diff --git a/CHANGELOG.md b/CHANGELOG.md
index d7845799..02ba21d8 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -238,6 +238,23 @@ it shipped into a `## [x.y.z] - date` section of their own; the tag's
 
 ### Changed
 
+- RBAC: 29 MCP tools that return stored records or configuration (run history,
+  costs, traces, heal logs, journals, the USB ACL, lease tokens, mobile
+  clipboards) now need `read_data` instead of `read_screen`. The built-in
+  `viewer` role can no longer call them; `operator` and `admin` are unaffected.
+- MCP plug-ins: a callable with `mcp_read_only = True` is offered on a
+  read-only server and to `viewer`. The declaration is trusted, not verified.
+- ChatOps: `/run` is ended by a stop-all (`AC_stop_execution` without a run id,
+  the GUI's stop-all, MCP `ac_stop_execution`); `/stop [run-id]` is new.
+- Config sync: a device's first sync against a non-empty bucket no longer
+  commits a revision or adds itself to `peers`. A device that has only read the
+  bucket and first sends an edit more than 30 days after the entry was deleted
+  elsewhere re-creates it without a conflict.
+- Logging: a command's result is masked before it is logged, so fields named
+  `token`, `password`, `secret`, `api_key` and the like read `***` in the
+  `execute: [...] -> ...` line. The returned record is unchanged.
+- Script Builder: the result of `AC_jwt_encode` is masked like the user-token
+  commands; read it through **One-time values**.
 - Stop: inside a stoppable run the polling waits (`AC_wait_window`,
   `AC_wait_text`, the smart waits, `AC_expect_poll`, `AC_assert_eventually`,
   `AC_wait_actionable` and others) end with `ExecutionStopped` as soon as a
diff --git a/CLAUDE.md b/CLAUDE.md
index b49796a7..295991e0 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -42,7 +42,9 @@ executed: measured, that was 11,962 statements and ~24 percentage points
 module `je_auto_control_pytest`, which imports only pytest
 (`test_pytest_entrypoint_light.py` keeps it so), but `coverage run` remains the
 rule: it does not depend on what a plugin imports or on which build is
-installed, and `pytest --cov` has not been re-measured since.
+installed. Re-measured on 2026-10-09 the two agreed (87.35% against 87.32%),
+and the maintainer decided the same day to keep `coverage run` as the only
+spelling.
 `test/unit_test/headless/test_coverage_measurement.py` holds CI to the
 correct spelling. After changing the entry point, reinstall (`pip install -e .`)
 for it to take effect.
diff --git a/Progress.md b/Progress.md
index faa458e5..81f1fce0 100644
--- a/Progress.md
+++ b/Progress.md
@@ -2,7 +2,7 @@
 
 ## 跨平台與 GUI 全面改版
 
-`WIP` — 計畫 A–H 的程式都已交付（A 在 U-20261009-01…14，B–H 在 U-20261009-15…26，留下的缺口在 U-20261009-27…37）；還沒做到的是**實機驗證**、要維護者決定的幾件事，與下面各節列的少數缺口
+`WIP` — 計畫 A–H 的程式都已交付（A 在 U-20261009-01…14，B–H 在 U-20261009-15…26，留下的缺口在 U-20261009-27…38）；還沒做到的是**實機驗證**、要維護者決定的幾件事，與下面各節列的少數缺口
 
 核准設計：[跨平台自動化與 GUI 改版](docs/superpowers/specs/2026-10-02-platform-gui-modernization-design.md)。
 實作計畫：[分階段交付計畫](docs/superpowers/plans/2026-10-02-modernization-index.md)。
@@ -226,15 +226,14 @@ U-20261009-06 與 -04 的 macOS 部分是在 Windows 上對假的 pyobjc／Quart
 
 ## 安全與伺服器：留下的缺口
 
-`TODO` — U-20261009-29、-30、-34、-35 之後還開著的
+`TODO` — U-20261009-29、-30、-34、-35、-37 之後還開著的
 
 **要維護者過目或決定的：**
 
-- `utils/rbac/policy.py` 的 `DATA_TOOLS`（42 個需要 `read_data` 的工具）是實作時分的類；刻意留在 `read_screen` 的有
-  `ac_list_run_history`、`ac_costs_*`、`ac_trace_export`、`ac_self_heal_log_list`、`ac_usb_acl_list`、`ac_vlm_locate`／`ac_self_heal_locate`（會花 VLM 費用）。
-- Script Builder 現在永遠不顯示 `AC_user_add`／`AC_user_rotate_token` 回傳的 token（要從 Users 群組、CLI 或腳本取得）。
-- 唯讀模式現在在三種工具模式都強制執行，而外掛工具一律被登記成會變更的：**唯讀的 MCP server 不會執行任何外掛工具**。要不要讓外掛宣告自己唯讀。
-- 設定同步：一台裝置加入「已經有內容」的 bucket 時仍會多提交一個 revision（這個登記是之後的刪除會等它的依據；要拿掉是 `merge.awaits_ack` 的一行，代價是那個保證）。
+- **`DECIDE`：REST 的 `GET /history` 與 `GET /usb/acl` 仍只要 `read_screen`**（`REST_ROUTE_CAPABILITIES`；REST 文件寫 viewer 可以用「除了兩個以外的所有 GET」）。
+  MCP 那邊同樣的資料已改成要 `read_data`（`DATA_TOOLS` 42 → 71），所以 viewer 的 token 經 MCP 讀不到執行歷史與 USB ACL，經 REST 仍讀得到。
+- **`DECIDE`：`AC_lease_secret`／`AC_lease_active` 回傳的租約 token 在 Script Builder 仍以明文顯示**（後者巢狀在 `leases` 底下，遮蔽與一次性顯示都只看最上層欄位）。
+  `AC_rest_api_start`／`AC_rest_api_status` 回傳共用的 REST bearer token，沒有 Script Builder schema，從 raw JSON 檢視執行時明文顯示。
 
 **還沒做的：**
 
@@ -254,6 +253,8 @@ U-20261009-06 與 -04 的 macOS 部分是在 Windows 上對假的 pyobjc／Quart
   - 沒有做過真的兩台機器同步，也沒有真的多行程 server；伺服器端的測試在本機是略過的（共用環境沒裝 `fastapi`），只在 CI 跑。
   - 墓碑：已確認的刪除現在會保留 30 天（`TOMBSTONE_HOLD_S`），沒被列過的機器帶舊資料來時變成衝突。剩下的風險：超過 30 天才第一次同步的機器
     仍可能讓項目復活；舊版 client 提交時會丟掉保留中的墓碑並去掉 `deleted_at`，所以保護程度取決於還在提交的最舊 client。沒對真的舊版安裝跑過。
+  - 加入 bucket 不再提交 revision 之後變弱的保證：只讀過 bucket 的裝置改了某個項目，而且在該項目於別處被刪除超過 30 天之後才第一次送出那個編輯，
+    項目會被重新建立而沒有衝突（以前墓碑會無限期等它）。只讀的裝置不再出現在 `peers`，所以 `max_offline_s` 退役與 `FullResyncRequired` 不會套用到它。
   - `ConfigBucket.upsert` 不帶 `origin=` 時現在存的是帶版本的項目，直接讀 `bucket.sections[s][id]["field"]` 的程式會壞（`bucket.values(section)` 兩種形狀都能讀）。
   - 沒有自動的剪貼簿轉送，所以 `automatic=True`（`ClipboardEchoGuard.should_send`）在產品裡沒有呼叫端。
   - blob：鎖檔超過 30 秒會被視為過期而接管，單次寫入比這更久時仍可能超出配額；用 `publish_assets` 手動上傳的 blob 沒有 bucket 項目引用，
@@ -296,20 +297,21 @@ U-20261009-18 的每一個裝置面呼叫都只對假的 ADB／uiautomator2／WD
 
 ## GUI：留下的缺口
 
-`TODO` — U-20261009-27、-28、-34、-36 之後還開著的
+`TODO` — U-20261009-27、-28、-34、-36、-38 之後還開著的
 
 - **Windows UIA 後端的執行緒模型完全沒對真的 COM 驗過**：現在每個呼叫執行緒各有一個自動化物件（`accessibility/backends/windows_automation.py`；
   主執行緒 STA、其他執行緒進 MTA），Accessibility 分頁與 A11y Audit 已移出 GUI 執行緒。開發環境沒裝 `comtypes`，CI 也沒有同時有 `comtypes` 與桌面的 job，
   測試全是假 COM 物件。未驗證的假設：MTA 工作執行緒上的 UIA 呼叫可用；焦點事件 callback 不需要 message pump；
   `import comtypes` 第一次發生在已經是 MTA 的執行緒上會丟 `OSError`（憑記憶，沒處理）。`AC_wait_for_focus_change` 的原生 `Queue.get` 仍不會被 stop 叫醒。
+- **Script Builder 的一次性值**：在區塊指令（`AC_loop`、`AC_try`、`AC_if_*`）裡產生的 token 拿不到——區塊只記錄自己的摘要，巢狀指令的結果不在任何紀錄裡（結果畫面會說明並列出指令）。
+  要補需要 executor 的結果掛鉤（`utils/executor/action_executor.py` 的 `_run_one_action` 與 `gui/script_builder/step_model.py::nested_sensitive_commands`）。
+  對話框開過之後結果畫面仍顯示「有值可看」那一行；複製到系統剪貼簿的 token 關閉時不清除；對話框從未實際顯示過。
 - **stop 還叫不醒的**：已經進到後端的單一指令（一次影像搜尋、OCR、HTTP 請求、shell 指令）、單一手勢內的節奏 sleep、`AC_wait_for_focus_change`；
   MCP 自己的輪詢（`ac_wait_for_image`／`ac_wait_for_pixel`）不在可停止的執行裡。非腳本的分頁工作在後端無法取消，只是結果被丟掉。
-  ChatOps 的 `/run` 只有在腳本自己含 `AC_run_stoppable` 時才停得掉（刻意沒有整個包起來：那會讓 GUI 的「全部停止」也停掉聊天裡的執行，要維護者決定）。
+  ChatOps：`SlackBot.poll_once` 在輪詢執行緒上依序分派，所以同一個 bot 自己的 `/run` 還在跑時貼的 `/stop` 要等它結束才會被讀到（不帶參數的 `/stop` 因此只停 `chatops-` 開頭的執行）；沒對真的 Slack workspace 跑過。
   新轉成可停止的等待裡，`AC_handle_file_dialog`、`AC_wait_until_app_idle`、`AC_wait_for_composition_commit`、`AC_wait_for_unlock` 與行動裝置的 `wait_for_app` 只對假探針測過。
 - **WebRTC**：`StatsPoller.start()` 會在 GUI 執行緒上最多等 2 秒（`future.result(timeout=2.0)`，是啟動路徑，沒動）。LAN 廣播的註冊與取消已移出 GUI 執行緒，
   但真的 zeroconf 的時間與名稱衝突行為只對假物件測過。
-- **`DECIDE`：釋放 Remote Desktop 分頁時，WebRTC 的 host 與 viewer session 現在會被結束**（TCP／WebSocket 的仍留在 registry）。理由：WebRTC host 只屬於面板，
-  面板釋放後沒有東西能停它，會在看不到的情況下繼續分享畫面。要改回去是拿掉兩個 `dispose()` 裡的 `self._stop_host_if_any` 與 `self._end_session_for_good`。
 - **切換主題後那幾個事件迴圈回合內**，以被暫存的頁面為 parent 的 `QMessageBox` 會相對於隱藏的暫存 widget 定位（只影響位置）。
   系統匣路徑在 offscreen 下沒有 tray，`_on_tray_open` 是直接呼叫測的。基準（`benchmarks/gui_*.py`）CI 仍不設門檻。
 - **把 Python 建的 widget 放進分頁列在結束時崩潰**：已查明觸發條件——分頁列按鈕上接了 Python callable、又有排隊中的 `deleteLater()`、而行程經 `os._exit` 離開；
@@ -326,8 +328,6 @@ U-20261009-18 的每一個裝置面呼叫都只對假的 ADB／uiautomator2／WD
 
 `TODO` — 小項目，各自獨立
 
-- **`DECIDE`：`pytest --cov` 可以放行了嗎**。進入點搬到 `je_auto_control_pytest` 之後重新量過（2026-10-09）：`coverage run -m pytest` 87.35%，`pytest --cov` 87.32%。
-  `CLAUDE.md` 與 `test_coverage_measurement.py` 仍規定只能用 `coverage run`；要不要放寬由維護者決定。
 - **本機的共用 `.venv` 裝著 `je_auto_control_dev 0.0.136`**，它的 `pytest11` 進入點還是舊的重量級路徑；重裝即可，不影響 CI。
 - **free-threaded**：呼叫者身分、綁定的裝置、自愈的執行標記與 stop token 都改成只在設定它的執行緒上有效（`utils/thread_bound.py`）。
   這台機器沒有 free-threaded 直譯器：驗證用的是模擬繼承與真的 `-X thread_inherit_context=1`（3.14.7，GIL 開著）；`free-threaded-scope` job（3.14t）是第一次真的跑。
diff --git a/architecture_explore.md b/architecture_explore.md
index 5f001852..8a889ea2 100644
--- a/architecture_explore.md
+++ b/architecture_explore.md
@@ -6,7 +6,7 @@
 > 擷取每個模組的 docstring 與頂層公開名稱；統計數字取自實際檔案，非估算。
 > 指令數與公開 API 數以 `executor.known_commands()` 與 `je_auto_control.__all__` 在工作樹上實測取得。
 >
-> **掃描時間**：2026-10-09　**版本**：`pyproject.toml` version `0.0.230`　**分支**：`feat/progress-sweep-4`
+> **掃描時間**：2026-10-09　**版本**：`pyproject.toml` version `0.0.232`　**分支**：`feat/maintainer-decisions`
 
 ---
 
@@ -19,8 +19,8 @@ iOS（WebDriverAgent）。核心能力是滑鼠／鍵盤控制、影像辨識、
 
 | 指標 | 數值 |
 | --- | ---: |
-| Python 模組總數（含周邊子專案） | 1,175 |
-| 程式碼總行數 | 187,645 |
+| Python 模組總數（含周邊子專案） | 1,176 |
+| 程式碼總行數 | 188,115 |
 | `je_auto_control/utils/` 子套件數 | 311 |
 | `AC_*` 動作指令數（`known_commands()` 實測） | 852 |
 | 套件門面 `__all__` 公開名稱數 | 1,244 |
@@ -272,7 +272,7 @@ socket server 有 8 MiB 讀取上限與 30 秒 handler timeout。
 
 ### 5.4.1 執行引擎與腳本資產
 
-> 25 個套件、約 18,209 行。
+> 25 個套件、約 18,210 行。
 
 | 模組 | 行數 | 職責 |
 | --- | ---: | --- |
@@ -283,7 +283,7 @@ socket server 有 8 MiB 讀取上限與 30 秒 handler timeout。
 | `utils/dag/` | 564 | 跨主機 DAG 編排器（圖模型 + runner） |
 | `utils/decision_table/` | 112 | DMN 風格決策表：規則 + 命中策略，把分支外部化 |
 | `utils/deterministic/` | 116 | 決定性執行控制：固定亂數種子 + 凍結時鐘 |
-| `utils/executor/` | 10,368 | **核心**。`Executor` 指令分派表（852 個 `AC_*`）、參數插值、乾跑、逐步 callback；`flow_control` 提供 34 個區塊指令（迴圈／分支／try／巨集／變數） |
+| `utils/executor/` | 10,369 | **核心**。`Executor` 指令分派表（852 個 `AC_*`）、參數插值、乾跑、逐步 callback；`flow_control` 提供 34 個區塊指令（迴圈／分支／try／巨集／變數） |
 | `utils/action_journal/` | 1,001 | 選用的動作日誌：執行邊界記錄 typed 輸入／結果與 parent id，先遮蔽再寫入 JSONL；`codegen.journal_import` 由它產生候選腳本 |
 | `utils/flow_debugger/` | 166 | action list 的單步除錯器與追蹤器 |
 | `utils/input_macro/` | 469 | 定時輸入事件：錄製結果的整形（`timeline`／`InputRecorder`，Windows 與 macOS 共用）、重播與宣告式輸入序列 DSL |
@@ -495,7 +495,7 @@ socket server 有 8 MiB 讀取上限與 30 秒 handler timeout。
 
 ### 5.4.9 AI / Agent / LLM
 
-> 13 個套件、約 25,801 行。
+> 13 個套件、約 25,860 行。
 
 | 模組 | 行數 | 職責 |
 | --- | ---: | --- |
@@ -508,19 +508,19 @@ socket server 有 8 MiB 讀取上限與 30 秒 handler timeout。
 | `utils/cua_action/` | 204 | 標準化 computer-use 動作結構（Anthropic／OpenAI → `AC_*`） |
 | `utils/llm/` | 387 | 自然語言 → action list 規劃器 + Anthropic／null 後端 |
 | `utils/mcp_registry/` | 97 | MCP registry `server.json` 資訊清單產生（可被發現） |
-| `utils/mcp_server/` | 21,113 | **無頭 MCP 伺服器**（16K LOC，預設註冊 757 個工具＝738 個 `ac_*` + 19 個別名）：stdio + HTTP 傳輸、工具工廠與處理器、資源、prompt、稽核、限流、外掛熱重載 |
+| `utils/mcp_server/` | 21,172 | **無頭 MCP 伺服器**（16K LOC，預設註冊 757 個工具＝738 個 `ac_*` + 19 個別名）：stdio + HTTP 傳輸、工具工廠與處理器、資源、prompt、稽核、限流、外掛熱重載 |
 | `utils/tool_use_schema/` | 195 | 把 `AC_*` 指令匯出成 Claude／OpenAI 的 tool-use schema |
 | `utils/trajectory_eval/` | 132 | agent 軌跡評估：依評分規準為一次執行打分 |
 | `utils/vision/` | 580 | VLM 元素定位器（依描述找元素）+ Anthropic／OpenAI／null 後端 |
 
 ### 5.4.10 遠端桌面與 USB
 
-> 6 個套件、約 24,954 行。
+> 6 個套件、約 24,961 行。
 
 | 模組 | 行數 | 職責 |
 | --- | ---: | --- |
 | `utils/admin/` | 418 | 多主機管理主控台：平行輪詢 N 個 AutoControl REST 端點 |
-| `utils/config_sync/` | 4,089 | 透過訊令伺服器做跨機器設定同步 |
+| `utils/config_sync/` | 4,096 | 透過訊令伺服器做跨機器設定同步 |
 | `utils/device_matrix/` | 203 | 行動裝置矩陣：同一 action list 於多台裝置平行執行 |
 | `utils/remote_desktop/` | 14,179 | **遠端桌面子系統**（56 檔／11.7K LOC）：TCP／WebSocket／WebRTC 三條傳輸路徑、主機與檢視端、訊令伺服器、TURN／中繼、多檢視者、錄影、信任清單、TOTP、稽核鏈 |
 | `utils/usb/` | 5,057 | 跨平台 USB 列舉／熱插拔／裝置直通（WinUSB、IOKit、libusb 後端 + ACL + WebRTC DataChannel 通道） |
@@ -535,15 +535,16 @@ socket server 有 8 MiB 讀取上限與 30 秒 handler timeout。
 > **2026-10-09 第四輪新增的模組**：`utils/thread_bound.py`（只在設定它的執行緒上有效的 context 變數，RBAC 身分、裝置綁定、自愈標記與 stop token 共用）、
 > `utils/accessibility/backends/windows_automation.py`（每個執行緒的 COM apartment 與 UIAutomation 物件）、
 > `gui/_weak_call.py`（弱參照持有的工作回呼）、`gui/_qt_typed.py`（對真實 Qt 型別檢查用的小工具）。
+> 之後新增：`gui/script_builder/one_time_dialog.py`（Script Builder 的一次性值對話框，值只留在記憶體）。
 
 ### 5.4.11 伺服器、網路協定與外部整合
 
-> 24 個套件、約 7,165 行。
+> 24 個套件、約 7,241 行。
 
 | 模組 | 行數 | 職責 |
 | --- | ---: | --- |
 | `utils/acme_v2/` | 617 | 完整 ACME v2 用戶端（RFC 8555），不依賴 certbot |
-| `utils/chatops/` | 682 | Chat-ops bot：接收 Slack／Discord／webhook 的 slash 指令並路由到動作 |
+| `utils/chatops/` | 758 | Chat-ops bot：接收 Slack／Discord／webhook 的 slash 指令並路由到動作 |
 | `utils/cookie_jar/` | 191 | RFC 6265 cookie jar |
 | `utils/email_send/` | 118 | SMTP 寄信（email 觸發器的發送端搭檔） |
 | `utils/events/` | 106 | 對外 CloudEvents 發送（執行生命週期事件） |
@@ -641,7 +642,7 @@ socket server 有 8 MiB 讀取上限與 30 秒 handler timeout。
 
 ### 5.4.14 安全、機密與合規
 
-> 13 個套件、約 3,907 行。
+> 13 個套件、約 3,931 行。
 
 | 模組 | 行數 | 職責 |
 | --- | ---: | --- |
@@ -650,7 +651,7 @@ socket server 有 8 MiB 讀取上限與 30 秒 handler timeout。
 | `utils/governance/` | 242 | 治理：maker-checker 核准閘門與即時憑證租約 |
 | `utils/license_policy/` | 240 | 以 SBOM 元件評估 SPDX 授權允許／拒絕政策 |
 | `utils/provenance/` | 126 | SLSA 建置來源證明（in-toto v1） |
-| `utils/rbac/` | 1,161 | 角色型存取控制：使用者、角色與權杖驗證（尚未接到 REST／MCP） |
+| `utils/rbac/` | 1,185 | 角色型存取控制：使用者、角色與權杖驗證（尚未接到 REST／MCP） |
 | `utils/redaction/` | 508 | 截圖遮蔽層：規則偵測 + 政策 + 協調器（上傳 VLM 前先遮） |
 | `utils/sbom/` | 170 | SBOM（CycloneDX）產生 |
 | `utils/secret_ref/` | 242 | URI scheme 形式的值參照解析 |
@@ -707,11 +708,11 @@ socket server 有 8 MiB 讀取上限與 30 秒 handler timeout。
 
