`capabilities.batch.${dimension}`),
-              onChange: choice => setBatchChoices(current => ({ ...current, [dimension]: choice })),
-              options: ['keep', 'inherit', ...(dimension === 'availability' ? ['enabled', 'closed'] : CAPABILITY_DISCLOSURES)]
-                .map(choice => ({ value: choice, label: choice === 'keep' ? t('capabilities.batch.keep')
-                  : choice === 'inherit' ? t('capabilities.batch.sessionInherit')
-                    : choice === 'enabled' ? t('capabilities.action.enable')
-                      : choice === 'closed' ? t('capabilities.action.close') : t(`capabilities.${choice}`) })) })))),
-        h('p', { className: 'ptcPlusDetail' }, t('capabilities.batch.sessionStage'))),
-      h('div', { className: 'ptcPlusCapabilityBatchFooter' },
-        h('button', { type: 'button', className: 'ptcPlusButton', onClick: () => setBatchOpen(false) }, t('capabilities.batch.cancel')),
-        h('button', { type: 'button', className: 'ptcPlusButton', 'data-kind': 'primary',
-          disabled: pickedRows.length === 0 || !['availability', 'disclosure'].some(dimension => batchChoices[dimension] !== 'keep'),
-          onClick: () => { stageBatch(pickedRows.map(entry => entry.id), batchChoices); setBatchOpen(false) } },
-          t('capabilities.batch.stage', { count: pickedRows.length })))) : null,
-    h('div', { className: 'ptcPlusSessionCapabilityFooter' },
-      h('span', { role: 'status' }, pending ? t('capabilities.quick.applying') : status ? t(status.key, status.params)
-        : t('capabilities.quick.changes', { count: staged.length })),
-      h('button', { type: 'button', className: 'ptcPlusButton', disabled: pending || staged.length === 0, onClick: discard },
-        t('capabilities.quick.discard')),
-      // Session-scoped temporary application stays the footer's primary action; saving global
-      // defaults is an explicit secondary choice, so no default-looking control changes global state.
-      h('button', { type: 'button', className: 'ptcPlusButton', 'data-kind': 'primary', title: t('capabilities.quick.sessionHint'),
-        disabled: pending || !enabled || !available || writesBlocked || staged.length === 0, onClick: () => void apply('session') },
-        t('capabilities.quick.applySession')),
-      h('button', { type: 'button', className: 'ptcPlusButton',
-        title: t(hasInheritanceReset ? 'capabilities.quick.inheritSessionOnly' : 'capabilities.quick.globalHint'),
-        disabled: pending || !enabled || !available || writesBlocked || staged.length === 0 || hasInheritanceReset,
-        onClick: () => void apply('global') },
-        t('capabilities.quick.applyGlobal')),
-      h('button', { type: 'button', className: 'ptcPlusButton', 'aria-haspopup': 'dialog',
-        'aria-label': t('capabilities.batchSettings'),
-        disabled: pending || writesBlocked || picked.length === 0,
-        onClick: () => { setBatchChoices({ availability: 'keep', disclosure: 'keep' }); setBatchOpen(true) } },
-        t('capabilities.batchSettings'),
-        picked.length ? h('span', { className: 'ptcPlusCapabilityBatchCount', 'aria-hidden': true,
-          title: t('capabilities.selectionCount', { count: picked.length }) },
-          String(picked.length)) : null)))
+    const filter = (label, value, onChange, options) => h('div', { className: 'ptcPlusCapabilityFilter' },
+      h('span', null, label), h(Select, { label, value, onChange,
+        options: options.map(([key, text]) => ({ value: key, label: text })) }))
+    // The two filters narrow the same list, so a value that no longer matches the
+    // other dimension is withdrawn instead of silently emptying the table.
