The .permissions client-local action carried the raw session guid,
but the toggle write-path and button-label read-path both key
permissions off the session reference (stableID). This keyspace split
meant the label never reflected a changed permission and re-clicking
appeared to do nothing. Publish the action with the reference so all
three paths share one key.