 上表以子套件為單位；以下把行數最大的幾個子系統展開到檔案層。
 
-#### `utils/executor/`（10,368 行）— 執行核心
+#### `utils/executor/`（10,369 行）— 執行核心
 
 | 檔案 | 行數 | 職責 |
 | --- | ---: | --- |
-| `action_executor.py` | 8,730 | `Executor` 類別與 `event_dict` 分派表（852 個指令），另含數百個把 utils 能力接成指令的 adapter 函式；全域單例 `executor` 與 `add_command_to_executor()` 擴充點。 |
+| `action_executor.py` | 8,731 | `Executor` 類別與 `event_dict` 分派表（852 個指令），另含數百個把 utils 能力接成指令的 adapter 函式；全域單例 `executor` 與 `add_command_to_executor()` 擴充點。 |
 | `flow_control.py` | 693 | 真正的流程控制：`AC_loop`／`AC_for_each`／`AC_while_*`／`AC_if_*`／`AC_try`／`AC_retry`／`AC_parallel`／`AC_define_macro`／`AC_call_macro`／變數指令（`AC_set_var`／`AC_get_var`／`AC_inc_var`）。`LoopBreak`／`LoopContinue` 以例外實作。34 個區塊指令的分派表 `BLOCK_COMMANDS` 也在這裡，含下一列匯入的資料來源指令。 |
 | `flow_data_commands.py` | 272 | `AC_*_to_var` 資料來源與轉換指令：shell、時鐘、亂數、PDF、TOTP、SQL、檔案、HTTP、OCR，加上 `AC_assert_var`／`AC_assert_db`／`AC_assert_duration`／`AC_transform_var`。都不執行巢狀 action list，所以沒有迴圈／分支語意。 |
 | `action_schema.py` | 223 | action list 的結構驗證：形狀、參數型別、未知指令拒絕。單一走訪同時支援兩種消費方式：`validate_actions()` 遇到第一個問題就拋、`unknown_command_names()` 收齊全部不認得的名字（REST `/execute` 用它回 400）。 |
@@ -719,7 +720,7 @@ socket server 有 8 MiB 讀取上限與 30 秒 handler timeout。
 | `mouse_aliases.py` | 39 | 單鍵點擊別名（`AC_click_left` 等），executor 與 callback executor 共用。 |
 | `flags.py` | 19 | 旗標讀取 `as_bool`：依拼法（`"true"`／`"yes"`／`"on"`／`"1"`）而非 Python 真值判斷，所以 JSON、CLI、MCP 傳來的 `"false"` 是關；所有 adapter 與流程指令共用。 |
 
-#### `utils/mcp_server/`（21,113 行，757 個工具）— 最大子系統
+#### `utils/mcp_server/`（21,172 行，757 個工具）— 最大子系統
 
 | 檔案 | 行數 | 職責 |
 | --- | ---: | --- |
@@ -747,10 +748,10 @@ socket server 有 8 MiB 讀取上限與 30 秒 handler timeout。
 | `resources.py` | 309 | MCP resource 提供者。 |
 | `prompts.py` | 220 | MCP prompt 目錄。 |
 | `fake_backend.py` | 187 | CI／無頭測試用的記憶體內假後端。 |
-| `plugin_watcher.py` | 168 | 檔案變更時熱重載外掛工具的背景 watcher。 |
+| `plugin_watcher.py` | 169 | 檔案變更時熱重載外掛工具的背景 watcher。 |
 | `tools/_base.py` | 190 | 工具註冊表的共用型別與輔助。 |
 | `tools/_validation.py` | 122 | MCP 工具用到的 JSON Schema 子集驗證器。 |
-| `tools/plugin_tools.py` | 89 | 把外掛載入的 `AC_*` callable 包成 `MCPTool`。 |
+| `tools/plugin_tools.py` | 147 | 把外掛載入的 `AC_*` callable 包成 `MCPTool`。 |
 | `log_bridge.py` | 118 | 把 Python logging 記錄橋接成 MCP `notifications/message`；2026-07-28 的請求只收到自己設了 `logLevel` 時產生的記錄。 |
 | `audit.py` | 126 | MCP 工具呼叫稽核記錄。 |
 | `context.py` | 71 | 傳給 opt-in 工具處理器的每次呼叫上下文。 |
@@ -914,7 +915,7 @@ GUI 是**選用 extra**（`pip install je_auto_control[gui]`，PySide6），且
 | `_screen_geometry.py` | 55 | Qt 邏輯座標與截圖用的原生像素互轉：`native_region()`、`screen_at_native()`、`logical_point()`（每個螢幕的左上角在兩者相同，螢幕內依 device pixel ratio 縮放）。區域選取與主機端標註覆蓋層都用它。 |
 | `_daemon_thread.py` | 79 | `DaemonThread`：`QThread` 的替代品，保留遠端桌面 worker 用到的介面（`start`／`run`／`isRunning`／`wait`／`requestInterruption`／`started`／`finished`），但 `run()` 跑在 daemon `threading.Thread` 上，刪除物件或程式結束都不會銷毀執行中的執行緒。 |
 | `_worker_thread.py` | 266 | `start_worker()`：在 daemon `threading.Thread` 上執行 `QObject` worker 的 `run()`（沒有 `QThread` 可被銷毀），並經由分頁擁有的中繼物件回報結果（回呼一律在 GUI 執行緒；worker 沒處理的例外也送到 `on_fail`）；worker 留在模組登錄表直到 GUI 執行緒看到它結束，回傳 `WorkerHandle`（`isRunning()`）；程式結束時先呼叫 worker 的 `request_stop()`，最多等 10 秒，仍在跑的隨行程結束。 |
-| `language_wrapper/` | 6,055 | 四語系字典（英／日／簡中／繁中）+ `multi_language_wrapper` 執行期切換器與監聽註冊表。 |
+| `language_wrapper/` | 6,107 | 四語系字典（英／日／簡中／繁中）+ `multi_language_wrapper` 執行期切換器與監聽註冊表。 |
 | `selector/` | 216 | 拖曳選取螢幕區域的半透明全螢幕覆蓋層與樣板裁切工具（互動式，但都有對應的程式化 API）。 |
 
 > **分頁指令一律走 Actions 選單**：分頁本身只放輸入、表格與結果檢視，指令由視窗層選單暴露。
@@ -1098,10 +1099,10 @@ socket 預設綁 `127.0.0.1`；資源一律用 `with`。
 
 | 層／子系統 | 檔案數 | 行數 |
 | --- | ---: | ---: |
-| `gui/` | 125 | 34,684 |
-| `utils/mcp_server/` | 43 | 21,113 |
+| `gui/` | 126 | 34,987 |
+| `utils/mcp_server/` | 43 | 21,172 |
 | `utils/remote_desktop/` | 57 | 14,179 |
-| `utils/executor/` | 9 | 10,368 |
+| `utils/executor/` | 9 | 10,369 |
 | `utils/usb/` | 20 | 5,057 |
 | `je_auto_control/`（頂層 3 檔） | 3 | 2,676 |
 | `utils/accessibility/` | 15 | 3,290 |
@@ -1118,6 +1119,6 @@ socket 預設綁 `127.0.0.1`；資源一律用 `with`。
 | `osx/` | 17 | 981 |
 | `autocontrol-lsp/` | 8 | 744 |
 | `utils/hotkey/` | 7 | 861 |
-| 其餘模組（約 286 個 `utils/` 子套件 + `android/`／`ios/`／周邊小工具） | 724 | 68,557 |
-| **總計** | **1,163** | **186,805** |
+| 其餘模組（約 286 個 `utils/` 子套件 + `android/`／`ios/`／周邊小工具） | 724 | 68,664 |
+| **總計** | **1,164** | **187,275** |
 
diff --git a/docs/source/Eng/doc/config_sync/config_sync_doc.rst b/docs/source/Eng/doc/config_sync/config_sync_doc.rst
index 0f736b16..6fb302e4 100644
--- a/docs/source/Eng/doc/config_sync/config_sync_doc.rst
+++ b/docs/source/Eng/doc/config_sync/config_sync_doc.rst
@@ -215,10 +215,27 @@ applies the hold only when ``now`` is given. A tombstone stamped by a release
 from before this has no ``deleted_at`` and is dropped on acknowledgement as
 before; such a release also drops acknowledged tombstones without holding
 them, so the hold is only as good as the oldest client still committing.
-A device joins ``peers`` with its first push; ``push_operations([])`` from a
-device the bucket does not list is such a push when the bucket holds entries
-(their later deletion must wait for it) and writes nothing when it holds
-none -- a first sync of an empty account commits no revision.
+A device joins ``peers`` with the first change it commits.
+``push_operations([])`` from a device the bucket does not list writes
+nothing, whether the bucket holds entries or not: a device that only reads a
+bucket commits no revision for joining it, and a first sync of an empty
+account commits none either. (Earlier a join against a non-empty bucket
+wrote one revision so that later deletions would wait for the device.)
+
+**What an unlisted device still gets, and what it does not.** A deletion made
+while the device is unlisted reaches it through the held tombstone: inside
+the thirty days its untouched copy is removed, and a copy it edited in the
+meantime becomes a conflict. After the hold the tombstone is gone. A copy
+the device did not touch is still removed -- its own baseline records that
+the entry came from the bucket, so its absence is a deletion made elsewhere.
+What is no longer guaranteed is the edited copy: a device that has only ever
+read the bucket, edits an entry, and first sends that edit more than
+``TOMBSTONE_HOLD_S`` after the entry was deleted elsewhere **re-creates the
+entry with no conflict**. With the join revision the tombstone would have
+waited for that device indefinitely and the edit would have been a
+conflict. The remedy is the same as for a machine that never synced: sync
+every machine at least once every thirty days, or have it commit a change
+before it goes away.
 
 A device that will not come back is retired with
 ``client.retire_peer(device_id)`` (or automatically with
diff --git a/docs/source/Eng/doc/mcp_server/mcp_server_doc.rst b/docs/source/Eng/doc/mcp_server/mcp_server_doc.rst
index a570cb62..b83b7e6e 100644
--- a/docs/source/Eng/doc/mcp_server/mcp_server_doc.rst
+++ b/docs/source/Eng/doc/mcp_server/mcp_server_doc.rst
@@ -337,6 +337,38 @@ bearer token and is never subject to RBAC.
   ``DATA_TOOLS`` in ``je_auto_control.utils.rbac.policy``. A ``viewer`` keeps
   every other read-only tool: screen size, windows, pixels, image and text
   location, accessibility reads, waits.
+- The rule behind that list: a tool that returns **records or configuration
+  the host keeps** needs ``read_data``; a tool that only observes the live
+  screen needs ``read_screen``. So ``read_data`` also covers run history and
+  what is computed from it (``ac_list_run_history``, ``ac_flaky_report``,
+  ``ac_rank_tests``, ``ac_select_tests``, ``ac_shard_suite``); agent traces
+  and the cost ledger (``ac_trace_export``, ``ac_trace_summary``,
+  ``ac_costs_list``, ``ac_costs_summary``); action journals
+  (``ac_journal_read``, ``ac_journal_runs``); the self-healing log, its
+  statistics, stored revisions and datasets (``ac_self_heal_log_list``,
+  ``ac_heal_stats``, ``ac_self_heal_revision_list``,
+  ``ac_self_heal_evaluate``); locator strategy history, repairs and saved
+  libraries (``ac_ab_report``, ``ac_ab_best_strategy``, ``ac_repair_pending``,
+  ``ac_repair_resolved``, ``ac_element_list``, ``ac_skill_list``,
+  ``ac_skill_search``); stored policy and state (``ac_usb_acl_list``,
+  ``ac_lease_active``, ``ac_quarantine_list``, ``ac_pending_artifacts``,
+  ``ac_config_sync_status``); and a connected device's clipboard
+  (``ac_android_get_clipboard``, ``ac_ios_get_clipboard``). These were
+  ``read_screen`` before, so **a viewer token can no longer call them**;
+  ``operator`` and ``admin`` are unaffected.
+- What a call costs is not a capability. ``ac_vlm_locate`` and
+  ``ac_self_heal_locate`` read the screen and stay ``read_screen`` although a
+  call may be billed by a model provider; limit spend with the rate limiter
+  or by not configuring a VLM backend for a server viewers reach.
+- The classification covers MCP tools only. The REST routes ``GET /history``
+  and ``GET /usb/acl`` still need ``read_screen``, as the REST table in the
+  operations chapter says, so a viewer token reads the same run history and
+  USB ACL there.
+- Tools that report the live state of this process rather than a stored
+  record -- ``ac_list_executions``, ``ac_scheduler_list_jobs``,
+  ``ac_trigger_list``, ``ac_hotkey_list``, ``ac_observe_list``,
+  ``ac_watchdog_list``, ``ac_journal_status``, the USB device lists -- stay
+  ``read_screen``.
 - ``tools/list`` returns only the tools the caller may call, and
   ``tools/call`` on any other answers JSON-RPC error ``-32003``
   (``Forbidden: ...``, ``data.required_capability``) without running it.
@@ -669,11 +701,12 @@ that is not marked read-only and is registered on a running read-only server
 out of ``tools/list`` and a call to it is answered ``-32602`` and recorded in
 the audit log as ``denied``. In the default ``full`` mode the filter used to
 run only when the registry was built, so such a tool was listed and ran.
-Plugin tools are registered as destructive, so **a read-only server runs no
-plugin tool**; a tool your own code registers with ``readOnlyHint`` true is
-still offered. ``MCPServer(tools=[...])`` with the variable set is filtered
-the same way -- pass ``read_only=False`` to an embedded server that must
-ignore the variable.
+Plugin tools are registered as destructive unless the plugin declares
+otherwise, so **a read-only server runs no plugin tool that has not declared
+itself read-only** (see `Plugin hot-reload`_); a tool your own code registers
+with ``readOnlyHint`` true is still offered. ``MCPServer(tools=[...])`` with
+the variable set is filtered the same way -- pass ``read_only=False`` to an
+embedded server that must ignore the variable.
 
 Confining file arguments to root directories
 ============================================
@@ -882,6 +915,48 @@ Each register / unregister fires
 ``notifications/tools/list_changed`` so the client refreshes its
 cached catalogue automatically.
 
+**Declaring a plugin tool read-only.** A plugin tool is registered as
+mutating: it is absent from a read-only server and needs ``drive_input``
+under RBAC. A plugin opts one of its callables out by setting the attribute
+``mcp_read_only`` to ``True`` on it:
+
+.. code-block:: python
+
+   def AC_queue_depth():
+       """How many jobs are waiting."""
+       return {"depth": len(_pending)}
+
+   AC_queue_depth.mcp_read_only = True
+
+The tool is then registered with ``readOnlyHint`` true. It is listed and
+runs on a read-only server in all three tool modes (``full``,
+``progressive`` -- once enabled -- and ``static``, when the profile names
+it), and under RBAC it needs only ``read_screen``, so a ``viewer`` may call
+it. Only the read-only hint is taken from the plugin; the tool is not
+marked idempotent.
+
+.. warning::
+
+   The declaration is **trusted, not verified**. It is the plugin author's
+   word: the server cannot tell what arbitrary Python does, and a callable
+   that declares itself read-only and then writes files or sends input will
+   do so on a read-only server and for a viewer. Declaring it does not
+   sandbox it. Review a plugin before giving it a directory a read-only or
+   viewer-facing server watches. Each time such a tool is registered the
+   server logs a warning naming it (``plugin tool 'plugin_ac_queue_depth' is
+   registered read-only because its plugin declared mcp_read_only=True; the
+   declaration is trusted, not verified``).
+
+Anything other than the boolean ``True`` is not a declaration: ``"true"``,
+``1``, a callable, an attribute that raises. Such a value is logged and the
+tool stays mutating, as does a tool with no attribute or with ``False``.
+The same rule applies to tools registered through
+``register_plugin_tools(server, commands)`` and ``make_plugin_tool``; the
+attribute's name is ``PLUGIN_READ_ONLY_ATTRIBUTE`` in
+``je_auto_control.utils.mcp_server.tools.plugin_tools``. The declaration
+says nothing to the ``AC_*`` executor command of the same name, and the path
+roots still do not reach a plugin tool's arguments.
+
 CI smoke tests with the fake backend
 ====================================
 
diff --git a/docs/source/Eng/doc/new_features/new_features_doc.rst b/docs/source/Eng/doc/new_features/new_features_doc.rst
index 3d3bfec8..ab8d5900 100644
--- a/docs/source/Eng/doc/new_features/new_features_doc.rst
+++ b/docs/source/Eng/doc/new_features/new_features_doc.rst
@@ -560,8 +560,11 @@ Over MCP the same two are the tools ``ac_stop_execution`` (``run_id``,
 ``ac_list_executions`` (read-only). There is no separate "run stoppably" tool:
 ``ac_execute_actions`` and ``ac_execute_action_file`` take any action list, so
 the list itself carries the ``AC_run_stoppable`` block shown above. A ChatOps
-command whose run is stopped replies ``<command> stopped.`` (with the reason
-in parentheses) instead of reporting a failure.
+``/run`` is a stoppable run by itself, named ``chatops-<script>-<id>``, so
+every stop above reaches it -- a stop that names no run included -- and the
+chat command ``/stop [run-id]`` does too. A ChatOps command whose run is
+stopped replies ``<command> stopped.`` (with the reason in parentheses)
+instead of reporting a failure.
 
 What a stop does:
 
diff --git a/docs/source/Eng/doc/new_features/v2_features_doc.rst b/docs/source/Eng/doc/new_features/v2_features_doc.rst
index 79597b21..dfa225e1 100644
--- a/docs/source/Eng/doc/new_features/v2_features_doc.rst
+++ b/docs/source/Eng/doc/new_features/v2_features_doc.rst
@@ -489,7 +489,16 @@ Chat-ops bot
 Transport-agnostic ``CommandRouter`` plus a polling Slack adapter so
 ``/run <script>`` over Slack hits the same execution path as the
 scheduler. Built-in commands: ``/help``, ``/scripts``, ``/run``,
-``/screenshot [name]``, ``/status``. ``/screenshot`` writes into the
+``/stop [run-id]``, ``/screenshot [name]``, ``/status``. ``/run`` is a
+stoppable run named ``chatops-<script>-<8 hex digits>`` (the id is in the
+reply's ``metadata["run_id"]`` and in ``AC_list_executions`` while it
+lasts): ``AC_stop_execution``, the MCP ``ac_stop_execution`` tool and the
+GUI's stop-all end it, **including a stop-all that names no run**, and the
+reply is ``run stopped.``. ``/stop`` asks the chat-started runs to stop;
+``/stop <run-id>`` asks the one named, wherever it was started. The Slack
+adapter handles one message at a time, so a ``/stop`` posted while its own
+``/run`` is still going is read after that run has ended -- stop such a run
+from the GUI, an action list or MCP. ``/screenshot`` writes into the
 context's ``screenshot_dir`` (default: ``je_auto_control_chatops`` in the
 temp directory) and keeps only the file name it is given. The Slack
 adapter goes through the package HTTP client, so the egress policy applies.
diff --git a/docs/source/Eng/doc/new_features/v61_features_doc.rst b/docs/source/Eng/doc/new_features/v61_features_doc.rst
index 2e6e0376..1cc6c193 100644
--- a/docs/source/Eng/doc/new_features/v61_features_doc.rst
+++ b/docs/source/Eng/doc/new_features/v61_features_doc.rst
@@ -67,4 +67,8 @@ optional ``alg``; it returns ``{token}``. ``AC_jwt_decode`` takes ``token``,
 ``key`` and optional ``algorithms`` / ``audience`` / ``leeway``; it returns
 ``{ok, claims}`` (or ``{ok: false, error}`` so a flow can branch without
 raising). Both are exposed as the MCP tools ``ac_jwt_encode`` / ``ac_jwt_decode``
-and as Script Builder commands under **Security**.
+and as Script Builder commands under **Security**. The builder masks the
+token ``AC_jwt_encode`` returns in its result pane; read it once with
+**One-time values** after the run (a script still receives it). The executor's
+result log masks secret-named fields (``token``, ``password``...) of every
+command's result.
diff --git a/docs/source/Eng/doc/operations_layer/operations_layer_doc.rst b/docs/source/Eng/doc/operations_layer/operations_layer_doc.rst
index bc608012..439282f0 100644
--- a/docs/source/Eng/doc/operations_layer/operations_layer_doc.rst
+++ b/docs/source/Eng/doc/operations_layer/operations_layer_doc.rst
@@ -173,8 +173,21 @@ surface, each of which needs the ``manage_users`` capability:
   ``AC_user_remove``, ``AC_user_set_role``, ``AC_user_rotate_token`` and
   ``AC_user_list`` in an action list -- so also through ``POST /execute``.
   The Script Builder lists all five under **Security**; a run's result pane
-  shows ``AC_user_add`` / ``AC_user_rotate_token`` with the token masked, so
-  read a new token from the Users group, the CLI or a script instead;
+  shows ``AC_user_add`` / ``AC_user_rotate_token`` with the token masked and
+  says that a one-time value is available. **One-time values** on the
+  builder's toolbar then shows each token of that run once, labelled by its
+  step (``Step 1 · User: Add · alice · token``), with a Copy button per value.
+  Nothing opens by itself, so an unattended run is not interrupted. The
+  values are held in memory only: opening the dialog takes them from the
+  tab, closing it empties it, and starting the next run or closing the tab
+  drops what nobody read. They are never written to the result pane, the
+  log, the test record, the run history, the action journal, a saved script
+  or the GUI settings; the Copy button puts one on the clipboard. A token
+  issued inside a block (``AC_loop``, ``AC_try``...) is in no record -- a
+  block records its own summary -- so the result pane says it is not
+  available; keep such a step at the top level, or run it from a script, the
+  CLI or the Users group. ``execute_action`` still returns the token to a
+  script, as before;
 - the MCP tools ``ac_user_add`` / ``ac_user_remove`` / ``ac_user_set_role`` /
   ``ac_user_rotate_token`` / ``ac_user_list``;
 - the **Users (RBAC)** group of the REST API tab (commands in the Actions
diff --git a/docs/source/Zh/doc/config_sync/config_sync_doc.rst b/docs/source/Zh/doc/config_sync/config_sync_doc.rst
index c5987e26..2fcff161 100644
--- a/docs/source/Zh/doc/config_sync/config_sync_doc.rst
+++ b/docs/source/Zh/doc/config_sync/config_sync_doc.rst
@@ -178,9 +178,19 @@ vector 為 ``{"<裝置 id>": n}``。``peers`` 多出
 這個版本之前蓋章的 tombstone 沒有 ``deleted_at``,和以前一樣在確認後就移除;那樣的版本也不會保留
 已確認的 tombstone,所以保留期的效果取決於仍在提交的最舊 client。
 
