step 4/4: the docs say permissions too, and capability means one thing again

44 files of prose — CLAUDE.md, AGENTS.md, TODO.md, 20 docs, both plugin design
documents, and the comment surface the earlier steps could not reach.

Applied against an explicit keep-list, not swept, because the word turned out to
have SIX meanings in this repository rather than the three the offscale doc
recorded:

  permissions          renamed (steps 1–2)
  $OFFICER_ROOT/capabilities/  KEPT — the item store, and now the only thing
                               the word means that is ours
  sidecar routing keys renamed to `handles` (step 3)
  Lightning wallet     KEPT — a domain term, and on the wire to the mobile apps
  terminfo queries     KEPT — XTGETTCAP, in the pty sidecar
  InvoiceShelf         KEPT — per-resource { write, bulkDelete } flags

The sweep still falsified two things, both caught by checking rather than by
review, and both in prose that discusses more than one meaning at once:

CLAUDE.md began claiming the item store lives at `$OFFICER_ROOT/permissions`.
It does not; that directory is on disk and full of skills and tools.

And the offscale doc's own note about the collision became
"Named `permissions`, NOT `permissions`" — a sentence that had eaten the thing
it existed to warn about.

Both restored, and the note rewritten to say what is now true: capability means
one thing of ours, and three that belong to somebody else's vocabulary.

Verified live after restart: self and admin permission endpoints 200, gated
route 200, agent-status 200, 9 grants intact with 6 permissions offered.
tsgo clean, 797 tests, 787 pass, same 7.

The rename is done. Four steps, no data lost, no client break that survived
the step it was introduced in.

plugins/EXTRACTING-A-PLUGIN.md

@@ -69,7 +69,7 @@ on uninstall. Only deleting a plugin's source can lose its data.
    `officerdev` (the barrel exports `WorkspaceView`, `TerminalView`, `AppRegistryMeta`); `hooks/useClient`
    and `helpers/clipboard` stay as they are.
 6. **Remove every trace from the platform**, and delete rather than comment out: `hono.ts` mount and
-   import, the `capabilities/registry.ts` entry, `App.tsx` routes, `Screens/Dashboard/index.tsx`,
+   import, the `permissions/registry.ts` entry, `App.tsx` routes, `Screens/Dashboard/index.tsx`,
    `AppRegistry.tsx`, `officerdev/src/index.ts` re-exports, `Dock.tsx` tile, `usePageTitle.ts` rule, and
    **both** database barrels (`index.ts` and `schema.ts`).
 7. **`bunx tsgo`** until clean. It finds the wiring you missed.
@@ -117,9 +117,9 @@ A normal refresh is enough; the shell is `no-store`. When the log's last line ap
 - **The shell output is named for the entrypoint** (`index.gen.html`), and `naming` does not change it.
 - **A stale generated file** (`Plugins.gen.tsx`, `plugin-schemas.gen.ts`) will fail the typecheck after a
   contract change. Regenerate rather than hand-edit.
-- **Delete the feature's `app-store/catalogue.ts` entry, or its screen goes blank.** `capabilityAvailability`
+- **Delete the feature's `app-store/catalogue.ts` entry, or its screen goes blank.** `permissionAvailability`
   derives from `sidecar_installs`, and a plugin never gets a row there — its install state is
-  `plugin_installs`. A leftover catalogue entry therefore makes the capability permanently `unavailable`,
+  `plugin_installs`. A leftover catalogue entry therefore makes the permission permanently `unavailable`,
   which puts its route into `deniedRoutes` and withholds the dock tile, on a server where the plugin is
   installed and healthy. This has now bitten twice: headscale (2026-08-14) and nearly music. The note in
   `catalogue.ts` is the one to read.
@@ -180,10 +180,10 @@ No decision has been made. What the tree says, for whoever picks it:
 
 - **Websocket providers** — `server.reload({ routes })` proven, never called. No plugin owns a socket yet;
   music would have been the first and cliamp being out of scope is what let it pass.
-- **`assertCapabilityTotality` reads the wrong list** — `Object.keys(handlers)` while Bun serves the route
+- **`assertPermissionTotality` reads the wrong list** — `Object.keys(handlers)` while Bun serves the route
   table, and plugin routes are not in `PROTECTED_API_PREFIXES` at all. It belongs in `buildHonoApp()`,
   now the single place routes are mounted. Security-adjacent; close it before members reach plugin routes.
-  The live example is the two cliamp sockets: served in the route table, claimed by no capability, and
+  The live example is the two cliamp sockets: served in the route table, claimed by no permission, and
   invisible to the check. Pinned by a test in `registry.test.ts` so it stays a known fact.
 - **Two dock sources** — the app store keeps its own catalogue; one when it is rebuilt on this
 - **Offscale's queries scope by caller**, so a granted member sees their own empty list rather than the