+    const chooseFamily = next => {
+      setFamily(next)
+      if (source !== 'all'
+        && !capabilities.some(row => (next === 'all' || familyOf(row) === next) && sourceKeyOf(row) === source)) setSource('all')
+    }
+    const chooseSource = next => {
+      setSource(next)
+      if (next !== 'all'
+        && !capabilities.some(row => (family === 'all' || familyOf(row) === family) && sourceKeyOf(row) === next)) setFamily('all')
+    }
+    const close = () => {
+      request.current?.abort()
+      request.current = null
+      onClose?.()
+    }
+    // §3.3: a page reports its own address set, so a missing receipt is read against the
+    // record it belongs to instead of against an unnamed blank.
+    const addressSet = settingsEntrance ? t('capabilities.surface.addresses.settings')
+      : t('capabilities.surface.addresses.session', { session: sessionId })
+    const table = h('div', { role: 'table',
+      'aria-label': t(settingsEntrance ? 'capabilities.surface.settingsTitle' : 'capabilities.quick.members') },
+      columnsRow(),
+      loaded && listed.length === 0 ? h('p', { className: 'ptcPlusSessionCapabilityMessage' },
+        t(capabilities.length === 0 ? 'capabilities.quick.supplyEmpty' : 'capabilities.noMatches')) : null,
+      ...listed.map(renderRow))
+    const body = [
+      h('div', { key: 'head', className: 'ptcPlusSessionCapabilityHead' },
+        h('div', null,
+          h('h2', null, t(settingsEntrance ? 'capabilities.surface.settingsTitle' : 'capabilities.quick.modalTitle')),
+          h('p', { className: 'ptcPlusSessionCapabilityAddresses' }, addressSet)),
+        inline === true ? null : h('button', { type: 'button', className: 'ptcPlusDialogClose',
+          'aria-label': t('settings.close'), onClick: close }, '\u00d7')),
+      h('div', { key: 'toolbar', className: 'ptcPlusSessionCapabilityToolbar' },
+        h('label', { className: 'ptcPlusSearch' },
+          h('svg', { viewBox: '0 0 24 24', width: 16, height: 16, 'aria-hidden': true },
+            h('circle', { cx: 10, cy: 10, r: 6, fill: 'none', stroke: 'currentColor', strokeWidth: 2 }),
+            h('path', { d: 'm15 15 6 6', fill: 'none', stroke: 'currentColor', strokeWidth: 2 })),
+          h('input', { type: 'search', value: query, 'aria-label': t('capabilities.search'),
+            placeholder: t('capabilities.search'), onChange: event => setQuery(event.target.value) })),
+        filter(t('capabilities.quick.kind'), family, chooseFamily,
+          [['all', t('capabilities.quick.all')], ...FAMILIES.map(key => [key, t(`capabilities.quick.${key}`)])]),
+        filter(t('capabilities.sourceFilter'), source, chooseSource,
+          [['all', t('capabilities.allSources')], ...[...sources].sort(([a], [b]) => compare(a, b))]),
+        h('button', { type: 'button', className: 'ptcPlusButton', 'aria-haspopup': 'dialog',
+          'aria-label': t('capabilities.batchSettings'), disabled: writable === false,
+          onClick: () => { setBatchChoices({ availability: 'keep', disclosure: 'keep' }); setBatchOpen(true) } },
+          t('capabilities.batchSettings'),
+          picked.length ? h('span', { className: 'ptcPlusCapabilityBatchCount', 'aria-hidden': true },
+            String(picked.length)) : null)),
+      // A read that failed is a defect in the panel's own source, so it names the error
+      // and offers the retry beside the rows it could not replace.
+      defect === null ? null : h('p', { key: 'defect', className: 'ptcPlusSessionCapabilityMessage', role: 'status' },
+        t('capabilities.quick.catalogError', { error: defect }), ' ',
+        h('button', { type: 'button', className: 'ptcPlusCapabilityLink', onClick: reload }, t('capabilities.reloadCatalog'))),
+      h('div', { key: 'list', className: 'ptcPlusSessionCapabilityList' },
+        h('div', { className: 'ptcPlusSessionCapabilityTable' }, table),
+        // The group is present whenever this entrance states the binding document: the
+        // Host supplies it whether or not this session has used any of it, and a
+        // zero-row group is an empty table.