-裝置在第一次 push 時加入 ``peers``;bucket 還沒列出的裝置呼叫 ``push_operations([])``,
-在 bucket 有 entry 時就是這樣的一次 push(之後的刪除必須等它),在 bucket 沒有任何 entry 時
-不寫入任何東西 —— 空帳號的第一次同步不會提交 revision。
+裝置在第一次提交變更時加入 ``peers``。bucket 還沒列出的裝置呼叫 ``push_operations([])``
+不會寫入任何東西,不論 bucket 有沒有 entry:只讀取 bucket 的裝置不會為了加入而提交 revision,
+空帳號的第一次同步也不會。(先前對已有內容的 bucket 加入時會寫一個 revision,
+讓之後的刪除等這台裝置。)
+
+**還沒被列出的裝置仍然得到什麼、得不到什麼。** 裝置未被列出期間發生的刪除,透過保留中的
+tombstone 送達:三十天內,它沒動過的副本會被移除,期間編輯過的副本會變成衝突。保留期過後
+tombstone 就不在了。裝置沒動過的副本仍然會被移除 —— 它自己的基準記錄了那筆 entry 來自
+bucket,所以 entry 不見就是別處做的刪除。不再保證的是編輯過的副本:一台只讀取過 bucket
+的裝置,編輯了某筆 entry,並在該 entry 於別處被刪除超過 ``TOMBSTONE_HOLD_S`` 之後才第一次
+送出這個編輯,會\ **在沒有衝突的情況下把 entry 重新建立**。有加入 revision 時,tombstone
+會無限期等這台裝置,那個編輯會是衝突。補救方式和從未同步過的機器相同:讓每台機器至少每三十天
+同步一次,或在離線之前先提交一次變更。
 
 不會再回來的裝置以 ``client.retire_peer(device_id)`` 退休(或以
 ``push_operations(..., max_offline_s=...)`` 自動退休,它比較 ``last_seen`` ——
diff --git a/docs/source/Zh/doc/mcp_server/mcp_server_doc.rst b/docs/source/Zh/doc/mcp_server/mcp_server_doc.rst
index 060b2830..b1d13db4 100644
--- a/docs/source/Zh/doc/mcp_server/mcp_server_doc.rst
+++ b/docs/source/Zh/doc/mcp_server/mcp_server_doc.rst
@@ -306,6 +306,31 @@ Bearer token 也可從 ``JE_AUTOCONTROL_MCP_TOKEN`` 環境變數讀取。
   ``ac_assert_audio``）。完整清單是 ``je_auto_control.utils.rbac.policy`` 的
   ``DATA_TOOLS``。其餘唯讀工具 ``viewer`` 都保留：螢幕尺寸、視窗、像素、影像與文字
   定位、無障礙讀取、等待。
+- 這份清單背後的規則：回傳\ **主機保存的紀錄或設定**\ 的工具需要 ``read_data``；
+  只觀察目前畫面的工具需要 ``read_screen``。所以 ``read_data`` 也包含執行歷史與由它
+  算出來的結果（``ac_list_run_history``、``ac_flaky_report``、``ac_rank_tests``、
+  ``ac_select_tests``、``ac_shard_suite``）；agent trace 與費用帳本
+  （``ac_trace_export``、``ac_trace_summary``、``ac_costs_list``、
+  ``ac_costs_summary``）；動作日誌（``ac_journal_read``、``ac_journal_runs``）；
+  自愈紀錄、其統計、保存的 revision 與資料集（``ac_self_heal_log_list``、
+  ``ac_heal_stats``、``ac_self_heal_revision_list``、``ac_self_heal_evaluate``）；
+  定位策略歷史、修復與保存的函式庫（``ac_ab_report``、``ac_ab_best_strategy``、
+  ``ac_repair_pending``、``ac_repair_resolved``、``ac_element_list``、
+  ``ac_skill_list``、``ac_skill_search``）；保存的政策與狀態（``ac_usb_acl_list``、
+  ``ac_lease_active``、``ac_quarantine_list``、``ac_pending_artifacts``、
+  ``ac_config_sync_status``）；以及連線裝置的剪貼簿（``ac_android_get_clipboard``、
+  ``ac_ios_get_clipboard``）。這些以前是 ``read_screen``，所以\ **viewer 的 token
+  現在不能呼叫它們**\ ；``operator`` 與 ``admin`` 不受影響。
+- 一次呼叫要花多少錢不是一種能力。``ac_vlm_locate`` 與 ``ac_self_heal_locate`` 讀的是
+  畫面，雖然呼叫可能被模型供應商計費，仍然是 ``read_screen``；要限制花費，請用
+  rate limiter，或不要在 viewer 連得到的伺服器上設定 VLM 後端。
+- 這個分類只涵蓋 MCP 工具。REST 的 ``GET /history`` 與 ``GET /usb/acl`` 仍然只需要
+  ``read_screen``\ （如維運章節的 REST 表格所列），所以 viewer 的 token 在那裡讀得到
+  同樣的執行歷史與 USB ACL。
+- 回報這個行程目前狀態、而不是保存紀錄的工具——``ac_list_executions``、
+  ``ac_scheduler_list_jobs``、``ac_trigger_list``、``ac_hotkey_list``、
+  ``ac_observe_list``、``ac_watchdog_list``、``ac_journal_status``、USB 裝置清單——
+  維持 ``read_screen``。
 - ``tools/list`` 只回呼叫者可以呼叫的工具；對其他工具 ``tools/call`` 會回 JSON-RPC
   錯誤 ``-32003``\ （``Forbidden: ...``、``data.required_capability``），且不會執行。
 - 接受動作清單的工具（``ac_execute_actions`` 等）在清單含有呼叫者角色沒有的指令時
@@ -572,7 +597,8 @@ process 內量測兩種模式。以 680 個工具的 registry 量測(2026-10-09,
 標為唯讀的工具(透過 ``register_tool``、``ac_load_plugins`` 或 plugin watcher),不會
 出現在 ``tools/list``,呼叫它會得到 ``-32602`` 並在稽核 log 記為 ``denied``。預設的
 ``full`` 模式以前只在建立 registry 時過濾,所以這種工具會被列出、也會執行。Plugin
-工具一律註冊為破壞性,因此\ **唯讀伺服器不會執行任何 plugin 工具**;你自己的程式以
+工具除非自己宣告,否則註冊為破壞性,因此\ **唯讀伺服器不會執行沒有宣告自己唯讀的
+plugin 工具**\ (見下方「Plugin Hot-Reload」);你自己的程式以
 ``readOnlyHint`` 為 true 註冊的工具仍然會提供。設了該環境變數時,
 ``MCPServer(tools=[...])`` 也會被同樣過濾——內嵌的伺服器若必須忽略該變數,請傳
 ``read_only=False``。
@@ -750,6 +776,40 @@ Plugin Hot-Reload
 每次 register / unregister 都會送出
 ``notifications/tools/list_changed``,client 會自動更新工具目錄。
 
+**宣告 plugin 工具為唯讀。** Plugin 工具預設註冊為會變更狀態的工具:唯讀伺服器不提供它,
+在 RBAC 下需要 ``drive_input``。Plugin 可以在某個 callable 上把屬性 ``mcp_read_only``
+設為 ``True``,讓它例外:
+
+.. code-block:: python
+
+   def AC_queue_depth():
+       """有多少工作在等待。"""
+       return {"depth": len(_pending)}
+
+   AC_queue_depth.mcp_read_only = True
+
+這個工具就會以 ``readOnlyHint`` 為 true 註冊。唯讀伺服器在三種工具模式下都會列出並執行它
+(``full``、``progressive`` —— 啟用之後 —— 以及 profile 有列它的 ``static``),在 RBAC 下
+只需要 ``read_screen``,所以 ``viewer`` 可以呼叫。從 plugin 取用的只有唯讀這一項;
+工具不會被標成 idempotent。
+
+.. warning::
+
+   這個宣告是\ **被信任的,不是被驗證的**。它只是 plugin 作者的說法:伺服器無從得知
+   任意的 Python 程式做了什麼,一個宣告自己唯讀、實際上卻寫檔或送出輸入的 callable,
+   在唯讀伺服器上、對 viewer 也照樣會那樣做。宣告不會把它關進沙箱。把 plugin 放進
+   唯讀或給 viewer 用的伺服器所監看的目錄之前,請先審查它。每次註冊這樣的工具,
+   伺服器都會記一筆指名它的 warning(``plugin tool 'plugin_ac_queue_depth' is
+   registered read-only because its plugin declared mcp_read_only=True; the
+   declaration is trusted, not verified``)。
+
+布林值 ``True`` 以外的任何值都不算宣告:``"true"``、``1``、callable、讀取時丟例外的屬性。
+這樣的值會被記錄,工具維持會變更狀態;沒有這個屬性或值為 ``False`` 的工具也一樣。
+透過 ``register_plugin_tools(server, commands)`` 與 ``make_plugin_tool`` 註冊的工具適用
+同一條規則;屬性名稱是 ``je_auto_control.utils.mcp_server.tools.plugin_tools`` 的
+``PLUGIN_READ_ONLY_ATTRIBUTE``。這個宣告不影響同名的 ``AC_*`` executor 指令,
+路徑根目錄也仍然管不到 plugin 工具的參數。
+
 CI 煙霧測試 (Fake Backend)
 ==========================
 
diff --git a/docs/source/Zh/doc/new_features/new_features_doc.rst b/docs/source/Zh/doc/new_features/new_features_doc.rst
index 4a832c34..63aeee90 100644
--- a/docs/source/Zh/doc/new_features/new_features_doc.rst
+++ b/docs/source/Zh/doc/new_features/new_features_doc.rst
@@ -517,7 +517,9 @@ GUI：**Variables** 分頁 — 即時檢視 ``executor.variables``，可單筆
 在 MCP 上，同樣的兩件事是工具 ``ac_stop_execution``\ （參數 ``run_id`` 與 ``reason``\ ，需要
 ``drive_input``\ ，唯讀的 server 不提供）與 ``ac_list_executions``\ （唯讀）。沒有另外的
 「以可停止方式執行」工具： ``ac_execute_actions`` 與 ``ac_execute_action_file`` 接受
-任何 action list，所以由清單自己帶上面的 ``AC_run_stoppable`` 區塊。ChatOps 指令的
+任何 action list，所以由清單自己帶上面的 ``AC_run_stoppable`` 區塊。ChatOps 的
+``/run`` 本身就是可停止的執行，名稱為 ``chatops-<腳本>-<id>``\ ，所以上面每一種停止
+（包含不指名的停止）都停得到它，聊天指令 ``/stop [run-id]`` 也可以。ChatOps 指令的
 執行被停止時，回覆是 ``<command> stopped.``\ （原因放在括號裡），而不是回報失敗。
 
 停止時會發生的事：
diff --git a/docs/source/Zh/doc/new_features/v2_features_doc.rst b/docs/source/Zh/doc/new_features/v2_features_doc.rst
index e5fa523c..d1ab4e94 100644
--- a/docs/source/Zh/doc/new_features/v2_features_doc.rst
+++ b/docs/source/Zh/doc/new_features/v2_features_doc.rst
@@ -434,8 +434,14 @@ Chat-ops 機器人
 
 傳輸層中立的 ``CommandRouter`` 加上 Slack polling adapter，
 ``/run <script>`` 經 Slack 進入和 scheduler 相同的執行路徑。
-內建命令：``/help``、``/scripts``、``/run``、``/screenshot``、
-``/status``。``/screenshot [name]`` 寫進 context 的 ``screenshot_dir``
+內建命令：``/help``、``/scripts``、``/run``、``/stop [run-id]``、``/screenshot``、
+``/status``。``/run`` 是一個可停止的執行，名稱為 ``chatops-<腳本>-<8 個十六進位字元>``
+（id 在回覆的 ``metadata["run_id"]`` 裡，執行期間也列在 ``AC_list_executions``）：
+``AC_stop_execution``、MCP 的 ``ac_stop_execution`` 工具與 GUI 的「全部停止」都能結束它，
+**包含不指名的全部停止**，回覆是 ``run stopped.``。``/stop`` 要求由聊天啟動的執行停止；
+``/stop <run-id>`` 要求指名的那一個停止，不論它從哪裡啟動。Slack adapter 一次處理一則訊息，
+所以在自己的 ``/run`` 還在跑時送出的 ``/stop`` 要等那次執行結束後才會被讀到——
+這種執行請從 GUI、action list 或 MCP 停止。``/screenshot [name]`` 寫進 context 的 ``screenshot_dir``
 （預設為暫存目錄下的 ``je_auto_control_chatops``），給的名稱只保留檔名。
 Slack adapter 走套件的 HTTP client，所以出站政策同樣適用。
 RBAC 透過 ``required_role`` 參數。
diff --git a/docs/source/Zh/doc/new_features/v61_features_doc.rst b/docs/source/Zh/doc/new_features/v61_features_doc.rst
index beab7cbf..2ab32370 100644
--- a/docs/source/Zh/doc/new_features/v61_features_doc.rst
+++ b/docs/source/Zh/doc/new_features/v61_features_doc.rst
@@ -59,4 +59,6 @@ token 可直接接上 HTTP 用戶端:
 ``{token}``。``AC_jwt_decode`` 接受 ``token``、``key`` 與選用的 ``algorithms`` /
 ``audience`` / ``leeway``,回傳 ``{ok, claims}``(或 ``{ok: false, error}``,讓流程可在不拋出
 例外的情況下分支)。兩者皆以 MCP 工具 ``ac_jwt_encode`` / ``ac_jwt_decode`` 以及 Script Builder
-中 **Security** 分類下的命令提供。
+中 **Security** 分類下的命令提供。Script Builder 的結果面板會遮蔽 ``AC_jwt_encode`` 回傳的
+token;執行後按 **一次性的值** 可看一次(腳本照舊收到 token)。執行器的結果 log 會遮蔽每個命令
+結果中名稱屬於機密的欄位(``token``、``password``…)。
diff --git a/docs/source/Zh/doc/operations_layer/operations_layer_doc.rst b/docs/source/Zh/doc/operations_layer/operations_layer_doc.rst
index 9b7c43f0..f2e28a7b 100644
--- a/docs/source/Zh/doc/operations_layer/operations_layer_doc.rst
+++ b/docs/source/Zh/doc/operations_layer/operations_layer_doc.rst
@@ -158,7 +158,15 @@ CLI::
   ``AC_user_remove``、``AC_user_set_role``、``AC_user_rotate_token`` 與
   ``AC_user_list``——所以 ``POST /execute`` 也可以。Script Builder 在 **Security**
   分類列出這五個指令；執行結果面板顯示 ``AC_user_add``／``AC_user_rotate_token`` 時
-  會遮蔽 token，所以新 token 請從使用者群組、CLI 或腳本取得；
+  會遮蔽 token，並註明有一次性的值可看。接著按工具列的 **一次性的值**，就會把該次
+  執行的每個 token 顯示一次，各自標上步驟（``步驟 1 · User: Add · alice · token``），
+  每個值有自己的「複製」按鈕。對話框不會自動開啟，所以無人值守的執行不會被打斷。
+  這些值只存在記憶體裡：開啟對話框時就從分頁取走，關閉對話框即清空，開始下一次
+  執行或關閉分頁則丟棄沒人看過的值。它們不會寫進結果面板、log、測試紀錄、執行歷史、
+  動作日誌、儲存的腳本或 GUI 設定；「複製」按鈕會把值放到剪貼簿。在區塊
+  （``AC_loop``、``AC_try``…）裡產生的 token 不在任何紀錄中——區塊只記錄自己的
+  摘要——所以結果面板會註明無法取得；請把這種步驟放在最上層，或改從腳本、CLI、
+  使用者群組執行。``execute_action`` 照舊把 token 回傳給腳本；
 - MCP 工具 ``ac_user_add``／``ac_user_remove``／``ac_user_set_role``／
   ``ac_user_rotate_token``／``ac_user_list``；
 - REST API 分頁的 **使用者（RBAC）** 群組（指令在 Actions 選單），該分頁也可以用這個
diff --git a/docs/updates/2026-10.md b/docs/updates/2026-10.md
index 9647fa64..9a2c1f64 100644
--- a/docs/updates/2026-10.md
+++ b/docs/updates/2026-10.md
@@ -434,3 +434,15 @@ Jeffrey_RPA kept its own `KEY_ALIASES` (40 friendly names) and `_EXTRA_KEY_CODES
 - **What**: `gui/_weak_call.py`: the worker relay, the task controller and the panel helpers no longer keep a tab alive (the new test aborted the interpreter on the old code); a structural test refuses a lambda or closure connected to a task signal. `dispose()` on the six remote-desktop classes and 17 tabs. Pages of closed tabs are parked for a restyle and `real_window()` finds the main window from a parked page. The Windows UIA backend gives each calling thread its own automation object (`windows_automation.py`), `windows_backend.py` drops to 748 lines and leaves the exemption list, and the accessibility tabs run off the GUI thread. `typing_extras_exempt.txt` shrinks from 70 modules to 18.
 - **Tests**: `test_gui_weak_callbacks.py` (14), `test_webrtc_lan_advertise_stop.py` (6), `test_gui_panel_dispose.py` (14), `test_accessibility_windows_threads.py` (14), `test_gui_accessibility_offthread.py` (8), `test_gui_qt_typed.py` (4).
 - **Open items**: the COM behaviour is tested against fakes only (`comtypes` is not installed); releasing the Remote Desktop tab now ends a WebRTC host or session — a decision for the maintainer. `Progress.md` › GUI.
+
+## U-20261009-37 · 2026-10-09 · Plug-in tools can declare themselves read-only; stored records need read_data; a chat /run can be stopped; joining a bucket commits nothing · #done #mcp #rbac #chatops #sync
+
+- **What**: A plug-in callable with `mcp_read_only = True` is offered on a read-only MCP server and to `viewer`; only the boolean counts, the declaration is trusted rather than verified, and each one is logged at registration. `DATA_TOOLS` grows from 42 to 71: tools that return stored records or configuration (run history, costs, traces, heal logs, journals, the USB ACL, lease tokens, mobile clipboards) need `read_data`, so `viewer` loses 29 MCP tools; `operator` and `admin` lose nothing. ChatOps `/run` is a stoppable run named `chatops-<script>-<id>` and `/stop [run-id]` is new. A device's first sync against a non-empty bucket no longer commits a revision or lists itself under `peers`.
+- **Tests**: `test_mcp_plugin_read_only_declaration.py` (32), `test_chatops_stoppable_run.py` (9), `test_config_sync_join_without_commit.py` (10).
+- **Open items**: REST `GET /history` and `GET /usb/acl` still need only `read_screen`; the weaker tombstone guarantee past 30 days. `Progress.md` › 安全與伺服器.
+
+## U-20261009-38 · 2026-10-09 · Script Builder shows a freshly issued token once; command results are masked before they are logged · #done #gui #security
+
+- **What**: After a run the Script Builder keeps the masked record and offers **One-time values**: each value produced by a `sensitive_result` step, labelled by its step, with a copy button, held in memory until the dialog closes or the next run starts. `AC_jwt_encode` is now a `sensitive_result` command. Fixed: the executor logged every command result as it was, so a signed JWT and a lease token appeared in the log in plain text; results now pass through `redact_actions` before logging (the returned record is unchanged).
+- **Tests**: `test_script_builder_one_time_reveal.py` (23).
+- **Open items**: a token issued inside a block command cannot be revealed. `Progress.md` › GUI.
diff --git a/docs/updates/README.md b/docs/updates/README.md
index c81d63e4..8dbaa350 100644
--- a/docs/updates/README.md
+++ b/docs/updates/README.md
@@ -58,6 +58,8 @@ In the same commit: delete the item from `Progress.md`, add a `#done` entry here
 
