diff --git a/CHANGELOG.md b/CHANGELOG.md
index 4f387b365..b027914ca 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -7,6 +7,16 @@ Releases follow [Semantic Versioning](https://semver.org/).
 
 ### Breaking Changes
 
+- **profiles / tool refusals:** a profile's tool refusal now names the profile to a caller whose
+  effective profile is its own (a pin, a client binding, the URL or `set_profile`):
+  `blocked by profile: github:create_issue is a write tool; profile "Work Read-only" (work-readonly)
+  allows read tools only`, and likewise for the deny-rule and unannotated texts. `retrieve_tools`
+  returns `profile` for the same callers. A caller that connects without a credential keeps the
+  previous, non-disclosing text and gets no `profile` field, so the operator's `anonymous_profile` is
+  never handed out. **Migration:** a consumer that matches the old refusal wording for a pinned or
+  bound credential should match on the `block_reason` (`profile_tier`, `profile_rule`,
+  `profile_unannotated`) instead. (spec 108 D39, narrowing D27)
+
 - **mcp/describe_tool:** the per-id error code `invisible` is retired. An id on a server the
   session cannot see (agent-token scope or active profile) now reports `not_found` — the same
   code, `remediation` text and shape as an id that does not exist. A distinct code confirmed
@@ -61,6 +71,13 @@ Releases follow [Semantic Versioning](https://semver.org/).
 
 ### Features
 
+- **catalog:** a catalog source whose live search times out or fails is now answered from the listing
+  the daemon last saw from it (at most 24 hours old, kept in memory). Those results are marked
+  `from_cache` ("From cached list" in the Web UI and macOS, `(cached)` in the CLI) and the source
+  stays in `unavailable[]` with `fallback` and `cached_at`. The empty-query browse lists Popular
+  before Official and the curated reference servers first. (spec 109 FR-060, D35)
+- **web:** the command palette (Cmd/Ctrl+K) also finds profiles, clients and agent tokens. (spec 109 FR-054)
+
 - **mcp:** schema-deferred direct mode — a new `direct_tool_response_mode` key (`full` | `deferred`,
   **default `full`, so this is opt-in and changes nothing until you turn it on**). In `deferred`,
   the direct enumeration surface (`/mcp/all`, and `/mcp` under `routing_mode: "direct"`) lists every
@@ -150,6 +167,14 @@ Releases follow [Semantic Versioning](https://semver.org/).
 
 ### Bug Fixes
 
+- **web/settings:** toggles for nullable settings (`quarantine_enabled`, `telemetry.enabled` and the
+  `audit_log.*` booleans) show the value the core actually applies instead of OFF when the key is
+  absent, and the page header now says to press Save changes instead of "Changes save instantly".
+  (spec 109 D35)
+- **web/clients:** the token Profile chip stays on one line, radio and checkbox labels sit next to
+  their control, and a client with no mcpproxy entry offers **Connect** (macOS: Connect…) instead of
+  "Upgrade to client credential". (spec 108 D39)
+
 - **security/scope:** `set_profile` and `/mcp/p` now report the intersection of an agent
   token's grant and the requested profile through a single selectable-profile predicate; a
   non-selectable profile is refused identically to a nonexistent one, closing a scope-disclosure
diff --git a/ROADMAP.md b/ROADMAP.md
index df6a029ed..78ac342af 100644
--- a/ROADMAP.md
+++ b/ROADMAP.md
@@ -1035,7 +1035,7 @@ Legend: `shipped` ≥95% checked · `in-flight` 1–94% · `drafted` 0% · `—`
 | [105-agent-scope-hardening](./specs/105-agent-scope-hardening/) | `in-flight` | 94/113 (83%) |
 | [106-security-residual-fixes](./specs/106-security-residual-fixes/) | `shipped` | 18/19 (95%) |
 | [107-server-edition-sso-hardening](./specs/107-server-edition-sso-hardening/) | `shipped` | 126/126 (100%) |
-| [108-profiles-v3](./specs/108-profiles-v3/) | `shipped` | 180/181 (99%) |
-| [109-ux-navigation-consistency](./specs/109-ux-navigation-consistency/) | `shipped` | 194/195 (99%) |
+| [108-profiles-v3](./specs/108-profiles-v3/) | `shipped` | 185/186 (99%) |
+| [109-ux-navigation-consistency](./specs/109-ux-navigation-consistency/) | `shipped` | 200/201 (100%) |
 | [110-catalog-popularity](./specs/110-catalog-popularity/) | `in-flight` | 19/23 (83%) |
 | [112-client-header-forwarding](./specs/112-client-header-forwarding/) | `shipped` | 38/40 (95%) |
diff --git a/cmd/mcpproxy/activity_blocked_refusal_test.go b/cmd/mcpproxy/activity_blocked_refusal_test.go
new file mode 100644
index 000000000..c72fbbf0d
--- /dev/null
+++ b/cmd/mcpproxy/activity_blocked_refusal_test.go
@@ -0,0 +1,98 @@
+package main
+
+import (
+	"encoding/json"
+	"net/http"
+	"net/http/httptest"
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+// Spec 108 D39 (T148): the CLI prints a blocked record's refusal text
+// verbatim. The text is the disclosed refusal of
+// internal/profile/testdata/contract/tool_refusals.json: the activity record is
+// what the operator reads, so the CLI must neither truncate, re-wrap nor
+// "tidy" the quoted profile title.
+
+func toolRefusalFromGolden(t *testing.T, name, label string) string {
+	t.Helper()
+	raw, err := os.ReadFile(filepath.Join("..", "..", "internal", "profile", "testdata", "contract", "tool_refusals.json"))
+	require.NoError(t, err)
+	var g struct {
+		Refusals []struct {
+			Name      string `json:"name"`
+			Disclosed string `json:"disclosed"`
+		} `json:"refusals"`
+	}
+	require.NoError(t, json.Unmarshal(raw, &g))
+	for _, r := range g.Refusals {
+		if r.Name == name {
+			return strings.NewReplacer(
+				"<server>", "github", "<tool>", "create_issue", "<tier>", "write", "<cap>", "read", "<label>", label,
+			).Replace(r.Disclosed)
+		}
+	}
+	t.Fatalf("no golden refusal %q", name)
+	return ""
+}
+
+func TestActivityBlockedRefusalTextVerbatim_CLI(t *testing.T) {
+	text := toolRefusalFromGolden(t, "tier", `"Work Read-only" (work-readonly)`)
+	require.Contains(t, text, `profile "Work Read-only" (work-readonly) allows read tools only`)
+
+	record := map[string]any{
+		"id": "01BLOCKED", "source": "mcp", "type": "policy_decision", "server_name": "github", "tool_name": "create_issue",
+		"status": "blocked", "timestamp": "2026-10-02T09:00:00Z", "error_message": text,
+		"client_id": "cursor", "profile": "work-readonly", "profile_source": "pin", "token_name": "client-cursor",
+		"metadata": map[string]any{"block_reason": "profile_tier", "reason": text},
+	}
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		w.Header().Set("Content-Type", "application/json")
+		switch r.URL.Path {
+		case "/api/v1/status":
+			_, _ = w.Write([]byte(`{"success":true,"data":{"running":true}}`))
+		case "/api/v1/activity":
+			body, _ := json.Marshal(map[string]any{"success": true, "data": map[string]any{
+				"activities": []map[string]any{record}, "total": 1, "limit": 50, "offset": 0,
+			}})
+			_, _ = w.Write(body)
+		case "/api/v1/activity/01BLOCKED":
+			body, _ := json.Marshal(map[string]any{"success": true, "data": map[string]any{"activity": record}})
+			_, _ = w.Write(body)
+		default:
+			w.WriteHeader(http.StatusNotFound)
+		}
+	}))
+	t.Cleanup(srv.Close)
+	withClientDaemon(t, srv.URL)
+
+	t.Run("activity list -o json carries the text verbatim", func(t *testing.T) {
+		p108ResetFlags(activityListCmd)
+		t.Cleanup(func() { p108ResetFlags(activityListCmd) })
+		out, _, err := runCLI(t, GetActivityCommand, "json", "list", "--status", "blocked")
+		require.NoError(t, err)
+		var doc struct {
+			Activities []struct {
+				ErrorMessage string `json:"error_message"`
+				Metadata     struct {
+					Reason string `json:"reason"`
+				} `json:"metadata"`
+			} `json:"activities"`
+		}
+		require.NoError(t, json.Unmarshal([]byte(out), &doc), out)
+		require.Len(t, doc.Activities, 1)
+		assert.Equal(t, text, doc.Activities[0].ErrorMessage)
+		assert.Equal(t, text, doc.Activities[0].Metadata.Reason)
+	})
+
+	t.Run("activity show (table) prints the text verbatim", func(t *testing.T) {
+		out, _, err := runCLI(t, GetActivityCommand, "table", "show", "01BLOCKED")
+		require.NoError(t, err)
+		assert.Contains(t, out, "Error:        "+text)
+	})
+}
diff --git a/cmd/mcpproxy/catalog_cached_fallback_test.go b/cmd/mcpproxy/catalog_cached_fallback_test.go
new file mode 100644
index 000000000..3e9701eb1
--- /dev/null
+++ b/cmd/mcpproxy/catalog_cached_fallback_test.go
@@ -0,0 +1,152 @@
+package main
+
+import (
+	"context"
+	"encoding/json"
+	"net/http"
+	"net/http/httptest"
+	"os"
+	"path/filepath"
+	"strings"
+	"sync/atomic"
+	"testing"
+
+	"github.com/smart-mcp-proxy/mcpproxy-go/internal/config"
+	"github.com/smart-mcp-proxy/mcpproxy-go/internal/registries"
+)
+
+// Spec 109 D35 (T160): the CLI leg of the cached-fallback chain. While one
+// source is down, `catalog search github` lists the same ids in the same order
+// as the REST golden (internal/registries/testdata/catalog_cached_fallback_order.json),
+// `-o json` carries from_cache and unavailable[].fallback, and the table marks
+// cached rows and says why.
+
+type p109CachedFallbackFile struct {
+	Query   string `json:"query"`
+	Sources []struct {
+		ID         string            `json:"id"`
+		Name       string            `json:"name"`
+		Provenance string            `json:"provenance"`
+		Flaky      bool              `json:"flaky"`
+		Servers    []json.RawMessage `json:"servers"`
+	} `json:"sources"`
+	IDs     []string `json:"ids"`
+	Results []struct {
+		Source    string `json:"source"`
+		ID        string `json:"id"`
+		FromCache bool   `json:"from_cache"`
+	} `json:"results"`
+	Unavailable []struct {
+		Source   string `json:"source"`
+		Fallback string `json:"fallback"`
+	} `json:"unavailable"`
+}
+
+func TestCatalogCachedFallbackParityCLI(t *testing.T) {
+	raw, err := os.ReadFile(filepath.Join("..", "..", "internal", "registries", "testdata", "catalog_cached_fallback_order.json"))
+	if err != nil {
+		t.Fatal(err)
+	}
+	var f p109CachedFallbackFile
+	if err := json.Unmarshal(raw, &f); err != nil {
+		t.Fatal(err)
+	}
+	if len(f.IDs) == 0 {
+		t.Fatal("the REST golden is missing; run the httpapi cached-fallback test with UPDATE_GOLDEN=1")
+	}
+
+	registries.ResetListingCacheForTest()
+	t.Cleanup(registries.ResetListingCacheForTest)
+	var broken atomic.Bool
+	var entries []registries.RegistryEntry
+	for _, src := range f.Sources {
+		body, _ := json.Marshal(src.Servers)
+		flaky := src.Flaky
+		srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
+			if flaky && broken.Load() {
+				http.Error(w, "down", http.StatusInternalServerError)
+				return
+			}
+			w.Header().Set("Content-Type", "application/json")
+			_, _ = w.Write(body)
+		}))
+		t.Cleanup(srv.Close)
+		entries = append(entries, registries.RegistryEntry{ID: src.ID, Name: src.Name, ServersURL: srv.URL, Provenance: src.Provenance})
+	}
+	t.Cleanup(registries.AllowPrivateRegistryFetchForTest())
+	t.Cleanup(registries.SetRegistriesForTest(entries))
+
+	cfg := &config.Config{}
+	if _, err := catalogSearchInProcess(context.Background(), cfg, "", "", "", 20); err != nil { // prime
+		t.Fatal(err)
+	}
+	broken.Store(true)
+	resp, err := catalogSearchInProcess(context.Background(), cfg, f.Query, "", "", 20)
+	if err != nil {
+		t.Fatalf("catalogSearchInProcess: %v", err)
+	}
+
+	var got []string
+	for i, r := range resp.Results {
+		got = append(got, r.Source+":"+r.ID)
+		if r.FromCache != f.Results[i].FromCache {
+			t.Errorf("%s: from_cache = %v, want %v", r.ID, r.FromCache, f.Results[i].FromCache)
+		}
+	}
+	if strings.Join(got, ",") != strings.Join(f.IDs, ",") {
+		t.Errorf("CLI order = %v, want the REST golden %v", got, f.IDs)
+	}
+	if len(resp.Unavailable) != len(f.Unavailable) || resp.Unavailable[0].Fallback != f.Unavailable[0].Fallback {
+		t.Fatalf("unavailable = %+v, want %+v", resp.Unavailable, f.Unavailable)
+	}
+
+	// -o json carries the same fields as REST.
+	setOutputGlobals(t, "json", false)
+	formatter, err := GetOutputFormatter()
+	if err != nil {
+		t.Fatal(err)
+	}
+	out := captureOutput(func() {
+		if err := renderCatalogSearch(formatter, resp); err != nil {
+			t.Fatalf("renderCatalogSearch: %v", err)
+		}
+	})
+	var decoded struct {
+		Results     []registries.CatalogResult `json:"results"`
+		Unavailable []registries.SourceError   `json:"unavailable"`
+	}
+	if err := json.Unmarshal([]byte(out), &decoded); err != nil {
+		t.Fatalf("-o json did not parse: %v\n%s", err, out)
+	}
+	var jsonIDs []string
+	for _, r := range decoded.Results {
+		jsonIDs = append(jsonIDs, r.Source+":"+r.ID)
+	}
+	if strings.Join(jsonIDs, ",") != strings.Join(f.IDs, ",") {
+		t.Errorf("-o json order = %v, want %v", jsonIDs, f.IDs)
+	}
+	if !strings.Contains(out, `"from_cache": true`) || !strings.Contains(out, `"fallback": "cached_listing"`) {
+		t.Errorf("-o json must carry from_cache and unavailable[].fallback, got:\n%s", out)
+	}
+
+	// The table marks cached rows and says what happened.
+	setOutputGlobals(t, "table", false)
+	formatter, err = GetOutputFormatter()
+	if err != nil {
+		t.Fatal(err)
+	}
+	table := captureOutput(func() {
+		if err := renderCatalogSearch(formatter, resp); err != nil {
+			t.Fatalf("renderCatalogSearch: %v", err)
+		}
+	})
+	if !strings.Contains(table, "slowreg (cached)") {
+		t.Errorf("cached rows must read `slowreg (cached)` in SOURCE, got:\n%s", table)
+	}
+	if strings.Contains(table, "official (cached)") {
+		t.Errorf("live rows must not be marked cached, got:\n%s", table)
+	}
+	if !strings.Contains(table, "slowreg unavailable:") || !strings.Contains(table, "showing matches from its cached list") {
+		t.Errorf("expected the unavailable line with the fallback sentence, got:\n%s", table)
+	}
+}
diff --git a/cmd/mcpproxy/catalog_cmd.go b/cmd/mcpproxy/catalog_cmd.go
index 3800a956f..a35e0c31b 100644
--- a/cmd/mcpproxy/catalog_cmd.go
+++ b/cmd/mcpproxy/catalog_cmd.go
@@ -375,14 +375,36 @@ func catalogInstallTargetForConfigServer(s *config.ServerConfig) string {
 func renderCatalogSearch(formatter clioutput.OutputFormatter, resp *cliclient.CatalogSearchResponse) error {
 	if _, isTable := formatter.(*clioutput.TableFormatter); isTable {
 		if resp.Sections != nil {
-			fmt.Println("Official:")
-			printCatalogTable(formatter, resp.Sections.Official)
-			fmt.Println("\nPopular:")
-			printCatalogTable(formatter, resp.Sections.Popular)
+			// Popular first when it has entries (popularity if available, else
+			// the curated Official list), and never an empty section's header
+			// and table (Spec 109 D35). Same order as the Web UI and macOS.
+			printed := false
+			section := func(title string, rows []registries.CatalogResult) {
+				if len(rows) == 0 {
+					return
+				}
+				if printed {
+					fmt.Println()
+				}
+				fmt.Println(title + ":")
+				printCatalogTable(formatter, rows)
+				printed = true
+			}
+			section("Popular", resp.Sections.Popular)
+			section("Official", resp.Sections.Official)
+			if !printed {
+				printCatalogTable(formatter, nil)
+			}
 		} else {
 			printCatalogTable(formatter, resp.Results)
 		}
 		for _, u := range resp.Unavailable {
+			if u.Fallback != "" {
+				// The live fetch failed but its cached listing answered
+				// (Spec 109 D35); the rows above are marked (cached).
+				fmt.Printf("⚠ %s unavailable: %s; showing matches from its cached list\n", u.Source, u.Reason)
+				continue
+			}
 			fmt.Printf("⚠ %s unavailable: %s\n", u.Source, u.Reason)
 		}
 		return nil
@@ -403,7 +425,11 @@ func printCatalogTable(formatter clioutput.OutputFormatter, results []registries
 		if r.Added {
 			added = "✓"
 		}
-		rows = append(rows, []string{r.Source, r.ID, truncateStr(r.Title, 40), r.Transport, added})
+		source := r.Source
+		if r.FromCache {
+			source += " (cached)"
+		}
+		rows = append(rows, []string{source, r.ID, truncateStr(r.Title, 40), r.Transport, added})
 	}
 	out, err := formatter.FormatTable(headers, rows)
 	if err == nil {
diff --git a/cmd/mcpproxy/catalog_cmd_test.go b/cmd/mcpproxy/catalog_cmd_test.go
index b27891194..655f3d8db 100644
--- a/cmd/mcpproxy/catalog_cmd_test.go
+++ b/cmd/mcpproxy/catalog_cmd_test.go
@@ -11,6 +11,7 @@ import (
 	"strings"
 	"testing"
 
+	"github.com/smart-mcp-proxy/mcpproxy-go/internal/cliclient"
 	"github.com/smart-mcp-proxy/mcpproxy-go/internal/config"
 	"github.com/smart-mcp-proxy/mcpproxy-go/internal/registries"
 )
@@ -195,8 +196,61 @@ func TestCatalogSearchInProcess_BrowseSections(t *testing.T) {
 			t.Fatalf("render error: %v", err)
 		}
 	})
-	if !strings.Contains(out, "Official:") || !strings.Contains(out, "Popular:") {
-		t.Errorf("expected Official/Popular section headers, got:\n%s", out)
+	// No popularity signal in this fixture: Official only, no empty Popular table.
+	if !strings.Contains(out, "Official:") || strings.Contains(out, "Popular:") {
+		t.Errorf("expected only the Official section header (Popular is empty), got:\n%s", out)
+	}
+}
+
+// Spec 109 D35 (T164): the browse table lists Popular first when it has
+// entries, then Official, and never prints the header and table of an empty
+// section.
+func TestRenderCatalogSearch_PopularBeforeOfficialAndEmptySectionHidden(t *testing.T) {
+	official := []registries.CatalogResult{{Source: "reference", ID: "reference/filesystem", Title: "filesystem", Transport: "stdio"}}
+	popular := []registries.CatalogResult{{Source: "official", ID: "io.github.x/hot", Title: "hot server", Transport: "stdio"}}
+
+	setOutputGlobals(t, "table", false)
+	formatter, err := GetOutputFormatter()
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	both := captureOutput(func() {
+		if err := renderCatalogSearch(formatter, &cliclient.CatalogSearchResponse{
+			Sections: &cliclient.CatalogSections{Official: official, Popular: popular},
+		}); err != nil {
+			t.Fatal(err)
+		}
+	})
+	pi, oi := strings.Index(both, "Popular:"), strings.Index(both, "Official:")
+	if pi < 0 || oi < 0 || pi > oi {
+		t.Fatalf("expected Popular: before Official:, got:\n%s", both)
+	}
+	if strings.Index(both, "hot server") > strings.Index(both, "filesystem") {
+		t.Errorf("expected the popular row before the official row, got:\n%s", both)
+	}
+
+	onlyOfficial := captureOutput(func() {
+		if err := renderCatalogSearch(formatter, &cliclient.CatalogSearchResponse{
+			Sections: &cliclient.CatalogSections{Official: official},
+		}); err != nil {
+			t.Fatal(err)
+		}
+	})
+	if strings.Contains(onlyOfficial, "Popular:") || !strings.Contains(onlyOfficial, "Official:") {
+		t.Errorf("an empty Popular section must be hidden, got:\n%s", onlyOfficial)
+	}
+	if strings.Count(onlyOfficial, "Found ") != 1 {
+		t.Errorf("expected exactly one results footer, got:\n%s", onlyOfficial)
+	}
+
+	neither := captureOutput(func() {
+		if err := renderCatalogSearch(formatter, &cliclient.CatalogSearchResponse{Sections: &cliclient.CatalogSections{}}); err != nil {
+			t.Fatal(err)
+		}
+	})
+	if strings.Contains(neither, "Popular:") || strings.Contains(neither, "Official:") {
+		t.Errorf("no section header when both are empty, got:\n%s", neither)
 	}
 }
 
diff --git a/docs/api/rest-api.md b/docs/api/rest-api.md
index 617e2874c..2c009c5d7 100644
--- a/docs/api/rest-api.md
+++ b/docs/api/rest-api.md
@@ -1001,7 +1001,7 @@ Search every enabled catalog source (registry) at once. Both editions; open to a
 }
 ```
 
-Results are ranked: official source first, then verified publishers, then popularity (a missing value counts as zero), then text relevance, then title and id. The order is identical on the Web UI, macOS, the CLI (`mcpproxy catalog search`) and the MCP `search_servers` tool. A source that fails or times out is listed in `unavailable` and the other sources' results are still returned. `added` is true when a configured server visible to the caller has the same source and install target, and then `added_server_name` names it. Adding an entry stays `POST /api/v1/registries/{id}/servers/{serverId}/add`, which always quarantines the new server; see [Registry Add](../features/registry-add.md).
+Results are ranked: official source first, then verified publishers, then popularity (a missing value counts as zero), then text relevance, then title and id. The order is identical on the Web UI, macOS, the CLI (`mcpproxy catalog search`) and the MCP `search_servers` tool. A source that fails or times out is listed in `unavailable` and the other sources' results are still returned. When the daemon has a recent listing of that source (at most 24 hours old, kept in memory and filled by every successful fetch), the matches come from it instead: those results carry `from_cache: true` and the `unavailable` entry gains `fallback: "cached_listing"` and `cached_at`, so the source still reads as unavailable. An empty `q` lists `popular` before `official` in every surface, and `official` starts with the curated reference servers. `added` is true when a configured server visible to the caller has the same source and install target, and then `added_server_name` names it. Adding an entry stays `POST /api/v1/registries/{id}/servers/{serverId}/add`, which always quarantines the new server; see [Registry Add](../features/registry-add.md).
 
 ### Registries
 
diff --git a/docs/cli/catalog-commands.md b/docs/cli/catalog-commands.md
index e3fc521a6..36b9ec96d 100644
--- a/docs/cli/catalog-commands.md
+++ b/docs/cli/catalog-commands.md
@@ -44,7 +44,7 @@ community  acme/github-fork                   GitHub (community fork)  http
 Found 3 results. Add one with: mcpproxy catalog add <source>/<id>
 ```
 
-With no query the output has two blocks, `Official:` and `Popular:`. A source that did not answer prints `⚠ <source> unavailable: <reason>` after the table. `-o json` adds `official`, `verified`, `publisher` and `popularity` to every result.
+With no query the output has two blocks, `Popular:` first when any server has a popularity signal, then `Official:` (the curated reference servers first); an empty block is not printed. A source that did not answer prints `⚠ <source> unavailable: <reason>` after the table. When the daemon holds a recent listing of that source, its matches are shown instead, their SOURCE reads `<source> (cached)` and the line ends `; showing matches from its cached list`. The listing cache lives in the daemon, so `catalog search` without a running daemon has none. `-o json` adds `official`, `verified`, `publisher`, `popularity` and `from_cache` to every result, and `fallback` and `cached_at` to the `unavailable` entry.
 
 ## catalog show
 
diff --git a/docs/development/macos-tray.md b/docs/development/macos-tray.md
index 0386a6985..bbbb73231 100644
--- a/docs/development/macos-tray.md
+++ b/docs/development/macos-tray.md
@@ -63,10 +63,10 @@ After a change under `Views/Profiles*`, `Views/Client*`, `Views/AccessExplainer*
 1. **Profiles (⌘3).** The "All servers" card comes first, then one card per profile with its tier, tool counts, "Used by" and calls in 24 h. The Tools, Activity, Clients and Tokens links open the destination filtered by that profile, and the ✕ on the chip clears it. Toolbar "+ > Profile" opens the editor on a new profile.
 2. **Editor.** Create `work-ro-mac` (servers, max tier Read, a title). A write tool reads "Above tier cap" and an unannotated one "Unannotated — classify". Classify an unannotated tool as Read and Save: the row becomes visible. Classify an annotated tool: the stale marker "classification ignored — tool is now annotated" appears with a Remove button. "Try it" with an unsaved edit shows "Hidden by profile: N" and leaves the stored profile unchanged. A 400 lands on its field, and a 409 binding guard shows the guard view with two fixes that only open Settings.
 3. **Rename and delete** list what they move (clients with their mode, tokens, profiles that list it, anonymous callers) and require a target when anything is listed.
-4. **Clients.** A row shows `Profile · locked` and a credential badge. The detail has the profile Picker, the Locked toggle, credential state, "Blocked (24h)", Rotate, Finalize rotation, Forget and Explain access. A client with no active client credential has no working Picker; it shows "Upgrade to client credential…" or "Reconnect…". Changing the Picker from a terminal (`PUT /clients/<id>/binding`) updates the row and the tray within a second (SSE `client.binding_changed`).
+4. **Clients.** A row shows `Profile · locked` and a credential badge. The detail has the profile Picker, the Locked toggle, credential state, "Blocked (24h)", Rotate, Finalize rotation, Forget and Explain access. A client with no active client credential has no working Picker; it shows one button: "Connect…" for a client with no mcpproxy entry, "Upgrade to client credential…" for one that holds the admin key, or "Reconnect…" for a revoked or expired credential. Changing the Picker from a terminal (`PUT /clients/<id>/binding`) updates the row and the tray within a second (SSE `client.binding_changed`).
 5. **Sheets.** "Move Clients…" shows `skipped` clients. "Upgrade Admin-Key Clients…" shows the combined preview; with a named profile and authentication off the guard disables Apply, and "Require authentication…" opens Settings → Security scrolled to and highlighting `require_mcp_auth`. "Other Client…" shows the credential once with Copy; reopening shows nothing.
 6. **Connect sheet.** With a profile chosen the lock is on, the preview shows `Credential: mcp_cli_•••• (client credential)`, and the notice "This client can no longer add, change or restart servers…" shows unless the profile sets `management_tools`. There is no API-key notice. The result line reads `Credential: mcp_cli_•••• (token client-<id>, profile <name>, locked)`.
-7. **Tray.** `list_menu_items` has a "Clients" submenu and **no** item starting "Profile:". Rows read `name — profile 🔒`, the current profile is checked, Lock is disabled on All servers, and a client without a credential offers only "Upgrade to client credential…".
+7. **Tray.** `list_menu_items` has a "Clients" submenu and **no** item starting "Profile:". Rows read `name — profile 🔒`, the current profile is checked, Lock is disabled on All servers, and a client without a credential offers only its one call to action ("Connect…", "Upgrade to client credential…" or "Reconnect…").
 8. **Tokens.** Create Token asks for a Profile first and an Expiry (default 30 days); the legacy servers and permissions sit under "Legacy scope (advanced)". Legacy tokens show "Legacy scope" and "Migrate to a profile"; client-credential rows have no Revoke. The Profile and token-name filters send `GET /tokens?profile=&token=`.
 9. **Settings → Security → Anonymous callers** saves `anonymous_profile`; a refused change shows the guard view, and a fix button preselects the picker without saving.
 10. **Scoped views.** Tools "View as Client… / Profile…" greys rows the subject cannot use, with the reason and a "Why?" button that opens the explainer. Activity shows a Caller column and Profile, Client and Token pickers. Home filters usage and sessions by the same three and shows Profile and Source columns. Servers filters by profile.
diff --git a/docs/development/release-gate.md b/docs/development/release-gate.md
index 37297b07b..296c2c2bf 100644
--- a/docs/development/release-gate.md
+++ b/docs/development/release-gate.md
@@ -129,6 +129,10 @@ page disagree):
   sidebar and `+ Add`, the Viewing chip across pages, Clients-row and
   agent-token-row links, `/servers?profile=`, a Spec 108 warning surfacing as a
   needs-attention item, layout and keyboard order).
+- `demo-ux-fixes.spec.ts`: the layout findings of the live Web UI demo, measured
+  at 1440 and 900 px: the token Profile chip is one line inside its cell, and
+  radio labels sit next to their radios in the create-profile, custom-client and
+  bulk-move dialogs.
 
 Setup is not duplicated in YAML: the job calls
 [`scripts/run-web-smoke.sh`](https://github.com/smart-mcp-proxy/mcpproxy-go/blob/main/scripts/run-web-smoke.sh),
diff --git a/docs/development/web-ui-verification.md b/docs/development/web-ui-verification.md
index 69196d954..b03fa6cf4 100644
--- a/docs/development/web-ui-verification.md
+++ b/docs/development/web-ui-verification.md
@@ -28,6 +28,8 @@ Alongside it, [`e2e/web-ui-sweep/visual-a11y-sweep.spec.ts`](https://github.com/
 
 [`e2e/web-ui-sweep/profiles-unhide.spec.ts`](https://github.com/smart-mcp-proxy/mcpproxy-go/blob/main/e2e/web-ui-sweep/profiles-unhide.spec.ts) guards the Spec 108 un-hide of Spec 109 (`specs/109-ux-navigation-consistency`, PR 109-l). It reuses `profiles-seed.ts` and adds a run-unique agent token and a client credential that expires in 7 days (a revoked token keeps its name, so a fixed name would collide on a re-run). It checks that Profiles is in the sidebar and "+ Add → Profile" opens the create dialog; that the header Viewing chip survives Activity, Usage and Tools and Back restores it; that an expanded Clients row links Activity, Sessions, "Tools it sees" and Usage by client; that an agent-token row links Activity and Usage by token; that `/servers?profile=` lists only that profile's servers with a removable chip; that creating the expiring credential makes a `client_credential_expiring` needs-attention item appear within seconds, first in the list, whose fix lands on `/clients?focus=<id>`; the layout at 1440/900/390px (no page-level horizontal scroll, the fix button at least 24px tall); and the Tab order to the attention fix and each Clients-row link. The binding-guard item cannot be produced through the API (the API refuses a bypassable binding, `409`), so its rendering is pinned by `attention-108-targets.spec.ts` and the live recipe instead.
 
+[`e2e/web-ui-sweep/demo-ux-fixes.spec.ts`](https://github.com/smart-mcp-proxy/mcpproxy-go/blob/main/e2e/web-ui-sweep/demo-ux-fixes.spec.ts) guards the two pixel-level findings of the live Web UI demo (Spec 108 T149 and T151). It seeds a profile titled `Work Read-only for very long client names 2026` and a token pinned to it, then at 1440x900 and 900x900 checks that the token's Profile chip is a single line inside its table cell with the full title on hover (a Range over its text reports one line, and its scroll height does not exceed its client height), and that the radio labels of the create-profile, custom-client and bulk-move dialogs start within 16 px of their radios. It attaches screenshots to the report.
+
 The release QA gate runs this exact script on every tag as its **advisory** `web-ui-sweep` job — see [Release Gate](release-gate.md#web-ui-sweep-t2--advisory). Extend the committed sweep when you add a screen worth guarding on releases; use the ad-hoc pattern below for the deeper, spec-specific verification that ships beside a spec.
 
 ## Ad-hoc, spec-specific verification
diff --git a/docs/features/profiles.md b/docs/features/profiles.md
index 3b8d0617a..f65f2df96 100644
--- a/docs/features/profiles.md
+++ b/docs/features/profiles.md
@@ -87,12 +87,12 @@ Patterns are `server:tool` with `*` as the only wildcard, matched case-sensitive
 
 | Surface | A tool the profile excludes |
 |---|---|
-| `retrieve_tools` | Left out **before** the result limit, and counted in `hidden_by_profile` without naming any of them. A pinned or bound caller never learns which profile it is under |
+| `retrieve_tools` | Left out **before** the result limit, and counted in `hidden_by_profile` without naming any of them. The response names the caller's own profile (`profile`) when it came from the caller's own credential or choice, never the operator's anonymous profile |
 | `describe_tool` | The same not-found answer as a tool that does not exist |
-| `call_tool_read`, `call_tool_write`, `call_tool_destructive`, `/mcp/all`, REST `/tools/call` | Refused before any upstream call with `blocked by profile: <server>:<tool> is a <tier> tool; this profile allows <cap> tools only`, or `... is denied by a profile rule`, or `... has no tier annotation; an operator can classify it in the profile to allow it` |
+| `call_tool_read`, `call_tool_write`, `call_tool_destructive`, `/mcp/all`, REST `/tools/call` | Refused before any upstream call with `blocked by profile: <server>:<tool> is a <tier> tool; profile "<title>" (<slug>) allows <cap> tools only`, or `... is denied by a rule in profile "<title>" (<slug>)`, or `... has no tier annotation; an operator can classify it in profile "<title>" (<slug>) to allow it` |
 | `code_execution` | Absent and refused when the profile turns it off; every nested `call_tool` goes through the same gate |
 
-The refusal text is identical whether the profile came from a pin, a binding, `anonymous_profile`, the URL or `set_profile`, so it never reveals that a caller is pinned or to what. The operator sees the profile in the activity record and in the explainer. A blocked call is recorded with `status=blocked` and `block_reason` `profile_tier`, `profile_rule` or `profile_unannotated` (`profile_code_execution` and `profile_management` for the tools above).
+A refusal names the profile only to a caller whose effective profile is its own: one that came from the caller's pin, its client binding, the URL or `set_profile`, so an agent can tell the operator which profile to change. A caller that connects without a credential and falls under `anonymous_profile` gets the same refusal without the profile name (`... this profile allows <cap> tools only`, `... is denied by a profile rule`, `... in the profile to allow it`), and so does a caller whose profile no longer exists, so the operator's anonymous confinement is never handed out. The title is quoted and escaped, so it cannot add a line to the refusal. The operator sees the profile in the activity record and in the explainer. A blocked call is recorded with `status=blocked` and `block_reason` `profile_tier`, `profile_rule` or `profile_unannotated` (`profile_code_execution` and `profile_management` for the tools above).
 
 A profile does not change prompts: tier and rules apply to tools only.
 
diff --git a/e2e/web-ui-sweep/demo-ux-fixes.spec.ts b/e2e/web-ui-sweep/demo-ux-fixes.spec.ts
new file mode 100644
index 000000000..e5d86f085
--- /dev/null
+++ b/e2e/web-ui-sweep/demo-ux-fixes.spec.ts
@@ -0,0 +1,144 @@
+// Demo UX fixes sweep (Spec 108 T149/T151, Spec 109 T161-T163, plan demo-ux-fixes).
+//
+// Drives the Web UI served by a REAL mcpproxy binary and checks, in layout terms
+// a unit test cannot, the two findings that are about pixels:
+//  - the token Profile chip stays on ONE line, inside its cell (a long profile
+//    title used to wrap inside a fixed-height badge and the border cut through
+//    the second line);
+//  - radio and checkbox labels sit next to their control (the unlayered daisyUI
+//    shim used to push the text to the far right).
+// Both run at 1440x900 and 900x900 and attach screenshots to the report.
+//
+// Launcher: scripts/run-web-smoke.sh (docs/development/web-ui-verification.md).
+import { test, expect, Page } from '@playwright/test'
+import path from 'node:path'
+import { SERVER, api, cleanupProfiles, seedProfiles } from './profiles-seed'
+
+const BASE = process.env.MCPPROXY_BASE_URL || 'http://127.0.0.1:18080'
+const KEY = process.env.MCPPROXY_API_KEY || ''
+const REPORT_DIR = process.env.SWEEP_REPORT_DIR || './playwright-report'
+
+const LONG_PROFILE = 'e2e-long-title'
+const LONG_TITLE = 'Work Read-only for very long client names 2026'
+const LONG_TOKEN = 'e2e-long-chip'
+const VIEWPORTS = [
+  { width: 1440, height: 900 },
+  { width: 900, height: 900 },
+]
+
+function url(route: string): string {
+  const sep = route.includes('?') ? '&' : '?'
+  return KEY ? `${BASE}/ui${route}${sep}apikey=${encodeURIComponent(KEY)}` : `${BASE}/ui${route}`
+}
+
+async function open(page: Page, route: string) {
+  await page.goto(url(route))
+  await page.waitForLoadState('domcontentloaded')
+  const closeWizard = page.locator('[data-test="close-wizard"]')
+  if (await closeWizard.isVisible().catch(() => false)) await closeWizard.click()
+  await page.locator('main').first().waitFor({ state: 'visible' })
+}
+
+async function shot(page: Page, name: string) {
+  await page.screenshot({ path: path.join(REPORT_DIR, `demo-ux-fixes-${name}.png`), fullPage: false })
+}
+
+test.describe.configure({ mode: 'serial' })
+test.skip(!SERVER, 'needs a fixture upstream (SWEEP_SERVER_NAME)')
+
+test.beforeAll(async () => {
+  await cleanupProfiles([LONG_PROFILE], [LONG_TOKEN])
+  await seedProfiles()
+  await api('POST', '/profiles', { name: LONG_PROFILE, title: LONG_TITLE, servers: [SERVER], max_tier: 'read' })
+  await api('POST', '/tokens', { name: LONG_TOKEN, profile: LONG_PROFILE, expires_in: '1d' })
+})
+test.afterAll(async () => {
+  await cleanupProfiles([LONG_PROFILE], [LONG_TOKEN])
+})
+
+for (const viewport of VIEWPORTS) {
+  const label = `${viewport.width}x${viewport.height}`
+
+  test(`token profile chip is one line inside its cell at ${label}`, async ({ page }) => {
+    await page.setViewportSize(viewport)
+    await open(page, '/clients?tab=tokens')
+    const chip = page.locator(`[data-test="token-profile-${LONG_TOKEN}"]`)
+    await expect(chip).toBeVisible()
+    await expect(chip).toHaveAttribute('title', LONG_TITLE)
+
+    const measured = await chip.evaluate((el) => {
+      const rect = el.getBoundingClientRect()
+      const cell = el.closest('td')!.getBoundingClientRect()
+      // One line: every client rect of a Range over the text starts at the same top
+      // (a wrapped second line would add a rect with a different top).
+      const inner = el.querySelector('.truncate') ?? el
+      const range = document.createRange()
+      range.selectNodeContents(inner)
+      const tops = new Set(Array.from(range.getClientRects()).map((r) => Math.round(r.top)))
+      return {
+        scrollHeight: (el as HTMLElement).scrollHeight,
+        clientHeight: (el as HTMLElement).clientHeight,
+        scrollWidth: (inner as HTMLElement).scrollWidth,
+        clientWidth: (inner as HTMLElement).clientWidth,
+        lines: tops.size,
+        insideCell: rect.left >= cell.left - 1 && rect.right <= cell.right + 1 && rect.top >= cell.top - 1 && rect.bottom <= cell.bottom + 1,
+        hasTitle: el.hasAttribute('title'),
+      }
+    })
+    expect(measured.scrollHeight).toBeLessThanOrEqual(measured.clientHeight + 1)
+    expect(measured.lines).toBe(1)
+    expect(measured.insideCell).toBe(true)
+    if (measured.scrollWidth > measured.clientWidth) expect(measured.hasTitle).toBe(true)
+    await shot(page, `token-chip-${label}`)
+  })
+
+  test(`create-profile radio labels sit next to their radios at ${label}`, async ({ page }) => {
+    await page.setViewportSize(viewport)
+    await open(page, '/profiles?create=1')
+    const dialog = page.locator('[data-test="profile-create-dialog"]')
+    await expect(dialog).toBeVisible()
+    const radios = dialog.locator('[data-test^="profile-create-start-"]')
+    expect(await radios.count()).toBeGreaterThan(1)
+    for (let n = 0; n < (await radios.count()); n++) {
+      const gap = await radios.nth(n).evaluate((radio) => {
+        const text = radio.closest('label')!.querySelector('.label-text')!.getBoundingClientRect()
+        return text.left - radio.getBoundingClientRect().right
+      })
+      expect(gap, `radio ${n}`).toBeLessThanOrEqual(16)
+      expect(gap, `radio ${n}`).toBeGreaterThanOrEqual(0)
+    }
+    await shot(page, `radio-labels-create-${label}`)
+  })
+
+  test(`custom-client and bulk-move radio labels sit next to their radios at ${label}`, async ({ page }) => {
+    await page.setViewportSize(viewport)
+    await open(page, '/clients')
+    const cases: Array<{ open: string; radios: string; shot: string }> = [
+      { open: '[data-test="clients-add-other"]', radios: '[data-test^="custom-client-mode-"]', shot: 'custom-client' },
+      { open: '[data-test="clients-bulk-move"]', radios: '[data-test^="bulk-mode-"]', shot: 'bulk-move' },
+    ]
+    for (const c of cases) {
+      const opener = page.locator(c.open)
+      if (!(await opener.isVisible().catch(() => false))) {
+        test.info().annotations.push({ type: 'skipped', description: `${c.shot}: ${c.open} not available on this seed` })
+        continue
+      }
+      await opener.click()
+      const radios = page.locator(`dialog[open] ${c.radios}`)
+      if ((await radios.count()) === 0) {
+        test.info().annotations.push({ type: 'skipped', description: `${c.shot}: no radios in the dialog on this seed` })
+        await page.keyboard.press('Escape')
+        continue
+      }
+      for (let n = 0; n < (await radios.count()); n++) {
+        const gap = await radios.nth(n).evaluate((radio) => {
+          const text = radio.closest('label')!.querySelector('.label-text')!.getBoundingClientRect()
+          return text.left - radio.getBoundingClientRect().right
+        })
+        expect(gap, `${c.shot} radio ${n}`).toBeLessThanOrEqual(16)
+      }
+      await shot(page, `radio-labels-${c.shot}-${label}`)
+      await page.keyboard.press('Escape')
+    }
+  })
+}
diff --git a/e2e/web-ui-sweep/navigation-consistency.spec.ts b/e2e/web-ui-sweep/navigation-consistency.spec.ts
index cb9b95fdb..9c4340148 100644
--- a/e2e/web-ui-sweep/navigation-consistency.spec.ts
+++ b/e2e/web-ui-sweep/navigation-consistency.spec.ts
@@ -10,6 +10,7 @@
 // Launcher: scripts/run-web-smoke.sh (boots a real mcpproxy instance with its
 // embedded frontend, never a dev server).
 import { test, expect, Page } from '@playwright/test'
+import { RO_PROFILE, SERVER, cleanupProfiles, seedProfiles } from './profiles-seed'
 
 const BASE = process.env.MCPPROXY_BASE_URL || 'http://127.0.0.1:18080'
 const KEY = process.env.MCPPROXY_API_KEY || ''
@@ -476,3 +477,40 @@ test('client, profile and token scope links stay hidden without scope_filters (S
     ).toHaveCount(0)
   }
 })
+
+// Spec 109 D35 (T163): the palette also finds profiles, clients and agent
+// tokens. The three lists load on the first non-empty input, never on open.
+test('the command palette finds a profile and opens its editor (Spec 109 T163)', async ({ page }) => {
+  test.skip(!SERVER, 'needs a fixture upstream (SWEEP_SERVER_NAME) to seed the profile')
+  await seedProfiles()
+  try {
+    const listRequests: string[] = []
+    page.on('request', (request) => {
+      const u = new URL(request.url())
+      if (/^\/api\/v1\/(profiles|clients|tokens)$/.test(u.pathname)) listRequests.push(u.pathname)
+    })
+    await goto(page, '/', 'main')
+    const palette = page.locator('dialog[data-test="command-palette"]')
+    await page.keyboard.press('ControlOrMeta+K')
+    await expect(palette).toHaveAttribute('open', '')
+    const before = listRequests.length
+    await palette.locator('input').fill('e2e')
+    const row = palette.locator('[data-test^="palette-row-profiles-"]').first()
+    await expect(row).toContainText(RO_PROFILE)
+    const during = listRequests.slice(before)
+    expect(during.filter((p) => p === '/api/v1/clients'), 'one /clients request after the first keystroke').toHaveLength(1)
+    expect(during.filter((p) => p === '/api/v1/tokens'), 'one /tokens request after the first keystroke').toHaveLength(1)
+    // The default row is "Search tools for ..."; arrow down to the profile row, then Enter.
+    const options = palette.locator('[role="option"]')
+    const index = await options.evaluateAll(
+      (els, id) => els.findIndex((el) => el.getAttribute('data-test') === id),
+      await row.getAttribute('data-test'),
+    )
+    expect(index).toBeGreaterThan(0)
+    for (let n = 0; n < index; n++) await page.keyboard.press('ArrowDown')
+    await page.keyboard.press('Enter')
+    await expect(page).toHaveURL(new RegExp(`/ui/profiles/${RO_PROFILE}`))
+  } finally {
+    await cleanupProfiles()
+  }
+})
diff --git a/frontend/src/assets/main.css b/frontend/src/assets/main.css
index 8799f7954..9b2e4d81e 100644
--- a/frontend/src/assets/main.css
+++ b/frontend/src/assets/main.css
@@ -425,6 +425,13 @@ body {
   padding-block: 0.5rem;
   padding-inline: 0.25rem;
 }
+/* A radio/checkbox row written `label.label.justify-start` directly inside a
+   .form-control wants its text next to the control. The space-between rule
+   above is unlayered, so it beats the layered Tailwind `justify-start`
+   utility; reassert the author's intent here (demo-ux-fixes, finding #9). */
+.form-control > .label.justify-start {
+  justify-content: flex-start;
+}
 .label-text {
   font-size: 0.875rem;
   line-height: 1.25rem;
diff --git a/frontend/src/components/CatalogSearch.vue b/frontend/src/components/CatalogSearch.vue
index ca534e83f..a906394ae 100644
--- a/frontend/src/components/CatalogSearch.vue
+++ b/frontend/src/components/CatalogSearch.vue
@@ -19,15 +19,19 @@
     <template v-else>
       <div v-if="addError && !pendingResult" class="alert alert-error text-sm mb-3" data-test="catalog-add-error">{{ addError }}</div>
       <div v-if="unavailable.length > 0" class="alert alert-warning text-sm mb-3" data-test="catalog-unavailable-notice">
-        <span>{{ unavailable.map((u) => `${u.source} (${u.reason})`).join(', ') }} unavailable</span>
+        <div>
+          <div v-for="line in unavailableLines" :key="line">{{ line }}</div>
+        </div>
       </div>
 