+        settingsEntrance ? null
+          : h('section', { key: 'bindings', className: 'ptcPlusSessionCapabilityGroup ptcPlusBindingGroup' },
+            h('h3', null, t('bindings.title')),
+            h('div', { className: 'ptcPlusBindingTable', role: 'table', 'aria-label': t('bindings.title') },
+              columnsRow(),
+              ...bindings.map(renderRow)))),
+      batchOpen ? h(Modal, { key: 'batch', open: true, onClose: () => setBatchOpen(false),
+        title: t('capabilities.batchSettings'), closeLabel: t('capabilities.batch.cancel'), headless: true,
+        className: 'ptcPlusCapabilityBatchModal' },
+        h('div', { className: 'ptcPlusCapabilityBatchHead' }, h('h2', null, t('capabilities.batchSettings')),
+          h('button', { type: 'button', className: 'ptcPlusDialogClose', 'aria-label': t('capabilities.batch.cancel'),
+            onClick: () => setBatchOpen(false) }, '\u00d7')),
+        h('div', { className: 'ptcPlusCapabilityBatchBody' },
+          h('p', { className: 'ptcPlusDetail', role: 'status' }, t('capabilities.batch.selected', { count: pickedRows.length })),
+          h('ul', { className: 'ptcPlusCapabilityBatchTargets', 'aria-label': t('capabilities.batch.targetList') },
+            ...pickedRows.map(row => h('li', { key: row.id }, h('span', null, row.name ?? row.id), h('code', null, row.id)))),
+          h('div', { className: 'ptcPlusCapabilityBatchFields' }, ...DIMENSIONS.map(dimension => {
+            const address = t(settingsEntrance ? 'capabilities.batch.address.saved' : 'capabilities.batch.address.session')
+            const label = `${address} · ${dimensionWord(dimension)}`
+            return h('div', { key: dimension, className: 'ptcPlusCapabilityFilter' }, h('span', null, label),
+              h(Select, { value: batchChoices[dimension], label,
+                onChange: choice => setBatchChoices(current => ({ ...current, [dimension]: choice })),
+                // Each entrance offers the words its own address can hold: the session batch offers
+                // the record's words plus `inherit`, the saved batch offers `automatic`.
+                options: [{ value: 'keep', label: t('capabilities.batch.keep') },
+                  ...choiceOptions(dimension === 'availability'
+                    ? (settingsEntrance ? SAVED_AVAILABILITY : SESSION_AVAILABILITY)
+                    : (settingsEntrance ? SAVED_DISCLOSURE : SESSION_DISCLOSURE))] }))
+          })),
+          h('p', { className: 'ptcPlusDetail' },
+            t(settingsEntrance ? 'capabilities.batch.effect' : 'capabilities.batch.effectSession'))),
+        h('div', { className: 'ptcPlusCapabilityBatchFooter' },
+          h('button', { type: 'button', className: 'ptcPlusButton', onClick: () => setBatchOpen(false) },
+            t('capabilities.batch.cancel')),
+          h('button', { type: 'button', className: 'ptcPlusButton', 'data-kind': 'primary',
+            disabled: writable === false, onClick: () => void applyBatch() },
+            t('capabilities.batch.record', { count: batchLines().length })))) : null,
+      h('div', { key: 'footer', className: 'ptcPlusSessionCapabilityFooter' },
+        // The footer states the same receipt the chat card does, in the current
+        // language: which record this write named, its choice and its session. The raw
+        // payload stays in the command's own result, where history keeps it.
+        receipt === null ? null : h('span', { role: 'status' }, receipt.error === undefined
+          ? capabilityCommandText(t, receipt.text)
+          : t('capabilities.quick.writeError', { error: receipt.error }))),
+    ]
+    return inline === true
+      ? h('div', { className: 'ptcPlusCapabilitySurface ptcPlusCapabilitySurface-inline' }, ...body)
+      : h(Modal, { open, onClose: close, title: t('capabilities.quick.modalTitle'),
+        closeLabel: t('settings.close'), headless: true, className: 'ptcPlusSessionCapabilityModal' }, ...body)
   }
 }