 | ID | Date | Title | Tags | Batch |
 |---|---|---|---|---|
+| U-20261009-38 | 2026-10-09 | Script Builder shows a freshly issued token once; command results are masked before they are logged | #done #gui #security | [2026-10](2026-10.md) |
+| U-20261009-37 | 2026-10-09 | Plug-in tools can declare themselves read-only; stored records need read_data; a chat /run can be stopped; joining a bucket commits nothing | #done #mcp #rbac #chatops #sync | [2026-10](2026-10.md) |
 | U-20261009-36 | 2026-10-09 | GUI: task callbacks held weakly, dispose() on every panel and tab with background work, per-thread UI Automation, 52 fewer typing exemptions | #done #gui #accessibility #typing | [2026-10](2026-10.md) |
 | U-20261009-35 | 2026-10-09 | Config sync: oversize blobs refused before upload, unused blobs collected, a deletion held for 30 days, the mirror sees same-tick edits | #done #sync | [2026-10](2026-10.md) |
 | U-20261009-34 | 2026-10-09 | A stop wakes the polling waits; MCP can stop and list runs; a USB ACL file that fails its check denies everything; per-thread context | #done #executor #mcp #security #rbac | [2026-10](2026-10.md) |
@@ -385,7 +387,7 @@ In the same commit: delete the item from `Progress.md`, add a `#done` entry here
 
 | File | Period | Entries |
 |---|---|---:|
-| [2026-10.md](2026-10.md) | 2026-10 | 49 |
+| [2026-10.md](2026-10.md) | 2026-10 | 51 |
 | [2026-09-e.md](2026-09-e.md) | 2026-09 | 7 |
 | [2026-09-d.md](2026-09-d.md) | 2026-09 | 55 |
 | [2026-09-c.md](2026-09-c.md) | 2026-09 | 38 |
diff --git a/je_auto_control/gui/language_wrapper/english.py b/je_auto_control/gui/language_wrapper/english.py
index 43c07661..893dea8e 100644
--- a/je_auto_control/gui/language_wrapper/english.py
+++ b/je_auto_control/gui/language_wrapper/english.py
@@ -981,6 +981,19 @@
     "rh_journal_link": "Journal run {run} in {path}",
     "re_import_journal": "Import journal run…",
     "sb_import_journal": "Import journal",
+    "sb_one_time_show": "One-time values",
+    "sb_one_time_title": "One-time values of the last run",
+    "sb_one_time_notice": (
+        "These values exist nowhere else and are shown this once. Copy what you need now: "
+        "closing this window, or starting another run, forgets them."
+    ),
+    "sb_one_time_step": "Step {step}",
+    "sb_one_time_copy": "Copy",
+    "sb_one_time_available": "{count} one-time value(s) available: press 'One-time values' to read them, once.",
+    "sb_one_time_nested": (
+        "Not available here: values issued inside a block ({commands}). "
+        "A block records no result for the commands in its body."
+    ),
     "jr_dialog_open": "Open action journal",
     "jr_dialog_start": "Journal file to append to",
     "jr_dialog_save_code": "Save candidate script",
diff --git a/je_auto_control/gui/language_wrapper/japanese.py b/je_auto_control/gui/language_wrapper/japanese.py
index 82711540..9035c560 100644
--- a/je_auto_control/gui/language_wrapper/japanese.py
+++ b/je_auto_control/gui/language_wrapper/japanese.py
@@ -871,6 +871,19 @@
     "rh_journal_link": "ジャーナル実行 {run}({path})",
     "re_import_journal": "ジャーナルの実行を取り込む…",
     "sb_import_journal": "ジャーナル取込",
+    "sb_one_time_show": "一度だけの値",
+    "sb_one_time_title": "前回の実行の一度だけの値",
+    "sb_one_time_notice": (
+        "これらの値は他のどこにも存在せず、今回だけ表示されます。必要な値を今コピーしてください。"
+        "このウィンドウを閉じるか次の実行を開始すると破棄されます。"
+    ),
+    "sb_one_time_step": "ステップ {step}",
+    "sb_one_time_copy": "コピー",
+    "sb_one_time_available": "一度だけの値が {count} 件あります。「一度だけの値」を押すと一度だけ確認できます。",
+    "sb_one_time_nested": (
+        "ここでは取得できません：ブロック内で発行された値（{commands}）。"
+        "ブロックは内部のコマンドの結果を記録しません。"
+    ),
     "jr_dialog_open": "アクションジャーナルを開く",
     "jr_dialog_start": "追記するジャーナルファイル",
     "jr_dialog_save_code": "候補スクリプトを保存",
diff --git a/je_auto_control/gui/language_wrapper/simplified_chinese.py b/je_auto_control/gui/language_wrapper/simplified_chinese.py
index 679add91..6b6acb21 100644
--- a/je_auto_control/gui/language_wrapper/simplified_chinese.py
+++ b/je_auto_control/gui/language_wrapper/simplified_chinese.py
@@ -841,6 +841,19 @@
     "rh_journal_link": "日志运行 {run},位于 {path}",
     "re_import_journal": "导入日志的运行…",
     "sb_import_journal": "导入日志",
+    "sb_one_time_show": "一次性的值",
+    "sb_one_time_title": "上次执行的一次性的值",
+    "sb_one_time_notice": (
+        "这些值不存在于其他任何地方，而且只显示这一次。请现在复制需要的值："
+        "关闭这个窗口或开始下一次执行后就会被丢弃。"
+    ),
+    "sb_one_time_step": "步骤 {step}",
+    "sb_one_time_copy": "复制",
+    "sb_one_time_available": "有 {count} 个一次性的值：按「一次性的值」查看，只能看一次。",
+    "sb_one_time_nested": (
+        "这里无法取得：在区块内产生的值（{commands}）。"
+        "区块不会记录其内部指令的结果。"
+    ),
     "jr_dialog_open": "打开动作日志",
     "jr_dialog_start": "要追加写入的日志文件",
     "jr_dialog_save_code": "保存候选脚本",
diff --git a/je_auto_control/gui/language_wrapper/traditional_chinese.py b/je_auto_control/gui/language_wrapper/traditional_chinese.py
index d150d24e..356f6eb3 100644
--- a/je_auto_control/gui/language_wrapper/traditional_chinese.py
+++ b/je_auto_control/gui/language_wrapper/traditional_chinese.py
@@ -848,6 +848,19 @@
     "rh_journal_link": "日誌執行 {run},位於 {path}",
     "re_import_journal": "匯入日誌的執行…",
     "sb_import_journal": "匯入日誌",
+    "sb_one_time_show": "一次性的值",
+    "sb_one_time_title": "上次執行的一次性的值",
+    "sb_one_time_notice": (
+        "這些值不存在於其他任何地方，而且只顯示這一次。請現在複製需要的值："
+        "關閉這個視窗或開始下一次執行後就會被捨棄。"
+    ),
+    "sb_one_time_step": "步驟 {step}",
+    "sb_one_time_copy": "複製",
+    "sb_one_time_available": "有 {count} 個一次性的值：按「一次性的值」查看，只能看一次。",
+    "sb_one_time_nested": (
+        "這裡無法取得：在區塊內產生的值（{commands}）。"
+        "區塊不會記錄其內部指令的結果。"
+    ),
     "jr_dialog_open": "開啟動作日誌",
     "jr_dialog_start": "要附加寫入的日誌檔",
     "jr_dialog_save_code": "儲存候選腳本",
diff --git a/je_auto_control/gui/script_builder/builder_tab.py b/je_auto_control/gui/script_builder/builder_tab.py
index 91818698..0a380500 100644
--- a/je_auto_control/gui/script_builder/builder_tab.py
+++ b/je_auto_control/gui/script_builder/builder_tab.py
@@ -2,10 +2,16 @@
 
 Run executes the steps off the GUI thread as a stoppable executor run, one at
 a time; Stop ends it at its next checkpoint.
+
+A step whose result carries a secret (``sensitive_result`` in the schema: a
+freshly issued token) is masked in the result pane. The values of the last
+run are kept in memory, and the "one-time values" button hands them to
+:class:`OneTimeValueDialog` -- once: the tab forgets them as it opens the
+dialog, when the next run starts and when it is disposed.
 """
 import functools
 import json
-from typing import Optional
+from typing import List, Optional
 
 from PySide6.QtCore import Qt
 from PySide6.QtGui import QAction
@@ -24,11 +30,12 @@
 from je_auto_control.gui.script_builder.command_schema import (
     CATEGORIES, COMMAND_SPECS, specs_in_category,
 )
+from je_auto_control.gui.script_builder.one_time_dialog import OneTimeValueDialog
 from je_auto_control.gui.script_builder.step_form_view import StepFormView
 from je_auto_control.gui.script_builder.step_list_view import StepTreeView
 from je_auto_control.gui.script_builder.step_model import (
-    Step, actions_to_steps, displayable_record, load_action_file, save_action_file,
-    steps_to_actions,
+    OneTimeValue, Step, actions_to_steps, displayable_record, load_action_file,
+    nested_sensitive_commands, one_time_values, save_action_file, steps_to_actions,
 )
 from je_auto_control.utils.exception.exceptions import AutoControlException
 from je_auto_control.utils.executor.action_executor import execute_action
@@ -58,6 +65,11 @@ def __init__(self, parent: Optional[QWidget] = None) -> None:
         # The other top-level keys of a loaded {"auto_control": [...]} file,
         # written back on Save; None for a bare list.
         self._file_extras: Optional[dict] = None
+        # The secrets of the last run, until they are revealed or the next run starts.
+        self._one_time: List[OneTimeValue] = []
+        self._nested_marked: List[str] = []
+        self._reveal_btn = QPushButton()
+        self._reveal_dialog: Optional[OneTimeValueDialog] = None
         self._runs = TabTask(self)
         self._runs.result.connect(self._show_run_result)
         self._runs.error.connect(self._show_run_error)
@@ -70,7 +82,7 @@ def dispose(self) -> None:
         A script run is stopped; other work cannot be interrupted, so it runs to its end and its
         result is dropped. Called by ``close_tab(key, release=True)``; safe to call twice.
         """
-        release_resources(self)
+        release_resources(self, self._forget_one_time)
 
     def retranslate(self) -> None:
         TranslatableMixin.retranslate(self)
@@ -111,6 +123,10 @@ def _build_toolbar(self) -> QHBoxLayout:
             btn = self._tr(QPushButton(), key)
             btn.clicked.connect(handler)
             bar.addWidget(btn)
+        self._tr(self._reveal_btn, "sb_one_time_show")
+        self._reveal_btn.setEnabled(False)
+        self._reveal_btn.clicked.connect(self._on_reveal)
+        bar.addWidget(self._reveal_btn)
         return bar
 
     def _add_button(self) -> QToolButton:
@@ -205,6 +221,8 @@ def _on_run(self) -> None:
         if not self._runs.start_script(functools.partial(_run_actions, actions)):
             self._result.setPlainText(_t("task_busy"))
             return
+        self._forget_one_time()
+        self._nested_marked = nested_sensitive_commands(actions)
         self._result.setPlainText(_t("task_running"))
 
     def _on_stop(self) -> None:
@@ -213,8 +231,43 @@ def _on_stop(self) -> None:
 
     def _show_run_result(self, result: object) -> None:
         # Masked first: AC_user_add / AC_user_rotate_token answer with a token.
-        self._result.setPlainText(json.dumps(
-            displayable_record(result), indent=2, default=str, ensure_ascii=False))
+        lines = [json.dumps(displayable_record(result), indent=2, default=str, ensure_ascii=False)]
+        self._one_time = one_time_values(result)
+        if self._one_time:
+            lines.append(_t("sb_one_time_available").format(count=len(self._one_time)))
+        if self._nested_marked:
+            lines.append(_t("sb_one_time_nested").format(commands=", ".join(self._nested_marked)))
+        self._result.setPlainText("\n\n".join(lines))
+        self._reveal_btn.setEnabled(bool(self._one_time))
+
+    def _forget_one_time(self) -> None:
+        """Drop the last run's secrets and close the dialog still showing them."""
+        self._one_time = []
+        self._reveal_btn.setEnabled(False)
+        dialog, self._reveal_dialog = self._reveal_dialog, None
+        if dialog is not None:
+            dialog.forget()
+            dialog.done(0)  # emits ``finished`` even when it was never shown
+
+    def _take_one_time_dialog(self) -> Optional[OneTimeValueDialog]:
+        """Build the reveal dialog for the pending values and forget them here; not shown yet."""
+        if not self._one_time:
+            return None
+        values, self._one_time = self._one_time, []
+        self._reveal_btn.setEnabled(False)
+        dialog = OneTimeValueDialog(values, self)
+        dialog.finished.connect(dialog.deleteLater)
+        dialog.finished.connect(self._on_reveal_closed)
+        self._reveal_dialog = dialog
+        return dialog
+
+    def _on_reveal(self) -> None:
+        dialog = self._take_one_time_dialog()
+        if dialog is not None:
+            dialog.open()  # window-modal without a nested event loop
+
+    def _on_reveal_closed(self, _result: int = 0) -> None:
+        self._reveal_dialog = None
 
     def _show_run_error(self, error: object) -> None:
         if was_stopped(error):
diff --git a/je_auto_control/gui/script_builder/command_schema.py b/je_auto_control/gui/script_builder/command_schema.py
index 6b1cfb15..adaa7624 100644
--- a/je_auto_control/gui/script_builder/command_schema.py
+++ b/je_auto_control/gui/script_builder/command_schema.py
@@ -42,7 +42,8 @@ class CommandSpec:
     body_keys: Tuple[str, ...] = ()
     description: str = ""
     #: The command's result carries a secret that exists nowhere else (a
-    #: freshly issued token). The builder masks it before displaying a run.
+    #: freshly issued token). The builder masks it before displaying a run and
+    #: offers it once through its one-time reveal.
     sensitive_result: bool = False
 
 
@@ -2872,7 +2873,9 @@ def _add_misc_specs(specs: List[CommandSpec]) -> None:
                       placeholder="HS256",
                       choices=("HS256", "HS384", "HS512")),
         ),
-        description="Sign a compact JWT (HMAC) from claims; returns {token}.",
+        description="Sign a compact JWT (HMAC) from claims; returns {token}. This builder masks "
+                    "the token -- read it with 'One-time values' after the run.",
+        sensitive_result=True,
     ))
     specs.append(CommandSpec(
         "AC_jwt_decode", "Security", "JWT: Verify Token",
@@ -5344,7 +5347,7 @@ def _add_user_specs(specs: List[CommandSpec]) -> None:
                            placeholder="default: JE_AUTOCONTROL_RBAC_USERS")
     roles = ("viewer", "operator", "admin")
     token_note = (" The token is in the run's record once; this builder masks it -- "
-                  "run the step from a script, REST or the CLI to read it.")
+                  "read it with 'One-time values' after the run (top-level steps only).")
     specs.append(CommandSpec(
         "AC_user_add", "Security", "User: Add",
         fields=(
diff --git a/je_auto_control/gui/script_builder/one_time_dialog.py b/je_auto_control/gui/script_builder/one_time_dialog.py
new file mode 100644
index 00000000..66d43ed4
--- /dev/null
+++ b/je_auto_control/gui/script_builder/one_time_dialog.py
@@ -0,0 +1,102 @@
+"""The Script Builder's one-time reveal of the secrets a run produced.
+
+``AC_user_add`` and ``AC_user_rotate_token`` answer with a bearer token that
+exists nowhere else, and the builder masks it in its result pane. This dialog
+is where the person who ran the step reads and copies it, once: each value is
+in a read-only field labelled by its step -- the presentation the Users (RBAC)
+group uses for a new token -- and closing the dialog empties the fields and
+drops the values. Nothing here logs, saves or records a value; the only way
+one leaves the dialog is the Copy button, onto the clipboard.
+
+The tab opens it with ``open()`` (window-modal, not a nested event loop), only
+when its "one-time values" button is pressed.
+"""
+from typing import List, Optional, Sequence
+
+from PySide6.QtGui import QGuiApplication
+from PySide6.QtWidgets import (
+    QDialog, QDialogButtonBox, QGridLayout, QLabel, QLineEdit, QPushButton,
+    QVBoxLayout, QWidget,
+)
+
+from je_auto_control.gui.language_wrapper.multi_language_wrapper import (
+    language_wrapper,
+)
+from je_auto_control.gui.script_builder.command_schema import COMMAND_SPECS
+from je_auto_control.gui.script_builder.step_model import OneTimeValue
+
+
+def _t(key: str) -> str:
+    return str(language_wrapper.translate(key, key))
+
+
+def _copy_to_clipboard(text: str) -> None:
+    """Put ``text`` on the clipboard; the one place a value leaves the dialog."""
+    QGuiApplication.clipboard().setText(text)
+
+
+def value_label(value: OneTimeValue) -> str:
+    """What names ``value`` in the dialog: its step, its command and whom it is for."""
+    spec = COMMAND_SPECS.get(value.command)
+    parts = [_t("sb_one_time_step").format(step=value.step),
+             spec.label if spec is not None else value.command,
+             value.subject, value.name]
+    return " · ".join(part for part in parts if part)
+
+
+class OneTimeValueDialog(QDialog):
+    """Shows each value of a run once; forgets them all when it closes."""
+
+    def __init__(self, values: Sequence[OneTimeValue],
+                 parent: Optional[QWidget] = None) -> None:
+        super().__init__(parent)
+        self.setWindowTitle(_t("sb_one_time_title"))
+        self._values: List[OneTimeValue] = list(values)
+        self._fields: List[QLineEdit] = []
+        root = QVBoxLayout(self)
+        notice = QLabel(_t("sb_one_time_notice"))
+        notice.setWordWrap(True)
+        root.addWidget(notice)
+        grid = QGridLayout()
+        for row, value in enumerate(self._values):
+            self._add_row(grid, row, value)
+        root.addLayout(grid)
+        buttons = QDialogButtonBox(QDialogButtonBox.StandardButton.Close)
+        buttons.rejected.connect(self.reject)
+        root.addWidget(buttons)
+        self.setMinimumWidth(560)
+        self.finished.connect(self.forget)
+
+    def _add_row(self, grid: QGridLayout, row: int, value: OneTimeValue) -> None:
+        field = QLineEdit(value.value)
+        field.setReadOnly(True)
+        copy = QPushButton(_t("sb_one_time_copy"))
+        copy.clicked.connect(lambda _checked=False, index=row: self.copy_value(index))
+        grid.addWidget(QLabel(value_label(value)), row, 0)
+        grid.addWidget(field, row, 1)
+        grid.addWidget(copy, row, 2)
+        self._fields.append(field)
+
+    def labels(self) -> List[str]:
+        """The label of each value still held, in the order shown."""
+        return [value_label(value) for value in self._values]
+
+    def shown_values(self) -> List[str]:
+        """The text of each value field, in the order shown."""
+        return [field.text() for field in self._fields]
+
+    def copy_value(self, index: int) -> bool:
+        """Copy value ``index`` to the clipboard; ``False`` once it is forgotten."""
+        if not 0 <= index < len(self._values):
+            return False
+        _copy_to_clipboard(self._values[index].value)
+        return True
+
+    def forget(self, _result: int = 0) -> None:
+        """Empty every field and drop the values; runs when the dialog closes."""
+        for field in self._fields:
+            field.setText("")  # also resets the field's undo history
+        self._values = []
+
+
+__all__ = ["OneTimeValueDialog", "value_label"]
diff --git a/je_auto_control/gui/script_builder/step_model.py b/je_auto_control/gui/script_builder/step_model.py
index f4d43bd0..091be160 100644
--- a/je_auto_control/gui/script_builder/step_model.py
+++ b/je_auto_control/gui/script_builder/step_model.py
@@ -1,11 +1,14 @@
 """Step data model and (de)serialisation between the tree view and AC JSON.
 