       <template v-if="sections">
-        <div v-if="sections.official.length > 0" data-test="catalog-section-official">
-          <h4 class="font-semibold text-sm text-base-content/70 mb-2">Official</h4>
+        <!-- Popular first when it has entries (popularity if available), then the
+             curated Official list (Spec 109 D35, amends Spec 110 FR-005). -->
+        <div v-if="sections.popular.length > 0" data-test="catalog-section-popular">
+          <h4 class="font-semibold text-sm text-base-content/70 mb-2">Popular</h4>
           <div class="grid grid-cols-1 md:grid-cols-2 gap-3 mb-6">
             <CatalogResultCard
-              v-for="r in sections.official"
+              v-for="r in sections.popular"
               :key="catalogEntryKey(r.source, r.id)"
               :result="r"
               :keyring-available="keyringAvailable"
@@ -37,11 +41,11 @@
             />
           </div>
         </div>
-        <div v-if="sections.popular.length > 0" data-test="catalog-section-popular">
-          <h4 class="font-semibold text-sm text-base-content/70 mb-2">Popular</h4>
+        <div v-if="sections.official.length > 0" data-test="catalog-section-official">
+          <h4 class="font-semibold text-sm text-base-content/70 mb-2">Official</h4>
           <div class="grid grid-cols-1 md:grid-cols-2 gap-3">
             <CatalogResultCard
-              v-for="r in sections.popular"
+              v-for="r in sections.official"
               :key="catalogEntryKey(r.source, r.id)"
               :result="r"
               :keyring-available="keyringAvailable"
@@ -117,7 +121,7 @@
 import { ref, reactive, computed, watch, onMounted, defineComponent, h } from 'vue'
 import { useRouter } from 'vue-router'
 import api from '@/services/api'
-import type { CatalogResult, CatalogSections } from '@/types'
+import type { CatalogResult, CatalogSections, CatalogSourceError } from '@/types'
 import SecretToggle from '@/components/SecretToggle.vue'
 import { resolveSecretFields, rollbackSecrets } from '@/composables/useSecretFields'
 import { useDialogOpen } from '@/composables/useDialogOpen'
@@ -132,7 +136,17 @@ const loading = ref(false)
 const error = ref<string | null>(null)
 const results = ref<CatalogResult[]>([])
 const sections = ref<CatalogSections | null>(null)
-const unavailable = ref<{ source: string; reason: string }[]>([])
+const unavailable = ref<CatalogSourceError[]>([])
+
+// One line per source that failed. A source that answered from its cached
+// listing says so (Spec 109 D35); the others keep the original wording.
+const unavailableLines = computed(() =>
+  unavailable.value.map((u) =>
+    u.fallback === 'cached_listing'
+      ? `${u.source}: live search unavailable (${u.reason}); showing matches from its cached list`
+      : `${u.source} (${u.reason}) unavailable`
+  )
+)
 const addingKey = ref<string | null>(null)
 // FR-063: once added this page-visit, the entry's button flips to "Added ✓ ·
 // Open" and stays that way (a fresh search doesn't re-fetch config, so an
@@ -358,6 +372,9 @@ const CatalogResultCard = defineComponent({
               h('div', { class: 'flex gap-1 shrink-0' }, [
                 r.official ? h('span', { class: 'badge badge-sm badge-primary' }, 'Official') : null,
                 r.verified && !r.official ? h('span', { class: 'badge badge-sm badge-success' }, 'Verified') : null,
+                r.from_cache
+                  ? h('span', { class: 'badge badge-sm badge-warning badge-outline', title: 'The source\u2019s live search is unavailable; this entry is from its cached list.', 'data-test': `catalog-from-cache-${r.source}-${r.id}` }, 'From cached list')
+                  : null,
                 h('span', { class: 'badge badge-sm badge-ghost' }, r.transport),
               ]),
             ]),
diff --git a/frontend/src/components/CommandPalette.vue b/frontend/src/components/CommandPalette.vue
index f055e1a2b..40cbd2ac1 100644
--- a/frontend/src/components/CommandPalette.vue
+++ b/frontend/src/components/CommandPalette.vue
@@ -20,13 +20,13 @@
           role="combobox"
           aria-expanded="true"
           aria-autocomplete="list"
-          aria-label="Search servers, tools, settings"
+          aria-label="Search servers, tools, profiles, clients, settings"
           :aria-controls="listboxId"
           :aria-activedescendant="activeId"
           autocomplete="off"
           spellcheck="false"
           class="grow min-w-0 bg-transparent outline-none text-base"
-          placeholder="Search servers, tools, settings…"
+          placeholder="Search servers, tools, profiles, clients, settings…"
           data-test="palette-input"
           @keydown="onInputKeydown"
         />
@@ -72,8 +72,11 @@ import { useRouter, type RouteLocationRaw } from 'vue-router'
 import api from '@/services/api'
 import { useAuthStore } from '@/stores/auth'
 import { useServersStore } from '@/stores/servers'
+import { useProfilesStore } from '@/stores/profiles'
 import { useDialogOpen } from '@/composables/useDialogOpen'
 import { allCatalogFields, SERVER_EDITION_FIELDS } from '@/views/settings/fields'
+import { profileEditorLink } from '@/utils/profileRoute'
+import { clientLink, tokenLink } from '@/utils/scopeLinks'
 import {
   CONNECT_CLIENT_EVENT,
   PALETTE_ACTIONS,
@@ -85,7 +88,7 @@ import {
   type NavItem,
 } from '@/navigation/navModel'
 
-type SectionId = 'search' | 'pages' | 'actions' | 'servers' | 'tools' | 'settings'
+type SectionId = 'search' | 'pages' | 'actions' | 'servers' | 'tools' | 'profiles' | 'clients' | 'tokens' | 'settings'
 
 interface Row {
   key: string
@@ -104,6 +107,10 @@ interface ToolRow {
   name: string
   server: string
 }
+interface ClientRow {
+  id: string
+  name: string
+}
 
 const SEARCH_DEBOUNCE_MS = 150
 const RESULT_LIMIT = 8
@@ -112,10 +119,13 @@ const open = defineModel<boolean>('open', { default: false })
 const router = useRouter()
 const authStore = useAuthStore()
 const serversStore = useServersStore()
+const profilesStore = useProfilesStore()
 
 const query = ref('')
 const active = ref(0)
 const toolRows = ref<ToolRow[]>([])
+const clientRows = ref<ClientRow[]>([])
+const tokenNames = ref<string[]>([])
 const inputEl = ref<HTMLInputElement | null>(null)
 const listboxId = `palette-listbox-${Math.random().toString(36).slice(2, 8)}`
 
@@ -201,6 +211,34 @@ const toolSpecs = computed<RowSpec[]>(() =>
       })),
 )
 
+// Profiles, clients and agent tokens (needle-only, like settings). A tenant and
+// the server edition have no Clients hub, so none of the three exist there.
+const hasDirectory = computed(() => !isTenant.value && !authStore.isTeamsEdition)
+
+const profileSpecs = computed<RowSpec[]>(() => {
+  if (!hasDirectory.value || !needle.value || !hasRoutePath('/profiles')) return []
+  return profilesStore.profiles
+    .filter((p) => matches(p.title || p.name) || matches(p.name))
+    .slice(0, RESULT_LIMIT)
+    .map((p) => ({ key: `profile:${p.name}`, label: p.title || p.name, hint: `Profile · ${p.name}`, run: () => go(profileEditorLink(p.name)) }))
+})
+
+const clientSpecs = computed<RowSpec[]>(() => {
+  if (!hasDirectory.value || !needle.value || !hasRoutePath('/clients')) return []
+  return clientRows.value
+    .filter((c) => matches(c.name) || matches(c.id))
+    .slice(0, RESULT_LIMIT)
+    .map((c) => ({ key: `client:${c.id}`, label: c.name, hint: `Client · ${c.id}`, run: () => go(clientLink(c.id)) }))
+})
+
+const tokenSpecs = computed<RowSpec[]>(() => {
+  if (!hasDirectory.value || !needle.value || !hasRoutePath('/clients')) return []
+  return tokenNames.value
+    .filter((name) => matches(name))
+    .slice(0, RESULT_LIMIT)
+    .map((name) => ({ key: `token:${name}`, label: name, hint: 'Agent token', run: () => go(tokenLink(name)) }))
+})
+
 const sections = computed<Section[]>(() => {
   const defs: Array<[SectionId, string, RowSpec[]]> = [
     ['search', 'Search', text.value
@@ -210,6 +248,9 @@ const sections = computed<Section[]>(() => {
     ['actions', 'Actions', actionSpecs.value],
     ['servers', 'Servers', serverSpecs.value],
     ['tools', 'Tools', toolSpecs.value],
+    ['profiles', 'Profiles', profileSpecs.value],
+    ['clients', 'Clients', clientSpecs.value],
+    ['tokens', 'Agent tokens', tokenSpecs.value],
     ['settings', 'Settings', settingSpecs.value],
   ]
   let index = 0
@@ -253,10 +294,39 @@ async function runSearch(value: string) {
   }
 }
 
+// --- profiles / clients / tokens: one lazy load per open -----------------------
+
+let directoryState: 'idle' | 'loading' | 'done' = 'idle'
+let directoryEpoch = 0
+
+// Each source is isolated: a failure (or a missing endpoint) yields an empty
+// group and never an error, and never blocks the other two. The clients list is
+// fetched directly and unscoped; the `clients` store is page-scoped (`load(scope)`)
+// and would answer with whatever filter the previous page left behind.
+async function loadDirectory() {
+  if (directoryState !== 'idle' || !hasDirectory.value) return
+  directoryState = 'loading'
+  const epoch = directoryEpoch
+  const [, clients, tokens] = await Promise.allSettled([
+    Promise.resolve().then(() => (profilesStore.loaded ? undefined : profilesStore.fetchProfiles())),
+    Promise.resolve().then(() => api.getClients()),
+    Promise.resolve().then(() => api.listAgentTokens()),
+  ])
+  if (epoch !== directoryEpoch) return // closed meanwhile; the next open starts fresh
+  const clientList = clients.status === 'fulfilled' && clients.value?.success ? clients.value.data?.clients ?? [] : []
+  clientRows.value = clientList.map((c) => ({ id: c.id, name: c.display_name || c.id }))
+  const tokenList = tokens.status === 'fulfilled' && tokens.value?.success ? tokens.value.data?.tokens ?? [] : []
+  // Agent tokens only: a client credential is reached as a client, and a
+  // revoked token has nothing left to open.
+  tokenNames.value = tokenList.filter((t) => t.kind !== 'client' && !t.revoked).map((t) => t.name)
+  directoryState = 'done'
+}
+
 watch(query, (raw) => {
   active.value = 0
   const value = raw.trim()
   cancelSearch()
+  if (value) void loadDirectory()
   if (!value || isTenant.value) {
     toolRows.value = []
     return
@@ -280,6 +350,10 @@ watch(open, async (isOpen) => {
   cancelSearch()
   query.value = ''
   toolRows.value = []
+  clientRows.value = []
+  tokenNames.value = []
+  directoryState = 'idle'
+  directoryEpoch++
   active.value = 0
   // Hand focus back to whatever opened the palette; with no opener, just let go
   // of the (now hidden) input so a later "/" is not mistaken for typing.
diff --git a/frontend/src/components/settings/SettingsSection.vue b/frontend/src/components/settings/SettingsSection.vue
index a9425bcea..6e0f9212c 100644
--- a/frontend/src/components/settings/SettingsSection.vue
+++ b/frontend/src/components/settings/SettingsSection.vue
@@ -41,7 +41,7 @@
           @click="attemptSave"
         >
           <span v-if="saving" class="loading loading-spinner loading-xs"></span>
-          Save changes
+          {{ SAVE_CHANGES_LABEL }}
         </button>
       </div>
     </div>
@@ -77,7 +77,7 @@
 <script setup lang="ts">
 import { ref, computed, getCurrentInstance } from 'vue'
 import SettingField from './SettingField.vue'
-import { getPath, setPath, buildPartial, validateField, type SettingField as Field } from '@/views/settings/fields'
+import { getPath, setPath, buildPartial, validateField, SAVE_CHANGES_LABEL, type SettingField as Field } from '@/views/settings/fields'
 import { useSystemStore } from '@/stores/system'
 import api from '@/services/api'
 
diff --git a/frontend/src/types/api.ts b/frontend/src/types/api.ts
index 37530f454..7c3bb325c 100644
--- a/frontend/src/types/api.ts
+++ b/frontend/src/types/api.ts
@@ -926,11 +926,20 @@ export interface CatalogResult {
   added: boolean
   /** Unique visible installed server selected by the backend before redaction. */
   added_server_name?: string
+  /**
+   * True when this hit came from the source's cached listing because its live
+   * search failed (Spec 109 D35). The source is then also in `unavailable`.
+   */
+  from_cache?: boolean
 }
 
 export interface CatalogSourceError {
   source: string
   reason: string
+  /** "cached_listing" when the hits for this source came from its cached listing. */
+  fallback?: 'cached_listing'
+  /** RFC 3339: when that cached listing was last refreshed. */
+  cached_at?: string
 }
 
 export interface CatalogSections {
diff --git a/frontend/src/utils/profiles.ts b/frontend/src/utils/profiles.ts
index 0ee575a36..dbce65863 100644
--- a/frontend/src/utils/profiles.ts
+++ b/frontend/src/utils/profiles.ts
@@ -133,9 +133,19 @@ export function credentialLabel(state: string | undefined): string {
   }
 }
 
-// The fix-button text for a failed step.
+// The fix-button text for a row without a usable client credential
+// (labels.json credential_cta, identical on macOS). Only a client that holds
+// the admin key is an "upgrade"; a revoked or expired credential is a
+// "reconnect"; an installed client that never connected (none, or the
+// stat-only unknown) is simply "Connect". A client credential needs no button.
 export function credentialCta(state: string | undefined): string {
-  return state === 'revoked' || state === 'expired' ? 'Reconnect' : 'Upgrade to client credential'
+  switch (state) {
+    case 'client': return ''
+    case 'admin_key': return 'Upgrade to client credential'
+    case 'revoked':
+    case 'expired': return 'Reconnect'
+    default: return 'Connect'
+  }
 }
 
 // --- errors ----------------------------------------------------------------
diff --git a/frontend/src/utils/scopeLinks.ts b/frontend/src/utils/scopeLinks.ts
new file mode 100644
index 000000000..3169f21d2
--- /dev/null
+++ b/frontend/src/utils/scopeLinks.ts
@@ -0,0 +1,23 @@
+import type { RouteLocationRaw } from 'vue-router'
+import { isScopeParamAvailable } from '@/composables/useScopeQuery'
+
+// Spec 109 D35 (T163, FR-054). The palette jumps to a client or an agent token
+// on the Clients page. These are fresh navigations, so they carry NO sticky
+// params: a sticky `profile` filter from the page the user was on could hide the
+// very row they asked for. Without the scope filters (an older core) the same
+// destinations degrade to the Clients page itself, never to a dead parameter.
+
+/** The Clients page focused on one client: `/clients?client=<id>`. */
+export function clientLink(id: string): RouteLocationRaw {
+  // `focus` is the attention-fix landing of Spec 109-l: it highlights the row.
+  return isScopeParamAvailable('client')
+    ? { path: '/clients', query: { client: id } }
+    : { path: '/clients', query: { focus: id } }
+}
+
+/** The Clients page, Agent Tokens tab, filtered to one token. */
+export function tokenLink(name: string): RouteLocationRaw {
+  return isScopeParamAvailable('token')
+    ? { path: '/clients', query: { tab: 'tokens', token: name } }
+    : { path: '/clients', query: { tab: 'tokens' } }
+}
diff --git a/frontend/src/views/AgentTokens.vue b/frontend/src/views/AgentTokens.vue
index 2e0e0ab97..5ca012808 100644
--- a/frontend/src/views/AgentTokens.vue
+++ b/frontend/src/views/AgentTokens.vue
@@ -151,7 +151,7 @@
             </td>
             <td :data-test="`token-kind-${token.name}`">{{ isClientCredential(token) ? 'Client' : 'Agent' }}</td>
             <td>
-              <span v-if="token.profile_pin" class="badge badge-outline badge-sm" :data-test="`token-profile-${token.name}`">{{ profilesStore.titleFor(token.profile_pin) }}</span>
+              <span v-if="token.profile_pin" class="badge badge-outline badge-sm max-w-[12rem] min-w-0 justify-start overflow-hidden" :title="profilesStore.titleFor(token.profile_pin)" :data-test="`token-profile-${token.name}`"><span class="truncate">{{ profilesStore.titleFor(token.profile_pin) }}</span></span>
               <span v-else class="text-base-content/40 text-sm">&mdash;</span>
             </td>
             <td>
diff --git a/frontend/src/views/Settings.vue b/frontend/src/views/Settings.vue
index 631342b2c..df4e9fe11 100644
--- a/frontend/src/views/Settings.vue
+++ b/frontend/src/views/Settings.vue
@@ -5,7 +5,7 @@
       <div>
         <h1 class="text-3xl font-bold">Settings</h1>
         <p class="text-base-content/70 mt-1">
-          Manage mcpproxy settings. Changes save instantly; a badge marks fields that need a restart.
+          Edit a section, then press {{ SAVE_CHANGES_LABEL }} to apply it. A badge marks fields that need a restart.
           <a
             :href="`${DOCS_BASE}/configuration/config-file`"
             target="_blank"
@@ -206,6 +206,9 @@ import {
   isBlankInstructions,
   restartRequiredLabels,
   hydrateConfigState,
+  refreshEditionDefaults,
+  effectiveBool,
+  SAVE_CHANGES_LABEL,
   type SettingField,
   type SettingsAccordion,
 } from '@/views/settings/fields'
@@ -310,7 +313,7 @@ const filteredFields = computed<SettingField[]>(() => {
 const posture = computed(() => {
   const w: any = state.working || {}
   const sdd = w.sensitive_data_detection?.enabled !== false
-  const quarantine = w.quarantine_enabled !== false // default-on
+  const quarantine = effectiveBool(w, 'quarantine_enabled') // nil = on, same rule as the toggle
   return [
     { label: 'Quarantine', on: quarantine, good: quarantine },
     { label: 'MCP auth', on: !!w.require_mcp_auth, good: !!w.require_mcp_auth },
@@ -388,6 +391,16 @@ const editorOptions = {
   lineNumbers: 'on' as const,
 }
 
+// The untouched /config response of the last load; the edition-dependent
+// defaults are re-resolved from it if /status arrives after the config did.
+let rawConfig: any = null
+watch(
+  () => systemStore.status?.edition,
+  (edition) => {
+    if (loaded.value && rawConfig) refreshEditionDefaults(state, rawConfig, { edition })
+  }
+)
+
 async function loadConfig() {
   loading.value = true
   loadError.value = ''
@@ -403,9 +416,10 @@ async function loadConfig() {
       // keys the API omits (the serialization modes: absent means "full"), so
       // their <select> shows the real default instead of an empty box. Applied
       // to both copies — otherwise the untouched field would read as dirty.
-      const hydrated = hydrateConfigState(cfg)
+      const hydrated = hydrateConfigState(cfg, { edition: systemStore.status?.edition })
       state.working = hydrated.working
       state.original = hydrated.original
+      rawConfig = hydrated.raw
       formEpoch.value++
       // hydrated.raw, not cfg: the Raw tab must show the untouched response,
       // and this makes that dependency explicit rather than relying on the
diff --git a/frontend/src/views/settings/fields.ts b/frontend/src/views/settings/fields.ts
index 06a460728..cb6d605e8 100644
--- a/frontend/src/views/settings/fields.ts
+++ b/frontend/src/views/settings/fields.ts
@@ -40,6 +40,12 @@ export type ValueKind = 'hostport' | 'bytesize' | 'cpu' | 'hostname' | 'url' | '
 // Without this the textarea would PATCH a plain string into a []string key.
 export type ListKind = 'comma' | 'lines'
 
+export interface DefaultContext {
+  // 'server' for the server-edition build; anything else (including unknown,
+  // while /status is still loading) reads as the personal edition.
+  edition?: string
+}
+
 export interface SettingField {
   key: string // dot-path, e.g. "docker_isolation.enabled"
   label: string
@@ -58,8 +64,16 @@ export interface SettingField {
   resetDefault?: string // when set, render an inline "Reset to default" button that emits this value
   // Value an absent/blank key actually resolves to on the Go side. Only needed
   // for `omitempty` fields whose zero value is meaningful (the serialization
-  // modes: "" means "full"). See normalizeFieldDefaults below for why.
-  defaultValue?: string
+  // modes: "" means "full") and for nullable (*bool) keys whose nil resolves to
+  // true (quarantine_enabled, telemetry.enabled, ...). See normalizeFieldDefaults
+  // below for why. The shared fixture internal/config/testdata/
+  // settings_nullable_defaults.json pins the boolean ones to the Go resolvers.
+  defaultValue?: string | boolean
+  // Default that depends on the rest of the config or on the edition (the
+  // audit_log.* keys: an absent block resolves per edition, an explicit block
+  // resolves differently). Receives an UNTOUCHED snapshot of the config, so
+  // materialising one default never changes the answer for another.
+  defaultFor?: (cfg: any, ctx: DefaultContext) => unknown
   // Set for a textarea that edits a []string key (see ListKind).
   listKind?: ListKind
 }
@@ -72,6 +86,10 @@ export interface SettingsAccordion {
   docs?: string // doc page path on docs.mcpproxy.app
 }
 
+// The label of the per-section save button. The Settings header copy
+// interpolates the same constant, so the instruction and the button cannot drift.
+export const SAVE_CHANGES_LABEL = 'Save changes'
+
 // Base URL for the hosted documentation; field/accordion `docs` are paths under it.
 export const DOCS_BASE = 'https://docs.mcpproxy.app'
 
@@ -172,6 +190,7 @@ export const SECURITY_FIELDS: SettingField[] = [
   },
   {
     key: 'quarantine_enabled',
+    defaultValue: true, // *bool, nil = on (Config.IsQuarantineEnabled)
     docs: '/features/security-quarantine',
     label: 'Quarantine new servers & changed tools',
     help: 'Holds newly added servers and tools whose description/schema changed for your approval before agents can call them — protects against Tool Poisoning Attacks. Recommended ON.',
@@ -318,6 +337,7 @@ export const GENERAL_FIELDS: SettingField[] = [
   },
   {
     key: 'telemetry.enabled',
+    defaultValue: true, // *bool, nil = on (Config.IsTelemetryEnabled)
     docs: '/features/telemetry',
     label: 'Anonymous usage telemetry',
     help: 'Sends anonymous usage counts (never tool arguments, content, or identities). Opt-out at any time. Disabling sends a single anonymous opt-out signal, then stops all telemetry.',
@@ -450,14 +470,25 @@ export function isBlankInstructions(v: string | null | undefined): boolean {
 // construction" — DetectConfigChanges), so every row carries the restart
 // badge. There is no secret key under `audit_log`, so no row uses the
 // `secret` control.
+// An absent audit_log block resolves per edition (EffectiveAuditLog): the server
+// edition runs enabled with a stdout sink, the personal edition leaves audit
+// logging off. Once the block exists, `enabled` defaults on and `stdout` off
+// (an explicit block never defaults to stdout; it needs a path).
+function auditLogEnabledDefault(cfg: any, ctx: DefaultContext): boolean {
+  return cfg?.audit_log == null ? ctx.edition === 'server' : true
+}
+function auditLogStdoutDefault(cfg: any, ctx: DefaultContext): boolean {
+  return cfg?.audit_log == null ? ctx.edition === 'server' : false
+}
+
 export const AUDIT_LOG_FIELDS: SettingField[] = [
-  { key: 'audit_log.enabled', label: 'Enable audit logging', help: 'Writes one JSONL line per authorization decision and tool call. On by default under the server edition; the personal edition defaults to off.', control: 'toggle', restart: true },
-  { key: 'audit_log.stdout', label: 'Write to stdout', help: 'Server edition default when no path is set — not used under the native stdio transport (stdout carries JSON-RPC there); set a path instead.', control: 'toggle', restart: true },
+  { key: 'audit_log.enabled', label: 'Enable audit logging', help: 'Writes one JSONL line per authorization decision and tool call. On by default under the server edition; the personal edition defaults to off.', control: 'toggle', restart: true, defaultFor: auditLogEnabledDefault },
+  { key: 'audit_log.stdout', label: 'Write to stdout', help: 'Server edition default when no path is set — not used under the native stdio transport (stdout carries JSON-RPC there); set a path instead.', control: 'toggle', restart: true, defaultFor: auditLogStdoutDefault },
   { key: 'audit_log.path', label: 'File path', help: 'Where to write the rotating audit log file. Leave blank to use stdout instead.', control: 'text', optional: true, placeholder: '/var/log/mcpproxy/audit.jsonl', restart: true },
   { key: 'audit_log.max_size_mb', label: 'Rotate after (MB)', control: 'number', min: 1, restart: true },
   { key: 'audit_log.max_backups', label: 'Rotated files to keep', control: 'number', min: 1, restart: true },
   { key: 'audit_log.max_age_days', label: 'Delete rotated logs after (days)', control: 'number', min: 1, restart: true },
-  { key: 'audit_log.compress', label: 'Compress rotated files', control: 'toggle', restart: true },
+  { key: 'audit_log.compress', label: 'Compress rotated files', control: 'toggle', restart: true, defaultValue: true },
 ]
 
 // ---- Section 3: Advanced (subsystem accordions) ----
@@ -676,25 +707,73 @@ export function aliasServerEdition(cfg: any): any {
  *  - `raw` is the untouched response. The Raw JSON tab must show server truth,
  *    and both helpers above MUTATE their argument, so the clones matter.
  */
-export function hydrateConfigState(cfg: any): { working: any; original: any; raw: any } {
+export function hydrateConfigState(
+  cfg: any,
+  ctx: DefaultContext = {}
+): { working: any; original: any; raw: any } {
   const clone = (v: any) => (v == null ? v : JSON.parse(JSON.stringify(v)))
   return {
-    working: normalizeListFields(normalizeFieldDefaults(aliasServerEdition(clone(cfg)))),
-    original: normalizeListFields(normalizeFieldDefaults(aliasServerEdition(clone(cfg)))),
+    working: normalizeListFields(normalizeFieldDefaults(aliasServerEdition(clone(cfg)), ctx)),
+    original: normalizeListFields(normalizeFieldDefaults(aliasServerEdition(clone(cfg)), ctx)),
     raw: clone(cfg),
   }
 }
 
-export function normalizeFieldDefaults(cfg: any): any {
+export function normalizeFieldDefaults(cfg: any, ctx: DefaultContext = {}): any {
   if (cfg == null || typeof cfg !== 'object') return cfg
+  // Resolve every default against an untouched snapshot FIRST, then write them.
+  // Writing as we go would let `audit_log.enabled` create the audit_log block
+  // and flip the answer `audit_log.stdout` gives for "is the block absent".
+  const snapshot = JSON.parse(JSON.stringify(cfg))
+  const resolved: Array<[string, unknown]> = []
   for (const f of allCatalogFields()) {
-    if (f.defaultValue == null) continue
-    const cur = getPath(cfg, f.key)
-    if (cur == null || cur === '') setPath(cfg, f.key, f.defaultValue)
+    const dv = f.defaultFor ? f.defaultFor(snapshot, ctx) : f.defaultValue
+    if (dv == null) continue
+    const cur = getPath(snapshot, f.key)
+    if (cur == null || cur === '') resolved.push([f.key, dv])
   }
+  for (const [key, value] of resolved) setPath(cfg, key, value)
   return cfg
 }
 
+/**
+ * Re-resolve the edition-dependent defaults (the `defaultFor` fields) once the
+ * edition is known, for a form that was hydrated before /status arrived. Only
+ * keys the user has not touched (working equals original) are rewritten, and
+ * both copies get the same value, so nothing becomes an unsaved change.
+ */
+export function refreshEditionDefaults(
+  state: { working: any; original: any },
+  raw: any,
+  ctx: DefaultContext
+): void {
+  const fresh = hydrateConfigState(raw, ctx).working
+  for (const f of allCatalogFields()) {
+    if (!f.defaultFor) continue
+    const w = getPath(state.working, f.key)
+    const o = getPath(state.original, f.key)
+    if (JSON.stringify(w) !== JSON.stringify(o)) continue
+    const next = getPath(fresh, f.key)
+    if (next === undefined) continue
+    setPath(state.working, f.key, next)
+    setPath(state.original, f.key, next)
+  }
+}
+
+/**
+ * Effective boolean for a catalogue toggle: the config value when present,
+ * otherwise the field's declared default (nil *bool keys resolve to true).
+ * The one place the "absent means X" rule lives, so the posture chip and the
+ * toggle cannot disagree.
+ */
+export function effectiveBool(cfg: any, key: string, ctx: DefaultContext = {}): boolean {
+  const cur = getPath(cfg, key)
+  if (cur != null && cur !== '') return !!cur
+  const f = allCatalogFields().find((x) => x.key === key)
+  const dv = f?.defaultFor ? f.defaultFor(cfg, ctx) : f?.defaultValue
+  return !!dv
+}
+
 /**
  * Render a []string value as the textarea text of a list-kind field. Anything
  * that is not an array (already text, null) is returned unchanged.
@@ -769,5 +848,19 @@ export function buildPartial(source: any, dirtyKeys: string[]): Record<string, a
     const val = getPath(source, key)
     setPath(out, key, f?.listKind ? textToList(f.listKind, val) : val)
   }
+  // audit_log is validated as a whole block: a block carrying neither
+  // `stdout` nor `path` while enabled is refused (MsgAuditLogNoSink). When the
+  // block is absent on disk the backend merge creates it from this partial
+  // alone, so a rotation-only edit would arrive without the sink toggles the
+  // form is displaying. Ship the displayed enable/sink state with any audit_log
+  // edit so what is saved matches what the form shows.
+  if (dirtyKeys.some((k) => k.startsWith('audit_log.'))) {
+    for (const k of ['audit_log.enabled', 'audit_log.stdout']) {
+      if (!dirtyKeys.includes(k)) {
+        const v = getPath(source, k)
+        if (v !== undefined) setPath(out, k, v)
+      }
+    }
+  }
   return out
 }
diff --git a/frontend/tests/unit/agent-tokens-profile-chip.spec.ts b/frontend/tests/unit/agent-tokens-profile-chip.spec.ts
new file mode 100644
index 000000000..39fd532bf
--- /dev/null
+++ b/frontend/tests/unit/agent-tokens-profile-chip.spec.ts
@@ -0,0 +1,69 @@
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import { flushPromises, mount } from '@vue/test-utils'
+import { createPinia, setActivePinia } from 'pinia'
+import { createMemoryHistory, createRouter } from 'vue-router'
+import AgentTokens from '@/views/AgentTokens.vue'
+import api from '@/services/api'
+import { setAvailableFeatures } from '@/composables/useScopeQuery'
+import { WORK_RO } from './fixtures/profiles108i'
+
+// Spec 108 D39 (T149, demo finding #7): daisyUI's `badge-sm` has a fixed height,
+// so a long profile title wrapped inside the Profile chip and the border cut
+// through the second line (it read as strikethrough, i.e. "revoked"). The chip
+// is now a single line with an ellipsis and the full title on hover.
+
+vi.mock('@/services/api', () => ({
+  default: {
+    hasAPIKey: vi.fn(() => true),
+    listAgentTokens: vi.fn(),
+    getServers: vi.fn(),
+    getProfiles: vi.fn(),
+  },
+}))
+
+const stub = { template: '<div />' }
+const future = '2030-01-01T00:00:00Z'
+const LONG_TITLE = 'Work Read-only for very long client names 2026'
+const LONG_PROFILE = { ...WORK_RO, name: 'work-readonly', title: LONG_TITLE }
+const TOKENS = [
+  { name: 'qa-ro', token_prefix: 'mcp_agt_aa', allowed_servers: ['*'], permissions: ['read'], expires_at: future, created_at: future, last_used_at: null, revoked: false, profile_pin: 'work-readonly', kind: 'agent', legacy_scope: false },
+]
+
+describe('Agent token Profile chip (Spec 108 T149)', () => {
+  const original = (HTMLDialogElement.prototype as any).showModal
+
+  beforeEach(() => {
+    setActivePinia(createPinia())
+    vi.clearAllMocks()
+    ;(HTMLDialogElement.prototype as any).showModal = vi.fn()
+    setAvailableFeatures(['scope_filters'])
+    ;(api.listAgentTokens as any).mockResolvedValue({ success: true, data: { tokens: TOKENS } })
+    ;(api.getServers as any).mockResolvedValue({ success: true, data: { servers: [] } })
+    ;(api.getProfiles as any).mockResolvedValue({ profiles: [LONG_PROFILE] })
+  })
+  afterEach(() => {
+    ;(HTMLDialogElement.prototype as any).showModal = original
+  })
+
+  it('is bounded, clips overflow, truncates the text and carries the full title', async () => {
+    const router = createRouter({ history: createMemoryHistory(), routes: [{ path: '/clients', name: 'clients', component: stub }, { path: '/profiles', name: 'profiles', component: stub }] })
+    await router.push('/clients?tab=tokens')
+    await router.isReady()
+    const wrapper = mount(AgentTokens, { global: { plugins: [router] }, attachTo: document.body })
+    await new Promise(resolve => setTimeout(resolve, 130))
+    await flushPromises()
+
+    const chip = wrapper.find('[data-test="token-profile-qa-ro"]')
+    expect(chip.exists()).toBe(true)
+    expect(chip.text()).toBe(LONG_TITLE)
+    const cls = chip.classes().join(' ')
+    expect(cls).toMatch(/max-w-\[/)
+    expect(chip.classes()).toContain('overflow-hidden')
+    expect(chip.classes()).toContain('min-w-0')
+    expect(chip.attributes('title')).toBe(LONG_TITLE)
+    const inner = chip.find('span.truncate')
+    expect(inner.exists()).toBe(true)
+    expect(inner.text()).toBe(LONG_TITLE)
+    wrapper.unmount()
+  })
+})
diff --git a/frontend/tests/unit/catalog-browse-order.spec.ts b/frontend/tests/unit/catalog-browse-order.spec.ts
new file mode 100644
index 000000000..9b5599a35
--- /dev/null
+++ b/frontend/tests/unit/catalog-browse-order.spec.ts
@@ -0,0 +1,69 @@
+import { describe, it, expect, vi, beforeEach } from 'vitest'
+import { mount, flushPromises } from '@vue/test-utils'
+import { createRouter, createWebHistory } from 'vue-router'
+import CatalogSearch from '@/components/CatalogSearch.vue'
+
+// Spec 109 D35 (T164, demo finding #6): with an empty query the catalog lists
+// Popular first when it has entries (popularity if available), then Official
+// (curated first). With no popularity signal only Official shows, so the
+// landing is never led by an empty section.
+
+vi.mock('@/services/api', () => ({
+  default: {
+    catalogSearch: vi.fn(),
+    getConfigSecrets: vi.fn(),
+    addServerFromRegistry: vi.fn(),
+    getSecretRefs: vi.fn(),
+    setSecret: vi.fn(),
+    deleteSecret: vi.fn(),
+    getServers: vi.fn(),
+  },
+}))
+import api from '@/services/api'
+
+const router = createRouter({
+  history: createWebHistory(),
+  routes: [{ path: '/', component: { template: '<div/>' } }, { path: '/servers/:serverName', component: { template: '<div/>' } }],
+})
+
+function result(id: string, title: string) {
+  return {
+    source: 'official', id, title, publisher: 'p', verified: true, official: true, description: 'd',
+    transport: 'stdio', install: { command: 'npx', args: ['-y', id] }, required_inputs: [], added: false,
+  }
+}
+
+async function mountWith(sections: { official: unknown[]; popular: unknown[] }) {
+  vi.mocked(api.getConfigSecrets).mockResolvedValue({
+    success: true,
+    data: { secrets: [], environment_vars: [], total_secrets: 0, total_env_vars: 0, keyring_available: true },
+  })
+  vi.mocked(api.catalogSearch).mockResolvedValue({
+    success: true,
+    data: { query: '', results: [], sections, unavailable: [] },
+  } as never)
+  const wrapper = mount(CatalogSearch, { global: { plugins: [router] } })
+  await flushPromises()
+  return wrapper
+}
+
+describe('catalog browse section order (T164)', () => {
+  beforeEach(() => {
+    vi.mocked(api.catalogSearch).mockReset()
+    vi.mocked(api.getConfigSecrets).mockReset()
+  })
+
+  it('renders Popular before Official when Popular is non-empty', async () => {
+    const wrapper = await mountWith({ official: [result('ref/filesystem', 'filesystem')], popular: [result('io.github.x/hot', 'hot server')] })
+    const sections = wrapper.findAll('[data-test^="catalog-section-"]').map(s => s.attributes('data-test'))
+    expect(sections).toEqual(['catalog-section-popular', 'catalog-section-official'])
+    const text = wrapper.text()
+    expect(text.indexOf('hot server')).toBeLessThan(text.indexOf('filesystem'))
+  })
+
+  it('renders only Official when Popular is empty', async () => {
+    const wrapper = await mountWith({ official: [result('ref/filesystem', 'filesystem')], popular: [] })
+    const sections = wrapper.findAll('[data-test^="catalog-section-"]').map(s => s.attributes('data-test'))
+    expect(sections).toEqual(['catalog-section-official'])
+  })
+})
diff --git a/frontend/tests/unit/catalog-cached-fallback.spec.ts b/frontend/tests/unit/catalog-cached-fallback.spec.ts
new file mode 100644
index 000000000..10d82252f
--- /dev/null
+++ b/frontend/tests/unit/catalog-cached-fallback.spec.ts
@@ -0,0 +1,105 @@
+import { describe, it, expect, vi, beforeEach } from 'vitest'
+import { readFileSync } from 'node:fs'
+import { resolve } from 'node:path'
+import { mount, flushPromises } from '@vue/test-utils'
+import { createRouter, createWebHistory } from 'vue-router'
+import CatalogSearch from '@/components/CatalogSearch.vue'
+
+// Spec 109 D35 (T160, demo finding #1): the Web leg of the cached-fallback
+// chain. The REST golden internal/registries/testdata/catalog_cached_fallback_order.json
+// (written by the Go httpapi test from the real handler while one source is
+// down) is served to Add Server -> Catalog: the rows render in the golden
+// order, only cached rows carry "From cached list", and the notice says what
+// happened and what is shown.
+
+const golden = JSON.parse(
+  readFileSync(resolve(__dirname, '../../../internal/registries/testdata/catalog_cached_fallback_order.json'), 'utf8'),
+) as {
+  query: string
+  ids: string[]
+  results: Array<Record<string, unknown> & { source: string; id: string; title: string; from_cache?: boolean }>
+  unavailable: Array<{ source: string; fallback: string }>
+}
+
+vi.mock('@/services/api', () => ({
+  default: {
+    catalogSearch: vi.fn(),
+    getConfigSecrets: vi.fn(),
+    addServerFromRegistry: vi.fn(),
+    getSecretRefs: vi.fn(),
+    setSecret: vi.fn(),
+    deleteSecret: vi.fn(),
+    getServers: vi.fn(),
+  },
+}))
+import api from '@/services/api'
+
+const router = createRouter({
+  history: createWebHistory(),
+  routes: [{ path: '/', component: { template: '<div/>' } }, { path: '/servers/:serverName', component: { template: '<div/>' } }],
+})
+
+async function mountAndSearch(unavailable: unknown[]) {
+  vi.mocked(api.getConfigSecrets).mockResolvedValue({
+    success: true,
+    data: { secrets: [], environment_vars: [], total_secrets: 0, total_env_vars: 0, keyring_available: true },
+  })
+  vi.mocked(api.catalogSearch).mockImplementation(async (params: { q?: string }) => ({
+    success: true,
+    data: params.q === golden.query
+      ? { query: golden.query, results: golden.results, sections: null, unavailable }
+      : { query: params.q ?? '', results: [], sections: { official: [], popular: [] }, unavailable: [] },
+  }) as never)
+  const wrapper = mount(CatalogSearch, { global: { plugins: [router] } })
+  await flushPromises()
+  await wrapper.find('[data-test="catalog-search-input"]').setValue(golden.query)
+  await flushPromises()
+  await new Promise(r => setTimeout(r, 400)) // the input is debounced
+  await flushPromises()
+  return wrapper
+}
+
+describe('catalog cached fallback on the Web UI (T160)', () => {
+  beforeEach(() => {
+    vi.mocked(api.catalogSearch).mockReset()
+    vi.mocked(api.getConfigSecrets).mockReset()
+  })
+
+  const unavailable = () => golden.unavailable.map(u => ({
+    source: u.source,
+    reason: 'timeout after 5s',
+    fallback: u.fallback,
+    cached_at: '2026-10-02T10:00:00Z',
+  }))
+
+  it('renders the golden order, badges only the cached rows', async () => {
+    const wrapper = await mountAndSearch(unavailable())
+    const titles = wrapper.findAll('[data-test="catalog-result-title"]').map(t => t.text())
+    expect(titles).toEqual(golden.results.map(r => r.title))
+
+    for (const r of golden.results) {
+      const badge = wrapper.find(`[data-test="catalog-from-cache-${r.source}-${r.id}"]`)
+      expect(badge.exists(), `${r.source}:${r.id}`).toBe(Boolean(r.from_cache))
+      if (r.from_cache) expect(badge.text()).toBe('From cached list')
+    }
+    expect(wrapper.text()).toContain('From cached list')
+  })
+
+  it('says which source is down and that matches come from its cached list', async () => {
+    const wrapper = await mountAndSearch(unavailable())
+    const notice = wrapper.find('[data-test="catalog-unavailable-notice"]')
+    expect(notice.exists()).toBe(true)
+    expect(notice.text()).toBe('slowreg: live search unavailable (timeout after 5s); showing matches from its cached list')
+  })
+
+  it('keeps today\'s wording for a source with no cached listing', async () => {
+    const wrapper = await mountAndSearch([{ source: 'slowreg', reason: 'timeout after 5s' }])
+    expect(wrapper.find('[data-test="catalog-unavailable-notice"]').text()).toBe('slowreg (timeout after 5s) unavailable')
+  })
+
+  it('never marks a live row as cached', async () => {
+    const wrapper = await mountAndSearch(unavailable())
+    const live = golden.results.find(r => !r.from_cache)!
+    expect(wrapper.find(`[data-test="catalog-from-cache-${live.source}-${live.id}"]`).exists()).toBe(false)
+  })
+})
diff --git a/frontend/tests/unit/client-binding-controls.spec.ts b/frontend/tests/unit/client-binding-controls.spec.ts
index 80ec04f99..4881ee3ea 100644
--- a/frontend/tests/unit/client-binding-controls.spec.ts
+++ b/frontend/tests/unit/client-binding-controls.spec.ts
@@ -197,9 +197,11 @@ describe('Client binding controls on the Clients page (Spec 108-i T092)', () =>
   })
 
