Composition notes

• Question: what can agents do, and what do they actually call? Can is the table of every tool with what it belongs to and whether it is allowlisted; do is calls, agents, people, the called-vs-never pair in the band, and the sessions on record.
• Verdict line from toolsVerdict(world) (derived/tools.ts, sharpening verdicts.tools): it separates calls outside the allowlist that went through (attention debt — the unreviewed browser server) from calls outside it that were denied (a receipt — policy working). The all-clear state keeps the amber by the Stage-1 ruling, and says "policy working" so the color is honest.
• Framing band = four claims as filter buttons (Phase1StatBlock button): tools (reset), called in 30d ("n of 36" — can vs do), never called (quiet; names them), and the one attention device: calls outside the allowlist that went through, as the big number, with the tools it names and the denial count ("policy working") as the sub — the debt is the value, the receipt is the sub. At zero it reads clear. The kind mix is a three-segment bar in structural greys whose legend filters by kind; both filters compose and cross-foot with the visible rows, including under ?mcp=.
• Table is the raw UxTableList family so ?id= can pre-open a row. Rows from toolRows(world, { mcpId }), pre-ranked: outside-the-allowlist-and-went-through → denied > 0 → calls desc (a deliberate deviation from "denied first": Bash's prompt-declines are policy working quietly; the browser tools are the debt). Fifteen rows by default — the rank puts everything that matters in them — with "show all n" in the table's footer row; ?id= lifts the cap when the row it opens is past it. MCP tools print as server.name. Search rides the Tool header. Belongs-to is a chip: MCP server (filters here as ?mcp=), skill (→ Skills), or the harness technologies that call a builtin (→ Inventory). Denied prints its decision source; Allowlisted is the quiet column — grey yes, plain "not allowlisted", amber only on the rows whose outside-allowlist calls went through — and links to the policy page rather than rebuilding it.
• Last call is not a column: only skill tools carry it at tool grain, mcp tools have the server's last call, builtins only what the four event-grain sessions show. The expand prints it with its grain named instead of mixing grains in one column.
• Expand = three UxTableListExpandSection cards (the inventory exemplar's idiom): header with the derived story note, callers (agent chips → Agent detail, person chips → User detail), on record (event-grain sessions where a tool_call matched by kind + name + server → Session detail). "view details →" is an honest stub: the protocol has no tool detail page.
• Fabricated, minimally: the decision source of a denial (policy when the tool is not allowlisted, prompt when it is) — the world stores only denied30d; c59 says decision_source is captured at T2. Marked TODO(reconcile) in the derived file.
• Open: amber in the calm state for a policy receipt (attention color is rationed to debt); the default rank deviation; whether the sibling pages (Skills, Plugins) name the belongs-to column the same way.