 Also what the builder may show of a run: :func:`displayable_record` masks the
-results of commands whose schema entry is marked ``sensitive_result``.
+results of commands whose schema entry is marked ``sensitive_result``, and
+:func:`one_time_values` lists what it masked, for the builder's one-time
+reveal. Neither writes anything anywhere; both are free of Qt.
 """
+import json
 import re
 from dataclasses import dataclass, field
-from typing import Any, Dict, List, Mapping, Optional, Tuple
+from typing import Any, Dict, Iterator, List, Mapping, Optional, Set, Tuple
 
 from je_auto_control.gui.script_builder.command_schema import COMMAND_SPECS
 from je_auto_control.utils.executor.action_redaction import SENSITIVE_ARGUMENT_NAMES
@@ -63,15 +66,105 @@ def displayable_record(record: Any) -> Any:
         return record
     shown: Dict[Any, Any] = {}
     for key, value in record.items():
-        match = _RECORD_COMMAND.match(key) if isinstance(key, str) else None
-        spec = COMMAND_SPECS.get(match.group(1)) if match is not None else None
-        if spec is not None and spec.sensitive_result:
+        if _marked_command(key) is not None:
             shown[key] = _without_secrets(value)
         else:
             shown[key] = displayable_record(value)
     return shown
 
 
+def _marked_command(key: Any) -> Optional[str]:
+    """The command of record key ``key`` when its result is marked sensitive."""
+    match = _RECORD_COMMAND.match(key) if isinstance(key, str) else None
+    if match is None:
+        return None
+    spec = COMMAND_SPECS.get(match.group(1))
+    return match.group(1) if spec is not None and spec.sensitive_result else None
+
+
+@dataclass(frozen=True)
+class OneTimeValue:
+    """One secret a run produced, with what identifies the step that produced it.
+
+    ``step`` is the 1-based position of the top-level step in the run,
+    ``subject`` what the command acted on (the user id) and ``name`` the
+    result field that held the value. ``value`` is left out of the text form,
+    so formatting or logging the object never prints it.
+    """
+    step: int
+    command: str
+    subject: str
+    name: str
+    value: str = field(repr=False)
+
+
+def one_time_values(record: Any) -> List[OneTimeValue]:
+    """Every secret :func:`displayable_record` would mask in ``record``, in run order.
+
+    A command that failed (its result is the error's text) produced none. The
+    record is only read.
+    """
+    found: List[OneTimeValue] = []
+    if isinstance(record, dict):
+        for position, (key, value) in enumerate(record.items(), start=1):
+            _collect_secrets(key, value, position, found)
+    return found
+
+
+def _collect_secrets(key: Any, value: Any, step: int, found: List[OneTimeValue]) -> None:
+    command = _marked_command(key)
+    if command is not None:
+        found.extend(_secrets_of(step, command, value))
+        return
+    for nested_key, nested in _entries(value):
+        _collect_secrets(nested_key, nested, step, found)
+
+
+def _entries(value: Any) -> Iterator[Tuple[Any, Any]]:
+    """The ``(key, item)`` pairs of a container; a list's items have no key."""
+    if isinstance(value, dict):
+        yield from value.items()
+    elif isinstance(value, list):
+        for item in value:
+            yield None, item
+
+
+def _secrets_of(step: int, command: str, value: Any) -> List[OneTimeValue]:
+    """What a marked command's result holds that the display hides."""
+    if value is None or isinstance(value, str):
+        return []
+    if not isinstance(value, dict):
+        text = json.dumps(value, default=str, ensure_ascii=False)
+        return [OneTimeValue(step, command, "", "", text)]
+    subject = str(value.get("user_id", ""))
+    return [OneTimeValue(step, command, subject, str(name), str(item))
+            for name, item in value.items()
+            if str(name).lower() in SENSITIVE_ARGUMENT_NAMES and item not in (None, "")]
+
+
+def nested_sensitive_commands(actions: Any) -> List[str]:
+    """The marked commands that sit inside a block of ``actions``, sorted.
+
+    A block (``AC_loop``, ``AC_if_*``, ``AC_try``...) records its own summary,
+    not the results of the commands in its body, so a secret issued there is in
+    no record and cannot be revealed afterwards.
+    """
+    names: Set[str] = set()
+    for action in actions if isinstance(actions, list) else []:
+        for argument in action[1:] if isinstance(action, list) else []:
+            _nested_marked(argument, names)
+    return sorted(names)
+
+
+def _nested_marked(value: Any, names: Set[str]) -> None:
+    if isinstance(value, list) and value and isinstance(value[0], str) and value[0] in COMMAND_SPECS:
+        if COMMAND_SPECS[value[0]].sensitive_result:
+            names.add(value[0])
+        value = value[1:]
+    for _key, item in _entries(value):
+        _nested_marked(item, names)
+
+
 def _without_secrets(value: Any) -> Any:
     """``value`` with its secret-named fields masked; hidden whole when it has no fields."""
     if isinstance(value, str):
diff --git a/je_auto_control/utils/chatops/__init__.py b/je_auto_control/utils/chatops/__init__.py
index fa7689d5..e629dbdf 100644
--- a/je_auto_control/utils/chatops/__init__.py
+++ b/je_auto_control/utils/chatops/__init__.py
@@ -16,7 +16,8 @@
     bot.run_forever()
 """
 from je_auto_control.utils.chatops.handlers import (
-    cmd_run, cmd_screenshot, cmd_scripts, cmd_status,
+    CHATOPS_RUN_PREFIX, chatops_run_id,
+    cmd_run, cmd_screenshot, cmd_scripts, cmd_status, cmd_stop,
     register_default_commands as register_chatops_default_commands,
 )
 from je_auto_control.utils.chatops.router import (
@@ -29,8 +30,8 @@
 
 
 __all__ = [
-    "ChatOpsError", "CommandHandler", "CommandResult", "CommandRouter",
-    "CommandSpec", "SlackBot", "SlackError",
-    "cmd_run", "cmd_screenshot", "cmd_scripts", "cmd_status",
+    "CHATOPS_RUN_PREFIX", "ChatOpsError", "CommandHandler", "CommandResult",
+    "CommandRouter", "CommandSpec", "SlackBot", "SlackError", "chatops_run_id",
+    "cmd_run", "cmd_screenshot", "cmd_scripts", "cmd_status", "cmd_stop",
     "make_default_slack_bot", "register_chatops_default_commands",
 ]
diff --git a/je_auto_control/utils/chatops/handlers.py b/je_auto_control/utils/chatops/handlers.py
index b918a6d4..e9f07b96 100644
--- a/je_auto_control/utils/chatops/handlers.py
+++ b/je_auto_control/utils/chatops/handlers.py
@@ -3,20 +3,46 @@
 Each function takes ``(argv, context)`` and returns a
 :class:`CommandResult`. Stitched into a :class:`CommandRouter` by
 :func:`register_default_commands` so the bot ships with a usable set
-of verbs out of the box (``/run``, ``/scripts``, ``/status``,
+of verbs out of the box (``/run``, ``/stop``, ``/scripts``, ``/status``,
 ``/screenshot``).
+
+``/run`` is a stoppable run named ``chatops-<script>-<id>``: it is listed by
+``AC_list_executions`` and ended by ``AC_stop_execution``, the MCP
+``ac_stop_execution`` tool, the GUI's stop-all and ``/stop``. A stop-all that
+names no run therefore also ends runs started from chat.
 """
 from __future__ import annotations
 
 import json
 import os
+import re
 import tempfile
+import uuid
 from pathlib import Path
-from typing import Any, Dict, List
+from typing import Any, Dict, List, Optional
 
 from je_auto_control.utils.chatops.router import (
     ChatOpsError, CommandResult, CommandRouter,
 )
+from je_auto_control.utils.executor.run_control import (
+    active_executions, current_stop_token, stop_execution, stoppable_run,
+)
+
+#: What the ``run_id`` of every run started by ``/run`` begins with.
+CHATOPS_RUN_PREFIX = "chatops-"
+
+_UNSAFE_ID_CHARS = re.compile(r"[^A-Za-z0-9_.-]+")
+
+
+def chatops_run_id(script_name: str) -> str:
+    """A new run id for a ``/run`` of ``script_name``: ``chatops-<stem>-<8 hex>``.
+
+    The stem is reduced to letters, digits, ``_``, ``.`` and ``-`` so the id
+    can be typed back as one word (``/stop <run-id>``); the suffix keeps two
+    runs of the same script apart.
+    """
+    stem = _UNSAFE_ID_CHARS.sub("_", Path(script_name).stem).strip("_") or "script"
+    return f"{CHATOPS_RUN_PREFIX}{stem[:40]}-{uuid.uuid4().hex[:8]}"
 
 
 def _require_script_root(context: Dict[str, Any]) -> Path:
@@ -49,7 +75,13 @@ def _resolve_script(root: Path, name: str) -> Path:
 
 
 def cmd_run(argv: List[str], context: Dict[str, Any]) -> CommandResult:
-    """``/run <script-name>`` — execute one JSON action file."""
+    """``/run <script-name>`` — execute one JSON action file as a stoppable run.
+
+    The run is registered as ``chatops-<script>-<id>`` for as long as it
+    lasts. Inside a run that is already stoppable (the GUI's Chat-Ops tab
+    starts one for its own Stop command) it joins that run instead, so the
+    stop that already existed keeps working.
+    """
     if not argv:
         raise ChatOpsError("usage: /run <script-name>")
     if len(argv) > 1:
@@ -60,14 +92,54 @@ def cmd_run(argv: List[str], context: Dict[str, Any]) -> CommandResult:
     script_path = _resolve_script(root, argv[0])
     from je_auto_control.utils.executor.action_executor import execute_files
     from je_auto_control.utils.script_vars.execution import execution_scope
-    with execution_scope():  # one /run, one variable scope
+    run_id = None if current_stop_token() is not None else chatops_run_id(script_path.name)
+    with stoppable_run(run_id) as token, execution_scope():  # one /run, one variable scope
         result = execute_files([str(script_path)])
     return CommandResult(
         text=f"ran {script_path.name}: {len(result)} action(s) executed",
-        metadata={"script": str(script_path), "results": _safe(result)},
+        metadata={"script": str(script_path), "results": _safe(result),
+                  "run_id": token.run_id},
     )
 
 
+def cmd_stop(argv: List[str], context: Dict[str, Any]) -> CommandResult:
+    """``/stop [run-id]`` — ask a stoppable run to stop.
+
+    Without an argument only the runs ``/run`` started are asked (their ids
+    begin with ``chatops-``); a run started elsewhere has to be named. The
+    reply comes at once: a run ends at its next checkpoint, on its own thread.
+    """
+    if len(argv) > 1:
+        raise ChatOpsError("usage: /stop [run-id]")
+    named = argv[0] if argv else None
+    user = context.get("slack_user")
+    reason = f"stopped from chat by {user}" if user else "stopped from chat"
+    active = [str(run["run_id"]) for run in active_executions()]
+    asked = [run_id for run_id in _stop_targets(named, active)
+             if stop_execution(run_id, reason=reason)]
+    metadata = {"stopped": asked, "active": active}
+    if asked:
+        return CommandResult(text="stop requested: " + ", ".join(asked), metadata=metadata)
+    return CommandResult(text=_nothing_to_stop(named, active), succeeded=False,
+                         metadata=metadata)
+
+
+def _stop_targets(named: Optional[str], active: List[str]) -> List[str]:
+    """The active runs ``/stop`` addresses: the one named, else the chat-started ones."""
+    if named is not None:
+        return [named] if named in active else []
+    return [run_id for run_id in active if run_id.startswith(CHATOPS_RUN_PREFIX)]
+
+
+def _nothing_to_stop(named: Optional[str], active: List[str]) -> str:
+    """The reply when ``/stop`` found no run, naming the runs it did not touch."""
+    what = (f"no run named {named!r} is in progress." if named is not None
+            else "no chat-started run is in progress.")
+    if not active:
+        return what
+    return f"{what} Other runs in progress: {', '.join(active)} (/stop <run-id>)."
+
+
 def cmd_scripts(_argv: List[str],
                 context: Dict[str, Any]) -> CommandResult:
     """``/scripts`` — list every script available under the configured root."""
@@ -139,9 +211,11 @@ def cmd_screenshot(argv: List[str],
 
 
 def register_default_commands(router: CommandRouter) -> CommandRouter:
-    """Register the four standard handlers in one call."""
+    """Register the five standard handlers in one call."""
     router.register("run", cmd_run,
                     description="Run a script under script_root.")
+    router.register("stop", cmd_stop,
+                    description="Stop the chat-started runs, or the run named.")
     router.register("scripts", cmd_scripts,
                     description="List every script available to /run.")
     router.register("status", cmd_status,
@@ -161,6 +235,7 @@ def _safe(value: Any) -> Any:
 
 
 __all__ = [
-    "cmd_run", "cmd_scripts", "cmd_screenshot", "cmd_status",
+    "CHATOPS_RUN_PREFIX", "chatops_run_id",
+    "cmd_run", "cmd_scripts", "cmd_screenshot", "cmd_status", "cmd_stop",
     "register_default_commands",
 ]
diff --git a/je_auto_control/utils/config_sync/client.py b/je_auto_control/utils/config_sync/client.py
index 662e4718..1498e595 100644
--- a/je_auto_control/utils/config_sync/client.py
+++ b/je_auto_control/utils/config_sync/client.py
@@ -226,11 +226,12 @@ def push_operations(self, operations: Sequence["SyncOperation"], *, device_id: s
         commits against the fetched revision -- fetching again when another
         device got there first, up to ``max_attempts`` times. Applying the
         same operations twice changes nothing, so a batch can be resent
-        after an uncertain failure. With no operations this still pushes
-        when the bucket holds a deletion this device has not acknowledged,
-        or to list a device the bucket does not know yet -- unless the
-        bucket holds no entries, when there is nothing to commit and
-        ``pushed`` is false.
+        after an uncertain failure. With no operations this pushes only
+        when the bucket lists this device and holds a deletion it has not
+        acknowledged; otherwise nothing is committed and ``pushed`` is
+        false. In particular a device the bucket does not list yet is not
+        recorded for merely reading it: it joins ``peers`` with the first
+        change it commits.
 
         Raises :class:`FullResyncRequired` when the group has retired this
         device. ``max_offline_s`` retires peers not seen for that long.
diff --git a/je_auto_control/utils/config_sync/merge.py b/je_auto_control/utils/config_sync/merge.py
index b97148b6..7bdf12de 100644
--- a/je_auto_control/utils/config_sync/merge.py
+++ b/je_auto_control/utils/config_sync/merge.py
@@ -200,16 +200,22 @@ def apply_operation(bucket: ConfigBucket, operation: SyncOperation,
 def awaits_ack(bucket: ConfigBucket, device_id: str) -> bool:
     """Whether ``bucket`` needs a write from ``device_id`` that carries no change.
 
-    A device already listed under ``peers`` owes one while a tombstone waits
-    for its acknowledgement. A device not listed yet owes one to *join* --
-    so that later deletions wait for it -- but only when the bucket holds
-    versioned entries: with none there is nothing whose deletion could be
-    forgotten before this device saw it, and the write would be an empty
-    revision.
+    Only a device already listed under ``peers`` can owe one, and only while
+    a tombstone waits for its acknowledgement. A device the bucket does not
+    list owes nothing: joining is not worth a revision of its own. It is
+    listed by the first change it commits, and until then a deletion reaches
+    it through the tombstone, which is held for
+    :data:`~je_auto_control.utils.config_sync.versions.TOMBSTONE_HOLD_S`
+    after every listed device acknowledged it.
+
+    What that gives up: an unlisted device that edits an entry and first
+    sends the edit after the hold has run out re-creates an entry deleted in
+    the meantime, with no conflict. (A copy it did not touch is still
+    removed -- its own baseline shows the entry was deleted elsewhere.)
     """
     peer = bucket.peer_states().get(device_id)
     if peer is None:
-        return any(bucket.sync_entries(section) for section in bucket.sections)
+        return False
     return any(entry.deleted and entry.deleted_revision > peer.acked_revision
                for section in bucket.sections
                for entry in bucket.sync_entries(section).values())
diff --git a/je_auto_control/utils/executor/action_executor.py b/je_auto_control/utils/executor/action_executor.py
index bdb93746..25468817 100644
--- a/je_auto_control/utils/executor/action_executor.py
+++ b/je_auto_control/utils/executor/action_executor.py
@@ -8517,7 +8517,8 @@ def _execute_list(self, action_list: Union[list, dict], raise_on_error: bool,
                     signal, execute_record_dict, raise_on_error, key)
 
         for key, value in execute_record_dict.items():
-            autocontrol_logger.info("%s -> %s", key, value)
+            # Masked by field name: a minted token (AC_jwt_encode, a lease) is a result, not an argument.
+            autocontrol_logger.info("%s -> %s", key, redact_actions(value))
         return execute_record_dict
 
     @staticmethod
diff --git a/je_auto_control/utils/mcp_server/plugin_watcher.py b/je_auto_control/utils/mcp_server/plugin_watcher.py
index 780b3521..1f95efa3 100644
--- a/je_auto_control/utils/mcp_server/plugin_watcher.py
+++ b/je_auto_control/utils/mcp_server/plugin_watcher.py
@@ -12,7 +12,7 @@
 
 from je_auto_control.utils.logging.logging_instance import autocontrol_logger
 from je_auto_control.utils.mcp_server.tools.plugin_tools import (
-    make_plugin_tool,
+    log_read_only_declaration, make_plugin_tool,
 )
 
 
@@ -107,6 +107,7 @@ def _reload_file(self, path: str, mtime: float) -> None:
         registered: List[str] = []
         for tool in tools:
             self._server.register_tool(tool)
+            log_read_only_declaration(tool)
             registered.append(tool.name)
         self._known[path] = (mtime, registered)
         autocontrol_logger.info(
diff --git a/je_auto_control/utils/mcp_server/tools/plugin_tools.py b/je_auto_control/utils/mcp_server/tools/plugin_tools.py
index 7d350b31..1d42b3c3 100644
--- a/je_auto_control/utils/mcp_server/tools/plugin_tools.py
+++ b/je_auto_control/utils/mcp_server/tools/plugin_tools.py
@@ -5,14 +5,66 @@
 dynamic catalogue into the live MCP server so a plugin a user drops
 into their plugin directory shows up as a tool the model can call,
 and the client gets notified to refresh its tool list.
+
+A plugin tool is registered as mutating (``DESTRUCTIVE``) unless the plugin
+says otherwise: a callable whose ``mcp_read_only`` attribute is exactly
+``True`` is registered read-only, which is what lets it run on a read-only
+server and makes it need only ``read_screen`` under RBAC. That is the plugin
+author's word and nothing checks it -- the server cannot tell what arbitrary
+Python does -- so each declaration is logged when the tool is registered.
+Anything other than the boolean ``True`` (``"yes"``, ``1``, a callable, an
+attribute that raises) leaves the tool mutating.
 """
 import inspect
 from typing import Any, Callable, Dict, List
 
+from je_auto_control.utils.logging.logging_instance import autocontrol_logger
 from je_auto_control.utils.mcp_server.tools._base import (
-    DESTRUCTIVE, MCPTool, schema,
+    DESTRUCTIVE, MCPTool, MCPToolAnnotations, schema,
 )
 
+#: Attribute a plugin sets to ``True`` on a callable to declare it read-only.
+PLUGIN_READ_ONLY_ATTRIBUTE = "mcp_read_only"
+
+#: Annotations of a plugin tool that declared itself read-only. Only the
+#: read-only hint is the plugin's claim; idempotence was not declared.
+PLUGIN_READ_ONLY = MCPToolAnnotations(read_only=True)
+
+_UNSET = object()
+
+
+def plugin_declares_read_only(handler: Callable[..., Any]) -> bool:
+    """Whether ``handler`` carries ``mcp_read_only = True``, and nothing looser.
+
+    The declaration is trusted, not verified. A value that is present but is
+    not a boolean is logged and treated as no declaration, so a typo fails
+    towards the tool staying mutating.
+    """
+    try:
+        declared = getattr(handler, PLUGIN_READ_ONLY_ATTRIBUTE, _UNSET)
+    except Exception as error:  # noqa: BLE001  # reason: untrusted plugin object; raising means undeclared
+        autocontrol_logger.warning(
+            "plugin %r: reading %s raised %r; the tool stays mutating",
+            getattr(handler, "__name__", handler), PLUGIN_READ_ONLY_ATTRIBUTE, error)
+        return False
+    if declared is True:
+        return True
+    if declared is not _UNSET and declared is not False:
+        autocontrol_logger.warning(
+            "plugin %r: %s must be the boolean True, not %s; the tool stays mutating",
+            getattr(handler, "__name__", handler), PLUGIN_READ_ONLY_ATTRIBUTE,
+            type(declared).__name__)
+    return False
+
+
+def log_read_only_declaration(tool: MCPTool) -> None:
+    """Log that the plugin tool ``tool`` is registered on its own read-only claim."""
+    if tool.annotations.read_only:
+        autocontrol_logger.warning(
+            "plugin tool %r is registered read-only because its plugin declared "
+            "%s=True; the declaration is trusted, not verified",
+            tool.name, PLUGIN_READ_ONLY_ATTRIBUTE)
+
 
 def make_plugin_tool(name: str,
                      handler: Callable[..., Any],
@@ -22,7 +74,8 @@ def make_plugin_tool(name: str,
     The schema is derived from ``inspect.signature(handler)``: every
     parameter becomes a property, parameters without defaults are
     marked required, and a parameter named ``ctx`` is excluded so
-    progress / cancellation context plumbing keeps working.
+    progress / cancellation context plumbing keeps working. The tool is
+    mutating unless :func:`plugin_declares_read_only` says otherwise.
     """
     properties, required = _properties_from_signature(handler)
     tool_name = f"plugin_{name.lower()}" if not name.lower().startswith(
@@ -37,7 +90,7 @@ def make_plugin_tool(name: str,
         description=desc,
         input_schema=schema(properties, required=required or None),
         handler=handler,
-        annotations=DESTRUCTIVE,
+        annotations=PLUGIN_READ_ONLY if plugin_declares_read_only(handler) else DESTRUCTIVE,
     )
 
 
@@ -45,12 +98,14 @@ def register_plugin_tools(server, commands: Dict[str, Callable[..., Any]]
                            ) -> List[str]:
     """Wrap each entry in ``commands`` and add it to ``server``.
 