   it.each([
-    ['none', 'Upgrade to client credential'],
+    // Spec 108 D39 (T150): only a known admin-key holder is an "upgrade"; an
+    // installed client that never connected has nothing to upgrade.
+    ['none', 'Connect'],
     ['admin_key', 'Upgrade to client credential'],
-    ['unknown', 'Upgrade to client credential'],
+    ['unknown', 'Connect'],
     ['revoked', 'Reconnect'],
     ['expired', 'Reconnect'],
   ])('%s: chip and switch disabled, PUT never called, CTA "%s" opens the connect list for the client', async (state, cta) => {
diff --git a/frontend/tests/unit/command-palette-directory.spec.ts b/frontend/tests/unit/command-palette-directory.spec.ts
new file mode 100644
index 000000000..9acde6de5
--- /dev/null
+++ b/frontend/tests/unit/command-palette-directory.spec.ts
@@ -0,0 +1,285 @@
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import { mount } from '@vue/test-utils'
+import { createPinia, setActivePinia } from 'pinia'
+import { createRouter, createMemoryHistory } from 'vue-router'
+
+// Spec 109 D35 (T163, demo finding #5): the palette also finds profiles,
+// clients and agent tokens. The three lists load once, on the first non-empty
+// query after opening (never on open), and each group is needle-only.
+
+const searchTools = vi.hoisted(() => vi.fn())
+const getProfiles = vi.hoisted(() => vi.fn())
+const getClients = vi.hoisted(() => vi.fn())
+const listAgentTokens = vi.hoisted(() => vi.fn())
+
+vi.mock('@/services/api', () => ({
+  default: {
+    hasAPIKey: vi.fn(() => true),
+    searchTools,
+    getProfiles,
+    getClients,
+    listAgentTokens,
+  },
+}))
+
+import CommandPalette from '@/components/CommandPalette.vue'
+import { useAuthStore } from '@/stores/auth'
+import { useServersStore } from '@/stores/servers'
+import { setAvailableFeatures } from '@/composables/useScopeQuery'
+import api from '@/services/api'
+
+const stub = { template: '<div />' }
+
+async function tick(ms = 0) {
+  await vi.advanceTimersByTimeAsync(ms)
+}
+
+async function mountPalette(opts: { profiles?: boolean; clients?: boolean } = {}) {
+  const router = createRouter({
+    history: createMemoryHistory(),
+    routes: [
+      { path: '/', component: stub },
+      { path: '/tools', component: stub },
+      ...(opts.profiles ? [
+        { path: '/profiles', component: stub },
+        { path: '/profiles/:name', name: 'profile-editor', component: stub },
+      ] : []),
+      ...(opts.clients ? [{ path: '/clients', component: stub }] : []),
+    ],
+  })
+  router.push('/')
+  await router.isReady()
+  const push = vi.spyOn(router, 'push')
+  const wrapper = mount(CommandPalette, { attachTo: document.body, global: { plugins: [router] } })
+  await tick()
+  return { wrapper, router, push }
+}
+
+const dialog = () => document.querySelector('dialog[data-test="command-palette"]') as HTMLDialogElement
+const input = () => dialog().querySelector('input') as HTMLInputElement
+const rows = () => Array.from(dialog().querySelectorAll('[role="option"]')) as HTMLElement[]
+const sectionIds = () =>
+  Array.from(dialog().querySelectorAll('[data-test^="palette-section-"]')).map((el) => el.getAttribute('data-test')!.replace('palette-section-', ''))
+const directoryIds = () => sectionIds().filter((id) => ['profiles', 'clients', 'tokens'].includes(id))
+
+function key(init: KeyboardEventInit) {
+  window.dispatchEvent(new KeyboardEvent('keydown', { bubbles: true, cancelable: true, ...init }))
+}
+
+async function type(text: string) {
+  input().value = text
+  input().dispatchEvent(new Event('input', { bubbles: true }))
+  await tick()
+}
+
+const PROFILE = { name: 'work-readonly', title: 'Work Read-only', max_tier: 'read', servers: ['notes'], effective_servers: ['notes'] }
+const CLIENTS = [
+  { id: 'cursor', display_name: 'Cursor', kind: 'supported', state: 'connected_seen' },
+  { id: 'claude-code', display_name: 'Claude Code', kind: 'supported', state: 'connected_seen' },
+]
+const TOKENS = [
+  { name: 'qa-ro', token_prefix: 'mcp_agt_aa', kind: 'agent', revoked: false },
+  { name: 'qa-old', token_prefix: 'mcp_agt_bb', kind: 'agent', revoked: true },
+  { name: 'client-cursor', token_prefix: 'mcp_cli_cc', kind: 'client', client_id: 'cursor', revoked: false },
+]
+
+describe('CommandPalette profiles, clients and agent tokens (T163)', () => {
+  beforeEach(() => {
+    vi.useFakeTimers()
+    setActivePinia(createPinia())
+    document.body.innerHTML = ''
+    searchTools.mockReset().mockResolvedValue({ success: true, data: { results: [] } })
+    ;(api.hasAPIKey as any).mockReturnValue(true)
+    getProfiles.mockReset().mockResolvedValue({ profiles: [PROFILE] })
+    getClients.mockReset().mockResolvedValue({ success: true, data: { clients: CLIENTS } })
+    listAgentTokens.mockReset().mockResolvedValue({ success: true, data: { tokens: TOKENS } })
+    setAvailableFeatures(['scope_filters'])
+    useServersStore().servers = [] as any
+  })
+  afterEach(() => {
+    vi.useRealTimers()
+    document.body.innerHTML = ''
+  })
+
+  const open = async (opts = { profiles: true, clients: true }) => {
+    const mounted = await mountPalette(opts)
+    key({ key: 'k', metaKey: true })
+    await tick()
+    return mounted
+  }
+
+  it('issues no /profiles, /clients or /tokens request on open, and exactly one each after the first input', async () => {
+    const { wrapper } = await open()
+    await tick(1000)
+    expect(getProfiles).not.toHaveBeenCalled()
+    expect(getClients).not.toHaveBeenCalled()
+    expect(listAgentTokens).not.toHaveBeenCalled()
+
+    await type('w')
+    await tick(10)
+    await type('wo')
+    await tick(10)
+    await type('wor')
+    await tick(200)
+    expect(getProfiles).toHaveBeenCalledTimes(1)
+    expect(getClients).toHaveBeenCalledTimes(1)
+    expect(listAgentTokens).toHaveBeenCalledTimes(1)
+    // unscoped: the palette never reuses the page-scoped clients store
+    expect(getClients).toHaveBeenCalledWith()
+    wrapper.unmount()
+  })
+
+  it('"work" lists the profile by title with the slug hint and Enter opens its editor', async () => {
+    const { wrapper, push } = await open()
+    await type('work')
+    await tick(200)
+    expect(sectionIds()).toContain('profiles')
+    const row = dialog().querySelector('[data-test="palette-row-profiles-0"]') as HTMLElement
+    expect(row.textContent).toContain('Work Read-only')
+    expect(row.textContent).toContain('work-readonly')
+    row.click()
+    await tick()
+    expect(push).toHaveBeenLastCalledWith({ name: 'profile-editor', params: { name: 'work-readonly' }, query: {} })
+    wrapper.unmount()
+  })
+
+  it('"cur" lists Cursor and routes to /clients?client=cursor', async () => {
+    const { wrapper, push } = await open()
+    await type('cur')
+    await tick(200)
+    const row = dialog().querySelector('[data-test="palette-row-clients-0"]') as HTMLElement
+    expect(row.textContent).toContain('Cursor')
+    row.click()
+    await tick()
+    expect(push).toHaveBeenLastCalledWith({ path: '/clients', query: { client: 'cursor' } })
+    wrapper.unmount()
+  })
+
+  it('without scope filters a client row lands on the attention-fix focus instead', async () => {
+    setAvailableFeatures([])
+    const { wrapper, push } = await open()
+    await type('cur')
+    await tick(200)
+    ;(dialog().querySelector('[data-test="palette-row-clients-0"]') as HTMLElement).click()
+    await tick()
+    expect(push).toHaveBeenLastCalledWith({ path: '/clients', query: { focus: 'cursor' } })
+    wrapper.unmount()
+  })
+
+  it('a token row routes to /clients?tab=tokens&token=qa-ro; client credentials and revoked tokens are excluded', async () => {
+    const { wrapper, push } = await open()
+    await type('qa')
+    await tick(200)
+    const tokenRows = Array.from(dialog().querySelectorAll('[data-test^="palette-row-tokens-"]')) as HTMLElement[]
+    expect(tokenRows).toHaveLength(1)
+    expect(tokenRows[0].textContent).toContain('qa-ro')
+    tokenRows[0].click()
+    await tick()
+    expect(push).toHaveBeenLastCalledWith({ path: '/clients', query: { tab: 'tokens', token: 'qa-ro' } })
+
+    key({ key: 'k', metaKey: true })
+    await tick()
+    await type('client-cursor')
+    await tick(200)
+    expect(dialog().querySelector('[data-test^="palette-row-tokens-"]')).toBeNull()
+    wrapper.unmount()
+  })
+
+  it('without scope filters a token row opens the tokens tab', async () => {
+    setAvailableFeatures([])
+    const { wrapper, push } = await open()
+    await type('qa-ro')
+    await tick(200)
+    ;(dialog().querySelector('[data-test="palette-row-tokens-0"]') as HTMLElement).click()
+    await tick()
+    expect(push).toHaveBeenLastCalledWith({ path: '/clients', query: { tab: 'tokens' } })
+    wrapper.unmount()
+  })
+
+  it('all three groups are needle-only: none shows on an empty input', async () => {
+    const { wrapper } = await open()
+    expect(directoryIds()).toEqual([])
+    wrapper.unmount()
+  })
+
+  it('profile rows need the /profiles route; client and token rows need /clients', async () => {
+    const { wrapper } = await open({ profiles: false, clients: false })
+    await type('w')
+    await tick(200)
+    await type('cur')
+    await tick(200)
+    await type('qa')
+    await tick(200)
+    expect(directoryIds()).toEqual([])
+    wrapper.unmount()
+  })
+
+  it('a failed /tokens request hides only the tokens group', async () => {
+    listAgentTokens.mockReset().mockRejectedValue(new Error('boom'))
+    const { wrapper } = await open()
+    await type('c')
+    await tick(200)
+    const ids = sectionIds()
+    expect(ids).toContain('clients')
+    expect(ids).not.toContain('tokens')
+    wrapper.unmount()
+  })
+
+  it('arrow keys and aria-activedescendant span the new sections', async () => {
+    const { wrapper } = await open()
+    await type('c')
+    await tick(200)
+    const all = rows()
+    expect(sectionIds()).toContain('clients')
+    const clientIdx = all.findIndex((r) => r.getAttribute('data-test')?.startsWith('palette-row-clients-'))
+    expect(clientIdx).toBeGreaterThan(-1)
+    for (let n = 0; n < clientIdx; n++) {
+      input().dispatchEvent(new KeyboardEvent('keydown', { key: 'ArrowDown', bubbles: true, cancelable: true }))
+    }
+    await tick()
+    expect(rows()[clientIdx].getAttribute('aria-selected')).toBe('true')
+    expect(input().getAttribute('aria-activedescendant')).toBe(rows()[clientIdx].id)
+    wrapper.unmount()
+  })
+
+  it('a tenant and the server edition get none of the three groups and make no requests', async () => {
+    const auth = useAuthStore()
+    ;(api.hasAPIKey as any).mockReturnValue(false)
+    auth.isTeamsEdition = true
+    auth.loading = false
+    auth.authResolvedSuccessfully = true
+    auth.user = { id: 'u', email: 'u@x', display_name: 'U', role: 'user', provider: 'oidc', created_at: '', last_login_at: '' } as any
+    const { wrapper } = await open()
+    await type('cur')
+    await tick(300)
+    expect(getProfiles).not.toHaveBeenCalled()
+    expect(getClients).not.toHaveBeenCalled()
+    expect(listAgentTokens).not.toHaveBeenCalled()
+    expect(directoryIds()).toEqual([])
+    wrapper.unmount()
+
+    document.body.innerHTML = ''
+    auth.user = { id: 'a', email: 'a@x', display_name: 'A', role: 'admin', provider: 'oidc', created_at: '', last_login_at: '' } as any
+    const admin = await open()
+    await type('cur')
+    await tick(300)
+    expect(getClients).not.toHaveBeenCalled()
+    expect(directoryIds()).toEqual([])
+    admin.wrapper.unmount()
+  })
+
+  it('reloads the lists on the next open (cached for one open only)', async () => {
+    const { wrapper } = await open()
+    await type('cur')
+    await tick(200)
+    expect(getClients).toHaveBeenCalledTimes(1)
+    key({ key: 'k', metaKey: true }) // close
+    await tick()
+    key({ key: 'k', metaKey: true }) // reopen
+    await tick()
+    await type('cur')
+    await tick(200)
+    expect(getClients).toHaveBeenCalledTimes(2)
+    wrapper.unmount()
+  })
+})
diff --git a/frontend/tests/unit/form-control-label-shim.spec.ts b/frontend/tests/unit/form-control-label-shim.spec.ts
new file mode 100644
index 000000000..6134b2f47
--- /dev/null
+++ b/frontend/tests/unit/form-control-label-shim.spec.ts
@@ -0,0 +1,55 @@
+import { describe, it, expect } from 'vitest'
+import { readFileSync } from 'node:fs'
+import { resolve } from 'node:path'
+
+// Spec 108 D39 (T151, demo finding #9): the unlayered daisyUI-v5 shim gives
+// `.form-control > .label` `justify-content: space-between`. An unlayered rule
+// beats the layered Tailwind `justify-start` utility, so a radio/checkbox label
+// written as `<label class="label cursor-pointer justify-start ...">` directly
+// inside a `.form-control` had its text pushed to the far right. One unlayered
+// rule, placed after the shim, restores the author's intent for every instance.
+
+const css = readFileSync(resolve(__dirname, '../../src/assets/main.css'), 'utf8')
+
+// Remove every `@layer name { ... }` block (brace-matched) so what is left is
+// the unlayered CSS.
+function stripLayers(src: string): string {
+  let out = ''
+  let i = 0
+  while (i < src.length) {
+    const at = src.indexOf('@layer', i)
+    if (at === -1) {
+      out += src.slice(i)
+      break
+    }
+    out += src.slice(i, at)
+    const open = src.indexOf('{', at)
+    if (open === -1) break
+    let depth = 1
+    let j = open + 1
+    while (j < src.length && depth > 0) {
+      if (src[j] === '{') depth++
+      else if (src[j] === '}') depth--
+      j++
+    }
+    i = j
+  }
+  return out
+}
+
+describe('form-control label shim (justify-start)', () => {
+  const unlayered = stripLayers(css)
+
+  it('has an unlayered `.form-control > .label.justify-start` rule with flex-start', () => {
+    const m = unlayered.match(/\.form-control\s*>\s*\.label\.justify-start\s*\{([^}]*)\}/)
+    expect(m, 'rule missing from the unlayered CSS').not.toBeNull()
+    expect(m![1]).toMatch(/justify-content:\s*flex-start/)
+  })
+
+  it('comes after the space-between shim rule it overrides', () => {
+    const base = unlayered.search(/\.form-control\s*>\s*\.label\s*\{/)
+    const override = unlayered.search(/\.form-control\s*>\s*\.label\.justify-start\s*\{/)
+    expect(base).toBeGreaterThanOrEqual(0)
+    expect(override).toBeGreaterThan(base)
+  })
+})
diff --git a/frontend/tests/unit/profiles-enums-labels.spec.ts b/frontend/tests/unit/profiles-enums-labels.spec.ts
index 82b6d094c..74d5d3c71 100644
--- a/frontend/tests/unit/profiles-enums-labels.spec.ts
+++ b/frontend/tests/unit/profiles-enums-labels.spec.ts
@@ -5,6 +5,7 @@ import {
   MAX_TIER_OPTIONS,
   STEP_LABELS,
   UNANNOTATED_OPTIONS,
+  credentialCta,
   credentialLabel,
   modeLabel,
   profileSourceLabel,
@@ -106,6 +107,19 @@ describe('the Web UI words equal labels.json (L6, US3-3)', () => {
     }
   })
 
+  it('credential CTA: credentialCta returns the table for every state, empty only for a client credential', () => {
+    expect(Object.keys(labels.credential_cta).sort()).toEqual([...enums.credential_state].sort())
+    for (const state of enums.credential_state) {
+      if (state === 'client') {
+        expect(labels.credential_cta[state]).toBe('')
+        continue
+      }
+      expect(credentialCta(state), state).toBe(labels.credential_cta[state])
+    }
+    // a state the Web UI has never heard of is not an upgrade either
+    expect(credentialCta(undefined)).toBe(labels.credential_cta.unknown)
+  })
+
   it('binding modes: modeLabel returns the table for every value', () => {
     for (const mode of enums.binding_mode) {
       expect(modeLabel(mode), mode).toBe(labels.binding_mode[mode])
diff --git a/frontend/tests/unit/settings-audit-log.spec.ts b/frontend/tests/unit/settings-audit-log.spec.ts
index d530509c7..953b37a04 100644
--- a/frontend/tests/unit/settings-audit-log.spec.ts
+++ b/frontend/tests/unit/settings-audit-log.spec.ts
@@ -1,5 +1,5 @@
 import { describe, it, expect } from 'vitest'
-import { AUDIT_LOG_FIELDS, ADVANCED_ACCORDIONS, allCatalogFields } from '../../src/views/settings/fields'
+import { AUDIT_LOG_FIELDS, ADVANCED_ACCORDIONS, allCatalogFields, buildPartial, hydrateConfigState } from '../../src/views/settings/fields'
 
 // Spec 107 PR-D (T110a/T110, US3): the `audit_log.*` accordion rows of
 // `contracts/config-keys.md` — every row is restart-pinned ("audit_log is
@@ -55,3 +55,37 @@ describe('Settings audit-log accordion (Spec 107 T110)', () => {
     }
   })
 })
+
+// F3.1: hydrating an absent audit_log block as enabled+stdout ON must not make
+// a dirty-keys-only save of another audit_log field produce a sink-less block.
+describe('audit_log partial save carries the displayed sink state (F3.1)', () => {
+  it('server edition, absent block: a compress-only edit also sends enabled and stdout', () => {
+    const { working } = hydrateConfigState({}, { edition: 'server' })
+    working.audit_log.compress = false
+    expect(buildPartial(working, ['audit_log.compress'])).toEqual({
+      audit_log: { compress: false, enabled: true, stdout: true },
+    })
+  })
+
+  it('personal edition, absent block: a rotation edit sends enabled=false so the block validates', () => {
+    const { working } = hydrateConfigState({})
+    working.audit_log.max_size_mb = 50
+    expect(buildPartial(working, ['audit_log.max_size_mb'])).toEqual({
+      audit_log: { max_size_mb: 50, enabled: false, stdout: false },
+    })
+  })
+
+  it('an explicitly dirty sink key keeps its own value', () => {
+    const { working } = hydrateConfigState({}, { edition: 'server' })
+    working.audit_log.stdout = false
+    working.audit_log.path = '/tmp/a.jsonl'
+    expect(buildPartial(working, ['audit_log.stdout', 'audit_log.path'])).toEqual({
+      audit_log: { stdout: false, path: '/tmp/a.jsonl', enabled: true },
+    })
+  })
+
+  it('does not touch audit_log when no audit_log key is dirty', () => {
+    const { working } = hydrateConfigState({}, { edition: 'server' })
+    expect(buildPartial(working, ['quarantine_enabled'])).not.toHaveProperty('audit_log')
+  })
+})
diff --git a/frontend/tests/unit/settings-header-copy.spec.ts b/frontend/tests/unit/settings-header-copy.spec.ts
new file mode 100644
index 000000000..d5ecad7c6
--- /dev/null
+++ b/frontend/tests/unit/settings-header-copy.spec.ts
@@ -0,0 +1,34 @@
+import { describe, it, expect, vi } from 'vitest'
+import { mount } from '@vue/test-utils'
+import { reactive } from 'vue'
+import { readFileSync } from 'node:fs'
+import { resolve } from 'node:path'
+
+// Spec 109 D35 (T162, demo finding #3): the Settings header claimed "Changes
+// save instantly" while every section has a "Save changes" button and an
+// unsaved-changes counter. The header now names the button by interpolating the
+// same constant the button renders, so the two cannot drift.
+
+vi.mock('@/services/api', () => ({ default: { patchConfig: vi.fn() } }))
+vi.mock('@/stores/system', () => ({ useSystemStore: () => ({ addToast: vi.fn() }) }))
+
+import SettingsSection from '@/components/settings/SettingsSection.vue'
+import { SAVE_CHANGES_LABEL, type SettingField } from '@/views/settings/fields'
+
+describe('Settings header copy matches behaviour', () => {
+  const settingsVue = readFileSync(resolve(__dirname, '../../src/views/Settings.vue'), 'utf8')
+
+  it('names the save button by interpolating SAVE_CHANGES_LABEL and never says "instantly"', () => {
+    expect(settingsVue).not.toMatch(/save instantly/i)
+    expect(settingsVue).toContain('{{ SAVE_CHANGES_LABEL }}')
+  })
+
+  it('SAVE_CHANGES_LABEL is the section save button text', () => {
+    const field: SettingField = { key: 'tool_response_limit', label: 'Limit', control: 'number', min: 0 }
+    const w = mount(SettingsSection, {
+      props: { sectionId: 'general', fields: [field], working: reactive({ tool_response_limit: 1 }), original: reactive({ tool_response_limit: 1 }) },
+    })
+    expect(w.find('[data-test="settings-apply-general"]').text()).toBe(SAVE_CHANGES_LABEL)
+    expect(SAVE_CHANGES_LABEL).toBe('Save changes')
+  })
+})
diff --git a/frontend/tests/unit/settings-nullable-defaults.spec.ts b/frontend/tests/unit/settings-nullable-defaults.spec.ts
new file mode 100644
index 000000000..764c81530
--- /dev/null
+++ b/frontend/tests/unit/settings-nullable-defaults.spec.ts
@@ -0,0 +1,184 @@
+import { describe, it, expect, vi, beforeEach } from 'vitest'
+import { mount, flushPromises } from '@vue/test-utils'
+import { readFileSync } from 'node:fs'
+import { resolve } from 'node:path'
+import { reactive } from 'vue'
+
+// Spec 109 D35 (T161, demo finding #2): a nullable (*bool) config key that the
+// API omits resolves to a concrete value in Go (quarantine on, telemetry on,
+// ...). The Settings toggle used to read `!!undefined` and render OFF, while
+// the posture chip said ON. The shared fixture below is the same file the Go
+// test pins to the Go resolvers.
+
+const patchConfig = vi.fn(() =>
+  Promise.resolve({ success: true, data: { changed_fields: [], requires_restart: false } })
+)
+vi.mock('@/services/api', () => ({
+  default: { patchConfig: (...args: unknown[]) => patchConfig(...args) },
+}))
+vi.mock('@/stores/system', () => ({ useSystemStore: () => ({ addToast: vi.fn() }) }))
+
+import SettingsSection from '@/components/settings/SettingsSection.vue'
+import SettingField from '@/components/settings/SettingField.vue'
+import {
+  hydrateConfigState,
+  allCatalogFields,
+  effectiveBool,
+  refreshEditionDefaults,
+  type SettingField as Field,
+} from '@/views/settings/fields'
+
+type BlockDefault = {
+  absent_block: { personal: boolean; server: boolean }
+  present_block: boolean
+}
+const fixture = JSON.parse(
+  readFileSync(resolve(__dirname, '../../../internal/config/testdata/settings_nullable_defaults.json'), 'utf8')
+) as { defaults: Record<string, boolean | BlockDefault>; not_in_settings: string[] }
+
+const field = (key: string): Field => {
+  const f = allCatalogFields().find((x) => x.key === key)
+  if (!f) throw new Error(`no settings field for ${key}`)
+  return f
+}
+
+describe('nullable boolean settings render their effective value', () => {
+  it('quarantine_enabled absent -> ON in working and original, not dirty', () => {
+    const { working, original } = hydrateConfigState({})
+    expect(working.quarantine_enabled).toBe(true)
+    expect(original.quarantine_enabled).toBe(true)
+    expect(JSON.stringify(working)).toBe(JSON.stringify(original))
+  })
+
+  it('SettingField renders the quarantine toggle checked when the key is absent', () => {
+    const { working } = hydrateConfigState({})
+    const w = mount(SettingField, {
+      props: { field: field('quarantine_enabled'), modelValue: working.quarantine_enabled, dirty: false },
+    })
+    const toggle = w.find('[data-test="setting-toggle-quarantine_enabled"]')
+    expect((toggle.element as HTMLInputElement).checked).toBe(true)
+  })
+
+  it('an explicit false stays false', () => {
+    const { working, original } = hydrateConfigState({ quarantine_enabled: false, telemetry: { enabled: false } })
+    expect(working.quarantine_enabled).toBe(false)
+    expect(original.quarantine_enabled).toBe(false)
+    expect(working.telemetry.enabled).toBe(false)
+  })
+
+  it('telemetry.enabled absent (no block, or block without the key) -> ON', () => {
+    expect(hydrateConfigState({}).working.telemetry.enabled).toBe(true)
+    expect(hydrateConfigState({ telemetry: { endpoint: 'x' } }).working.telemetry.enabled).toBe(true)
+  })
+
+  it('server edition: audit_log block absent -> enabled, stdout and compress ON', () => {
+    const { working, original } = hydrateConfigState({}, { edition: 'server' })
+    expect(working.audit_log).toEqual({ enabled: true, stdout: true, compress: true })
+    expect(original.audit_log).toEqual({ enabled: true, stdout: true, compress: true })
+  })
+
+  it('personal edition: audit_log block absent -> logging OFF, compress ON', () => {
+    const { working } = hydrateConfigState({}, { edition: 'personal' })
+    expect(working.audit_log.enabled).toBe(false)
+    expect(working.audit_log.stdout).toBe(false)
+    expect(working.audit_log.compress).toBe(true)
+    // edition unknown behaves as personal (the safe, "off" reading)
+    expect(hydrateConfigState({}).working.audit_log.enabled).toBe(false)
+  })
+
+  it('audit_log block present: enabled ON, stdout OFF (an explicit block never defaults stdout)', () => {
+    const { working } = hydrateConfigState({ audit_log: { path: 'x' } }, { edition: 'server' })
+    expect(working.audit_log.enabled).toBe(true)
+    expect(working.audit_log.stdout).toBe(false)
+    expect(working.audit_log.compress).toBe(true)
+    expect(working.audit_log.path).toBe('x')
+  })
+
+  it('materialising audit_log.enabled does not flip the stdout rule (snapshot first)', () => {
+    // stdout's default reads "is the block absent"; if enabled were written
+    // first the block would exist by the time stdout was resolved.
+    const { working } = hydrateConfigState({}, { edition: 'server' })
+    expect(working.audit_log.stdout).toBe(true)
+  })
+
+  it('explicit audit_log values are never overwritten', () => {
+    const { working } = hydrateConfigState(
+      { audit_log: { enabled: false, stdout: true, compress: false } },
+      { edition: 'server' }
+    )
+    expect(working.audit_log).toEqual({ enabled: false, stdout: true, compress: false })
+  })
+
+  it('the posture helper and the toggle agree on the effective value', () => {
+    const empty = hydrateConfigState({}).working
+    expect(effectiveBool(empty, 'quarantine_enabled')).toBe(true)
+    expect(effectiveBool({ quarantine_enabled: false }, 'quarantine_enabled')).toBe(false)
+    // works on a raw (un-hydrated) config too
+    expect(effectiveBool({}, 'quarantine_enabled')).toBe(true)
+  })
+})
+
+describe('fixture parity (internal/config/testdata/settings_nullable_defaults.json)', () => {
+  const personal = hydrateConfigState({}, { edition: 'personal' }).working
+  const server = hydrateConfigState({}, { edition: 'server' }).working
+  const present = hydrateConfigState({ audit_log: {} }, { edition: 'server' }).working
+  const get = (cfg: any, key: string) => key.split('.').reduce((o, k) => (o == null ? undefined : o[k]), cfg)
+
+  for (const [key, def] of Object.entries(fixture.defaults)) {
+    it(`${key} is a catalogue toggle whose default matches the fixture`, () => {
+      expect(field(key).control).toBe('toggle')
+      if (typeof def === 'boolean') {
+        expect(get(personal, key), `${key} personal`).toBe(def)
+        expect(get(server, key), `${key} server`).toBe(def)
+      } else {
+        expect(get(personal, key), `${key} absent/personal`).toBe(def.absent_block.personal)
+        expect(get(server, key), `${key} absent/server`).toBe(def.absent_block.server)
+        expect(get(present, key), `${key} present`).toBe(def.present_block)
+      }
+    })
+  }
+
+  it('no catalogue toggle is listed as not_in_settings', () => {
+    const toggles = new Set(allCatalogFields().filter((f) => f.control === 'toggle').map((f) => f.key))
+    for (const k of fixture.not_in_settings) expect(toggles.has(k), k).toBe(false)
+  })
+})
+
+describe('saving an unrelated section never writes the defaulted keys', () => {
+  beforeEach(() => patchConfig.mockClear())
+
+  it('PATCH body for another field carries no audit_log / quarantine_enabled / telemetry key', async () => {
+    const { working, original } = hydrateConfigState({}, { edition: 'server' })
+    const other: Field = { key: 'tool_response_limit', label: 'Limit', control: 'number', min: 0 }
+    const rw = reactive(working)
+    const w = mount(SettingsSection, {
+      props: { sectionId: 'general', fields: [other], working: rw, original: reactive(original) },
+    })
+    rw.tool_response_limit = 123
+    await flushPromises()
+    await w.find('[data-test="settings-apply-general"]').trigger('click')
+    await flushPromises()
+    expect(patchConfig).toHaveBeenCalledTimes(1)
+    const body = patchConfig.mock.calls[0][0] as Record<string, unknown>
+    expect(body).toEqual({ tool_response_limit: 123 })
+    expect(Object.keys(body)).not.toContain('audit_log')
+  })
+})
+
+describe('edition arriving after the config (status frame race)', () => {
+  it('re-resolves untouched audit_log defaults in both copies, so nothing turns dirty', () => {
+    const state = hydrateConfigState({}) // edition unknown yet
+    expect(state.working.audit_log.enabled).toBe(false)
+    refreshEditionDefaults(state, state.raw, { edition: 'server' })
+    expect(state.working.audit_log).toEqual({ enabled: true, stdout: true, compress: true })
+    expect(JSON.stringify(state.working)).toBe(JSON.stringify(state.original))
+  })
+
+  it('leaves a key the user already edited alone', () => {
+    const state = hydrateConfigState({})
+    state.working.audit_log.stdout = true // user flipped it
+    refreshEditionDefaults(state, state.raw, { edition: 'server' })
+    expect(state.working.audit_log.stdout).toBe(true)
+    expect(state.original.audit_log.stdout).toBe(false)
+  })
+})
diff --git a/frontend/tests/unit/settings-serialization-modes.spec.ts b/frontend/tests/unit/settings-serialization-modes.spec.ts
index bfdd57f1c..117fa17f4 100644
--- a/frontend/tests/unit/settings-serialization-modes.spec.ts
+++ b/frontend/tests/unit/settings-serialization-modes.spec.ts
@@ -104,7 +104,7 @@ describe('normalizeFieldDefaults', () => {
   it('leaves fields that declare no default untouched', () => {
     const cfg = normalizeFieldDefaults({})
     for (const f of allCatalogFields()) {
-      if (f.defaultValue == null) expect(getPath(cfg, f.key)).toBeUndefined()
+      if (f.defaultValue == null && !f.defaultFor) expect(getPath(cfg, f.key)).toBeUndefined()
     }
   })
 
diff --git a/internal/config/settings_nullable_defaults_personal_test.go b/internal/config/settings_nullable_defaults_personal_test.go
new file mode 100644
index 000000000..db6d0a3bc
--- /dev/null
+++ b/internal/config/settings_nullable_defaults_personal_test.go
@@ -0,0 +1,24 @@
+//go:build !server
+
+package config
+
+import "testing"
+
+// Spec 109 D35 (T161): the personal edition leaves audit logging off when the
+// audit_log block is absent; the Settings toggles must agree.
+func TestSettingsNullableDefaultsAbsentAuditLogBlock_Personal(t *testing.T) {
+	fx := loadNullableDefaultsFixture(t)
+	resolved, _, err := EffectiveAuditLog(&Config{}, TransportHTTP)
+	if err != nil {
+		t.Fatalf("unexpected error: %v", err)
+	}
+	if want := fixtureBlock(t, fx, "audit_log.enabled").AbsentBlock["personal"]; resolved.Enabled != want {
+		t.Errorf("absent-block audit_log.enabled = %v, fixture says %v", resolved.Enabled, want)
+	}
+	if want := fixtureBlock(t, fx, "audit_log.stdout").AbsentBlock["personal"]; resolved.Stdout != want {
+		t.Errorf("absent-block audit_log.stdout = %v, fixture says %v", resolved.Stdout, want)
+	}
+	if want := fixtureBlock(t, fx, "audit_log.compress").AbsentBlock["personal"]; resolved.Compress != want {
+		t.Errorf("absent-block audit_log.compress = %v, fixture says %v", resolved.Compress, want)
+	}
+}
diff --git a/internal/config/settings_nullable_defaults_server_test.go b/internal/config/settings_nullable_defaults_server_test.go
new file mode 100644
index 000000000..c23e0595b
--- /dev/null
+++ b/internal/config/settings_nullable_defaults_server_test.go
@@ -0,0 +1,25 @@
+//go:build server
+
+package config
+
+import "testing"
+
+// Spec 109 D35 (T161): the server edition turns audit logging on with a stdout
+// sink when the audit_log block is absent (HTTP transport); the Settings
+// toggles must agree.
+func TestSettingsNullableDefaultsAbsentAuditLogBlock_Server(t *testing.T) {
+	fx := loadNullableDefaultsFixture(t)
+	resolved, _, err := EffectiveAuditLog(&Config{}, TransportHTTP)
+	if err != nil {
+		t.Fatalf("unexpected error: %v", err)
+	}
+	if want := fixtureBlock(t, fx, "audit_log.enabled").AbsentBlock["server"]; resolved.Enabled != want {
+		t.Errorf("absent-block audit_log.enabled = %v, fixture says %v", resolved.Enabled, want)
+	}
+	if want := fixtureBlock(t, fx, "audit_log.stdout").AbsentBlock["server"]; resolved.Stdout != want {
+		t.Errorf("absent-block audit_log.stdout = %v, fixture says %v", resolved.Stdout, want)
+	}
+	if want := fixtureBlock(t, fx, "audit_log.compress").AbsentBlock["server"]; resolved.Compress != want {
+		t.Errorf("absent-block audit_log.compress = %v, fixture says %v", resolved.Compress, want)
+	}
+}
diff --git a/internal/config/settings_nullable_defaults_test.go b/internal/config/settings_nullable_defaults_test.go
new file mode 100644
index 000000000..032e29342
--- /dev/null
+++ b/internal/config/settings_nullable_defaults_test.go
@@ -0,0 +1,177 @@
+package config
+
+import (
+	"encoding/json"
+	"os"
+	"reflect"
+	"sort"
+	"strings"
+	"testing"
+)
+
+// Spec 109 D35 (T161): the Settings page renders a toggle for every nullable
+// (*bool) config key. A nil *bool resolves to a concrete value on the Go side
+// (quarantine on, telemetry on, ...). The shared fixture records that value so
+// the Web UI (frontend/tests/unit/settings-nullable-defaults.spec.ts) renders
+// the same state the core enforces, and so a new *bool key cannot be added
+// without deciding which of the two sets it belongs to.
+
+type nullableDefaultsFixture struct {
+	Defaults      map[string]json.RawMessage `json:"defaults"`
+	NotInSettings []string                   `json:"not_in_settings"`
+}
+
+// blockDependentDefault is the fixture shape for the audit_log keys, whose
+// resolved default depends on whether the audit_log block is present, and (for
+// an absent block) on the edition the binary was built as.
+type blockDependentDefault struct {
+	AbsentBlock  map[string]bool `json:"absent_block"`
+	PresentBlock bool            `json:"present_block"`
+}
+
+func loadNullableDefaultsFixture(t *testing.T) nullableDefaultsFixture {
+	t.Helper()
+	raw, err := os.ReadFile("testdata/settings_nullable_defaults.json")
+	if err != nil {
+		t.Fatalf("read fixture: %v", err)
+	}
+	var fx nullableDefaultsFixture
+	if err := json.Unmarshal(raw, &fx); err != nil {
+		t.Fatalf("decode fixture: %v", err)
+	}
+	return fx
+}
+
+func fixtureBool(t *testing.T, fx nullableDefaultsFixture, key string) bool {
+	t.Helper()
+	raw, ok := fx.Defaults[key]
+	if !ok {
+		t.Fatalf("fixture has no default for %q", key)
+	}
+	var b bool
+	if err := json.Unmarshal(raw, &b); err != nil {
+		t.Fatalf("fixture default for %q is not a bool: %v", key, err)
+	}
+	return b
+}
+
+func fixtureBlock(t *testing.T, fx nullableDefaultsFixture, key string) blockDependentDefault {
+	t.Helper()
+	raw, ok := fx.Defaults[key]
+	if !ok {
+		t.Fatalf("fixture has no default for %q", key)
+	}
+	var d blockDependentDefault
+	if err := json.Unmarshal(raw, &d); err != nil {
+		t.Fatalf("fixture default for %q is not block-dependent: %v", key, err)
+	}
+	return d
+}
+
+func TestSettingsNullableDefaultsMatchGoResolvers(t *testing.T) {
+	fx := loadNullableDefaultsFixture(t)
+
+	t.Run("quarantine_enabled", func(t *testing.T) {
+		cfg := &Config{}
+		if got, want := cfg.IsQuarantineEnabled(), fixtureBool(t, fx, "quarantine_enabled"); got != want {
+			t.Fatalf("nil quarantine_enabled resolves to %v, fixture says %v", got, want)
+		}
+	})
+
+	t.Run("telemetry.enabled", func(t *testing.T) {
+		t.Setenv("MCPPROXY_TELEMETRY", "")
+		want := fixtureBool(t, fx, "telemetry.enabled")
+		if got := (&Config{}).IsTelemetryEnabled(); got != want {
+			t.Fatalf("absent telemetry block resolves to %v, fixture says %v", got, want)
+		}
+		if got := (&Config{Telemetry: &TelemetryConfig{}}).IsTelemetryEnabled(); got != want {
+			t.Fatalf("nil telemetry.enabled resolves to %v, fixture says %v", got, want)
+		}
+	})
+
+	t.Run("audit_log present block", func(t *testing.T) {
+		cfg := &Config{AuditLog: &AuditLogConfig{Path: "/tmp/audit.jsonl"}}
+		resolved, _, err := EffectiveAuditLog(cfg, TransportHTTP)
+		if err != nil {
+			t.Fatalf("unexpected error: %v", err)
+		}
+		if want := fixtureBlock(t, fx, "audit_log.enabled").PresentBlock; resolved.Enabled != want {
+			t.Errorf("present-block audit_log.enabled = %v, fixture says %v", resolved.Enabled, want)
+		}
+		if want := fixtureBlock(t, fx, "audit_log.compress").PresentBlock; resolved.Compress != want {
+			t.Errorf("present-block audit_log.compress = %v, fixture says %v", resolved.Compress, want)
+		}
+		if want := fixtureBlock(t, fx, "audit_log.stdout").PresentBlock; resolved.Stdout != want {
+			t.Errorf("present-block audit_log.stdout = %v, fixture says %v", resolved.Stdout, want)
+		}
+	})
+}
+
+// collectNullableBoolPaths walks a struct type and returns the dot-path of
+// every *bool reachable through struct (or pointer-to-struct) fields. Slices
+// and maps are not followed: per-server and per-profile structs are edited on
+// their own pages, not through the Settings catalogue.
+func collectNullableBoolPaths(t reflect.Type, prefix string, seen map[reflect.Type]bool, out *[]string) {
+	if t.Kind() == reflect.Pointer {
+		t = t.Elem()
+	}
+	if t.Kind() != reflect.Struct || seen[t] {
+		return
+	}
+	seen[t] = true
+	defer delete(seen, t)
+	for i := 0; i < t.NumField(); i++ {
+		f := t.Field(i)
+		tag := strings.Split(f.Tag.Get("json"), ",")[0]
+		if tag == "" || tag == "-" {
+			continue
+		}
+		path := tag
+		if prefix != "" {
+			path = prefix + "." + tag
+		}
+		ft := f.Type
+		if ft.Kind() == reflect.Pointer && ft.Elem().Kind() == reflect.Bool {
+			*out = append(*out, path)
+			continue
+		}
+		if ft.Kind() == reflect.Pointer || ft.Kind() == reflect.Struct {
+			collectNullableBoolPaths(ft, path, seen, out)
+		}
+	}
+}
+
+func TestEveryNullableBoolConfigPathIsClassified(t *testing.T) {
+	fx := loadNullableDefaultsFixture(t)
+	classified := map[string]string{}
+	for k := range fx.Defaults {
+		classified[k] = "defaults"
+	}
+	for _, k := range fx.NotInSettings {
+		if prev, dup := classified[k]; dup {
+			t.Errorf("%q is listed in both %s and not_in_settings", k, prev)
+		}
+		classified[k] = "not_in_settings"
+	}
+
+	var paths []string
+	collectNullableBoolPaths(reflect.TypeOf(Config{}), "", map[reflect.Type]bool{}, &paths)
+	sort.Strings(paths)
+	if len(paths) == 0 {
+		t.Fatal("reflection found no *bool paths; the walker is broken")
+	}
+	found := map[string]bool{}
+	for _, p := range paths {
+		found[p] = true
+		if _, ok := classified[p]; !ok {
+			t.Errorf("*bool config path %q is not classified in testdata/settings_nullable_defaults.json: "+
+				"add it to `defaults` (and give its Settings toggle a defaultValue in frontend/src/views/settings/fields.ts) "+
+				"or to `not_in_settings`", p)
+		}
+	}
+	for k := range classified {
+		if !found[k] {
+			t.Errorf("fixture lists %q but Config has no such *bool path (stale entry)", k)
+		}
+	}
+}
diff --git a/internal/config/testdata/settings_nullable_defaults.json b/internal/config/testdata/settings_nullable_defaults.json
new file mode 100644
index 000000000..c0508d4f8
--- /dev/null
+++ b/internal/config/testdata/settings_nullable_defaults.json
@@ -0,0 +1,26 @@
+{
+  "_comment": "Spec 109 D35 (T161). Resolved value of every nullable (*bool) config key that has a Settings toggle. Decoded by internal/config/settings_nullable_defaults_test.go (pins each value to the Go resolver) and frontend/tests/unit/settings-nullable-defaults.spec.ts (pins fields.ts to it). A plain value applies when the key is absent. The audit_log.* keys depend on whether the audit_log block is present, and for an absent block on the edition: the personal edition leaves audit logging off, the server edition (HTTP transport) turns it on with a stdout sink. not_in_settings lists *bool keys that have no Settings toggle.",
+  "defaults": {
+    "quarantine_enabled": true,
+    "telemetry.enabled": true,
+    "audit_log.enabled": {
+      "absent_block": { "personal": false, "server": true },
+      "present_block": true
+    },
+    "audit_log.stdout": {
+      "absent_block": { "personal": false, "server": true },
+      "present_block": false
+    },
+    "audit_log.compress": {
+      "absent_block": { "personal": true, "server": true },
+      "present_block": true
+    }
+  },
+  "not_in_settings": [
+    "forward_client_headers",
+    "security.auto_baseline_scan",
+    "security.deep_scan.fetch_package_source",
+    "security.scanner_fetch_package_source",
+    "update_check.enabled"
+  ]
+}
diff --git a/internal/httpapi/concurrency_shed_test.go b/internal/httpapi/concurrency_shed_test.go
index 349236e50..dee4e9b84 100644
--- a/internal/httpapi/concurrency_shed_test.go
+++ b/internal/httpapi/concurrency_shed_test.go
@@ -135,7 +135,7 @@ func TestHandleCallTool_ShedReturns429WithRetryAfter(t *testing.T) {
 
 func TestHandleCallTool_ProfileBlockedReturns403(t *testing.T) {
 	apiKey := "test-profile-api-key"
-	message := "blocked by profile: github:create_issue is a write tool; this profile allows read tools only"
+	message := p108DisclosedToolRefusal(t, "tier")
 	ctrl := &shedController{
 		apiKey: apiKey,
 		err:    &profile.ToolBlockedError{Reason: profile.BlockReasonTier, Message: message},
@@ -145,7 +145,7 @@ func TestHandleCallTool_ProfileBlockedReturns403(t *testing.T) {
 	w := postToolCall(t, srv, apiKey)
 
 	require.Equal(t, http.StatusForbidden, w.Code)
-	assert.Contains(t, w.Body.String(), message)
+	assert.Contains(t, p108ErrorText(w.Body.String()), message)
 }
 
 // TestHandleCallTool_ServerUnavailableIsNot429 keeps FR-009 separate from
@@ -204,7 +204,7 @@ func TestHandleReplayToolCall_ShedReturns429(t *testing.T) {
 
 func TestReplayToolCall_ProfileGateUses403AndNonDisclosing404(t *testing.T) {
 	apiKey := "test-replay-profile-api-key"
-	message := "blocked by profile: github:create_issue is denied by a profile rule"
+	message := p108DisclosedToolRefusal(t, "rule")
 	cases := []struct {
 		name string
 		err  error
@@ -223,7 +223,7 @@ func TestReplayToolCall_ProfileGateUses403AndNonDisclosing404(t *testing.T) {
 			w := httptest.NewRecorder()
 			srv.ServeHTTP(w, req)
 			require.Equal(t, tc.want, w.Code)
-			assert.Contains(t, w.Body.String(), tc.body)
+			assert.Contains(t, p108ErrorText(w.Body.String()), tc.body)
 		})
 	}
 }
diff --git a/internal/httpapi/profiles_v3_parity_test.go b/internal/httpapi/profiles_v3_parity_test.go
index 59a10cd58..98ea9812c 100644
--- a/internal/httpapi/profiles_v3_parity_test.go
+++ b/internal/httpapi/profiles_v3_parity_test.go
@@ -56,13 +56,19 @@ func TestProfilesV3LabelsCoverEnums(t *testing.T) {
 	var labels map[string]json.RawMessage
 	p108ReadJSON(t, "internal/profile/testdata/contract/labels.json", &labels)
 
