Read-only. Editing lands once write authorization is settled.
Held in sessionStorage for this tab only — never localStorage, never a cookie.