-    Returns the list of MCP tool names that were registered.
+    Returns the list of MCP tool names that were registered. A tool whose
+    plugin declared it read-only is logged by name.
     """
     registered: List[str] = []
     for raw_name, handler in commands.items():
         tool = make_plugin_tool(raw_name, handler)
         server.register_tool(tool)
+        log_read_only_declaration(tool)
         registered.append(tool.name)
     return registered
 
@@ -86,4 +141,7 @@ def _properties_from_signature(handler: Callable[..., Any]
     return properties, required
 
 
-__all__ = ["make_plugin_tool", "register_plugin_tools"]
+__all__ = [
+    "PLUGIN_READ_ONLY", "PLUGIN_READ_ONLY_ATTRIBUTE", "log_read_only_declaration",
+    "make_plugin_tool", "plugin_declares_read_only", "register_plugin_tools",
+]
diff --git a/je_auto_control/utils/rbac/policy.py b/je_auto_control/utils/rbac/policy.py
index e836bb55..1f214d55 100644
--- a/je_auto_control/utils/rbac/policy.py
+++ b/je_auto_control/utils/rbac/policy.py
@@ -127,12 +127,36 @@
 #: Read-only MCP tools that expose data rather than screen state. "Read-only"
 #: says a tool changes nothing; it does not say that what it returns is
 #: something a viewer of the desktop was meant to see.
+#:
+#: The rule: a tool that returns records or configuration the host keeps --
+#: history, traces, cost ledgers, healing logs, journals, saved libraries, ACL
+#: contents -- is listed here; a tool that only observes the live screen (or
+#: computes on what the caller sent) is not. What a tool costs to run is a
+#: separate question this table does not answer: ``ac_vlm_locate`` and
+#: ``ac_self_heal_locate`` read the screen and stay ``read_screen`` although a
+#: call may be billed by a model provider.
 DATA_TOOLS = frozenset({
-    # the clipboard and its history
+    # the clipboard and its history, a connected device's included
     "ac_get_clipboard", "ac_get_clipboard_csv", "ac_get_clipboard_files",
     "ac_get_clipboard_html", "ac_get_clipboard_image", "ac_get_clipboard_rtf",
     "ac_clipboard_formats", "ac_assert_clipboard",
     "ac_clip_history_list", "ac_clip_history_search",
+    "ac_android_get_clipboard", "ac_ios_get_clipboard",
+    # records the host keeps of what ran: run history and what is derived
+    # from it, agent traces, the cost ledger, action journals
+    "ac_list_run_history", "ac_flaky_report", "ac_rank_tests", "ac_select_tests",
+    "ac_shard_suite", "ac_trace_export", "ac_trace_summary",
+    "ac_costs_list", "ac_costs_summary", "ac_journal_read", "ac_journal_runs",
+    # the self-healing log, its statistics, stored revisions and datasets;
+    # locator strategy history and repairs; saved locators and skills
+    "ac_self_heal_log_list", "ac_heal_stats", "ac_self_heal_revision_list",
+    "ac_self_heal_evaluate", "ac_ab_report", "ac_ab_best_strategy",
+    "ac_repair_pending", "ac_repair_resolved", "ac_element_list",
+    "ac_skill_list", "ac_skill_search",
+    # stored policy and state: the USB ACL, lease tokens, quarantine,
+    # artifacts awaiting approval, the recorded config-sync state
+    "ac_usb_acl_list", "ac_lease_active", "ac_quarantine_list",
+    "ac_pending_artifacts", "ac_config_sync_status",
     # files: their content, or an oracle on it (substring, digest)
     "ac_load_dotenv", "ac_load_data", "ac_read_action_file", "ac_read_document",
     "ac_read_presentation", "ac_read_workbook", "ac_extract_pdf_text",
diff --git a/pyproject.toml b/pyproject.toml
index a531e43e..ce4e523b 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -364,6 +364,7 @@ module = [
     "je_auto_control.gui.remote_desktop.webrtc_viewer_files",
     "je_auto_control.gui.remote_desktop.webrtc_viewer_media",
     "je_auto_control.gui.remote_desktop.webrtc_viewer_ui",
+    "je_auto_control.gui.script_builder.one_time_dialog",
     "je_auto_control.gui.tab_registry",
     "je_auto_control.gui.task_controller",
     "je_auto_control.gui.theme",
diff --git a/test/unit_test/headless/test_chatops_stoppable_run.py b/test/unit_test/headless/test_chatops_stoppable_run.py
new file mode 100644
index 00000000..199c8e04
--- /dev/null
+++ b/test/unit_test/headless/test_chatops_stoppable_run.py
@@ -0,0 +1,188 @@
+"""A ChatOps ``/run`` is a stoppable run, and ``/stop`` ends it.
+
+``/run`` used to be stoppable only when the script itself contained an
+``AC_run_stoppable`` block: ``AC_stop_execution``, the MCP stop tool and the
+GUI's stop-all had nothing to address. The scripts here run fake commands that
+wait on the stop-aware ``pause`` -- no input, no screen.
+"""
+import json
+import threading
+
+import pytest
+
+from je_auto_control.utils.chatops import (
+    CHATOPS_RUN_PREFIX, CommandRouter, chatops_run_id, cmd_stop,
+    register_chatops_default_commands,
+)
+from je_auto_control.utils.executor.action_executor import executor
+from je_auto_control.utils.executor.run_control import (
+    active_executions, pause, stop_execution, stoppable_run,
+)
+
+_WAIT = 10.0
+_LONG = 120.0
+
+
+class _Script:
+    """Fake commands: one that waits until it is stopped, one that only marks."""
+
+    def __init__(self):
+        self.entered = threading.Event()
+        self.after = []
+        self.seen_ids = []
+
+    def held(self):
+        self.seen_ids.extend(run["run_id"] for run in active_executions())
+        self.entered.set()
+        pause(_LONG)
+
+    def mark(self):
+        self.seen_ids.extend(run["run_id"] for run in active_executions())
+        self.after.append("ran")
+
+
+@pytest.fixture()
+def script(monkeypatch):
+    fake = _Script()
+    monkeypatch.setitem(executor.event_dict, "AC_fake_chat_held", fake.held)
+    monkeypatch.setitem(executor.event_dict, "AC_fake_chat_mark", fake.mark)
+    yield fake
+    stop_execution()
+    assert active_executions() == [], "a chat run outlived its test"
+
+
+@pytest.fixture()
+def root(tmp_path):
+    (tmp_path / "long job.json").write_text(
+        json.dumps([["AC_fake_chat_held"], ["AC_fake_chat_mark"]]), encoding="utf-8")
+    (tmp_path / "quick.json").write_text(json.dumps([["AC_fake_chat_mark"]]), encoding="utf-8")
+    return tmp_path
+
+
+def _router() -> CommandRouter:
+    return register_chatops_default_commands(CommandRouter())
+
+
+class _Background:
+    """Dispatch one chat message on another thread and keep its reply."""
+
+    def __init__(self, router, message, context):
+        self.reply = None
+        self._thread = threading.Thread(
+            target=self._run, args=(router, message, context), daemon=True)
+        self._thread.start()
+
+    def _run(self, router, message, context):
+        self.reply = router.dispatch(message, context=context)
+
+    def result(self):
+        self._thread.join(_WAIT)
+        assert not self._thread.is_alive(), "the chat run did not end"
+        return self.reply
+
+
+def _chat_runs():
+    return [run["run_id"] for run in active_executions()
+            if run["run_id"].startswith(CHATOPS_RUN_PREFIX)]
+
+
+def test_the_run_id_names_the_script_and_is_one_word():
+    run_id = chatops_run_id("long job (v2).json")
+    assert run_id.startswith("chatops-long_job_v2-")
+    assert len(run_id.split()) == 1
+    assert chatops_run_id("long job (v2).json") != run_id
+    assert chatops_run_id("???.json").startswith("chatops-script-")
+
+
+def test_a_run_is_listed_while_it_lasts_and_reports_its_id(script, root):
+    reply = _router().dispatch("/run quick.json", context={"script_root": str(root)})
+    assert reply.succeeded and reply.text == "ran quick.json: 1 action(s) executed"
+    assert reply.metadata["run_id"].startswith("chatops-quick-")
+    assert script.seen_ids == [reply.metadata["run_id"]]
+    assert active_executions() == []
+
+
+def test_a_bare_stop_all_ends_a_chat_run(script, root):
+    run = _Background(_router(), '/run "long job.json"', {"script_root": str(root)})
+    assert script.entered.wait(_WAIT)
+    (run_id,) = _chat_runs()
+    assert run_id.startswith("chatops-long_job-")
+    assert stop_execution(reason="stop-all") == 1
+    reply = run.result()
+    assert reply.text == "run stopped. (stop-all)" and reply.succeeded is False
+    assert reply.metadata == {"stopped": True, "run_id": run_id, "reason": "stop-all"}
+    assert script.after == [], "the action after the stop still ran"
+    assert active_executions() == []
+
+
+def test_the_stop_command_of_the_executor_ends_it_by_name(script, root):
+    run = _Background(_router(), '/run "long job.json"', {"script_root": str(root)})
+    assert script.entered.wait(_WAIT)
+    (run_id,) = _chat_runs()
+    executor.execute_action([["AC_stop_execution", {"run_id": run_id, "reason": "by name"}]])
+    assert run.result().text == "run stopped. (by name)"
+    assert script.after == []
+
+
+def test_chat_stop_ends_the_chat_run_and_leaves_other_runs_alone(script, root):
+    router = _router()
+    run = _Background(router, '/run "long job.json"', {"script_root": str(root)})
+    assert script.entered.wait(_WAIT)
+    (run_id,) = _chat_runs()
+    with stoppable_run("gui-run") as other:
+        reply = router.dispatch("/stop", context={"slack_user": "U1"})
+        assert reply.succeeded and reply.text == f"stop requested: {run_id}"
+        assert reply.metadata["stopped"] == [run_id]
+        assert other.stopped is False, "a bare /stop reached a run chat did not start"
+    stopped = run.result()
+    assert stopped.text == "run stopped. (stopped from chat by U1)"
+    assert script.after == []
+
+
+def test_chat_stop_by_id_reaches_any_run_and_says_so_when_there_is_none(script):
+    router = _router()
+    with stoppable_run("gui-run") as other:
+        nothing = router.dispatch("/stop")
+        assert nothing.succeeded is False
+        assert nothing.text == ("no chat-started run is in progress. "
+                                "Other runs in progress: gui-run (/stop <run-id>).")
+        assert other.stopped is False
+        missing = router.dispatch("/stop nope")
+        assert missing.succeeded is False and missing.text.startswith("no run named 'nope'")
+        named = router.dispatch("/stop gui-run")
+        assert named.succeeded and named.text == "stop requested: gui-run"
+        assert other.stopped and other.reason == "stopped from chat"
+    idle = router.dispatch("/stop")
+    assert idle.text == "no chat-started run is in progress." and idle.succeeded is False
+
+
+def test_stop_takes_at_most_one_argument():
+    reply = _router().dispatch("/stop a b")
+    assert reply.succeeded is False and "usage: /stop [run-id]" in reply.text
+    assert cmd_stop([], {}).succeeded is False
+
+
+def test_inside_a_stoppable_run_the_chat_run_joins_it(script, root):
+    """The GUI's Chat-Ops tab wraps the dispatch in its own run; its Stop must still work."""
+    router = _router()
+    replies = []
+
+    def work():
+        with stoppable_run("tab-run"):
+            replies.append(router.dispatch('/run "long job.json"',
+                                           context={"script_root": str(root)}))
+
+    worker = threading.Thread(target=work, daemon=True)
+    worker.start()
+    assert script.entered.wait(_WAIT)
+    assert [run["run_id"] for run in active_executions()] == ["tab-run"]
+    assert stop_execution("tab-run", reason="tab stop") == 1
+    worker.join(_WAIT)
+    assert not worker.is_alive()
+    assert replies[0].text == "run stopped. (tab stop)"
+    assert replies[0].metadata["run_id"] == "tab-run"
+
+
+def test_stop_is_listed_in_help():
+    text = _router().dispatch("/help").text
+    assert "/stop" in text and "/run" in text
diff --git a/test/unit_test/headless/test_config_sync_convergence.py b/test/unit_test/headless/test_config_sync_convergence.py
index 5c38ec8e..cd3ce7b3 100644
--- a/test/unit_test/headless/test_config_sync_convergence.py
+++ b/test/unit_test/headless/test_config_sync_convergence.py
@@ -193,9 +193,12 @@ def test_a_deletion_reaches_an_offline_machine_however_long_it_was_away(server):
     client = _client()
     entry = SyncEntry.create("hk1", {"combo": "ctrl+a"}, "laptop")
     client.push_operations([_op(entry)], device_id="laptop", now=0.0)
-    client.push_operations([], device_id="desktop", now=0.0)
+    # Reading the bucket lists nobody; the desktop's first own change does.
+    assert client.push_operations([], device_id="desktop", now=0.0).pushed is False
+    shared = entry.edited({"combo": "ctrl+a"}, "desktop")
+    client.push_operations([_op(shared)], device_id="desktop", now=0.0)
 
-    client.push_operations([_op(entry.removed("laptop"))], device_id="laptop", now=1.0)
+    client.push_operations([_op(shared.removed("laptop"))], device_id="laptop", now=1.0)
     # Years pass on the laptop's clock; the desktop has not been back.
     for year in range(1, 4):
         result = client.push_operations([], device_id="laptop", now=year * 3.2e7)
@@ -219,7 +222,8 @@ def test_retired_peer_requires_full_sync(server):
     client = ConfigSyncClient("https://sync.invalid", user_id="alice", tombstone_hold_s=0)
     entry = SyncEntry.create("hk1", {"combo": "ctrl+a"}, "laptop")
     client.push_operations([_op(entry)], device_id="laptop")
-    client.push_operations([], device_id="desktop")
+    entry = entry.edited({"combo": "ctrl+a"}, "desktop")
+    client.push_operations([_op(entry)], device_id="desktop")   # lists the desktop
     stale_edit = entry.edited({"combo": "made while away"}, "desktop")
 
     client.retire_peer("desktop")
@@ -243,7 +247,8 @@ def test_peers_unseen_for_too_long_are_retired_when_asked(server):
     client = _client()
     seed = SyncEntry.create("hk0", {"combo": "seed"}, "laptop")
     client.push_operations([_op(seed)], device_id="laptop", now=0.0)
-    client.push_operations([], device_id="desktop", now=0.0)
+    client.push_operations([_op(seed.edited({"combo": "seed"}, "desktop"))],
+                           device_id="desktop", now=0.0)
     entry = SyncEntry.create("hk1", {"combo": "a"}, "laptop")
     client.push_operations([_op(entry)], device_id="laptop", now=100.0, max_offline_s=50.0)
     assert server.body["peers"]["desktop"]["retired"] is True
diff --git a/test/unit_test/headless/test_config_sync_empty_change.py b/test/unit_test/headless/test_config_sync_empty_change.py
index e632c4d1..6caecc57 100644
--- a/test/unit_test/headless/test_config_sync_empty_change.py
+++ b/test/unit_test/headless/test_config_sync_empty_change.py
@@ -4,8 +4,10 @@
 under ``peers``. Against an account with no entries that produced revision 1
 of a bucket holding nothing but the device's own name -- a write, a row in
 the server's database and a 409 for anyone pushing at the same moment, all
-for no content. Joining is only worth a revision when the bucket holds
-entries whose later deletion must wait for this device.
+for no content. Joining a bucket that does hold entries is not worth a
+revision either: the device is listed by the first change it commits, and
+until then a deletion reaches it through the held tombstone
+(``test_config_sync_join_without_commit.py``).
 """
 from unittest.mock import patch
 
@@ -90,14 +92,18 @@ def test_the_first_real_change_still_creates_the_bucket_and_lists_the_device(tmp
     assert list(server.body["peers"]) == ["laptop"]
 
 
-def test_joining_a_bucket_that_holds_entries_is_still_recorded(tmp_path, server):
-    # Not an empty change: from here on a deletion of "a" must wait for the desktop.
+def test_joining_a_bucket_that_holds_entries_commits_nothing_either(tmp_path, server):
     _run(tmp_path, "laptop", {"a": {"v": 1}})
     store = {}
     report, _outbox = _run(tmp_path, "desktop", store)
     assert store == {"a": {"v": 1}}
+    assert report.state == "synced" and report.revision == 1
+    assert server.puts == 1 and list(server.body["peers"]) == ["laptop"]
+    # The desktop's first real change is what lists it ...
+    store["b"] = {"v": 2}
+    report, _outbox = _run(tmp_path, "desktop", store)
     assert report.revision == 2 and set(server.body["peers"]) == {"laptop", "desktop"}
-    # Once listed, a further sync with nothing new writes nothing.
+    # ... and once listed, a further sync with nothing new writes nothing.
     _run(tmp_path, "desktop", store)
     assert server.puts == 2
 