-	for _, family := range []string{"access_reason", "source", "explain_step", "credential_state", "binding_mode", "unannotated", "max_tier"} {
+	// credential_cta is keyed by the credential_state enum (the button a row
+	// shows to fix its credential), so it is compared with that family.
+	for _, family := range []string{"access_reason", "source", "explain_step", "credential_state", "credential_cta", "binding_mode", "unannotated", "max_tier"} {
 		raw, ok := labels[family]
 		require.True(t, ok, "labels.json has no %q family", family)
 		var words map[string]string
 		require.NoError(t, json.Unmarshal(raw, &words), family)
-		values, ok := enums[family]
-		require.True(t, ok, "enums.json has no %q family", family)
+		enumFamily := family
+		if family == "credential_cta" {
+			enumFamily = "credential_state"
+		}
+		values, ok := enums[enumFamily]
+		require.True(t, ok, "enums.json has no %q family", enumFamily)
 
 		want := append([]string(nil), values...)
 		sort.Strings(want)
@@ -73,6 +79,10 @@ func TestProfilesV3LabelsCoverEnums(t *testing.T) {
 				require.Empty(t, word, "source none carries no suffix")
 				continue
 			}
+			if family == "credential_cta" && key == "client" {
+				require.Empty(t, word, "a client credential needs no fix button")
+				continue
+			}
 			require.NotEmpty(t, word, "%s.%s has an empty label", family, key)
 		}
 	}
diff --git a/internal/httpapi/spec109_catalog_cached_fallback_test.go b/internal/httpapi/spec109_catalog_cached_fallback_test.go
new file mode 100644
index 000000000..5e3d1edb0
--- /dev/null
+++ b/internal/httpapi/spec109_catalog_cached_fallback_test.go
@@ -0,0 +1,146 @@
+package httpapi
+
+import (
+	"encoding/json"
+	"net/http"
+	"net/http/httptest"
+	"os"
+	"path/filepath"
+	"sync/atomic"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	"github.com/smart-mcp-proxy/mcpproxy-go/internal/registries"
+)
+
+// Spec 109 D35 (T160): the cached-fallback golden.
+// internal/registries/testdata/catalog_cached_fallback_order.json holds the
+// registry fixtures (input, one flaky source) and the REST answer while that
+// source is down (golden output). MCP, CLI, vitest and XCTest replay it.
+// UPDATE_GOLDEN=1 rewrites ids, results and unavailable from the real handler.
+
+const p109CachedFallbackFixture = "internal/registries/testdata/catalog_cached_fallback_order.json"
+
+type p109CachedFallbackSource struct {
+	ID         string            `json:"id"`
+	Name       string            `json:"name"`
+	Provenance string            `json:"provenance"`
+	Flaky      bool              `json:"flaky,omitempty"`
+	Servers    []json.RawMessage `json:"servers"`
+}
+
+// p109CachedFallbackUnavailable is the part of unavailable[] that is stable
+// across runs: which source fell back, and how.
+type p109CachedFallbackUnavailable struct {
+	Source   string `json:"source"`
+	Fallback string `json:"fallback"`
+}
+
+type p109CachedFallbackFile struct {
+	Comment     string                          `json:"_comment"`
+	Query       string                          `json:"query"`
+	Sources     []p109CachedFallbackSource      `json:"sources"`
+	IDs         []string                        `json:"ids"`
+	Results     []registries.CatalogResult      `json:"results"`
+	Unavailable []p109CachedFallbackUnavailable `json:"unavailable"`
+}
+
+// p109InstallCachedFallbackFixture serves each source from httptest. A flaky
+// source answers 500 once the returned breaker is tripped.
+func p109InstallCachedFallbackFixture(t *testing.T, f p109CachedFallbackFile) (trip func()) {
+	t.Helper()
+	registries.ResetListingCacheForTest()
+	t.Cleanup(registries.ResetListingCacheForTest)
+	var broken atomic.Bool
+	var entries []registries.RegistryEntry
+	for _, src := range f.Sources {
+		body, err := json.Marshal(src.Servers)
+		require.NoError(t, err)
+		flaky := src.Flaky
+		srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
+			if flaky && broken.Load() {
+				http.Error(w, "down", http.StatusInternalServerError)
+				return
+			}
+			w.Header().Set("Content-Type", "application/json")
+			_, _ = w.Write(body)
+		}))
+		t.Cleanup(srv.Close)
+		entries = append(entries, registries.RegistryEntry{ID: src.ID, Name: src.Name, ServersURL: srv.URL, Provenance: src.Provenance})
+	}
+	t.Cleanup(registries.AllowPrivateRegistryFetchForTest())
+	t.Cleanup(registries.SetRegistriesForTest(entries))
+	return func() { broken.Store(true) }
+}
+
+func TestCatalogCachedFallback_RESTWritesTheGolden(t *testing.T) {
+	var f p109CachedFallbackFile
+	p108ReadJSON(t, p109CachedFallbackFixture, &f)
+	trip := p109InstallCachedFallbackFixture(t, f)
+
+	ctrl := &scopeController{cfg: scopeFixtureConfig(false), servers: nil, withManagement: true}
+	srv, _ := scopedAgentServer(t, ctrl, []string{"alpha"})
+
+	// Browse once while every source is healthy: this primes the per-source
+	// listing cache. Then the flaky source goes down.
+	prime := scopeGet(t, srv, "/api/v1/catalog/search?q=", scopeAdminAPIKey)
+	require.Equal(t, http.StatusOK, prime.Code, "body: %s", prime.Body.String())
+	trip()
+
+	rec := scopeGet(t, srv, "/api/v1/catalog/search?q="+f.Query, scopeAdminAPIKey)
+	require.Equal(t, http.StatusOK, rec.Code, "body: %s", rec.Body.String())
+	var body struct {
+		Data struct {
+			Results     []registries.CatalogResult `json:"results"`
+			Unavailable []registries.SourceError   `json:"unavailable"`
+		} `json:"data"`
+	}
+	require.NoError(t, json.Unmarshal(rec.Body.Bytes(), &body))
+	got := body.Data.Results
+	require.NotEmpty(t, got)
+
+	// The live official hit is first and is not marked cached; every slowreg
+	// hit is marked cached.
+	assert.Equal(t, "official:io.github.github/github-mcp-server", got[0].Source+":"+got[0].ID)
+	assert.False(t, got[0].FromCache)
+	var sawCached bool
+	for _, r := range got {
+		if r.Source == "slowreg" {
+			assert.True(t, r.FromCache, "%s must be marked from_cache", r.ID)
+			sawCached = true
+		} else {
+			assert.False(t, r.FromCache, "%s is live", r.ID)
+		}
+	}
+	require.True(t, sawCached, "expected cached slowreg hits")
+
+	// The source stays in unavailable[] with the fallback marker and a time.
+	require.Len(t, body.Data.Unavailable, 1)
+	u := body.Data.Unavailable[0]
+	assert.Equal(t, "slowreg", u.Source)
+	assert.Equal(t, registries.FallbackCachedListing, u.Fallback)
+	require.NotNil(t, u.CachedAt)
+
+	var unavailable []p109CachedFallbackUnavailable
+	for _, e := range body.Data.Unavailable {
+		unavailable = append(unavailable, p109CachedFallbackUnavailable{Source: e.Source, Fallback: e.Fallback})
+	}
+
+	golden := filepath.Join(p109Root(t), p109CachedFallbackFixture)
+	if os.Getenv("UPDATE_GOLDEN") == "1" {
+		f.IDs = p109CatalogIDs(got)
+		f.Results = got
+		f.Unavailable = unavailable
+		require.NoError(t, os.WriteFile(golden, p109MarshalGolden(t, f), 0o644))
+		return
+	}
+	assert.Equal(t, f.IDs, p109CatalogIDs(got), "REST order must equal the golden ids (UPDATE_GOLDEN=1 regenerates)")
+	assert.Equal(t, f.Unavailable, unavailable)
+	want, err := json.Marshal(f.Results)
+	require.NoError(t, err)
+	have, err := json.Marshal(got)
+	require.NoError(t, err)
+	assert.JSONEq(t, string(want), string(have))
+}
diff --git a/internal/httpapi/tool_refusal_golden_test.go b/internal/httpapi/tool_refusal_golden_test.go
new file mode 100644
index 000000000..04cb49d28
--- /dev/null
+++ b/internal/httpapi/tool_refusal_golden_test.go
@@ -0,0 +1,53 @@
+package httpapi
+
+import (
+	"encoding/json"
+	"strings"
+	"testing"
+
+	"github.com/stretchr/testify/require"
+)
+
+// Spec 108 D39 (T148): the tool refusals a REST caller sees are the DISCLOSED
+// texts of internal/profile/testdata/contract/tool_refusals.json (a pinned
+// token is told its own profile). The handlers pass the typed refusal through
+// verbatim, so these tests render the expected message from the golden instead
+// of repeating a literal that could drift from it.
+
+type p108ToolRefusals struct {
+	Refusals []struct {
+		Name      string `json:"name"`
+		Disclosed string `json:"disclosed"`
+	} `json:"refusals"`
+}
+
+// p108DisclosedToolRefusal renders one disclosed golden refusal for
+// github:create_issue under the profile label `"Work Read-only" (work-readonly)`.
+func p108DisclosedToolRefusal(t testing.TB, name string) string {
+	t.Helper()
+	var g p108ToolRefusals
+	p108ReadJSON(t, "internal/profile/testdata/contract/tool_refusals.json", &g)
+	for _, r := range g.Refusals {
+		if r.Name == name {
+			return strings.NewReplacer(
+				"<server>", "github", "<tool>", "create_issue", "<tier>", "write", "<cap>", "read",
+				"<label>", `"Work Read-only" (work-readonly)`,
+			).Replace(r.Disclosed)
+		}
+	}
+	require.Failf(t, "missing golden", "no tool refusal named %q", name)
+	return ""
+}
+
+// p108ErrorText returns the `error` field of a {"success":false,"error":...}
+// body, JSON-decoded (the quotes around a profile title are escaped on the
+// wire), or the raw body when it is not that envelope.
+func p108ErrorText(body string) string {
+	var env struct {
+		Error string `json:"error"`
+	}
+	if err := json.Unmarshal([]byte(body), &env); err == nil && env.Error != "" {
+		return env.Error
+	}
+	return body
+}
diff --git a/internal/profile/testdata/contract/labels.json b/internal/profile/testdata/contract/labels.json
index eb81a2045..16ddb6ecf 100644
--- a/internal/profile/testdata/contract/labels.json
+++ b/internal/profile/testdata/contract/labels.json
@@ -41,6 +41,14 @@
     "expired": "Expired",
     "unknown": "Unknown"
   },
+  "credential_cta": {
+    "client": "",
+    "admin_key": "Upgrade to client credential",
+    "none": "Connect",
+    "revoked": "Reconnect",
+    "expired": "Reconnect",
+    "unknown": "Connect"
+  },
   "binding_mode": {
     "locked": "Locked",
     "switchable": "Switchable"
diff --git a/internal/profile/testdata/contract/tool_refusals.json b/internal/profile/testdata/contract/tool_refusals.json
new file mode 100644
index 000000000..32656234c
--- /dev/null
+++ b/internal/profile/testdata/contract/tool_refusals.json
@@ -0,0 +1,27 @@
+{
+  "_comment": "Spec 108 D39 (T148): the agent-facing TOOL refusals of a profile's tool policy, byte-for-byte after substituting <server>, <tool>, <tier> (the tool's tier), <cap> (\"read\" or \"read and write\") and <label>. `disclosed` is what a caller whose effective profile is its OWN gets (source pin, binding, url or session): it names the profile. `undisclosed` is what every other caller gets (source anonymous: naming the operator's anonymous_profile would hand it to any local process; a dangling or out-of-scope shape is non-disclosing and unchanged) and is byte-identical to the pre-D39 text. <label> is `\"<title>\" (<slug>)` with the title rendered by Go %q, or `\"<slug>\"` alone when the title is empty or equals the slug. Readers: TestProfileToolPolicyRefusal_MatchesToolRefusalsGolden and the MCP, REST and CLI tests in internal/server, internal/httpapi and cmd/mcpproxy. The four ADMIN refusals live in refusals.json and are untouched.",
+  "label": {
+    "with_title": "<%q title> (<slug>)",
+    "slug_only": "<%q slug>"
+  },
+  "refusals": [
+    {
+      "name": "tier",
+      "block_reason": "profile_tier",
+      "disclosed": "blocked by profile: <server>:<tool> is a <tier> tool; profile <label> allows <cap> tools only",
+      "undisclosed": "blocked by profile: <server>:<tool> is a <tier> tool; this profile allows <cap> tools only"
+    },
+    {
+      "name": "rule",
+      "block_reason": "profile_rule",
+      "disclosed": "blocked by profile: <server>:<tool> is denied by a rule in profile <label>",
+      "undisclosed": "blocked by profile: <server>:<tool> is denied by a profile rule"
+    },
+    {
+      "name": "unannotated",
+      "block_reason": "profile_unannotated",
+      "disclosed": "blocked by profile: <server>:<tool> has no tier annotation; an operator can classify it in profile <label> to allow it",
+      "undisclosed": "blocked by profile: <server>:<tool> has no tier annotation; an operator can classify it in the profile to allow it"
+    }
+  ]
+}
diff --git a/internal/registries/catalog.go b/internal/registries/catalog.go
index 82d6e7d27..343871b73 100644
--- a/internal/registries/catalog.go
+++ b/internal/registries/catalog.go
@@ -7,6 +7,7 @@ package registries
 
 import (
 	"context"
+	"errors"
 	"fmt"
 	"sort"
 	"strconv"
@@ -31,12 +32,19 @@ type Popularity struct {
 // GET /registries/{id}/servers and MCP search_servers keep serving its JSON
 // unchanged (contracts/rest-api.md#catalog).
 type CatalogHit struct {
-	Entry      ServerEntry
-	Source     string
-	Title      string
-	Publisher  string
-	Verified   bool
-	Official   bool
+	Entry     ServerEntry
+	Source    string
+	Title     string
+	Publisher string
+	Verified  bool
+	Official  bool
+	// Curated marks a hit from the built-in reference source (Spec 109 D35):
+	// the shipped, hand-picked basics. buildSections lists them first in the
+	// Official section. Pure data, set by BuildCatalogHit.
+	Curated bool
+	// FromCache marks a hit served from the per-source listing cache because
+	// the source's live fetch failed (Spec 109 D35); see listing_cache.go.
+	FromCache  bool
 	Popularity *Popularity
 }
 
@@ -80,6 +88,10 @@ type CatalogResult struct {
 	// This lets clients open a credential-bearing install without attempting to
 	// join against redacted GET /servers fields.
 	AddedServerName string `json:"added_server_name,omitempty"`
+	// FromCache is true when this hit came from the source's cached listing
+	// because its live search failed. The source is also in unavailable[] with
+	// fallback="cached_listing" (Spec 109 D35).
+	FromCache bool `json:"from_cache,omitempty"`
 }
 
 // CatalogSections groups the empty-query landing results (FR-060): the
@@ -97,6 +109,12 @@ type CatalogSections struct {
 type SourceError struct {
 	Source string `json:"source"`
 	Reason string `json:"reason"`
+	// Fallback is "cached_listing" when SearchAll answered for this source from
+	// its cached listing instead (the hits carry FromCache); CachedAt is when
+	// that listing was last refreshed. Both are empty when there was nothing to
+	// fall back on (Spec 109 D35).
+	Fallback string     `json:"fallback,omitempty"`
+	CachedAt *time.Time `json:"cached_at,omitempty"`
 }
 
 // SearchOptions configures a catalog search. SourceTimeout defaults to 5s;
@@ -190,9 +208,36 @@ func SearchAll(ctx context.Context, q, tag string, limit int, opts SearchOptions
 				if sctx.Err() != nil {
 					reason = fmt.Sprintf("timeout after %s", timeout)
 				}
-				outcomes[i] = sourceOutcome{unavailable: &SourceError{Source: reg.ID, Reason: reason}}
+				failure := &SourceError{Source: reg.ID, Reason: reason}
+				// Answer from the source's cached listing when the live fetch
+				// failed for any reason except a missing API key (that source
+				// never fetched, so nothing is cached for it). The source stays
+				// in unavailable[]; the hits are marked FromCache.
+				if !errors.Is(err, ErrRegistryKeyMissing) {
+					if cached, at, ok := cachedListing(&reg); ok {
+						matches := make([]CatalogHit, 0, len(cached))
+						for i := range cached {
+							if len(matches) >= fetchLimit {
+								break
+							}
+							if !matchCachedEntry(&cached[i], q) {
+								continue
+							}
+							cached[i].Registry = reg.Name
+							hit := BuildCatalogHit(&reg, cached[i])
+							hit.FromCache = true
+							matches = append(matches, hit)
+						}
+						failure.Fallback = FallbackCachedListing
+						failure.CachedAt = &at
+						outcomes[i] = sourceOutcome{hits: matches, unavailable: failure}
+						return
+					}
+				}
+				outcomes[i] = sourceOutcome{unavailable: failure}
 				return
 			}
+			cacheListing(&reg, entries)
 
 			hits := make([]CatalogHit, 0, len(entries))
 			for _, e := range entries {
@@ -215,7 +260,6 @@ func SearchAll(ctx context.Context, q, tag string, limit int, opts SearchOptions
 	for _, outcome := range outcomes {
 		if outcome.unavailable != nil {
 			unavailable = append(unavailable, *outcome.unavailable)
-			continue
 		}
 		for _, h := range outcome.hits {
 			key := h.Source + "\x00" + h.Entry.ID
@@ -344,6 +388,7 @@ func BuildCatalogHit(reg *RegistryEntry, entry ServerEntry) CatalogHit {
 		Publisher: derivePublisher(entry.ID, reg.Name),
 		Verified:  official,
 		Official:  official,
+		Curated:   reg.Protocol == protocolReference,
 	}
 	// FR-001/FR-002: copy the source-native signal (e.g. Docker pull_count)
 	// first, then layer in GitHub stars from the provider's cache only — no
@@ -520,12 +565,12 @@ func relevanceScore(h CatalogHit, q string) int {
 // (BEFORE limit truncation and BEFORE any Rank sort) into the empty-query
 // landing sections (Spec 110 FR-005, amending Spec 109 FR-060):
 //
-//   - Official: official-source hits in `pool`'s own MERGE (source-native)
-//     order — registry-list order, then each source's native order. Pool
-//     MUST NOT have been Rank-sorted yet: on an all-official default install
-//     every hit ties on Official/Verified, so Rank order IS popularity order,
-//     and building Official from a ranked pool silently reintroduces the bug
-//     this spec fixes. Capped at 12.
+//   - Official: the official-source hits of `pool`, curated first, never
+//     popularity-ordered (Spec 109 D35 amends Spec 110 FR-005; see
+//     officialBrowseOrder). Pool MUST NOT have been Rank-sorted yet: on an
+//     all-official default install every hit ties on Official/Verified, so Rank
+//     order IS popularity order, and building Official from a ranked pool
+//     silently reintroduces the bug Spec 110 fixed. Capped at 12.
 //   - Popular: hits with a known signal (stars>0 ∨ installs>0), sorted by
 //     popularity (FR-004) then Rank as a tiebreak, at most one per GitHub
 //     repo key (a monorepo's shared star count keeps only the first by Rank —
@@ -533,10 +578,9 @@ func relevanceScore(h CatalogHit, q string) int {
 func buildSections(pool []CatalogHit, q string) *CatalogSections {
 	sections := &CatalogSections{Official: []CatalogHit{}, Popular: []CatalogHit{}}
 
-	for _, h := range pool {
-		if h.Official && len(sections.Official) < catalogSectionCap {
-			sections.Official = append(sections.Official, h)
-		}
+	sections.Official = officialBrowseOrder(pool)
+	if len(sections.Official) > catalogSectionCap {
+		sections.Official = sections.Official[:catalogSectionCap]
 	}
 
 	candidates := make([]CatalogHit, 0, len(pool))
@@ -572,6 +616,46 @@ func buildSections(pool []CatalogHit, q string) *CatalogSections {
 	return sections
 }
 
+// officialBrowseOrder orders the official-source hits of the merged pool (in
+// MERGE order: registry-list order, then each source's native order) for the
+// empty-query Official section. The curated reference servers come first, in
+// curated order; the rest are interleaved round-robin across their sources in
+// registry-list order, each source keeping its native order. The official
+// source paginates alphabetically by reverse-DNS id, so taking its first twelve
+// would list obscure namespaces and hide the curated basics (Spec 109 D35, demo
+// finding #6). Popularity plays no part: Popular must still differ from Official.
+func officialBrowseOrder(pool []CatalogHit) []CatalogHit {
+	var out []CatalogHit
+	var sources []string
+	bySource := make(map[string][]CatalogHit)
+	for _, h := range pool {
+		if !h.Official {
+			continue
+		}
+		if h.Curated {
+			out = append(out, h)
+			continue
+		}
+		if _, ok := bySource[h.Source]; !ok {
+			sources = append(sources, h.Source)
+		}
+		bySource[h.Source] = append(bySource[h.Source], h)
+	}
+	for round := 0; ; round++ {
+		progressed := false
+		for _, src := range sources {
+			if round < len(bySource[src]) {
+				out = append(out, bySource[src][round])
+				progressed = true
+			}
+		}
+		if !progressed {
+			break
+		}
+	}
+	return out
+}
+
 // ToCatalogResult builds the REST DTO from an internal hit. added is computed
 // by the caller (httpapi layer, FR-007 scoped join) — SearchAll itself has no
 // notion of the calling caller's visibility.
@@ -601,6 +685,7 @@ func ToCatalogResult(h CatalogHit, added bool) CatalogResult {
 		RequiredInputs: inputs,
 		SourceCodeURL:  h.Entry.SourceCodeURL,
 		Added:          added,
+		FromCache:      h.FromCache,
 	}
 }
 
diff --git a/internal/registries/catalog_browse_order_test.go b/internal/registries/catalog_browse_order_test.go
new file mode 100644
index 000000000..32fcb77ff
--- /dev/null
+++ b/internal/registries/catalog_browse_order_test.go
@@ -0,0 +1,101 @@
+package registries
+
+import (
+	"fmt"
+	"reflect"
+	"testing"
+)
+
+// Spec 109 D35 (T164, demo finding #6): the empty-query Official section used
+// to be the merged pool's first twelve official hits. The official source
+// paginates alphabetically by reverse-DNS id, so it filled with obscure
+// "ac.inference.sh/..." entries and the curated reference servers (filesystem,
+// memory, fetch, ...) never appeared. Official is now curated-first, then the
+// remaining official hits round-robin across sources in registry-list order.
+// It is still never popularity-ordered (Spec 110: Popular must differ).
+
+func hitsOf(source string, curated bool, ids ...string) []CatalogHit {
+	out := make([]CatalogHit, 0, len(ids))
+	for _, id := range ids {
+		out = append(out, CatalogHit{
+			Entry:    ServerEntry{ID: id, Name: id},
+			Source:   source,
+			Title:    id,
+			Official: true,
+			Verified: true,
+			Curated:  curated,
+		})
+	}
+	return out
+}
+
+func TestBuildSections_OfficialCuratedFirstThenRoundRobin(t *testing.T) {
+	var official []string
+	for _, c := range "abcdefghijklmn" {
+		official = append(official, fmt.Sprintf("ac.%c", c))
+	}
+	// Merge order = registry-list order: official, reference, docker.
+	var pool []CatalogHit
+	pool = append(pool, hitsOf("official", false, official...)...)
+	pool = append(pool, hitsOf("reference", true, "ref-1", "ref-2", "ref-3", "ref-4", "ref-5", "ref-6", "ref-7")...)
+	pool = append(pool, hitsOf("docker", false, "dock-1", "dock-2", "dock-3")...)
+
+	sections := buildSections(pool, "")
+	got := idsOf(sections.Official)
+	want := []string{
+		"ref-1", "ref-2", "ref-3", "ref-4", "ref-5", "ref-6", "ref-7",
+		"ac.a", "dock-1", "ac.b", "dock-2", "ac.c",
+	}
+	if !reflect.DeepEqual(got, want) {
+		t.Fatalf("Official order\n got  %v\n want %v", got, want)
+	}
+}
+
+func TestBuildSections_OfficialRoundRobinDrainsShortSourcesAndHonoursCap(t *testing.T) {
+	var pool []CatalogHit
+	pool = append(pool, hitsOf("a", false, "a1", "a2")...)
+	pool = append(pool, hitsOf("b", false, "b1", "b2", "b3", "b4", "b5", "b6", "b7", "b8", "b9", "b10", "b11", "b12")...)
+	got := idsOf(buildSections(pool, "").Official)
+	want := []string{"a1", "b1", "a2", "b2", "b3", "b4", "b5", "b6", "b7", "b8", "b9", "b10"}
+	if !reflect.DeepEqual(got, want) {
+		t.Fatalf("got %v want %v", got, want)
+	}
+}
+
+func TestBuildSections_OfficialSkipsNonOfficialHits(t *testing.T) {
+	pool := hitsOf("official", false, "o1")
+	pool = append(pool, CatalogHit{Entry: ServerEntry{ID: "community"}, Source: "community", Official: false})
+	got := idsOf(buildSections(pool, "").Official)
+	if !reflect.DeepEqual(got, []string{"o1"}) {
+		t.Fatalf("got %v", got)
+	}
+}
+
+// Popular must stay different from Official even though Official is reordered:
+// Official ignores popularity entirely.
+func TestBuildSections_OfficialNeverPopularityOrdered(t *testing.T) {
+	stars := func(n int) *Popularity { return &Popularity{Stars: &n} }
+	pool := hitsOf("official", false, "low", "mid", "high")
+	pool[0].Popularity = stars(1)
+	pool[1].Popularity = stars(50)
+	pool[2].Popularity = stars(9000)
+
+	sections := buildSections(pool, "")
+	if got := idsOf(sections.Official); !reflect.DeepEqual(got, []string{"low", "mid", "high"}) {
+		t.Fatalf("Official must keep the source's native order, got %v", got)
+	}
+	if got := idsOf(sections.Popular); !reflect.DeepEqual(got, []string{"high", "mid", "low"}) {
+		t.Fatalf("Popular must be popularity-ordered, got %v", got)
+	}
+}
+
+func TestBuildCatalogHit_MarksTheCuratedReferenceSource(t *testing.T) {
+	ref := &RegistryEntry{ID: "reference", Protocol: protocolReference, Provenance: "official"}
+	other := &RegistryEntry{ID: "official", Provenance: "official"}
+	if h := BuildCatalogHit(ref, ServerEntry{ID: "reference/filesystem"}); !h.Curated {
+		t.Fatal("a hit from the built-in reference source must be Curated")
+	}
+	if h := BuildCatalogHit(other, ServerEntry{ID: "x"}); h.Curated {
+		t.Fatal("a hit from any other source must not be Curated")
+	}
+}
diff --git a/internal/registries/catalog_listing_cache_test.go b/internal/registries/catalog_listing_cache_test.go
new file mode 100644
index 000000000..65bfbdd35
--- /dev/null
+++ b/internal/registries/catalog_listing_cache_test.go
@@ -0,0 +1,365 @@
+package registries
+
+import (
+	"context"
+	"fmt"
+	"net/http"
+	"net/http/httptest"
+	"strings"
+	"sync"
+	"sync/atomic"
+	"testing"
+	"time"
+)
+
+// Spec 109 D35 (T160, demo finding #1): a catalog source that times out (the
+// official registry's server-side ?search= took 17s in the live demo) used to
+// contribute nothing. SearchAll now remembers the listing each source returned
+// and, when a live fetch fails, answers from that cache. The source stays in
+// unavailable[] (honestly) with fallback="cached_listing" and cached_at, and
+// the hits carry FromCache.
+
+// flakySource is a registry endpoint that serves entries, and can be told to
+// hang past the per-source timeout or to answer 500.
+type flakySource struct {
+	srv    *httptest.Server
+	slow   atomic.Bool
+	broken atomic.Bool
+	hits   atomic.Int32
+	body   atomic.Value // string
+}
+
+func newFlakySource(t *testing.T, entries ...string) *flakySource {
+	t.Helper()
+	f := &flakySource{}
+	f.body.Store("[" + strings.Join(entries, ",") + "]")
+	f.srv = httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		f.hits.Add(1)
+		if f.slow.Load() {
+			select {
+			case <-time.After(5 * time.Second):
+			case <-r.Context().Done():
+				return
+			}
+		}
+		if f.broken.Load() {
+			http.Error(w, "boom", http.StatusInternalServerError)
+			return
+		}
+		w.Header().Set("Content-Type", "application/json")
+		_, _ = w.Write([]byte(f.body.Load().(string)))
+	}))
+	t.Cleanup(f.srv.Close)
+	return f
+}
+
+func entryJSON(id, name, desc string) string {
+	return fmt.Sprintf(`{"id":%q,"name":%q,"description":%q}`, id, name, desc)
+}
+
+func useFlakyRegistry(t *testing.T, f *flakySource) {
+	t.Helper()
+	ResetListingCacheForTest()
+	t.Cleanup(ResetListingCacheForTest)
+	withTestRegistries(t, []RegistryEntry{
+		{ID: "slowreg", Name: "Slow", ServersURL: f.srv.URL, Provenance: "official"},
+	})
+}
+
+const fastTimeout = 100 * time.Millisecond
+
+func TestSearchAll_TimedOutSourceFallsBackToCachedListing(t *testing.T) {
+	f := newFlakySource(t,
+		entryJSON("slow/github-a", "github-a", "GitHub helper"),
+		entryJSON("slow/notes-x", "notes-x", "Notes"),
+	)
+	useFlakyRegistry(t, f)
+	opts := SearchOptions{SourceTimeout: fastTimeout, PopularityWait: -1}
+
+	// Browse primes the cache.
+	if _, _, unavailable := SearchAll(context.Background(), "", "", 10, opts); len(unavailable) != 0 {
+		t.Fatalf("priming browse: unexpected unavailable %+v", unavailable)
+	}
+
+	f.slow.Store(true)
+	hits, _, unavailable := SearchAll(context.Background(), "github", "", 10, opts)
+	if len(hits) != 1 || hits[0].Entry.ID != "slow/github-a" {
+		t.Fatalf("expected the cached github hit, got %v", idsOf(hits))
+	}
+	if !hits[0].FromCache {
+		t.Fatal("a cached hit must be marked FromCache")
+	}
+	if len(unavailable) != 1 {
+		t.Fatalf("the source must stay in unavailable[], got %+v", unavailable)
+	}
+	u := unavailable[0]
+	if u.Source != "slowreg" || u.Reason != "timeout after 100ms" {
+		t.Fatalf("the reason must stay honest, got %+v", u)
+	}
+	if u.Fallback != FallbackCachedListing {
+		t.Fatalf("Fallback = %q, want %q", u.Fallback, FallbackCachedListing)
+	}
+	if u.CachedAt == nil || time.Since(*u.CachedAt) > time.Minute {
+		t.Fatalf("CachedAt must be the cache's update time, got %v", u.CachedAt)
+	}
+	if got := ToCatalogResult(hits[0], false); !got.FromCache {
+		t.Fatal("the REST DTO must carry from_cache")
+	}
+}
+
+func TestSearchAll_ServerErrorFallsBackToCachedListingToo(t *testing.T) {
+	f := newFlakySource(t, entryJSON("slow/github-a", "github-a", "d"))
+	useFlakyRegistry(t, f)
+	opts := SearchOptions{SourceTimeout: 2 * time.Second, PopularityWait: -1}
+	SearchAll(context.Background(), "", "", 10, opts)
+
+	f.broken.Store(true)
+	hits, _, unavailable := SearchAll(context.Background(), "github", "", 10, opts)
+	if len(hits) != 1 || !hits[0].FromCache {
+		t.Fatalf("a 5xx must fall back like a timeout, got %v", idsOf(hits))
+	}
+	if len(unavailable) != 1 || unavailable[0].Fallback != FallbackCachedListing {
+		t.Fatalf("unavailable = %+v", unavailable)
+	}
+}
+
+func TestSearchAll_CachedFallbackMatchesNameDescriptionAndID(t *testing.T) {
+	f := newFlakySource(t,
+		entryJSON("io.github.acme/alpha", "alpha", "does things"),
+		entryJSON("zzz/beta", "beta", "Talks to GitHub"),
+		entryJSON("zzz/GitHub-gamma", "Gamma", "plain"),
+		entryJSON("zzz/delta", "delta", "unrelated"),
+	)
+	useFlakyRegistry(t, f)
+	opts := SearchOptions{SourceTimeout: fastTimeout, PopularityWait: -1}
+	SearchAll(context.Background(), "", "", 10, opts)
+
+	f.slow.Store(true)
+	hits, _, _ := SearchAll(context.Background(), "  GITHUB ", "", 10, opts)
+	got := map[string]bool{}
+	for _, h := range hits {
+		got[h.Entry.ID] = true
+	}
+	for _, want := range []string{"io.github.acme/alpha", "zzz/beta", "zzz/GitHub-gamma"} {
+		if !got[want] {
+			t.Errorf("expected %s (matched on id/description/id), got %v", want, idsOf(hits))
+		}
+	}
+	if got["zzz/delta"] {
+		t.Errorf("zzz/delta does not match and must not be returned")
+	}
+}
+
+func TestSearchAll_ColdCacheKeepsTodaysBehaviour(t *testing.T) {
+	f := newFlakySource(t, entryJSON("slow/github-a", "github-a", "d"))
+	useFlakyRegistry(t, f)
+	f.slow.Store(true)
+	hits, _, unavailable := SearchAll(context.Background(), "github", "", 10, SearchOptions{SourceTimeout: fastTimeout, PopularityWait: -1})
+	if len(hits) != 0 {
+		t.Fatalf("a cold cache contributes nothing, got %v", idsOf(hits))
+	}
+	if len(unavailable) != 1 || unavailable[0].Fallback != "" || unavailable[0].CachedAt != nil {
+		t.Fatalf("no fallback marker without a cached listing, got %+v", unavailable)
+	}
+}
+
+func TestSearchAll_StaleCacheOver24hIsNotUsed(t *testing.T) {
+	f := newFlakySource(t, entryJSON("slow/github-a", "github-a", "d"))
+	useFlakyRegistry(t, f)
+	opts := SearchOptions{SourceTimeout: fastTimeout, PopularityWait: -1}
+
+	base := time.Now()
+	prev := listingNow
+	t.Cleanup(func() { listingNow = prev })
+	listingNow = func() time.Time { return base }
+	SearchAll(context.Background(), "", "", 10, opts)
+
+	f.slow.Store(true)
+	listingNow = func() time.Time { return base.Add(24*time.Hour + time.Minute) }
+	hits, _, unavailable := SearchAll(context.Background(), "github", "", 10, opts)
+	if len(hits) != 0 || unavailable[0].Fallback != "" {
+		t.Fatalf("a listing older than 24h must not be served, got %v / %+v", idsOf(hits), unavailable)
+	}
+
+	// exactly at the limit is still served
+	listingNow = func() time.Time { return base.Add(24 * time.Hour) }
+	hits, _, _ = SearchAll(context.Background(), "github", "", 10, opts)
+	if len(hits) != 1 {
+		t.Fatalf("a listing exactly 24h old is still fresh, got %v", idsOf(hits))
+	}
+}
+
+func TestSearchAll_LiveHitsNeverMarkedCached(t *testing.T) {
+	f := newFlakySource(t, entryJSON("slow/github-a", "github-a", "d"))
+	useFlakyRegistry(t, f)
+	opts := SearchOptions{SourceTimeout: time.Second, PopularityWait: -1}
+	for i := 0; i < 2; i++ { // the second call has a warm cache but a healthy source
+		hits, _, unavailable := SearchAll(context.Background(), "github", "", 10, opts)
+		if len(hits) != 1 || hits[0].FromCache || len(unavailable) != 0 {
+			t.Fatalf("live hits must not be marked cached: %v / %+v", hits, unavailable)
+		}
+	}
+}
+
+func TestSearchAll_EmptyQueryBrowseFallsBackToCachedListing(t *testing.T) {
+	f := newFlakySource(t,
+		entryJSON("slow/a", "a", "d"),
+		entryJSON("slow/b", "b", "d"),
+	)
+	useFlakyRegistry(t, f)
+	opts := SearchOptions{SourceTimeout: fastTimeout, PopularityWait: -1}
+	SearchAll(context.Background(), "", "", 10, opts)
+
+	f.slow.Store(true)
+	hits, sections, unavailable := SearchAll(context.Background(), "", "", 10, opts)
+	if len(hits) != 2 || !hits[0].FromCache {
+		t.Fatalf("browse must be answered from the cached listing, got %v", idsOf(hits))
+	}
+	if sections == nil || len(sections.Official) != 2 {
+		t.Fatalf("the Official section must be built from the cached hits, got %+v", sections)
+	}
+	for _, h := range sections.Official {
+		if !h.FromCache {
+			t.Fatal("section hits must carry FromCache")
+		}
+	}
+	if len(unavailable) != 1 || unavailable[0].Fallback != FallbackCachedListing {
+		t.Fatalf("unavailable = %+v", unavailable)
+	}
+}
+
+func TestSearchAll_KeyMissingSourceNeverFallsBack(t *testing.T) {
+	ResetListingCacheForTest()
+	t.Cleanup(ResetListingCacheForTest)
+	reg := RegistryEntry{ID: "keyed", Name: "Keyed", ServersURL: "http://127.0.0.1:1/servers", RequiresKey: true, Provenance: "official"}
+	withTestRegistries(t, []RegistryEntry{reg})
+	cacheListing(&reg, []ServerEntry{{ID: "keyed/github", Name: "github"}})
+
+	hits, _, unavailable := SearchAll(context.Background(), "github", "", 10, SearchOptions{SourceTimeout: fastTimeout, PopularityWait: -1})
+	if len(hits) != 0 {
+		t.Fatalf("a key-missing source never fetched, so it must not serve a cache: %v", idsOf(hits))
+	}
+	if len(unavailable) != 1 || unavailable[0].Fallback != "" {
+		t.Fatalf("unavailable = %+v", unavailable)
+	}
+}
+
+func TestListingCache_MergeByIDCapAndPrune(t *testing.T) {
+	ResetListingCacheForTest()
+	t.Cleanup(ResetListingCacheForTest)
+	reg := RegistryEntry{ID: "r", ServersURL: "http://one"}
+
+	cacheListing(&reg, []ServerEntry{{ID: "a", Name: "old-a"}, {ID: "b", Name: "b"}})
+	cacheListing(&reg, []ServerEntry{{ID: "a", Name: "new-a"}, {ID: "c", Name: "c"}})
+	got, at, ok := cachedListing(&reg)
+	if !ok || at.IsZero() {
+		t.Fatal("expected a fresh cached listing")
+	}
+	// latest fetch first (latest wins), then the older entries not in it
+	if ids := idsOf(hitsFromEntries(got)); strings.Join(ids, ",") != "a,c,b" || got[0].Name != "new-a" {
+		t.Fatalf("merge order = %v (%s)", ids, got[0].Name)
+	}
+
+	// cap: 2,000 per source, keeping the newest
+	var many []ServerEntry
+	for i := 0; i < 2500; i++ {
+		many = append(many, ServerEntry{ID: fmt.Sprintf("e%04d", i)})
+	}
+	cacheListing(&reg, many)
+	got, _, _ = cachedListing(&reg)
+	if len(got) != listingCacheMaxEntries || got[0].ID != "e0000" {
+		t.Fatalf("expected %d entries led by the latest fetch, got %d (first %s)", listingCacheMaxEntries, len(got), got[0].ID)
+	}
+
+	// an empty result never wipes a listing
+	cacheListing(&reg, nil)
+	if got, _, _ = cachedListing(&reg); len(got) != listingCacheMaxEntries {
+		t.Fatal("caching an empty result must be a no-op")
+	}
+
+	// editing the source URL never serves the old listing
+	edited := RegistryEntry{ID: "r", ServersURL: "http://two"}
+	if _, _, ok := cachedListing(&edited); ok {
+		t.Fatal("a different servers_url is a different cache key")
+	}
+
+	// pruning drops keys that are no longer configured
+	other := RegistryEntry{ID: "keep", ServersURL: "http://keep"}
+	cacheListing(&other, []ServerEntry{{ID: "k"}})
+	pruneListingCache([]RegistryEntry{other, edited})
+	if _, _, ok := cachedListing(&reg); ok {
+		t.Fatal("the pruned (id, url) must be gone")
+	}
+	if _, _, ok := cachedListing(&other); !ok {
+		t.Fatal("a still-configured listing must survive pruning")
+	}
+}
+
+func hitsFromEntries(entries []ServerEntry) []CatalogHit {
+	out := make([]CatalogHit, len(entries))
+	for i, e := range entries {
+		out[i] = CatalogHit{Entry: e}
+	}
+	return out
+}
+
+func TestListingCache_ReturnsACopy(t *testing.T) {
+	ResetListingCacheForTest()
+	t.Cleanup(ResetListingCacheForTest)
+	reg := RegistryEntry{ID: "r", ServersURL: "http://one"}
+	cacheListing(&reg, []ServerEntry{{ID: "a", Name: "a"}})
+	got, _, _ := cachedListing(&reg)
+	got[0].Name = "mutated"
+	again, _, _ := cachedListing(&reg)
+	if again[0].Name != "a" {
+		t.Fatal("callers must not be able to mutate the cache")
+	}
+}
+
+func TestListingCache_ConcurrentSearchAllRace(t *testing.T) {
+	f := newFlakySource(t,
+		entryJSON("slow/github-a", "github-a", "d"),
+		entryJSON("slow/notes-x", "notes-x", "d"),
+	)
+	useFlakyRegistry(t, f)
+	opts := SearchOptions{SourceTimeout: 200 * time.Millisecond, PopularityWait: -1}
+
+	var wg sync.WaitGroup
+	for g := 0; g < 8; g++ {
+		wg.Add(1)
+		go func(g int) {
+			defer wg.Done()
+			for i := 0; i < 5; i++ {
+				if g%2 == 0 && i == 2 {
+					f.slow.Store(true)
+				}
+				q := ""
+				if i%2 == 1 {
+					q = "github"
+				}
+				SearchAll(context.Background(), q, "", 10, opts)
+				if g == 7 && i == 4 {
+					f.slow.Store(false)
+				}
+			}
+		}(g)
+	}
+	wg.Wait()
+}
+
+func TestSearchAll_FallbackWithinSC011Budget(t *testing.T) {
+	f := newFlakySource(t, entryJSON("slow/github-a", "github-a", "d"))
+	useFlakyRegistry(t, f)
+	opts := SearchOptions{SourceTimeout: fastTimeout, PopularityWait: -1}
+	SearchAll(context.Background(), "", "", 10, opts)
+
+	f.slow.Store(true)
+	start := time.Now()
+	hits, _, _ := SearchAll(context.Background(), "github", "", 10, opts)
+	if elapsed := time.Since(start); elapsed > fastTimeout+200*time.Millisecond {
+		t.Fatalf("the fallback must not extend the budget: took %s", elapsed)
+	}
+	if len(hits) != 1 {
+		t.Fatalf("expected the cached hit, got %v", idsOf(hits))
+	}
+}
diff --git a/internal/registries/listing_cache.go b/internal/registries/listing_cache.go
new file mode 100644
index 000000000..c845ccf63
--- /dev/null
+++ b/internal/registries/listing_cache.go
@@ -0,0 +1,149 @@
+package registries
+
+import (
+	"strings"
+	"sync"
+	"time"
+)
+
+// listing_cache.go: the per-source listing cache behind the catalog's
+// "answer from what we last saw" fallback (Spec 109 D35, FR-060).
+//
+// A registry's server-side search can be far slower than its plain listing
+// (the official registry's ?search= took 17s while page 1 of the listing came
+// back at once), so a search that times out used to contribute nothing.
+// SearchAll remembers every listing a source returned and, when a later live
+// fetch fails, filters that memory instead. The source still appears in
+// unavailable[] (with fallback and cached_at), so the surfaces stay honest.
+//
+// The cache is in memory and process-wide. It is not persisted: the storage
+// layer is deliberately not involved, and a daemon-lifetime cache is enough.
+// The CLI's in-process path (no daemon) therefore starts cold.
+
+const (
+	// FallbackCachedListing is the SourceError.Fallback value, and the
+	// `fallback` field of GET /catalog/search's unavailable[] on every surface.
+	FallbackCachedListing = "cached_listing"
+
+	// listingCacheMaxEntries caps one source's cached listing.
+	listingCacheMaxEntries = 2000
+
+	// listingCacheMaxAge is how old a listing may be and still be served. It is
+	// the age of the LAST successful fetch from that source.
+	listingCacheMaxAge = 24 * time.Hour
+)
+
+// listingNow is the cache's clock; tests move it.
+var listingNow = time.Now
+
+type listingCacheEntry struct {
+	entries   []ServerEntry
+	updatedAt time.Time
+}
+
+var listingCache = struct {
+	mu sync.RWMutex
+	m  map[string]listingCacheEntry
+}{m: make(map[string]listingCacheEntry)}
+
+// listingKey identifies a source's listing by id AND servers URL, so editing a
+// source's URL never serves the listing of the old endpoint.
+func listingKey(reg *RegistryEntry) string {
+	return reg.ID + "\x00" + reg.ServersURL
+}
+
+func listingEntryKey(e *ServerEntry) string {
+	if e.ID != "" {
+		return e.ID
+	}
+	return "name:" + e.Name
+}
+
+// cacheListing merges the entries a successful fetch returned into the
+// source's cached listing. The newest fetch goes first (latest wins on an id
+// collision), then the older entries it did not repeat, capped at
+// listingCacheMaxEntries. An empty result is a no-op: a query that matched
+// nothing must not wipe what the source returned before.
+func cacheListing(reg *RegistryEntry, entries []ServerEntry) {
+	if reg == nil || len(entries) == 0 {
+		return
+	}
+	key := listingKey(reg)
+
+	listingCache.mu.Lock()
+	defer listingCache.mu.Unlock()
+
+	merged := make([]ServerEntry, 0, len(entries))
+	seen := make(map[string]struct{}, len(entries))
+	for i := range entries {
+		k := listingEntryKey(&entries[i])
+		if _, dup := seen[k]; dup {
+			continue
+		}
+		seen[k] = struct{}{}
+		merged = append(merged, entries[i])
+	}
+	for i := range listingCache.m[key].entries {
+		if len(merged) >= listingCacheMaxEntries {
+			break
+		}
+		old := &listingCache.m[key].entries[i]
+		if _, dup := seen[listingEntryKey(old)]; dup {
+			continue
+		}
+		merged = append(merged, *old)
+	}
+	if len(merged) > listingCacheMaxEntries {
+		merged = merged[:listingCacheMaxEntries]
+	}
+	listingCache.m[key] = listingCacheEntry{entries: merged, updatedAt: listingNow()}
+}
+
+// cachedListing returns a copy of the source's cached listing and when it was
+// last updated, if one exists and is at most listingCacheMaxAge old.
+func cachedListing(reg *RegistryEntry) ([]ServerEntry, time.Time, bool) {
+	if reg == nil {
+		return nil, time.Time{}, false
+	}
+	listingCache.mu.RLock()
+	cached, ok := listingCache.m[listingKey(reg)]
+	listingCache.mu.RUnlock()
+	if !ok || len(cached.entries) == 0 || listingNow().Sub(cached.updatedAt) > listingCacheMaxAge {
+		return nil, time.Time{}, false
+	}
+	out := make([]ServerEntry, len(cached.entries))
+	copy(out, cached.entries)
+	return out, cached.updatedAt, true
+}
+
+// pruneListingCache drops every cached listing whose (id, servers URL) is not
+// in regs. SetRegistriesFromConfig calls it after each config load, so a
+// removed or re-pointed source does not keep its listing alive.
+func pruneListingCache(regs []RegistryEntry) {
+	keep := make(map[string]struct{}, len(regs))
+	for i := range regs {
+		keep[listingKey(&regs[i])] = struct{}{}
+	}
+	listingCache.mu.Lock()
+	defer listingCache.mu.Unlock()
+	for key := range listingCache.m {
+		if _, ok := keep[key]; !ok {
+			delete(listingCache.m, key)
+		}
+	}
+}
+
+// matchCachedEntry is the fallback filter: a case-insensitive substring of the
+// trimmed query in the entry's name, description OR id. The live path's
+// filterServers skips the id, but the official registry's own search matches
+// names, so including the id is what lets "github" find "io.github.*". An empty
+// query matches everything (browse).
+func matchCachedEntry(e *ServerEntry, q string) bool {
+	q = strings.ToLower(strings.TrimSpace(q))
+	if q == "" {
+		return true
+	}
+	return strings.Contains(strings.ToLower(e.Name), q) ||
+		strings.Contains(strings.ToLower(e.Description), q) ||
+		strings.Contains(strings.ToLower(e.ID), q)
+}
diff --git a/internal/registries/registry_data.go b/internal/registries/registry_data.go
index 2c64aa615..d5784fdcd 100644
--- a/internal/registries/registry_data.go
+++ b/internal/registries/registry_data.go
@@ -59,6 +59,8 @@ func SetRegistriesFromConfig(cfg *config.Config) {
 	}
 
 	registryList = merged
+	// A removed or re-pointed source must not keep its cached listing alive.
+	pruneListingCache(merged)
 
 	// Propagate the SSRF allow-policy (MCP-1076): off by default, opt-in via the
 	// user's allow_private_registry_fetch flag. Done here so every config load /
diff --git a/internal/registries/testdata/catalog_cached_fallback_order.json b/internal/registries/testdata/catalog_cached_fallback_order.json
new file mode 100644
index 000000000..3f0c49953
--- /dev/null
+++ b/internal/registries/testdata/catalog_cached_fallback_order.json
@@ -0,0 +1,108 @@
+{
+  "_comment": "Spec 109 D35 (T160): catalog search \"github\" while one source is down. sources + query are the INPUT: every source is served by an httptest registry; a source with flaky:true is browsed once first (priming the per-source listing cache) and then answers 500. ids + results + unavailable are the golden OUTPUT written by internal/httpapi/spec109_catalog_order_test.go with UPDATE_GOLDEN=1 (REST GET /catalog/search). unavailable keeps only source and fallback (the reason and cached_at vary per run). The MCP search_servers, CLI catalog search, vitest and XCTest legs read the same file. ids are \"<source>:<entry id>\".",
+  "query": "github",
+  "sources": [
+    {
+      "id": "official",
+      "name": "Official",
+      "provenance": "official",
+      "servers": [
+        {
+          "id": "io.github.github/github-mcp-server",
+          "name": "GitHub",
+          "description": "GitHub's official MCP server",
+          "url": "https://api.githubcopilot.com/mcp/"
+        }
+      ]
+    },
+    {
+      "id": "slowreg",
+      "name": "Slow",
+      "provenance": "custom",
+      "flaky": true,
+      "servers": [
+        {
+          "id": "slow/github-a",
+          "name": "github-a",
+          "description": "A GitHub helper",
+          "installCmd": "npx github-a-mcp"
+        },
+        {
+          "id": "slow/notes-x",
+          "name": "notes-x",
+          "description": "Notes",
+          "installCmd": "npx notes-x-mcp"
+        },
+        {
+          "id": "slow/issues",
+          "name": "Issue sync",
+          "description": "Syncs github issues",
+          "installCmd": "npx issue-sync-mcp"
+        }
+      ]
+    }
+  ],
+  "ids": [
+    "official:io.github.github/github-mcp-server",
+    "slowreg:slow/github-a",
+    "slowreg:slow/issues"
+  ],
+  "results": [
+    {
+      "source": "official",
+      "id": "io.github.github/github-mcp-server",
+      "title": "GitHub",
+      "publisher": "github",
+      "verified": true,
+      "official": true,
+      "description": "GitHub's official MCP server",
+      "transport": "http",
+      "install": {
+        "url": "https://api.githubcopilot.com/mcp/"
+      },
+      "added": false
+    },
+    {
+      "source": "slowreg",
+      "id": "slow/github-a",
+      "title": "github-a",
+      "publisher": "Slow",
+      "verified": false,
+      "official": false,
+      "description": "A GitHub helper",
+      "transport": "stdio",
+      "install": {
+        "command": "npx",
+        "args": [
+          "github-a-mcp"
+        ]
+      },
+      "added": false,
+      "from_cache": true
+    },
+    {
+      "source": "slowreg",
+      "id": "slow/issues",
+      "title": "Issue sync",
+      "publisher": "Slow",
+      "verified": false,
+      "official": false,
+      "description": "Syncs github issues",
+      "transport": "stdio",
+      "install": {
+        "command": "npx",
+        "args": [
+          "issue-sync-mcp"
+        ]
+      },
+      "added": false,
+      "from_cache": true
+    }
+  ],
+  "unavailable": [
+    {
+      "source": "slowreg",
+      "fallback": "cached_listing"
+    }
+  ]
+}
diff --git a/internal/registries/testhooks.go b/internal/registries/testhooks.go
index cc6f35916..a20d9ca08 100644
--- a/internal/registries/testhooks.go
+++ b/internal/registries/testhooks.go
@@ -56,3 +56,11 @@ func SetGitHubAPIBaseForTest(base string) (restore func()) {
 		githubAPIBaseOverride.Store(&p)
 	}
 }
+
+// ResetListingCacheForTest empties the per-source listing cache (Spec 109 D35)
+// so a test neither inherits nor leaks cached listings.
+func ResetListingCacheForTest() {
+	listingCache.mu.Lock()
+	defer listingCache.mu.Unlock()
+	listingCache.m = make(map[string]listingCacheEntry)
+}
diff --git a/internal/server/call_tool_profile_v3_test.go b/internal/server/call_tool_profile_v3_test.go
index 7b333d9b9..6087afdbc 100644
--- a/internal/server/call_tool_profile_v3_test.go
+++ b/internal/server/call_tool_profile_v3_test.go
@@ -2,6 +2,7 @@ package server
 
 import (
 	"context"
+	"strings"
 	"testing"
 	"time"
 
@@ -33,27 +34,22 @@ func TestCallTool_ProfileV3_RefusalsAreStableAcrossResolutionSources(t *testing.
 		"anonymous": anonCtx,
 	}
 	cases := []struct {
-		name, tool, refusal string
+		name, tool, golden string
+		tier               profile.Tier
+		capText            string
 	}{
-		{
-			name: "tier cap", tool: "github:create_issue",
-			refusal: "blocked by profile: github:create_issue is a write tool; this profile allows read tools only",
-		},
-		{
-			name: "deny rule", tool: "github:get_secret_scanning_alert",
-			refusal: "blocked by profile: github:get_secret_scanning_alert is denied by a profile rule",
-		},
-		{
-			name: "unannotated deny", tool: "github:search_code",
-			refusal: "blocked by profile: github:search_code has no tier annotation; an operator can classify it in the profile to allow it",
-		},
+		{name: "tier cap", tool: "github:create_issue", golden: "tier", tier: profile.TierWrite, capText: "read"},
+		{name: "deny rule", tool: "github:get_secret_scanning_alert", golden: "rule", tier: profile.TierRead, capText: "read"},
+		{name: "unannotated deny", tool: "github:search_code", golden: "unannotated", tier: profile.TierUnannotated, capText: "read"},
 	}
 	variants := []string{contracts.ToolVariantRead, contracts.ToolVariantWrite, contracts.ToolVariantDestructive}
 	for _, tc := range cases {
 		t.Run(tc.name, func(t *testing.T) {
+			server, tool, _ := strings.Cut(tc.tool, ":")
+			disclosed := v3Disclosed(t, tc.golden, server, tool, tc.tier, tc.capText, "work-readonly")
+			undisclosed := undisclosedToolRefusal(t, tc.golden, server, tool, tc.tier, tc.capText)
 			for _, variant := range variants {
 				t.Run(variant, func(t *testing.T) {
-					var first string
 					for source, contextFor := range sources {
 						t.Run(source, func(t *testing.T) {
 							result, err := proxy.handleCallToolVariant(contextFor(), auditCallToolRequest(tc.tool, nil), variant)
@@ -61,14 +57,17 @@ func TestCallTool_ProfileV3_RefusalsAreStableAcrossResolutionSources(t *testing.
 							require.NotNil(t, result)
 							require.True(t, result.IsError)
 							text := resultText(t, result)
-							require.Equal(t, tc.refusal, text)
-							require.NotContains(t, text, "work-readonly")
-							require.NotContains(t, text, "Work · Read-only")
-							if first == "" {
-								first = text
-							} else {
-								require.Equal(t, first, text, "refusal bytes must not reveal the resolution source")
+							if source == "anonymous" {
+								// Spec 108 D39: the operator's anonymous_profile is never
+								// handed to an unauthenticated caller.
+								require.Equal(t, undisclosed, text)
+								require.NotContains(t, text, "work-readonly")
+								require.NotContains(t, text, "Work · Read-only")
+								return
 							}
+							// pin, binding, url, session: the caller's own profile is named.
+							require.Equal(t, disclosed, text)
+							require.Contains(t, text, `"Work · Read-only" (work-readonly)`)
 						})
 					}
 				})
@@ -78,6 +77,32 @@ func TestCallTool_ProfileV3_RefusalsAreStableAcrossResolutionSources(t *testing.
 	require.Empty(t, up.dispatched(), "profile denials must happen before upstream I/O")
 }
 
+// Spec 108 D39: an anonymous caller keeps the non-disclosing text.
+func TestCallTool_AnonymousProfileRefusalStaysUndisclosed(t *testing.T) {
+	proxy, rt := newProfilesV3Fixture(t)
+	startCountingUpstream(t, proxy, rt, "github", writeSpec("create_issue"))
+	proxy.currentConfig().AnonymousProfile = "work-readonly"
+
+	result, err := proxy.handleCallToolVariant(anonCtx(), auditCallToolRequest("github:create_issue", nil), contracts.ToolVariantWrite)
+	require.NoError(t, err)
+	require.True(t, result.IsError)
+	require.Equal(t, "blocked by profile: github:create_issue is a write tool; this profile allows read tools only", resultText(t, result))
+}
+
+// Spec 108 D39: a dangling pin has no policy and answers like an out-of-scope
+// token (the Spec 105 non-disclosing shape), never naming a profile.
+func TestCallTool_DanglingPinStaysNonDisclosing(t *testing.T) {
+	proxy, rt := newProfilesV3Fixture(t)
+	startCountingUpstream(t, proxy, rt, "github", writeSpec("create_issue"))
+
+	result, err := proxy.handleCallToolVariant(pinnedProfileCtx("gone"), auditCallToolRequest("github:create_issue", nil), contracts.ToolVariantWrite)
+	require.NoError(t, err)
+	require.True(t, result.IsError)
+	text := resultText(t, result)
+	require.NotContains(t, text, "gone")
+	require.NotContains(t, text, "blocked by profile")
+}
+
 func TestCallTool_ProfileV3_RestDispatchPreservesTypedRefusal(t *testing.T) {
 	proxy, rt := newProfilesV3Fixture(t)
 	up := startCountingUpstream(t, proxy, rt, "github", writeSpec("create_issue"))
@@ -92,7 +117,7 @@ func TestCallTool_ProfileV3_RestDispatchPreservesTypedRefusal(t *testing.T) {
 	var refusal *profile.ToolBlockedError
 	require.ErrorAs(t, err, &refusal)
 	require.Equal(t, profile.BlockReasonTier, refusal.Reason)
-	require.Equal(t, "blocked by profile: github:create_issue is a write tool; this profile allows read tools only", refusal.Error())
+	require.Equal(t, v3TierRefusal(t), refusal.Error())
 	require.Empty(t, up.dispatched(), "REST dispatch must refuse before upstream I/O")
 }
 
@@ -106,7 +131,7 @@ func TestCallTool_ProfileRefusalPrecedesTokenPermissionRefusal(t *testing.T) {
 	result, err := proxy.handleCallToolVariant(ctx, auditCallToolRequest("github:create_issue", nil), contracts.ToolVariantWrite)
 	require.NoError(t, err)
 	require.True(t, result.IsError)
-	require.Equal(t, "blocked by profile: github:create_issue is a write tool; this profile allows read tools only", resultText(t, result))
+	require.Equal(t, v3TierRefusal(t), resultText(t, result))
 }
 
 func TestCallTool_ProfileDenialWritesBlockedActivityReason(t *testing.T) {
diff --git a/internal/server/code_execution_profile_v3_test.go b/internal/server/code_execution_profile_v3_test.go
index dbee5e1f8..3d821db69 100644
--- a/internal/server/code_execution_profile_v3_test.go
+++ b/internal/server/code_execution_profile_v3_test.go
@@ -192,7 +192,7 @@ func TestCallToolRoutingMode_ProfileV3FilterAndEnforcement(t *testing.T) {
 	require.NoError(t, json.Unmarshal(writePayload, &writeEnvelope), string(writePayload))
 	require.True(t, writeEnvelope.Result.IsError)
 	require.NotEmpty(t, writeEnvelope.Result.Content)
-	assert.Equal(t, "blocked by profile: github:create_issue is a write tool; this profile allows read tools only", writeEnvelope.Result.Content[0].Text)
+	assert.Equal(t, v3TierRefusal(t), writeEnvelope.Result.Content[0].Text)
 	assert.Empty(t, up.dispatched(), "the /mcp/call profile gate must refuse before upstream I/O")
 }
 
@@ -330,7 +330,8 @@ func TestCodeExecution_ProfileV3NestedCallBlockedBeforeUpstream(t *testing.T) {
 	require.NoError(t, err)
 	require.NotNil(t, result)
 	require.False(t, result.IsError, "a denied nested call is returned as an error envelope to the script; result=%s", resultText(t, result))
-	require.Contains(t, resultText(t, result), "blocked by profile: github:create_issue is a write tool; this profile allows read tools only")
+	// The script result is JSON, so the quotes around the title are escaped.
+	require.Contains(t, resultText(t, result), jsonEscapedText(t, v3TierRefusal(t)))
 	require.Empty(t, up.dispatched(), "nested profile denial must happen before upstream I/O")
 	calls, total, listErr := rt.GetToolCalls(50, 0, nil)
 	require.NoError(t, listErr)
diff --git a/internal/server/direct_profile_v3_test.go b/internal/server/direct_profile_v3_test.go
index 642e21999..2c6cd8ecb 100644
--- a/internal/server/direct_profile_v3_test.go
+++ b/internal/server/direct_profile_v3_test.go
@@ -8,6 +8,7 @@ import (
 	"github.com/mark3labs/mcp-go/mcp"
 	"github.com/smart-mcp-proxy/mcpproxy-go/internal/auth"
 	"github.com/smart-mcp-proxy/mcpproxy-go/internal/config"
+	"github.com/smart-mcp-proxy/mcpproxy-go/internal/profile"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 )
@@ -63,7 +64,7 @@ func TestDirectProtocol_ProfileV3CallRefusalOnWire(t *testing.T) {
 	require.NoError(t, json.Unmarshal(callPayload, &call), string(callPayload))
 	require.True(t, call.Result.IsError, string(callPayload))
 	require.NotEmpty(t, call.Result.Content)
-	assert.Equal(t, "blocked by profile: github:create_issue is a write tool; this profile allows read tools only", call.Result.Content[0].Text)
+	assert.Equal(t, v3TierRefusal(t), call.Result.Content[0].Text)
 	assert.Empty(t, up.dispatched(), "a direct-mode refusal must precede upstream I/O")
 }
 
@@ -85,7 +86,7 @@ func TestDirectCall_ProfileV3PolicyRefusesBeforeUpstream(t *testing.T) {
 	require.NoError(t, err)
 	require.NotNil(t, result)
 	require.True(t, result.IsError)
-	require.Equal(t, "blocked by profile: github:create_issue is a write tool; this profile allows read tools only", resultText(t, result))
+	require.Equal(t, v3TierRefusal(t), resultText(t, result))
 	require.Empty(t, up.dispatched(), "direct-mode profile denials must happen before upstream I/O")
 }
 
@@ -112,7 +113,7 @@ func TestDirectCall_ProfileV3DeniesUnannotatedTool(t *testing.T) {
 	require.NoError(t, err)
 	require.NotNil(t, result)
 	require.True(t, result.IsError)
-	require.Equal(t, "blocked by profile: github:search_code has no tier annotation; an operator can classify it in the profile to allow it", resultText(t, result))
+	require.Equal(t, v3Disclosed(t, "unannotated", "github", "search_code", profile.TierUnannotated, "read", "work-full"), resultText(t, result))
 	require.Empty(t, up.dispatched(), "an unannotated tool denied by profile policy must never reach the upstream")
 }
 
diff --git a/internal/server/mcp.go b/internal/server/mcp.go
index 82d618b84..6697efdfe 100644
--- a/internal/server/mcp.go
+++ b/internal/server/mcp.go
@@ -1746,6 +1746,10 @@ type mcpCatalogServerEntry struct {
 	Official   bool                   `json:"official"`
 	Popularity *registries.Popularity `json:"popularity,omitempty"`
 	Source     string                 `json:"source"`
+	// FromCache is true when this entry came from the source's cached listing
+	// because its live search failed (Spec 109 D35); the source is then also in
+	// the response's unavailable[] with fallback "cached_listing".
+	FromCache bool `json:"from_cache,omitempty"`
 }
 
 // catalogServerEntryWithSecretLike returns a copy of entry whose
@@ -1796,6 +1800,7 @@ func (p *MCPProxyServer) handleSearchServersAllSources(ctx context.Context, sess
 			Official:    h.Official,
 			Popularity:  h.Popularity,
 			Source:      h.Source,
+			FromCache:   h.FromCache,
 		})
 	}
 
@@ -2360,12 +2365,14 @@ func (p *MCPProxyServer) handleRetrieveToolsWithMode(ctx context.Context, reques
 	// the effective profile is non-legacy, and NEVER for no profile or a
 	// legacy one (SC-003 byte parity: a legacy profile, even one that sets
 	// only a display title, must not gain this field). profile names the
-	// slug only when the caller itself selected it (url/session) — never for
-	// a pin, so discovery can never confirm that a caller is pinned or to
-	// what (research D27).
+	// slug only to a caller whose effective profile is its own: pin, binding,
+	// url, session (Spec 108 D39 narrows research D27, which withheld it from a
+	// pin). Never for anonymous (the operator's anonymous_profile) or a dangling
+	// base. The same predicate decides the tool refusals' wording
+	// (profileDisclosedTo), so refusal and discovery cannot diverge.
 	if nonLegacyProfile {
 		response["hidden_by_profile"] = hiddenByPolicy
-		if profileSource == profile.SourceURL || profileSource == profile.SourceSession {
+		if profileDisclosedTo(profileSource) && policy != nil {
 			response["profile"] = profileName
 		}
 	}
@@ -2949,12 +2956,14 @@ func (p *MCPProxyServer) handleCallToolVariant(ctx context.Context, request mcp.
 	// and effective annotation identity. This gate follows server-scope and
 	// identity resolution, but precedes token permissions, global gates,
 	// server state, and tool approval. A profile denial therefore never
-	// reaches the upstream and cannot reveal a profile's name to the caller.
+	// reaches the upstream. It names the profile only to a caller whose
+	// effective profile is its own (pin, binding, url, session: Spec 108 D39);
+	// an anonymous caller keeps the non-disclosing text.
 	if policy := profileResolution.Policy; policy != nil {
 		intrinsic := profile.IntrinsicTier(annotations, annotationsFound)
 		admitted, reason, tier := policy.Decide(serverName, actualToolName, intrinsic)
 		if !admitted && reason != profile.ReasonServerNotInProfile {
-			errMsg, blockReason := profileToolPolicyRefusal(reason, tier, policy.Cap, serverName, actualToolName)
+			errMsg, blockReason := profileToolPolicyRefusal(reason, tier, policy.Cap, serverName, actualToolName, profileRefusalSubject(profileResolution, profileIdx))
 			recordProfileToolRefusal(ctx, &profile.ToolBlockedError{Reason: blockReason, Message: errMsg})
 			p.emitActivityPolicyDecisionWithBlockReason(ctx, serverName, actualToolName, getSessionID(), requestID, "blocked", errMsg, telemetry.BlockReasonOther, string(blockReason))
 			return mcp.NewToolResultError(errMsg), nil
diff --git a/internal/server/mcp_code_execution.go b/internal/server/mcp_code_execution.go
index f615db902..1ffc2be2f 100644
--- a/internal/server/mcp_code_execution.go
+++ b/internal/server/mcp_code_execution.go
@@ -297,7 +297,7 @@ func (p *MCPProxyServer) handleCodeExecution(ctx context.Context, request mcp.Ca
 			serverName, toolName, profile.IntrinsicTier(identity.Annotations, identity.Found),
 		)
 		if !admitted && reason != profile.ReasonServerNotInProfile {
-			sandbox.profileRefusal, _ = profileToolPolicyRefusal(reason, tier, profileResolution.Policy.Cap, serverName, toolName)
+			sandbox.profileRefusal, _ = profileToolPolicyRefusal(reason, tier, profileResolution.Policy.Cap, serverName, toolName, profileRefusalSubject(profileResolution, profileIdx))
 		}
 		return required, rawGate
 	}
diff --git a/internal/server/mcp_routing.go b/internal/server/mcp_routing.go
index 2440fe67a..ae9bf7032 100644
--- a/internal/server/mcp_routing.go
+++ b/internal/server/mcp_routing.go
@@ -536,7 +536,7 @@ func (p *MCPProxyServer) makeDirectModeHandler(entry *directCatalogEntry) mcpser
 			// must follow the profile's fail-closed unannotated policy.
 			intrinsic := profile.IntrinsicTier(annotations, true)
 			if admitted, reason, tier := policy.Decide(serverName, toolName, intrinsic); !admitted && reason != profile.ReasonServerNotInProfile {
-				errMsg, blockReason := profileToolPolicyRefusal(reason, tier, policy.Cap, serverName, toolName)
+				errMsg, blockReason := profileToolPolicyRefusal(reason, tier, policy.Cap, serverName, toolName, profileRefusalSubject(profileResolution, profileIndex))
 				p.emitActivityPolicyDecisionWithBlockReason(ctx, serverName, toolName, sessionID, requestID,
 					"blocked", errMsg, telemetry.BlockReasonOther, string(blockReason))
 				return mcp.NewToolResultError(errMsg), nil
diff --git a/internal/server/profile_refusals.go b/internal/server/profile_refusals.go
index 9ff83013d..d7b584cc7 100644
--- a/internal/server/profile_refusals.go
+++ b/internal/server/profile_refusals.go
@@ -6,19 +6,87 @@ import (
 	"github.com/smart-mcp-proxy/mcpproxy-go/internal/profile"
 )
 
-// profileToolPolicyRefusal renders the stable, non-disclosing refusal text
-// for a tool excluded by a compiled profile policy.
-func profileToolPolicyRefusal(reason profile.Reason, tier, cap profile.Tier, server, tool string) (string, profile.BlockReason) {
+// profileDisclosedTo reports whether a caller whose effective profile came
+// from source is told that profile's name (Spec 108 D39, narrowing D27).
+//
+// The caller's own credential (pin, binding) or its own choice (url, session)
+// decides its profile, so naming it reveals nothing the caller does not
+// already hold. The operator's anonymous_profile is different: naming it would
+// hand it to any local process that connects without a credential. "none" has
+// no profile to name.
+//
+// This is the ONE predicate. The tool refusals and retrieve_tools' `profile`
+// field both ask it, so refusal and discovery cannot diverge.
+func profileDisclosedTo(source profile.Source) bool {
+	switch source {
+	case profile.SourcePin, profile.SourceBinding, profile.SourceURL, profile.SourceSession:
+		return true
+	default:
+		return false
+	}
+}
+
+// refusalSubject is the profile a tool refusal may name. Disclose is false for
+// every caller that must not learn it; the refusal then keeps the original,
+// non-disclosing "this profile" wording.
+type refusalSubject struct {
+	Slug     string
+	Title    string
+	Disclose bool
+}
+
+// profileRefusalSubject decides what a refusal under res may name. A dangling
+// base has no compiled policy (and never reaches a tool refusal), and an empty
+// name is the "All servers" base: neither names anything.
+func profileRefusalSubject(res ProfileResolution, idx *profileIndex) refusalSubject {
+	if res.Policy == nil || res.Name == "" || !profileDisclosedTo(profile.Source(res.Source)) {
+		return refusalSubject{}
+	}
+	subj := refusalSubject{Slug: res.Name, Disclose: true}
+	if idx != nil {
+		if pc := idx.lookup(res.Name); pc != nil {
+			subj.Title = pc.Title
+		}
+	}
+	return subj
+}
+
+// label renders the profile as `"<title>" (<slug>)`, or `"<slug>"` alone when
+// there is no title or it equals the slug. Both the title and the slug go
+// through %q: a title is operator text that lands in an agent's context and in
+// activity logs, so it can neither break out of the sentence nor add a line.
+func (s refusalSubject) label() string {
+	if s.Title == "" || s.Title == s.Slug {
+		return fmt.Sprintf("%q", s.Slug)
+	}
+	return fmt.Sprintf("%q (%s)", s.Title, s.Slug)
+}
+
+// profileToolPolicyRefusal renders the refusal text for a tool excluded by a
+// compiled profile policy. A caller that may learn its own profile is told
+// which one it is (subj.Disclose); every other caller gets the stable,
+// non-disclosing text. The two shapes are pinned by
+// internal/profile/testdata/contract/tool_refusals.json.
+func profileToolPolicyRefusal(reason profile.Reason, tier, cap profile.Tier, server, tool string, subj refusalSubject) (string, profile.BlockReason) {
 	switch reason {
 	case profile.ReasonAboveTierCap:
 		capText := "read and write"
 		if cap == profile.TierRead {
 			capText = "read"
 		}
+		if subj.Disclose {
+			return fmt.Sprintf("blocked by profile: %s:%s is a %s tool; profile %s allows %s tools only", server, tool, tier, subj.label(), capText), profile.BlockReasonTier
+		}
 		return fmt.Sprintf("blocked by profile: %s:%s is a %s tool; this profile allows %s tools only", server, tool, tier, capText), profile.BlockReasonTier
 	case profile.ReasonDeniedByRule:
+		if subj.Disclose {
+			return fmt.Sprintf("blocked by profile: %s:%s is denied by a rule in profile %s", server, tool, subj.label()), profile.BlockReasonRule
+		}
 		return fmt.Sprintf("blocked by profile: %s:%s is denied by a profile rule", server, tool), profile.BlockReasonRule
 	case profile.ReasonUnannotatedHidden:
+		if subj.Disclose {
+			return fmt.Sprintf("blocked by profile: %s:%s has no tier annotation; an operator can classify it in profile %s to allow it", server, tool, subj.label()), profile.BlockReasonUnannotated
+		}
 		return fmt.Sprintf("blocked by profile: %s:%s has no tier annotation; an operator can classify it in the profile to allow it", server, tool), profile.BlockReasonUnannotated
 	default:
 		return "blocked by profile: tool is not allowed by the active profile", profile.BlockReasonRule
diff --git a/internal/server/profile_refusals_test.go b/internal/server/profile_refusals_test.go
new file mode 100644
index 000000000..23b61d911
--- /dev/null
+++ b/internal/server/profile_refusals_test.go
@@ -0,0 +1,202 @@
+package server
+
+import (
+	"encoding/json"
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	"github.com/smart-mcp-proxy/mcpproxy-go/internal/config"
+	"github.com/smart-mcp-proxy/mcpproxy-go/internal/profile"
+)
+
+// Spec 108 D39 (T148): the tool refusals name the caller's OWN profile.
+// internal/profile/testdata/contract/tool_refusals.json is the shared golden;
+// the other surfaces' tests render their expected text through the same helper
+// so a literal can never drift from it.
+
+type toolRefusalGolden struct {
+	Refusals []struct {
+		Name        string `json:"name"`
+		BlockReason string `json:"block_reason"`
+		Disclosed   string `json:"disclosed"`
+		Undisclosed string `json:"undisclosed"`
+	} `json:"refusals"`
+}
+
+func loadToolRefusalGolden(t testing.TB) toolRefusalGolden {
+	t.Helper()
+	raw, err := os.ReadFile(filepath.Join("..", "profile", "testdata", "contract", "tool_refusals.json"))
+	require.NoError(t, err)
+	var g toolRefusalGolden
+	require.NoError(t, json.Unmarshal(raw, &g))
+	require.Len(t, g.Refusals, 3)
+	return g
+}
+
+// goldenToolRefusal renders one golden refusal. label is "" for the
+// undisclosed text.
+func goldenToolRefusal(t testing.TB, name, server, tool string, tier profile.Tier, capText, label string) string {
+	t.Helper()
+	for _, r := range loadToolRefusalGolden(t).Refusals {
+		if r.Name != name {
+			continue
+		}
+		text := r.Undisclosed
+		if label != "" {
+			text = r.Disclosed
+		}
+		return strings.NewReplacer(
+			"<server>", server, "<tool>", tool, "<tier>", tier.String(), "<cap>", capText, "<label>", label,
+		).Replace(text)
+	}
+	t.Fatalf("no golden refusal named %q", name)
+	return ""
+}
+
+// disclosedToolRefusal is what a caller whose effective profile is its own
+// (pin, binding, url, session) is told; undisclosedToolRefusal is everyone
+// else's. The helpers are shared by every refusal test in this package.
+func disclosedToolRefusal(t testing.TB, name, server, tool string, tier profile.Tier, capText, slug, title string) string {
+	t.Helper()
+	return goldenToolRefusal(t, name, server, tool, tier, capText, refusalSubject{Slug: slug, Title: title, Disclose: true}.label())
+}
+
+func undisclosedToolRefusal(t testing.TB, name, server, tool string, tier profile.Tier, capText string) string {
+	t.Helper()
+	return goldenToolRefusal(t, name, server, tool, tier, capText, "")
+}
+
+// v3Disclosed renders the disclosed golden refusal for a fixture profile
+// (enforcementMatrixProfiles): work-readonly carries the title "Work · Read-only",
+// the others have none.
+func v3Disclosed(t testing.TB, name, server, tool string, tier profile.Tier, capText, slug string) string {
+	t.Helper()
+	title := ""
+	if slug == "work-readonly" || slug == "rule-and-cap" {
+		title = "Work · Read-only"
+	}
+	return disclosedToolRefusal(t, name, server, tool, tier, capText, slug, title)
+}
+
+// jsonEscapedText returns s as it appears inside a JSON string literal.
+func jsonEscapedText(t testing.TB, s string) string {
+	t.Helper()
+	b, err := json.Marshal(s)
+	require.NoError(t, err)
+	return string(b[1 : len(b)-1])
+}
+
+// v3TierRefusal is the text a caller on work-readonly gets for a write to
+// github:create_issue.
+func v3TierRefusal(t testing.TB) string {
+	t.Helper()
+	return v3Disclosed(t, "tier", "github", "create_issue", profile.TierWrite, "read", "work-readonly")
+}
+
+func TestProfileToolPolicyRefusal_MatchesToolRefusalsGolden(t *testing.T) {
+	cases := []struct {
+		name   string
+		reason profile.Reason
+		block  profile.BlockReason
+		tier   profile.Tier
+		cap    profile.Tier
+		capTxt string
+	}{
+		{"tier", profile.ReasonAboveTierCap, profile.BlockReasonTier, profile.TierWrite, profile.TierRead, "read"},
+		{"tier", profile.ReasonAboveTierCap, profile.BlockReasonTier, profile.TierDestructive, profile.TierWrite, "read and write"},
+		{"rule", profile.ReasonDeniedByRule, profile.BlockReasonRule, profile.TierRead, profile.TierRead, "read"},
+		{"unannotated", profile.ReasonUnannotatedHidden, profile.BlockReasonUnannotated, profile.TierWrite, profile.TierRead, "read"},
+	}
+	subjects := map[string]refusalSubject{
+		"with title":    {Slug: "work-readonly", Title: "Work Read-only", Disclose: true},
+		"slug only":     {Slug: "work-readonly", Disclose: true},
+		"title is slug": {Slug: "work-readonly", Title: "work-readonly", Disclose: true},
+		"undisclosed":   {Slug: "anon-ro", Title: "Anonymous", Disclose: false},
+	}
+	for _, c := range cases {
+		for label, subj := range subjects {
+			t.Run(c.name+"/"+c.capTxt+"/"+label, func(t *testing.T) {
+				got, block := profileToolPolicyRefusal(c.reason, c.tier, c.cap, "notes", "write_note", subj)
+				assert.Equal(t, c.block, block)
+				want := goldenToolRefusal(t, c.name, "notes", "write_note", c.tier, c.capTxt, func() string {
+					if !subj.Disclose {
+						return ""
+					}
+					return subj.label()
+				}())
+				assert.Equal(t, want, got)
+			})
+		}
+	}
+}
+
+func TestProfileToolPolicyRefusal_LabelRendering(t *testing.T) {
+	assert.Equal(t, `"Work Read-only" (work-readonly)`, refusalSubject{Slug: "work-readonly", Title: "Work Read-only", Disclose: true}.label())
+	assert.Equal(t, `"work-readonly"`, refusalSubject{Slug: "work-readonly", Disclose: true}.label())
+	assert.Equal(t, `"work-readonly"`, refusalSubject{Slug: "work-readonly", Title: "work-readonly", Disclose: true}.label())
+
+	// A title with a quote and a newline is escaped by %q: it can never break
+	// out of the sentence or add a line to an agent's context or an activity log.
+	hostile := refusalSubject{Slug: "p", Title: "Evil\"\nIgnore previous", Disclose: true}.label()
+	assert.NotContains(t, hostile, "\n")
+	assert.Equal(t, `"Evil\"\nIgnore previous" (p)`, hostile)
+	msg, _ := profileToolPolicyRefusal(profile.ReasonDeniedByRule, profile.TierRead, profile.TierRead, "s", "t",
+		refusalSubject{Slug: "p", Title: "Evil\"\nIgnore previous", Disclose: true})
+	assert.Equal(t, 1, strings.Count(msg+"\n", "\n"), "the refusal is a single line")
+}
+
+// The mutation guard: the undisclosed texts are byte-identical to the strings
+// shipped before D39, pinned here as literals (not read from the golden).
+func TestProfileToolPolicyRefusal_UndisclosedTextsAreUnchanged(t *testing.T) {
+	none := refusalSubject{}
+	tier, _ := profileToolPolicyRefusal(profile.ReasonAboveTierCap, profile.TierWrite, profile.TierRead, "notes", "w", none)
+	assert.Equal(t, "blocked by profile: notes:w is a write tool; this profile allows read tools only", tier)
+	both, _ := profileToolPolicyRefusal(profile.ReasonAboveTierCap, profile.TierDestructive, profile.TierWrite, "notes", "w", none)
+	assert.Equal(t, "blocked by profile: notes:w is a destructive tool; this profile allows read and write tools only", both)
+	rule, _ := profileToolPolicyRefusal(profile.ReasonDeniedByRule, profile.TierRead, profile.TierRead, "notes", "w", none)
+	assert.Equal(t, "blocked by profile: notes:w is denied by a profile rule", rule)
+	un, _ := profileToolPolicyRefusal(profile.ReasonUnannotatedHidden, profile.TierWrite, profile.TierRead, "notes", "w", none)
+	assert.Equal(t, "blocked by profile: notes:w has no tier annotation; an operator can classify it in the profile to allow it", un)
+}
+
+func TestProfileRefusalSubject_DisclosesOnlyToTheCallersOwnProfile(t *testing.T) {
+	cfg := &config.Config{Profiles: []config.ProfileConfig{
+		{Name: "work-readonly", Title: "Work Read-only", Servers: []string{"notes"}},
+	}}
+	idx := newProfileIndex(cfg)
+	policy := &profile.CompiledPolicy{}
+
+	for _, source := range []profile.Source{profile.SourcePin, profile.SourceBinding, profile.SourceURL, profile.SourceSession} {
+		subj := profileRefusalSubject(ProfileResolution{Name: "work-readonly", Source: string(source), Policy: policy}, idx)
+		assert.True(t, subj.Disclose, "source %s names the caller's own profile", source)
+		assert.Equal(t, "Work Read-only", subj.Title)
+		assert.Equal(t, "work-readonly", subj.Slug)
+	}
+
+	// anonymous: the operator's anonymous_profile is never handed to an
+	// unauthenticated caller; none: nothing to name.
+	for _, source := range []profile.Source{profile.SourceAnonymous, profile.SourceNone} {
+		subj := profileRefusalSubject(ProfileResolution{Name: "work-readonly", Source: string(source), Policy: policy}, idx)
+		assert.False(t, subj.Disclose, "source %s must not be named", source)
+	}
+
+	// a dangling base has no compiled policy: never disclosed.
+	assert.False(t, profileRefusalSubject(ProfileResolution{Name: "gone", Source: string(profile.SourcePin)}, idx).Disclose)
+	// an empty name (the "All servers" base) has no profile to name.
+	assert.False(t, profileRefusalSubject(ProfileResolution{Source: string(profile.SourceBinding), Policy: policy}, idx).Disclose)
+	// a missing index still discloses the slug, with no title.
+	subj := profileRefusalSubject(ProfileResolution{Name: "work-readonly", Source: string(profile.SourceURL), Policy: policy}, nil)
+	assert.True(t, subj.Disclose)
+	assert.Equal(t, "", subj.Title)
+
+	// The one predicate retrieve_tools shares.
+	assert.True(t, profileDisclosedTo(profile.SourcePin))
+	assert.True(t, profileDisclosedTo(profile.SourceSession))
+	assert.False(t, profileDisclosedTo(profile.SourceAnonymous))
+	assert.False(t, profileDisclosedTo(profile.SourceNone))
+}
diff --git a/internal/server/profiles_v3_acceptance_test.go b/internal/server/profiles_v3_acceptance_test.go
index d088b4b1a..e700e5b86 100644
--- a/internal/server/profiles_v3_acceptance_test.go
+++ b/internal/server/profiles_v3_acceptance_test.go
@@ -60,7 +60,8 @@ func TestProfilesV3Acceptance_Check1_DiscoveryHidesNonReadTools(t *testing.T) {
 		require.Empty(t, p108ToolNames(resp), "%s must not be discovered under work-readonly", hidden)
 		require.NotNil(t, resp.HiddenByProfile, "%s: hidden_by_profile is reported", hidden)
 		require.GreaterOrEqual(t, *resp.HiddenByProfile, 1, "%s: the count says something was hidden", hidden)
-		require.Nil(t, resp.Profile, "a locked credential (pin source) never learns the profile")
+		require.NotNil(t, resp.Profile, "a locked credential learns its OWN profile (Spec 108 D39)")
+		require.Equal(t, "work-readonly", *resp.Profile)
 	}
 	require.Empty(t, p108ToolNames(callRetrieveToolsV3(t, proxy, cursor, "read_text_file", 10)), "no filesystem tool is returned")
 	visible := callRetrieveToolsV3(t, proxy, cursor, "list_issues", 10)
@@ -104,8 +105,8 @@ func TestProfilesV3Acceptance_Check1_DiscoveryHidesNonReadTools(t *testing.T) {
 // TestProfilesV3Acceptance_Check2_CLIListsBlockedRecord (CLI),
 // activity-scope-params.spec.ts (Web) and ScopeFilterTests (macOS).
 func TestProfilesV3Acceptance_Check2_WriteRefusedAndRecorded(t *testing.T) {
-	const refusal = "blocked by profile: github:create_issue is a write tool; this profile allows read tools only"
 	proxy, rt := newProfilesV3Fixture(t)
+	refusal := v3TierRefusal(t)
 	up := startCountingUpstream(t, proxy, rt, "github", writeSpec("create_issue"))
 	go rt.ActivityService().Start(rt.AppContext(), rt)
 	require.Eventually(t, rt.ActivityService().Started, 5*time.Second, time.Millisecond,
@@ -183,7 +184,7 @@ func TestProfilesV3Acceptance_Check3_UnannotatedHiddenUntilClassified(t *testing
 	callBefore, err := f.proxy.handleCallToolVariant(cursor, auditCallToolRequest(tool, nil), "call_tool_read")
 	require.NoError(t, err)
 	require.True(t, callBefore.IsError)
-	require.Equal(t, "blocked by profile: github:search_code has no tier annotation; an operator can classify it in the profile to allow it", resultText(t, callBefore))
+	require.Equal(t, v3Disclosed(t, "unannotated", "github", "search_code", profile.TierUnannotated, "read", "work-readonly"), resultText(t, callBefore))
 	require.Empty(t, f.upstreams["github"].dispatched())
 
 	// Classify it read from the MCP tool; no restart, no reload step.
diff --git a/internal/server/refusal_precedence_profile_v3_test.go b/internal/server/refusal_precedence_profile_v3_test.go
index 3dc87d1de..206bfd39b 100644
--- a/internal/server/refusal_precedence_profile_v3_test.go
+++ b/internal/server/refusal_precedence_profile_v3_test.go
@@ -34,7 +34,6 @@ import (
 )
 
 const (
-	precedenceTierText       = "blocked by profile: github:create_issue is a write tool; this profile allows read tools only"
 	precedenceOutOfScopeText = "Server 'github' is not in scope for this agent token"
 )
 
@@ -146,7 +145,7 @@ func TestRefusalPrecedence_ProfileV3ExplainerOrder(t *testing.T) {
 			cfg.Profiles = append(cfg.Profiles, both)
 		})
 		text := p.call(t, pinnedProfileCtx("rule-and-cap"), contracts.ToolVariantWrite, "github:create_issue")
-		require.Equal(t, "blocked by profile: github:create_issue is denied by a profile rule", text)
+		require.Equal(t, v3Disclosed(t, "rule", "github", "create_issue", profile.TierWrite, "read", "rule-and-cap"), text)
 		p.requireBlockReason(t, "github", "create_issue", profile.BlockReasonRule)
 		p.requireNoUpstreamCalls(t)
 	})
@@ -156,7 +155,7 @@ func TestRefusalPrecedence_ProfileV3ExplainerOrder(t *testing.T) {
 		p := newPrecedenceFixture(t, nil)
 		ctx := agentCtx([]string{"*"}, []string{auth.PermRead}, "work-readonly")
 		text := p.call(t, ctx, contracts.ToolVariantDestructive, "github:get_secret_scanning_alert")
-		require.Equal(t, "blocked by profile: github:get_secret_scanning_alert is denied by a profile rule", text)
+		require.Equal(t, v3Disclosed(t, "rule", "github", "get_secret_scanning_alert", profile.TierRead, "read", "work-readonly"), text)
 		require.NotContains(t, text, "Insufficient permissions")
 		p.requireBlockReason(t, "github", "get_secret_scanning_alert", profile.BlockReasonRule)
 		p.requireNoUpstreamCalls(t)
@@ -226,7 +225,7 @@ func TestRefusalPrecedence_ProfileV3ExplainerOrder(t *testing.T) {
 			require.NoError(t, controlErr)
 			require.Contains(t, resultText(t, controlResult), state.mustNotContain, "the server-state gate must fire when the profile admits the call")
 			text := p.call(t, pinnedProfileCtx("work-readonly"), contracts.ToolVariantWrite, "github:create_issue")
-			require.Equal(t, precedenceTierText, text)
+			require.Equal(t, v3TierRefusal(t), text)
 			require.NotContains(t, text, state.mustNotContain)
 			p.requireBlockReason(t, "github", "create_issue", profile.BlockReasonTier)
 			p.requireNoUpstreamCalls(t)
@@ -240,7 +239,7 @@ func TestRefusalPrecedence_ProfileV3ExplainerOrder(t *testing.T) {
 			ServerName: "github", ToolName: "create_issue", Status: storage.ToolApprovalStatusPending,
 		}))
 		text := p.call(t, pinnedProfileCtx("work-readonly"), contracts.ToolVariantWrite, "github:create_issue")
-		require.Equal(t, precedenceTierText, text)
+		require.Equal(t, v3TierRefusal(t), text)
 		require.NotContains(t, text, "pending")
 		p.requireBlockReason(t, "github", "create_issue", profile.BlockReasonTier)
 		p.requireNoUpstreamCalls(t)
diff --git a/internal/server/rest_profile_v3_test.go b/internal/server/rest_profile_v3_test.go
index 2d0b84749..1add91df3 100644
--- a/internal/server/rest_profile_v3_test.go
+++ b/internal/server/rest_profile_v3_test.go
@@ -33,7 +33,6 @@ import (
 
 const (
 	restV3AdminKey   = "t108-rest-admin"
-	restV3TierText   = "blocked by profile: github:create_issue is a write tool; this profile allows read tools only"
 	restV3ReadonlyID = "work-readonly"
 )
 