diff --git a/test/unit_test/headless/test_config_sync_join_without_commit.py b/test/unit_test/headless/test_config_sync_join_without_commit.py
new file mode 100644
index 00000000..b93c51ca
--- /dev/null
+++ b/test/unit_test/headless/test_config_sync_join_without_commit.py
@@ -0,0 +1,253 @@
+"""Joining a bucket that already has content commits no revision.
+
+A device's first sync against a non-empty bucket used to write a revision
+that carried nothing but the device's own name under ``peers``: that listing
+was what made later deletions wait for the device. Acknowledged tombstones
+are now held for ``TOMBSTONE_HOLD_S``, which covers a device the bucket does
+not list, so the join-only commit is gone. A device is listed by its first
+real change.
+
+What that costs is pinned here too: once the hold has run out, an *edit* made
+on a device that only ever pulled re-creates a deleted entry without a
+conflict (``test_past_the_hold_an_edit_from_a_device_that_only_pulled_...``).
+An untouched copy is still removed, because the device's own baseline says
+the entry was deleted elsewhere.
+
+Hold expiry is simulated with ``tombstone_hold_s=0`` (the tombstone goes as
+soon as the listed devices acknowledged it) or with ``now=``; no test waits.
+"""
+from unittest.mock import patch
+
+import pytest
+
+from je_auto_control.utils.config_sync import (
+    ConfigBucket, ConfigSyncClient, ConfigSyncConflict, SyncAdapter, SyncEntry, SyncOperation,
+    SyncOutbox, run_sync,
+)
+from je_auto_control.utils.config_sync.merge import awaits_ack
+from je_auto_control.utils.config_sync.versions import TOMBSTONE_HOLD_S
+
+_URL = "https://sync.invalid"
+_T0 = 1_700_000_000.0
+
+
+class _Server:
+    """The revision-checked bucket endpoint, in memory."""
+
+    def __init__(self):
+        self.body = None
+        self.revision = 0
+        self.puts = 0
+
+    def request(self, method, body=None):
+        if method == "GET":
+            return self.body
+        self.puts += 1
+        if body["base_revision"] != self.revision:
+            raise ConfigSyncConflict("behind", self.revision)
+        self.revision += 1
+        self.body = {**body["bucket"], "revision": self.revision}
+        return {"ok": True, "revision": self.revision}
+
+    def bucket(self):
+        return ConfigBucket.from_dict(self.body)
+
+
+@pytest.fixture
+def server():
+    endpoint = _Server()
+    with patch.object(ConfigSyncClient, "_request",
+                      new=lambda _client, method, body=None: endpoint.request(method, body)):
+        yield endpoint
+
+
+class _DictAdapter(SyncAdapter):
+    section = "custom"
+
+    def __init__(self, origin, store):
+        super().__init__(origin)
+        self.store = store
+
+    def read_local(self):
+        return {key: dict(value) for key, value in self.store.items()}
+
+    def write_local(self, key, value, existing):
+        self.store[key] = dict(value)
+
+    def delete_local(self, key):
+        self.store.pop(key, None)
+
+
+class _Device:
+    """One machine: its local store and its durable outbox."""
+
+    def __init__(self, tmp_path, name, store=None, hold_s=TOMBSTONE_HOLD_S):
+        self.name = name
+        self.store = {} if store is None else store
+        self._outbox = SyncOutbox(tmp_path / f"{name}.sqlite3", account="alice",
+                                  endpoint=_URL, base_delay_s=0.0)
+        self._client = ConfigSyncClient(_URL, user_id="alice", tombstone_hold_s=hold_s)
+
+    def sync(self):
+        return run_sync(self._client, self._outbox, [_DictAdapter(self.name, self.store)],
+                        device_id=self.name)
+
+
+def _op(entry):
+    return SyncOperation(section="custom", entry=entry)
+
+
+# --- the join itself -----------------------------------------------------------------
+
+def test_a_join_with_nothing_to_send_commits_nothing(tmp_path, server):
+    _Device(tmp_path, "laptop", {"a": {"v": 1}}).sync()
+    assert (server.revision, server.puts) == (1, 1)
+    desktop = _Device(tmp_path, "desktop")
+    report = desktop.sync()
+    assert desktop.store == {"a": {"v": 1}}, "it still receives the content"
+    assert (report.state, report.revision, report.pending) == ("synced", 1, 0)
+    assert (server.revision, server.puts) == (1, 1), "a revision was committed just for joining"
+    assert list(server.body["peers"]) == ["laptop"]
+    for _again in range(3):
+        desktop.sync()
+    assert (server.revision, server.puts) == (1, 1)
+
+
+def test_push_operations_from_an_unlisted_device_with_no_change_does_not_push(server):
+    client = ConfigSyncClient(_URL, user_id="alice")
+    entry = SyncEntry.create("a", {"v": 1}, "laptop")
+    client.push_operations([_op(entry)], device_id="laptop", now=_T0)
+    result = client.push_operations([], device_id="desktop", now=_T0)
+    assert result.pushed is False and result.revision == 1
+    assert result.bucket.values("custom") == {"a": {"v": 1}}
+    assert server.puts == 1
+    assert awaits_ack(server.bucket(), "desktop") is False
+
+
+def test_an_unlisted_device_owes_no_acknowledgement_for_a_waiting_tombstone(server):
+    client = ConfigSyncClient(_URL, user_id="alice")
+    entry = SyncEntry.create("a", {"v": 1}, "laptop")
+    client.push_operations([_op(entry)], device_id="laptop", now=_T0)
+    client.push_operations([_op(entry.removed("laptop"))], device_id="laptop", now=_T0)
+    assert awaits_ack(server.bucket(), "desktop") is False
+    assert client.push_operations([], device_id="desktop", now=_T0).pushed is False
+    assert server.puts == 2
+
+
+def test_the_first_real_change_lists_the_device_and_deletions_then_wait_for_it(tmp_path, server):
+    laptop = _Device(tmp_path, "laptop", {"a": {"v": 1}}, hold_s=0)
+    laptop.sync()
+    desktop = _Device(tmp_path, "desktop", hold_s=0)
+    desktop.sync()
+    desktop.store["b"] = {"v": 2}
+    desktop.sync()
+    assert set(server.body["peers"]) == {"laptop", "desktop"}
+    laptop.sync()
+    del laptop.store["a"]
+    laptop.sync()
+    # No hold at all, and still kept: the desktop is listed and has not acknowledged.
+    assert server.bucket().get_entry("custom", "a").deleted
+    assert awaits_ack(server.bucket(), "desktop") is True
+    desktop.sync()
+    assert desktop.store == {"b": {"v": 2}}
+    laptop.sync()
+    assert server.bucket().get_entry("custom", "a") is None
+
+
+# --- a deletion made while the device is unlisted, inside the hold ---------------------
+
+def _pulled_then_deleted_elsewhere(tmp_path, hold_s=TOMBSTONE_HOLD_S):
+    """laptop creates ``a``; desktop pulls it without committing; laptop deletes it."""
+    laptop = _Device(tmp_path, "laptop", {"a": {"v": 1}}, hold_s=hold_s)
+    laptop.sync()
+    desktop = _Device(tmp_path, "desktop", hold_s=hold_s)
+    desktop.sync()
+    assert desktop.store == {"a": {"v": 1}}
+    del laptop.store["a"]
+    laptop.sync()
+    return laptop, desktop
+
+
+def test_inside_the_hold_the_deletion_reaches_an_unlisted_device_as_a_deletion(tmp_path, server):
+    _laptop, desktop = _pulled_then_deleted_elsewhere(tmp_path)
+    assert list(server.body["peers"]) == ["laptop"], "the desktop was never listed"
+    assert server.bucket().get_entry("custom", "a").deleted, "held although the laptop acknowledged"
+    puts = server.puts
+    report = desktop.sync()
+    assert desktop.store == {}
+    assert report.applied["custom"]["removed"] == ["a"]
+    assert (report.state, report.conflicts) == ("synced", [])
+    assert server.puts == puts, "receiving a deletion is not a reason to commit either"
+
+
+def test_inside_the_hold_an_edit_made_meanwhile_becomes_a_conflict(tmp_path, server):
+    laptop, desktop = _pulled_then_deleted_elsewhere(tmp_path)
+    desktop.store["a"] = {"v": "edited while away"}
+    report = desktop.sync()
+    assert (report.state, report.conflicts) == ("conflict", ["custom/a"])
+    entry = server.bucket().get_entry("custom", "a")
+    assert entry.in_conflict
+    assert sorted(sibling.deleted for sibling in entry.siblings) == [False, True]
+    assert server.bucket().values("custom") == {}, "nothing came back by itself"
+    seen = laptop.sync()
+    assert laptop.store == {} and seen.conflicts == ["custom/a"]
+
+
+def test_the_conflict_is_the_same_by_the_clock_until_the_hold_runs_out(server):
+    client = ConfigSyncClient(_URL, user_id="alice")
+    created = SyncEntry.create("a", {"v": 1}, "laptop")
+    client.push_operations([_op(created)], device_id="laptop", now=_T0)
+    assert client.push_operations([], device_id="tablet", now=_T0).pushed is False
+    client.push_operations([_op(created.removed("laptop"))], device_id="laptop", now=_T0)
+    # Another commit just short of thirty days later keeps the tombstone ...
+    client.push_operations([_op(SyncEntry.create("b", {"v": 2}, "laptop"))],
+                           device_id="laptop", now=_T0 + TOMBSTONE_HOLD_S - 60)
+    edit = created.edited({"v": "tablet"}, "tablet")
+    result = client.push_operations([_op(edit)], device_id="tablet",
+                                    now=_T0 + TOMBSTONE_HOLD_S - 30)
+    assert [conflict.key for conflict in result.conflicts] == ["a"]
+    assert server.bucket().get_entry("custom", "a").in_conflict
+
+
+# --- past the hold: what still holds, and what no longer does -----------------------------
+
+def test_past_the_hold_an_untouched_copy_is_still_removed(tmp_path, server):
+    _laptop, desktop = _pulled_then_deleted_elsewhere(tmp_path, hold_s=0)
+    assert server.bucket().get_entry("custom", "a") is None, "the tombstone is gone"
+    puts = server.puts
+    report = desktop.sync()
+    assert desktop.store == {}, "its own baseline says the entry was deleted elsewhere"
+    assert report.applied["custom"]["removed"] == ["a"]
+    assert server.bucket().values("custom") == {} and server.puts == puts
+
+
+def test_past_the_hold_an_edit_from_a_device_that_only_pulled_brings_the_entry_back(
+        tmp_path, server):
+    """The weaker guarantee: with the join-only commit this was a conflict.
+
+    The desktop was never listed, so the tombstone did not wait for it; once
+    the hold is over nothing in the bucket remembers the deletion and the
+    desktop's edit is taken as a new entry.
+    """
+    laptop, desktop = _pulled_then_deleted_elsewhere(tmp_path, hold_s=0)
+    desktop.store["a"] = {"v": "edited while away"}
+    report = desktop.sync()
+    assert (report.state, report.conflicts) == ("synced", [])
+    assert server.bucket().values("custom") == {"a": {"v": "edited while away"}}
+    laptop.sync()
+    assert laptop.store == {"a": {"v": "edited while away"}}, "the deleted entry returned"
+
+
+def test_past_the_hold_by_the_clock_the_edit_returns_without_a_conflict(server):
+    client = ConfigSyncClient(_URL, user_id="alice")
+    created = SyncEntry.create("a", {"v": 1}, "laptop")
+    client.push_operations([_op(created)], device_id="laptop", now=_T0)
+    assert client.push_operations([], device_id="tablet", now=_T0).pushed is False
+    client.push_operations([_op(created.removed("laptop"))], device_id="laptop", now=_T0)
+    client.push_operations([_op(SyncEntry.create("b", {"v": 2}, "laptop"))],
+                           device_id="laptop", now=_T0 + TOMBSTONE_HOLD_S + 60)
+    assert server.bucket().get_entry("custom", "a") is None
+    result = client.push_operations([_op(created.edited({"v": "tablet"}, "tablet"))],
+                                    device_id="tablet", now=_T0 + TOMBSTONE_HOLD_S + 120)
+    assert result.conflicts == []
+    assert server.bucket().values("custom") == {"a": {"v": "tablet"}, "b": {"v": 2}}
diff --git a/test/unit_test/headless/test_config_sync_unlisted_device.py b/test/unit_test/headless/test_config_sync_unlisted_device.py
index 3ddf1016..34667447 100644
--- a/test/unit_test/headless/test_config_sync_unlisted_device.py
+++ b/test/unit_test/headless/test_config_sync_unlisted_device.py
@@ -65,8 +65,10 @@ def _delete_on_both_listed_devices(now=_T0, **options):
     """laptop and desktop both know ``hk1``; laptop deletes it; both acknowledge."""
     created = SyncEntry.create("hk1", {"combo": "ctrl+a"}, "laptop")
     _push("laptop", [created], now=now, **options)
-    _push("desktop", now=now, **options)                    # joins: it now holds hk1 too
-    _push("laptop", [created.removed("laptop")], now=now, **options)
+    # Reading does not list a device; the desktop's own change to hk1 does.
+    shared = created.edited({"combo": "ctrl+a"}, "desktop")
+    _push("desktop", [shared], now=now, **options)
+    _push("laptop", [shared.removed("laptop")], now=now, **options)
     _push("desktop", now=now, **options)                    # acknowledges the deletion
     _push("laptop", now=now, **options)
     return created
@@ -134,8 +136,9 @@ def test_a_held_tombstone_does_not_make_acknowledged_devices_commit_again(server
 def test_no_clock_drops_a_tombstone_a_listed_device_has_not_acknowledged(server):
     created = SyncEntry.create("hk1", {"combo": "ctrl+a"}, "laptop")
     _push("laptop", [created], now=_T0)
-    _push("desktop", now=_T0)
-    _push("laptop", [created.removed("laptop")], now=_T0)
+    shared = created.edited({"combo": "ctrl+a"}, "desktop")
+    _push("desktop", [shared], now=_T0)                     # lists the desktop
+    _push("laptop", [shared.removed("laptop")], now=_T0)
     # The desktop has not acknowledged; the laptop's clock jumps ten years.
     _push("laptop", [SyncEntry.create("hk2", {"combo": "b"}, "laptop")], now=_T0 + 3650 * _DAY)
     assert server.bucket().get_entry("hotkeys", "hk1").deleted
diff --git a/test/unit_test/headless/test_mcp_plugin_read_only_declaration.py b/test/unit_test/headless/test_mcp_plugin_read_only_declaration.py
new file mode 100644
index 00000000..d63667bb
--- /dev/null
+++ b/test/unit_test/headless/test_mcp_plugin_read_only_declaration.py
@@ -0,0 +1,258 @@
+"""A plugin may declare a tool read-only; nothing else makes a plugin tool read-only.
+
+Read-only mode is enforced in every tool mode and plugin tools were always
+registered as mutating, so a read-only MCP server ran no plugin tool at all.
+``mcp_read_only = True`` on the plugin's callable is the opt-in. It is the
+plugin author's word -- trusted, not verified -- so it is logged at
+registration, and anything but the boolean ``True`` leaves the tool mutating.
+"""
+import json
+import logging
+
+import pytest
+
+from je_auto_control.utils.logging.logging_instance import autocontrol_logger
+from je_auto_control.utils.mcp_server._authz import visible_tools
+from je_auto_control.utils.mcp_server.plugin_watcher import PluginWatcher
+from je_auto_control.utils.mcp_server.server import MCPServer
+from je_auto_control.utils.mcp_server.tools.plugin_tools import (
+    PLUGIN_READ_ONLY_ATTRIBUTE, make_plugin_tool, plugin_declares_read_only,
+    register_plugin_tools,
+)
+from je_auto_control.utils.rbac import (
+    AuthorizationContext, Capability, Role, authorization_scope, capability_for_tool,
+)
+
+_MODES = ["full", "progressive", "static"]
+_PEEK = "plugin_ac_peek"
+_POKE = "plugin_ac_poke"
+
+
+@pytest.fixture(autouse=True)
+def _no_ambient_configuration(monkeypatch):
+    for name in ("JE_AUTOCONTROL_MCP_READONLY", "JE_AUTOCONTROL_MCP_TOOL_MODE",
+                 "JE_AUTOCONTROL_MCP_AUDIT"):
+        monkeypatch.delenv(name, raising=False)
+    # The static mode offers a fixed profile; name the two plugin tools in it.
+    monkeypatch.setenv("JE_AUTOCONTROL_MCP_TOOL_PROFILE", f"{_PEEK},{_POKE}")
+
+
+@pytest.fixture()
+def log_records():
+    """Records the framework logger emits (it does not propagate to caplog)."""
+    records = []
+
+    class _Collect(logging.Handler):
+        def emit(self, record):
+            records.append(record)
+
+    handler = _Collect(level=logging.DEBUG)
+    autocontrol_logger.addHandler(handler)
+    try:
+        yield records
+    finally:
+        autocontrol_logger.removeHandler(handler)
+
+
+class _Plugin:
+    """Two plugin callables that record their calls instead of doing anything."""
+
+    def __init__(self, declaration=True):
+        self.ran = []
+        ran = self.ran
+
+        def AC_peek():
+            """Report something without changing it."""
+            ran.append("peek")
+            return {"seen": True}
+
+        def AC_poke():
+            """Change something."""
+            ran.append("poke")
+            return {"poked": True}
+
+        setattr(AC_peek, PLUGIN_READ_ONLY_ATTRIBUTE, declaration)
+        self.commands = {"AC_peek": AC_peek, "AC_poke": AC_poke}
+
+
+def _rpc(server, method, params=None):
+    reply = server.handle_line(json.dumps(
+        {"jsonrpc": "2.0", "id": 1, "method": method, "params": params or {}}))
+    return json.loads(reply)
+
+
+def _listed(server):
+    return {tool["name"] for tool in _rpc(server, "tools/list")["result"]["tools"]}
+
+
+def _call(server, name, arguments=None):
+    return _rpc(server, "tools/call", {"name": name, "arguments": arguments or {}})
+
+
+def _enable(server, mode, *names):
+    if mode == "progressive":
+        reply = _call(server, "ac_tools_enable", {"names": list(names)})
+        assert "result" in reply, reply
+
+
+def test_the_attribute_name_is_the_documented_one():
+    assert PLUGIN_READ_ONLY_ATTRIBUTE == "mcp_read_only"
+
+
+def test_a_plugin_tool_is_mutating_by_default():
+    def AC_plain():
+        return 1
+
+    tool = make_plugin_tool("AC_plain", AC_plain)
+    assert tool.annotations.read_only is False
+    assert tool.annotations.to_dict()["destructiveHint"] is True
+    assert capability_for_tool(tool.name, tool.annotations.read_only) == Capability.DRIVE_INPUT
+
+
+def test_a_declared_tool_is_read_only_and_claims_nothing_else():
+    plugin = _Plugin()
+    hints = make_plugin_tool("AC_peek", plugin.commands["AC_peek"]).annotations.to_dict()
+    assert hints["readOnlyHint"] is True and hints["destructiveHint"] is False
+    assert hints["idempotentHint"] is False, "only read-only was declared"
+    assert make_plugin_tool("AC_poke", plugin.commands["AC_poke"]).annotations.read_only is False
+
+
+@pytest.mark.parametrize("declaration", [
+    False, None, 1, 1.0, "true", "True", "yes", ["True"], {"read_only": True}, lambda: True,
+])
+def test_anything_but_the_boolean_true_is_mutating(declaration):
+    plugin = _Plugin(declaration)
+    assert plugin_declares_read_only(plugin.commands["AC_peek"]) is False
+    assert make_plugin_tool("AC_peek", plugin.commands["AC_peek"]).annotations.read_only is False
+
+
+def test_a_malformed_declaration_is_logged(log_records):
+    plugin = _Plugin("yes")
+    make_plugin_tool("AC_peek", plugin.commands["AC_peek"])
+    assert any("mcp_read_only" in record.getMessage() and "stays mutating" in record.getMessage()
+               for record in log_records)
+
+
+def test_a_declaration_that_raises_is_mutating(log_records):
+    class _Raises:
+        @property
+        def mcp_read_only(self):
+            raise RuntimeError("no")
+
+        def __call__(self):
+            return 1
+
+    handler = _Raises()
+    assert plugin_declares_read_only(handler) is False
+    assert make_plugin_tool("AC_odd", handler).annotations.read_only is False
+    assert any("stays mutating" in record.getMessage() for record in log_records)
+
+
+def test_a_bound_method_carries_its_functions_declaration():
+    class _Owner:
+        def AC_look(self):
+            return 1
+        AC_look.mcp_read_only = True
+
+    assert make_plugin_tool("AC_look", _Owner().AC_look).annotations.read_only is True
+
+
+@pytest.mark.parametrize("mode", _MODES)
+def test_a_declared_tool_runs_on_a_read_only_server(mode):
+    plugin = _Plugin()
+    server = MCPServer(tools=[], read_only=True, tool_mode=mode)
+    assert register_plugin_tools(server, plugin.commands) == [_PEEK, _POKE]
+    _enable(server, mode, _PEEK)
+    listed = _listed(server)
+    assert _PEEK in listed and _POKE not in listed
+    assert _call(server, _PEEK)["result"]["isError"] is False
+    assert _call(server, _POKE)["error"]["code"] == -32602
+    assert plugin.ran == ["peek"]
+
+
+@pytest.mark.parametrize("mode", _MODES)
+def test_an_undeclared_plugin_tool_still_does_not_run_read_only(mode):
+    plugin = _Plugin(declaration=False)
+    server = MCPServer(tools=[], read_only=True, tool_mode=mode)
+    register_plugin_tools(server, plugin.commands)
+    assert not {_PEEK, _POKE} & _listed(server)
+    assert "error" in _call(server, _PEEK) and "error" in _call(server, _POKE)
+    assert plugin.ran == []
+
+
+@pytest.mark.parametrize("mode", _MODES)
+def test_a_malformed_declaration_does_not_run_read_only(mode):
+    plugin = _Plugin(declaration="true")
+    server = MCPServer(tools=[], read_only=True, tool_mode=mode)
+    register_plugin_tools(server, plugin.commands)
+    assert _PEEK not in _listed(server)
+    assert _call(server, _PEEK)["error"]["code"] == -32602
+    assert plugin.ran == []
+
+
+def test_a_server_that_is_not_read_only_offers_both():
+    plugin = _Plugin()
+    server = MCPServer(tools=[])
+    register_plugin_tools(server, plugin.commands)
+    assert _listed(server) == {_PEEK, _POKE}
+    assert _call(server, _POKE)["result"]["isError"] is False
+
+
+@pytest.mark.parametrize("mode", _MODES)
+def test_a_viewer_may_call_the_declared_tool_and_only_that_one(mode):
+    plugin = _Plugin()
+    server = MCPServer(tools=[], tool_mode=mode)
+    register_plugin_tools(server, plugin.commands)
+    with authorization_scope(AuthorizationContext("viewer-user", Role.VIEWER)):
+        _enable(server, mode, _PEEK)
+        listed = _listed(server)
+        peek, poke = _call(server, _PEEK), _call(server, _POKE)
+    assert _PEEK in listed and _POKE not in listed
+    assert peek["result"]["isError"] is False
+    assert "error" in poke
+    assert plugin.ran == ["peek"]
+
+
+def test_the_declared_tool_needs_read_screen_and_a_role_without_it_is_refused():
+    plugin = _Plugin()
+    tools = [make_plugin_tool(name, handler) for name, handler in plugin.commands.items()]
+    peek = tools[0]
+    assert capability_for_tool(peek.name, peek.annotations.read_only) == Capability.READ_SCREEN
+    with authorization_scope(AuthorizationContext("nobody", "no-such-role")):
+        assert visible_tools(tools) == []
+    with authorization_scope(AuthorizationContext("op", Role.OPERATOR)):
+        assert {tool.name for tool in visible_tools(tools)} == {_PEEK, _POKE}
+    server = MCPServer(tools=tools)
+    with authorization_scope(AuthorizationContext("nobody", "no-such-role")):
+        refused = _call(server, _PEEK)
+    assert "error" in refused and plugin.ran == []
+
+
+def test_registration_logs_which_tools_declared_it(log_records):
+    plugin = _Plugin()
+    register_plugin_tools(MCPServer(tools=[]), plugin.commands)
+    declared = [record.getMessage() for record in log_records
+                if "trusted, not verified" in record.getMessage()]
+    assert len(declared) == 1 and _PEEK in declared[0] and _POKE not in declared[0]
+
+
+def test_the_watcher_honours_and_logs_the_declaration(tmp_path, log_records):
+    marker = tmp_path / "ran.txt"
+    plugins = tmp_path / "plugins"
+    plugins.mkdir()
+    (plugins / "tools.py").write_text(
+        "def AC_peek():\n"
+        f"    open({str(marker)!r}, 'w').close()\n"
+        "    return 'seen'\n"
+        "AC_peek.mcp_read_only = True\n"
+        "def AC_poke():\n"
+        "    raise AssertionError('a mutating plugin tool ran on a read-only server')\n",
+        encoding="utf-8")
+    server = MCPServer(tools=[], read_only=True)
+    PluginWatcher(server, str(plugins)).poll_once()
+    assert _listed(server) == {_PEEK}
+    assert _call(server, _PEEK)["result"]["isError"] is False
+    assert marker.exists()
+    assert "error" in _call(server, _POKE)
+    assert any("trusted, not verified" in record.getMessage() and _PEEK in record.getMessage()
+               for record in log_records)
diff --git a/test/unit_test/headless/test_rbac_user_admin.py b/test/unit_test/headless/test_rbac_user_admin.py
index ffd7b86e..c3e731b0 100644
--- a/test/unit_test/headless/test_rbac_user_admin.py
+++ b/test/unit_test/headless/test_rbac_user_admin.py
@@ -23,7 +23,7 @@
 from je_auto_control.utils.mcp_server.audit import AuditLogger
 from je_auto_control.utils.mcp_server.http_transport import DEFAULT_PATH, HttpMCPServer
 from je_auto_control.utils.mcp_server.server import MCPServer
-from je_auto_control.utils.mcp_server.tools import build_default_tool_registry
+from je_auto_control.utils.mcp_server.tools import MCPTool, build_default_tool_registry
 from je_auto_control.utils.rbac import (
     USERS_ENV, AuthorizationContext, AuthorizationError, Capability, IssuedToken,
     Role, UserAuthError, UserStore, admin, authorization_scope, can,
@@ -394,6 +394,61 @@ def test_data_tools_need_more_than_read_screen(users):
         "screenshot"}, "screen-state tools stay; the screenshot tool is not read-only"
 