@@ -250,12 +249,12 @@ func TestRESTProfileV3_ToolsCall_PinnedAgentToken(t *testing.T) {
 	t.Run("tier refusal is 403 with the contract text, before upstream I/O", func(t *testing.T) {
 		rec := f.callTool(ro, "call_tool_write", map[string]interface{}{"name": "github:create_issue", "args_json": "{}"}, "")
 		require.Equal(t, http.StatusForbidden, rec.Code, rec.Body.String())
-		require.Equal(t, restV3TierText, restV3Error(t, rec))
-		require.NotContains(t, rec.Body.String(), "work-readonly")
-		require.NotContains(t, rec.Body.String(), "Work · Read-only")
+		require.Equal(t, v3TierRefusal(t), restV3Error(t, rec))
+		// Spec 108 D39: the pinned token's own profile is named.
+		require.Contains(t, rec.Body.String(), "work-readonly")
 		require.Empty(t, f.upstreams["github"].dispatched())
 		row := f.waitBlocked("github", "create_issue", profile.BlockReasonTier)
-		require.Equal(t, restV3TierText, row.Metadata["reason"], "the persisted refusal text is the caller-visible one")
+		require.Equal(t, v3TierRefusal(t), row.Metadata["reason"], "the persisted refusal text is the caller-visible one")
 	})
 
 	t.Run("hidden built-ins answer exactly like an unknown tool and record profile_* reasons", func(t *testing.T) {
@@ -288,7 +287,7 @@ func TestRESTProfileV3_ToolsCall_PinnedAgentToken(t *testing.T) {
 		require.Empty(t, f.totalDispatched(), "hidden built-ins must never reach an upstream")
 	})
 
-	t.Run("retrieve_tools matches the direct handler and never names the profile (pin source)", func(t *testing.T) {
+	t.Run("retrieve_tools matches the direct handler and names the pinned token's own profile (pin source)", func(t *testing.T) {
 		rec := f.callTool(ro, "retrieve_tools", map[string]interface{}{"query": "create_issue"}, "")
 		require.Equal(t, http.StatusOK, rec.Code, rec.Body.String())
 		var envelope struct {
@@ -307,7 +306,7 @@ func TestRESTProfileV3_ToolsCall_PinnedAgentToken(t *testing.T) {
 		var payload map[string]json.RawMessage
 		require.NoError(t, json.Unmarshal([]byte(envelope.Data[0].Text), &payload))
 		require.JSONEq(t, "1", string(payload["hidden_by_profile"]))
-		require.NotContains(t, payload, "profile", "a pin never names its profile in retrieve_tools (FR-011)")
+		require.JSONEq(t, `"work-readonly"`, string(payload["profile"]), "a pinned caller learns its own profile in retrieve_tools (FR-011, Spec 108 D39)")
 		require.NotContains(t, envelope.Data[0].Text, "github:create_issue", "create_issue is over the tier cap and must not be a hit")
 	})
 
@@ -470,8 +469,8 @@ func TestRESTProfileV3_Replay_PinnedAgentToken(t *testing.T) {
 	t.Run("in-scope write over the tier cap is a 403 with the tier text", func(t *testing.T) {
 		rec := replay(ro, ids.writeID, "")
 		require.Equal(t, http.StatusForbidden, rec.Code, rec.Body.String())
-		require.Equal(t, restV3TierText, restV3Error(t, rec))
-		require.NotContains(t, rec.Body.String(), "work-readonly")
+		require.Equal(t, v3TierRefusal(t), restV3Error(t, rec))
+		require.Contains(t, rec.Body.String(), "work-readonly")
 		require.Empty(t, ids.github.dispatched(), "a refused replay must not reach the upstream")
 		f.waitBlocked("github", "create_issue", profile.BlockReasonTier)
 	})
diff --git a/internal/server/retrieve_tools_profile_v3_test.go b/internal/server/retrieve_tools_profile_v3_test.go
index 0c89f39ba..45194e70d 100644
--- a/internal/server/retrieve_tools_profile_v3_test.go
+++ b/internal/server/retrieve_tools_profile_v3_test.go
@@ -133,8 +133,9 @@ func TestRetrieveTools_ProfileV3_DecisionMatrix(t *testing.T) {
 }
 
 // TestRetrieveTools_ProfileV3_ProfileFieldSourceGating pins FR-011's `profile`
-// field rule: present only for url/session sources, absent for a pin — for
-// the SAME non-legacy profile and tool.
+// field rule (Spec 108 D39, which narrows research D27): present for the
+// caller's OWN profile (pin, binding, url, session), absent for anonymous and
+// for a dangling base — for the SAME non-legacy profile and tool.
 func TestRetrieveTools_ProfileV3_ProfileFieldSourceGating(t *testing.T) {
 	proxy, _ := newProfilesV3Fixture(t)
 	indexEnforcementMatrixFixtureTools(t, proxy)
@@ -152,18 +153,20 @@ func TestRetrieveTools_ProfileV3_ProfileFieldSourceGating(t *testing.T) {
 		assert.Equal(t, "work-readonly", *resp.Profile)
 	})
 
-	t.Run("pin source: profile field absent", func(t *testing.T) {
+	t.Run("pin source: the caller's own profile is reported (Spec 108 D39)", func(t *testing.T) {
 		resp := callRetrieveToolsV3(t, proxy, pinnedProfileCtx("work-readonly"), "list_issues", 5)
-		assert.Nil(t, resp.Profile, "a pinned caller must never learn it is pinned or to what (research D27)")
+		require.NotNil(t, resp.Profile, "a pinned caller learns its own profile; nothing is confirmed to a third party")
+		assert.Equal(t, "work-readonly", *resp.Profile)
 		require.NotNil(t, resp.HiddenByProfile, "hidden_by_profile is independent of source and still applies")
 	})
 
-	t.Run("switchable client binding: policy applies without disclosing the base", func(t *testing.T) {
+	t.Run("switchable client binding: the bound profile is reported to its own credential", func(t *testing.T) {
 		resp := callRetrieveToolsV3(t, proxy, clientCtx("desktop", "work-readonly", "switchable"), "create_issue", 5)
 		assert.Empty(t, resp.Tools)
 		require.NotNil(t, resp.HiddenByProfile)
 		assert.Equal(t, 1, *resp.HiddenByProfile)
-		assert.Nil(t, resp.Profile)
+		require.NotNil(t, resp.Profile)
+		assert.Equal(t, "work-readonly", *resp.Profile)
 	})
 
 	t.Run("switchable client session selection: selected profile is reported", func(t *testing.T) {
@@ -209,7 +212,7 @@ func TestRetrieveTools_ProfileV3_ProfileFieldSourceGating(t *testing.T) {
 
 // TestRetrieveTools_ProfileV3_DanglingPinDenyAll pins FR-020: a legacy agent
 // token pinned to a profile hand-deleted from config resolves deny-all, with
-// hidden_by_profile: 0 and NO profile field (base source, never disclosed).
+// hidden_by_profile: 0 and NO profile field (a dangling base has no profile to name).
 func TestRetrieveTools_ProfileV3_DanglingPinDenyAll(t *testing.T) {
 	proxy, _ := newProfilesV3Fixture(t)
 	indexEnforcementMatrixFixtureTools(t, proxy)
diff --git a/internal/server/scope_oracle_v3_test.go b/internal/server/scope_oracle_v3_test.go
index 9841cf9ab..991baed15 100644
--- a/internal/server/scope_oracle_v3_test.go
+++ b/internal/server/scope_oracle_v3_test.go
@@ -173,8 +173,19 @@ func TestScopeOracleV3_NewResolutionSourcesMatchAcrossFixtures(t *testing.T) {
 					fullResp := callRetrieveToolsV3(t, full.proxy, callers.full, query, 10)
 					require.NotNil(t, narrowResp.HiddenByProfile, "the profile must be active for %s", source)
 					require.NotNil(t, fullResp.HiddenByProfile, "the profile must be active for %s", source)
-					assert.Nil(t, narrowResp.Profile, "credential and anonymous resolution sources never reveal the base profile")
-					assert.Nil(t, fullResp.Profile, "credential and anonymous resolution sources never reveal the base profile")
+					// Spec 108 D39: a credential source (locked pin, switchable
+					// binding) tells the caller its OWN profile; the anonymous source
+					// never reveals the operator's anonymous_profile. Either way the
+					// two fixtures must answer identically (JSONEq below).
+					if source == "anonymous profile" {
+						assert.Nil(t, narrowResp.Profile, "the anonymous source never reveals the base profile")
+						assert.Nil(t, fullResp.Profile, "the anonymous source never reveals the base profile")
+					} else {
+						require.NotNil(t, narrowResp.Profile, "a credential source names its own profile for %s", source)
+						require.NotNil(t, fullResp.Profile, "a credential source names its own profile for %s", source)
+						assert.Equal(t, "cap-read-a", *narrowResp.Profile)
+						assert.Equal(t, "cap-read-a", *fullResp.Profile)
+					}
 					if query == "read_thing" {
 						require.NotEmpty(t, narrowResp.Tools, "positive control: the admitted read tool is discoverable")
 						require.NotEmpty(t, fullResp.Tools, "positive control: the admitted read tool is discoverable")
diff --git a/internal/server/server.go b/internal/server/server.go
index 30873af11..0bff34a6b 100644
--- a/internal/server/server.go
+++ b/internal/server/server.go
@@ -4113,7 +4113,7 @@ func (s *Server) ReplayToolCall(ctx context.Context, id string, arguments map[st
 		annotations, found := s.mcpProxy.EffectiveAnnotations(original.ServerName, original.ToolName)
 		intrinsic := profile.IntrinsicTier(annotations, found)
 		if admitted, reason, tier := policy.Decide(original.ServerName, original.ToolName, intrinsic); !admitted && reason != profile.ReasonServerNotInProfile {
-			message, blockReason := profileToolPolicyRefusal(reason, tier, policy.Cap, original.ServerName, original.ToolName)
+			message, blockReason := profileToolPolicyRefusal(reason, tier, policy.Cap, original.ServerName, original.ToolName, profileRefusalSubject(profileResolution, profileIndex))
 			refusal := &profile.ToolBlockedError{Reason: blockReason, Message: message}
 			s.mcpProxy.emitActivityPolicyDecisionWithBlockReason(ctx, original.ServerName, original.ToolName,
 				sessionIDFromContext(ctx), requestID, "blocked", message, telemetry.BlockReasonOther, string(blockReason))
diff --git a/internal/server/spec109_catalog_cached_fallback_test.go b/internal/server/spec109_catalog_cached_fallback_test.go
new file mode 100644
index 000000000..2372b15f3
--- /dev/null
+++ b/internal/server/spec109_catalog_cached_fallback_test.go
@@ -0,0 +1,120 @@
+package server
+
+import (
+	"context"
+	"encoding/json"
+	"net/http"
+	"net/http/httptest"
+	"os"
+	"path/filepath"
+	"sync/atomic"
+	"testing"
+
+	"github.com/mark3labs/mcp-go/mcp"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	"github.com/smart-mcp-proxy/mcpproxy-go/internal/registries"
+)
+
+// p109CachedFallback is the shared Spec 109 D35 fixture
+// (internal/registries/testdata/catalog_cached_fallback_order.json): the
+// sources are the input (one is flaky), ids/results/unavailable are the REST
+// answer the golden pins while that source is down.
+type p109CachedFallback struct {
+	Query   string `json:"query"`
+	Sources []struct {
+		ID         string            `json:"id"`
+		Name       string            `json:"name"`
+		Provenance string            `json:"provenance"`
+		Flaky      bool              `json:"flaky"`
+		Servers    []json.RawMessage `json:"servers"`
+	} `json:"sources"`
+	IDs     []string `json:"ids"`
+	Results []struct {
+		Source    string `json:"source"`
+		ID        string `json:"id"`
+		FromCache bool   `json:"from_cache"`
+	} `json:"results"`
+	Unavailable []struct {
+		Source   string `json:"source"`
+		Fallback string `json:"fallback"`
+	} `json:"unavailable"`
+}
+
+// TestSearchServers_CachedFallbackMatchesTheRESTGolden is the MCP leg of the
+// cached-fallback chain: search_servers {search:"github"} while one source is
+// down returns the same ids in the same order as GET /catalog/search, with
+// from_cache on the cached ones and the source still in unavailable[] with
+// fallback "cached_listing".
+func TestSearchServers_CachedFallbackMatchesTheRESTGolden(t *testing.T) {
+	raw, err := os.ReadFile(filepath.Join("..", "registries", "testdata", "catalog_cached_fallback_order.json"))
+	require.NoError(t, err)
+	var f p109CachedFallback
+	require.NoError(t, json.Unmarshal(raw, &f))
+	require.NotEmpty(t, f.IDs, "the REST golden is missing; run the httpapi cached-fallback test with UPDATE_GOLDEN=1")
+
+	registries.ResetListingCacheForTest()
+	t.Cleanup(registries.ResetListingCacheForTest)
+	var broken atomic.Bool
+	var entries []registries.RegistryEntry
+	for _, src := range f.Sources {
+		body, err := json.Marshal(src.Servers)
+		require.NoError(t, err)
+		flaky := src.Flaky
+		srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
+			if flaky && broken.Load() {
+				http.Error(w, "down", http.StatusInternalServerError)
+				return
+			}
+			w.Header().Set("Content-Type", "application/json")
+			_, _ = w.Write(body)
+		}))
+		t.Cleanup(srv.Close)
+		entries = append(entries, registries.RegistryEntry{ID: src.ID, Name: src.Name, ServersURL: srv.URL, Provenance: src.Provenance})
+	}
+	t.Cleanup(registries.AllowPrivateRegistryFetchForTest())
+	t.Cleanup(registries.SetRegistriesForTest(entries))
+
+	proxy := createTestMCPProxyServer(t)
+	call := func(search string) map[string]json.RawMessage {
+		result, err := proxy.handleSearchServers(context.Background(), mcp.CallToolRequest{Params: mcp.CallToolParams{
+			Name: "search_servers", Arguments: map[string]interface{}{"search": search},
+		}})
+		require.NoError(t, err)
+		require.False(t, result.IsError, "%+v", result.Content)
+		var payload map[string]json.RawMessage
+		require.NoError(t, json.Unmarshal([]byte(toolResultText(t, result)), &payload))
+		return payload
+	}
+
+	call("") // browse while healthy: primes the per-source listing cache
+	broken.Store(true)
+	payload := call(f.Query)
+
+	var servers []struct {
+		ID        string `json:"id"`
+		Source    string `json:"source"`
+		FromCache bool   `json:"from_cache"`
+	}
+	require.NoError(t, json.Unmarshal(payload["servers"], &servers))
+	var got []string
+	for i, s := range servers {
+		got = append(got, s.Source+":"+s.ID)
+		assert.Equal(t, f.Results[i].FromCache, s.FromCache, "from_cache of %s", s.ID)
+	}
+	assert.Equal(t, f.IDs, got, "MCP search_servers order must equal the REST golden")
+
+	var unavailable []struct {
+		Source   string  `json:"source"`
+		Fallback string  `json:"fallback"`
+		CachedAt *string `json:"cached_at"`
+	}
+	require.NoError(t, json.Unmarshal(payload["unavailable"], &unavailable))
+	require.Len(t, unavailable, len(f.Unavailable))
+	for i, u := range unavailable {
+		assert.Equal(t, f.Unavailable[i].Source, u.Source)
+		assert.Equal(t, f.Unavailable[i].Fallback, u.Fallback)
+		assert.NotNil(t, u.CachedAt, "cached_at must accompany the fallback")
+	}
+}
diff --git a/native/macos/MCPProxy/MCPProxy/API/CatalogModels.swift b/native/macos/MCPProxy/MCPProxy/API/CatalogModels.swift
index 608228abf..b5b3a00c2 100644
--- a/native/macos/MCPProxy/MCPProxy/API/CatalogModels.swift
+++ b/native/macos/MCPProxy/MCPProxy/API/CatalogModels.swift
@@ -65,6 +65,13 @@ struct CatalogResult: Codable, Identifiable, Equatable {
     /// avoids comparing the catalog install target with redacted server URLs
     /// or command arguments after a prior session.
     let addedServerName: String?
+    /// Wire `from_cache` (omitted when false): this hit came from the source's
+    /// cached listing because its live search failed (Spec 109 D35).
+    let fromCacheWire: Bool?
+
+    /// True for a hit served from the source's cached listing. Shown as the
+    /// "From cached list" badge; the source is also in `unavailable`.
+    var fromCache: Bool { fromCacheWire ?? false }
 
     /// Globally unique list identity (and the key for per-card local state).
     /// Length prefixes keep the composition unambiguous when either value
@@ -77,6 +84,7 @@ struct CatalogResult: Codable, Identifiable, Equatable {
         case requiredInputs = "required_inputs"
         case sourceCodeURL = "source_code_url"
         case addedServerName = "added_server_name"
+        case fromCacheWire = "from_cache"
     }
 }
 
@@ -84,6 +92,26 @@ struct CatalogResult: Codable, Identifiable, Equatable {
 struct CatalogSourceError: Codable, Equatable {
     let source: String
     let reason: String
+    /// `cached_listing` when the hits for this source came from its cached
+    /// listing instead of a live fetch (Spec 109 D35); nil otherwise.
+    let fallback: String?
+    /// RFC 3339: when that cached listing was last refreshed.
+    let cachedAt: String?
+
+    enum CodingKeys: String, CodingKey {
+        case source, reason, fallback
+        case cachedAt = "cached_at"
+    }
+
+    /// The one-line notice the Catalog view shows for this source. A source that
+    /// answered from its cached listing says so; the others keep the original
+    /// wording. Identical text on the Web UI (CatalogSearch.vue).
+    var noticeLine: String {
+        if fallback == "cached_listing" {
+            return "\(source): live search unavailable (\(reason)); showing matches from its cached list"
+        }
+        return "\(source) (\(reason)) unavailable"
+    }
 }
 
 /// The empty-query landing sections (FR-060), each capped at 12 server-side.
diff --git a/native/macos/MCPProxy/MCPProxy/API/ProfilesModels.swift b/native/macos/MCPProxy/MCPProxy/API/ProfilesModels.swift
index 87804172c..769d81d9e 100644
--- a/native/macos/MCPProxy/MCPProxy/API/ProfilesModels.swift
+++ b/native/macos/MCPProxy/MCPProxy/API/ProfilesModels.swift
@@ -65,6 +65,21 @@ enum CredentialState: TolerantStringEnum {
     /// Only an active client credential can be rebound (FR-026).
     var canBind: Bool { self == .client }
 
+    /// The words of the fix button for a row without a usable client credential
+    /// (`credential_cta` table of labels.json, identical on the Web UI). Empty
+    /// for a client credential, which needs no button. Only a known admin-key
+    /// holder is an "upgrade"; a revoked or expired credential is a
+    /// "reconnect"; a client that never connected (none, or the stat-only
+    /// unknown) is simply "Connect".
+    var ctaWord: String {
+        switch self {
+        case .client: return ""
+        case .adminKey: return "Upgrade to client credential"
+        case .revoked, .expired: return "Reconnect"
+        case .none, .unknown: return "Connect"
+        }
+    }
+
     /// The badge text of a Clients row.
     var badgeLabel: String {
         switch self {
diff --git a/native/macos/MCPProxy/MCPProxy/Menu/TrayClientsMenu.swift b/native/macos/MCPProxy/MCPProxy/Menu/TrayClientsMenu.swift
index c41bf1e75..16bb6d9bf 100644
--- a/native/macos/MCPProxy/MCPProxy/Menu/TrayClientsMenu.swift
+++ b/native/macos/MCPProxy/MCPProxy/Menu/TrayClientsMenu.swift
@@ -89,7 +89,6 @@ enum TrayClientsMenu {
 
     /// The top-level menu title.
     static let title = "Clients"
-    static let upgradeTitle = "Upgrade to client credential…"
     static let allServersTitle = "All servers"
 
     /// Clients that hold an active client credential OR are connected, sorted by
@@ -129,7 +128,10 @@ enum TrayClientsMenu {
         let title = "\(client.displayName) — \(profileLabel(for: client, profiles: profiles))"
             + (client.isLocked ? " 🔒" : "")
         guard client.hasClientCredential else {
-            return TrayClientMenuRow(clientId: client.id, title: title, items: [.upgrade(title: upgradeTitle)])
+            // The same words as the row's button on the Clients page: only an
+            // admin-key holder is an "upgrade".
+            let cta = ClientBindingControlsState(client).cta ?? .connect
+            return TrayClientMenuRow(clientId: client.id, title: title, items: [.upgrade(title: cta.title)])
         }
         let current = client.boundProfile
         let missing = client.profileMissing == true
diff --git a/native/macos/MCPProxy/MCPProxy/Views/CatalogView.swift b/native/macos/MCPProxy/MCPProxy/Views/CatalogView.swift
index 4a25c187d..6c221ec41 100644
--- a/native/macos/MCPProxy/MCPProxy/Views/CatalogView.swift
+++ b/native/macos/MCPProxy/MCPProxy/Views/CatalogView.swift
@@ -55,7 +55,7 @@ struct CatalogView: View {
                 .accessibilityIdentifier("catalog-search-input")
 
             if !unavailable.isEmpty {
-                Text(unavailable.map { "\($0.source) (\($0.reason))" }.joined(separator: ", ") + " unavailable")
+                Text(unavailable.map(\.noticeLine).joined(separator: "\n"))
                     .font(.scaled(.caption, scale: fontScale))
                     .foregroundStyle(.orange)
                     .padding(.horizontal)
@@ -105,8 +105,14 @@ struct CatalogView: View {
             ScrollView {
                 VStack(alignment: .leading, spacing: 12) {
                     if let sections {
-                        sectionBlock(title: "Official", items: sections.official, testID: "catalog-section-official")
-                        sectionBlock(title: "Popular", items: sections.popular, testID: "catalog-section-popular")
+                        ForEach(Self.sectionOrder(sections), id: \.self) { section in
+                            switch section {
+                            case .popular:
+                                sectionBlock(title: "Popular", items: sections.popular, testID: "catalog-section-popular")
+                            case .official:
+                                sectionBlock(title: "Official", items: sections.official, testID: "catalog-section-official")
+                            }
+                        }
                         if sections.official.isEmpty && sections.popular.isEmpty {
                             Text("Nothing to browse yet.")
                                 .font(.scaled(.callout, scale: fontScale))
@@ -126,6 +132,19 @@ struct CatalogView: View {
         }
     }
 
+    /// The browse sections in render order: Popular first when it has entries
+    /// (popularity if available), then Official (curated first). An empty
+    /// section is omitted. Mirrors the Web UI's CatalogSearch.vue and the CLI
+    /// table (Spec 109 D35, amends Spec 110 FR-005).
+    enum BrowseSection: Hashable { case popular, official }
+
+    static func sectionOrder(_ sections: CatalogSections) -> [BrowseSection] {
+        var order: [BrowseSection] = []
+        if !sections.popular.isEmpty { order.append(.popular) }
+        if !sections.official.isEmpty { order.append(.official) }
+        return order
+    }
+
     @ViewBuilder
     private func sectionBlock(title: String, items: [CatalogResult], testID: String) -> some View {
         if !items.isEmpty {
@@ -165,6 +184,11 @@ struct CatalogView: View {
                     } else if r.verified {
                         badge("Verified", tint: .green)
                     }
+                    if r.fromCache {
+                        badge("From cached list", tint: .orange)
+                            .help("The source’s live search is unavailable; this entry is from its cached list.")
+                            .accessibilityIdentifier("catalog-from-cache-\(r.source)-\(r.catalogID)")
+                    }
                     badge(r.transport, tint: .secondary)
                 }
             }
diff --git a/native/macos/MCPProxy/MCPProxy/Views/ClientBindingControls.swift b/native/macos/MCPProxy/MCPProxy/Views/ClientBindingControls.swift
index 13f01af00..4024dfd56 100644
--- a/native/macos/MCPProxy/MCPProxy/Views/ClientBindingControls.swift
+++ b/native/macos/MCPProxy/MCPProxy/Views/ClientBindingControls.swift
@@ -6,7 +6,7 @@
 // credential badge; its detail carries the profile Picker, the Locked toggle
 // and the credential actions. A client WITHOUT an active client credential gets
 // no working picker or toggle: they are disabled and replaced by the primary
-// button that gets it one ("Upgrade to client credential…" or "Reconnect…").
+// button that gets it one ("Connect…", "Upgrade to client credential…" or "Reconnect…").
 
 import SwiftUI
 
diff --git a/native/macos/MCPProxy/MCPProxy/Views/ClientBindingModel.swift b/native/macos/MCPProxy/MCPProxy/Views/ClientBindingModel.swift
index cfc0733d0..faa2fd8cd 100644
--- a/native/macos/MCPProxy/MCPProxy/Views/ClientBindingModel.swift
+++ b/native/macos/MCPProxy/MCPProxy/Views/ClientBindingModel.swift
@@ -37,17 +37,25 @@ extension APIClient: ClientBindingSource {}
 /// What the profile controls of a Clients row show and allow (K9).
 struct ClientBindingControlsState: Equatable {
     enum CTA: Equatable {
-        /// `none`, `admin_key` or `unknown`: connect it with a client credential.
+        /// `none` or `unknown`: the client never connected; connect it.
+        case connect
+        /// `admin_key`: the client holds the admin key; upgrade it to a client credential.
         case upgrade
         /// `revoked` or `expired`: the credential is dead; reconnect.
         case reconnect
 
-        var title: String {
+        /// The bare words, equal to labels.json `credential_cta`.
+        var word: String {
             switch self {
-            case .upgrade: return "Upgrade to client credential…"
-            case .reconnect: return "Reconnect…"
+            case .connect: return CredentialState.none.ctaWord
+            case .upgrade: return CredentialState.adminKey.ctaWord
+            case .reconnect: return CredentialState.revoked.ctaWord
             }
         }
+
+        /// The button or menu title: the words plus the ellipsis that says a
+        /// dialog (the previewed connect) follows.
+        var title: String { word + "…" }
     }
 
     /// The picker and the lock toggle work only with an active client credential.
@@ -73,7 +81,8 @@ struct ClientBindingControlsState: Equatable {
         switch state {
         case .client: cta = nil
         case .revoked, .expired: cta = .reconnect
-        default: cta = .upgrade
+        case .adminKey: cta = .upgrade
+        case .none, .unknown: cta = .connect
         }
         profile = client.boundProfile
         isLocked = client.isLocked
diff --git a/native/macos/MCPProxy/MCPProxy/Views/ConnectClientModel.swift b/native/macos/MCPProxy/MCPProxy/Views/ConnectClientModel.swift
index 6dccdbcc6..2b0024c99 100644
--- a/native/macos/MCPProxy/MCPProxy/Views/ConnectClientModel.swift
+++ b/native/macos/MCPProxy/MCPProxy/Views/ConnectClientModel.swift
@@ -498,7 +498,7 @@ final class ConnectClientModel: ObservableObject {
     }
 
     /// Select a client from an entry point that carries the profile the client
-    /// was last bound to ("Reconnect…", "Upgrade to client credential…"), so the
+    /// was last bound to ("Connect…", "Reconnect…", "Upgrade to client credential…"), so the
     /// picker opens on it instead of silently widening to All servers (K9).
     func preselect(_ clientId: String, profile: String?) async {
         if let profile, !profile.isEmpty { initialProfile = profile }
diff --git a/native/macos/MCPProxy/MCPProxyTests/CatalogOrderParityTests.swift b/native/macos/MCPProxy/MCPProxyTests/CatalogOrderParityTests.swift
index 5db3607dc..b6f773ad7 100644
--- a/native/macos/MCPProxy/MCPProxyTests/CatalogOrderParityTests.swift
+++ b/native/macos/MCPProxy/MCPProxyTests/CatalogOrderParityTests.swift
@@ -50,4 +50,52 @@ final class CatalogOrderParityTests: XCTestCase {
         XCTAssertEqual(response.query, g.query)
         XCTAssertNil(response.sections, "a non-empty query has no sections")
     }
+
+    // MARK: - Cached fallback (Spec 109 D35, T160)
+
+    private struct CachedGolden: Decodable {
+        struct Unavailable: Decodable { let source: String; let fallback: String }
+        let query: String
+        let ids: [String]
+        let results: [CatalogResult]
+        let unavailable: [Unavailable]
+    }
+
+    private func cachedGolden() throws -> CachedGolden {
+        var url = URL(fileURLWithPath: #filePath)
+        for _ in 0..<5 { url.deleteLastPathComponent() }
+        url.appendPathComponent("internal/registries/testdata/catalog_cached_fallback_order.json")
+        return try JSONDecoder().decode(CachedGolden.self, from: try Data(contentsOf: url))
+    }
+
+    /// The REST golden written while one source is down decodes into the
+    /// models the Catalog view lists: same order, and only the cached rows
+    /// carry the "From cached list" badge. A hit with no `from_cache` key is a
+    /// live hit.
+    func testCachedFallbackGoldenOrderAndBadge() throws {
+        let g = try cachedGolden()
+        XCTAssertFalse(g.ids.isEmpty, "the REST golden is missing; run the Go httpapi cached-fallback test with UPDATE_GOLDEN=1")
+        XCTAssertEqual(g.results.map { "\($0.source):\($0.catalogID)" }, g.ids)
+        let cached = g.results.filter(\.fromCache).map(\.source)
+        XCTAssertFalse(cached.isEmpty)
+        XCTAssertEqual(Set(cached), Set(g.unavailable.map(\.source)), "only the fallback source's rows are cached")
+        XCTAssertFalse(try XCTUnwrap(g.results.first).fromCache, "the live official hit is not cached")
+    }
+
+    func testTheUnavailableNoticeSaysWhatIsShown() throws {
+        let g = try cachedGolden()
+        let response = """
+        {"query":"\(g.query)","results":[],"sections":null,
+         "unavailable":[{"source":"slowreg","reason":"timeout after 5s","fallback":"cached_listing","cached_at":"2026-10-02T10:00:00Z"}]}
+        """
+        let decoded = try JSONDecoder().decode(CatalogSearchResponse.self, from: Data(response.utf8))
+        let notice = try XCTUnwrap(decoded.unavailable?.first)
+        XCTAssertEqual(notice.fallback, "cached_listing")
+        XCTAssertEqual(notice.noticeLine, "slowreg: live search unavailable (timeout after 5s); showing matches from its cached list")
+
+        let plain = try JSONDecoder().decode(
+            CatalogSourceError.self, from: Data(#"{"source":"slowreg","reason":"timeout after 5s"}"#.utf8))
+        XCTAssertNil(plain.fallback)
+        XCTAssertEqual(plain.noticeLine, "slowreg (timeout after 5s) unavailable")
+    }
 }
diff --git a/native/macos/MCPProxy/MCPProxyTests/CatalogTests.swift b/native/macos/MCPProxy/MCPProxyTests/CatalogTests.swift
index 773c5e8ee..29e3aa349 100644
--- a/native/macos/MCPProxy/MCPProxyTests/CatalogTests.swift
+++ b/native/macos/MCPProxy/MCPProxyTests/CatalogTests.swift
@@ -13,6 +13,30 @@ final class CatalogTests: XCTestCase {
         return try JSONDecoder().decode(T.self, from: data)
     }
 
+    // MARK: - Browse section order (Spec 109 D35, T164)
+
+    private func sampleResult(_ id: String) throws -> CatalogResult {
+        try decode(CatalogResult.self, from: """
+        {"source": "official", "id": "\(id)", "title": "\(id)", "verified": true, "official": true,
+         "description": "d", "transport": "stdio", "install": {"command": "npx"}, "added": false}
+        """)
+    }
+
+    /// Popular is rendered first when it has entries, then Official; an empty
+    /// section is never listed (same order as the Web UI and the CLI table).
+    func testPopularSectionRendersFirst() throws {
+        let popular = [try sampleResult("hot")]
+        let official = [try sampleResult("filesystem")]
+        XCTAssertEqual(
+            CatalogView.sectionOrder(CatalogSections(official: official, popular: popular)),
+            [.popular, .official])
+        XCTAssertEqual(
+            CatalogView.sectionOrder(CatalogSections(official: official, popular: [])), [.official])
+        XCTAssertEqual(
+            CatalogView.sectionOrder(CatalogSections(official: [], popular: popular)), [.popular])
+        XCTAssertEqual(CatalogView.sectionOrder(CatalogSections(official: [], popular: [])), [])
+    }
+
     // MARK: - CatalogResult decode (contracts/rest-api.md#catalog example)
 
     func testDecodesTheContractExampleShape() throws {
diff --git a/native/macos/MCPProxy/MCPProxyTests/ClientBindingModelTests.swift b/native/macos/MCPProxy/MCPProxyTests/ClientBindingModelTests.swift
index 4d2ff6cff..26f980beb 100644
--- a/native/macos/MCPProxy/MCPProxyTests/ClientBindingModelTests.swift
+++ b/native/macos/MCPProxy/MCPProxyTests/ClientBindingModelTests.swift
@@ -129,8 +129,8 @@ final class ClientBindingModelTests: XCTestCase {
 
     func testEveryNonClientCredentialStateDisablesTheControlsAndOffersACTA() {
         let expected: [(String?, ClientBindingControlsState.CTA, String)] = [
-            ("none", .upgrade, "No credential"), ("admin_key", .upgrade, "Admin key"),
-            ("unknown", .upgrade, "Unknown"), (nil, .upgrade, "Unknown"),
+            ("none", .connect, "No credential"), ("admin_key", .upgrade, "Admin key"),
+            ("unknown", .connect, "Unknown"), (nil, .connect, "Unknown"),
             ("revoked", .reconnect, "Revoked"), ("expired", .reconnect, "Expired"),
         ]
         for (credential, cta, badge) in expected {
@@ -140,10 +140,23 @@ final class ClientBindingModelTests: XCTestCase {
             XCTAssertEqual(state.credentialBadge, badge)
             XCTAssertFalse(state.lockEnabled)
         }
+        XCTAssertEqual(ClientBindingControlsState.CTA.connect.title, "Connect…")
         XCTAssertEqual(ClientBindingControlsState.CTA.upgrade.title, "Upgrade to client credential…")
         XCTAssertEqual(ClientBindingControlsState.CTA.reconnect.title, "Reconnect…")
     }
 
+    /// Spec 108 D39 (T150): a client that never connected has nothing to
+    /// upgrade; only a known admin-key holder reads "Upgrade".
+    func testNoneAndUnknownShowConnect() {
+        for credential in ["none", "unknown", nil] as [String?] {
+            let state = ClientBindingControlsState(Self.record(credential: credential))
+            XCTAssertEqual(state.cta?.title, "Connect…", "\(String(describing: credential))")
+        }
+        XCTAssertEqual(ClientBindingControlsState(Self.record(credential: "admin_key")).cta?.title,
+                       "Upgrade to client credential…")
+        XCTAssertEqual(ClientBindingControlsState(Self.record(credential: "revoked")).cta?.title, "Reconnect…")
+    }
+
     func testTheAccessibilityLabelCarriesTheState() {
         let state = ClientBindingControlsState(Self.record(id: "cursor", profile: "work-ro", mode: "locked"))
         XCTAssertTrue(state.accessibilityLabel.contains("Cursor profile"))
diff --git a/native/macos/MCPProxy/MCPProxyTests/ClientsTrayMenuTests.swift b/native/macos/MCPProxy/MCPProxyTests/ClientsTrayMenuTests.swift
index 73561bcff..a33a97f8c 100644
--- a/native/macos/MCPProxy/MCPProxyTests/ClientsTrayMenuTests.swift
+++ b/native/macos/MCPProxy/MCPProxyTests/ClientsTrayMenuTests.swift
@@ -205,21 +205,30 @@ final class ClientsTrayMenuTests: XCTestCase {
 
     /// A client without an active client credential cannot be bound: its whole
     /// submenu is the one way to get a credential.
-    func testAClientWithoutACredentialOffersOnlyTheUpgrade() {
+    func testAClientWithoutACredentialOffersOnlyTheFix() {
         let rows = TrayClientsMenu.build(clients: [
             client(id: "codex", name: "Codex", credential: "admin_key"),
             client(id: "gone", name: "Gone", credential: nil, connected: true),
         ], profiles: profiles)
-        for row in rows {
-            XCTAssertEqual(row.items, [.upgrade(title: "Upgrade to client credential…")], row.clientId)
-        }
+        XCTAssertEqual(rows.map(\.clientId), ["codex", "gone"])
+        XCTAssertEqual(rows[0].items, [.upgrade(title: "Upgrade to client credential…")], "an admin-key holder is an upgrade")
+        XCTAssertEqual(rows[1].items, [.upgrade(title: "Connect…")], "an unclassified client is simply connected")
+    }
+
+    /// Spec 108 D39 (T150): an installed client with no mcpproxy entry offers
+    /// "Connect…", not "Upgrade to client credential…".
+    func testInstalledClientWithoutCredentialShowsConnect() {
+        let row = TrayClientsMenu.build(clients: [
+            client(id: "claude-code", name: "Claude Code", credential: "none", connected: true),
+        ], profiles: profiles)[0]
+        XCTAssertEqual(row.items, [.upgrade(title: "Connect…")])
     }
 
-    func testARevokedConnectedClientOffersTheUpgradeToo() {
+    func testARevokedConnectedClientOffersReconnect() {
         let row = TrayClientsMenu.build(clients: [
             client(id: "c", name: "C", credential: "revoked", connected: true),
         ], profiles: profiles)[0]
-        XCTAssertEqual(row.items, [.upgrade(title: "Upgrade to client credential…")])
+        XCTAssertEqual(row.items, [.upgrade(title: "Reconnect…")])
     }
 
     // MARK: Tooltip (F11 kept)
diff --git a/native/macos/MCPProxy/MCPProxyTests/ProfilesEnumsLabelsTests.swift b/native/macos/MCPProxy/MCPProxyTests/ProfilesEnumsLabelsTests.swift
index edba5c1bf..3f02a5c5e 100644
--- a/native/macos/MCPProxy/MCPProxyTests/ProfilesEnumsLabelsTests.swift
+++ b/native/macos/MCPProxy/MCPProxyTests/ProfilesEnumsLabelsTests.swift
@@ -115,6 +115,27 @@ final class ProfilesEnumsLabelsTests: XCTestCase {
         }
     }
 
+    /// Spec 108 D39 (T150): the fix-button words of a row without a usable client
+    /// credential are the `credential_cta` table, identical on the Web UI. The
+    /// button and menu titles add a trailing "…" (a dialog follows).
+    func testCredentialCTAWordsEqualLabels() throws {
+        let words = try labelFamily("credential_cta")
+        let states = try XCTUnwrap(try enums()["credential_state"])
+        XCTAssertEqual(Set(words.keys), Set(states))
+        for wire in states {
+            let state = CredentialState(wire: wire)
+            XCTAssertEqual(state.ctaWord, words[wire], "credential_cta.\(wire)")
+            let cta = ClientBindingControlsState(ClientBindingModelTests.record(credential: wire)).cta
+            if wire == "client" {
+                XCTAssertNil(cta)
+            } else {
+                let title = try XCTUnwrap(cta).title
+                XCTAssertTrue(title.hasSuffix("…"), title)
+                XCTAssertEqual(String(title.dropLast()), words[wire], "title of \(wire) minus the ellipsis")
+            }
+        }
+    }
+
     func testBindingModeWordsAreTheSharedTable() throws {
         let words = try labelFamily("binding_mode")
         for mode in try XCTUnwrap(try enums()["binding_mode"]) {
diff --git a/scripts/run-web-smoke.sh b/scripts/run-web-smoke.sh
index 61801da2b..61bb6f4bf 100755
--- a/scripts/run-web-smoke.sh
+++ b/scripts/run-web-smoke.sh
@@ -344,7 +344,7 @@ set +e
   MCPPROXY_API_KEY="$API_KEY" \
   SWEEP_SERVER_NAME="$SWEEP_SERVER_NAME" \
   SWEEP_REPORT_DIR="$REPORT_DIR" \
-    "$PLAYWRIGHT_BIN" test web-ui-sweep.spec.ts visual-a11y-sweep.spec.ts navigation-consistency.spec.ts profiles-clients.spec.ts profiles-scope.spec.ts profiles-unhide.spec.ts
+    "$PLAYWRIGHT_BIN" test web-ui-sweep.spec.ts visual-a11y-sweep.spec.ts navigation-consistency.spec.ts profiles-clients.spec.ts profiles-scope.spec.ts profiles-unhide.spec.ts demo-ux-fixes.spec.ts
 )
 PLAYWRIGHT_STATUS=$?
 set -e
diff --git a/specs/108-profiles-v3/contracts/mcp-tools.md b/specs/108-profiles-v3/contracts/mcp-tools.md
index 21d4f090d..fff01db58 100644
--- a/specs/108-profiles-v3/contracts/mcp-tools.md
+++ b/specs/108-profiles-v3/contracts/mcp-tools.md
@@ -9,7 +9,7 @@ When the effective profile is non-legacy (sets any of the six policy fields `max
 ```
 
 - `hidden_by_profile`: integer ≥ 0 (FR-011). Present iff the effective profile is non-legacy — including `0` when nothing matched was excluded (e.g. a `max_tier: destructive`-only profile); omitted for no profile and for legacy profiles, whatever their `title`. A dangling base (FR-020 deny-all for a pin, binding or `anonymous_profile` naming a missing profile) and the FR-008a binding guard always count as non-legacy: `hidden_by_profile: 0`. Never accompanied by names, descriptions or per-server breakdowns. Counted by the extended index API (`SearchToolsAdmitted`, data-model §2) over the full match set before the limit — `indexedToolVisible` on the already-cut result cannot do it (FR-011).
-- `profile`: effective profile slug **only when the caller selected it** (`profile_source` `url` or `session`); omitted for no profile and for every base the caller did not choose (`pin`, `binding`, `anonymous`, incl. dangling bases and the guard), so discovery never confirms that a caller is pinned or to what (FR-011, research D27).
+- `profile`: effective profile slug **only to a caller whose effective profile is its own** (`profile_source` `pin`, `binding`, `url` or `session`); omitted for no profile, for `anonymous` (the operator's `anonymous_profile`) and for a dangling base or the guard (FR-011, research D39, which narrows D27).
 - Frozen goldens: legacy fixtures unchanged; one new golden `retrieve_tools_profile_v3.golden.json`.
 
 ## `describe_tool`
diff --git a/specs/108-profiles-v3/contracts/refusals.md b/specs/108-profiles-v3/contracts/refusals.md
index 95a917a4e..009bc37b3 100644
--- a/specs/108-profiles-v3/contracts/refusals.md
+++ b/specs/108-profiles-v3/contracts/refusals.md
@@ -1,12 +1,12 @@
 # Contract: refusals and block reasons
 
-Texts are exact (tests compare byte-for-byte after substituting `<server>`, `<tool>`, `<tier>`, `<cap>`). All are returned before any upstream I/O. **No agent-facing refusal names the profile's title or slug** (codex review round 1, research D27): the text is byte-identical whether the effective profile came from a pin, a binding, `anonymous_profile`, the URL or `set_profile`, so a refusal can never confirm that a caller is pinned or to what (the Spec 105 `set_profile` non-disclosure precedent, `internal/server/profile_tool.go`). The operator sees the profile on the activity record, in the explainer and in view-as.
+Texts are exact (tests compare byte-for-byte after substituting `<server>`, `<tool>`, `<tier>`, `<cap>`, `<label>`). All are returned before any upstream I/O. **A refusal names the profile only to a caller whose effective profile is its own** (research D39, which narrows D27): source `pin` or `binding` (its own credential) or `url` or `session` (its own choice). It never names it for source `anonymous` (the operator's `anonymous_profile` would be handed to any local process that connects), for a dangling base or for an out-of-scope server; those keep the original non-disclosing text and shapes (the Spec 105 `set_profile` precedent, `internal/server/profile_tool.go`). `<label>` is `"<title>" (<slug>)` with the title rendered by Go `%q`, or `"<slug>"` when the title is empty or equals the slug. The exact texts are pinned by `internal/profile/testdata/contract/tool_refusals.json`. The operator sees the profile on the activity record, in the explainer and in view-as.
 
 | Situation | Surface | Response | Activity |
 |---|---|---|---|
-| Tool above cap on in-scope server | `call_tool_*`, `/mcp/all` `tools/call`, nested `call_tool` in `code_execution` (from MCP, REST `/tools/call` or REST `/code/exec`), REST `POST /api/v1/tools/call` and `POST /api/v1/tool-calls/{id}/replay` (HTTP `403`, same text as `error`) | `blocked by profile: <server>:<tool> is a <tier> tool; this profile allows <cap> tools only` (cap phrase: `read` → "read", `write` → "read and write") | `status=blocked`, `block_reason=profile_tier` |
-| Tool matches deny rule | same | `blocked by profile: <server>:<tool> is denied by a profile rule` | `block_reason=profile_rule` |
-| Unannotated, unclassified, policy deny | same | `blocked by profile: <server>:<tool> has no tier annotation; an operator can classify it in the profile to allow it` | `block_reason=profile_unannotated` |
+| Tool above cap on in-scope server | `call_tool_*`, `/mcp/all` `tools/call`, nested `call_tool` in `code_execution` (from MCP, REST `/tools/call` or REST `/code/exec`), REST `POST /api/v1/tools/call` and `POST /api/v1/tool-calls/{id}/replay` (HTTP `403`, same text as `error`) | disclosed: `blocked by profile: <server>:<tool> is a <tier> tool; profile <label> allows <cap> tools only`; undisclosed (anonymous): `blocked by profile: <server>:<tool> is a <tier> tool; this profile allows <cap> tools only` (cap phrase: `read` → "read", `write` → "read and write") | `status=blocked`, `block_reason=profile_tier` |
+| Tool matches deny rule | same | disclosed: `blocked by profile: <server>:<tool> is denied by a rule in profile <label>`; undisclosed: `blocked by profile: <server>:<tool> is denied by a profile rule` | `block_reason=profile_rule` |
+| Unannotated, unclassified, policy deny | same | disclosed: `blocked by profile: <server>:<tool> has no tier annotation; an operator can classify it in profile <label> to allow it`; undisclosed: `blocked by profile: <server>:<tool> has no tier annotation; an operator can classify it in the profile to allow it` | `block_reason=profile_unannotated` |
 | Server outside effective scope (incl. FR-010 `server_not_in_profile`) | all, incl. REST `POST /api/v1/tool-calls/{id}/replay` (its existing out-of-scope/unknown-id `404`, FR-015) and the REST discovery routes (absent rows / scoped `404`, FR-015a) | **unchanged** Spec 105 non-disclosing refusal — never the descriptive `403` texts above, which apply only to the three policy reasons on an in-scope server | unchanged |
 | Excluded tool via `describe_tool` | `describe_tool` | uniform not-found (Spec 105) | none (discovery) |
 | Excluded tool in `retrieve_tools` | `retrieve_tools` | omitted; counted in `hidden_by_profile` | none |
diff --git a/specs/108-profiles-v3/research.md b/specs/108-profiles-v3/research.md
index 85ec8b0a9..6f52f5fac 100644
--- a/specs/108-profiles-v3/research.md
+++ b/specs/108-profiles-v3/research.md
@@ -161,7 +161,7 @@ Each finding was verified against `638fa805a` before it was applied.
 - **Staged rotation (high, applied)** — verified: the single-tx replace of the earlier D8 invalidated the old secret before the config write. FR-021a adds a pending secret, an idempotent finalize and a reconciler keyed on the existing `credential_state` classifier.
 - **Non-admin profile omission (high, applied)** — verified: `internal/httpapi/profiles.go` sets `omitHiddenProfiles := ac.IsSessionPrincipal() && !ac.IsAdmin()`, so agent tokens get `servers:[]`/`tool_count:0`. Extended to every non-admin caller (FR-034).
 - **Effective-tools rows (high, applied)** — excluded rows with reasons are administrator-only; non-admin callers get visible rows and aggregate counts (FR-032).
-- **Refusal naming (high, applied)** — verified against the Spec 105 precedent in `internal/server/profile_tool.go` (a pin mismatch must be indistinguishable so a caller cannot learn that it is pinned, and to what). Refusal texts, `retrieve_tools.profile` for base sources, `set_profile`'s `profile_source` and `/code/exec`'s `PROFILE_BLOCKED` message no longer name a base profile. The tier and reason stay: they describe the tool, not the caller's binding.
+- **Refusal naming (high, applied; superseded in part by D39 for a caller's OWN profile)** — verified against the Spec 105 precedent in `internal/server/profile_tool.go` (a pin mismatch must be indistinguishable so a caller cannot learn that it is pinned, and to what). Refusal texts, `retrieve_tools.profile` for base sources, `set_profile`'s `profile_source` and `/code/exec`'s `PROFILE_BLOCKED` message no longer name a base profile. The tier and reason stay: they describe the tool, not the caller's binding.
 - **Rollout gate (high, applied)** — PR independence let 108-b (discovery) ship without 108-d (execution). FR-009a rejects v3 policy fields until `profile.PolicyEnforcementReady` flips in 108-d. Rejected: "b and d in one release" (a process rule no test enforces).
 - **Filter before limit (high, applied)** — verified: `SearchToolsScoped`'s predicate is `func(serverName string) bool` (`internal/index/manager.go`, `bleve.go`) and `indexedToolVisible` runs after the cut (`internal/server/mcp.go`). FR-011 now requires a hit-level index predicate (`SearchToolsAdmitted`).
 - **Cache tier generation (medium, applied)** — the policy fingerprint does not change when a tool's annotations do; the stamp gains `ToolTierGeneration` (FR-027).
@@ -335,3 +335,23 @@ J1 wires Tools, Activity (calls/system/all + summary + export), the Sessions tab
 L1 108-l merges before 109-m; the two specs keep separate matrix files, checkers and fixtures, and every Go helper here is prefixed `p108` (109-m uses `p109`). L2 `parity-matrix.json` is `{schema, spec, rows[{row, capability, cells{web,macos,cli,mcp,rest}}]}` with a status and identifiers per cell. L3 the Go test parses the spec's parity table and compares row numbers, capability text and every cell status. L4 each identifier kind is resolved where its symbol table lives: Go (REST, MCP, source ids, test refs), a CLI helper process over `--help-json`, vitest (the router), XCTest (the Swift enums). L5 `enums.json` is generated from `contract.go` and compared with `contracts.ts` (exact lines) and the Swift tolerant enums; a `go/ast` walk fails on an uncovered constant. L6 `labels.json` is the one table of UI words (access reasons incl. "Unannotated — classify" and "Needs review", sources, steps, credential states, modes, unannotated handling, tier cap); the CLI keeps raw enum values. L7 SC-001 is five named server tests plus the CLI check 2 test, the Playwright spec for check 6 and `acceptance-checks.json`. L8 SC-006 is one golden of 64 combinations derived by an independent reference filter and replayed by the CLI, vitest and XCTest. L9 `DetectConfigChanges` reports `profiles` and `anonymous_profile` (it was silent about both). Follow-up (#1458 item 1): the apply and the disk reload, not only the config funnel, reconcile the per-profile indexes when either field changes. L10 published pages get the user docs; the repo-root `cli-management-commands.md` keeps a pointer to `cli/profile-commands`. L11 release notes carry the connect credential change, the downgrade precondition and the `/profiles/active` deprecation. L12 the sweep spec list is pinned by `TestWebUISweepSpecListIsComplete`. L13 the docs pages are pinned by `TestSpec108DocsPublished`. L14 the four shared refusals are compared with `refusals.json` on REST, MCP and the CLI. L15 the Task Count is recomputed by script.
 
 Deviations found while building (recorded, not planned): **I26** `ErrorCodeConnectInProgress` and `ErrorCodeCredentialSuperseded` were in `contract.go` but not in the generated `contracts.ts`; `cmd/generate-types` gained the two constants. **I27** the Web UI Servers "profile" filter (parity row 19, Web) is Spec 109-l's; the matrix carries one `pending: "109-l"` cell, allowlisted in the Go test, which stops being needed when 109-l lands. **I28** the macOS Activity "Caller" profile label now reads "work-readonly · locked by credential" like the Web chip (it read "work-readonly (pin)"). **I29** `require_mcp_auth` is also missing from `DetectConfigChanges`; it is not a 108 field and is filed as a follow-up.
+
+## D39 - demo-ux-fixes decisions (profile refusals, token chip, client CTA, radio labels; 2026-10-02)
+
+A live demo of `main` at `b3191a059` found nine gaps; these are the four Spec 108 owns (Spec 109's five are D35).
+
+**A7 name the profile (finding 4; reverses part of D27).** An agent hit `blocked by profile: github:create_issue is a write tool; this profile allows read tools only` and could not tell which profile, so it could not tell the operator what to change. D27 withheld the profile from every caller because naming it to a third party would confirm that a caller is pinned. That threat does not apply to a caller learning its OWN profile: its credential or its own choice decided it, `set_profile` and `switchable_to` are unchanged, and its reach is already observable from what it can call. The refusal now names the profile **only to a caller whose effective profile is its own**: source `pin` or `binding` (its own credential) or `url` or `session` (it chose it). It never names it for source `anonymous` (an unauthenticated caller: naming it would hand the operator's `anonymous_profile` to any local process that connects), for a dangling base (no policy, so the Spec 105 deny-all shape is unchanged) or for an out-of-scope server (the non-disclosing shape is unchanged). Texts, with `<label>` = `"<title>" (<slug>)` (the title through Go `%q`, so it cannot add a line to an agent's context or an activity log), or `"<slug>"` alone when the title is empty or equals the slug:
+
+- tier: `blocked by profile: <s>:<t> is a <tier> tool; profile <label> allows <cap> tools only`
+- rule: `blocked by profile: <s>:<t> is denied by a rule in profile <label>`
+- unannotated: `blocked by profile: <s>:<t> has no tier annotation; an operator can classify it in profile <label> to allow it`
+
+The undisclosed (anonymous) texts are byte-identical to the pre-D39 ones. `retrieve_tools` returns `profile: "<slug>"` for `pin`, `binding`, `url` and `session` whenever the profile is non-legacy (presence is still keyed on non-legacy, so the SC-003 legacy byte-parity holds) and omits it for `anonymous` and a dangling base. No `profile_title` field is added; the refusal carries the title. One predicate, `profileDisclosedTo`, decides both, so refusal and discovery cannot diverge. Reviewed as a security-semantic change: the codex-reviewed non-disclosure decision is reversed only for the caller's own profile. If that is rejected, the fallback is slug-only disclosure.
+
+**A8 refusal golden.** A new golden, `internal/profile/testdata/contract/tool_refusals.json` (`name`, `block_reason`, `disclosed`, `undisclosed`), pins the tool refusals the same way `refusals.json` pins the four admin ones; `refusals.json` is untouched (its three readers assert four entries; `TestProfilesV3RefusalParity*` stay green). Readers: the unit test of `profileToolPolicyRefusal` (every reason, titled, slug-only and undisclosed), the MCP, REST and replay tests, and the CLI (`activity list -o json` and `activity show` print the blocked record's text verbatim).
+
+**A11 token chip (finding 7).** daisyUI's `badge-sm` has a fixed height, so a long profile title wrapped inside the Profile chip and the border cut through the second line, which read as strikethrough (revoked). The chip is a single line (`max-w-[12rem]`, `overflow-hidden`, an inner `truncate`) with the full title on hover.
+
+**A12 Connect (finding 8).** `credentialCta` returned "Upgrade to client credential" for everything but revoked and expired, including `none`, so an installed client that never connected was told to upgrade. Now: `admin_key` is "Upgrade to client credential", `revoked` and `expired` are "Reconnect", `none` and `unknown` are "Connect" (`unknown` is a connected client the stat-only list could not classify; the connect dialog previews its existing entry anyway), and `client` has no button. The words are the `credential_cta` family of `labels.json`, read by Go, vitest and XCTest. macOS appends the ellipsis to button and menu titles, and the tray's no-credential row uses the row's own CTA instead of a fixed "Upgrade" item. Amends FR-042 and FR-048.
+
+**A13 radio layout (finding 9).** The unlayered daisyUI v5 shim in `main.css` gives `.form-control > .label` `justify-content: space-between`, which beats the layered Tailwind `justify-start`, so a radio's text was pushed to the far right. One unlayered rule after the shim, `.form-control > .label.justify-start { justify-content: flex-start }`, fixes every instance without markup churn.
diff --git a/specs/108-profiles-v3/spec.md b/specs/108-profiles-v3/spec.md
index 5f884a09b..2d6b9ae11 100644
--- a/specs/108-profiles-v3/spec.md
+++ b/specs/108-profiles-v3/spec.md
@@ -77,7 +77,7 @@ A user defines "Work Read-only" = GitHub, Linear, Notion, read tools only. Any s
 **Acceptance Scenarios**:
 
 1. **Given** a session under `work-readonly`, **When** it calls `retrieve_tools("create issue")`, **Then** no write/destructive/unannotated GitHub tool is returned, no `filesystem` tool is returned, and the response carries `hidden_by_profile ≥ 1` without naming any hidden tool. *(audit acceptance check 1)*
-2. **Given** the same session, **When** it calls `call_tool_write` with `github:create_issue`, **Then** the call is refused before any upstream I/O with `blocked by profile: github:create_issue is a write tool; this profile allows read tools only` — the same bytes whether the profile came from a pin, a binding, `anonymous_profile`, the URL or `set_profile`, so the refusal never tells a caller that it is pinned or to what (Spec 105 precedent, FR-013) — and an activity record is written with `status=blocked`, `block_reason=profile_tier`, `profile=work-readonly`. *(audit acceptance check 2, first half)*
+2. **Given** the same session, **When** it calls `call_tool_write` with `github:create_issue`, **Then** the call is refused before any upstream I/O with `blocked by profile: github:create_issue is a write tool; profile "Work Read-only" (work-readonly) allows read tools only` for a caller whose effective profile is its own (a pin, a binding, the URL or `set_profile`: research D39 narrows D27), while an anonymous caller keeps `... this profile allows read tools only` so the operator's `anonymous_profile` is never handed out (Spec 105 precedent, FR-013) — and an activity record is written with `status=blocked`, `block_reason=profile_tier`, `profile=work-readonly`. *(audit acceptance check 2, first half)*
 3. **Given** a GitHub tool with no annotations, **When** a session under `work-readonly` searches for it, describes it or calls it, **Then** it is absent from discovery, `describe_tool` returns the uniform not-found response, and a call is refused with `block_reason=profile_unannotated`; **When** the user classifies it `read` in the profile (any surface), **Then** it becomes visible and callable. *(audit acceptance check 3)*
 4. **Given** the enforcement-matrix `work-readonly` fixture (`servers: [github, notion]`, `max_tier: read`, `tools.deny: ["github:*secret*"]`, `tools.allow: ["notion:update_page", "github:get_secret_scanning_alert", "filesystem:read_text_file"]` — [contracts/enforcement-matrix.md](contracts/enforcement-matrix.md); note `notion` is in `servers`, unlike the minimal Independent Test profile above), **When** discovery runs, **Then** secret-matching tools are excluded (`denied_by_rule`) even though they are read tools **and** `github:get_secret_scanning_alert` is also matched by an allow rule (deny beats allow on overlap); `notion:update_page` is admitted even though it is a write tool; and the allow rule naming `filesystem` (outside `servers`) is saved with the FR-007 warning and ignored, so `filesystem:read_text_file` stays `server_not_in_profile` (FR-004).
 5. **Given** `code_execution: false` on the profile, **When** the session lists tools on `/mcp` or `/mcp/code`, **Then** `code_execution` is absent and a call to it is refused; **Given** `code_execution` enabled, **When** a script calls `call_tool('github','create_issue',…)`, **Then** the nested call is refused with the same profile refusal and recorded as a child record (`parent_id`) with `block_reason=profile_tier`.
@@ -211,7 +211,7 @@ A user who keeps `require_mcp_auth` off (for legacy clients) can still confine a
 **B. Enforcement (PV-A)**
 
 - **FR-010**: One predicate MUST compute the profile decision for (profile, tool identity, effective annotations): (1) server ∉ servers → `server_not_in_profile`; (2) matches deny → `denied_by_rule`; (3) matches allow → admitted; (4) unannotated and unclassified with policy `deny` → `unannotated_hidden`; (5) profile tier > `max_tier` → `above_tier_cap`; else admitted. Enforcement, `effective_tools`, "view as client", "Try it" and the access explainer MUST all call it.
-- **FR-011**: `retrieve_tools` MUST exclude profile-excluded tools **before** the result limit (Spec 105 FR-005 scope-aware search, never "search then drop"). Today's pre-limit predicate (`index.SearchToolsScoped(query, limit, inScope func(serverName string) bool)`, `internal/index/bleve.go`) sees only the server name, and `indexedToolVisible` runs on the already-cut result, so the policy cannot be evaluated there: the index API MUST be extended with a hit-level predicate that receives the hit's canonical `server:tool` identity (`SearchToolsAdmitted(query, limit, admit func(Hit) Admission)`, exhaustive paging as today). The index stores no annotations (`ToolDocument`/`readToolMetadata`, `internal/index/bleve.go`, carry none) and this spec adds none — no index-schema change, no reindex: the predicate, built by the server from the request's one resolution, obtains the hit's effective annotations through the **same identity seam every dispatch path uses** (`resolveExactToolIdentity` behind `profile.EffectiveAnnotations`, T013; an O(1) StateView lookup per hit, inside the SC-007 budget), so discovery and execution classify a tool from one source and a tool whose identity is not found is destructive (`IntrinsicTier(nil,false)`) and reports, per rejected hit, whether it failed on server scope or only on policy, so the limit is applied to admitted hits only and `hidden_by_profile` is counted in the same pass over the full match set. It MUST return `hidden_by_profile` = the number of query-matching tools on servers inside the caller's effective server scope that the tool policy excluded (reasons 2, 4, 5). It never names or describes a hidden tool and is identical across the Spec 105 two-fixture differential oracle. Presence is keyed on the profile, never on the query: `hidden_by_profile` is **present — possibly `0` — whenever the effective profile is non-legacy** (sets any of the six policy fields named in Definitions; `title`/`description` do not count), and **omitted** when there is no effective profile or it is legacy (byte-parity, SC-003). The companion `profile` field names the effective profile **only when the caller selected it** (`profile_source` `url` or `session`); for a base the caller did not choose (`pin`, `binding`, `anonymous`) it is omitted, so discovery never tells a caller that it is pinned or to what (Spec 105 precedent, research D27). A **dangling base** (FR-020 deny-all resolution for a pin, binding or `anonymous_profile` naming a profile no longer in config) and the FR-008a guard have no `ProfileConfig` to test and always count as **non-legacy**: `hidden_by_profile` = `0` (the effective server scope is empty) and `profile` is omitted (the source is a base).
+- **FR-011**: `retrieve_tools` MUST exclude profile-excluded tools **before** the result limit (Spec 105 FR-005 scope-aware search, never "search then drop"). Today's pre-limit predicate (`index.SearchToolsScoped(query, limit, inScope func(serverName string) bool)`, `internal/index/bleve.go`) sees only the server name, and `indexedToolVisible` runs on the already-cut result, so the policy cannot be evaluated there: the index API MUST be extended with a hit-level predicate that receives the hit's canonical `server:tool` identity (`SearchToolsAdmitted(query, limit, admit func(Hit) Admission)`, exhaustive paging as today). The index stores no annotations (`ToolDocument`/`readToolMetadata`, `internal/index/bleve.go`, carry none) and this spec adds none — no index-schema change, no reindex: the predicate, built by the server from the request's one resolution, obtains the hit's effective annotations through the **same identity seam every dispatch path uses** (`resolveExactToolIdentity` behind `profile.EffectiveAnnotations`, T013; an O(1) StateView lookup per hit, inside the SC-007 budget), so discovery and execution classify a tool from one source and a tool whose identity is not found is destructive (`IntrinsicTier(nil,false)`) and reports, per rejected hit, whether it failed on server scope or only on policy, so the limit is applied to admitted hits only and `hidden_by_profile` is counted in the same pass over the full match set. It MUST return `hidden_by_profile` = the number of query-matching tools on servers inside the caller's effective server scope that the tool policy excluded (reasons 2, 4, 5). It never names or describes a hidden tool and is identical across the Spec 105 two-fixture differential oracle. Presence is keyed on the profile, never on the query: `hidden_by_profile` is **present — possibly `0` — whenever the effective profile is non-legacy** (sets any of the six policy fields named in Definitions; `title`/`description` do not count), and **omitted** when there is no effective profile or it is legacy (byte-parity, SC-003). The companion `profile` field names the effective profile **only to a caller whose effective profile is its own** (`profile_source` `pin`, `binding`, `url` or `session`: its own credential or its own choice; research D39 narrows D27); it is omitted for `anonymous` (the operator's `anonymous_profile` is never handed out, Spec 105 precedent). The tool refusals of FR-013 follow the same rule through the same predicate. A **dangling base** (FR-020 deny-all resolution for a pin, binding or `anonymous_profile` naming a profile no longer in config) and the FR-008a guard have no `ProfileConfig` to test and always count as **non-legacy**: `hidden_by_profile` = `0` (the effective server scope is empty) and `profile` is omitted (it has no policy to name).
 - **FR-012**: `describe_tool` MUST apply the same visibility; excluded tools receive the uniform not-found response (Spec 105 FR-010).
 - **FR-013**: `call_tool_read|write|destructive` MUST refuse a profile-excluded tool on an in-scope server before any upstream I/O with the refusal text in [contracts/refusals.md](contracts/refusals.md), naming the tool, its tier and the reason but **never the profile's title or slug** — the text is byte-identical whatever the profile source (pin, binding, anonymous, URL, session), so it cannot confirm that a caller is pinned or to what (Spec 105 `set_profile` precedent; the operator sees the profile on the activity record and in the explainer) — and record `status=blocked` with `block_reason` ∈ {`profile_tier`, `profile_rule`, `profile_unannotated`} (plus `profile_code_execution`, `profile_management` for FR-014/FR-016 refusals). Out-of-scope servers keep the Spec 105 non-disclosing refusal. The Spec 105 token-permission and target-tier gates are unchanged and evaluated independently (all must pass).
 - **FR-014**: `code_execution` MUST be absent from `tools/list` and refused at call time on `/mcp`, `/mcp/code` and `/mcp/p/<slug>` when the profile's effective code execution is off (`code_execution: false`, or unset under a `read`/`write` cap — FR-003a), and refused on both REST routes into the shared handler (`POST /api/v1/tools/call`, FR-015, and `POST /api/v1/code/exec`, below); every nested `call_tool` inside a script MUST pass the FR-013 gate and write its child record with `parent_id`, whichever route started the script. `POST /api/v1/code/exec` (the CLI-client-mode route, `internal/httpapi/code_exec.go`) dispatches through `CallToolDirect("code_execution")` and has its own error classifier (`classifyCodeExecError`), so the profile refusal MUST reach it as a **typed** error (`errors.As`, the Spec 097 technique that classifier already uses): code execution hidden by the effective profile → `403` in the route's existing `CodeExecResponse` error shape (`{ok:false, error:{code:"PROFILE_BLOCKED", message:<refusals.md text>}, request_id}`) and a `status=blocked`, `block_reason=profile_code_execution` record, never the `500 EXECUTION_FAILED` fall-through. The same typed error formats as the `unknown tool: code_execution` text on `POST /api/v1/tools/call` and MCP (FR-015), so only `/code/exec` — whose sole purpose is code execution, so admitting that a profile disabled it discloses nothing — reports a profile refusal, and its message names neither the profile's title nor its slug (FR-013). When both the profile and the global `enable_code_execution` gate refuse, the profile answer wins (refusal precedence, [contracts/refusals.md](contracts/refusals.md)).
@@ -232,7 +232,7 @@ A user who keeps `require_mcp_auth` off (for legacy clients) can still confine a
 - **FR-024**: Connect (all surfaces) MUST mint a client credential bound to a chosen profile — default: the built-in "All servers" scope, represented as an empty `profile_pin` with `profile_mode=switchable`, which reproduces today's reach (research D5) — and write it via the client's existing carrier (header, `mcp-remote --header`, `?apikey=` for Codex). Connect MUST NOT write the instance admin API key in any mode. `--keyless` (and the UI equivalent) writes a credential-less entry only when `require_mcp_auth` is off, and the client is then unidentified. `--keyless` combined with a profile or mode is refused (`400 {error, field:"keyless"}`): an unidentified client has no binding. A build with no credential minter wired never falls back to the admin API key: with `require_mcp_auth` off it writes the legacy keyless entry, with it on it refuses.
 - **FR-025**: Existing entries holding the admin API key or no credential MUST be reported (`credential_state` ∈ `client`, `admin_key`, `none`, `revoked`, `expired`) and upgradable through an explicit, previewed reconnect; no automatic rewrite on upgrade. Because detection alone would leave the P4 exposure open indefinitely, every surface MUST also offer the **admin-key remediation**: (1) "Upgrade all clients holding the admin key" — one previewed bulk reconnect (`POST /clients/upgrade-admin-key-holders`, preview first, one `profile_change` `assign` per upgraded client, clients that fail are listed) that mints a client credential ("All servers" unless a profile is chosen) for every `admin_key` row — with a named profile the upgrade creates bindings and runs the FR-008a guard: every row receives the same binding, so the guard answers for all rows at once; the preview carries the would-be refusal (`guard: {code, bindings, fixes}`) and `apply` answers `409 binding_bypassable_without_auth` and mints nothing; (2) once no supported client reports `admin_key` — or when the operator accepts that the remaining ones will stop working — the prompt "Rotate the admin API key" linking to the documented rotation (set a new `api_key`, restart), which invalidates every remaining copy including in unmanaged clients. The `client_holds_admin_key` warning (and Spec 109's Needs-attention item built from it) persists until step 1 leaves no `admin_key` row; `mcpproxy doctor` `connect.admin_key_in_client_config` prints both steps. `credential_state` also takes the value `unknown` on the stat-only `GET /connect` listing (a config is not read there, Spec 075); the on-demand read maps a secret found in the entry as: the admin key → `admin_key`; a `mcp_cli_` secret → its record (`client` active, `revoked`, `expired`), **no record → `revoked`** (a rotated-away or deleted secret); any other value, including a pasted `mcp_agt_` token → `none`. Every comparison is constant-time and the value is never echoed. **108-f**: the stat-only `GET /clients` list reports `credential_state` from the token store when a `client-<id>` record exists (`client`/`revoked`/`expired`), else from the **last on-demand classification** persisted in `OnboardingState.ClientCredentialObserved` (written only on change by every on-demand read and deleted on disconnect), else `unknown` for a connected presence row and `none` otherwise; the row carries `credential_checked_at` when the state came from an observation, so a client holding the admin key stays visible across restarts without the list reading a config (Spec 075). `POST /clients/upgrade-admin-key-holders` previews (`preview[]` with masked credentials, a per-row and a combined `precondition_token`, `guard` when a named profile would be refused, `next_step: rotate_admin_api_key` when nothing holds the key) and applies (a stale token is `409 precondition_failed`; the whole-request FR-008a guard runs first and only when a named profile is given; then one forced connect per client bound to its own token; `{upgraded, failed, next_step?}`).
 - **FR-025a** (connect status is administrator-only): `credential_state` tells a reader which clients still hold the raw admin API key, the exposure FR-025 exists to close, and the preview (FR-024) discloses a client's profile and mode. Today `GET /connect`, `GET /connect/{client}` and `GET /connect/{client}/preview` are open to every authenticated caller, including scoped agent tokens (`internal/httpapi/server.go`: only the write/undo/disconnect verbs are gated; Spec 075 left the reads open). From 108-c, the PR that adds `credential_state`, these three reads MUST be administrator-only through `requireAdminRead` (a non-administrator caller, i.e. `!IsAdmin()` — agent tokens, pinned or not, and server-edition non-admin session principals — gets `403 {"error":"Admin credentials required to read client connection status"}` and no body data; the tray/socket and nil-context callers keep today's passthrough), the same rule Spec 109 applies to its sibling `GET /clients`. The route comment in `server.go` that says "Status/preview reads stay open" is replaced. **Cross-spec** (codex round 3): Spec 109-h, which adds the administrator-only `GET /clients`, gates the same three reads with the same middleware and message in its own PR (Spec 109 FR-030a), so no build serves an administrator-only `/clients` next to open connect reads that disclose the same client presence; 109-h and 108-c have no edge — whichever merges first adds the gate, the second keeps it (this spec's T030b and Spec 109's T125a pin the same `403`). `credential_state` is never added to a response a non-administrator can read; no other surface (SSE payloads, `GET /status`, MCP `upstream_servers`) carries it. Client credentials are already refused on every REST route (FR-023).
-- **FR-026**: Reassignment (profile or mode change) MUST be one service operation used by REST, CLI, MCP, Web UI and macOS; it updates the credential in the token store, clears the stored `set_profile` selection of every live session authenticated by that credential, emits `client.binding_changed` on the event bus, sends `notifications/tools/list_changed` to every live MCP session authenticated by that credential, writes a `profile_change` activity record, and never touches the client's config file. It applies only to a client whose `credential_state` is `client` (an active `kind=client` credential): for `none`, `admin_key`, `revoked` or `expired` it is refused on every surface with `409 {error: "client <id> has no active client credential; connect it with a profile first", code: "no_client_credential"}` and writes nothing — it never mints a credential implicitly (FR-025: upgrades happen only through the previewed connect); bulk moves skip such clients and report them in `skipped[]`. A reassignment that would make the binding bypassable is refused by the FR-008a guard (`409 binding_bypassable_without_auth`) before anything is written; a bulk move applies the guard per client and reports refused clients in `skipped[]` with that code. The Web UI and macOS disable the profile picker and lock toggle on such rows and offer "Upgrade to client credential" / "Reconnect" (the previewed connect with the chosen profile) instead. The precondition is read from the token store, not from a client config: an active (not revoked, not expired) `kind=client` record `client-<id>` allows the operation, anything else is `409 no_client_credential`. The admin-key-held case has no active record and is refused.
+- **FR-026**: Reassignment (profile or mode change) MUST be one service operation used by REST, CLI, MCP, Web UI and macOS; it updates the credential in the token store, clears the stored `set_profile` selection of every live session authenticated by that credential, emits `client.binding_changed` on the event bus, sends `notifications/tools/list_changed` to every live MCP session authenticated by that credential, writes a `profile_change` activity record, and never touches the client's config file. It applies only to a client whose `credential_state` is `client` (an active `kind=client` credential): for `none`, `admin_key`, `revoked` or `expired` it is refused on every surface with `409 {error: "client <id> has no active client credential; connect it with a profile first", code: "no_client_credential"}` and writes nothing — it never mints a credential implicitly (FR-025: upgrades happen only through the previewed connect); bulk moves skip such clients and report them in `skipped[]`. A reassignment that would make the binding bypassable is refused by the FR-008a guard (`409 binding_bypassable_without_auth`) before anything is written; a bulk move applies the guard per client and reports refused clients in `skipped[]` with that code. The Web UI and macOS disable the profile picker and lock toggle on such rows and offer "Connect" / "Upgrade to client credential" / "Reconnect" per state (FR-042; the previewed connect with the chosen profile) instead. The precondition is read from the token store, not from a client config: an active (not revoked, not expired) `kind=client` record `client-<id>` allows the operation, anything else is `409 no_client_credential`. The admin-key-held case has no active record and is refused.
 - **FR-027**: Cache provenance (Spec 105) MUST include the effective profile's policy fingerprint **and** the tool-tier generation — a monotonic counter bumped whenever any tool's effective annotations change (upstream re-list, `annotation_overrides` once #1323 lands) or a tool appears/disappears, published with the (index, snapshot) pair — because the policy fingerprint alone does not change when a tool goes from unannotated/read to destructive with no profile edit; a cached page produced under a different policy, pin, binding or tool-tier generation is refused by the existing rule. Editing, renaming or deleting a profile — through the service or by a hand edit picked up on config reload (detected by comparing each profile's policy fingerprint and server set between the previous and the new published snapshot) — MUST send `tools/list_changed` to every live session whose latest effective profile (FR-028) or base is that profile; changing `anonymous_profile` MUST send it to every live anonymous session. Enforcement never depends on the notification (it is re-evaluated per request). **108-f**: one observer on the config service's pre-publish hook computes, per published snapshot, the per-profile delta (policy fingerprint, sorted effective servers, existence) and whether `anonymous_profile` changed, and enqueues it for a single worker that waits until `currentConfig()` IS the new snapshot and then notifies each live session whose latest effective profile or derived base is in the delta (every anonymous session when `anonymous_profile` changed; `SessionInfo.Anonymous` is stamped at initialize); nothing is sent from inside the config mutex, and a service write and a hand edit take the same path. A delete-with-reassign also notifies the moved tokens' sessions, whose base changed without a profile changing.
 - **FR-028**: Sessions MUST record the authenticating token name and client id at initialize, and the latest effective profile and source, so session rows and reassignment notifications can find them.
 
@@ -257,7 +257,7 @@ A user who keeps `require_mcp_auth` off (for legacy clients) can still confine a
 
 - **FR-040**: A **Profiles** page (route `/profiles`, `/profiles/:name`; its sidebar entry and placement — Connect group — belong to Spec 109's sidebar, which shows the entry once the route exists) MUST list profiles as cards with tools by tier, unannotated hidden count, used by (clients, tokens), calls and blocked calls in 24 h, and links Tools · Activity · Clients · Tokens with `?profile=`; plus the built-in "All servers" card describing unbound and anonymous callers and showing the anonymous status (`anonymous_profile`, or "unconfined") with a link to Settings.
 - **FR-041**: The profile **editor** MUST offer servers, max tier, unannotated handling, a per-tool table (tier, in-scope reason, allow/deny toggle, classify for unannotated), code execution, management tools, switchable-to, title/description, "Assigned to" with Assign, "Try it" (FR-034 `try`), and Rename (FR-034 `rename`, showing the pins, bindings and `switchable_to` references it will move); deleting shows affected clients/tokens and requires a reassignment target; `?focus=server:tool` scrolls to and highlights that tool.
-- **FR-042**: **Spec 109's Clients page** (shell, tabs, presence rows, `ClientConnectList`, sidebar entry and the row deep links Activity · Sessions · Tools it sees · Usage with `?client=` — Spec 109-h/109-k) MUST gain, from this spec: credential state, 24 h blocked calls, the profile chip (dropdown + lock toggle + source), the profile + mode fields and masked credential in the connect flow (added to whichever connect component exists when this spec's PR merges — `ConnectModal.vue` before 109-h, 109's `ClientConnectList.vue` after), "Other client" (custom id → snippet + credential shown once), Rotate, Forget, bulk "Move all clients using X to Y", "Upgrade all clients holding the admin key" (FR-025), and the binding-warnings banner (`anonymous_denied_by_binding_guard`, `client_holds_admin_key`, `client_token_name_conflict`, `client_rotation_pending`, `client_credential_expiring`, `profile_missing`). The two guard fix buttons (`require_mcp_auth`, `set_anonymous_profile`) **only navigate** to Settings -> Security, where the operator sees and confirms the change; they never write config themselves. A row with no client credential (`none`, `admin_key`, `revoked`, `expired`, `unknown`) shows the chip and lock switch disabled with a call to action per state ("Upgrade to client credential", or "Reconnect" for `revoked`/`expired`) that opens the connect dialog on that client. Settings → Security MUST offer an "Anonymous callers" profile picker that sets `anonymous_profile` (`PATCH /config`, FR-030 `change=anonymous`) with the binding-bypass explanation; the banner's fix action links to it (parity row 23).
+- **FR-042**: **Spec 109's Clients page** (shell, tabs, presence rows, `ClientConnectList`, sidebar entry and the row deep links Activity · Sessions · Tools it sees · Usage with `?client=` — Spec 109-h/109-k) MUST gain, from this spec: credential state, 24 h blocked calls, the profile chip (dropdown + lock toggle + source), the profile + mode fields and masked credential in the connect flow (added to whichever connect component exists when this spec's PR merges — `ConnectModal.vue` before 109-h, 109's `ClientConnectList.vue` after), "Other client" (custom id → snippet + credential shown once), Rotate, Forget, bulk "Move all clients using X to Y", "Upgrade all clients holding the admin key" (FR-025), and the binding-warnings banner (`anonymous_denied_by_binding_guard`, `client_holds_admin_key`, `client_token_name_conflict`, `client_rotation_pending`, `client_credential_expiring`, `profile_missing`). The two guard fix buttons (`require_mcp_auth`, `set_anonymous_profile`) **only navigate** to Settings -> Security, where the operator sees and confirms the change; they never write config themselves. A row with no client credential (`none`, `admin_key`, `revoked`, `expired`, `unknown`) shows the chip and lock switch disabled with a call to action per state ("Connect" for `none` and `unknown`, a client with no mcpproxy entry; "Upgrade to client credential" for `admin_key`; "Reconnect" for `revoked`/`expired`; the words are the `credential_cta` family of `labels.json`, research D39) that opens the connect dialog on that client. Settings → Security MUST offer an "Anonymous callers" profile picker that sets `anonymous_profile` (`PATCH /config`, FR-030 `change=anonymous`) with the binding-bypass explanation; the banner's fix action links to it (parity row 23).
 - **FR-043**: The token dialog MUST offer Profile (selector incl. "None — legacy scope") and Expiry; the legacy server/permission fields appear only under "Legacy scope (advanced)" and read-only on tokens that have them. A client-credential row (`kind=client`) is read-only in the token list ("Client credential for <client> - manage from Clients"): rotation goes through the staged path on the Clients page, so Regenerate and Delete are not offered there. A revoked token's name stays reserved for activity history (revocation is a soft delete, `activity.token_name` references it): `POST /tokens` with that name answers `409` with the revoked-holder text.
 - **FR-044**: The header `ProfileSwitcher` MUST be removed and replaced by the "Viewing: profile · client" chip, placed in **Spec 109's reserved header slot** (109-i) and reading/writing **Spec 109's `useScopeQuery()`** state (109-k), visibly labelled as a view filter, hidden when neither profiles nor bound clients exist. A sticky parameter the current page does not register (for example `client` on Servers) is shown dimmed with the tooltip "Not applied on this page". The chip component is this spec's; the header layout and the composable are Spec 109's.
 - **FR-045**: Every Web UI page this spec adds or extends (Profiles, the profile editor, the Clients-row additions, the Tools view-as rows, the Activity attribution chips and blocked-row actions, the Viewing chip) MUST read and write scope parameters only through **Spec 109's `useScopeQuery()`** (Spec 109 FR-080) and link only through **Spec 109's link map** (Spec 109 contracts/url-filter-contract.md, which includes the rows that open this spec's pages: profile cards, client rows, blocked activity rows, view-as "Why?"). This spec does not define the composable, the parameter table or the link map; it supplies the backend filters and the `scope_filters` availability signal (FR-031). One exception, because the link map carries a query only: the profile editor is `/profiles/:name`, a path parameter, so it is linked through the single named-route helper `utils/profileRoute.ts` `profileEditorLink(name, focus?)` (108-j), never by assembling the route in a view.
@@ -266,7 +266,7 @@ A user who keeps `require_mcp_auth` off (for legacy clients) can still confine a
 **G. macOS app parity**
 
 - **FR-047**: The macOS main window MUST add the **Profiles** view (list + editor with the FR-041 fields, Try it, Assigned to, Rename, delete with reassignment; its sidebar entry and group are Spec 109's) and extend **Spec 109's `ClientsView`** (109-h) with the FR-042 additions (profile picker, lock toggle, credential state, Connect with profile, Other client, Rotate, Forget, bulk move, admin-key upgrade, binding-warnings banner). A fix button on a warning, a guard refusal or an explainer step navigates (to Settings, the editor, a row, the connect sheet) and never mutates configuration. **108-retro-mac**: Try it also works on a new, never-saved profile (the draft is sent to `POST /profiles/try` without a name, and a new profile has no tool table). "Changed elsewhere — Reload" discards the unsaved draft and adopts the saved version. Assign states the wanted mode and sends profile and mode in one binding change, so it can lock or unlock a client already on the profile. Forget always reports its outcome, and a `disconnect_error` is shown as "credential revoked, config entry not removed". In the admin-key upgrade, changing the profile invalidates the preview, and Apply applies exactly what was previewed. Saving Anonymous callers never discards other unsaved Settings edits.
-- **FR-048**: The tray MUST replace the "Profile:" submenu with a "Clients" submenu: one row per client that holds a client credential or is connected, showing `name — profile (🔒 when locked)`, whose submenu lists profiles (checkmark on current) and Lock/Unlock; choosing one calls the FR-026 operation (Lock is disabled on All servers, where only `switchable` is valid; a client without a client credential shows only "Upgrade to client credential…"). The glance "Clients" section rows deep-link to Activity filtered by `client`.
+- **FR-048**: The tray MUST replace the "Profile:" submenu with a "Clients" submenu: one row per client that holds a client credential or is connected, showing `name — profile (🔒 when locked)`, whose submenu lists profiles (checkmark on current) and Lock/Unlock; choosing one calls the FR-026 operation (Lock is disabled on All servers, where only `switchable` is valid; a client without a client credential shows only its one call to action: "Connect…", "Upgrade to client credential…" for an admin-key holder or "Reconnect…" for a dead credential). The glance "Clients" section rows deep-link to Activity filtered by `client`.
 - **FR-049**: Create Token sheet MUST gain Profile and Expiry (legacy fields under a disclosure); the Clients and Agent Tokens lists MUST filter by profile (and client / token) through Spec 109's `ScopeFilter` pages; Activity view MUST show the Profile, Client and Token filters that **Spec 109's macOS `ScopeFilter`** (109-k) already carries hidden, un-hidden by the `scope_filters` signal (FR-031), plus attribution columns; Home's usage summary and sessions list (Spec 109-d renames the macOS Dashboard to Home, `HomeView.swift`) MUST accept the same filters and show client/profile/source columns; Servers view MUST filter by profile; Tools view MUST gain "View as client/profile"; Settings MUST offer the `anonymous_profile` picker; the explainer MUST be available as a sheet.
 - **FR-050**: macOS models MUST decode the shared contract fixtures (FR-052) in `MCPProxyTests`.
 
diff --git a/specs/108-profiles-v3/tasks.md b/specs/108-profiles-v3/tasks.md
index e7b271b8b..bc8d8ff15 100644
--- a/specs/108-profiles-v3/tasks.md
+++ b/specs/108-profiles-v3/tasks.md
@@ -328,6 +328,16 @@ Go only, after 108-l and retro-go (no UI).
 
 - [x] T147 [US1] #1458 item 1: `ApplyConfig` and `ReloadConfiguration` reconcile the per-profile indexes when `profiles` or `anonymous_profile` change (single owner; the funnel's own call removed). A stale index only hid in-scope tools (`retrieve_tools` re-admits every hit against the live scope), it never exposed one. Tests: `TestApplyConfig_ProfileServersEditRebuildsProfileIndexImmediately`, `…ProfileCreateRenameDeleteReconcileImmediately`, `…AnonymousProfileOnlyEditIsHarmless`, `TestProfileIndexInputsChanged`, `TestReloadConfiguration_ProfileEditRebuildsProfileIndexImmediately`, `TestRetrieveTools_ProfileWidenedByHandEditIsSearchableImmediately`, `…ByRawApply…`, `…ByConfigPatch…`, `TestRetrieveTools_ProfileNarrowedStaleIndexNeverExposes`
 
+## Phase 16: PR demo-ux-fixes — gaps found in the live Web UI demo (2026-10-02)
+
+Four findings from a live demo of `main` at `b3191a059`; Spec 109's T160–T165 own the catalog, palette and Settings ones. Decisions: research D39.
+
+- [x] T148 [US1] #4 the tool refusals name the caller's OWN profile (narrows D27): `profileDisclosedTo`, `profileRefusalSubject` and `profileToolPolicyRefusal` in `internal/server/profile_refusals.go`; pin, binding, url and session are told `profile "<title>" (<slug>)`, anonymous and dangling callers keep today's text; `retrieve_tools` returns `profile` for the same sources through the same predicate. Golden `internal/profile/testdata/contract/tool_refusals.json` read by `internal/server/profile_refusals_test.go`, the MCP, REST and replay tests in `internal/server/call_tool_profile_v3_test.go` and `internal/server/rest_profile_v3_test.go`, `internal/httpapi/tool_refusal_golden_test.go` and `cmd/mcpproxy/activity_blocked_refusal_test.go`
+- [x] T149 [US2] #7 the token Profile chip stays on one line with an ellipsis and the full title on hover: `frontend/tests/unit/agent-tokens-profile-chip.spec.ts`
+- [x] T150 [US2] #8 a client row with no mcpproxy entry offers Connect, not Upgrade (FR-042, FR-048): the `credential_cta` family of `internal/profile/testdata/contract/labels.json`, read by `internal/httpapi/profiles_v3_parity_test.go`, `frontend/tests/unit/profiles-enums-labels.spec.ts`, `frontend/tests/unit/client-binding-controls.spec.ts`, `ProfilesEnumsLabelsTests.swift`, `ClientBindingModelTests.swift` and `ClientsTrayMenuTests.swift`
+- [x] T151 [US2] #9 radio and checkbox labels sit next to their control: one unlayered rule in `frontend/src/assets/main.css`, pinned by `frontend/tests/unit/form-control-label-shim.spec.ts` and the Playwright sweep `e2e/web-ui-sweep/demo-ux-fixes.spec.ts`
+- [x] T152 [US2] Docs and bookkeeping for T148–T151: `docs/features/profiles.md`, `contracts/refusals.md`, `contracts/mcp-tools.md`, FR-011, FR-042, FR-048, `parity-matrix.json`, research D39
+
 ---
 
 ## Dependencies & Execution Order
@@ -363,4 +373,4 @@ MVP = 108-a + 108-b (US1 discovery via config + `/mcp/p/<slug>` or pinned tokens
 
 ## Task Count
 
-181 tasks: setup 3 · a 14 · b 13 · c 24 · d 19 · e 14 · f 17 · g 8 · h 4 · i 16 · j 11 · k 21 · l 9 · retro-go 7 · fix-1458 1 (counted mechanically; the 108-l plan carries the counting script). History: codex round 4 added T005a; codex round 3 added T046c, T052b; codex round 1 added T004a, T016a, T027a, T027b, T028a, T030a, T033a, T040a, T055a; 108-j's composable/link-map tasks were merged into Spec 109-k and replaced by profile-specific UI tasks; 108-j added T106a, T107a, T108a, T109a; the post-merge macOS and Go review fixes added to k and retro-go; 108-l added T124a, T126a, T127; fix-1458 added T147.
+186 tasks: setup 3 · a 14 · b 13 · c 24 · d 19 · e 14 · f 17 · g 8 · h 4 · i 16 · j 11 · k 21 · l 9 · retro-go 7 · fix-1458 1 · demo-ux-fixes 5 (counted mechanically; the 108-l plan carries the counting script). History: codex round 4 added T005a; codex round 3 added T046c, T052b; codex round 1 added T004a, T016a, T027a, T027b, T028a, T030a, T033a, T040a, T055a; 108-j's composable/link-map tasks were merged into Spec 109-k and replaced by profile-specific UI tasks; 108-j added T106a, T107a, T108a, T109a; the post-merge macOS and Go review fixes added to k and retro-go; 108-l added T124a, T126a, T127; fix-1458 added T147; demo-ux-fixes added T148–T152.
diff --git a/specs/109-ux-navigation-consistency/contracts/cli.md b/specs/109-ux-navigation-consistency/contracts/cli.md
index 55d2d4ea2..976daeef3 100644
--- a/specs/109-ux-navigation-consistency/contracts/cli.md
+++ b/specs/109-ux-navigation-consistency/contracts/cli.md
@@ -13,11 +13,11 @@ Every new command honours the global `-o table|json|yaml`, `--json`, `MCPPROXY_O
 | `mcpproxy review reject <server> [--tools a,b] [--yes]` | no `--tools` → `security/reject`; `--tools` → `tools/block` | `Rejected …` |
 | `mcpproxy client list` | `GET /clients` | `CLIENT  STATE  LAST SEEN  SESSIONS  CALLS 24H  CONFIG PATH` (`display_path`). Spec 108 **appends** `CREDENTIAL  PROFILE  MODE  SOURCE  BLOCKED 24H` and `--profile`; it never removes or reorders these columns (`CONFIG PATH` stays) |
 | `mcpproxy client show <id>` | `GET /clients/{id}` | detail block incl. `reload_hint`, full `config_path`, sessions |
-| `mcpproxy catalog search <query> [--source id] [--limit n]` | `GET /catalog/search` | `SOURCE  ID  TITLE  TRANSPORT  ADDED`, then `Found N results. Add one with: mcpproxy catalog add <source>/<id>`; unavailable sources after the table as `⚠ <source> unavailable: <reason>`; `-o json` carries `publisher`, `verified`, `official` and `popularity`. The retained compatibility flag `--tag` accepts only an empty value; a non-empty value exits with an error because catalog entries carry no tags. |
+| `mcpproxy catalog search <query> [--source id] [--limit n]` | `GET /catalog/search` | `SOURCE  ID  TITLE  TRANSPORT  ADDED`, then `Found N results. Add one with: mcpproxy catalog add <source>/<id>`; unavailable sources after the table as `⚠ <source> unavailable: <reason>` (with `; showing matches from its cached list` when its cached listing answered, and those rows read `<source> (cached)` in SOURCE); `-o json` carries `from_cache` and `unavailable[].fallback`, `cached_at`; `-o json` carries `publisher`, `verified`, `official` and `popularity`. The retained compatibility flag `--tag` accepts only an empty value; a non-empty value exits with an error because catalog entries carry no tags. |
 | `mcpproxy catalog show <source>/<id>` | Spec 070 find | detail incl. required inputs |
 | `mcpproxy catalog add <source>/<id> [--name] [--env K=V] [--enabled]` | Spec 070 add | `Added <name> to MCPProxy (quarantined for review)`. Values that must stay out of the config use `upstream add --secret-env K=V --secret-header 'N: v'` (FR-065, parity row 17) |
 
-With no query (`mcpproxy catalog search ""` or `catalog search --browse`), the output prints the `official` and `popular` sections.
+With no query (`mcpproxy catalog search ""` or `catalog search --browse`), the output prints the `Popular:` section first when it has entries, then `Official:`; an empty section is not printed.
 
 ## Changed commands
 
diff --git a/specs/109-ux-navigation-consistency/contracts/mcp-tools.md b/specs/109-ux-navigation-consistency/contracts/mcp-tools.md
index 77472583a..66a2957b1 100644
--- a/specs/109-ux-navigation-consistency/contracts/mcp-tools.md
+++ b/specs/109-ux-navigation-consistency/contracts/mcp-tools.md
@@ -6,7 +6,7 @@ Small by design. MCP is a client surface with per-tool authorization. Search and
 |---|---|---|---|
 | `upstream_servers` `list` | each server's `health` gains `status`, `usable`, `actions` (shared struct) | 109-c | list-output goldens only (the tool schema is unchanged) |
 | `quarantine_security` `inspect_quarantined`, `inspect_tools` | each tool gains `tier`, `annotations`, `scan_verdict` with the names and values of `GET /servers/{id}/review`; changed tools gain `previous` + `diff`; any server `command`/`url` in the output comes from the same redacted review composer (FR-021), never raw config. **The live inspection is kept**: when the composer reports `definitions_captured: false`, `inspect_quarantined` still performs today's temporary-exemption connect + `ListTools()` (`internal/server/mcp.go` ~4879–5018) and decorates those live tools with `tier` from `contracts.AnnotationTier` over their live annotations and `scan_verdict: "not_scanned"`, plus `definitions_source: "live"` (`"captured"` otherwise) — it never degrades to the composer's `tools: []` | 109-f | output goldens only |
-| `search_servers` | `registry` becomes optional (omitted = all sources through `registries.SearchAll`); results gain `title`, `publisher`, `verified`, `official`, `popularity`, `source`, in the FR-060 order; descriptions say "catalog" and "catalog source". The retained `tag` parameter accepts only an empty value; a non-empty value returns a visible error because catalog entries carry no tags. | 109-j | **schema golden changes** (`registry` no longer `required`; description text). Declared in the 109-j PR body |
+| `search_servers` | `registry` becomes optional (omitted = all sources through `registries.SearchAll`); results gain `title`, `publisher`, `verified`, `official`, `popularity`, `source`, in the FR-060 order, and `from_cache: true` when a source's cached listing answered (its `unavailable[]` entry then carries `fallback` and `cached_at`, D35); descriptions say "catalog" and "catalog source". The retained `tag` parameter accepts only an empty value; a non-empty value returns a visible error because catalog entries carry no tags. | 109-j | **schema golden changes** (`registry` no longer `required`; description text). Declared in the 109-j PR body |
 | `list_registries` | description wording "catalog sources" | 109-j | schema golden (description text) |
 
 ## Unchanged, deliberately
diff --git a/specs/109-ux-navigation-consistency/contracts/rest-api.md b/specs/109-ux-navigation-consistency/contracts/rest-api.md
index 3af5564a1..5dcc6f42d 100644
--- a/specs/109-ux-navigation-consistency/contracts/rest-api.md
+++ b/specs/109-ux-navigation-consistency/contracts/rest-api.md
@@ -247,12 +247,13 @@ No new route: the Web UI and macOS write each secret with the existing `POST /se
      "required_inputs": [{"name": "GITHUB_TOKEN", "secret_like": true}], "added": false}   // secret_like = the registry's isSecret OR the research D13 secret-like-name rule (data-model §9)
   ],
   "sections": null,
-  "unavailable": [{"source": "smithery", "reason": "timeout after 5s"}]
+  "unavailable": [{"source": "smithery", "reason": "timeout after 5s", "fallback": "cached_listing", "cached_at": "2026-10-02T10:00:00Z"}]
 }
 ```
 