 
+_STORED_RECORD_TOOLS = (
+    # the ones the maintainer named
+    "ac_list_run_history", "ac_costs_list", "ac_costs_summary", "ac_trace_export",
+    "ac_self_heal_log_list", "ac_usb_acl_list",
+    # the rest of the registry that meets the same rule
+    "ac_trace_summary", "ac_heal_stats", "ac_self_heal_revision_list",
+    "ac_self_heal_evaluate", "ac_flaky_report", "ac_rank_tests", "ac_select_tests",
+    "ac_shard_suite", "ac_ab_report", "ac_ab_best_strategy", "ac_journal_read",
+    "ac_journal_runs", "ac_lease_active", "ac_element_list", "ac_skill_list",
+    "ac_skill_search", "ac_repair_pending", "ac_repair_resolved", "ac_quarantine_list",
+    "ac_pending_artifacts", "ac_config_sync_status",
+    "ac_android_get_clipboard", "ac_ios_get_clipboard",
+)
+_LIVE_SCREEN_TOOLS = (
+    "ac_vlm_locate", "ac_self_heal_locate",  # they read the screen; cost is not a capability
+    "ac_locate_text", "ac_locate_image_center", "ac_a11y_list", "ac_element_find",
+    "ac_list_executions", "ac_scheduler_list_jobs", "ac_journal_status",
+)
+
+
+def test_stored_records_need_read_data_and_the_live_screen_only_read_screen():
+    registry = {tool.name: tool for tool in build_default_tool_registry(read_only=False)}
+    for name in _STORED_RECORD_TOOLS:
+        assert registry[name].annotations.read_only, name
+        assert capability_for_tool(name, True) == Capability.READ_DATA, name
+    for name in _LIVE_SCREEN_TOOLS:
+        assert registry[name].annotations.read_only, name
+        assert capability_for_tool(name, True) == Capability.READ_SCREEN, name
+    assert len(DATA_TOOLS) == 71
+
+
+def test_a_viewer_is_refused_a_stored_record_tool_and_an_operator_is_not():
+    ran = []
+
+    def handler():
+        ran.append("history")
+        return []
+
+    registry = [tool for tool in build_default_tool_registry(read_only=False)
+                if tool.name == "ac_list_run_history"]
+    server = MCPServer(tools=[MCPTool(
+        name=registry[0].name, description="history", input_schema={"type": "object"},
+        handler=handler, annotations=registry[0].annotations)])
+    call = json.dumps({"jsonrpc": "2.0", "id": 1, "method": "tools/call",
+                       "params": {"name": "ac_list_run_history", "arguments": {}}})
+    with authorization_scope(AuthorizationContext("viewer-user", Role.VIEWER)):
+        refused = json.loads(server.handle_line(call))
+    assert refused["error"]["code"] == -32003
+    assert refused["error"]["data"]["required_capability"] == Capability.READ_DATA
+    assert ran == []
+    with authorization_scope(AuthorizationContext("op", Role.OPERATOR)):
+        allowed = json.loads(server.handle_line(call))
+    assert allowed["result"]["isError"] is False and ran == ["history"]
+
+
 def test_an_alias_needs_what_its_tool_needs():
     from je_auto_control.utils.mcp_server.tools import _DEFAULT_ALIASES
     registry = {tool.name: tool for tool in build_default_tool_registry(read_only=False)}
diff --git a/test/unit_test/headless/test_script_builder_one_time_reveal.py b/test/unit_test/headless/test_script_builder_one_time_reveal.py
new file mode 100644
index 00000000..1b96f3af
--- /dev/null
+++ b/test/unit_test/headless/test_script_builder_one_time_reveal.py
@@ -0,0 +1,400 @@
+"""The Script Builder reveals a run's freshly issued token once, and only on screen.
+
+``AC_user_add`` / ``AC_user_rotate_token`` answer with a bearer token, and the
+builder masks it in its result pane -- so whoever ran the step there never saw
+it. The values of the last run are now held in memory until the "one-time
+values" button hands them to a dialog; the tab forgets them at that moment,
+when the next run starts and when it is disposed, and the dialog forgets them
+when it closes.
+
+The first tests are headless (what the run produced, how each value is named).
+The rest build the tab offscreen; the dialog is built and inspected but never
+shown or executed, and the clipboard is replaced by a list.
+"""
+import json
+import logging
+from pathlib import Path
+
+import pytest
+
+from je_auto_control.gui.script_builder.step_model import (
+    OneTimeValue, Step, displayable_record, nested_sensitive_commands, one_time_values,
+    save_action_file, steps_to_actions,
+)
+from je_auto_control.utils.executor.action_executor import execute_action
+from je_auto_control.utils.logging.logging_instance import autocontrol_logger
+from je_auto_control.utils.rbac import UserStore
+
+_KEYS = ("sb_one_time_show", "sb_one_time_title", "sb_one_time_notice", "sb_one_time_step",
+         "sb_one_time_copy", "sb_one_time_available", "sb_one_time_nested")
+_ADD_KEY = "execute: ['AC_user_add', {'user_id': 'x'}]"
+
+
+def _user_steps(users: str) -> list:
+    return [
+        Step("AC_user_add", {"user_id": "ann", "role": "operator", "users_path": users}),
+        Step("AC_user_list", {"users_path": users}),
+        Step("AC_user_rotate_token", {"user_id": "ann", "users_path": users}),
+    ]
+
+
+# --- headless: what a run produced -------------------------------------------
+
+
+def test_the_headless_run_still_returns_the_token_and_names_each_by_its_step(tmp_path):
+    users = str(tmp_path / "users.json")
+    record = execute_action(steps_to_actions(_user_steps(users)))
+    values = one_time_values(record)
+    assert [(value.step, value.command, value.subject, value.name) for value in values] == [
+        (1, "AC_user_add", "ann", "token"), (3, "AC_user_rotate_token", "ann", "token")]
+    assert values[0].value == list(record.values())[0]["token"], "the record is not changed"
+    assert UserStore(users).authenticate(values[1].value).user_id == "ann"
+
+
+def test_a_value_is_not_in_the_text_form_of_its_holder():
+    value = OneTimeValue(1, "AC_user_add", "ann", "token", "tok-in-memory-only")
+    assert "tok-in-memory-only" not in repr(value) + str(value) + f"{[value]}"
+
+
+def test_a_failed_or_empty_marked_command_has_nothing_to_reveal():
+    assert one_time_values({_ADD_KEY: "UserAuthError('user exists')"}) == []
+    assert one_time_values({_ADD_KEY: None}) == []
+    assert one_time_values({_ADD_KEY: {"user_id": "x", "token": ""}}) == []
+    assert one_time_values("not a record") == []
+
+
+def test_a_marked_result_without_fields_is_revealed_whole():
+    values = one_time_values({_ADD_KEY: ["opaque", "values"]})
+    assert [(value.step, value.name, value.value) for value in values] == [
+        (1, "", json.dumps(["opaque", "values"]))]
+
+
+def test_a_marked_result_in_a_nested_record_keeps_the_top_level_step_number():
+    record = {"execute: ['AC_get_var', {'name': 'a'}]": 1,
+              "execute: ['AC_try', {}]": {"body": [{_ADD_KEY: {"user_id": "x", "token": "tok-nested"}}]}}
+    values = one_time_values(record)
+    assert [(value.step, value.subject, value.value) for value in values] == [(2, "x", "tok-nested")]
+
+
+def test_everything_revealed_is_exactly_what_the_display_masks(tmp_path):
+    users = str(tmp_path / "users.json")
+    record = execute_action(steps_to_actions(_user_steps(users)))
+    shown = json.dumps(displayable_record(record), default=str)
+    raw = json.dumps(record, default=str)
+    for value in one_time_values(record):
+        assert value.value in raw and value.value not in shown
+
+
+def test_marked_commands_inside_a_block_are_named_and_top_level_ones_are_not():
+    actions = [
+        ["AC_user_add", {"user_id": "top"}],
+        ["AC_loop", {"times": 2, "body": [
+            ["AC_user_rotate_token", {"user_id": "a"}],
+            ["AC_try", {"body": [["AC_user_add", {"user_id": "b"}]], "catch": []}]]}],
+        ["AC_user_list"],
+    ]
+    assert nested_sensitive_commands(actions) == ["AC_user_add", "AC_user_rotate_token"]
+    assert nested_sensitive_commands(actions[:1] + actions[2:]) == []
+    assert nested_sensitive_commands({"not": "a list"}) == []
+
+
+def test_a_block_really_records_no_nested_token(tmp_path):
+    """Why the note exists: the value issued in a body is in no record to reveal."""
+    users = str(tmp_path / "users.json")
+    record = execute_action([["AC_loop", {"times": 1, "body": [
+        ["AC_user_add", {"user_id": "bob", "users_path": users}]]}]])
+    assert UserStore(users).get("bob") is not None and one_time_values(record) == []
+
+
+def test_a_signed_jwt_is_masked_revealed_once_and_kept_out_of_the_log(caplog):
+    """The schema flag was missing: the builder printed the credential it had just minted."""
+    autocontrol_logger.addHandler(caplog.handler)
+    try:
+        with caplog.at_level(logging.DEBUG, logger=autocontrol_logger.name):
+            record = execute_action([["AC_jwt_encode", {"claims": {"sub": "ann"}, "key": "k" * 40}]])
+    finally:
+        autocontrol_logger.removeHandler(caplog.handler)
+    token = list(record.values())[0]["token"]
+    assert token.count(".") == 2, "the script still gets the signed token"
+    assert token not in json.dumps(displayable_record(record))
+    assert [(value.step, value.name, value.value) for value in one_time_values(record)] == [
+        (1, "token", token)]
+    logged = "\n".join(entry.getMessage() for entry in caplog.records)
+    assert "AC_jwt_encode" in logged and token not in logged
+
+
+def test_a_result_is_logged_with_its_secret_named_fields_masked_at_any_depth(caplog):
+    """The result log printed a lease token; the record a script receives is untouched."""
+    autocontrol_logger.addHandler(caplog.handler)
+    try:
+        with caplog.at_level(logging.DEBUG, logger=autocontrol_logger.name):
+            record = execute_action([["AC_lease_secret", {"name": "db", "ttl": 5}], ["AC_lease_active"]])
+    finally:
+        autocontrol_logger.removeHandler(caplog.handler)
+    issued, active = record.values()
+    assert issued["token"] in [lease["token"] for lease in active["leases"]]
+    logged = "\n".join(entry.getMessage() for entry in caplog.records)
+    assert "AC_lease_active" in logged and "'name': 'db'" in logged
+    assert issued["token"] not in logged
+    execute_action([["AC_revoke_lease", {"token": issued["token"]}]])
+
+
+def test_the_extraction_is_free_of_qt():
+    import je_auto_control.gui.script_builder.step_model as step_model
+    assert "PySide6" not in Path(step_model.__file__).read_text(encoding="utf-8")
+
+
+def test_the_strings_exist_in_every_catalogue_with_the_same_placeholders():
+    import re
+
+    from je_auto_control.gui.language_wrapper.english import english_word_dict
+    from je_auto_control.gui.language_wrapper.japanese import japanese_word_dict
+    from je_auto_control.gui.language_wrapper.simplified_chinese import simplified_chinese_word_dict
+    from je_auto_control.gui.language_wrapper.traditional_chinese import traditional_chinese_word_dict
+
+    def placeholders(text: str) -> list:
+        return sorted(re.findall(r"\{(\w+)\}", text))
+
+    for catalogue in (japanese_word_dict, simplified_chinese_word_dict, traditional_chinese_word_dict):
+        for key in _KEYS:
+            assert catalogue[key].strip()
+            assert placeholders(catalogue[key]) == placeholders(english_word_dict[key]), key
+
+
+# --- the tab, offscreen ------------------------------------------------------
+
+
+@pytest.fixture()
+def builder(monkeypatch):
+    """A Script Builder tab, its module, and the list standing in for the clipboard."""
+    pytest.importorskip("PySide6.QtWidgets", exc_type=ImportError)
+    from PySide6.QtWidgets import QApplication
+
+    from je_auto_control.gui.script_builder import builder_tab, one_time_dialog
+
+    app = QApplication.instance()
+    if app is None:
+        app = QApplication([])
+    copied: list = []
+    monkeypatch.setattr(one_time_dialog, "_copy_to_clipboard", copied.append)
+
+    def refuse(*_args, **_kwargs):
+        raise AssertionError("the reveal dialog must never run a nested event loop")
+    monkeypatch.setattr(one_time_dialog.OneTimeValueDialog, "exec", refuse)
+    tab = builder_tab.ScriptBuilderTab()
+    try:
+        yield tab, builder_tab, copied
+    finally:
+        tab.dispose()
+        tab.deleteLater()
+        app.processEvents()
+
+
+def _run(tab, steps) -> None:
+    from headless._qt_settle import settle
+
+    tab._tree.load_steps(steps)
+    tab._on_run()
+    assert settle(tab._runs, "task")
+
+
+def _translated(key: str, **fields) -> str:
+    from je_auto_control.gui.language_wrapper.multi_language_wrapper import language_wrapper
+    return language_wrapper.translate(key, key).format(**fields)
+
+
+def test_the_result_pane_masks_and_says_values_are_available(builder, tmp_path):
+    tab, _module, _copied = builder
+    assert not tab._reveal_btn.isEnabled(), "nothing to reveal before a run"
+    _run(tab, _user_steps(str(tmp_path / "users.json")))
+    text = tab._result.toPlainText()
+    tokens = [value.value for value in tab._one_time]
+    assert len(tokens) == 2 and all(len(token) > 20 for token in tokens)
+    assert not any(token in text for token in tokens)
+    assert '"token": "***"' in text and "ann" in text, "the masked record is still shown"
+    assert _translated("sb_one_time_available", count=2) in text
+    assert tab._reveal_btn.isEnabled()
+    assert tab._reveal_dialog is None, "nothing opens by itself"
+
+
+def test_the_dialog_shows_each_value_labelled_by_its_step_and_only_once(builder, tmp_path):
+    tab, _module, copied = builder
+    users = str(tmp_path / "users.json")
+    _run(tab, _user_steps(users))
+    tokens = [value.value for value in tab._one_time]
+    dialog = tab._take_one_time_dialog()
+    assert dialog.shown_values() == tokens
+    assert dialog.labels() == [
+        " · ".join((_translated("sb_one_time_step", step=1), "User: Add", "ann", "token")),
+        " · ".join((_translated("sb_one_time_step", step=3), "User: Rotate Token", "ann", "token")),
+    ]
+    assert not dialog.isVisible() and not dialog.isModal(), "built, not shown"
+    assert tab._one_time == [] and not tab._reveal_btn.isEnabled()
+    assert tab._take_one_time_dialog() is None, "a second reveal has nothing left"
+    assert dialog.copy_value(1) and copied == [tokens[1]]
+    assert UserStore(users).authenticate(copied[0]).user_id == "ann", "what is copied is the live token"
+    assert not dialog.copy_value(5)
+
+
+def test_closing_the_dialog_forgets_every_value(builder, tmp_path):
+    tab, _module, copied = builder
+    _run(tab, _user_steps(str(tmp_path / "users.json")))
+    dialog = tab._take_one_time_dialog()
+    assert tab._reveal_dialog is dialog
+    dialog.reject()  # what the Close button and the window's close box do
+    assert dialog.shown_values() == ["", ""] and dialog.labels() == []
+    assert not dialog.copy_value(0) and copied == []
+    assert tab._reveal_dialog is None and tab._one_time == []
+    assert tab._take_one_time_dialog() is None
+
+
+def test_the_button_opens_the_dialog_without_a_nested_event_loop(builder, tmp_path, monkeypatch):
+    tab, _module, _copied = builder
+    from je_auto_control.gui.script_builder.one_time_dialog import OneTimeValueDialog
+
+    opened: list = []
+    monkeypatch.setattr(OneTimeValueDialog, "open", lambda dialog: opened.append(dialog))
+    tab._reveal_btn.click()
+    assert opened == [], "a click with nothing pending opens nothing"
+    _run(tab, _user_steps(str(tmp_path / "users.json")))
+    tab._reveal_btn.click()
+    assert opened == [tab._reveal_dialog] and len(opened[0].shown_values()) == 2
+    opened[0].reject()
+
+
+def test_the_next_run_drops_values_nobody_revealed(builder, tmp_path):
+    tab, _module, _copied = builder
+    users = str(tmp_path / "users.json")
+    _run(tab, _user_steps(users))
+    assert len(tab._one_time) == 2
+    _run(tab, [Step("AC_user_list", {"users_path": users})])
+    assert tab._one_time == [] and not tab._reveal_btn.isEnabled()
+    assert _translated("sb_one_time_available", count=2) not in tab._result.toPlainText()
+
+
+def test_the_next_run_empties_a_dialog_still_holding_values(builder, tmp_path):
+    tab, _module, copied = builder
+    users = str(tmp_path / "users.json")
+    _run(tab, _user_steps(users))
+    dialog = tab._take_one_time_dialog()
+    _run(tab, [Step("AC_user_list", {"users_path": users})])
+    assert dialog.shown_values() == ["", ""] and not dialog.copy_value(0) and copied == []
+    assert tab._reveal_dialog is None
+
+
+def test_disposing_the_tab_forgets_pending_values_and_the_dialog(builder, tmp_path):
+    tab, _module, _copied = builder
+    users = str(tmp_path / "users.json")
+    _run(tab, _user_steps(users))
+    tab.dispose()
+    assert tab._one_time == [] and not tab._reveal_btn.isEnabled()
+    _run(tab, _user_steps(users)[2:])
+    dialog = tab._take_one_time_dialog()
+    tab.dispose()
+    assert dialog.shown_values() == [""]
+
+
+def test_a_failed_step_offers_nothing(builder, tmp_path):
+    tab, _module, _copied = builder
+    users = str(tmp_path / "users.json")
+    UserStore(users).add_user(user_id="root", display_name="root", role="admin")
+    _run(tab, [Step("AC_user_rotate_token", {"user_id": "nobody", "users_path": users})])
+    assert tab._one_time == [] and not tab._reveal_btn.isEnabled()
+    assert "nobody" in tab._result.toPlainText()
+
+
+def test_a_token_issued_inside_a_block_is_reported_as_unavailable(builder, tmp_path):
+    tab, _module, _copied = builder
+    users = str(tmp_path / "users.json")
+    _run(tab, [Step("AC_loop", {"times": 1}, bodies={"body": [
+        Step("AC_user_add", {"user_id": "bob", "users_path": users})]})])
+    assert UserStore(users).get("bob") is not None
+    assert _translated("sb_one_time_nested", commands="AC_user_add") in tab._result.toPlainText()
+    assert tab._one_time == [] and not tab._reveal_btn.isEnabled()
+
+
+# --- the value reaches nothing that is kept ----------------------------------
+
+
+class _Writes:
+    """Everything handed to a store that persists, as text."""
+
+    def __init__(self) -> None:
+        self.seen: list = []
+
+    def recorder(self, name: str, result=True):
+        def record(_self, *args, **kwargs):
+            self.seen.append(f"{name} {args!r} {kwargs!r} {json.dumps([args, kwargs], default=str)}")
+            return result
+        return record
+
+
+def test_the_token_reaches_no_log_record_journal_history_script_or_setting(
+        builder, tmp_path, monkeypatch, caplog):
+    from je_auto_control.gui.window_settings import WindowSettings
+    from je_auto_control.utils.action_journal.recorder import (
+        start_action_journal, stop_action_journal,
+    )
+    from je_auto_control.utils.run_history.history_store import HistoryStore
+    from je_auto_control.utils.test_record.record_test_class import test_record_instance
+
+    tab, _module, copied = builder
+    users = str(tmp_path / "users.json")
+    journal = tmp_path / "journal.jsonl"
+    saved = tmp_path / "saved.json"
+    writes = _Writes()
+    for name in ("start_run", "finish_run", "attach_artifact", "link_journal"):
+        monkeypatch.setattr(HistoryStore, name, writes.recorder(f"history.{name}", result=1))
+    for name in ("save", "save_form"):
+        monkeypatch.setattr(WindowSettings, name, writes.recorder(f"settings.{name}"))
+    monkeypatch.setattr(test_record_instance, "init_record", True)
+    monkeypatch.setattr(test_record_instance, "test_record_list", [])
+    autocontrol_logger.addHandler(caplog.handler)
+    start_action_journal(journal)
+    try:
+        with caplog.at_level(logging.DEBUG, logger=autocontrol_logger.name):
+            _run(tab, _user_steps(users))
+            pane_before = tab._result.toPlainText()
+            dialog = tab._take_one_time_dialog()
+            tokens = dialog.shown_values()
+            dialog.copy_value(0)
+            dialog.copy_value(1)
+            dialog.reject()
+            save_action_file(str(saved), tab._tree.root_steps(), tab._file_extras)
+    finally:
+        stop_action_journal()
+        autocontrol_logger.removeHandler(caplog.handler)
+    assert len(tokens) == 2 and copied == tokens, "the values were really revealed and copied"
+    assert UserStore(users).authenticate(tokens[1]).user_id == "ann"
+
+    outputs = {
+        "result pane before the reveal": pane_before,
+        "result pane after the reveal": tab._result.toPlainText(),
+        "log": "\n".join(entry.getMessage() for entry in caplog.records),
+        "test record": repr(test_record_instance.test_record_list),
+        "run history and GUI settings writes": "\n".join(writes.seen),
+        "the tab's steps": json.dumps(steps_to_actions(tab._tree.root_steps())),
+    }
+    for path in sorted(tmp_path.rglob("*")):
+        if path.is_file():
+            outputs[f"file {path.name}"] = path.read_bytes().decode("utf-8", errors="replace")
+    assert "AC_user_add" in outputs["log"], "the run was logged"
+    assert "AC_user_add" in outputs["file journal.jsonl"], "the run was journalled"
+    assert "AC_user_add" in outputs["file saved.json"], "the script was saved"
+    assert "file users.json" in outputs, "the store (hashes only) is searched too"
+    for name, text in outputs.items():
+        for token in tokens:
+            assert token not in text, f"the token reached: {name}"
+
+
+def test_the_reveal_code_names_no_store_that_persists():
+    """The dialog and the tab hold the values; neither module can write them anywhere."""
+    # Read as text: importing the modules needs a Qt that some CI images lack.
+    package = Path(__file__).resolve().parents[3] / "je_auto_control" / "gui" / "script_builder"
+    dialog_source = (package / "one_time_dialog.py").read_text(encoding="utf-8")
+    for word in ("autocontrol_logger", "QSettings", "window_settings", "run_history",
+                 "test_record", "action_journal", "open(", "write"):
+        assert word not in dialog_source.replace("dialog.open()", "").replace("``open()``", ""), word
+    tab_source = (package / "builder_tab.py").read_text(encoding="utf-8")
+    for word in ("autocontrol_logger", "QSettings", "window_settings", "run_history", "test_record"):
+        assert word not in tab_source, word
diff --git a/test/unit_test/headless/test_script_builder_user_commands.py b/test/unit_test/headless/test_script_builder_user_commands.py
index 0c72ece6..8a426396 100644
--- a/test/unit_test/headless/test_script_builder_user_commands.py
+++ b/test/unit_test/headless/test_script_builder_user_commands.py
@@ -45,7 +45,8 @@ def test_role_fields_offer_exactly_the_three_roles():
 
 def test_only_the_token_returning_commands_are_marked():
     marked = {command for command, spec in COMMAND_SPECS.items() if spec.sensitive_result}
-    assert marked == _TOKEN_COMMANDS
+    # AC_jwt_encode mints a bearer credential the same way: it exists only in the reply.
+    assert marked == _TOKEN_COMMANDS | {"AC_jwt_encode"}
 
 
 def test_a_run_record_is_shown_without_the_token(tmp_path):