 - Result objects are the `CatalogResult` **DTO** (data-model §9), built from the internal `CatalogHit` by `toCatalogResult`; the Spec 070 `registries.ServerEntry` JSON (`url`, `installCmd`, `registry`, `required_inputs[].secret`) is not renamed and keeps serving `GET /registries/{id}/servers` and MCP `search_servers` unchanged (codex round 3: embedding `ServerEntry` could not produce this example). Golden test T101a.
-- Empty `q` → `results: []`, `sections: {"official": [...], "popular": [...]}` (≤ 12 each).
+- Empty `q` → `results: []`, `sections: {"official": [...], "popular": [...]}` (≤ 12 each). The keys are not ordered; every surface renders Popular first when it is non-empty, then Official (curated reference servers first, then round-robin across sources, never popularity-ordered; research D35 A9).
+- **Cached fallback (D35).** A source whose live fetch fails (timeout or any error except a missing API key) is answered from its per-source listing cache when that holds a listing refreshed within 24 h: the hits match the trimmed query as a case-insensitive substring of name, description or id, carry `from_cache: true`, and rank like any other hit. The source stays in `unavailable[]` with `fallback: "cached_listing"` and `cached_at`, so a consumer that only reads `unavailable[]` is unchanged. A source with nothing cached has neither field. The cache is in memory, so a daemon restart empties it.
 - Ranking (pure `registries.Rank`): `official` desc, `verified` desc, popularity desc (missing = 0), relevance desc, `title` asc, `id` asc.
 - `added: true` when a configured server has `source_registry_id == source` **and** the same install target (`install.url`, or the command + args) as this result → surfaces render "Added ✓ · Open". The config does not store the registry's own server `id`, so `id` is not part of the join (data-model.md §9). A manually added server matches on the install target alone. When exactly one matching server is visible to the caller, the optional `added_server_name` identifies it; clients use that authoritative name before any comparison with redacted `GET /servers` URL/argv fields. It is omitted for ambiguous matches.
 - Adding stays `POST /registries/{id}/servers/{serverId}/add` (Spec 070), always quarantined.
diff --git a/specs/109-ux-navigation-consistency/data-model.md b/specs/109-ux-navigation-consistency/data-model.md
index 9a88e3814..4bfe8b30d 100644
--- a/specs/109-ux-navigation-consistency/data-model.md
+++ b/specs/109-ux-navigation-consistency/data-model.md
@@ -157,6 +157,8 @@ type CatalogHit struct {
     Entry      ServerEntry  // existing Spec 070 type; its JSON (url, installCmd, registry, required_inputs[].secret) is NOT changed
     Source, Title, Publisher string
     Verified, Official       bool
+    Curated    bool          // hit of the built-in reference source; listed first in the Official section (D35 A9)
+    FromCache  bool          // served from the source's cached listing because its live fetch failed (D35 A1/A2)
     Popularity *Popularity   // {stars?, installs?}
 }
 
@@ -176,7 +178,9 @@ type CatalogResult struct {
     SourceCodeURL  string          `json:"source_code_url,omitempty"`
     Added          bool            `json:"added"`
     AddedServerName string          `json:"added_server_name,omitempty"` // unique caller-visible installed match; omitted when ambiguous
+    FromCache       bool            `json:"from_cache,omitempty"`        // answered from the source's cached listing (D35)
 }
+// unavailable[] entry: {source, reason, fallback?: "cached_listing", cached_at?: RFC 3339}
 type SearchOptions struct{ SourceTimeout time.Duration } // default 5 s; only tests set another value (T109a)
 func SearchAll(ctx, q, tag string, limit int, opts SearchOptions) (results []CatalogHit, sections *CatalogSections, unavailable []SourceError)
 func Rank(a, b CatalogHit, q string) bool // pure, deterministic
diff --git a/specs/109-ux-navigation-consistency/parity-matrix.json b/specs/109-ux-navigation-consistency/parity-matrix.json
index 5db827693..b15377c02 100644
--- a/specs/109-ux-navigation-consistency/parity-matrix.json
+++ b/specs/109-ux-navigation-consistency/parity-matrix.json
@@ -767,7 +767,9 @@
           ],
           "tests": [
             "vitest:frontend/tests/unit/add-server-catalog.spec.ts",
-            "vitest:frontend/tests/unit/catalog-order-parity.spec.ts"
+            "vitest:frontend/tests/unit/catalog-order-parity.spec.ts",
+            "vitest:frontend/tests/unit/catalog-cached-fallback.spec.ts",
+            "vitest:frontend/tests/unit/catalog-browse-order.spec.ts"
           ]
         },
         "macos": {
@@ -786,7 +788,9 @@
             "cmd:catalog search"
           ],
           "tests": [
-            "go:cmd/mcpproxy/catalog_order_parity_test.go#TestCatalogOrderParityCLI"
+            "go:cmd/mcpproxy/catalog_order_parity_test.go#TestCatalogOrderParityCLI",
+            "go:cmd/mcpproxy/catalog_cached_fallback_test.go#TestCatalogCachedFallbackParityCLI",
+            "go:cmd/mcpproxy/catalog_cmd_test.go#TestRenderCatalogSearch_PopularBeforeOfficialAndEmptySectionHidden"
           ]
         },
         "mcp": {
@@ -795,7 +799,8 @@
             "mcp:search_servers"
           ],
           "tests": [
-            "go:internal/server/spec109_catalog_order_test.go#TestSearchServers_CatalogOrderMatchesTheRESTGolden"
+            "go:internal/server/spec109_catalog_order_test.go#TestSearchServers_CatalogOrderMatchesTheRESTGolden",
+            "go:internal/server/spec109_catalog_cached_fallback_test.go#TestSearchServers_CachedFallbackMatchesTheRESTGolden"
           ],
           "fields": [
             "search"
@@ -807,7 +812,8 @@
             "rest:GET /api/v1/catalog/search"
           ],
           "tests": [
-            "go:internal/httpapi/spec109_catalog_order_test.go#TestCatalogOrderParity_RESTWritesTheGolden"
+            "go:internal/httpapi/spec109_catalog_order_test.go#TestCatalogOrderParity_RESTWritesTheGolden",
+            "go:internal/httpapi/spec109_catalog_cached_fallback_test.go#TestCatalogCachedFallback_RESTWritesTheGolden"
           ]
         }
       }
@@ -1358,7 +1364,8 @@
             "component:frontend/src/components/CommandPalette.vue"
           ],
           "tests": [
-            "vitest:frontend/tests/unit/command-palette.spec.ts"
+            "vitest:frontend/tests/unit/command-palette.spec.ts",
+            "vitest:frontend/tests/unit/command-palette-directory.spec.ts"
           ]
         },
         "macos": {
diff --git a/specs/109-ux-navigation-consistency/quickstart.md b/specs/109-ux-navigation-consistency/quickstart.md
index c40a5cb08..6e0b4ec21 100644
--- a/specs/109-ux-navigation-consistency/quickstart.md
+++ b/specs/109-ux-navigation-consistency/quickstart.md
@@ -126,6 +126,7 @@ Every REST call below carries the admin key unless it names another credential:
 | 109-k | Approve filesystem, make 3 real calls, load `/activity`, `/activity?view=system`, `/sessions?session=x`, `/usage` bar click, `/tools?server=notes&tier=read` via URL; macOS Activity; `mp activity list --view calls --from -1h`; `curl -H "X-API-Key: $KEY" "$M/api/v1/activity?profile=x&client=cursor"` and `.../sessions?token=t`; `curl -H "X-API-Key: $KEY" "$M/api/v1/activity/usage?agent=qa109"`; `curl -H "X-API-Key: $KEY" $M/api/v1/status`; click the Tools row "Calls" link of `filesystem:read_0` | default view shows 3 calls; 1 folded system row; URL round-trips; no unfiltered fetch in the network log; savings tile says "estimate" before the first retrieve; without Spec 108-e both curls return `400 unsupported_scope_filter` (never unfiltered rows) and status has no `features.scope_filters` (with 108-e merged: `200`, filtered, and the field lists all three); `?agent=` still works on `/activity` while `/activity/usage?agent=qa109` answers `400 unsupported_scope_filter` naming `agent` until 108-e (never unfiltered totals); the Tools "Calls" link lands on `/activity?view=calls&tool=filesystem:read_0` showing the `read_0` calls, and its network log shows `server=filesystem&tool=read_0` |
 | 109-m | Run every story's independent test on one instance across all four surfaces: US1 attention order on Web, macOS tray and Home, `mp attention`, `status` and `doctor`; US2 the 14-tool review on Web, macOS, `mp review show --full` and MCP `inspect_quarantined`, then approve with `--except`; US3 Clients rows and Connect in at most two clicks; US4 the status word per fixture state on card, detail, macOS row, tray first line and `mp upstream list`; US5 `github` in Web, macOS, `mp catalog search github -o json` and MCP `search_servers`; US6 header widths 1440/1100/900/390 in both themes, ⌘K, redirects and deep-link network logs; US7 the wizard in a scratch HOME. Then SC-010 (the A1 fixture), the SC-011 benchmark (`go test -run XXX -bench Attention -benchtime 2000x ./internal/runtime/`) and the release-gate sweep (`MCPPROXY_BINARY_PATH=$PWD/mcpproxy MCPPROXY_FIXTURE_PATH=<mcpfixture> ./scripts/run-web-smoke.sh`) | SC-001 to SC-012; every parity test green; each story's independent test passes on all four surfaces |
 | 109-l | The "before Spec 108" half cannot run at 109-l's own merge point (its prerequisites include 108-f, which follows 108-e, so `features.scope_filters` is already listed); it is run on the build right after 109-k, before any Spec 108 PR — `/activity?client=cursor` keeps the parameter in the URL but shows no chip and sends no `client` to REST — and at every later build by T111/T116 with a status stub. At 109-l (Spec 108-f/i/j/k merged): bind Cursor, then use the Clients row links, the Viewing chip in the header slot, and hand-edit `anonymous_profile` away so Spec 108's binding guard warns | the hidden parameters and links appear without code changes once `features.scope_filters` is present; `?client=cursor` links work; the attention list shows `anonymous_denied_by_binding_guard` first and `client_holds_admin_key` for a seeded admin-key config (open `GET /clients/cursor`, or the Clients row, once before expecting `client_holds_admin_key`: the item needs an observed credential state, FR-093); the expanded Clients row shows Activity · Sessions · Tools it sees · Usage, the Tokens tab shows Activity · Usage on agent rows, and `/ui/servers?profile=<p>` lists only that profile's servers with a removable chip; all at 900 and 390 px |
+| demo-ux-fixes (109 half) | Scratch config adds `allow_private_registry_fetch`, a `slowreg` registry served by a node stub that sleeps 8 s while `$RUN/slow` exists, and no `quarantine_enabled`; prime Web Add server -> Catalog (empty query), `touch $RUN/slow`, search "github" on Web, `mp catalog search github -o json`, MCP `search_servers {search:"github"}` and macOS Catalog; Settings -> Security; Settings header; ⌘K "work", "cursor", "qa"; Catalog with an empty query on a cold and a warm popularity cache | The `slow/github-a` hit appears in the same order on every surface and is marked "From cached list" / `from_cache` / `(cached)`, the notice reads "slowreg: live search unavailable (timeout after 5s); showing matches from its cached list", the answer returns in at most 5.5 s, and a second search after `rm $RUN/slow` has no marker; the Quarantine toggle is ON and agrees with the posture chip, toggling it asks for confirmation and PATCHes `quarantine_enabled:false` only; the header names "Save changes"; the palette shows one `/profiles`, `/clients` and `/tokens` request after the first keystroke and none on open, and Enter lands on the profile editor, `/clients?client=cursor` and `/clients?tab=tokens&token=qa-ro`; cold Official starts with filesystem, memory, everything, then alternates official and docker, warm shows Popular above Official (Web, macOS and `mp catalog search`) |
 | 109-leftovers | `mp tools list --help`, `mp activity export --help`, `mp activity export -o json`, `mp --help`; edit `$TD/notes.json` (description → `changed`, add `search_notes_2` → `pending`) and open Web `/tools`; Web `/clients` → Connect N clients (scratch HOME with `.cursor/mcp.json`, `.codex/config.toml`); `initialize` with `clientInfo.name: "cursor"` while telemetry is off, restart the core; macOS Servers + tray + detail; `website/build/cli/review-commands/index.html` | `--approval` help names the three labels; export help explains `--format` vs `-o`, and `-o json` still fails with `unknown shorthand flag: 'o'`; Tools rows read "Changed, needs review" / "New, needs review" with a Review link to `/review/notes?change=…`, approved rows have none; the bulk preview lists each client with its `~/…` path, entry and backup notice, no `POST /connect/*` before Confirm, and Cancel leaves both files byte-identical; `client_last_seen.cursor` is set and survives the restart, a reconnect clears it until the next `initialize`; a connected server needing sign-in reads "Sign-in required" (never "Connected") in the row, the tray submenu's first line and the detail header; the review CLI page exists and matches `mp review list` output |
 
 For **109-h**, also inspect the API payload and network requests: `GET /clients` must carry `active_sessions` counts and no `sessions` key on any row; expanding Claude Code must issue one `GET /clients/claude-code` and show its session rows, with no detail fetch for collapsed rows. The personal-edition sidebar must already link to Clients in its current grouping. Seed an unknown `clientInfo.name` such as `zed`: the observed `other:zed` row appears separately from the always-available manual "Other client" snippet, which does not appear in the API payload. After Cursor has been seen, successfully reconnect it; before its next `initialize`, assert `connected_never_seen`, no current-generation session count, and no Cursor `client_last_seen` alias, while a failed reconnect would leave its prior state intact. A subsequent Cursor `initialize` must change it to `connected_seen`. If 108-c merged first, verify the extracted `ClientConnectList` still shows the profile picker and mode choice, masked credential, management notice, and the administrator-only connect reads; run `connect-profile-fields.spec.ts` and `connect_profile_flags_test.go` to preserve the CLI's profile/lock/switchable/keyless flags.
diff --git a/specs/109-ux-navigation-consistency/research.md b/specs/109-ux-navigation-consistency/research.md
index 89a0eab89..3484e6f90 100644
--- a/specs/109-ux-navigation-consistency/research.md
+++ b/specs/109-ux-navigation-consistency/research.md
@@ -310,3 +310,23 @@ M13 live run: see the PR; one scratch instance, local builds.
 M14 docs are retargeted to published pages (the root `docs/cli-management-commands.md` is not published); `catalog add` takes `--env` only, so the secret toggle's CLI form is `upstream add --secret-env|--secret-header` and `contracts/cli.md` was corrected.
 M15 CI path filters: native and frontend workflows run when a Go-owned golden they read by path changes.
 M16 `NavBar.vue` deleted. M17 `CatalogTests` already reads `ref_names.json` by path. M18 release notes in the CHANGELOG. M19 task count recomputed mechanically.
+
+## D35 - demo-ux-fixes decisions (catalog, palette and Settings; 2026-10-02)
+
+A live demo of `main` at `b3191a059` found nine gaps. These are the five Spec 109 owns (Spec 108's four are D39). Each fix is test-first and lands on every surface that shows the thing.
+
+**A1 cached listing (finding 1).** FR-060 said "existing caches reused", but no listing cache existed: `SearchServers` refetched every call, and the demo's "browse already loaded" was the empty-query fetch (page 1 of the official registry is quick; its server-side `?search=` took 17 s). `internal/registries/listing_cache.go` is a new in-memory, process-wide cache. Key: source id plus servers URL, so editing a source's URL never serves the old listing. It is filled from every successful per-source fetch in `SearchAll` (browse and query), merged by entry id with the newest fetch first, at most 2,000 entries per source, served only when its last refresh is at most 24 h old, and pruned when the registry config reloads. It is not persisted: `internal/storage` is not touched, so the CLI's in-process path (no daemon) starts cold. This is documented, not a bug.
+
+**A2 when to fall back.** When a source's live fetch fails for any reason except a missing API key (that source never fetched, so nothing is cached for it) and a fresh listing exists. A 5xx gets the same fallback as a timeout. The source stays in `unavailable[]`, honestly, with `fallback: "cached_listing"` and `cached_at`; its hits carry `from_cache` (REST and MCP), `(cached)` in the CLI SOURCE column and a "From cached list" badge on the Web UI and macOS. The notice reads `<source>: live search unavailable (<reason>); showing matches from its cached list`.
+
+**A3 matcher.** Case-insensitive substring of the trimmed query in name, description or id. The live path's filter skips the id, but the official registry's own search matches names, so including the id is what lets "github" find `io.github.*`.
+
+**A4 ranking.** Cached hits go through the same `BuildCatalogHit` and `Rank` path; `Rank`'s keys are unchanged. One golden, `internal/registries/testdata/catalog_cached_fallback_order.json`, is written by the REST test and replayed by MCP, CLI, vitest and XCTest (parity row 14).
+
+**A5 nullable booleans (finding 2).** A `*bool` that is nil resolves to a concrete value in Go, but the Settings toggle read `!!undefined` and showed OFF while the posture chip said ON. `SettingField.defaultValue` now accepts a boolean, and `defaultFor(cfg, ctx)` covers the keys whose default depends on the config or the edition. `quarantine_enabled`, `telemetry.enabled`, `audit_log.enabled` (when the block exists) and `audit_log.compress` default to true. `audit_log.enabled` and `audit_log.stdout` for an absent block follow the edition: the server edition resolves enabled with a stdout sink, the personal edition leaves audit logging off (`EffectiveAuditLog`). The edition is read from `/status`; if it arrives after the config, `refreshEditionDefaults` re-resolves the untouched keys in both copies. Defaults are computed from an untouched snapshot first and applied second, otherwise materialising `audit_log.enabled` would create the block and flip `stdout`'s rule. They go into both `working` and `original`, so nothing reads dirty and an untouched key is never PATCHed. One fixture, `internal/config/testdata/settings_nullable_defaults.json`, is pinned to the Go resolvers by a Go test, which also reflects over `Config` and fails when a `*bool` path is in neither set, and to `fields.ts` by vitest. Deviation from the plan, found while building: the audit-log rows live in an Advanced accordion that both editions show (the plan said server-edition-only), so the personal edition had to read OFF for an absent block.
+
+**A6 Settings copy (finding 3).** The header said "Changes save instantly" while every section has a "Save changes" button and an unsaved-changes counter. The header now reads "Edit a section, then press Save changes to apply it. A badge marks fields that need a restart." and interpolates `SAVE_CHANGES_LABEL`, the constant the button renders. Scanner install and remove stay separate cards with their own buttons, and the header does not mention them.
+
+**A9 browse order (finding 6).** The empty-query Official section was the merged pool's first twelve official hits in source order. The official source paginates alphabetically by reverse-DNS id, so it filled with obscure `ac.inference.sh/...` entries and the curated reference servers never appeared. Official is now: the curated source's hits first (`CatalogHit.Curated`, set from the built-in reference protocol), then the remaining official hits round-robin across sources in registry-list order, each keeping its native order, capped at 12. It is still never popularity-ordered, so Spec 110's "Popular differs from Official" guarantee holds. Every surface renders Popular first when it has entries and Official after it; an empty section is not printed (the CLI used to print an empty table). Amends Spec 110 FR-005 and US1-3.
+
+**A10 palette (finding 5).** The palette gains Profiles, Clients and Agent tokens groups, each needle-only. One `Promise.allSettled` of `GET /profiles`, `GET /clients` (direct, unscoped: the `clients` store is page-scoped) and `GET /tokens` runs on the first non-empty input after opening, never on open, and is cached for that open. A failure gives an empty group. Links come from `frontend/src/utils/scopeLinks.ts` and carry no sticky params: a palette jump is a fresh navigation, and a sticky `profile` filter could hide the target row. A client opens `/clients?client=<id>` (or `?focus=<id>` without scope filters), an agent token `/clients?tab=tokens&token=<name>`, a profile its editor. Client credentials and revoked tokens are not listed. A tenant and the server edition get none of the three groups.
diff --git a/specs/109-ux-navigation-consistency/spec.md b/specs/109-ux-navigation-consistency/spec.md
index 82793b437..a2a4b045d 100644
--- a/specs/109-ux-navigation-consistency/spec.md
+++ b/specs/109-ux-navigation-consistency/spec.md
@@ -294,7 +294,7 @@ A first-time user connects a client and imports servers in the wizard. Import ro
 - **FR-051**: `/` MUST render Home: the attention list (FR-003), the topology from today's Overview panel with its actions, and a usage summary strip that moves above the topology when the list is empty. `/usage` is the full Usage page in Monitor. `/overview` redirects to `/`. 109-a ships the interim step: `/` defaults to the Overview panel.
 - **FR-052**: The header MUST contain, in order: ⌘K search (one field, no separate button), the Viewing-chip slot (empty until Spec 108), a status pill (online/total servers, tools, read-only routing-mode chip; click → `/servers`), the attention pill (hidden at 0; click → popover with the first 5 items + "See all" → Home), and "+ Add ▾" (Server → `/add-server`, Client → connect dialog, Token → `/clients?tab=tokens&create=1`, which opens the create dialog and strips `create`; Profile → `/profiles?create=1` once a `/profiles` route exists). ModeSwitcher and the endpoint dropdown leave the header (FR-031).
 - **FR-053**: Below 1100 px the header MUST collapse search to an icon button, both pills (status and attention) to icon + count, and "+ Add ▾" to `+`; at 390 px the header is one row holding exactly these collapsed controls plus the drawer toggle ([contracts/navigation-map.md](contracts/navigation-map.md)). At 900 px and 390 px nothing may be clipped and the page may not scroll horizontally (checked by `visual-a11y-sweep`).
-- **FR-054**: The ⌘K palette MUST search pages, servers, tools, settings fields and actions, keyboard-first (arrows, Enter, Esc), and Enter on free text opens `/tools?q=` (the default row "Search tools for …"; tool rows are debounced 150 ms with `limit=8`). Tools are queried only for a non-empty (trimmed) input — `GET /api/v1/index/search` answers an empty `q` with `400` — so the empty palette shows pages, actions and servers only (research D16).
+- **FR-054**: The ⌘K palette MUST search pages, servers, tools, profiles, clients, agent tokens, settings fields and actions, keyboard-first (arrows, Enter, Esc), and Enter on free text opens `/tools?q=` (the default row "Search tools for …"; tool rows are debounced 150 ms with `limit=8`). Tools are queried only for a non-empty (trimmed) input — `GET /api/v1/index/search` answers an empty `q` with `400` — so the empty palette shows pages, actions and servers only (research D16). Profiles, clients and agent tokens are needle-only like settings: one `GET /profiles`, `GET /clients` and `GET /tokens` run on the first non-empty input after opening, never on open, and a failed one hides only its own group (research D35 A10; a tenant and the server edition get none of the three).
 - **FR-055**: Stacking MUST follow one z-index scale defined in one place (header < sidebar < dropdown < modal < toast). Modals render in the top layer, so no sidebar element paints over a modal (H4). This covers **every** `<dialog class="modal">` that exists when 109-a merges, named explicitly — including the three `:open`-bound dialogs in `views/Repositories.vue` (required-input, add-source and delete-registry), which live until 109-j retires the page — not only Add Server and Connect.
 - **FR-056**: The settings page MUST be named "Settings" in the sidebar, route title, heading and document title. Its tabs MUST use the app's line-icon set, and the "Server Edition" tab MUST show only when `/status` reports `edition: server`.
 - **FR-057**: Until Spec 108 removes it, the header ProfileSwitcher MUST be hidden when no profiles exist (H2 interim). The "Create profile" entry point is Spec 108's. Header profile population starts after confirmed core-capable authentication; successful personal and administrator startup still populate it.
@@ -302,7 +302,7 @@ A first-time user connects a client and imports servers in the wizard. Import ro
 
 **G. Catalog and adding servers (N3, C1, C2, S7, X4)**
 
-- **FR-060**: `GET /api/v1/catalog/search?q=&source=&tag=&limit=` MUST fan out to every enabled catalog source in parallel (timeout 5 s per source, existing caches reused), merge, de-duplicate by (source, id), rank with one pure function (official source > verified publisher > popularity > text relevance > title), and return `unavailable[]` for sources that failed. An empty `q` returns `official` and `popular` sections.
+- **FR-060**: `GET /api/v1/catalog/search?q=&source=&tag=&limit=` MUST fan out to every enabled catalog source in parallel (timeout 5 s per source; a source whose live fetch fails is answered from its per-source listing cache, marked `from_cache`, and stays in `unavailable[]` with `fallback` and `cached_at`, research D35), merge, de-duplicate by (source, id), rank with one pure function (official source > verified publisher > popularity > text relevance > title), and return `unavailable[]` for sources that failed. An empty `q` returns `official` and `popular` sections; every surface renders Popular first when it has entries, then Official (curated servers first, research D35 A9).
 - **FR-061**: Catalog results MUST carry `title`, `id`, `publisher`, `verified`, `official`, `popularity` (stars or installs when provided), `source` and the Spec 070 add fields. Every surface shows the title first and the id as secondary text.
 - **FR-062**: Adding a server MUST start at `/add-server` (outside the `/servers/:serverName` path space, so no server name — `add` included — can be shadowed by a static route; no server name is reserved) with the tabs Catalog (default) · Paste · Import · Manual, selected by `?tab=catalog|paste|import|manual` (FR-016). `?source=` on that page keeps its contract meaning (a catalog source id that narrows the Catalog tab, mapped to REST `source`). `/repositories` redirects to `/add-server?tab=catalog`, and catalog-source management moves to Settings → Catalog sources. macOS: the Add Server sheet gets the same four tabs and the "Registries" sidebar item is removed.
 - **FR-063**: The add action MUST be labelled "Add to MCPProxy", and after success "Added ✓ · Open", on Web and macOS. The CLI prints "Added <name> to MCPProxy (quarantined for review)".
diff --git a/specs/109-ux-navigation-consistency/tasks.md b/specs/109-ux-navigation-consistency/tasks.md
index ca4cf0fa4..6adefae5f 100644
--- a/specs/109-ux-navigation-consistency/tasks.md
+++ b/specs/109-ux-navigation-consistency/tasks.md
@@ -362,6 +362,17 @@ The parameters, link-map rows, sidebar entry and header slot are already wired (
 - [x] T158 [US6] #1437 item 1: `limitServersToProfile` holds a pinned caller to its own pin (tool counts and server rows agree with `GET /tools`); administrator output unchanged
 - [x] T159 [US6] #1437 item 5: `POST /tokens` answers a revoked holder with `A revoked token named "x" still holds this name for activity history; choose another name`
 
+## Phase 15: PR demo-ux-fixes — gaps found in the live Web UI demo (2026-10-02)
+
+Not new requirements: nine findings from a live demo of `main` at `b3191a059`, fixed test-first on every surface that shows them. Spec 109 owns the catalog, palette and Settings findings; Spec 108's T148–T152 own the profile-shaped ones. Decisions: research D35.
+
+- [x] T160 [P] #1 catalog cached-listing fallback (FR-060): a per-source in-memory listing cache (`internal/registries/listing_cache.go`) fills from every successful fetch; a source whose live fetch fails serves its cached listing, filtered by name, description or id (`internal/registries/catalog_listing_cache_test.go`, 24 h limit, 2,000 entries per source, pruned on config load). The source stays in `unavailable[]` with `fallback: "cached_listing"` and `cached_at`, hits carry `from_cache`. One golden (`internal/registries/testdata/catalog_cached_fallback_order.json`) written by `internal/httpapi/spec109_catalog_cached_fallback_test.go` and replayed by `internal/server/spec109_catalog_cached_fallback_test.go`, `cmd/mcpproxy/catalog_cached_fallback_test.go` (table `(cached)` and the fallback sentence), `frontend/tests/unit/catalog-cached-fallback.spec.ts` and `CatalogOrderParityTests.swift` ("From cached list")
+- [x] T161 [P] #2 nullable booleans render their effective value: `defaultValue` widens to booleans and a `defaultFor` hook handles the edition- and block-dependent `audit_log.*` keys in `frontend/src/views/settings/fields.ts`; one fixture (`internal/config/testdata/settings_nullable_defaults.json`) pinned to the Go resolvers by `internal/config/settings_nullable_defaults_test.go` (every `*bool` path under `Config` must be classified) and to the form by `frontend/tests/unit/settings-nullable-defaults.spec.ts`
+- [x] T162 [P] #3 the Settings header names the button it describes (`SAVE_CHANGES_LABEL`): `frontend/tests/unit/settings-header-copy.spec.ts`
+- [x] T163 [P] #5 the ⌘K palette finds profiles, clients and agent tokens (FR-054), needle-only, loaded once per open on the first non-empty input, links built by `frontend/src/utils/scopeLinks.ts`: `frontend/tests/unit/command-palette-directory.spec.ts`
+- [x] T164 [P] #6 useful browse order (FR-060; amends Spec 110 FR-005): Official is curated-first, then round-robin across sources, never popularity-ordered (`internal/registries/catalog_browse_order_test.go`); Popular renders before Official when non-empty on the Web UI (`frontend/tests/unit/catalog-browse-order.spec.ts`), macOS (`CatalogTests.swift`) and the CLI table (`cmd/mcpproxy/catalog_cmd_test.go`)
+- [x] T165 [P] Docs and bookkeeping for T160–T164: `docs/api/rest-api.md`, `docs/cli/catalog-commands.md`, `specs/109-ux-navigation-consistency/parity-matrix.json`, `quickstart.md` recipe `demo-ux-fixes`, research D35
+
 ---
 
 ## Dependencies & Execution Order
@@ -410,4 +421,4 @@ Spec 108-f, 108-i, 108-j, 108-k + 109-i ──> 109-l
 
 ## Task Count
 
-195 tasks (the mechanical count of `- [ ] T…` lines under the phase headings; 186 before 109-m); see the checklist above for phase totals and completion state (109-l added T152a, T154a, T157, T158, T159; 109-m added T144a, T145a, T145b, T147a, T148c, T149a–T149d; codex round 4 added T078c, T124a; codex round 3 added T011a, T076a, T101a, T125a, T148a, T148b; codex round 1 added T069a, T077b, T078b, and the threshold-timer test inside T053; Spec 108's duplicated scope-filter and Clients-shell tasks were merged into T111/T116/T117/T122/T131).
+201 tasks (the mechanical count of `- [ ] T…` lines under the phase headings; 195 before the demo-ux-fixes PR, 186 before 109-m; demo-ux-fixes added T160–T165); see the checklist above for phase totals and completion state (109-l added T152a, T154a, T157, T158, T159; 109-m added T144a, T145a, T145b, T147a, T148c, T149a–T149d; codex round 4 added T078c, T124a; codex round 3 added T011a, T076a, T101a, T125a, T148a, T148b; codex round 1 added T069a, T077b, T078b, and the threshold-timer test inside T053; Spec 108's duplicated scope-filter and Clients-shell tasks were merged into T111/T116/T117/T122/T131).
diff --git a/specs/110-catalog-popularity/spec.md b/specs/110-catalog-popularity/spec.md
index 60b120e22..cfe350a99 100644
--- a/specs/110-catalog-popularity/spec.md
+++ b/specs/110-catalog-popularity/spec.md
@@ -41,7 +41,7 @@ A user opens the Catalog with no query and sees an **Official** section (what th
 
 1. **Given** real popularity for at least one hit, **When** q is empty, **Then** Popular contains only hits with a known signal, ordered stars desc, then installs desc, then `Rank`. It is drawn from the full merged pool before `limit` truncation, has at most one hit per GitHub repository, and is capped at 12.
 2. **Given** no popularity is known for any hit (cold cache, GitHub unreachable, no Docker source), **When** q is empty, **Then** Popular is **empty**, not padded with zero-popularity hits, and each surface hides the empty section (Web UI and macOS already do).
-3. **Given** q is empty, **Then** Official lists official-source hits in **source order**: registry list order, then each source's native order. It does not re-rank by popularity and is capped at 12.
+3. **Given** q is empty, **Then** Official lists the curated reference servers first, then the remaining official-source hits round-robin across sources in registry-list order, each source keeping its native order. It does not re-rank by popularity and is capped at 12. (Amended 2026-10-02 by Spec 109 demo-ux-fixes: it used to be plain source order, which filled with the official source's alphabetically first entries.)
 
 ### User Story 2 — Popularity breaks ties in search results (Priority: P1)
 
@@ -71,7 +71,7 @@ The Web UI result row, the macOS catalog row and the CLI `catalog search` table
 - **FR-002 (BuildCatalogHit)**: `BuildCatalogHit` MUST copy `entry.Popularity` into the hit and fill in `Stars` from the installed provider's **cache only**, with no network call. It stays synchronous and never blocks.
 - **FR-003 (repo key)**: A pure `GitHubRepoKey(sourceCodeURL) (key string, ok bool)` MUST normalize the edge-case forms above. Owner: `^[A-Za-z0-9](?:[A-Za-z0-9-]{0,38})$`. Repo: `^[A-Za-z0-9._-]{1,100}$`, excluding `.` and `..`. Any other input returns `ok=false`.
 - **FR-004 (comparison)**: `Rank` and the Popular ordering MUST compare popularity as `(stars desc, installs desc)`, with missing = 0. Stars and installs are never added together or converted into each other.
-- **FR-005 (sections)**: `buildSections` MUST take the full merged, de-duplicated, source-filtered pool **before** `limit` truncation. For an empty q, each source is fanned out with the per-source maximum (50) rather than the caller's `limit`, so the pool is as wide as each source will give. Official = official hits in merge (source-native) order, at most 12. This order MUST come from a copy of the pool taken **before** any `Rank` sort. With an empty q and all-official defaults, rank order *is* popularity order, so building Official from the ranked pool would bring back the bug this spec fixes. Popular = hits with `stars>0 ∨ installs>0`, sorted per FR-004 and then `Rank`, at most one per GitHub repo key, at most 12. This amends Spec 109 FR-060 and data-model §9. *Known limitation*: the Docker source fetches a single page of `hub.docker.com/v2/repositories/mcp/`, which is 10 images by default. Popular therefore ranks only within what each source returns, and paginating Docker is a follow-up.
+- **FR-005 (sections)**: `buildSections` MUST take the full merged, de-duplicated, source-filtered pool **before** `limit` truncation. For an empty q, each source is fanned out with the per-source maximum (50) rather than the caller's `limit`, so the pool is as wide as each source will give. Official = the official hits, curated reference servers first and the rest round-robin across sources in registry-list order (each in its native order), at most 12 (amended 2026-10-02, Spec 109 research D35 A9; it was plain merge order). This order MUST come from a copy of the pool taken **before** any `Rank` sort. With an empty q and all-official defaults, rank order *is* popularity order, so building Official from the ranked pool would bring back the bug this spec fixes. Popular = hits with `stars>0 ∨ installs>0`, sorted per FR-004 and then `Rank`, at most one per GitHub repo key, at most 12. This amends Spec 109 FR-060 and data-model §9. *Known limitation*: the Docker source fetches a single page of `hub.docker.com/v2/repositories/mcp/`, which is 10 images by default. Popular therefore ranks only within what each source returns, and paginating Docker is a follow-up.
 - **FR-006 (fetch)**: The GitHub fetcher MUST send `GET https://api.github.com/repos/{owner}/{repo}` through the SSRF-hardened registry client. The host is a compile-time constant, overridable only by a test hook. The request carries `Accept: application/vnd.github+json`, `X-GitHub-Api-Version: 2022-11-28`, the versioned mcpproxy User-Agent, and `If-None-Match` when an ETag is cached. The response body is capped at 1 MiB and each request has a 10 s timeout. Only `stargazers_count` and `ETag` are read. The fetcher sends its own request on `sharedRegistryClient()`, with a per-request `context.WithTimeout(10s)` because the client's own timeout is 45 s. It MUST NOT use `registryGet`: that pins to `reg.ServersURL`, forces its own headers, and retries 429/5xx three times, which would burn budget against a rate-limited API. There are no retries; the breaker (FR-009) is the only backoff.
 - **FR-007 (never block the search)**: `SearchAll` MUST resolve popularity *after* the per-source fan-out. Cached values come back immediately. Misses are queued for a background fetch, and `SearchAll` waits for them for at most `SearchOptions.PopularityWait`: 0 (unset) means the default of 800 ms, a negative value disables the wait, and the wait never outlives `ctx`. Misses still outstanding keep being fetched after `SearchAll` returns, so the next search has them. The caller's ctx bounds **only the wait**. Workers fetch under a context owned by the provider, created at construction and cancelled by `Close()`. `Resolve` returns immediately, without waiting, when the provider is paused (breaker), its budget is used up, or none of the requested keys were admitted to the queue. It waits only on the keys it admitted. Popularity failures never add entries to `unavailable[]`.
 - **FR-008 (cache)**: Each entry `{stars, etag, fetched_at, status}` MUST be kept in memory and persisted to the bbolt bucket `catalog_popularity` when a store is attached. The entry is fresh for 24 h after a 200 or 304, 24 h after a 404 or 451 (negative), and 1 h after any other error. Expired entries are still served (stale-while-revalidate) and queued for refresh. A failed refresh (a transport error or any status except 200/304/404/451) MUST keep the last-known `stars`/`etag` and only move the revalidate time forward. Stars are cleared only on a definitive 404/451. `Lookup` MUST tell apart *fresh*, *stale*, *negative* (fresh 404/451) and *absent*. `Resolve` enqueues only *stale* and *absent* keys, so a dead repo is not fetched again until its negative TTL runs out. The store is capped at 5,000 keys, evicting the oldest `fetched_at` first.
@@ -93,3 +93,7 @@ The Web UI result row, the macOS catalog row and the CLI `catalog search` table
 - Stars are an adequate proxy for "popular" in the MCP ecosystem. The GitHub star count is the signal most widely used by MCP directories (Glama, PulseMCP, mcp.so).
 - 50 requests per hour covers a default catalog (~60–120 distinct repos) within about 2 hours of the first run, and the persisted cache means a restart costs nothing. Users who want it faster can set `MCPPROXY_GITHUB_TOKEN`.
 - Repository slugs sent to api.github.com are public catalog data, not user data. The kill switch exists for air-gapped or offline setups.
+
+## Amendments
+
+- 2026-10-02, Spec 109 demo-ux-fixes (T164): FR-005 and US1 scenario 3 replace "source order" with curated-first, then round-robin across sources. Official is still never popularity-ordered, so Popular still differs from it. Every surface renders Popular before Official when Popular is non-empty. Rationale: Spec 109 research D35 A9.